codiedev 0.10.0-beta.4 → 0.10.0-beta.6

package/dist/commands/tracesLabel.js

@@ -0,0 +1,348 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseArgs = parseArgs;
+exports.scoreValue = scoreValue;
+exports.runScore = runScore;
+exports.runScores = runScores;
+exports.runQueue = runQueue;
+exports.runJudge = runJudge;
+exports.runImport = runImport;
+exports.runAddExample = runAddExample;
+exports.runVersions = runVersions;
+exports.runSaveVersion = runSaveVersion;
+exports.runOverview = runOverview;
+exports.runRuns = runRuns;
+exports.runRun = runRun;
+exports.runScoreKinds = runScoreKinds;
+exports.runQueueCreate = runQueueCreate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const shared_1 = require("./shared");
+const BOOL_FLAGS = new Set(["--failed", "--on", "--off", "--json"]);
+function parseArgs(args) {
+    const out = { positional: [], flags: {}, bools: new Set(), runs: [] };
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (BOOL_FLAGS.has(a)) {
+            out.bools.add(a);
+            continue;
+        }
+        if (a.startsWith("--")) {
+            const eq = a.indexOf("=");
+            const name = eq > 0 ? a.slice(0, eq) : a;
+            const value = eq > 0 ? a.slice(eq + 1) : args[++i];
+            if (value === undefined)
+                throw new Error(`${name} needs a value`);
+            if (name === "--run")
+                out.runs.push(value);
+            else
+                out.flags[name] = value;
+            continue;
+        }
+        out.positional.push(a);
+    }
+    return out;
+}
+function scoreValue(raw) {
+    const t = raw.trim();
+    if (/^(true|false)$/i.test(t))
+        return t.toLowerCase() === "true";
+    if (t !== "" && Number.isFinite(Number(t)))
+        return Number(t);
+    return t;
+}
+async function call(config, tool, method, route, opts) {
+    const start = Date.now();
+    try {
+        const res = await (0, shared_1.apiRequest)(method, `/api/cli/traces/${route}`, { config, ...opts });
+        (0, shared_1.recordAgentEvent)(config, { tool, ok: true, latencyMs: Date.now() - start });
+        return res;
+    }
+    catch (err) {
+        const e = err;
+        (0, shared_1.recordAgentEvent)(config, { tool, ok: false, latencyMs: Date.now() - start, error: e.message });
+        console.error(e.message);
+        process.exit(1);
+    }
+}
+function usage(text) {
+    console.error(`Usage: ${text}`);
+    process.exit(1);
+}
+async function runScore(args, config) {
+    const p = parseArgs(args);
+    const [run, name, value] = p.positional;
+    if (!run || !name || value === undefined)
+        usage("codiedev traces score <run> <score> <value> [--agent name] [--comment text] [--step n]");
+    const res = await call(config, "codiedev_traces_score", "POST", "score", {
+        body: { run, name, value: scoreValue(value), agent: p.flags["--agent"], comment: p.flags["--comment"], ...(p.flags["--step"] ? { step: Number(p.flags["--step"]) } : {}) },
+    });
+    console.log(`✓ Scored ${res.runId}: ${name} = ${value}`);
+}
+async function runScores(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    if (!agent)
+        usage("codiedev traces scores <agent> [--days n] [--json]");
+    const res = await call(config, "codiedev_traces_scores", "GET", "scores", { query: { agent, days: p.flags["--days"] ?? "7" } });
+    if (p.bools.has("--json")) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+    }
+    if (!res.summary.length)
+        console.log(`No scores on ${res.agent} in the last ${p.flags["--days"] ?? 7} days.`);
+    for (const s of res.summary) {
+        const head = s.dataType === "boolean" && s.average !== null ? `${Math.round(s.average * 100)}% true`
+            : s.dataType === "numeric" && s.average !== null ? `avg ${Math.round(s.average * 100) / 100}`
+                : s.categories.map((c) => `${c.label} ${c.count}`).join(", ");
+        const from = [s.bySource.annotation ? `${s.bySource.annotation} people` : "", s.bySource.api ? `${s.bySource.api} your app` : "", s.bySource.judge ? `${s.bySource.judge} judge` : ""].filter(Boolean).join(", ");
+        console.log(`${s.name.padEnd(24)} ${head.padEnd(28)} ${s.count} scores (${from})`);
+    }
+    if (res.kinds.length)
+        console.log(`\nScore kinds: ${res.kinds.map((k) => `${k.name} (${k.dataType === "numeric" ? `${k.min ?? ""}–${k.max ?? ""}` : k.dataType === "boolean" ? "true/false" : k.categories.join("/")})`).join(", ")}`);
+}
+async function runQueue(args, config) {
+    const [verb, ...rest] = args;
+    if (verb === "list" || verb === undefined) {
+        const res = await call(config, "codiedev_traces_queue_list", "GET", "queues", {});
+        const live = res.queues.filter((q) => !q.archived);
+        if (!live.length)
+            console.log("No review queues yet. Make one in Codiedev → Traces → Review.");
+        for (const q of live)
+            console.log(`${q.name.padEnd(28)} ${String(q.pending).padStart(4)} to review  ${String(q.done).padStart(4)} done  ${q.scoreNames.join(", ")}`);
+        return;
+    }
+    if (verb === "create")
+        return runQueueCreate(rest, config);
+    if (verb !== "add")
+        usage("codiedev traces queue list | queue create <name> [--scores a,b] | queue add <queue> --agent <name> [--failed] [--days n] [--run id ...]");
+    const p = parseArgs(rest);
+    const queue = p.positional[0];
+    if (!queue || (!p.flags["--agent"] && !p.runs.length))
+        usage("codiedev traces queue add <queue> --agent <name> [--failed] [--days n] [--run id ...]");
+    const res = await call(config, "codiedev_traces_queue_add", "POST", "queue", {
+        body: { queue, agent: p.flags["--agent"], failed: p.bools.has("--failed"), ...(p.flags["--days"] ? { days: Number(p.flags["--days"]) } : {}), ...(p.runs.length ? { runs: p.runs } : {}) },
+    });
+    console.log(`✓ Added ${res.added} ${res.added === 1 ? "run" : "runs"} to ${res.queue}${res.skipped ? ` (${res.skipped} already there or not yours)` : ""}. Review them in Codiedev → Traces → Review.`);
+}
+function printJudge(agent, judge) {
+    if (!judge || judge === "none") {
+        console.log(`Automatic scoring isn't set up for ${agent}.`);
+        return;
+    }
+    console.log(`${agent}: automatic scoring ${judge.enabled ? "on" : "off"}`);
+    console.log(`  scores ${judge.scoreNames.join(", ")} · ${Math.round(judge.sampleRate * 100)}% of runs, up to ${judge.dailyMaxRuns}/day · ${judge.model}`);
+    if (judge.judgeKey)
+        console.log(`  billed to ${judge.judgeKey.name}${judge.judgeKey.monthlyBudgetUsd !== null ? ` ($${judge.judgeKey.monthlyBudgetUsd}/mo)` : ""} · ${judge.judgedToday} judged in 24h${judge.errorsToday ? `, ${judge.errorsToday} failed` : ""}`);
+    if (judge.lastError)
+        console.log(`  last problem: ${judge.lastError}`);
+}
+async function runJudge(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    const help = "codiedev traces judge <agent> [--on | --off] [--scores a,b] [--instructions text] [--model id] [--sample percent] [--daily n] [--budget usd | --key cdvm_…]";
+    if (!agent)
+        usage(help);
+    const changing = p.bools.has("--on") || p.bools.has("--off") || Object.keys(p.flags).length > 0;
+    if (!changing) {
+        const res = await call(config, "codiedev_traces_judge", "GET", "judge", { query: { agent } });
+        printJudge(res.agent, res.judge);
+        return;
+    }
+    const res = await call(config, "codiedev_traces_judge_set", "POST", "judge", {
+        body: {
+            agent,
+            ...(p.bools.has("--on") ? { enabled: true } : p.bools.has("--off") ? { enabled: false } : {}),
+            ...(p.flags["--scores"] ? { scores: p.flags["--scores"].split(",").map((s) => s.trim()).filter(Boolean) } : {}),
+            ...(p.flags["--instructions"] ? { instructions: p.flags["--instructions"] } : {}),
+            ...(p.flags["--model"] ? { model: p.flags["--model"] } : {}),
+            ...(p.flags["--sample"] ? { sampleRate: Number(p.flags["--sample"]) / 100 } : {}),
+            ...(p.flags["--daily"] ? { dailyMaxRuns: Number(p.flags["--daily"]) } : {}),
+            ...(p.flags["--budget"] ? { newKeyBudgetUsd: Number(p.flags["--budget"]) } : {}),
+            ...(p.flags["--key"] ? { pastedKey: p.flags["--key"] } : {}),
+        },
+    });
+    printJudge(res.agent, res.judge);
+}
+async function runImport(args, config) {
+    const p = parseArgs(args);
+    const [agent, file] = p.positional;
+    const dataset = p.flags["--dataset"];
+    if (!agent || !file || !dataset)
+        usage("codiedev traces import <agent> <file.csv|file.jsonl> --dataset <name>");
+    let text;
+    try {
+        text = fs.readFileSync(path.resolve(process.cwd(), file), "utf8");
+    }
+    catch (err) {
+        console.error(`Couldn't read ${file}: ${err.message}`);
+        process.exit(1);
+    }
+    const res = await call(config, "codiedev_traces_import", "POST", "examples", { body: { agent, dataset, text } });
+    console.log(`✓ Imported ${res.added} ${res.added === 1 ? "example" : "examples"} into ${dataset} for ${agent}.`);
+    for (const e of res.errors.slice(0, 10))
+        console.log(`  skipped${e.line ? ` line ${e.line}` : ""}: ${e.error}`);
+}
+async function runAddExample(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    const dataset = p.flags["--dataset"];
+    const input = p.flags["--input"];
+    if (!agent || !dataset || !input)
+        usage("codiedev traces add-example <agent> --dataset <name> --input <text> [--expected <text>] [--name <text>]");
+    await call(config, "codiedev_traces_add_example", "POST", "examples", { body: { agent, dataset, input, expected: p.flags["--expected"], name: p.flags["--name"] } });
+    console.log(`✓ Added an example to ${dataset} for ${agent}.`);
+}
+async function runVersions(args, config) {
+    const dataset = parseArgs(args).positional[0];
+    if (!dataset)
+        usage("codiedev traces versions <dataset>");
+    const res = await call(config, "codiedev_traces_versions", "GET", "versions", { query: { dataset } });
+    if (!res.versions.length)
+        console.log(`${dataset} has no saved versions. Save one with: codiedev traces save-version "${dataset}"`);
+    for (const v of res.versions)
+        console.log(`v${v.version}  ${String(v.cases).padStart(4)} cases  ${new Date(v.createdAt).toISOString().slice(0, 10)}  +${v.added} −${v.removed} ${v.changed} edited${v.note ? `  ${v.note}` : ""}`);
+    if (res.unsaved)
+        console.log(`Unsaved since v${res.versions[0].version}: +${res.unsaved.added} −${res.unsaved.removed} ${res.unsaved.changed} edited`);
+}
+async function runSaveVersion(args, config) {
+    const p = parseArgs(args);
+    const dataset = p.positional[0];
+    if (!dataset)
+        usage("codiedev traces save-version <dataset> [--note text]");
+    const res = await call(config, "codiedev_traces_save_version", "POST", "versions", { body: { dataset, note: p.flags["--note"] } });
+    console.log(`✓ Saved ${dataset} as v${res.version} (${res.cases} cases). Run it later with --dataset "${dataset}" --version ${res.version}.`);
+}
+const usd = (n) => (n === 0 ? "$0" : n < 0.01 ? "<$0.01" : `$${n.toFixed(2)}`);
+const json = (p, value) => { if (p.bools.has("--json")) {
+    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+    return true;
+} return false; };
+async function runOverview(args, config) {
+    const p = parseArgs(args);
+    const res = await call(config, "codiedev_traces_overview", "GET", "overview", { query: { days: p.flags["--days"] ?? "7" } });
+    if (json(p, res))
+        return;
+    if (!res.agents.length) {
+        console.log("No agents you can see yet. Connect one in Codiedev → Traces.");
+        return;
+    }
+    console.log(`Agents, last ${res.range}:`);
+    for (const a of res.agents)
+        console.log(`  ${a.name.padEnd(28)} ${String(a.runs).padStart(6)} runs  ${String(a.failedRuns).padStart(5)} failed  ${usd(a.spend7dUsd).padStart(9)} 7d spend  ${a.keepsPromptsDays ? `prompts ${a.keepsPromptsDays}d` : "metadata only"}${a.spike ? "  spend spike" : ""}${a.budgetBlock ? "  budget block" : ""}`);
+    if (res.issues.length) {
+        console.log("\nWhat's going wrong:");
+        for (const i of res.issues)
+            console.log(`  ${i.label.padEnd(18)} ${String(i.runs).padStart(5)} runs  ${usd(i.wastedUsd).padStart(9)} wasted  ${i.agents.join(", ")}${i.exampleRun ? `  e.g. ${i.exampleRun}` : ""}`);
+    }
+}
+async function runRuns(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    if (!agent)
+        usage("codiedev traces runs <agent> [--failed] [--flag errors|truncated|tool_loop|context_overflow|budget_block] [--model id] [--verdict pass|fail] [--days n] [--limit n] [--json]");
+    const res = await call(config, "codiedev_traces_runs", "GET", "runs", {
+        query: { agent, days: p.flags["--days"] ?? "7", ...(p.bools.has("--failed") ? { failed: "1" } : {}), ...(p.flags["--flag"] ? { flag: p.flags["--flag"] } : {}), ...(p.flags["--model"] ? { model: p.flags["--model"] } : {}), ...(p.flags["--verdict"] ? { verdict: p.flags["--verdict"] } : {}), limit: p.flags["--limit"] ?? "50" },
+    });
+    if (json(p, res))
+        return;
+    console.log(`${res.total} ${res.total === 1 ? "run" : "runs"} for ${res.agent}, last ${res.range}${res.total > res.runs.length ? ` (newest ${res.runs.length})` : ""}:`);
+    for (const r of res.runs)
+        console.log(`  ${r.startedAt.slice(0, 16).replace("T", " ")}  ${r.status === "failed" ? "FAIL" : " ok "}  ${r.runId.padEnd(24)} ${String(r.steps).padStart(3)} calls ${usd(r.costUsd).padStart(8)}  ${r.model ?? ""}${r.flags.length ? `  [${r.flags.join(", ")}]` : ""}${r.verdict ? `  marked ${r.verdict}` : ""}`);
+    if (res.runs.length)
+        console.log(`\nOpen one: codiedev traces run ${res.runs[0].runId} --agent "${res.agent}"`);
+}
+async function runRun(args, config) {
+    const p = parseArgs(args);
+    const run = p.positional[0];
+    if (!run)
+        usage("codiedev traces run <run> [--agent name] [--json]");
+    const res = await call(config, "codiedev_traces_run", "GET", "run", { query: { run, ...(p.flags["--agent"] ? { agent: p.flags["--agent"] } : {}) } });
+    if (json(p, res))
+        return;
+    const r = res.run;
+    console.log(`${r.title} · ${r.id}`);
+    console.log(`${new Date(r.startedAt).toISOString().slice(0, 16).replace("T", " ")} · ${r.status === "failed" ? "FAILED" : "ok"} · ${Math.round(r.durationMs / 100) / 10}s · ${usd(r.costUsd)}${r.flags.length ? ` · ${r.flags.join(", ")}` : ""}`);
+    if (r.diagnosis)
+        console.log(`\nWhat went wrong: ${r.diagnosis.title}\n  ${r.diagnosis.why}\n\nFix (for your coding agent):\n${r.diagnosis.fix.split("\n").map((l) => `  ${l}`).join("\n")}`);
+    if (r.annotation)
+        console.log(`\nMarked ${r.annotation.verdict} by ${r.annotation.by}${r.annotation.reason ? `: ${r.annotation.reason}` : ""}`);
+    if (res.scores.length)
+        console.log(`\nScores: ${res.scores.map((s) => `${s.name} ${s.text}${s.step ? ` (step ${s.step})` : ""} by ${s.by ?? s.source}${s.comment ? ` "${s.comment}"` : ""}`).join("; ")}`);
+    console.log("\nSteps:");
+    for (const s of r.spans.filter((x) => x.kind !== "run")) {
+        console.log(`  ${s.kind === "tool" ? "tool" : "call"}  ${s.name}  ${Math.round(s.durationMs)}ms${s.costUsd !== undefined ? `  ${usd(s.costUsd)}` : ""}${s.finishReason ? `  finish: ${s.finishReason}` : ""}${s.statusCode && s.statusCode >= 400 ? `  HTTP ${s.statusCode}` : ""}${s.flag ? `  [${s.flag}]` : ""}${s.note ? `  ${s.note}` : ""}`);
+        if (s.input)
+            console.log(`      prompt: ${s.input.replace(/\s+/g, " ").slice(0, 300)}`);
+        if (s.output)
+            console.log(`      reply:  ${s.output.replace(/\s+/g, " ").slice(0, 300)}`);
+    }
+    if (!r.bodiesVisible)
+        console.log("\n(Prompts and replies are shown only to the agent's maintainers.)");
+}
+async function runScoreKinds(args, config) {
+    const [verb, ...rest] = args;
+    if (verb === "add") {
+        const p = parseArgs(rest);
+        const name = p.positional[0];
+        const type = p.flags["--type"];
+        if (!name || !type)
+            usage("codiedev traces score-kinds add <name> --type number|categories|boolean [--min n --max n] [--categories a,b,c] [--description text]");
+        const dataType = type === "number" || type === "numeric" ? "numeric" : type === "categories" || type === "categorical" ? "categorical" : type === "boolean" || type === "bool" ? "boolean" : type;
+        await call(config, "codiedev_traces_score_kind_add", "POST", "score-kinds", {
+            body: { name, type: dataType, ...(p.flags["--min"] ? { min: Number(p.flags["--min"]) } : {}), ...(p.flags["--max"] ? { max: Number(p.flags["--max"]) } : {}), ...(p.flags["--categories"] ? { categories: p.flags["--categories"].split(",").map((c) => c.trim()) } : {}), ...(p.flags["--description"] ? { description: p.flags["--description"] } : {}) },
+        });
+        console.log(`✓ Added score kind ${name}.`);
+        return;
+    }
+    const p = parseArgs(verb === undefined || verb === "list" ? rest : args);
+    const res = await call(config, "codiedev_traces_score_kinds", "GET", "score-kinds", {});
+    if (json(p, res))
+        return;
+    const live = res.kinds.filter((k) => !k.archived);
+    if (!live.length)
+        console.log("No score kinds yet. Add one: codiedev traces score-kinds add helpfulness --type number --min 1 --max 5");
+    for (const k of live)
+        console.log(`  ${k.name.padEnd(24)} ${k.dataType === "numeric" ? `number ${k.min ?? ""}–${k.max ?? ""}` : k.dataType === "boolean" ? "true / false" : k.categories.join(" / ")}${k.description ? `  ${k.description}` : ""}`);
+}
+async function runQueueCreate(args, config) {
+    const p = parseArgs(args);
+    const name = p.positional[0];
+    if (!name)
+        usage("codiedev traces queue create <name> [--scores a,b] [--description text]");
+    await call(config, "codiedev_traces_queue_create", "POST", "queues", { body: { name, scores: (p.flags["--scores"] ?? "").split(",").map((s) => s.trim()).filter(Boolean), ...(p.flags["--description"] ? { description: p.flags["--description"] } : {}) } });
+    console.log(`✓ Created review queue ${name}. Add runs: codiedev traces queue add "${name}" --agent <name> --failed`);
+}

package/dist/configDir.js

@@ -34,16 +34,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codiedevStateDir = codiedevStateDir;
-// Single source of truth for where the CLI's config/state lives on disk.
-//
-// Defaults to ~/.codiedev. The desktop app sets CODIEDEV_CONFIG_DIR to
-// ~/.codiedev-desktop so a desktop session never touches the user's real
-// prod config — env-based (not a flag) so detached capture-finish/upload
-// children inherit the override automatically.
-//
-// Deliberately dependency-free (only node:path/os) so it can be imported
-// by both utils.ts and modules utils.ts itself imports (e.g. captureLog.ts)
-// without creating a circular import.
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const CONFIG_DIR = process.env.CODIEDEV_CONFIG_DIR?.trim()

package/dist/connect.js

@@ -39,36 +39,19 @@ const https = __importStar(require("https"));
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
-const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
 const shared_1 = require("./commands/shared");
-const securityInstall_1 = require("./securityInstall");
-const securityPolicy_1 = require("./securityPolicy");
-const securityFeature_1 = require("./securityFeature");
-// cli.codiedev.com is a Convex custom domain on the prod deployment; the
-// underlying judicious-falcon-861.convex.site URL keeps serving, so configs
-// written by older CLI versions stay valid without a re-connect.
+const harnessDirs_1 = require("./harnessDirs");
 const BACKEND_URL = process.env.CODIEDEV_URL || "https://cli.codiedev.com";
-/**
- * Reads a line from stdin without echoing the typed/pasted characters —
- * for tokens, passwords, anything that shouldn't end up in terminal
- * scrollback or screenshots. Echoes `*` per character so the user gets
- * visual feedback that input is being received.
- *
- * Falls back to the regular `prompt()` if stdin isn't a TTY (e.g., piped
- * input in CI). Without a TTY there's no echo to suppress anyway, and
- * raw mode would error.
- */
 function promptHidden(question) {
     return new Promise((resolve) => {
         const stdin = process.stdin;
         const stdout = process.stdout;
         if (!stdin.isTTY) {
-            // CI / piped input — no terminal to mute. Fall back to readline.
             const rl = readline.createInterface({ input: stdin, output: stdout });
             rl.question(question, (answer) => {
                 rl.close();
@@ -85,23 +68,18 @@ function promptHidden(question) {
         };
         const onData = (chunk) => {
             const key = chunk.toString("utf8");
-            // Iterate so a single `chunk` containing a multi-char paste still
-            // masks each character individually.
             for (const ch of key) {
-                // Ctrl+C — abort like a normal terminal interrupt.
                 if (ch === "") {
                     cleanup();
                     stdout.write("\n");
                     process.exit(130);
                 }
-                // Enter — finalize.
                 if (ch === "\r" || ch === "\n") {
                     cleanup();
                     stdout.write("\n");
                     resolve(buf.trim());
                     return;
                 }
-                // Backspace / DEL — erase one masked char.
                 if (ch === "" || ch === "\b") {
                     if (buf.length > 0) {
                         buf = buf.slice(0, -1);
@@ -109,7 +87,6 @@ function promptHidden(question) {
                     }
                     continue;
                 }
-                // Ignore other control bytes (escape sequences from arrow keys, etc.)
                 if (ch.charCodeAt(0) < 0x20)
                     continue;
                 buf += ch;
@@ -165,11 +142,6 @@ function postJson(url, body, extraHeaders = {}) {
     });
 }
 async function runConnect(args = []) {
-    // `--force` (or `-f`) re-prompts for a token even if `~/.codiedev/config.json`
-    // already has one. Default behavior reuses the saved token so users can
-    // re-run `connect` (e.g., after installing Claude Code) without having to
-    // mint a fresh token from the portal — which is what bit Sonifi's first
-    // engineer when he interpreted "no visible token" as "the old one is gone".
     const force = args.includes("--force") || args.includes("-f");
     console.log("\nWelcome to Codiedev CLI\n");
     await (0, upgradeNudge_1.maybePrintUpgradeNudge)();
@@ -183,8 +155,6 @@ async function runConnect(args = []) {
         console.log(`Reusing API token from ~/.codiedev/config.json (run with --force to use a new one).\n`);
     }
     else {
-        // Hidden prompt — masks the token with `*` as it's typed/pasted so it
-        // doesn't end up in terminal scrollback or screenshots.
         token = await promptHidden("Enter your Codiedev API token: ");
         if (!token) {
             console.error("Error: API token is required.");
@@ -202,10 +172,8 @@ async function runConnect(args = []) {
         console.error(`\nError: Failed to validate token — ${err.message}`);
         process.exit(1);
     }
-    // Extract fields from response
     const companyId = responseData.companyId;
     const companyName = responseData.companyName;
-    const agentSecurityEnabled = responseData.agentSecurityEnabled === true;
     const repos = responseData.repos ?? [];
     if (!companyId || !companyName) {
         console.error("\nError: Invalid response from server. Token may be invalid.");
@@ -218,7 +186,6 @@ async function runConnect(args = []) {
         repos,
         lastSynced: new Date().toISOString(),
         backendUrl: BACKEND_URL,
-        agentSecurityEnabled,
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
@@ -230,15 +197,7 @@ async function runConnect(args = []) {
         console.error(`\nError: Failed to save config — ${err.message}`);
         process.exit(1);
     }
-    // Once we have a valid token + config, every subsequent step posts a
-    // per-step row to /api/telemetry/install-event so the admin page can show
-    // a timeline when a customer says "it connected but it doesn't work."
-    // Fire-and-forget — never blocks the connect flow.
     (0, shared_1.recordInstallEvent)(config, { step: "started", ok: true });
-    // One-way device status sync. Local config remains authoritative: a network
-    // failure here never removes or weakens an ignored path. This also registers
-    // a freshly connected device with an empty list so the portal can distinguish
-    // "connected, no exclusions" from "old CLI has never reported status".
     try {
         await postJson(`${BACKEND_URL}/api/cli/capture-exclusions`, {
             deviceId: config.deviceId,
@@ -249,17 +208,6 @@ async function runConnect(args = []) {
     catch (err) {
         console.warn(`Warning: Local capture settings are active, but portal status did not sync — ${err.message}`);
     }
-    // Migration: strip MCP server entries written by pre-CLI-only versions
-    // of `codiedev connect`. These pointed at `npx codiedev-mcp`, a binary
-    // that was removed in 0.3.4 and that 0.7.11+ no longer ships. Without
-    // cleanup, customers upgrading from any prior version see persistent
-    // "MCP server failed to start" errors in their agent UIs even though
-    // the CLI works fine. Each helper is idempotent and a no-op when the
-    // relevant config file doesn't exist.
-    //
-    // Each call is wrapped because the user's upgrade path matters more
-    // than the cleanup. A locked / wrong-owner config file (rare but real)
-    // shouldn't block the install loop or strand them on an old version.
     for (const [label, fn] of [
         ["Claude Code", utils_1.cleanupClaudeCodeMcp],
         ["Codex", utils_1.cleanupCodexMcp],
@@ -278,29 +226,16 @@ async function runConnect(args = []) {
     const hasCodex = (0, utils_1.codexInstalled)();
     const hasCursor = (0, utils_1.cursorInstalled)();
     const hasOpenCode = (0, utils_1.openCodeInstalled)();
+    const hasCopilot = (0, utils_1.copilotInstalled)();
+    const hasPi = (0, utils_1.piInstalled)();
     (0, shared_1.recordInstallEvent)(config, { step: "detect", target: "claude-code", ok: hasClaude });
     (0, shared_1.recordInstallEvent)(config, { step: "detect", target: "codex", ok: hasCodex });
     (0, shared_1.recordInstallEvent)(config, { step: "detect", target: "cursor", ok: hasCursor });
     (0, shared_1.recordInstallEvent)(config, { step: "detect", target: "opencode", ok: hasOpenCode });
+    (0, shared_1.recordInstallEvent)(config, { step: "detect", target: "copilot", ok: hasCopilot });
+    (0, shared_1.recordInstallEvent)(config, { step: "detect", target: "pi", ok: hasPi });
     const installed = [];
-    // Machine-readable target keys reported back to the backend via
-    // /api/cli/markInstalled so the portal's "Connected" state reflects
-    // what's actually wired up on this machine, not just "token validated."
     const installedTargets = [];
-    const home = os.homedir();
-    const securityConfigPaths = [
-        path.join(home, ".claude", "settings.json"),
-        path.join(home, ".codex", "hooks.json"),
-        path.join(home, ".cursor", "hooks.json"),
-        path.join(home, ".config", "opencode", "plugins", "codiedev.js"),
-        path.join(home, ".codex", "config.toml"),
-    ];
-    // Snapshot before any hook update. Rollback is intentionally not automatic:
-    // an administrator can inspect these 0600 copies before restoring them.
-    const securitySnapshot = (0, securityInstall_1.createSecurityInstallSnapshot)(securityConfigPaths);
-    // Wrap each per-target write so we emit one install_target row each. The
-    // existing user-visible behavior (console.warn on failure, continue) is
-    // unchanged — telemetry just observes the outcome.
     const runInstall = (target, fn, label, targetKey) => {
         try {
             fn();
@@ -320,56 +255,26 @@ async function runConnect(args = []) {
         }
     };
     if (hasClaude) {
-        runInstall("claude-code-hook", () => (0, utils_1.installHook)(agentSecurityEnabled), "Claude Code SessionEnd (capture) + UserPromptSubmit (skill discovery) + Stop (auto-backup) hooks (~/.claude/settings.json)", "claudeCode-hook");
-        runInstall("claude-code-instructions", utils_1.installClaudeCodeInstructions, "Claude Code agent instructions (~/.claude/CLAUDE.md)", "claudeCode-instructions");
+        runInstall("claude-code-hook", utils_1.installHook, `Claude Code SessionEnd (capture) + UserPromptSubmit (skill discovery) + Stop (auto-backup) hooks (${(0, harnessDirs_1.displayPath)(path.join((0, harnessDirs_1.claudeConfigDir)(), "settings.json"))})`, "claudeCode-hook");
+        runInstall("claude-code-instructions", utils_1.installClaudeCodeInstructions, `Claude Code agent instructions (${(0, harnessDirs_1.displayPath)(path.join((0, harnessDirs_1.claudeConfigDir)(), "CLAUDE.md"))})`, "claudeCode-instructions");
     }
     if (hasCodex) {
-        runInstall("codex-hook", () => (0, utils_1.installCodexHook)(agentSecurityEnabled), "Codex Stop (capture + auto-backup) hooks (~/.codex/hooks.json)", "codex-hook");
-        runInstall("codex-instructions", utils_1.installCodexInstructions, "Codex agent instructions (~/.codex/AGENTS.md)", "codex-instructions");
+        runInstall("codex-hook", utils_1.installCodexHook, `Codex Stop (capture + auto-backup) hooks (${(0, harnessDirs_1.displayPath)(path.join((0, harnessDirs_1.codexHome)(), "hooks.json"))})`, "codex-hook");
+        runInstall("codex-instructions", utils_1.installCodexInstructions, `Codex agent instructions (${(0, harnessDirs_1.displayPath)(path.join((0, harnessDirs_1.codexHome)(), "AGENTS.md"))})`, "codex-instructions");
     }
     if (hasCursor) {
-        runInstall("cursor-hook", () => (0, utils_1.installCursorHook)(agentSecurityEnabled), "Cursor sessionStart + prompt security + stop backup + sessionEnd capture hooks (~/.cursor/hooks.json)", "cursor-hook");
+        runInstall("cursor-hook", utils_1.installCursorHook, "Cursor sessionStart + stop backup + sessionEnd capture hooks (~/.cursor/hooks.json)", "cursor-hook");
         runInstall("cursor-instructions", utils_1.installCursorInstructions, "Cursor agent instructions (~/.cursor/rules/codiedev.mdc)", "cursor-instructions");
     }
-    // Always stage the adapter. It is dormant until OpenCode starts, which lets
-    // a user connect Claude Code today and install the Codie harness tomorrow
-    // without needing a second setup ritual.
-    runInstall("opencode-capture-adapter", () => (0, utils_1.installOpenCodeCapturePlugin)(agentSecurityEnabled), "OpenCode session capture adapter (~/.config/opencode/plugins/codiedev.js)", "opencode-capture");
-    // Record the exact installed hook bytes and the pre-update rollback files.
-    // This supplies health/integrity checks without requiring a package publish
-    // or trusting whichever `node` happens to be first on PATH later.
-    try {
-        const hookScriptPath = path.join(__dirname, "hook.js");
-        if (agentSecurityEnabled && fs.existsSync(hookScriptPath)) {
-            const targets = [];
-            if (installedTargets.includes("claudeCode-hook"))
-                targets.push({ surface: "claude-code", configPath: securityConfigPaths[0] });
-            if (installedTargets.includes("codex-hook"))
-                targets.push({ surface: "codex", configPath: securityConfigPaths[1] });
-            if (installedTargets.includes("cursor-hook"))
-                targets.push({ surface: "cursor", configPath: securityConfigPaths[2] });
-            if (installedTargets.includes("opencode-capture"))
-                targets.push({ surface: "codie-harness", configPath: securityConfigPaths[3] });
-            (0, securityInstall_1.writeSecurityInstallManifest)({ hookScriptPath, snapshot: securitySnapshot, targets });
-        }
+    if (hasCopilot) {
+        runInstall("copilot-hook", utils_1.installCopilotHook, `GitHub Copilot (VS Code + CLI) sessionStart + agentStop backup + sessionEnd capture hooks (${(0, utils_1.copilotHooksPath)()})`, "copilot-hook");
+        runInstall("copilot-instructions", utils_1.installCopilotInstructions, "GitHub Copilot CLI team artifact instructions", "copilot-instructions");
     }
-    catch (err) {
-        console.warn(`Warning: Security hooks installed, but integrity manifest could not be written — ${err.message}`);
+    runInstall("pi-extension", utils_1.installPiExtension, `pi session start + skill discovery + capture extension (${(0, harnessDirs_1.displayPath)((0, utils_1.piExtensionPath)())})`, "pi-extension");
+    if (hasPi) {
+        runInstall("pi-instructions", utils_1.installPiInstructions, `pi agent instructions (${(0, harnessDirs_1.displayPath)((0, utils_1.piInstructionsPath)())})`, "pi-instructions");
     }
-    // Prime the local cache after installation. Hooks read this file only, so
-    // an endpoint decision never depends on live network latency.
-    if (agentSecurityEnabled) {
-        try {
-            await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
-        }
-        catch (err) {
-            console.warn(`Warning: Agent-security policy will use safe defaults until sync succeeds — ${err.message}`);
-        }
-    }
-    // Tell the backend which targets we wired up so the portal's onboarding
-    // card flips to "Connected" only when something actually installed —
-    // not on bare token validation. Best-effort: a network failure here
-    // doesn't undo the local install, and `codiedev doctor` still works.
+    runInstall("opencode-capture-adapter", utils_1.installOpenCodeCapturePlugin, `OpenCode session capture adapter (${(0, harnessDirs_1.displayPath)(path.join((0, harnessDirs_1.openCodeConfigDir)(), "plugins", "codiedev.js"))})`, "opencode-capture");
     if (installedTargets.length > 0) {
         try {
             await postJson(`${BACKEND_URL}/api/cli/markInstalled`, {
@@ -388,7 +293,7 @@ async function runConnect(args = []) {
             });
         }
     }
-    if (!hasClaude && !hasCodex && !hasCursor && !hasOpenCode) {
+    if (!hasClaude && !hasCodex && !hasCursor && !hasOpenCode && !hasCopilot && !hasPi) {
         console.warn("\nNo existing AI client detected; the Codie/OpenCode adapter is ready for a later install.");
         console.warn("If you just installed Claude Code, launch it once (so ~/.claude is created),");
         console.warn("then re-run `npx codiedev connect` to wire up the capture hook.");
@@ -404,8 +309,6 @@ async function runConnect(args = []) {
     }
     console.log();
     console.log("Run `codiedev doctor` to verify everything's wired up.");
-    if ((0, securityFeature_1.isAgentSecurityEnabled)(config)) {
-        console.log("Run `codiedev security pilot` to validate blocking safely.");
-    }
+    console.log("If `codiedev` is not on PATH, run `npx codiedev@latest doctor` instead.");
     console.log();
 }

package/dist/connectFlow.js

@@ -1,13 +1,4 @@
 "use strict";
-// Pure helper for `npx codiedev connect` — decides where the API token
-// comes from. Splitting this out lets us TDD the policy (re-use vs. re-prompt)
-// without touching readline or fs at all.
-//
-// Motivation: Jackson hit a confusing flow where he had a working token in
-// `~/.codiedev/config.json`, re-ran `connect` (to pick up Claude Code that
-// he'd just installed), and was forced to paste a token again. Since the
-// portal only displays the plaintext on creation, his only option was to
-// generate a new one — leaving him thinking the old one had been lost.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveConnectToken = resolveConnectToken;
 function resolveConnectToken(input) {