codiedev 0.10.0-beta.5 → 0.10.0-beta.7

package/README.md

@@ -18,7 +18,7 @@ The CLI will prompt you for an API token (get one at https://codiedev.com/portal
 
 - **Claude Code** — `SessionEnd` hook in `~/.claude/settings.json`
 - **Codex** — `Stop` hook in `~/.codex/hooks.json`
-- **Cursor** — native session, prompt-security, tool-security, backup, and capture hooks in `~/.cursor/hooks.json`
+- **Cursor** — native session, subagent/tool observation, backup, and capture hooks in `~/.cursor/hooks.json`
 - **OpenCode / Codie** — plugin in `~/.config/opencode/plugins/codiedev.js`
 
 Installed clients are wired automatically. The OpenCode adapter is staged even
@@ -57,9 +57,9 @@ Codex doesn't currently expose a `SessionEnd` event, so the hook runs on `Stop`
 
 ## Cursor note
 
-Cursor uses its native hook events for session start/end, prompt blocking,
-pre/post-tool security, and stop-time backup. Cursor's `beforeSubmitPrompt`
-cannot inject dynamic context today, so task-specific discovery is not claimed.
+Cursor uses its native hook events for session start/end, tool and subagent
+observation, and stop-time backup. Cursor's `beforeSubmitPrompt` cannot inject
+dynamic context today, so task-specific discovery is not claimed.
 Cursor sessions keep their source
 label and real transcript statistics through the shared capture pipeline.
 

package/dist/captureSignals.js

@@ -102,6 +102,8 @@ function parseCaptureSignals(content, source) {
         }
         if (e.type === "copilot.skill_invoked")
             addSkill(invocations, e.skill);
+        if (e.type === "pi.skill_invoked")
+            addSkill(invocations, e.skill);
         if (e.type === "copilot.usage_summary") {
             if (typeof e.premiumRequests === "number" && e.premiumRequests >= 0)
                 premiumRequests = e.premiumRequests;

package/dist/cli.js

@@ -9,19 +9,17 @@ const ask_1 = require("./commands/ask");
 const ping_1 = require("./commands/ping");
 const inbox_1 = require("./commands/inbox");
 const note_1 = require("./commands/note");
-const promote_1 = require("./commands/promote");
-const reverseTicket_1 = require("./commands/reverseTicket");
 const createTicket_1 = require("./commands/createTicket");
 const doctor_1 = require("./commands/doctor");
 const search_1 = require("./commands/search");
 const library_1 = require("./commands/library");
 const share_1 = require("./commands/share");
 const send_1 = require("./commands/send");
-const react_1 = require("./commands/react");
 const capture_1 = require("./commands/capture");
-const security_1 = require("./commands/security");
 const pack_1 = require("./commands/pack");
 const traces_1 = require("./commands/traces");
+const agents_1 = require("./commands/agents");
+const evals_1 = require("./commands/evals");
 const hookGate_1 = require("./packs/hookGate");
 const sync_1 = require("./packs/sync");
 const version_1 = require("./version");
@@ -34,14 +32,8 @@ Codiedev CLI
 
 Connect:
   codiedev connect                       Link Claude Code / Codex / Cursor /
-                                         GitHub Copilot to your org
-  codiedev doctor                        Verify setup, capture, and Agent Security
-  codiedev security pilot                Run safe synthetic policy checks
-  codiedev security inventory            Inventory MCPs, skills, hooks, plugins,
-                                         instructions, and editor extensions
-  codiedev security scan --deep          Run installed open-source scanners too
-  codiedev security sync                 Fetch administrator policy locally
-  codiedev security rollback --yes       Restore pre-update hook configuration
+                                         GitHub Copilot / pi to your org
+  codiedev doctor                        Verify setup and capture
 
 Harness:
   codie                                  Launch the governed Codie harness.
@@ -61,14 +53,6 @@ Artifacts:
                                          team's collective memory. Returns an
                                          LLM-synthesized answer with citations
                                          pointing at sessions + artifacts.
-  codiedev promote <artifact-id>         Promote an auto-extracted artifact
-                                         to an authored one
-  codiedev reverse-ticket [<pr-url>]     Generate a Jira ticket draft.
-                                         No URL = branch mode (uses your current
-                                         local git branch, no PR needed).
-                                         Draft lands in /portal/agentic-ticketing.
-  codiedev reverse-ticket --base <ref>   Override the base ref in branch mode
-                                         (defaults to origin/main).
   codiedev create-ticket [<prompt>]      Forward-write a scoped ticket plan.
                                          Claude investigates the codebase, asks
                                          "single repo or multiple? where?", then
@@ -89,19 +73,27 @@ Messaging:
 
 Starter packs:
   codiedev pack list                     Packs assigned to your team
-  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie]
+  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie,pi]
                        [--dry-run] [--json]
                                          Install a pack (or all) into every
                                          detected tool
   codiedev pack status                   Installed packs, up to date or not
 
 Traces (agents on the gateway):
+  codiedev agents init | deploy | run | runs | show | secrets | webhook
+                                         Deploy agents and run them in fresh sandboxes
+                                         (codiedev agents help)
   codiedev traces agents                 Agents you maintain, with saved test cases
-  codiedev traces cases <agent> [--suite name] [--model id]
-                                         Pull an agent's test cases (or one suite)
+  codiedev traces cases <agent> [--dataset name [--version n]] [--model id]
+                                         Pull an agent's test cases (or one dataset)
                                          into this repo for your coding agent to
                                          run, optionally on another model
   codiedev traces report <results.json>  Send the results back to Traces
+  codiedev traces overview | runs | run | score | scores | score-kinds | queue | judge | import | add-example | versions | save-version
+                                         Agents, runs, failures, scores, review queues,
+                                         automatic scoring and datasets (codiedev traces help)
+  codiedev evals report <run.json>       File one variant's eval scores under an experiment
+  codiedev evals last <subject>          Latest experiment on a subject + its champion
 
 Discovery:
   codiedev search "<query>"              Semantic search across the team's
@@ -110,9 +102,6 @@ Discovery:
                   [--type T] [--tag X] [--limit N]
                                          List artifacts in your workspace
 
-Feed:
-  codiedev react <postId> <emoji>        Toggle a reaction on a feed post
-
 Privacy:
   codiedev ignore <path>                 Never capture this folder or its children
   codiedev unignore <path>               Stop ignoring a folder
@@ -168,6 +157,8 @@ status sync never weakens it.
 const COMMAND_HELP = {
     pack: pack_1.PACK_HELP,
     traces: traces_1.TRACES_HELP,
+    agents: agents_1.AGENTS_HELP,
+    evals: evals_1.EVALS_HELP,
     connect: `
 codiedev connect — link your agent CLI to Codiedev
 
@@ -177,9 +168,11 @@ codiedev connect — link your agent CLI to Codiedev
     - ~/.claude/CLAUDE.md instructions   (teaches Claude the commands)
     - ~/.codex/hooks.json hook           (same, for Codex)
     - ~/.codex/AGENTS.md instructions    (same, for Codex)
-    - ~/.cursor/hooks.json hooks         (session, prompt, security, capture)
+    - ~/.cursor/hooks.json hooks         (session, backup, capture)
     - ~/.cursor/rules/codiedev.mdc       (teaches Cursor the commands)
     - ~/.copilot/hooks/codiedev.json     (GitHub Copilot: VS Code + CLI capture)
+    - ~/.pi/agent/extensions/codiedev.ts (pi: session, prompt, capture)
+    - ~/.pi/agent/AGENTS.md              (teaches pi the commands)
 
   Re-run anytime to swap accounts or refresh the instruction block.
 
@@ -285,20 +278,6 @@ codiedev note — capture a passing thought, linked to your session
     unignore: IGNORE_HELP,
     ignored: IGNORE_HELP,
     capture: IGNORE_HELP,
-    promote: `
-codiedev promote — promote an auto-extracted artifact to authored
-
-  Usage:
-    codiedev promote <artifact-id> [--key filename.md]
-
-  The session-capture pipeline auto-extracts spec/bugfix/decision
-  artifacts from each agent session. Promote turns one of those into
-  a first-class authored artifact your team can ping, pull, and
-  update versions of.
-
-  Find artifact-ids in the portal under Knowledge → Memory, or via
-  the portal search.
-`.trim(),
     "create-ticket": `
 codiedev create-ticket — forward-write a scoped ticket plan
 
@@ -424,6 +403,16 @@ Run 'codiedev help <command>' for each, or see the quick list:
 
 Tokens are per-user. Rotate any time by revoking + creating a new one.
 `.trim();
+const REMOVED_COMMANDS = {
+    promote: "Share an auto-saved spec with 'Promote to team' in the portal's My artifacts list.",
+    "reverse-ticket": "Use 'codiedev create-ticket' to draft Jira tickets.",
+    reverseTicket: "Use 'codiedev create-ticket' to draft Jira tickets.",
+    react: "React to feed posts in the portal.",
+};
+function removedCommand(command) {
+    console.error(`'codiedev ${command}' has been removed. ${REMOVED_COMMANDS[command] ?? ""}`.trim());
+    process.exit(1);
+}
 async function main() {
     const [, , command, ...rest] = process.argv;
     if (command === "hook-gate") {
@@ -476,9 +465,6 @@ async function main() {
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);
                 return;
-            case "security":
-                await (0, security_1.runSecurityCommand)(rest);
-                return;
             case "push":
                 await (0, push_1.runPush)(rest);
                 return;
@@ -511,11 +497,10 @@ async function main() {
                 await (0, note_1.runNote)(rest);
                 return;
             case "promote":
-                await (0, promote_1.runPromote)(rest);
-                return;
             case "reverse-ticket":
             case "reverseTicket":
-                await (0, reverseTicket_1.runReverseTicket)(rest);
+            case "react":
+                removedCommand(command);
                 return;
             case "create-ticket":
             case "createTicket":
@@ -531,15 +516,18 @@ async function main() {
             case "traces":
                 await (0, traces_1.runTraces)(rest);
                 return;
+            case "agents":
+                await (0, agents_1.runAgents)(rest);
+                return;
+            case "evals":
+                await (0, evals_1.runEvals)(rest);
+                return;
             case "share":
                 await (0, share_1.runShare)(rest);
                 return;
             case "send":
                 await (0, send_1.runSend)(rest);
                 return;
-            case "react":
-                await (0, react_1.runReact)(rest);
-                return;
             case "ignore":
             case "unignore":
             case "ignored":

package/dist/codexHookTrust.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexPluginContentHash = codexPluginContentHash;
 exports.codexCommandHookHash = codexCommandHookHash;
 exports.codiedevCodexHookTrustEntries = codiedevCodexHookTrustEntries;
 exports.writeCodexHookTrust = writeCodexHookTrust;
@@ -69,6 +70,42 @@ const MATCHER_EVENTS = new Set([
     "SubagentStart",
     "SubagentStop",
 ]);
+function codexPluginContentHash(root) {
+    const hash = crypto.createHash("sha256");
+    hash.update("codex-plugin-bundle-v1");
+    const u64 = (n) => {
+        const b = Buffer.alloc(8);
+        b.writeBigUInt64LE(BigInt(n));
+        return b;
+    };
+    const pending = [root];
+    while (pending.length) {
+        const current = pending.pop();
+        const relative = path.relative(root, current).split(path.sep).join("/");
+        const name = path.posix.basename(relative);
+        if (name === "__pycache__" || name === ".venv" || name.endsWith(".pyc") || name.endsWith(".egg-info"))
+            continue;
+        const nameBytes = Buffer.from(relative, "utf8");
+        hash.update(u64(nameBytes.length));
+        hash.update(nameBytes);
+        const stat = fs.lstatSync(current);
+        if (stat.isDirectory()) {
+            hash.update("directory");
+            const entries = fs.readdirSync(current).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+            for (const entry of entries.reverse())
+                pending.push(path.join(current, entry));
+        }
+        else if (stat.isFile()) {
+            hash.update("file");
+            hash.update(u64(stat.size));
+            hash.update(fs.readFileSync(current));
+        }
+        else {
+            throw new Error(`unsupported plugin entry type: ${current}`);
+        }
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
 function canonicalize(value) {
     if (Array.isArray(value))
         return value.map(canonicalize);
@@ -155,6 +192,27 @@ function codiedevCodexHookTrustEntries(hooksPath, hooksFile) {
     }
     return entries;
 }
+function stripBlockKeepingForeign(text, begin, end) {
+    const foreign = [];
+    const stripped = text.replace(new RegExp(`\\n?${begin}\\n([\\s\\S]*?)${end}\\n?`, "g"), (_match, body) => {
+        let table = null;
+        const flush = () => {
+            if (table && table.join("").trim())
+                foreign.push(table.join("\n").trimEnd());
+        };
+        for (const line of body.split("\n")) {
+            if (/^\s*\[/.test(line)) {
+                flush();
+                table = /^\s*\[hooks\.state\./.test(line) ? null : [];
+            }
+            if (table)
+                table.push(line);
+        }
+        flush();
+        return "\n";
+    });
+    return foreign.length ? `${stripped.trimEnd()}\n\n${foreign.join("\n\n")}\n` : stripped;
+}
 function tableHeader(key) {
     return `[hooks.state.${JSON.stringify(key)}]`;
 }
@@ -176,7 +234,7 @@ function removeTable(lines, header) {
 function writeCodexHookTrust(configPath, hooksPath, hooksFile) {
     const entries = codiedevCodexHookTrustEntries(hooksPath, hooksFile);
     let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
-    existing = existing.replace(new RegExp(`\\n?${TRUST_BEGIN}\\n[\\s\\S]*?${TRUST_END}\\n?`, "g"), "\n");
+    existing = stripBlockKeepingForeign(existing, TRUST_BEGIN, TRUST_END);
     let lines = existing.split("\n");
     for (const entry of entries)
         lines = removeTable(lines, tableHeader(entry.key));
@@ -225,11 +283,14 @@ function inspectCodexHookTrust(configPath, hooksPath, hooksFile, requiredSubcomm
 }
 const PACK_TRUST_BEGIN = "# codiedev-pack-trust:begin";
 const PACK_TRUST_END = "# codiedev-pack-trust:end";
-function packCodexHookTrustEntries(hooksPath, hooksFile) {
+function packCodexHookTrustEntries(hooksPath, hooksFile, plugin) {
     const events = hooksFile?.hooks;
     if (!events || typeof events !== "object")
         return [];
-    const source = normalizedHooksPath(hooksPath);
+    const source = plugin
+        ? `${plugin.id}:${path.relative(plugin.root, hooksPath).split(path.sep).join("/")}`
+        : normalizedHooksPath(hooksPath);
+    const contentHash = plugin ? codexPluginContentHash(plugin.root) : undefined;
     const entries = [];
     for (const [eventName, groupsValue] of Object.entries(events)) {
         const eventLabel = EVENT_LABELS[eventName];
@@ -248,6 +309,7 @@ function packCodexHookTrustEntries(hooksPath, hooksFile) {
                     eventName,
                     command: handler.command,
                     currentHash: codexCommandHookHash(eventName, group, handler),
+                    ...(contentHash ? { contentHash } : {}),
                 });
             });
         });
@@ -256,7 +318,7 @@ function packCodexHookTrustEntries(hooksPath, hooksFile) {
 }
 function writeCodexPackHookTrust(configPath, entries) {
     let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
-    existing = existing.replace(new RegExp(`\\n?${PACK_TRUST_BEGIN}\\n[\\s\\S]*?${PACK_TRUST_END}\\n?`, "g"), "\n");
+    existing = stripBlockKeepingForeign(existing, PACK_TRUST_BEGIN, PACK_TRUST_END);
     let lines = existing.split("\n");
     for (const entry of entries)
         lines = removeTable(lines, tableHeader(entry.key));
@@ -274,6 +336,7 @@ function writeCodexPackHookTrust(configPath, entries) {
         tableHeader(entry.key),
         "enabled = true",
         `trusted_hash = ${JSON.stringify(entry.currentHash)}`,
+        ...(entry.contentHash ? [`trusted_content_hash = ${JSON.stringify(entry.contentHash)}`] : []),
         "",
     ]).join("\n");
     const next = `${base}${base ? "\n\n" : ""}${PACK_TRUST_BEGIN}\n${trustBlock}${PACK_TRUST_END}\n`;

package/dist/codie.js

@@ -45,10 +45,10 @@ const codieBrandInstall_1 = require("./codieBrandInstall");
 const codieUsage_1 = require("./codieUsage");
 const codieRuntime_1 = require("./codieRuntime");
 const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
-const codieStartup_1 = require("./codieStartup");
 const upgradeNudge_1 = require("./upgradeNudge");
 const codie_1 = require("./packs/codie");
 const paths_1 = require("./packs/paths");
+const managedPi_1 = require("./managedPi");
 const USAGE_SETTLE_MS = 1200;
 function git(args) {
     const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -166,68 +166,8 @@ async function runNonInteractive(runtime, runtimeArgs, env) {
     process.once("SIGINT", forwardInterrupt);
     process.once("SIGTERM", forwardTermination);
     return await new Promise((resolve, reject) => {
-        let blockReason;
-        const errorPrefixes = [Buffer.from("\x1b[91m\x1b[1mError:"), Buffer.from("Error: {")];
-        const retainedPrefixBytes = Math.max(...errorPrefixes.map((prefix) => prefix.length)) - 1;
-        const createOutputGate = (write) => {
-            let tail = Buffer.alloc(0);
-            let possibleError;
-            return {
-                push(chunk, blocked) {
-                    if (blocked) {
-                        if (possibleError)
-                            possibleError.push(Buffer.from(chunk));
-                        return;
-                    }
-                    if (possibleError) {
-                        possibleError.push(Buffer.from(chunk));
-                        return;
-                    }
-                    const combined = Buffer.concat([tail, chunk]);
-                    let errorStart = -1;
-                    for (const prefix of errorPrefixes) {
-                        const index = combined.indexOf(prefix);
-                        if (index >= 0 && (errorStart < 0 || index < errorStart))
-                            errorStart = index;
-                    }
-                    if (errorStart >= 0) {
-                        if (errorStart > 0)
-                            write(combined.subarray(0, errorStart));
-                        possibleError = [combined.subarray(errorStart)];
-                        tail = Buffer.alloc(0);
-                        return;
-                    }
-                    const flushBytes = Math.max(0, combined.length - retainedPrefixBytes);
-                    if (flushBytes > 0)
-                        write(combined.subarray(0, flushBytes));
-                    tail = combined.subarray(flushBytes);
-                },
-                finish(blocked) {
-                    if (tail.length > 0)
-                        write(tail);
-                    const heldError = possibleError ? Buffer.concat(possibleError).toString() : "";
-                    const genericBlockError = heldError.includes("UnknownError") &&
-                        heldError.includes("Unexpected server error");
-                    if (heldError && (!blocked || !genericBlockError))
-                        write(heldError);
-                },
-            };
-        };
-        const stdoutGate = createOutputGate((chunk) => process.stdout.write(chunk));
-        const stderrGate = createOutputGate((chunk) => process.stderr.write(chunk));
-        child.stdout?.on("data", (chunk) => {
-            stdoutGate.push(Buffer.from(chunk), Boolean(blockReason));
-        });
-        child.stderr?.on("data", (chunk) => {
-            const text = chunk.toString();
-            const reason = (0, codieLauncher_1.extractCodieSecurityBlock)(text);
-            if (reason) {
-                blockReason = reason;
-                signalChild("SIGTERM");
-                return;
-            }
-            stderrGate.push(Buffer.from(chunk), Boolean(blockReason));
-        });
+        child.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+        child.stderr?.on("data", (chunk) => process.stderr.write(chunk));
         child.once("error", (error) => {
             if (child.stdin)
                 process.stdin.unpipe(child.stdin);
@@ -240,11 +180,6 @@ async function runNonInteractive(runtime, runtimeArgs, env) {
                 process.stdin.unpipe(child.stdin);
             process.removeListener("SIGINT", forwardInterrupt);
             process.removeListener("SIGTERM", forwardTermination);
-            stdoutGate.finish(Boolean(blockReason));
-            stderrGate.finish(Boolean(blockReason));
-            if (blockReason) {
-                console.error(`Codie Security blocked this action:\n${blockReason}`);
-            }
             resolve(status);
         });
     });
@@ -263,12 +198,28 @@ async function main() {
         process.exitCode = update.status ?? 0;
         return;
     }
-    const policyRefresh = await (0, codieStartup_1.refreshCodieSecurityPolicy)(connected);
-    if (policyRefresh.status === "cached") {
-        console.error(`codie: security policy refresh failed; using the cached policy (${policyRefresh.error})`);
-    }
     const gatewayUrl = process.env.CODIEDEV_GATEWAY_URL || "https://gateway.codiedev.com/api/v1";
     const catalog = await (0, codieLauncher_1.fetchApprovedCatalog)({ baseUrl: gatewayUrl, key });
+    if (process.argv[2] === "--pi") {
+        let skillPaths = [];
+        try {
+            const approved = new Set(catalog.map((model) => (0, codieLauncher_1.bareModel)(model.id)).filter(Boolean));
+            skillPaths = (0, codie_1.codiePackConfig)((0, paths_1.packsRoot)(), { approvedModels: approved, catalog }).skillPaths;
+        }
+        catch (error) {
+            console.error(`codie: skipping starter packs (${error instanceof Error ? error.message : error})`);
+        }
+        try {
+            process.exitCode = (0, managedPi_1.runManagedPi)({
+                args: process.argv.slice(3), key, gatewayUrl, catalog, stateDir: (0, configDir_1.codiedevStateDir)(), skillPaths,
+            });
+        }
+        catch (error) {
+            console.error(`codie: ${error instanceof Error ? error.message : String(error)}`);
+            process.exitCode = error instanceof managedPi_1.ManagedPiArgError ? 2 : 1;
+        }
+        return;
+    }
     const parsed = (0, codieLauncher_1.parseCodieArgs)(process.argv.slice(2));
     if (parsed.args.length === 1 && parsed.args[0] === "models") {
         console.log("Codiedev approved models\n");
@@ -343,8 +294,6 @@ async function main() {
     };
     const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
     const nonInteractiveRun = runtimeArgs[0] === "run";
-    if (nonInteractiveRun)
-        env.CODIEDEV_SECURITY_BLOCK_OUTPUT = "marker";
     if (nonInteractiveRun) {
         const reportCost = Boolean(process.stderr.isTTY);
         const startedAt = Date.now();

package/dist/codieLauncher.js

@@ -33,10 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.USAGE_MODULE_PLACEHOLDER = exports.CODIE_SECURITY_BLOCK_MARKER = void 0;
+exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.USAGE_MODULE_PLACEHOLDER = void 0;
 exports.usableModelCost = usableModelCost;
 exports.usableModelLimit = usableModelLimit;
-exports.extractCodieSecurityBlock = extractCodieSecurityBlock;
 exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
 exports.bareModel = bareModel;
 exports.buildCodieConfig = buildCodieConfig;
@@ -83,22 +82,6 @@ function usableModelLimit(value) {
         return undefined;
     return { context, output };
 }
-exports.CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
-function extractCodieSecurityBlock(stderr) {
-    for (const line of stderr.split(/\r?\n/)) {
-        const markerIndex = line.indexOf(exports.CODIE_SECURITY_BLOCK_MARKER);
-        if (markerIndex < 0)
-            continue;
-        try {
-            const parsed = JSON.parse(line.slice(markerIndex + exports.CODIE_SECURITY_BLOCK_MARKER.length));
-            if (typeof parsed?.reason === "string" && parsed.reason.trim())
-                return parsed.reason.trim();
-        }
-        catch {
-        }
-    }
-    return undefined;
-}
 function withCodieWorkingDirectory(args, cwd) {
     if (args[0] !== "run")
         return args;
@@ -305,20 +288,33 @@ function resolveCapturePlugin({ homeDir, existsSync, }) {
     }
     return (0, url_1.pathToFileURL)(capturePath).href;
 }
-async function fetchApprovedCatalog({ baseUrl, key, fetchImpl = fetch, }) {
+class CatalogRejected extends Error {
+}
+async function fetchApprovedCatalog({ baseUrl, key, fetchImpl = fetch, retryDelayMs = 1_000, }) {
+    try {
+        return await fetchCatalogOnce(baseUrl, key, fetchImpl);
+    }
+    catch (error) {
+        if (error instanceof CatalogRejected)
+            throw error;
+        await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+        return fetchCatalogOnce(baseUrl, key, fetchImpl);
+    }
+}
+async function fetchCatalogOnce(baseUrl, key, fetchImpl) {
     const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
+    const timeout = setTimeout(() => controller.abort(), 10_000);
     try {
         const response = await fetchImpl(`${cleanBaseUrl(baseUrl)}/models`, {
             headers: { Authorization: `Bearer ${key}` },
             signal: controller.signal,
         });
         if (response.status === 403) {
-            throw new Error("The Codie harness is not enabled for your company yet. Ask your Codiedev admin to turn it on — " +
+            throw new CatalogRejected("The Codie harness is not enabled for your company yet. Ask your Codiedev admin to turn it on — " +
                 "your session capture keeps working in the meantime.");
         }
         if (response.status === 401) {
-            throw new Error("Your Codiedev token was rejected. Run `codiedev connect` to relink this machine.");
+            throw new CatalogRejected("Your Codiedev token was rejected. Run `codiedev connect` to relink this machine.");
         }
         if (!response.ok)
             throw new Error(`model catalog returned ${response.status}`);