codiedev 0.10.0-beta.4 → 0.10.0-beta.6

package/dist/commands/reverseTicket.js

@@ -1,477 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isSafeRef = isSafeRef;
-exports.runReverseTicket = runReverseTicket;
-const child_process_1 = require("child_process");
-const shared_1 = require("./shared");
-const prUrl_1 = require("../prUrl");
-/**
- * Run a binary with an explicit argv, never a shell.
- *
- * The `gh`/`glab` API paths are built from an owner/repo parsed out of a URL the
- * caller pastes in. `parsePrOrMrUrl` only bounds those segments to "no slash",
- * so they can still carry `$(…)`, backticks or `;` — which a `shell: true`
- * invocation would execute. Passing argv directly means the shell never sees
- * them at all.
- */
-function runArgv(bin, argv, opts = {}) {
-    const res = (0, child_process_1.spawnSync)(bin, argv, {
-        stdio: ["pipe", "pipe", "pipe"],
-        encoding: "utf8",
-        maxBuffer: opts.maxBuffer ?? 50 * 1024 * 1024,
-        shell: false,
-    });
-    if (res.error)
-        throw res.error;
-    if (res.status !== 0) {
-        throw new Error(`${bin} ${argv.join(" ")} failed (exit ${res.status}): ${(res.stderr || "").trim().slice(0, 500)}`);
-    }
-    return res.stdout ?? "";
-}
-// Git ref names legally contain `$()`, `;`, `|` and backticks, all of which
-// break out of the `shell: true` git calls in branch mode below. A ref supplied
-// via `--base` is caller-controlled, so bound it to the safe subset before it
-// reaches a command line. Mirrors `validate_ref` in modal/runner.py.
-const SAFE_REF_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
-function isSafeRef(ref) {
-    if (!ref || ref.startsWith("-"))
-        return false;
-    if (ref.includes("..") || ref.includes("@{"))
-        return false;
-    if (ref.endsWith("/") || ref.endsWith("."))
-        return false;
-    return SAFE_REF_RE.test(ref);
-}
-async function fetchPrOrMrBundle(parsed, rawUrl, noTruncate) {
-    console.log(`Fetching ${parsed.provider === "gitlab" ? "MR" : "PR"} ${parsed.owner}/${parsed.repo}#${parsed.number}…`);
-    if (parsed.provider === "github") {
-        let prJson;
-        let filesJson;
-        let diff;
-        try {
-            prJson = ghApi(`/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.number}`);
-            filesJson = ghApi(`/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.number}/files`);
-            try {
-                const rawDiff = ghRaw(`/repos/${parsed.owner}/${parsed.repo}/pulls/${parsed.number}`);
-                diff = noTruncate ? rawDiff : rawDiff.slice(0, 12_000);
-            }
-            catch {
-                // diff is nice-to-have
-            }
-        }
-        catch (err) {
-            console.error(`Failed to fetch PR via gh api: ${err.message}`);
-            process.exit(1);
-        }
-        return {
-            repo: `${parsed.owner}/${parsed.repo}`,
-            number: parsed.number,
-            title: prJson.title ?? "",
-            body: prJson.body ?? "",
-            author: prJson.user?.login ?? "unknown",
-            authorEmail: prJson.user?.email ?? undefined,
-            mergedAt: prJson.merged_at
-                ? Date.parse(prJson.merged_at)
-                : prJson.closed_at
-                    ? Date.parse(prJson.closed_at)
-                    : Date.now(),
-            filesChanged: (filesJson ?? []).map((f) => f.filename),
-            diff,
-            htmlUrl: prJson.html_url ?? rawUrl,
-        };
-    }
-    // GitLab path. `glab api projects/<encoded-path>/...` returns the same
-    // MR shape as the REST API. We pull the diff from `merge_requests/<n>/changes`
-    // and reassemble a unified diff out of each file's `diff` blob.
-    const projectPath = `${parsed.owner}/${parsed.repo}`;
-    let mrJson;
-    let changesJson;
-    try {
-        mrJson = glabApi(projectPath, `merge_requests/${parsed.number}`);
-        changesJson = glabApi(projectPath, `merge_requests/${parsed.number}/changes`);
-    }
-    catch (err) {
-        console.error(`Failed to fetch MR via glab api: ${err.message}`);
-        process.exit(1);
-    }
-    const changes = (changesJson?.changes ?? []);
-    const filesChanged = changes
-        .map((c) => c.new_path ?? c.old_path)
-        .filter((p) => Boolean(p));
-    const rawDiff = changes
-        .map((c) => {
-        const header = `diff --git a/${c.old_path ?? c.new_path} b/${c.new_path ?? c.old_path}`;
-        return [header, c.diff ?? ""].join("\n");
-    })
-        .join("\n");
-    const diff = noTruncate ? rawDiff : rawDiff.slice(0, 12_000);
-    return {
-        repo: projectPath,
-        number: parsed.number,
-        title: mrJson.title ?? "",
-        body: mrJson.description ?? "",
-        author: mrJson.author?.username ?? "unknown",
-        authorEmail: undefined,
-        mergedAt: mrJson.merged_at
-            ? Date.parse(mrJson.merged_at)
-            : mrJson.closed_at
-                ? Date.parse(mrJson.closed_at)
-                : Date.now(),
-        filesChanged,
-        diff,
-        htmlUrl: mrJson.web_url ?? rawUrl,
-    };
-}
-function checkCli(bin) {
-    try {
-        runArgv(bin, ["--version"], { maxBuffer: 1024 * 1024 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function ghApi(path) {
-    return JSON.parse(runArgv("gh", ["api", path]));
-}
-function ghRaw(path) {
-    return runArgv("gh", [
-        "api",
-        "-H",
-        "Accept: application/vnd.github.v3.diff",
-        path,
-    ]);
-}
-// glab api takes a project path (URL-encoded) or numeric id and a sub-path.
-// For self-hosted GitLab, glab respects `GITLAB_HOST` env if the user has
-// configured glab against their internal instance.
-function glabApi(projectPath, subpath) {
-    const encoded = encodeURIComponent(projectPath);
-    return JSON.parse(runArgv("glab", ["api", `projects/${encoded}/${subpath}`]));
-}
-function parseArgs(args) {
-    let prUrl;
-    let base;
-    let forcedKey;
-    let noTruncate = false;
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if ((a === "--with" || a === "-w") && i + 1 < args.length) {
-            forcedKey = args[++i];
-        }
-        else if (a.startsWith("--with=")) {
-            forcedKey = a.slice("--with=".length);
-        }
-        else if ((a === "--base" || a === "-b") && i + 1 < args.length) {
-            base = args[++i];
-        }
-        else if (a.startsWith("--base=")) {
-            base = a.slice("--base=".length);
-        }
-        else if (a === "--full") {
-            noTruncate = true;
-        }
-        else if (!a.startsWith("--") && !prUrl) {
-            prUrl = a;
-        }
-    }
-    return { prUrl, base, forcedKey, noTruncate };
-}
-async function runReverseTicket(args) {
-    const { prUrl, base, forcedKey, noTruncate } = parseArgs(args);
-    // No PR URL → branch mode (mid-session, no PR exists yet).
-    if (!prUrl) {
-        return runBranchMode({ explicitBase: base, forcedKey });
-    }
-    const parsed = (0, prUrl_1.parsePrOrMrUrl)(prUrl);
-    if (!parsed) {
-        console.error("Couldn't parse PR/MR URL. Expected formats:");
-        console.error("  https://github.com/<owner>/<repo>/pull/<number>");
-        console.error("  https://gitlab.com/<group>/<repo>/-/merge_requests/<number>");
-        console.error("  (self-hosted GitLab works too — same shape, your host)");
-        console.error("");
-        console.error("Run with no arguments for branch mode (uses your current local branch).");
-        process.exit(1);
-    }
-    const requiredCli = parsed.provider === "gitlab" ? "glab" : "gh";
-    if (!checkCli(requiredCli)) {
-        console.error(`This command needs the \`${requiredCli}\` CLI installed and authenticated.`);
-        if (requiredCli === "gh") {
-            console.error("  brew install gh  (macOS)");
-            console.error("  gh auth login");
-        }
-        else {
-            console.error("  brew install glab  (macOS)");
-            console.error("  glab auth login");
-        }
-        process.exit(1);
-    }
-    const config = (0, shared_1.requireConfig)();
-    const bundle = await fetchPrOrMrBundle(parsed, prUrl, noTruncate);
-    console.log(`  title: ${bundle.title}`);
-    console.log(`  author: ${bundle.author}`);
-    console.log(`  files: ${bundle.filesChanged.length}`);
-    console.log(`  merged: ${new Date(bundle.mergedAt).toISOString()}`);
-    console.log("");
-    console.log("Generating ticket…");
-    console.log("");
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/reverseTicket", {
-            config,
-            body: {
-                pr: bundle,
-                forcedArtifactKey: forcedKey,
-            },
-        });
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        if (res.match) {
-            console.log(`✓ Matched artifact: ${res.match.key} (score=${res.match.score.toFixed(2)})`);
-            console.log(`  signals · body=${res.match.signals.bodyMention} · files=${res.match.signals.fileOverlap.toFixed(2)} · transcript=${res.match.signals.transcriptEdit}`);
-        }
-        else if (res.candidates.length > 0) {
-            console.log(`? Ambiguous / low confidence. Candidates:`);
-            for (const c of res.candidates.slice(0, 3)) {
-                console.log(`  - ${c.key} (score=${c.score.toFixed(2)})`);
-            }
-            console.log(`  Re-run with --with <key> to force a specific artifact.`);
-        }
-        else {
-            console.log("· No matched artifact. Ticket generated from PR diff alone.");
-        }
-        console.log(`  prompt tokens (est): ${res.tokensInEstimate}`);
-        console.log("");
-        console.log("─────────── Generated ticket ───────────");
-        console.log("");
-        console.log(res.ticket);
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Reverse-ticket failed: ${err.message}`);
-        process.exit(1);
-    }
-}
-function git(cmd) {
-    try {
-        return (0, child_process_1.execSync)(`git ${cmd}`, {
-            stdio: ["pipe", "pipe", "pipe"],
-            maxBuffer: 32 * 1024 * 1024,
-        })
-            .toString("utf8")
-            .trim();
-    }
-    catch (err) {
-        throw new Error(`git ${cmd} failed: ${err.message}`);
-    }
-}
-function safeGit(fn) {
-    try {
-        return fn() || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function runBranchMode(opts) {
-    // Confirm we're in a git repo.
-    try {
-        git("rev-parse --is-inside-work-tree");
-    }
-    catch {
-        console.error("Not inside a git repository. Run this from a checked-out repo.");
-        process.exit(1);
-    }
-    // `--base` lands unquoted on a `git` command line below, so reject anything
-    // outside the safe-ref subset instead of letting the shell interpret it.
-    if (opts.explicitBase !== undefined && !isSafeRef(opts.explicitBase)) {
-        console.error(`Invalid --base ref: ${JSON.stringify(opts.explicitBase)}. Expected a plain branch or tag name.`);
-        process.exit(1);
-    }
-    // Resolve base ref — explicit, then origin/main, then origin/master.
-    const candidates = opts.explicitBase
-        ? [opts.explicitBase]
-        : ["origin/main", "origin/master"];
-    let baseRef = null;
-    for (const c of candidates) {
-        try {
-            git(`rev-parse --verify ${c}`);
-            baseRef = c;
-            break;
-        }
-        catch {
-            // try next
-        }
-    }
-    if (!baseRef) {
-        console.error(`Couldn't find a base ref (tried ${candidates.join(", ")}). Pass --base <ref>.`);
-        process.exit(1);
-    }
-    const branch = git("rev-parse --abbrev-ref HEAD");
-    if (branch === "HEAD") {
-        console.error("Detached HEAD — checkout a branch first.");
-        process.exit(1);
-    }
-    const baseSha = git(`merge-base HEAD ${baseRef}`);
-    const headSha = git("rev-parse HEAD");
-    // Filter generated/lockfile noise from the diff body. The --stat (collected
-    // separately) still includes every file untouched, so excluded files still
-    // surface in the ticket's "Other files touched" section.
-    const isNoise = (p) => /(^|\/)(node_modules|dist|build|\.next|\.turbo|coverage|out)\//.test(p) ||
-        /(^|\/)package-lock\.json$/.test(p) ||
-        /(^|\/)yarn\.lock$/.test(p) ||
-        /(^|\/)pnpm-lock\.yaml$/.test(p) ||
-        /(^|\/)bun\.lock(b)?$/.test(p) ||
-        /(^|\/)Cargo\.lock$/.test(p) ||
-        /(^|\/)Gemfile\.lock$/.test(p) ||
-        /(^|\/)poetry\.lock$/.test(p) ||
-        /(^|\/)go\.sum$/.test(p);
-    const shellTolerant = (cmd) => {
-        try {
-            return (0, child_process_1.execSync)(`${cmd} || true`, {
-                stdio: ["pipe", "pipe", "pipe"],
-                maxBuffer: 32 * 1024 * 1024,
-            })
-                .toString("utf8")
-                .trim();
-        }
-        catch {
-            return "";
-        }
-    };
-    const shQuote = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    // Capture all work relative to the base ref: committed + uncommitted-tracked
-    // + new untracked. Matches "ticket my current changes" intent.
-    const trackedRaw = git(`diff --name-only ${baseSha}`);
-    const trackedFiles = trackedRaw ? trackedRaw.split("\n").filter(Boolean) : [];
-    const untrackedRaw = safeGit(() => git("ls-files --others --exclude-standard"));
-    const untrackedFiles = untrackedRaw
-        ? untrackedRaw.split("\n").filter(Boolean)
-        : [];
-    const filesChanged = Array.from(new Set([...trackedFiles, ...untrackedFiles]));
-    if (filesChanged.length === 0) {
-        console.error(`No changes detected between ${baseRef} and your working tree on ${branch}.`);
-        process.exit(1);
-    }
-    let stat = "";
-    try {
-        const trackedStat = git(`diff --stat=200 ${baseSha}`);
-        const untrackedStatLines = untrackedFiles.map((f) => {
-            const wc = shellTolerant(`wc -l < ${shQuote(f)}`);
-            const n = parseInt(wc.split(/\s+/)[0] || "0", 10) || 0;
-            return ` ${f} | ${n} ++++++++++ (new file)`;
-        });
-        stat = [trackedStat, ...untrackedStatLines]
-            .filter(Boolean)
-            .join("\n")
-            .slice(0, 8_000);
-    }
-    catch {
-        // best effort
-    }
-    let diff = "";
-    try {
-        const sourceTracked = trackedFiles.filter((f) => !isNoise(f));
-        const trackedDiff = sourceTracked.length > 0
-            ? git(`diff ${baseSha} -- ${sourceTracked.map(shQuote).join(" ")}`)
-            : git(`diff ${baseSha}`);
-        const sourceUntracked = untrackedFiles.filter((f) => !isNoise(f));
-        const untrackedDiffs = sourceUntracked.map((f) => shellTolerant(`git diff --no-index --no-color -- /dev/null ${shQuote(f)}`));
-        diff = [trackedDiff, ...untrackedDiffs]
-            .filter(Boolean)
-            .join("\n")
-            .slice(0, 40_000);
-    }
-    catch {
-        // best effort
-    }
-    let repo;
-    try {
-        const remoteUrl = git("config --get remote.origin.url");
-        const m = remoteUrl.match(/[:/]([^/:]+)\/([^/:]+?)(?:\.git)?$/);
-        if (!m) {
-            throw new Error(`Couldn't parse owner/repo from remote: ${remoteUrl}`);
-        }
-        repo = `${m[1]}/${m[2]}`;
-    }
-    catch (err) {
-        console.error(`Couldn't read git remote.origin.url: ${err.message}`);
-        process.exit(1);
-    }
-    const title = safeGit(() => git("log -1 --format=%s")) ?? `WIP: ${branch}`;
-    const author = safeGit(() => git("config --get user.name"));
-    const authorEmail = safeGit(() => git("config --get user.email"));
-    console.log(`Branch:  ${branch}  (${repo})`);
-    console.log(`Base:    ${baseRef} @ ${baseSha.slice(0, 12)}`);
-    console.log(`Head:    ${headSha.slice(0, 12)}`);
-    console.log(`Files:   ${filesChanged.length}`);
-    console.log("");
-    console.log("Generating ticket draft…");
-    console.log("");
-    const config = (0, shared_1.requireConfig)();
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/reverseTicketFromBranch", {
-            config,
-            body: {
-                branch: {
-                    repo,
-                    branch,
-                    baseSha,
-                    headSha,
-                    title,
-                    author,
-                    authorEmail,
-                    filesChanged,
-                    diff: diff || undefined,
-                    stat: stat || undefined,
-                },
-                forcedArtifactKey: opts.forcedKey,
-            },
-        });
-        if (!res.ok || !res.artifactId) {
-            (0, shared_1.recordAgentEvent)(config, {
-                tool: "codiedev_reverse_ticket",
-                ok: false,
-                latencyMs: Date.now() - start,
-                error: "no result",
-            });
-            console.error("Reverse-ticket generation returned no result. The writer may have skipped due to missing context.");
-            process.exit(1);
-        }
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        const portalHost = (process.env.CODIEDEV_PORTAL_URL || "https://codiedev.com").replace(/\/$/, "");
-        const portalLink = res.portalUrl.startsWith("http")
-            ? res.portalUrl
-            : `${portalHost}${res.portalUrl.startsWith("/") ? "" : "/"}${res.portalUrl}`;
-        const verb = res.action === "overwritten" ? "Updated" : "Created";
-        console.log(`✓ ${verb} reverse-ticket draft.`);
-        console.log(`  artifact: ${res.artifactKey ?? res.artifactId}`);
-        console.log(`  portal:   ${portalLink}`);
-        console.log("");
-        console.log("Open in your portal to review, edit, and push to Jira.");
-        console.log("Each call creates a fresh draft — clean up duplicates from the portal if needed.");
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_reverse_ticket",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Reverse-ticket failed: ${err.message}`);
-        process.exit(1);
-    }
-}

package/dist/commands/search.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runSearch(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/security.d.ts

@@ -1 +0,0 @@
-export declare function runSecurityCommand(args: string[]): Promise<void>;

package/dist/commands/security.js

@@ -1,156 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runSecurityCommand = runSecurityCommand;
-const securityInstall_1 = require("../securityInstall");
-const securityPilot_1 = require("../securityPilot");
-const securityPolicy_1 = require("../securityPolicy");
-const securityInventory_1 = require("../securityInventory");
-const securityDeepScan_1 = require("../securityDeepScan");
-const utils_1 = require("../utils");
-const securityDoctor_1 = require("../securityDoctor");
-const securityFeature_1 = require("../securityFeature");
-const SECURITY_USAGE = "Usage: codiedev security <doctor|pilot|inventory|scan|sync|rollback> [--json] [--deep] [--connect-mcp] [--supply-chain] [--no-upload] [--yes]";
-function printPilot(json) {
-    const report = (0, securityPilot_1.runSyntheticSecurityPilot)();
-    if (json) {
-        console.log(JSON.stringify(report, null, 2));
-        return report.ok;
-    }
-    console.log("\nCodiedev security pilot — synthetic, side-effect-free validation\n");
-    for (const item of report.cases) {
-        console.log(`${item.passed ? "✓" : "✗"} ${item.surface}: ${item.name} (${item.actual})`);
-    }
-    console.log(`\n${report.ok ? "PASS" : "FAIL"}: ${report.cases.filter((item) => item.passed).length}/${report.cases.length} policy checks matched.`);
-    console.log("No commands were executed and no real credentials were used.\n");
-    return report.ok;
-}
-function printDoctor(json, companyId) {
-    const result = (0, securityDoctor_1.collectSecurityDoctorReport)(companyId);
-    if (json) {
-        console.log(JSON.stringify(result, null, 2));
-        return result.ok;
-    }
-    console.log("\nCodiedev doctor — Agent Security details\n");
-    for (const check of (0, securityDoctor_1.securityDoctorChecks)(result)) {
-        const mark = check.status === "pass" ? "✓" : check.status === "warn" ? "!" : "✗";
-        console.log(`${mark} ${check.name}: ${check.detail}`);
-    }
-    console.log(`\n${result.ok ? "PASS" : "FAIL"}: ${result.ok ? "endpoint security is healthy" : "run `codiedev connect`, then repeat this check"}.\n`);
-    return result.ok;
-}
-async function runSecurityCommand(args) {
-    const subcommand = args.find((arg) => !arg.startsWith("-")) ?? "doctor";
-    const json = args.includes("--json");
-    if (args.includes("--help") || args.includes("-h") || subcommand === "help") {
-        console.log(SECURITY_USAGE);
-        return;
-    }
-    const connectedConfig = (0, utils_1.readConfig)();
-    const requiresEntitlement = !["pilot", "self-test"].includes(subcommand);
-    if (requiresEntitlement && (!connectedConfig || !(0, securityFeature_1.isAgentSecurityEnabled)(connectedConfig))) {
-        const detail = connectedConfig
-            ? `Agent Security is not enabled for ${connectedConfig.companyName}.`
-            : "Not connected. Run `codiedev connect` first.";
-        if (json)
-            console.log(JSON.stringify({ schemaVersion: 1, enabled: false, detail }, null, 2));
-        else
-            console.log(`\n${detail}\n`);
-        return;
-    }
-    if (subcommand === "inventory" || subcommand === "scan") {
-        const workspaceFlag = args.indexOf("--workspace");
-        const workspace = workspaceFlag >= 0 && args[workspaceFlag + 1]
-            ? args[workspaceFlag + 1]
-            : process.cwd();
-        const inventory = (0, securityInventory_1.buildSecurityInventory)({ workspace });
-        const deep = subcommand === "scan" && args.includes("--deep")
-            ? (0, securityDeepScan_1.runDeepSecurityScan)(inventory, {
-                workspace,
-                connectMcp: args.includes("--connect-mcp"),
-                supplyChain: args.includes("--supply-chain"),
-            })
-            : undefined;
-        const uploadableInventory = deep ? (0, securityDeepScan_1.mergeDeepScanFindings)(inventory, deep) : inventory;
-        let upload;
-        const config = (0, utils_1.readConfig)();
-        if (config && !args.includes("--no-upload")) {
-            try {
-                upload = await (0, securityInventory_1.uploadSecurityInventory)(uploadableInventory, config);
-            }
-            catch (error) {
-                if (!json)
-                    console.warn(`Inventory upload failed; local scan is still valid: ${error.message}`);
-            }
-        }
-        const output = { inventory: uploadableInventory, scanners: (0, securityInventory_1.scannerAvailability)(), ...(deep ? { deep } : {}), ...(upload ? { upload } : {}) };
-        if (json)
-            console.log(JSON.stringify(output, null, 2));
-        else {
-            const risky = inventory.components.filter((component) => component.findings.length > 0).length;
-            console.log(`\nCodiedev security inventory — ${inventory.components.length} components, ${risky} with local findings, ${inventory.drift.length} changed\n`);
-            const counts = new Map();
-            for (const component of inventory.components)
-                counts.set(component.kind, (counts.get(component.kind) ?? 0) + 1);
-            for (const [kind, count] of [...counts].sort())
-                console.log(`  ${kind}: ${count}`);
-            if (deep)
-                for (const run of deep.runs)
-                    console.log(`  ${run.scanner}: ${run.status} — ${run.detail}`);
-            if (upload)
-                console.log(`\nUploaded ${upload.accepted} component records to the security workspace.`);
-            console.log("\nUse --json for machine-readable hashes and findings. Use scan --deep for installed OSS scanners; --connect-mcp and --supply-chain are explicit because they start or download third-party code.\n");
-        }
-        return;
-    }
-    if (subcommand === "sync") {
-        const config = (0, utils_1.readConfig)();
-        if (!config) {
-            console.error("Not connected. Run `codiedev connect` first.");
-            process.exitCode = 1;
-            return;
-        }
-        try {
-            const policy = await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
-            if (json)
-                console.log(JSON.stringify({ ok: true, policy }, null, 2));
-            else {
-                const verification = (0, securityPolicy_1.verifyEndpointSecurityPolicySignature)(policy);
-                console.log(`Security policy v${policy.policyVersion} synced (${policy.enforcementMode} mode; ${verification.detail}).`);
-            }
-        }
-        catch (error) {
-            console.error(`Security policy sync failed: ${error.message}`);
-            process.exitCode = 1;
-        }
-        return;
-    }
-    if (subcommand === "rollback") {
-        if (!args.includes("--yes")) {
-            console.error("Rollback overwrites the installed agent hook configurations. Re-run with `codiedev security rollback --yes` after confirming the snapshot shown by `codiedev doctor`.");
-            process.exitCode = 1;
-            return;
-        }
-        try {
-            const result = (0, securityInstall_1.restoreSecurityInstallSnapshot)((0, securityInstall_1.readSecurityInstallManifest)());
-            if (json)
-                console.log(JSON.stringify({ schemaVersion: 1, ok: true, ...result }, null, 2));
-            else
-                console.log(`Restored ${result.restored} hook configuration(s) from snapshot ${result.snapshotId}.`);
-        }
-        catch (error) {
-            console.error(`Rollback failed: ${error.message}`);
-            process.exitCode = 1;
-        }
-        return;
-    }
-    const ok = subcommand === "pilot" || subcommand === "self-test"
-        ? printPilot(json)
-        : subcommand === "doctor" || subcommand === "status"
-            ? printDoctor(json, connectedConfig.companyId)
-            : false;
-    if (!["pilot", "self-test", "doctor", "status"].includes(subcommand)) {
-        console.error(SECURITY_USAGE);
-    }
-    if (!ok)
-        process.exitCode = 1;
-}

package/dist/commands/send.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runSend(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/share.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runShare(args: string[], configOverride?: CodiedevConfig): Promise<void>;