codiedev 0.10.0-beta.5 → 0.10.0-beta.6

package/dist/utils.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DIRECT_UPLOAD_THRESHOLD_CHARS = exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.FINISH_ORPHAN_AGE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = exports.CONFIG_PATH = exports.codiedevStateDir = void 0;
+exports.DIRECT_UPLOAD_THRESHOLD_CHARS = exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.FINISH_ORPHAN_AGE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = exports.PI_EXTENSION_SUBCOMMANDS = exports.CONFIG_PATH = exports.codiedevStateDir = exports.piExtensionPath = exports.inspectPiExtension = void 0;
 exports.readConfig = readConfig;
 exports.writeConfig = writeConfig;
 exports.writeConfigAtPath = writeConfigAtPath;
@@ -64,6 +64,11 @@ exports.cursorInstalled = cursorInstalled;
 exports.copilotInstalled = copilotInstalled;
 exports.openCodeInstalled = openCodeInstalled;
 exports.installOpenCodeCapturePlugin = installOpenCodeCapturePlugin;
+exports.ensureOpenCodePluginCurrent = ensureOpenCodePluginCurrent;
+exports.piInstalled = piInstalled;
+exports.piExtensionSource = piExtensionSource;
+exports.installPiExtension = installPiExtension;
+exports.ensurePiExtensionInstalled = ensurePiExtensionInstalled;
 exports.vscodeCopilotInstalled = vscodeCopilotInstalled;
 exports.upsertCodiedevHook = upsertCodiedevHook;
 exports.removeCodiedevHook = removeCodiedevHook;
@@ -78,8 +83,12 @@ exports.ensureSessionStartHookInstalled = ensureSessionStartHookInstalled;
 exports.installClaudeCodeInstructions = installClaudeCodeInstructions;
 exports.installCodexInstructions = installCodexInstructions;
 exports.copilotInstructionsPath = copilotInstructionsPath;
+exports.piInstructionsPath = piInstructionsPath;
+exports.installPiInstructions = installPiInstructions;
 exports.installCopilotInstructions = installCopilotInstructions;
 exports.installCursorInstructions = installCursorInstructions;
+exports.installedInstructionsTargets = installedInstructionsTargets;
+exports.refreshInstalledInstructions = refreshInstalledInstructions;
 exports.installClaudeCodeMcp = installClaudeCodeMcp;
 exports.installCursorMcp = installCursorMcp;
 exports.installVSCodeMcp = installVSCodeMcp;
@@ -139,6 +148,10 @@ const teamSkillContext_1 = require("./teamSkillContext");
 const nativeSteering_1 = require("./nativeSteering");
 const copilotHooks_1 = require("./copilotHooks");
 const harnessDirs_1 = require("./harnessDirs");
+const piHooks_1 = require("./piHooks");
+var piHooks_2 = require("./piHooks");
+Object.defineProperty(exports, "inspectPiExtension", { enumerable: true, get: function () { return piHooks_2.inspectPiExtension; } });
+Object.defineProperty(exports, "piExtensionPath", { enumerable: true, get: function () { return piHooks_2.piExtensionPath; } });
 const CONFIG_DIR = (0, configDir_1.codiedevStateDir)();
 exports.CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 function readConfig() {
@@ -885,29 +898,21 @@ function openCodeInstalled() {
         return false;
     }
 }
-function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
+function installOpenCodeCapturePlugin() {
     const start = resolveHookInvocation("session-start-opencode");
     const capture = resolveHookInvocation("capture-opencode");
     const finish = resolveHookInvocation("capture-opencode-final");
     const backup = resolveHookInvocation("backup");
     const prompt = resolveHookInvocation("discover-codie");
-    const securityPre = resolveHookInvocation("security-pre-codie");
-    const securityPost = resolveHookInvocation("security-post-codie");
-    const securityFailure = resolveHookInvocation("security-failure-codie");
     const source = `// Managed by codiedev connect. Safe to remove and reinstall.\n` +
         `import { spawn, spawnSync } from "node:child_process";\n` +
         `import { mkdirSync, writeFileSync, renameSync } from "node:fs";\n` +
         `import os from "node:os";\n` +
         `import path from "node:path";\n\n` +
         `const START = ${JSON.stringify(start)};\n` +
-        `const CAPTURE = ${JSON.stringify(capture)};\n` +
         `const FINISH = ${JSON.stringify(finish)};\n` +
         `const BACKUP = ${JSON.stringify(backup)};\n` +
         `const PROMPT = ${JSON.stringify(prompt)};\n` +
-        `const SECURITY_PRE = ${JSON.stringify(securityPre)};\n` +
-        `const SECURITY_POST = ${JSON.stringify(securityPost)};\n` +
-        `const SECURITY_FAILURE = ${JSON.stringify(securityFailure)};\n` +
-        `const AGENT_SECURITY_ENABLED = ${JSON.stringify(agentSecurityEnabled)};\n` +
         `// How this Codie process was started (run / serve / tui). OpenCode records\n` +
         `// nothing about it, so the plugin reads its own argv; see launchContext.ts.\n` +
         `const LAUNCH = (() => { const sub = process.argv.slice(2).find((a) => ["run", "serve", "acp", "web", "attach"].includes(a)); return sub ? "codie:" + sub : "codie:tui"; })();\n` +
@@ -935,20 +940,6 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `  } catch { return null; }\n` +
         `}\n\n` +
         `export const CodiedevCapture = async ({ client, directory, worktree }) => {\n` +
-        `  const enforce = async (invocation, payload) => {\n` +
-        `    const decision = invokeSync(invocation, payload);\n` +
-        `    const denied = decision?.decision === "block" || decision?.hookSpecificOutput?.permissionDecision === "deny";\n` +
-        `    const reason = denied ? (decision?.reason || decision?.hookSpecificOutput?.permissionDecisionReason || "Codie security policy blocked this action") : null;\n` +
-        `    if (!reason) return decision;\n` +
-        `    try { await client.tui.showToast({ title: "Codie Security", message: reason, variant: "error", duration: 10000 }); } catch {}\n` +
-        `    if (process.env.CODIEDEV_SECURITY_BLOCK_OUTPUT === "marker") {\n` +
-        `      process.stderr.write("__CODIEDEV_SECURITY_BLOCK__" + JSON.stringify({ reason }) + "\\n");\n` +
-        `      process.exit(1);\n` +
-        `    } else {\n` +
-        `      process.stderr.write("\\nCodie Security blocked this action:\\n" + reason + "\\n");\n` +
-        `    }\n` +
-        `    throw new Error(reason);\n` +
-        `  };\n` +
         `  const resolveCwd = async (id, hint) => {\n` +
         `    if (typeof hint === "string" && hint && hint !== "/") { sessionDirectories.set(id, hint); return hint; }\n` +
         `    const remembered = sessionDirectories.get(id);\n` +
@@ -974,7 +965,7 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
         `    const cwd = await resolveCwd(id);\n` +
         `    const prompt = Array.isArray(output?.parts) ? output.parts.filter((part) => part?.type === "text").map((part) => part.text || "").join("\\n") : "";\n` +
-        `    const decision = await enforce(PROMPT, { session_id: id, cwd, prompt });\n` +
+        `    const decision = invokeSync(PROMPT, { session_id: id, cwd, prompt });\n` +
         `    const context = decision?.hookSpecificOutput?.additionalContext;\n` +
         `    if (context && Array.isArray(output?.parts)) {\n` +
         `      // Preserve the native part IDs required by current engine schemas.\n` +
@@ -982,19 +973,6 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `      if (part) part.text += "\\n\\n" + context;\n` +
         `    }\n` +
         `  },\n` +
-        `  "tool.execute.before": async (input, output) => {\n` +
-        `    if (!AGENT_SECURITY_ENABLED) return;\n` +
-        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
-        `    const cwd = await resolveCwd(id);\n` +
-        `    await enforce(SECURITY_PRE, { sessionId: id, cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: output?.args ?? output });\n` +
-        `  },\n` +
-        `  "tool.execute.after": async (input, output) => {\n` +
-        `    if (!AGENT_SECURITY_ENABLED) return;\n` +
-        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
-        `    const cwd = await resolveCwd(id);\n` +
-        `    const payload = { sessionId: id, cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: input?.args, toolResponse: output };\n` +
-        `    dispatch(output?.error ? SECURITY_FAILURE : SECURITY_POST, payload);\n` +
-        `  },\n` +
         `  event: async ({ event }) => {\n` +
         `    const id = sessionId(event);\n` +
         `    if (!id) return;\n` +
@@ -1040,6 +1018,140 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
     fs.writeFileSync(OPENCODE_PLUGIN_PATH, source, { encoding: "utf8", mode: 0o600 });
     fs.chmodSync(OPENCODE_PLUGIN_PATH, 0o600);
 }
+function ensureOpenCodePluginCurrent() {
+    try {
+        if (!fs.existsSync(OPENCODE_PLUGIN_PATH))
+            return;
+        if (!fs.readFileSync(OPENCODE_PLUGIN_PATH, "utf8").includes("SECURITY_PRE"))
+            return;
+        installOpenCodeCapturePlugin();
+    }
+    catch { }
+}
+function piInstalled() {
+    if (fs.existsSync((0, harnessDirs_1.piAgentDir)()))
+        return true;
+    try {
+        (0, child_process_1.execSync)(process.platform === "win32" ? "where pi" : "command -v pi", { stdio: ["pipe", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+exports.PI_EXTENSION_SUBCOMMANDS = [
+    "session-start-pi", "backup-pi", "capture-pi-final", "discover-pi",
+];
+function piExtensionSource() {
+    const [start, backup, finish, prompt] = exports.PI_EXTENSION_SUBCOMMANDS.map((subcommand) => resolveHookInvocation(subcommand));
+    return `// Managed by codiedev connect. Safe to remove; \`codiedev connect\` reinstalls it.\n` +
+        `import { spawn, spawnSync } from "node:child_process";\n\n` +
+        `const START = ${JSON.stringify(start)};\n` +
+        `const FINISH = ${JSON.stringify(finish)};\n` +
+        `const BACKUP = ${JSON.stringify(backup)};\n` +
+        `const PROMPT = ${JSON.stringify(prompt)};\n` +
+        `const CONTEXT_TYPE = ${JSON.stringify(piHooks_1.PI_CONTEXT_CUSTOM_TYPE)};\n` +
+        `const piLaunchFromArgv = ${piHooks_1.piLaunchFromArgv.toString()};\n` +
+        `const LAUNCH = piLaunchFromArgv(process.argv.slice(2));\n\n` +
+        `function dispatch(invocation, payload) {\n` +
+        `  try {\n` +
+        `    const child = spawn(invocation.command, invocation.args, { detached: true, stdio: ["pipe", "ignore", "ignore"] });\n` +
+        `    child.stdin.end(JSON.stringify(payload));\n` +
+        `    child.unref();\n` +
+        `  } catch {}\n` +
+        `}\n\n` +
+        `function dispatchSync(invocation, payload) {\n` +
+        `  try { spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), stdio: ["pipe", "ignore", "ignore"], timeout: 1500 }); } catch {}\n` +
+        `}\n\n` +
+        `function invokeSync(invocation, payload) {\n` +
+        `  try {\n` +
+        `    const result = spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), encoding: "utf8", stdio: ["pipe", "pipe", "ignore"], timeout: 1500 });\n` +
+        `    if (result.error) return null;\n` +
+        `    return JSON.parse(result.stdout || "{}");\n` +
+        `  } catch { return null; }\n` +
+        `}\n\n` +
+        `export default function codiedev(pi) {\n` +
+        `  let session = null;\n` +
+        `  let pendingContext = null;\n` +
+        `  let finalized = false;\n` +
+        `  const current = (ctx) => {\n` +
+        `    const sm = ctx?.sessionManager;\n` +
+        `    const id = sm?.getSessionId?.() ?? session?.id;\n` +
+        `    const file = sm?.getSessionFile?.() ?? session?.file;\n` +
+        `    const cwd = ctx?.cwd || session?.cwd || process.cwd();\n` +
+        `    session = { id, file, cwd };\n` +
+        `    return session;\n` +
+        `  };\n` +
+        `  const payload = (s, extra) => ({ session_id: s.id, transcript_path: s.file, cwd: s.cwd, workspace_roots: [s.cwd], launch: LAUNCH, ...extra });\n` +
+        `  const finalize = () => {\n` +
+        `    // No file (pi --no-session) still finalizes: the hook reports a skip, so\n` +
+        `    // the start ping is not left open.\n` +
+        `    if (finalized || !session?.id) return;\n` +
+        `    finalized = true;\n` +
+        `    dispatchSync(FINISH, payload(session));\n` +
+        `  };\n` +
+        `  // Print mode can exit without a shutdown event; the session is still over.\n` +
+        `  // pi rebuilds extensions on every /new, /resume and /fork, so register one\n` +
+        `  // exit hook per process and point it at the newest instance.\n` +
+        `  globalThis.__codiedevPiFinalize = finalize;\n` +
+        `  if (!globalThis.__codiedevPiExitHook) {\n` +
+        `    globalThis.__codiedevPiExitHook = true;\n` +
+        `    process.once("exit", () => globalThis.__codiedevPiFinalize?.());\n` +
+        `  }\n\n` +
+        `  pi.on("session_start", async (event, ctx) => {\n` +
+        `    finalized = false;\n` +
+        `    if (event?.reason === "reload") { current(ctx); return; }\n` +
+        `    const s = current(ctx);\n` +
+        `    // pi can announce one new session twice across an extension rebind.\n` +
+        `    if (!s.id || globalThis.__codiedevPiStarted === s.id) return;\n` +
+        `    globalThis.__codiedevPiStarted = s.id;\n` +
+        `    dispatch(START, payload(s));\n` +
+        `  });\n\n` +
+        `  pi.on("input", async (event, ctx) => {\n` +
+        `    if (event?.source === "extension") return { action: "continue" };\n` +
+        `    const s = current(ctx);\n` +
+        `    const decision = invokeSync(PROMPT, { session_id: s.id, cwd: s.cwd, prompt: event?.text ?? "" });\n` +
+        `    pendingContext = decision?.hookSpecificOutput?.additionalContext || null;\n` +
+        `    return { action: "continue" };\n` +
+        `  });\n\n` +
+        `  pi.on("before_agent_start", async () => {\n` +
+        `    if (!pendingContext) return;\n` +
+        `    const content = pendingContext;\n` +
+        `    pendingContext = null;\n` +
+        `    return { message: { customType: CONTEXT_TYPE, content, display: false } };\n` +
+        `  });\n\n` +
+        `  pi.on("agent_end", async (_event, ctx) => {\n` +
+        `    const s = current(ctx);\n` +
+        `    if (!s.id || !s.file) return;\n` +
+        `    // Interim capture + artifact backup, like every harness's Stop hook. pi\n` +
+        `    // retries provider errors itself; agent_end comes after the last try, so\n` +
+        `    // the capture reports a hit limit once per run, not once per retry.\n` +
+        `    dispatch(BACKUP, payload(s));\n` +
+        `  });\n\n` +
+        `  pi.on("session_shutdown", async (event, ctx) => {\n` +
+        `    // A reload keeps the same session running.\n` +
+        `    if (event?.reason === "reload") return;\n` +
+        `    current(ctx);\n` +
+        `    finalize();\n` +
+        `  });\n` +
+        `}\n`;
+}
+function installPiExtension() {
+    const target = (0, piHooks_1.piExtensionPath)();
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const tmp = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, piExtensionSource(), { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(tmp, target);
+}
+function ensurePiExtensionInstalled() {
+    try {
+        const file = (0, piHooks_1.piExtensionPath)();
+        if (fs.existsSync(file) && fs.readFileSync(file, "utf8") === piExtensionSource())
+            return;
+        installPiExtension();
+    }
+    catch { }
+}
 function vscodeCopilotInstalled() {
     if (!fs.existsSync(VSCODE_EXTENSIONS_DIR))
         return false;
@@ -1108,7 +1220,8 @@ function removeCodiedevHook(hooks, eventName) {
         hooks[eventName] = filtered;
     return true;
 }
-function installHook(agentSecurityEnabled = true) {
+const RETIRED_SECURITY_TOOL_EVENTS = ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
+function installHook() {
     let settings = {};
     try {
         if (fs.existsSync(CLAUDE_SETTINGS_PATH)) {
@@ -1123,16 +1236,8 @@ function installHook(agentSecurityEnabled = true) {
     }
     const hooks = settings.hooks;
     upsertCodiedevHook(hooks, "SessionEnd", "capture");
-    if (agentSecurityEnabled) {
-        upsertCodiedevHook(hooks, "PreToolUse", "security-pre");
-        upsertCodiedevHook(hooks, "PostToolUse", "security-post");
-        upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure");
-    }
-    else {
-        removeCodiedevHook(hooks, "PreToolUse");
-        removeCodiedevHook(hooks, "PostToolUse");
-        removeCodiedevHook(hooks, "PostToolUseFailure");
-    }
+    for (const eventName of RETIRED_SECURITY_TOOL_EVENTS)
+        removeCodiedevHook(hooks, eventName);
     upsertCodiedevHook(hooks, "UserPromptSubmit", "discover");
     upsertCodiedevHook(hooks, "Stop", "backup");
     upsertCodiedevHook(hooks, "StopFailure", "limit", "rate_limit");
@@ -1202,7 +1307,7 @@ function ensureLimitHookInstalled() {
     }
     catch { }
 }
-function ensureAllCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?.agentSecurityEnabled === true) {
+function ensureAllCodiedevHooksInstalled() {
     try {
         if (!fs.existsSync(CLAUDE_SETTINGS_PATH))
             return;
@@ -1215,14 +1320,9 @@ function ensureAllCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?.ag
             ["StopFailure", "limit", "rate_limit"],
             ["SessionStart", "session-start"],
         ];
-        if (agentSecurityEnabled) {
-            wanted.splice(1, 0, ["PreToolUse", "security-pre"], ["PostToolUse", "security-post"], ["PostToolUseFailure", "security-failure"]);
-        }
         let changed = false;
-        if (!agentSecurityEnabled) {
-            for (const eventName of ["PreToolUse", "PostToolUse", "PostToolUseFailure"]) {
-                changed = removeCodiedevHook(hooks, eventName) || changed;
-            }
+        for (const eventName of RETIRED_SECURITY_TOOL_EVENTS) {
+            changed = removeCodiedevHook(hooks, eventName) || changed;
         }
         const missing = wanted.filter(([eventName]) => !hasCodiedevHook(hooks, eventName));
         if (missing.length === 0 && !changed)
@@ -1240,16 +1340,17 @@ const DIRECT_HOOK_PATH = /codiedev[^"'\s/\\]*[\\/]+dist[\\/]+hook\.js/;
 function hasDirectHookPath(configText) {
     return DIRECT_HOOK_PATH.test(configText);
 }
-function migrateHooksToLauncher(agentSecurityEnabled = readConfig()?.agentSecurityEnabled === true) {
+function migrateHooksToLauncher() {
     const probe = resolveHookInvocation("session-start");
     if (!(0, launcher_1.usesLauncher)(probe.args[0]))
         return [];
     const targets = [
-        ["claude-code", CLAUDE_SETTINGS_PATH, () => installHook(agentSecurityEnabled)],
-        ["codex", CODEX_HOOKS_PATH, () => installCodexHook(agentSecurityEnabled)],
-        ["cursor", CURSOR_HOOKS_PATH, () => installCursorHook(agentSecurityEnabled)],
-        ["copilot", copilotHooksPath(), () => installCopilotHook(agentSecurityEnabled)],
-        ["opencode", OPENCODE_PLUGIN_PATH, () => installOpenCodeCapturePlugin(agentSecurityEnabled)],
+        ["claude-code", CLAUDE_SETTINGS_PATH, () => installHook()],
+        ["codex", CODEX_HOOKS_PATH, () => installCodexHook()],
+        ["cursor", CURSOR_HOOKS_PATH, () => installCursorHook()],
+        ["copilot", copilotHooksPath(), () => installCopilotHook()],
+        ["opencode", OPENCODE_PLUGIN_PATH, () => installOpenCodeCapturePlugin()],
+        ["pi", (0, piHooks_1.piExtensionPath)(), () => installPiExtension()],
     ];
     const migrated = [];
     for (const [name, file, install] of targets) {
@@ -1321,15 +1422,20 @@ but does not install a global \`codiedev\` executable.
 | "any messages?" / "check my inbox" / "what did a teammate say?" | \`codiedev inbox\` |
 | "read that reply" / "mark that ping read" | \`codiedev read <ping-id>\` |
 | "note that X is a follow-up" / "remember X" | \`codiedev note "<text>"\` |
-| "promote the extracted spec" | \`codiedev promote <artifact-id>\` |
 | "create a ticket" / "scope this into tickets" / "ticket this for me" | \`codiedev create-ticket [optional-inline-prompt]\` |
 | "share with a teammate" / "give someone access" (no notification) | \`codiedev share <key> <name> [--role read\\|edit]\` |
 | "send this to a teammate" / "ask someone to look at this" | \`codiedev send <key> <name> ["<msg>"]\` |
 | "find something about X" / "has anyone solved Y?" | \`codiedev search "<query>" [--limit N]\` |
 | "why did we…?" / "what does the team know about X?" | \`codiedev ask "<question>"\` (synthesized answer + citations) |
 | "show my library" / "what artifacts exist?" | \`codiedev library [--scope mine\\|shared\\|all] [--kind doc\\|skill]\` |
-| "react 🛠 to that post" / "mark as used" | \`codiedev react <postId> <emoji>\` |
-| "run my agent's test cases" / "check the suite on model Y" | \`codiedev traces cases <agent> [--suite <name>] [--model <id>]\` (writes cases + RUN_CASES.md + results.json; follow it, then \`codiedev traces report <results.json>\`) |
+| "run my agent's test cases" / "check the dataset on model Y" / "run v2 of the dataset" | \`codiedev traces cases <agent> [--dataset <name> [--version <n>]] [--model <id>]\` (writes cases + RUN_CASES.md + results.json; follow it, then \`codiedev traces report <results.json>\`) |
+| "how are my agents doing?" / "what's failing this week?" / "show the booking agent's failed runs" / "why did run X fail?" | \`codiedev traces overview\`; \`codiedev traces runs <agent> [--failed] [--flag <issue>] [--days n]\`; \`codiedev traces run <run> --agent <name>\` (add \`--json\` to read the data yourself) |
+| "add a helpfulness 1–5 score" / "make a review queue for tone" | \`codiedev traces score-kinds add <name> --type number --min 1 --max 5\`; \`codiedev traces queue create <name> --scores <a,b>\` |
+| "score that run 4 for helpfulness" / "how is my agent scoring?" | \`codiedev traces score <run> <score> <value> [--agent <name>] [--comment <why>]\`; \`codiedev traces scores <agent>\` |
+| "put this week's failed runs in the review queue" | \`codiedev traces queue list\`; \`codiedev traces queue add <queue> --agent <name> [--failed] [--days n]\` |
+| "have a judge score 10% of my agent's runs" / "turn off automatic scoring" | \`codiedev traces judge <agent> --on --scores <a,b> --sample 10 [--budget 25]\`; \`--off\`; no flags shows it |
+| "import these test cases from a CSV" / "add an example to the dataset" / "save the dataset as a version" | \`codiedev traces import <agent> <file> --dataset <name>\`; \`codiedev traces add-example <agent> --dataset <name> --input "…" [--expected "…"]\`; \`codiedev traces save-version <dataset>\`; \`codiedev traces versions <dataset>\` |
+| "what was the last eval on X?" / "file these eval results" | \`codiedev evals last <subject>\` before starting a related eval; \`codiedev evals report <run.json>\` after each variant runs (scores only — \`codiedev evals help\` for the shape) |
 
 **Just push the file — we'll figure out where it goes.** Every artifact
 is classified into one of two kinds at upload time:
@@ -1413,6 +1519,12 @@ function installCodexInstructions() {
 function copilotInstructionsPath() {
     return path.join((0, copilotHooks_1.copilotHome)(), "copilot-instructions.md");
 }
+function piInstructionsPath() {
+    return path.join((0, harnessDirs_1.piAgentDir)(), "AGENTS.md");
+}
+function installPiInstructions() {
+    writeInstructionsBlock(piInstructionsPath(), `${teamSkillContext_1.TEAM_SKILL_CONTEXT}\n\n${CODIEDEV_INSTRUCTIONS_BODY}`);
+}
 function installCopilotInstructions() {
     writeInstructionsBlock(copilotInstructionsPath(), `${teamSkillContext_1.TEAM_SKILL_CONTEXT}\n\n${CODIEDEV_INSTRUCTIONS_BODY}`);
 }
@@ -1455,6 +1567,38 @@ function installCursorInstructions() {
     }
     fs.writeFileSync(CURSOR_RULES_PATH, next, "utf8");
 }
+function installedInstructionsTargets() {
+    const withTeamContext = `${teamSkillContext_1.TEAM_SKILL_CONTEXT}\n\n${CODIEDEV_INSTRUCTIONS_BODY}`;
+    return [
+        { path: CLAUDE_USER_INSTRUCTIONS_PATH, body: CODIEDEV_INSTRUCTIONS_BODY },
+        { path: CODEX_USER_INSTRUCTIONS_PATH, body: CODIEDEV_INSTRUCTIONS_BODY },
+        { path: copilotInstructionsPath(), body: withTeamContext },
+        { path: CURSOR_RULES_PATH, body: withTeamContext },
+        { path: piInstructionsPath(), body: withTeamContext },
+    ];
+}
+function refreshInstalledInstructions(targets = installedInstructionsTargets()) {
+    const refreshed = [];
+    for (const target of targets) {
+        try {
+            const existing = fs.readFileSync(target.path, "utf8");
+            const beginIdx = existing.indexOf(CODIEDEV_INSTRUCTIONS_BEGIN);
+            const endIdx = existing.indexOf(CODIEDEV_INSTRUCTIONS_END);
+            if (beginIdx === -1 || endIdx === -1 || endIdx <= beginIdx)
+                continue;
+            const next = existing.slice(0, beginIdx) +
+                `${CODIEDEV_INSTRUCTIONS_BEGIN}\n${target.body}\n${CODIEDEV_INSTRUCTIONS_END}` +
+                existing.slice(endIdx + CODIEDEV_INSTRUCTIONS_END.length);
+            if (next === existing)
+                continue;
+            fs.writeFileSync(target.path, next, "utf8");
+            refreshed.push(target.path);
+        }
+        catch {
+        }
+    }
+    return refreshed;
+}
 function readMcpConfigSafely(path) {
     if (!fs.existsSync(path))
         return {};
@@ -1595,7 +1739,7 @@ function installCodexMcp() {
     fs.writeFileSync(CODEX_CONFIG_PATH, existing + block, "utf8");
     return true;
 }
-function installCodexHook(agentSecurityEnabled = true) {
+function installCodexHook() {
     let hooksFile = {};
     try {
         if (fs.existsSync(CODEX_HOOKS_PATH)) {
@@ -1646,16 +1790,8 @@ function installCodexHook(agentSecurityEnabled = true) {
         ],
     });
     hooks.Stop = filtered;
-    if (agentSecurityEnabled) {
-        upsertCodiedevHook(hooks, "PreToolUse", "security-pre-codex");
-        upsertCodiedevHook(hooks, "PostToolUse", "security-post-codex");
-        upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure-codex");
-    }
-    else {
-        removeCodiedevHook(hooks, "PreToolUse");
-        removeCodiedevHook(hooks, "PostToolUse");
-        removeCodiedevHook(hooks, "PostToolUseFailure");
-    }
+    for (const eventName of RETIRED_SECURITY_TOOL_EVENTS)
+        removeCodiedevHook(hooks, eventName);
     upsertCodiedevHook(hooks, "UserPromptSubmit", "discover-codex", null);
     if (!fs.existsSync(CODEX_DIR)) {
         fs.mkdirSync(CODEX_DIR, { recursive: true });
@@ -1679,6 +1815,9 @@ function ensureCodexLimitHookInstalled() {
             return Array.isArray(inner) && inner.some((hook) => typeof hook.command === "string" && hook.command.trim().endsWith(subcommand));
         });
         let changed = false;
+        for (const eventName of RETIRED_SECURITY_TOOL_EVENTS) {
+            changed = removeCodiedevHook(hooks, eventName) || changed;
+        }
         if (!hasCommand(stop, "limit-codex")) {
             stop.unshift({
                 hooks: [{ type: "command", command: resolveHookCommand("limit-codex"), timeout: 10 }],
@@ -1702,7 +1841,7 @@ function ensureCodexLimitHookInstalled() {
     catch {
     }
 }
-function installCursorHook(agentSecurityEnabled = true) {
+function installCursorHook() {
     if (!fs.existsSync(CURSOR_DIR)) {
         fs.mkdirSync(CURSOR_DIR, { recursive: true });
     }
@@ -1743,40 +1882,26 @@ function installCursorHook(agentSecurityEnabled = true) {
     replaceManaged("stop", ["backup-cursor"]);
     replaceManaged("subagentStart", ["observe-cursor"]);
     replaceManaged("subagentStop", ["observe-cursor"]);
-    if (agentSecurityEnabled) {
-        replaceManaged("beforeSubmitPrompt", ["security-prompt-cursor"]);
-        replaceManaged("preToolUse", ["security-pre-cursor"]);
-        replaceManaged("postToolUse", ["observe-cursor", "security-post-cursor"]);
-        replaceManaged("postToolUseFailure", ["observe-cursor", "security-failure-cursor"]);
-    }
-    else {
-        replaceManaged("beforeSubmitPrompt", []);
-        replaceManaged("preToolUse", []);
-        replaceManaged("postToolUse", ["observe-cursor"]);
-        replaceManaged("postToolUseFailure", ["observe-cursor"]);
-    }
+    replaceManaged("beforeSubmitPrompt", []);
+    replaceManaged("preToolUse", []);
+    replaceManaged("postToolUse", ["observe-cursor"]);
+    replaceManaged("postToolUseFailure", ["observe-cursor"]);
     fs.writeFileSync(CURSOR_HOOKS_PATH, JSON.stringify(hooksFile, null, 2), "utf8");
 }
 function copilotHooksPath() {
     return path.join((0, copilotHooks_1.copilotHome)(), "hooks", "codiedev.json");
 }
-function copilotManagedHooks(agentSecurityEnabled) {
+function copilotManagedHooks() {
     return [
         ["sessionStart", "session-start-copilot", 10],
         ["userPromptSubmitted", "discover-copilot", 10],
         ["agentStop", "backup-copilot", 30],
         ["sessionEnd", "capture-copilot", 30],
         ["errorOccurred", "limit-copilot", 10],
-        ...(agentSecurityEnabled
-            ? [
-                ["preToolUse", "security-pre-copilot", 10],
-                ["postToolUse", "security-post-copilot", 10],
-            ]
-            : []),
     ];
 }
 const COPILOT_EVENTS = ["sessionStart", "userPromptSubmitted", "agentStop", "sessionEnd", "preToolUse", "postToolUse", "errorOccurred"];
-function installCopilotHook(agentSecurityEnabled = false) {
+function installCopilotHook() {
     const hooksPath = copilotHooksPath();
     let hooksFile = {};
     try {
@@ -1790,7 +1915,7 @@ function installCopilotHook(agentSecurityEnabled = false) {
     }
     hooksFile.version = 1;
     const hooks = (hooksFile.hooks && typeof hooksFile.hooks === "object" ? hooksFile.hooks : {});
-    const managed = copilotManagedHooks(agentSecurityEnabled);
+    const managed = copilotManagedHooks();
     for (const eventName of COPILOT_EVENTS) {
         const existing = Array.isArray(hooks[eventName]) ? hooks[eventName] : [];
         const preserved = existing.filter((hook) => !(0, detection_1.isCodiedevHookCommand)((hook.bash ?? hook.powershell ?? hook.command)));
@@ -1809,7 +1934,7 @@ function installCopilotHook(agentSecurityEnabled = false) {
     fs.mkdirSync(path.dirname(hooksPath), { recursive: true });
     fs.writeFileSync(hooksPath, JSON.stringify(hooksFile, null, 2), "utf8");
 }
-function ensureCopilotCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?.agentSecurityEnabled === true) {
+function ensureCopilotCodiedevHooksInstalled() {
     try {
         const hooksPath = copilotHooksPath();
         if (!fs.existsSync(hooksPath))
@@ -1819,17 +1944,17 @@ function ensureCopilotCodiedevHooksInstalled(agentSecurityEnabled = readConfig()
         const commandsFor = (eventName) => (Array.isArray(hooks[eventName]) ? hooks[eventName] : [])
             .map((entry) => (entry.bash ?? entry.powershell ?? entry.command))
             .filter((command) => typeof command === "string" && (0, detection_1.isCodiedevHookCommand)(command));
-        const required = copilotManagedHooks(agentSecurityEnabled);
+        const required = copilotManagedHooks();
         const complete = required.every(([eventName, subcommand]) => commandsFor(eventName).filter((command) => command.trim().endsWith(subcommand)).length === 1);
         const stale = COPILOT_EVENTS.some((eventName) => commandsFor(eventName).length !== required.filter(([event]) => event === eventName).length);
         if (complete && !stale)
             return;
-        installCopilotHook(agentSecurityEnabled);
+        installCopilotHook();
     }
     catch {
     }
 }
-function ensureCursorCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?.agentSecurityEnabled === true) {
+function ensureCursorCodiedevHooksInstalled() {
     try {
         if (!fs.existsSync(CURSOR_HOOKS_PATH))
             return;
@@ -1852,16 +1977,8 @@ function ensureCursorCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?
             ["postToolUseFailure", "observe-cursor"],
             ["subagentStart", "observe-cursor"],
             ["subagentStop", "observe-cursor"],
-            ...(agentSecurityEnabled
-                ? [
-                    ["beforeSubmitPrompt", "security-prompt-cursor"],
-                    ["preToolUse", "security-pre-cursor"],
-                    ["postToolUse", "security-post-cursor"],
-                    ["postToolUseFailure", "security-failure-cursor"],
-                ]
-                : []),
         ];
-        const hasStaleSecurity = !agentSecurityEnabled && [
+        const hasStaleSecurity = [
             "beforeSubmitPrompt", "preToolUse", "postToolUse", "postToolUseFailure",
         ].some((eventName) => {
             const entries = hooks[eventName];
@@ -1871,7 +1988,7 @@ function ensureCursorCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?
         if (required.every(([eventName, subcommand]) => has(eventName, subcommand)) && !hasStaleSecurity) {
             return;
         }
-        installCursorHook(agentSecurityEnabled);
+        installCursorHook();
     }
     catch {
     }
@@ -2360,9 +2477,9 @@ function sweepPendingCaptures(deps) {
 exports.CAPTURE_THROTTLE_MS = 10 * 60 * 1000;
 exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS + 2 * 60 * 1000;
 function resolveCaptureFinal(argv2) {
-    if (argv2 === "capture-opencode" || argv2 === "capture-desktop")
+    if (argv2 === "capture-opencode" || argv2 === "capture-desktop" || argv2 === "capture-pi")
         return false;
-    if (argv2 === "capture-opencode-final" || argv2 === "capture-desktop-final")
+    if (argv2 === "capture-opencode-final" || argv2 === "capture-desktop-final" || argv2 === "capture-pi-final")
         return true;
     return argv2 === "capture" || argv2 === "capture-cursor" || argv2 === "capture-copilot" || argv2 === undefined
         ? true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.10.0-beta.5",
+  "version": "0.10.0-beta.6",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration \u2014 and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,14 +12,12 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
-    "test:functional": "vitest run src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts",
-    "test:harness-parity": "vitest run src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts",
+    "test:functional": "vitest run src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:harness-parity": "vitest run src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
     "test:harness-binaries": "node scripts/checkHarnessBinaries.mjs",
-    "test:security-beta": "vitest run src/__tests__/security.test.ts src/__tests__/securityCommandEntitlement.test.ts src/__tests__/securityDeepScan.test.ts src/__tests__/securityDoctor.test.ts src/__tests__/securityEntitlementInstall.test.ts src/__tests__/securityFeature.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityInventory.test.ts src/__tests__/securityPilot.test.ts src/__tests__/securityPolicy.test.ts src/__tests__/securitySession.test.ts src/__tests__/codexHookTrust.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts src/__tests__/limitEvent.functional.test.ts && tsc && node dist/cli.js security pilot --json",
-    "test:security-pilot": "vitest run src/__tests__/security.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityPilot.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
     "test:opencode-attribution": "vitest run src/__tests__/repoResolver.test.ts src/__tests__/openCodeCapture.test.ts src/__tests__/openCodePluginGitRefs.test.ts src/__tests__/capturePayloadFinal.test.ts src/__tests__/captureDirectUpload.test.ts src/__tests__/resolveCaptureFinal.test.ts && tsc",
     "test:watch": "vitest",
-    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts"
+    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts"
   },
   "files": [
     "dist",
@@ -64,7 +62,7 @@
     "@modelcontextprotocol/sdk": "^1.30.0"
   },
   "overrides": {
-    "@hono/node-server": "^2.0.12",
+    "@hono/node-server": "^2.1.5",
     "ip-address": "^10.7.4",
     "esbuild": "^0.28.1"
   }