codiedev 0.10.0-beta.4 → 0.10.0-beta.6

package/dist/cli.js

@@ -1,19 +1,5 @@
 #!/usr/bin/env node
 "use strict";
-/**
- * Codiedev CLI dispatcher.
- *
- * Subcommands:
- *   codiedev connect                   — link agent CLIs to your org
- *   codiedev push <file>               — author/update a spec/review/decision/etc.
- *   codiedev pull <key>                — fetch an artifact by filename key
- *   codiedev ping <user> "<msg>"       — send a message (optionally --with <key>)
- *   codiedev inbox                     — list pings (use --unread to filter)
- *   codiedev read <ping-id>            — mark read + show full message
- *   codiedev note "<text>"             — capture a thought
- *   codiedev promote <artifact-id>     — promote an extracted artifact to authored
- *   codiedev help                      — show this help
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 const connect_1 = require("./connect");
 const push_1 = require("./commands/push");
@@ -23,17 +9,19 @@ const ask_1 = require("./commands/ask");
 const ping_1 = require("./commands/ping");
 const inbox_1 = require("./commands/inbox");
 const note_1 = require("./commands/note");
-const promote_1 = require("./commands/promote");
-const reverseTicket_1 = require("./commands/reverseTicket");
 const createTicket_1 = require("./commands/createTicket");
 const doctor_1 = require("./commands/doctor");
 const search_1 = require("./commands/search");
 const library_1 = require("./commands/library");
 const share_1 = require("./commands/share");
 const send_1 = require("./commands/send");
-const react_1 = require("./commands/react");
 const capture_1 = require("./commands/capture");
-const security_1 = require("./commands/security");
+const pack_1 = require("./commands/pack");
+const traces_1 = require("./commands/traces");
+const agents_1 = require("./commands/agents");
+const evals_1 = require("./commands/evals");
+const hookGate_1 = require("./packs/hookGate");
+const sync_1 = require("./packs/sync");
 const version_1 = require("./version");
 const HELP = `
 Codiedev CLI
@@ -43,14 +31,9 @@ Codiedev CLI
   someone left off across sessions and providers.
 
 Connect:
-  codiedev connect                       Link Claude Code / Codex / Cursor to your org
-  codiedev doctor                        Verify setup, capture, and Agent Security
-  codiedev security pilot                Run safe synthetic policy checks
-  codiedev security inventory            Inventory MCPs, skills, hooks, plugins,
-                                         instructions, and editor extensions
-  codiedev security scan --deep          Run installed open-source scanners too
-  codiedev security sync                 Fetch administrator policy locally
-  codiedev security rollback --yes       Restore pre-update hook configuration
+  codiedev connect                       Link Claude Code / Codex / Cursor /
+                                         GitHub Copilot / pi to your org
+  codiedev doctor                        Verify setup and capture
 
 Harness:
   codie                                  Launch the governed Codie harness.
@@ -70,14 +53,6 @@ Artifacts:
                                          team's collective memory. Returns an
                                          LLM-synthesized answer with citations
                                          pointing at sessions + artifacts.
-  codiedev promote <artifact-id>         Promote an auto-extracted artifact
-                                         to an authored one
-  codiedev reverse-ticket [<pr-url>]     Generate a Jira ticket draft.
-                                         No URL = branch mode (uses your current
-                                         local git branch, no PR needed).
-                                         Draft lands in /portal/agentic-ticketing.
-  codiedev reverse-ticket --base <ref>   Override the base ref in branch mode
-                                         (defaults to origin/main).
   codiedev create-ticket [<prompt>]      Forward-write a scoped ticket plan.
                                          Claude investigates the codebase, asks
                                          "single repo or multiple? where?", then
@@ -96,6 +71,30 @@ Messaging:
   codiedev inbox [--unread] [--limit N]  Show messages
   codiedev read <ping-id>                Mark read + show full message
 
+Starter packs:
+  codiedev pack list                     Packs assigned to your team
+  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie,pi]
+                       [--dry-run] [--json]
+                                         Install a pack (or all) into every
+                                         detected tool
+  codiedev pack status                   Installed packs, up to date or not
+
+Traces (agents on the gateway):
+  codiedev agents init | deploy | run | runs | show | secrets | webhook
+                                         Deploy agents and run them in fresh sandboxes
+                                         (codiedev agents help)
+  codiedev traces agents                 Agents you maintain, with saved test cases
+  codiedev traces cases <agent> [--dataset name [--version n]] [--model id]
+                                         Pull an agent's test cases (or one dataset)
+                                         into this repo for your coding agent to
+                                         run, optionally on another model
+  codiedev traces report <results.json>  Send the results back to Traces
+  codiedev traces overview | runs | run | score | scores | score-kinds | queue | judge | import | add-example | versions | save-version
+                                         Agents, runs, failures, scores, review queues,
+                                         automatic scoring and datasets (codiedev traces help)
+  codiedev evals report <run.json>       File one variant's eval scores under an experiment
+  codiedev evals last <subject>          Latest experiment on a subject + its champion
+
 Discovery:
   codiedev search "<query>"              Semantic search across the team's
                                          captured sessions and artifacts
@@ -103,9 +102,6 @@ Discovery:
                   [--type T] [--tag X] [--limit N]
                                          List artifacts in your workspace
 
-Feed:
-  codiedev react <postId> <emoji>        Toggle a reaction on a feed post
-
 Privacy:
   codiedev ignore <path>                 Never capture this folder or its children
   codiedev unignore <path>               Stop ignoring a folder
@@ -159,6 +155,10 @@ locally before any capture leaves your machine, so an offline or failed portal
 status sync never weakens it.
 `.trim();
 const COMMAND_HELP = {
+    pack: pack_1.PACK_HELP,
+    traces: traces_1.TRACES_HELP,
+    agents: agents_1.AGENTS_HELP,
+    evals: evals_1.EVALS_HELP,
     connect: `
 codiedev connect — link your agent CLI to Codiedev
 
@@ -168,8 +168,11 @@ codiedev connect — link your agent CLI to Codiedev
     - ~/.claude/CLAUDE.md instructions   (teaches Claude the commands)
     - ~/.codex/hooks.json hook           (same, for Codex)
     - ~/.codex/AGENTS.md instructions    (same, for Codex)
-    - ~/.cursor/hooks.json hooks         (session, prompt, security, capture)
+    - ~/.cursor/hooks.json hooks         (session, backup, capture)
     - ~/.cursor/rules/codiedev.mdc       (teaches Cursor the commands)
+    - ~/.copilot/hooks/codiedev.json     (GitHub Copilot: VS Code + CLI capture)
+    - ~/.pi/agent/extensions/codiedev.ts (pi: session, prompt, capture)
+    - ~/.pi/agent/AGENTS.md              (teaches pi the commands)
 
   Re-run anytime to swap accounts or refresh the instruction block.
 
@@ -275,20 +278,6 @@ codiedev note — capture a passing thought, linked to your session
     unignore: IGNORE_HELP,
     ignored: IGNORE_HELP,
     capture: IGNORE_HELP,
-    promote: `
-codiedev promote — promote an auto-extracted artifact to authored
-
-  Usage:
-    codiedev promote <artifact-id> [--key filename.md]
-
-  The session-capture pipeline auto-extracts spec/bugfix/decision
-  artifacts from each agent session. Promote turns one of those into
-  a first-class authored artifact your team can ping, pull, and
-  update versions of.
-
-  Find artifact-ids in the portal under Knowledge → Memory, or via
-  the portal search.
-`.trim(),
     "create-ticket": `
 codiedev create-ticket — forward-write a scoped ticket plan
 
@@ -414,8 +403,27 @@ Run 'codiedev help <command>' for each, or see the quick list:
 
 Tokens are per-user. Rotate any time by revoking + creating a new one.
 `.trim();
+const REMOVED_COMMANDS = {
+    promote: "Share an auto-saved spec with 'Promote to team' in the portal's My artifacts list.",
+    "reverse-ticket": "Use 'codiedev create-ticket' to draft Jira tickets.",
+    reverseTicket: "Use 'codiedev create-ticket' to draft Jira tickets.",
+    react: "React to feed posts in the portal.",
+};
+function removedCommand(command) {
+    console.error(`'codiedev ${command}' has been removed. ${REMOVED_COMMANDS[command] ?? ""}`.trim());
+    process.exit(1);
+}
 async function main() {
     const [, , command, ...rest] = process.argv;
+    if (command === "hook-gate") {
+        (0, hookGate_1.runHookGateCli)(rest);
+        return;
+    }
+    if (command && !["pack", "packs", "help", "docs", "version", "--version", "-v", "--help", "-h"].includes(command) && !rest.includes("--json")) {
+        const nag = (0, sync_1.packNagLine)();
+        if (nag)
+            console.error(`\n${nag}\n`);
+    }
     if (!command || command === "--help" || command === "-h") {
         console.log(HELP);
         return;
@@ -438,7 +446,6 @@ async function main() {
         console.log(DOCS);
         return;
     }
-    // Support `codiedev <command> --help` too.
     if (rest.includes("--help") || rest.includes("-h")) {
         if (COMMAND_HELP[command]) {
             console.log(COMMAND_HELP[command]);
@@ -458,9 +465,6 @@ async function main() {
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);
                 return;
-            case "security":
-                await (0, security_1.runSecurityCommand)(rest);
-                return;
             case "push":
                 await (0, push_1.runPush)(rest);
                 return;
@@ -479,7 +483,6 @@ async function main() {
                 return;
             case "inbox":
             case "check":
-                // Support `codiedev check inbox` as an alias.
                 if (command === "check" && rest[0] === "inbox") {
                     await (0, inbox_1.runInbox)(rest.slice(1));
                 }
@@ -494,11 +497,10 @@ async function main() {
                 await (0, note_1.runNote)(rest);
                 return;
             case "promote":
-                await (0, promote_1.runPromote)(rest);
-                return;
             case "reverse-ticket":
             case "reverseTicket":
-                await (0, reverseTicket_1.runReverseTicket)(rest);
+            case "react":
+                removedCommand(command);
                 return;
             case "create-ticket":
             case "createTicket":
@@ -511,22 +513,31 @@ async function main() {
             case "ls":
                 await (0, library_1.runLibrary)(rest);
                 return;
+            case "traces":
+                await (0, traces_1.runTraces)(rest);
+                return;
+            case "agents":
+                await (0, agents_1.runAgents)(rest);
+                return;
+            case "evals":
+                await (0, evals_1.runEvals)(rest);
+                return;
             case "share":
                 await (0, share_1.runShare)(rest);
                 return;
             case "send":
                 await (0, send_1.runSend)(rest);
                 return;
-            case "react":
-                await (0, react_1.runReact)(rest);
-                return;
             case "ignore":
             case "unignore":
             case "ignored":
                 await (0, capture_1.runCaptureCommand)([command, ...rest]);
                 return;
+            case "pack":
+            case "packs":
+                await (0, pack_1.runPack)(rest);
+                return;
             case "capture":
-                // Back-compat alias for the earlier `codiedev capture <sub>` form.
                 await (0, capture_1.runCaptureCommand)(rest);
                 return;
             default:

package/dist/codexHookTrust.js

@@ -33,10 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexPluginContentHash = codexPluginContentHash;
 exports.codexCommandHookHash = codexCommandHookHash;
 exports.codiedevCodexHookTrustEntries = codiedevCodexHookTrustEntries;
 exports.writeCodexHookTrust = writeCodexHookTrust;
 exports.inspectCodexHookTrust = inspectCodexHookTrust;
+exports.packCodexHookTrustEntries = packCodexHookTrustEntries;
+exports.writeCodexPackHookTrust = writeCodexPackHookTrust;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -67,6 +70,42 @@ const MATCHER_EVENTS = new Set([
     "SubagentStart",
     "SubagentStop",
 ]);
+function codexPluginContentHash(root) {
+    const hash = crypto.createHash("sha256");
+    hash.update("codex-plugin-bundle-v1");
+    const u64 = (n) => {
+        const b = Buffer.alloc(8);
+        b.writeBigUInt64LE(BigInt(n));
+        return b;
+    };
+    const pending = [root];
+    while (pending.length) {
+        const current = pending.pop();
+        const relative = path.relative(root, current).split(path.sep).join("/");
+        const name = path.posix.basename(relative);
+        if (name === "__pycache__" || name === ".venv" || name.endsWith(".pyc") || name.endsWith(".egg-info"))
+            continue;
+        const nameBytes = Buffer.from(relative, "utf8");
+        hash.update(u64(nameBytes.length));
+        hash.update(nameBytes);
+        const stat = fs.lstatSync(current);
+        if (stat.isDirectory()) {
+            hash.update("directory");
+            const entries = fs.readdirSync(current).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+            for (const entry of entries.reverse())
+                pending.push(path.join(current, entry));
+        }
+        else if (stat.isFile()) {
+            hash.update("file");
+            hash.update(u64(stat.size));
+            hash.update(fs.readFileSync(current));
+        }
+        else {
+            throw new Error(`unsupported plugin entry type: ${current}`);
+        }
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
 function canonicalize(value) {
     if (Array.isArray(value))
         return value.map(canonicalize);
@@ -85,8 +124,6 @@ function normalizedTimeout(eventName, value) {
         return Math.min(3, Math.max(1, configured ?? 1));
     return Math.max(1, configured ?? 600);
 }
-/** Codex hashes a canonical, normalized hook identity before it will execute a
- * user hook. Keep this compatible with codex_config::version_for_toml. */
 function codexCommandHookHash(eventName, group, handler) {
     const normalizedHandler = {
         type: "command",
@@ -155,6 +192,27 @@ function codiedevCodexHookTrustEntries(hooksPath, hooksFile) {
     }
     return entries;
 }
+function stripBlockKeepingForeign(text, begin, end) {
+    const foreign = [];
+    const stripped = text.replace(new RegExp(`\\n?${begin}\\n([\\s\\S]*?)${end}\\n?`, "g"), (_match, body) => {
+        let table = null;
+        const flush = () => {
+            if (table && table.join("").trim())
+                foreign.push(table.join("\n").trimEnd());
+        };
+        for (const line of body.split("\n")) {
+            if (/^\s*\[/.test(line)) {
+                flush();
+                table = /^\s*\[hooks\.state\./.test(line) ? null : [];
+            }
+            if (table)
+                table.push(line);
+        }
+        flush();
+        return "\n";
+    });
+    return foreign.length ? `${stripped.trimEnd()}\n\n${foreign.join("\n\n")}\n` : stripped;
+}
 function tableHeader(key) {
     return `[hooks.state.${JSON.stringify(key)}]`;
 }
@@ -173,13 +231,10 @@ function removeTable(lines, header) {
     }
     return output;
 }
-/** `codiedev connect` is an explicit install action, so trust only the exact
- * Codiedev commands it just wrote. Any later command change produces a new
- * hash and Codex disables that hook until connect is run again. */
 function writeCodexHookTrust(configPath, hooksPath, hooksFile) {
     const entries = codiedevCodexHookTrustEntries(hooksPath, hooksFile);
     let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
-    existing = existing.replace(new RegExp(`\\n?${TRUST_BEGIN}\\n[\\s\\S]*?${TRUST_END}\\n?`, "g"), "\n");
+    existing = stripBlockKeepingForeign(existing, TRUST_BEGIN, TRUST_END);
     let lines = existing.split("\n");
     for (const entry of entries)
         lines = removeTable(lines, tableHeader(entry.key));
@@ -226,3 +281,67 @@ function inspectCodexHookTrust(configPath, hooksPath, hooksFile, requiredSubcomm
     }).length;
     return { ok: entries.length > 0 && trusted === entries.length, total: entries.length, trusted };
 }
+const PACK_TRUST_BEGIN = "# codiedev-pack-trust:begin";
+const PACK_TRUST_END = "# codiedev-pack-trust:end";
+function packCodexHookTrustEntries(hooksPath, hooksFile, plugin) {
+    const events = hooksFile?.hooks;
+    if (!events || typeof events !== "object")
+        return [];
+    const source = plugin
+        ? `${plugin.id}:${path.relative(plugin.root, hooksPath).split(path.sep).join("/")}`
+        : normalizedHooksPath(hooksPath);
+    const contentHash = plugin ? codexPluginContentHash(plugin.root) : undefined;
+    const entries = [];
+    for (const [eventName, groupsValue] of Object.entries(events)) {
+        const eventLabel = EVENT_LABELS[eventName];
+        if (!eventLabel || !Array.isArray(groupsValue))
+            continue;
+        groupsValue.forEach((groupValue, groupIndex) => {
+            const group = groupValue;
+            if (!group || !Array.isArray(group.hooks))
+                return;
+            group.hooks.forEach((handlerValue, handlerIndex) => {
+                const handler = handlerValue;
+                if (!handler || handler.type !== "command" || typeof handler.command !== "string")
+                    return;
+                entries.push({
+                    key: `${source}:${eventLabel}:${groupIndex}:${handlerIndex}`,
+                    eventName,
+                    command: handler.command,
+                    currentHash: codexCommandHookHash(eventName, group, handler),
+                    ...(contentHash ? { contentHash } : {}),
+                });
+            });
+        });
+    }
+    return entries;
+}
+function writeCodexPackHookTrust(configPath, entries) {
+    let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+    existing = stripBlockKeepingForeign(existing, PACK_TRUST_BEGIN, PACK_TRUST_END);
+    let lines = existing.split("\n");
+    for (const entry of entries)
+        lines = removeTable(lines, tableHeader(entry.key));
+    const base = lines.join("\n").trimEnd();
+    if (entries.length === 0) {
+        const next = base ? `${base}\n` : "";
+        if (!fs.existsSync(configPath) && !next)
+            return entries;
+        fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+        fs.chmodSync(configPath, 0o600);
+        return entries;
+    }
+    const trustBlock = entries.flatMap((entry) => [
+        tableHeader(entry.key),
+        "enabled = true",
+        `trusted_hash = ${JSON.stringify(entry.currentHash)}`,
+        ...(entry.contentHash ? [`trusted_content_hash = ${JSON.stringify(entry.contentHash)}`] : []),
+        "",
+    ]).join("\n");
+    const next = `${base}${base ? "\n\n" : ""}${PACK_TRUST_BEGIN}\n${trustBlock}${PACK_TRUST_END}\n`;
+    fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+    return entries;
+}