codiedev 0.10.0-beta.4 → 0.10.0-beta.5

package/dist/codieUsage.js

@@ -1,14 +1,7 @@
 "use strict";
-// The Codie harness status line.
-//
-// The gateway already knows what a developer has spent, what caps them, and
-// what they have in flight. Nothing ever asked it. This module asks, and turns
-// the answer into one line the harness can paint next to the prompt.
-//
-// Every failure here is silent by design: a status poll must never interrupt,
-// delay, or break a coding session. No snapshot means no line.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatUsageLine = formatUsageLine;
+exports.usageTone = usageTone;
 exports.formatSessionCostLine = formatSessionCostLine;
 exports.fetchCodieUsage = fetchCodieUsage;
 const USAGE_TIMEOUT_MS = 4000;
@@ -18,8 +11,6 @@ function cleanBaseUrl(value) {
 function money(value) {
     return `$${value.toFixed(2)}`;
 }
-/** Budgets are set in whole dollars far more often than not, so $150 reads
- * better than $150.00 next to a spend figure that does need its cents. */
 function budgetMoney(value) {
     return Number.isInteger(value) ? `$${value}` : money(value);
 }
@@ -27,16 +18,10 @@ function percent(spent, budget) {
     if (!(budget > 0))
         return null;
     const share = (spent / budget) * 100;
-    // A first request against a large budget rounds to 0%, which reads as
-    // "nothing spent". Say "under one percent" instead.
     if (share > 0 && share < 1)
         return "<1%";
     return `${Math.round(share)}%`;
 }
-/**
- * One line: who is spending, how much, against what, and what is running.
- * Returns "" when there is nothing honest to say.
- */
 function formatUsageLine(usage) {
     if (!usage || !usage.enabled)
         return "";
@@ -44,61 +29,78 @@ function formatUsageLine(usage) {
     const segments = [];
     if (usage.user?.name)
         segments.push(usage.user.name);
-    // The developer's own month-to-date spend is always the headline. Only the
-    // budget that actually caps them earns a percentage next to it.
     if (typeof budget.userBudgetUsd === "number") {
         segments.push(`${money(budget.userSpentUsd)} / ${budgetMoney(budget.userBudgetUsd)}`);
         const share = percent(budget.userSpentUsd, budget.userBudgetUsd);
         if (share)
             segments.push(share);
+        if (poolBindsFirst(budget) && typeof budget.companyBudgetUsd === "number"
+            && budget.companyBudgetUsd > 0
+            && budget.companySpentUsd / budget.companyBudgetUsd >= 0.75) {
+            const share = percent(budget.companySpentUsd, budget.companyBudgetUsd);
+            if (share)
+                segments.push(`team pool ${share}`);
+        }
     }
     else {
         segments.push(money(budget.userSpentUsd));
         if (typeof budget.companyBudgetUsd === "number") {
             const share = percent(budget.companySpentUsd, budget.companyBudgetUsd);
-            // Labelled, because a team percentage beside a personal dollar figure
-            // otherwise reads as the developer's own share.
             if (share)
                 segments.push(`team ${share}`);
         }
     }
+    if (typeof budget.companyBudgetUsd === "number" && budget.companyBudgetUsd > 0
+        && budget.companySpentUsd >= budget.companyBudgetUsd) {
+        segments.push("team pool used up");
+    }
     if (inFlight.requests > 0)
         segments.push(`${inFlight.requests} in flight`);
-    // Stale holds cap a budget while doing no work. Naming them is the
-    // difference between "I am blocked" and "I am blocked by nothing".
     if (inFlight.staleHeldUsd > 0)
         segments.push(`${money(inFlight.staleHeldUsd)} held stale`);
     return segments.join(" · ");
 }
+function poolBindsFirst(budget) {
+    if (typeof budget.companyBudgetUsd !== "number" || typeof budget.userBudgetUsd !== "number")
+        return false;
+    const poolLeft = Math.max(0, budget.companyBudgetUsd - budget.companySpentUsd);
+    const userLeft = Math.max(0, budget.userBudgetUsd - budget.userSpentUsd);
+    return budget.userBudgetUsd > 0 && poolLeft < userLeft;
+}
+function usageTone(usage) {
+    if (!usage || !usage.enabled)
+        return "normal";
+    const { budget } = usage;
+    const ratios = [];
+    if (typeof budget.userBudgetUsd === "number" && budget.userBudgetUsd > 0) {
+        ratios.push(budget.userSpentUsd / budget.userBudgetUsd);
+    }
+    if (typeof budget.companyBudgetUsd === "number" && budget.companyBudgetUsd > 0
+        && (typeof budget.userBudgetUsd !== "number" || poolBindsFirst(budget))) {
+        ratios.push(budget.companySpentUsd / budget.companyBudgetUsd);
+    }
+    const worst = ratios.length ? Math.max(...ratios) : 0;
+    if (worst >= 0.9)
+        return "critical";
+    if (worst >= 0.75)
+        return "warn";
+    return "normal";
+}
 function tokens(total) {
-    // Rounded by arithmetic, not toFixed: 2.55 is not exactly representable, so
-    // toFixed(1) rounds it down and the same count can read two ways.
     if (total >= 1_000_000)
         return `${Math.round(total / 100_000) / 10}M`;
     if (total >= 1_000)
         return `${Math.round(total / 1_000)}k`;
     return String(total);
 }
-/**
- * What this session just cost. Returns "" when the session billed nothing,
- * because a developer who spent nothing does not need to be told a number.
- */
 function formatSessionCostLine(usage) {
     const since = readSince(usage?.since);
     if (!since || since.requests <= 0)
         return "";
-    // A real charge that rounds to $0.00 reads as free. Say it is under a cent
-    // instead — the month-to-date figure is where it really lands.
     const cost = since.costUsd > 0 && since.costUsd < 0.005 ? "<$0.01" : money(since.costUsd);
     const requests = `${since.requests} ${since.requests === 1 ? "request" : "requests"}`;
     return `This session: ${cost} · ${requests} · ${tokens(since.promptTokens + since.completionTokens)} tokens`;
 }
-/**
- * A usage window is reported only when every field of it is a real number.
- * A partial block is worse than none: it reads as a cheap session, and the
- * arithmetic on a missing field throws out of a call site whose whole
- * contract is that it cannot break the run that just finished.
- */
 function readSince(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return undefined;
@@ -127,11 +129,6 @@ function readUser(value) {
         role: typeof role === "string" ? role : "",
     };
 }
-/**
- * Read the developer's budget snapshot. Returns null on any refusal, network
- * failure, timeout, or malformed answer — a status poll is never worth an
- * error in front of a developer who asked for none.
- */
 async function fetchCodieUsage({ baseUrl, key, sinceMs, fetchImpl = fetch, }) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), USAGE_TIMEOUT_MS);

package/dist/commands/ask.js

@@ -3,9 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAsk = runAsk;
 const shared_1 = require("./shared");
 function parseArgs(args) {
-    // Everything after the command, joined back into a question string. Allows
-    // both quoted and unquoted forms: `codiedev ask "why pg-bouncer?"` or
-    // `codiedev ask why did we drop pg-bouncer`.
     const question = args
         .filter((a) => !a.startsWith("--"))
         .join(" ")

package/dist/commands/capture.js

@@ -123,7 +123,6 @@ async function runCaptureCommand(args, depsOverride = {}) {
         return;
     }
     if (subcommand === "ignored") {
-        // `ignored` lists everything; `ignored <path>` answers "is this ignored?".
         const query = args.slice(1).join(" ").trim();
         if (query) {
             reportCheck(query, current, deps);
@@ -139,7 +138,6 @@ async function runCaptureCommand(args, depsOverride = {}) {
             deps.log(`  ${value}`);
         return;
     }
-    // Back-compat: the earlier `codiedev capture check <path>` form.
     if (subcommand === "check") {
         reportCheck(requirePath(args), current, deps);
         return;

package/dist/commands/createTicket.js

@@ -100,7 +100,6 @@ async function runCreateTicket(args) {
         await runBare(config, parsed.prompt);
         return;
     }
-    // submit mode
     if (!parsed.submitSource) {
         console.error("--submit requires a path or '-' for stdin");
         process.exit(1);
@@ -114,7 +113,6 @@ async function runCreateTicket(args) {
         console.error(`Failed to read plan: ${err.message}`);
         process.exit(1);
     }
-    // Translate fullNames → IDs before submitting
     let parsedPlan;
     try {
         parsedPlan = JSON.parse(raw);
@@ -141,14 +139,6 @@ async function runCreateTicket(args) {
     }
     await runSubmit(config, JSON.stringify(parsedPlan));
 }
-/**
- * Bare-mode entrypoint. Fetches the protocol body from the backend so we can
- * iterate on it without shipping a new CLI, substitutes the user's prompt,
- * and writes the result to stdout for the agent to follow. Hard-errors on
- * fetch failure rather than falling back to a stale local copy — the whole
- * point of moving the protocol server-side is that the freshest version is
- * the only version.
- */
 async function runBare(config, prompt) {
     let res;
     try {

package/dist/commands/doctor.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.configDirInUseCheck = configDirInUseCheck;
 exports.runDoctor = runDoctor;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -47,12 +48,27 @@ const captureReadiness_1 = require("../captureReadiness");
 const captureLog_1 = require("../captureLog");
 const securityDoctor_1 = require("../securityDoctor");
 const securityFeature_1 = require("../securityFeature");
-const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
-const CLAUDE_INSTRUCTIONS_PATH = path.join(os.homedir(), ".claude", "CLAUDE.md");
-const CODEX_HOOKS_PATH = path.join(os.homedir(), ".codex", "hooks.json");
-const CODEX_INSTRUCTIONS_PATH = path.join(os.homedir(), ".codex", "AGENTS.md");
+const copilotInstallation_1 = require("../copilotInstallation");
+const harnessDirs_1 = require("../harnessDirs");
+const CLAUDE_DIR = (0, harnessDirs_1.claudeConfigDir)();
+const CLAUDE_SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json");
+const CLAUDE_INSTRUCTIONS_PATH = path.join(CLAUDE_DIR, "CLAUDE.md");
+const CODEX_DIR = (0, harnessDirs_1.codexHome)();
+const CODEX_HOOKS_PATH = path.join(CODEX_DIR, "hooks.json");
+const CODEX_INSTRUCTIONS_PATH = path.join(CODEX_DIR, "AGENTS.md");
 const CURSOR_HOOKS_PATH = path.join(os.homedir(), ".cursor", "hooks.json");
 const CURSOR_INSTRUCTIONS_PATH = path.join(os.homedir(), ".cursor", "rules", "codiedev.mdc");
+function configDirInUseCheck(agent, dir, inUse, envVar) {
+    return {
+        name: `${agent} reads this config dir`,
+        status: inUse ? "pass" : "warn",
+        detail: inUse
+            ? (0, harnessDirs_1.displayPath)(dir)
+            : `no ${agent} activity in ${(0, harnessDirs_1.displayPath)(dir)} — if you've run ${agent} here, it reads its config from ` +
+                `somewhere else, so the hooks below never fire. Set ${envVar} to that dir (or run as the user that runs ` +
+                `${agent}) and re-run \`codiedev connect\``,
+    };
+}
 function symbol(status) {
     if (status === "pass")
         return "✓";
@@ -61,17 +77,11 @@ function symbol(status) {
     return "✗";
 }
 function codexInstalled() {
-    return fs.existsSync(path.join(os.homedir(), ".codex"));
+    return fs.existsSync(CODEX_DIR);
 }
 function cursorInstalled() {
     return fs.existsSync(path.join(os.homedir(), ".cursor"));
 }
-// `isCodiedevHookCommand` lives in ../detection alongside detectClaudeCode
-// so utils.ts and doctor.ts share one definition (they used to drift —
-// each had its own copy).
-// Cursor's hooks.json schema is { hooks: { sessionEnd: [{ command, ... }] } }
-// — flat array of objects with `command`, not the Claude/Codex nested
-// `{ hooks: [{ command }] }` wrapper.
 function hasCursorHook() {
     try {
         if (!fs.existsSync(CURSOR_HOOKS_PATH))
@@ -140,7 +150,6 @@ async function runDoctor(_args) {
     const checks = [];
     console.log("\nCodiedev doctor — checking your setup…\n");
     await (0, upgradeNudge_1.maybePrintUpgradeNudge)();
-    // 1. Config file
     const config = (0, utils_1.readConfig)();
     if (!config) {
         checks.push({
@@ -156,19 +165,12 @@ async function runDoctor(_args) {
         status: "pass",
         detail: `connected to ${config.companyName}`,
     });
-    // 2. Token still valid + backend reachable (re-validate). The detail names
-    // the backend host so users (and their IT) can confirm which domain the CLI
-    // talks to — the same host capture uploads use, so this check exercises the
-    // exact TLS path a corporate proxy would intercept.
     let backendHost = "the capture host";
     try {
         backendHost = new URL(config.backendUrl).host;
     }
     catch {
-        // malformed backendUrl in config — keep the generic placeholder
     }
-    // Live tracked-repo list fetched from validateToken below. Null until (and
-    // unless) the backend answers; the checks fall back to `config.repos`.
     let liveRepos = null;
     try {
         const res = await fetch(`${config.backendUrl}/api/cli/validateToken`, {
@@ -185,20 +187,13 @@ async function runDoctor(_args) {
                 status: "pass",
                 detail: backendHost,
             });
-            // validateToken returns the company's CURRENT tracked repos. Capture
-            // them: the repo-resolution checks below must reflect what the SERVER
-            // will resolve at capture time (repoResolver.ts resolves against the
-            // live list), not the possibly-stale `config.repos` frozen at the last
-            // `connect`. A repo linked in the portal after that connect otherwise
-            // reports a false "isn't a tracked repo — link it in the portal" here
-            // even though sessions/MRs for it attribute fine server-side.
             try {
                 const data = (await res.json());
                 if (Array.isArray(data.repos))
                     liveRepos = data.repos;
             }
             catch {
-                liveRepos = null; // malformed body → fall back to the cached list
+                liveRepos = null;
             }
         }
         else {
@@ -210,9 +205,6 @@ async function runDoctor(_args) {
         }
     }
     catch (err) {
-        // fetch buries the real TLS/socket error in .cause ("fetch failed" alone
-        // is undiagnosable); unwrap it and, when it's an SSL-inspection signature,
-        // say what actually fixes it.
         const desc = (0, captureReadiness_1.describeFetchError)(err);
         const tlsHint = (0, captureReadiness_1.tlsInterceptionHint)(desc, backendHost);
         checks.push({
@@ -221,7 +213,6 @@ async function runDoctor(_args) {
             detail: tlsHint ? `${desc} — ${tlsHint}` : `${desc} (host: ${backendHost})`,
         });
     }
-    // 3. Authenticated endpoint smoke test (inbox query)
     try {
         await (0, shared_1.apiRequest)("GET", "/api/cli/inbox", {
             config,
@@ -239,38 +230,16 @@ async function runDoctor(_args) {
             detail: err.message,
         });
     }
-    // 4. Tracked repos. Prefer the live list from validateToken over the cache:
-    // a repo linked after the last `connect` is tracked server-side but absent
-    // from `config.repos`, and resolving against the stale cache is exactly what
-    // produced the false "isn't a tracked repo — link it in the portal" warning.
-    // Treat an EMPTY live list as "no usable live data", NOT an authoritative
-    // zero: a transient permission glitch / backend hiccup can return `repos: []`,
-    // and both driving the checks from it AND healing the cache to empty would be
-    // wrong — the write would durably break every offline doctor run (and the
-    // capture hook's providedRepoId) until the next successful connect. So when
-    // live is empty, fall back to the cache and skip the write, exactly like
-    // backend-unreachable. A genuinely repo-less company also has an empty cache,
-    // so it still reports "0 repos" correctly.
     const trackedRepos = liveRepos !== null && liveRepos.length > 0 ? liveRepos : (config.repos ?? []);
-    // Detect drift by CONTENT, not count: a same-size swap (one repo removed +
-    // another added between connects) or a repo whose path/URL changed while its
-    // id stayed stable (GitLab move/rename — exactly the SONIFI migration case)
-    // both leave the count unchanged. A length-only check would skip the heal and
-    // leave the capture hook's cache — and its advisory providedRepoId — stale.
     const canonRepos = (rs) => JSON.stringify([...rs].map((r) => [r.repoId, r.url, r.fullName]).sort());
     const cacheRefreshed = liveRepos !== null &&
         liveRepos.length > 0 &&
         canonRepos(liveRepos) !== canonRepos(config.repos ?? []);
-    // Heal the on-disk cache so the capture hook (which reads `config.repos` for
-    // the advisory providedRepoId) stops trailing the portal too. Best-effort:
-    // doctor must never fail because the config couldn't be rewritten.
     if (cacheRefreshed && liveRepos) {
         try {
             (0, utils_1.writeConfig)({ ...config, repos: liveRepos, lastSynced: new Date().toISOString() });
         }
         catch {
-            // read-only home / permission issue — the in-memory list still drives
-            // the checks below; the user just re-syncs on the next `connect`.
         }
     }
     const repoCount = trackedRepos.length;
@@ -281,11 +250,6 @@ async function runDoctor(_args) {
             ? `${repoCount} repo${repoCount === 1 ? "" : "s"}${cacheRefreshed ? " (refreshed from portal)" : ""}`
             : "0 — link repos in the portal so sessions get captured",
     });
-    // 4b. Capture readiness — the part that actually decides whether a session
-    // lands. doctor used to verify only that the hook was *installed*; these
-    // checks answer "from this directory, would a session capture, and did my
-    // last one?" — the blind spot behind lean-container / submodule / no-remote
-    // zeros.
     const cwd = process.cwd();
     const readiness = (0, captureReadiness_1.assessCaptureReadiness)(cwd, trackedRepos, {
         exec: (cmd, dir) => (0, child_process_1.execSync)(cmd, { cwd: dir, stdio: ["pipe", "pipe", "pipe"] }).toString(),
@@ -294,11 +258,6 @@ async function runDoctor(_args) {
         getBranch: utils_1.getGitBranch,
         getHeadSha: utils_1.getGitHeadSha,
     });
-    // Workspace-root mode: the cwd isn't a repo itself, but git repos sit
-    // directly under it (one `.devcontainer/` at a parent folder of several
-    // cloned repos). Capture tags the sub-repo a session edits, so report that
-    // instead of flatly warning "not a work tree / no remote" — the exact output
-    // that made working workspace-root setups read as broken.
     const workspaceScan = readiness.gitOnPath && !readiness.insideWorkTree
         ? (0, captureReadiness_1.assessWorkspaceRepos)(cwd, trackedRepos, {
             listChildDirs: (dir) => fs
@@ -349,9 +308,6 @@ async function runDoctor(_args) {
                 ? "branch/sha resolve from the sub-repo each session writes to"
                 : "no branch/sha resolved — session→merge attribution will be weaker",
     });
-    // 4c. The payoff: did the last session actually land? Ask the server for
-    // portal truth (does the row exist for this user?), falling back to the local
-    // 2xx breadcrumb if the endpoint is unreachable or predates this CLI/backend.
     const localMarker = (0, utils_1.readLastCapture)();
     let server = null;
     try {
@@ -372,7 +328,7 @@ async function runDoctor(_args) {
             server = (await res.json());
     }
     catch {
-        server = null; // unreachable / old backend → fall back to the local marker
+        server = null;
     }
     const lastCapture = (0, captureReadiness_1.summarizeServerCapture)(server, localMarker, Date.now());
     checks.push({
@@ -380,7 +336,6 @@ async function runDoctor(_args) {
         status: lastCapture.status,
         detail: lastCapture.detail,
     });
-    // 4d. Capture-log activity: did recent uploads succeed? Are there pending jobs?
     const logTail = (0, captureLog_1.readCaptureLogTail)(40);
     let pendingJobCount = 0;
     try {
@@ -397,25 +352,25 @@ async function runDoctor(_args) {
         status: captureActivity.status,
         detail: captureActivity.detail,
     });
-    // 5. Claude Code setup (if present)
     if ((0, utils_1.claudeCodeInstalled)()) {
         checks.push({
             name: "Claude Code detected",
             status: "pass",
-            detail: "~/.claude",
+            detail: (0, harnessDirs_1.displayPath)(CLAUDE_DIR),
         });
+        checks.push(configDirInUseCheck("Claude Code", CLAUDE_DIR, (0, harnessDirs_1.claudeConfigDirInUse)(CLAUDE_DIR), "CLAUDE_CONFIG_DIR"));
         checks.push({
             name: "Claude Code SessionEnd hook",
             status: hasCodiedevHook(CLAUDE_SETTINGS_PATH, "SessionEnd") ? "pass" : "fail",
             detail: hasCodiedevHook(CLAUDE_SETTINGS_PATH, "SessionEnd")
-                ? "~/.claude/settings.json"
+                ? (0, harnessDirs_1.displayPath)(CLAUDE_SETTINGS_PATH)
                 : "missing — re-run `codiedev connect`",
         });
         checks.push({
             name: "Claude Code agent instructions",
             status: hasCodiedevInstructions(CLAUDE_INSTRUCTIONS_PATH) ? "pass" : "fail",
             detail: hasCodiedevInstructions(CLAUDE_INSTRUCTIONS_PATH)
-                ? "~/.claude/CLAUDE.md"
+                ? (0, harnessDirs_1.displayPath)(CLAUDE_INSTRUCTIONS_PATH)
                 : "missing — re-run `codiedev connect`",
         });
     }
@@ -426,25 +381,25 @@ async function runDoctor(_args) {
             detail: "not installed on this machine",
         });
     }
-    // 6. Codex setup (if present)
     if (codexInstalled()) {
         checks.push({
             name: "Codex detected",
             status: "pass",
-            detail: "~/.codex",
+            detail: (0, harnessDirs_1.displayPath)(CODEX_DIR),
         });
+        checks.push(configDirInUseCheck("Codex", CODEX_DIR, (0, harnessDirs_1.codexHomeInUse)(CODEX_DIR), "CODEX_HOME"));
         checks.push({
             name: "Codex Stop hook",
             status: hasCodiedevHook(CODEX_HOOKS_PATH, "Stop") ? "pass" : "fail",
             detail: hasCodiedevHook(CODEX_HOOKS_PATH, "Stop")
-                ? "~/.codex/hooks.json"
+                ? (0, harnessDirs_1.displayPath)(CODEX_HOOKS_PATH)
                 : "missing — re-run `codiedev connect`",
         });
         checks.push({
             name: "Codex agent instructions",
             status: hasCodiedevInstructions(CODEX_INSTRUCTIONS_PATH) ? "pass" : "fail",
             detail: hasCodiedevInstructions(CODEX_INSTRUCTIONS_PATH)
-                ? "~/.codex/AGENTS.md"
+                ? (0, harnessDirs_1.displayPath)(CODEX_INSTRUCTIONS_PATH)
                 : "missing — re-run `codiedev connect`",
         });
     }
@@ -455,7 +410,6 @@ async function runDoctor(_args) {
             detail: "not installed on this machine",
         });
     }
-    // 7. Cursor setup (if present)
     if (cursorInstalled()) {
         checks.push({
             name: "Cursor detected",
@@ -484,14 +438,19 @@ async function runDoctor(_args) {
             detail: "not installed on this machine",
         });
     }
-    // Agent Security is part of installation health, not a separate setup
-    // concept. Keep `codiedev security doctor` as an alias for focused output,
-    // while the main doctor remains the one command users need to remember.
+    if ((0, utils_1.copilotInstalled)()) {
+        const hooks = (0, copilotInstallation_1.inspectCopilotHooks)();
+        checks.push({ name: "GitHub Copilot capture hooks", status: hooks.status === "pass" ? "pass" : "fail", detail: hooks.detail });
+        checks.push({ name: "GitHub Copilot CLI instructions",
+            status: hasCodiedevInstructions((0, utils_1.copilotInstructionsPath)()) ? "pass" : "fail",
+            detail: hasCodiedevInstructions((0, utils_1.copilotInstructionsPath)()) ? (0, utils_1.copilotInstructionsPath)() : "missing — re-run `codiedev connect`" });
+    }
+    else {
+        checks.push({ name: "GitHub Copilot", status: "warn", detail: "not installed on this machine" });
+    }
     if ((0, securityFeature_1.isAgentSecurityEnabled)(config)) {
         checks.push(...(0, securityDoctor_1.securityDoctorChecks)((0, securityDoctor_1.collectSecurityDoctorReport)(config.companyId)));
     }
-    // 8. gh / glab CLIs (optional — only needed for reverse-ticket from a
-    // specific PR/MR URL; branch mode works without either).
     checks.push({
         name: "GitHub CLI (`gh`) for reverse-ticket from a PR url",
         status: hasGhCli() ? "pass" : "warn",

package/dist/commands/inbox.js

@@ -70,8 +70,6 @@ async function runRead(args) {
     const config = (0, shared_1.requireConfig)();
     const start = Date.now();
     try {
-        // First, fetch inbox so we can show the full body (markRead endpoint
-        // doesn't return content).
         const listRes = await (0, shared_1.apiRequest)("GET", "/api/cli/inbox", {
             config,
             query: { limit: 100 },

package/dist/commands/library.js

@@ -1,7 +1,4 @@
 "use strict";
-// `codiedev library [--scope mine|shared|all] [--kind doc|skill] [--tag X]
-// [--type spec|...] [--limit N]` — list artifacts in your Codiedev workspace.
-// Server applies companyId scoping; --scope filters within that.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runLibrary = runLibrary;
 const shared_1 = require("./shared");