codiedev 0.10.0-beta.6 → 0.10.0-beta.8

package/dist/cli.js

@@ -2,6 +2,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const connect_1 = require("./connect");
+const cliSession_1 = require("./cliSession");
+const utils_1 = require("./utils");
 const push_1 = require("./commands/push");
 const delete_1 = require("./commands/delete");
 const pull_1 = require("./commands/pull");
@@ -31,8 +33,10 @@ Codiedev CLI
   someone left off across sessions and providers.
 
 Connect:
-  codiedev connect                       Link Claude Code / Codex / Cursor /
+  codiedev connect                       Sign in with your browser and link
+                                         Claude Code / Codex / Cursor /
                                          GitHub Copilot / pi to your org
+  codiedev logout                        Sign this machine out
   codiedev doctor                        Verify setup and capture
 
 Harness:
@@ -162,8 +166,9 @@ const COMMAND_HELP = {
     connect: `
 codiedev connect — link your agent CLI to Codiedev
 
-  Interactive setup. Prompts for an API token, then installs:
-    - ~/.codiedev/config.json            (token + org + tracked repos)
+  Opens your browser to sign in (approve once, no API key to copy), then
+  installs:
+    - ~/.codiedev/config.json            (sign-in + org + tracked repos)
     - ~/.claude/settings.json hook       (captures session transcripts)
     - ~/.claude/CLAUDE.md instructions   (teaches Claude the commands)
     - ~/.codex/hooks.json hook           (same, for Codex)
@@ -176,7 +181,27 @@ codiedev connect — link your agent CLI to Codiedev
 
   Re-run anytime to swap accounts or refresh the instruction block.
 
-  Get your token: https://codiedev.com/portal/integrations/claude-code
+  Over SSH or on a machine with no display it shows a link and a short code
+  instead: open the link on your laptop or phone, check the code, approve.
+  Detected automatically.
+
+  Options:
+    --token        Paste an API token instead of signing in with a browser
+                   (CI, or a machine with no browser anywhere). Create one at
+                   https://codiedev.com/portal/integrations/claude-code
+    --force, -f    Sign in again even if this machine is already connected.
+
+  Browser sign-in stores a 24-hour access token and a refresh token that
+  rotates on every use; nothing long-lived is saved. Revoke a machine from
+  Integrations in the portal, or run 'codiedev logout' on it.
+`.trim(),
+    logout: `
+codiedev logout — sign this machine out
+
+  Ends this machine's browser sign-in on the server and removes it from
+  ~/.codiedev/config.json. Device settings (ignored folders) are kept.
+  For a pasted API token, it's only forgotten locally: revoke it in the
+  portal under Integrations.
 `.trim(),
     push: `
 codiedev push — author or update an artifact
@@ -395,13 +420,15 @@ Run 'codiedev help <command>' for each, or see the quick list:
 
     codiedev help
 
-## Getting a token
+## Signing in
 
-  1. Log in to https://codiedev.com/portal/integrations/claude-code
-  2. Click "Create token"
-  3. Copy the cdv_... string and paste it into 'codiedev connect'
+  'codiedev connect' opens your browser; approve, and you're done. Nothing
+  long-lived is stored: a 24-hour access token plus a rotating refresh token.
 
-Tokens are per-user. Rotate any time by revoking + creating a new one.
+  Over SSH it shows a link and code to approve from your laptop or phone,
+  automatically. For CI, create a token at
+  https://codiedev.com/portal/integrations/claude-code and run
+  'codiedev connect --token'.
 `.trim();
 const REMOVED_COMMANDS = {
     promote: "Share an auto-saved spec with 'Promote to team' in the portal's My artifacts list.",
@@ -456,11 +483,32 @@ async function main() {
         console.log(`codiedev v${version_1.CLI_VERSION}`);
         return;
     }
+    if (command !== "connect" && command !== "logout") {
+        const fresh = await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => null);
+        if (fresh?.status === "signed_out") {
+            console.error("\nYour Codiedev sign-in has ended (revoked or expired). Run `codiedev connect` to sign in again.\n");
+        }
+    }
     try {
         switch (command) {
             case "connect":
                 await (0, connect_1.runConnect)(rest);
                 return;
+            case "logout": {
+                const out = await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH });
+                if (!out.wasConnected) {
+                    console.log("This machine isn't signed in.");
+                }
+                else if (out.hadBrowserAuth) {
+                    console.log(out.serverRevoked
+                        ? "Signed out. This machine's sign-in is revoked."
+                        : "Signed out on this machine. Couldn't reach Codiedev to revoke the sign-in; revoke it under Integrations in the portal.");
+                }
+                else {
+                    console.log("Removed the API token from this machine. It still works elsewhere until you revoke it under Integrations in the portal.");
+                }
+                return;
+            }
             case "doctor":
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);

package/dist/cliSession.js

@@ -0,0 +1,456 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_CODE_GRANT = exports.LOCK_STALE_MS = exports.DEFAULT_MIN_VALIDITY_MS = void 0;
+exports.readConfigAt = readConfigAt;
+exports.renameWithRetry = renameWithRetry;
+exports.writeConfigAtomic = writeConfigAtomic;
+exports.ensureFreshToken = ensureFreshToken;
+exports.pkcePair = pkcePair;
+exports.openBrowser = openBrowser;
+exports.parseCallback = parseCallback;
+exports.browserLogin = browserLogin;
+exports.isHeadless = isHeadless;
+exports.deviceLogin = deviceLogin;
+exports.logout = logout;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+exports.DEFAULT_MIN_VALIDITY_MS = 10 * 60_000;
+exports.LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 20_000;
+const REFRESH_TIMEOUT_MS = 10_000;
+const LOGIN_TIMEOUT_MS = 10 * 60_000;
+function readConfigAt(configPath) {
+    try {
+        return JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+const RENAME_RETRY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_RETRY_MS = [10, 25, 50, 100, 200, 400, 800];
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function renameWithRetry(from, to, rename = fs.renameSync, sleep = sleepSync) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (err) {
+            const code = err?.code ?? "";
+            if (!RENAME_RETRY_CODES.has(code) || attempt >= RENAME_RETRY_MS.length)
+                throw err;
+            sleep(RENAME_RETRY_MS[attempt]);
+        }
+    }
+}
+function writeConfigAtomic(configPath, config) {
+    const dir = path.dirname(configPath);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const data = JSON.stringify(config, null, 2);
+    const tmp = path.join(dir, `.config.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+    fs.writeFileSync(tmp, data, { encoding: "utf8", mode: 0o600 });
+    try {
+        fs.chmodSync(tmp, 0o600);
+        renameWithRetry(tmp, configPath);
+        return;
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { }
+        if (!RENAME_RETRY_CODES.has(err?.code ?? ""))
+            throw err;
+    }
+    fs.writeFileSync(configPath, data, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+}
+function lockPathFor(configPath) {
+    return path.join(path.dirname(configPath), "refresh.lock");
+}
+function tryLock(lockPath, now) {
+    try {
+        const fd = fs.openSync(lockPath, "wx", 0o600);
+        fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: now }));
+        fs.closeSync(fd);
+        return true;
+    }
+    catch (err) {
+        if (err?.code !== "EEXIST")
+            throw err;
+        try {
+            const age = now - fs.statSync(lockPath).mtimeMs;
+            if (age > exports.LOCK_STALE_MS)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+        }
+        return false;
+    }
+}
+function unlock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch { }
+}
+function needsRefresh(config, now, minValidityMs) {
+    const auth = config.auth;
+    return !!auth && !!config.token && auth.accessTokenExpiresAt - now < minValidityMs;
+}
+async function postForm(fetchImpl, url, form, timeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form).toString(),
+            signal: ctl.signal,
+        });
+        return { status: res.status, body: (await res.json().catch(() => null)) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDITY_MS) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const first = readConfigAt(deps.configPath);
+    if (!first?.auth)
+        return { status: "none", config: first };
+    if (!needsRefresh(first, now(), minValidityMs))
+        return { status: "fresh", config: first };
+    const seen = first.token;
+    const lockPath = lockPathFor(deps.configPath);
+    const deadline = now() + LOCK_WAIT_MS;
+    let locked = false;
+    try {
+        while (!(locked = tryLock(lockPath, now()))) {
+            if (now() > deadline)
+                return { status: "unavailable", config: first };
+            await sleep(50 + Math.floor(Math.random() * 100));
+        }
+        const current = readConfigAt(deps.configPath);
+        if (!current?.auth)
+            return { status: "none", config: current };
+        if (current.token !== seen)
+            return { status: "adopted", config: current };
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${current.backendUrl}/oauth/token`, {
+                grant_type: "refresh_token",
+                client_id: current.auth.clientId,
+                refresh_token: current.auth.refreshToken,
+            }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            return { status: "unavailable", config: current };
+        }
+        if (res.status === 200 && typeof res.body?.access_token === "string" && typeof res.body.refresh_token === "string") {
+            const next = {
+                ...current,
+                token: res.body.access_token,
+                auth: {
+                    ...current.auth,
+                    refreshToken: res.body.refresh_token,
+                    accessTokenExpiresAt: now() + Number(res.body.expires_in ?? 0) * 1000,
+                },
+            };
+            writeConfigAtomic(deps.configPath, next);
+            return { status: "refreshed", config: next };
+        }
+        if (res.status === 400 && res.body?.error === "invalid_grant") {
+            const out = { ...current, token: "" };
+            delete out.auth;
+            writeConfigAtomic(deps.configPath, out);
+            return { status: "signed_out", config: out };
+        }
+        return { status: "unavailable", config: current };
+    }
+    finally {
+        if (locked)
+            unlock(lockPath);
+    }
+}
+function base64Url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+    const verifier = base64Url(crypto.randomBytes(32));
+    const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function openBrowser(url) {
+    try {
+        const [cmd, args] = process.platform === "darwin"
+            ? ["open", [url]]
+            : process.platform === "win32"
+                ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+                : ["xdg-open", [url]];
+        const child = (0, child_process_1.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const DONE_PAGE = (ok, msg) => `<!doctype html><html><head><meta charset="utf-8">
+<title>Codiedev CLI</title><style>body{font-family:system-ui,sans-serif;display:grid;place-items:center;
+height:100vh;margin:0;background:#fbfbfa;color:#1f1f1f}main{max-width:28rem;text-align:center}
+h1{font-size:1.25rem}</style></head><body><main><h1>${ok ? "You're signed in" : "Sign-in didn't finish"}</h1>
+<p>${msg}</p></main></body></html>`;
+function parseCallback(input) {
+    try {
+        const u = new URL(input.trim());
+        return {
+            code: u.searchParams.get("code") ?? undefined,
+            state: u.searchParams.get("state") ?? undefined,
+            error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? undefined,
+        };
+    }
+    catch {
+        return { error: "That isn't the address from the browser's address bar." };
+    }
+}
+async function browserLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const state = base64Url(crypto.randomBytes(16));
+    const { verifier, challenge } = pkcePair();
+    let settle;
+    const result = new Promise((r) => (settle = r));
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        const cb = parseCallback(url.toString());
+        const ok = !cb.error && cb.state === state && !!cb.code;
+        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(DONE_PAGE(ok, ok
+            ? "You can close this tab and go back to your terminal."
+            : "Go back to your terminal and run <code>codiedev connect</code> again."));
+        if (cb.error)
+            settle({ error: cb.error });
+        else if (cb.state !== state)
+            settle({ error: "The sign-in response didn't match this request (state mismatch)." });
+        else
+            settle({ code: cb.code });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const timer = setTimeout(() => settle({ error: "Timed out waiting for the browser (10 minutes)." }), LOGIN_TIMEOUT_MS);
+    try {
+        const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+                redirect_uris: [redirectUri],
+            }),
+        });
+        if (reg.status !== 201)
+            throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+        const { client_id: clientId } = (await reg.json());
+        const authorize = new URL(`${opts.backendUrl}/oauth/authorize`);
+        authorize.search = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+            scope: "cli",
+        }).toString();
+        const link = authorize.toString();
+        if (opts.onAuthorizeUrl) {
+            opts.onAuthorizeUrl(link);
+        }
+        else {
+            log("Opening your browser to sign in…");
+            log(`If it doesn't open, visit:\n  ${link}\n`);
+            openBrowser(link);
+        }
+        const cb = await result;
+        if (cb.error || !cb.code)
+            throw new Error(cb.error ?? "Sign-in was cancelled.");
+        const tok = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, {
+            grant_type: "authorization_code",
+            code: cb.code,
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+        }, REFRESH_TIMEOUT_MS);
+        const body = tok.body;
+        if (tok.status !== 200 || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string") {
+            throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${tok.status}`}`);
+        }
+        if (body.scope !== "cli")
+            throw new Error("The server didn't grant CLI access.");
+        return {
+            accessToken: body.access_token,
+            refreshToken: body.refresh_token,
+            expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+            clientId,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        server.close();
+    }
+}
+exports.DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function isHeadless(env = process.env, platform = process.platform) {
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return true;
+    if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
+async function deviceLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+            redirect_uris: [],
+            grant_types: [exports.DEVICE_CODE_GRANT, "refresh_token"],
+        }),
+    });
+    if (reg.status !== 201)
+        throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+    const { client_id: clientId } = (await reg.json());
+    const start = await fetchImpl(`${opts.backendUrl}/oauth/device_authorization`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, scope: "cli" }).toString(),
+    });
+    const auth = (await start.json().catch(() => null));
+    if (start.status !== 200 || !auth?.device_code || !auth.user_code || !auth.verification_uri) {
+        throw new Error(`Sign-in setup failed: ${auth?.error_description ?? `HTTP ${start.status}`}`);
+    }
+    const complete = auth.verification_uri_complete ?? auth.verification_uri;
+    if (opts.onCode) {
+        opts.onCode({ userCode: auth.user_code, verificationUri: auth.verification_uri, verificationUriComplete: complete });
+    }
+    log("To sign in, open this link on any device (your laptop or phone) and approve:\n");
+    log(`  ${complete}\n`);
+    log(`Your code: ${auth.user_code}   (check it matches the page)\n`);
+    log("Waiting for approval…");
+    let intervalMs = Math.max(1, Number(auth.interval ?? 5)) * 1000;
+    const deadline = now() + Number(auth.expires_in ?? 600) * 1000;
+    for (;;) {
+        await sleep(intervalMs);
+        if (now() > deadline)
+            throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, { grant_type: exports.DEVICE_CODE_GRANT, device_code: auth.device_code, client_id: clientId }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            continue;
+        }
+        const body = res.body;
+        if (res.status === 200 && typeof body?.access_token === "string" && typeof body.refresh_token === "string") {
+            if (body.scope !== "cli")
+                throw new Error("The server didn't grant CLI access.");
+            return {
+                accessToken: body.access_token,
+                refreshToken: body.refresh_token,
+                expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+                clientId,
+            };
+        }
+        switch (body?.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                intervalMs += 5000;
+                continue;
+            case "access_denied":
+                throw new Error("Sign-in was denied in the browser.");
+            case "expired_token":
+                throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+            default:
+                throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${res.status}`}`);
+        }
+    }
+}
+async function logout(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const config = readConfigAt(deps.configPath);
+    if (!config?.token)
+        return { wasConnected: false, hadBrowserAuth: false, serverRevoked: false };
+    let serverRevoked = false;
+    const hadBrowserAuth = !!config.auth;
+    if (config.token && config.auth) {
+        try {
+            const res = await fetchImpl(`${config.backendUrl}/api/cli/logout`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${config.token}` },
+            });
+            serverRevoked = res.ok && (await res.json().catch(() => null))?.revoked === true;
+        }
+        catch {
+        }
+    }
+    const out = { ...config, token: "" };
+    delete out.auth;
+    writeConfigAtomic(deps.configPath, out);
+    return { wasConnected: true, hadBrowserAuth, serverRevoked };
+}

package/dist/codie.js

@@ -49,6 +49,8 @@ const upgradeNudge_1 = require("./upgradeNudge");
 const codie_1 = require("./packs/codie");
 const paths_1 = require("./packs/paths");
 const managedPi_1 = require("./managedPi");
+const cliSession_1 = require("./cliSession");
+const CODIE_MIN_TOKEN_VALIDITY_MS = 12 * 60 * 60_000;
 const USAGE_SETTLE_MS = 1200;
 function git(args) {
     const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -186,6 +188,12 @@ async function runNonInteractive(runtime, runtimeArgs, env) {
 }
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
+    if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN) {
+        const fresh = await (0, cliSession_1.ensureFreshToken)({ configPath: path.join((0, configDir_1.codiedevStateDir)(), "config.json") }, CODIE_MIN_TOKEN_VALIDITY_MS);
+        if (fresh.status === "signed_out") {
+            throw new Error("Your Codiedev sign-in has ended. Run `codiedev connect` to sign in again");
+        }
+    }
     const connected = connectedCodiedevConfig();
     const key = process.env.CODIEDEV_GATEWAY_KEY ||
         process.env.CODIEDEV_TOKEN ||

package/dist/commands/agents.js

@@ -55,6 +55,10 @@ codiedev agents — deploy agents and run them in fresh sandboxes
   codiedev agents install <template> <name>
                                          Deploy a copy of a shared template as your own agent
   codiedev agents unpublish <template>   Take a template you shared off the marketplace
+  codiedev agents connect <name> [--description "…"] [--budget <usd>]
+                                         An agent you already run on your own servers: get its key.
+                                         Its model calls (via the gateway) show in Traces with spend,
+                                         budget and a kill switch; the key also reaches approvals and state
   codiedev agents deploy [dir]           Package the folder and deploy it (new version each time)
   codiedev agents run <name> [--input '<json>' | --input-file f] [--no-wait] [--json] [--quiet]
                          [--idempotency-key k] [--delay 30m] [--retries n]
@@ -90,8 +94,10 @@ codiedev agents — deploy agents and run them in fresh sandboxes
   .codiedevignore lists extra files to leave out of the bundle (.env*, .git,
   node_modules and virtualenvs are always left out).
   entrypoint: a .py, .js, .mjs, .ts or .sh file. "every" (5m–7d) runs it on a
-  schedule; omit it, or set null, for none. retries (0–5) tries a failed run
-  again on the same run id, after 15s, 30s, 60s… cpu 0.25–8 cores, memoryMb 512–32768.
+  schedule; set null for none. retries (0–5) tries a failed run again on the
+  same run id, after 15s, 30s, 60s… cpu 0.25–8 cores, memoryMb 512–32768.
+  Leave a setting out to keep what it is now (it can be changed on the agent's
+  Setup tab in the portal); a new agent gets the defaults.
 `.trim();
 exports.AGENT_GUIDE = `# Building a Codiedev agent
 
@@ -1028,6 +1034,22 @@ async function cmdCancel(args, config) {
     const res = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/cancel", { config, body: { id } });
     console.log(res.status && res.status !== "cancelled" ? `Run already ${res.status}.` : "Cancelled.");
 }
+async function cmdConnect(args, config) {
+    const [name] = positional(args);
+    if (!name)
+        fail('Usage: codiedev agents connect <name> [--description "…"] [--budget <usd>]');
+    const budget = flag(args, "--budget");
+    const out = await (0, shared_1.apiRequest)("POST", "/api/agents/v1/connect", {
+        config,
+        body: { name, description: flag(args, "--description"), ...(budget ? { monthlyBudgetUsd: Number(budget) } : {}) },
+    });
+    console.log(`Connected ${out.agent}. Its key is shown once; put it in your secret manager.\n`);
+    console.log(`CODIEDEV_API_KEY=${out.key}`);
+    console.log(`CODIEDEV_GATEWAY_URL=${out.gatewayUrl}`);
+    console.log(`CODIEDEV_AGENTS_URL=${out.agentsUrl}\n`);
+    console.log("Point its OpenAI-compatible client at CODIEDEV_GATEWAY_URL with that key (one X-Codiedev-Run-Id per job groups its calls into a trace).");
+    console.log(`The same key calls ${out.agentsUrl}/api/agents/v1/approvals and /state. See it: Agents → ${out.agent}.`);
+}
 async function cmdDelete(args, config) {
     const [name] = positional(args);
     if (!name)
@@ -1044,7 +1066,7 @@ async function runAgents(args, configOverride) {
     if (sub === "run" && rest.includes("--local"))
         return cmdRunLocal(rest);
     const commands = {
-        deploy: cmdDeploy, run: cmdRun, runs: cmdRuns, show: cmdShow, logs: cmdLogs, list: cmdList, ls: cmdList,
+        connect: cmdConnect, deploy: cmdDeploy, run: cmdRun, runs: cmdRuns, show: cmdShow, logs: cmdLogs, list: cmdList, ls: cmdList,
         secrets: cmdSecrets, webhook: cmdWebhook, cancel: cmdCancel, stop: (a, c) => cmdControl(a, c, true), resume: (a, c) => cmdControl(a, c, false), delete: cmdDelete, pull: cmdPull,
         versions: cmdVersions, rollback: cmdRollback, state: cmdState, approvals: cmdApprovals, decide: cmdDecide,
         publish: cmdPublish, install: cmdInstall, unpublish: cmdUnpublish,

package/dist/commands/agentsSdk.generated.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jsPackage = exports.jsTypes = exports.jsIndex = exports.python = void 0;
-exports.python = "\"\"\"Codiedev agents SDK — the run primitive, from Python.\n\nInside a deployed agent (everything is already configured):\n\n    import codiedev_agents as agents\n\n    task = agents.input()                      # this run's input (JSON)\n    llm = agents.openai()                      # OpenAI client on the Codiedev gateway, traced\n    child = agents.run(\"summarize\", {\"text\": ...})   # start another agent as a child run\n    agents.output({\"summary\": child[\"output\"]})      # this run's result\n    agents.request()                           # webhook runs: method, headers, raw body\n    agents.respond({\"text\": \"on it\"})          # what a webhook caller waiting (?wait=) gets back\n\n    agents.state.get(\"cursor\")                 # per-agent storage that outlives runs\n    agents.state.set(\"cursor\", 42)\n    agents.step(\"fetch\", lambda: fetch())      # done once per run, even across retries\n    agents.start(\"triage\", {...}, delay=3600)  # start a run later (up to 7 days)\n    agents.request_approval(\"Refund $120?\", context={...})  # a person decides; a run acts on it\n    agents.attempt()                           # 1, or 2+ when this run is a retry\n\nOutside a run (a script, a notebook, another service), set CODIEDEV_TOKEN\n(your CLI token) and CODIEDEV_AGENTS_URL, then call agents.run() the same way.\nStandard library only, so it drops into any project.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nfrom typing import Any\n\n__all__ = [\n    \"input\", \"output\", \"request\", \"respond\", \"run\", \"start\", \"get\", \"openai\", \"attempt\",\n    \"state\", \"step\", \"request_approval\", \"get_approval\", \"AgentRunError\", \"StateConflict\",\n]\n\n_INPUT_PATH = os.environ.get(\"CODIEDEV_INPUT_PATH\", \"/agent/.codiedev/input.json\")\n_OUTPUT_PATH = os.environ.get(\"CODIEDEV_OUTPUT_PATH\", \"/agent/.codiedev/output.json\")\n_REQUEST_PATH = os.environ.get(\"CODIEDEV_REQUEST_PATH\", \"/agent/.codiedev/request.json\")\n_RESPONSE_PATH = os.environ.get(\"CODIEDEV_RESPONSE_PATH\", \"/agent/.codiedev/response.json\")\n# Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\n_STATE_PATH = os.environ.get(\"CODIEDEV_STATE_PATH\")\n_DONE = {\"succeeded\", \"failed\", \"cancelled\"}\n\n\nclass StateConflict(RuntimeError):\n    \"\"\"state.set(..., if_version=n) found the key at another version.\"\"\"\n\n    def __init__(self, key: str, version: int):\n        super().__init__(f\"state {key!r} changed (now version {version})\")\n        self.key = key\n        self.version = version\n\n\nclass AgentRunError(RuntimeError):\n    def __init__(self, run: dict):\n        super().__init__(f\"{run.get('agent')} run {run.get('id')} {run.get('status')}: {run.get('error') or 'no error message'}\")\n        self.run = run\n\n\ndef input(default: Any = None) -> Any:  # noqa: A001 - mirrors output()\n    \"\"\"This run's input, parsed from JSON (None when started without one).\"\"\"\n    try:\n        with open(_INPUT_PATH) as f:\n            value = json.load(f)\n    except FileNotFoundError:\n        return default\n    return default if value is None else value\n\n\ndef output(value: Any) -> None:\n    \"\"\"Set this run's result. Must be JSON-serializable; the last call wins.\"\"\"\n    os.makedirs(os.path.dirname(_OUTPUT_PATH), exist_ok=True)\n    with open(_OUTPUT_PATH, \"w\") as f:\n        json.dump(value, f)\n\n\ndef respond(body: Any = None, status: int = 200, headers: \"dict | None\" = None) -> None:\n    \"\"\"What a webhook caller gets back when it waits for the run (?wait=N):\n    a string is sent as text, anything else as JSON. Without respond(), a\n    waiting caller gets the run's output.\"\"\"\n    os.makedirs(os.path.dirname(_RESPONSE_PATH), exist_ok=True)\n    with open(_RESPONSE_PATH, \"w\") as f:\n        json.dump({\"status\": status, \"headers\": headers or {}, \"body\": body}, f)\n\n\ndef attempt() -> int:\n    \"\"\"This run's attempt: 1, or 2+ when it's a retry of a failed attempt.\"\"\"\n    return int(os.environ.get(\"CODIEDEV_ATTEMPT\", \"1\"))\n\n\ndef request() -> \"dict | None\":\n    \"\"\"For a webhook run: {\"method\", \"query\", \"headers\", \"body\"} with the raw\n    body, to verify the sender's signature. None for other runs.\"\"\"\n    try:\n        with open(_REQUEST_PATH) as f:\n            return json.load(f)\n    except FileNotFoundError:\n        return None\n\n\ndef _base() -> str:\n    url = os.environ.get(\"CODIEDEV_AGENTS_URL\", \"\").rstrip(\"/\")\n    if not url:\n        raise RuntimeError(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\")\n    return url\n\n\ndef _token() -> str:\n    token = os.environ.get(\"CODIEDEV_RUN_TOKEN\") or os.environ.get(\"CODIEDEV_TOKEN\")\n    if not token:\n        raise RuntimeError(\"Set CODIEDEV_TOKEN to your Codiedev CLI token (inside a run it's set for you)\")\n    return token\n\n\ndef _request(method: str, path: str, body: dict | None = None, ok: tuple[int, ...] = ()) -> dict:\n    req = urllib.request.Request(\n        f\"{_base()}{path}\",\n        method=method,\n        data=json.dumps(body).encode() if body is not None else None,\n        headers={\"Authorization\": f\"Bearer {_token()}\", \"Content-Type\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, timeout=30) as res:\n            return json.loads(res.read() or b\"{}\")\n    except urllib.error.HTTPError as err:\n        detail = err.read().decode(errors=\"replace\")\n        if err.code in ok:\n            return {\"_status\": err.code, **json.loads(detail or \"{}\")}\n        try:\n            detail = json.loads(detail).get(\"error\", detail)\n        except ValueError:\n            pass\n        raise RuntimeError(f\"Codiedev agents API {err.code}: {detail}\") from None\n\n\ndef start(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    idempotency_key: str | None = None,\n    delay: float | None = None,\n    retries: int | None = None,\n) -> str:\n    \"\"\"Start a run and return its id without waiting. With an idempotency key,\n    a second start within a day returns the first run's id. delay (seconds,\n    up to 7 days) starts it later; retries overrides the agent's retries.\"\"\"\n    body: dict = {\"agent\": agent, \"input\": input}\n    if idempotency_key:\n        body[\"idempotencyKey\"] = idempotency_key\n    if delay:\n        body[\"delaySec\"] = int(delay)\n    if retries is not None:\n        body[\"retries\"] = retries\n    return _request(\"POST\", \"/api/agents/v1/run\", body)[\"runId\"]\n\n\ndef get(run_id: str) -> dict:\n    \"\"\"A run's status, input, output (parsed), error, log tail and children.\"\"\"\n    run = _request(\"GET\", f\"/api/agents/v1/run?id={run_id}\")\n    if isinstance(run.get(\"output\"), str):\n        try:\n            run[\"output\"] = json.loads(run[\"output\"])\n        except ValueError:\n            pass\n    return run\n\n\ndef run(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    timeout: float = 900,\n    poll: float = 2.0,\n    check: bool = True,\n    idempotency_key: str | None = None,\n) -> dict:\n    \"\"\"Run an agent and wait for it. Returns the run; its result is run[\"output\"].\n\n    Inside a run this starts a child run, so the chain shows as one tree.\n    Raises AgentRunError if it fails (pass check=False to get the run anyway).\n    \"\"\"\n    run_id = start(agent, input, idempotency_key)\n    deadline = time.monotonic() + timeout\n    while True:\n        result = get(run_id)\n        if result.get(\"status\") in _DONE:\n            if check and result[\"status\"] != \"succeeded\":\n                raise AgentRunError(result)\n            return result\n        if time.monotonic() > deadline:\n            raise TimeoutError(f\"{agent} run {run_id} still {result.get('status')} after {timeout}s\")\n        time.sleep(poll)\n\n\nclass _State:\n    \"\"\"Per-agent key-value storage that outlives runs (values: any JSON, up\n    to 64 KB; 1,000 keys). Every write bumps the key's version; pass\n    if_version to write only if nobody else did since you read it.\"\"\"\n\n    def get(self, key: str, default: Any = None) -> Any:\n        value, _ = self.get_versioned(key)\n        return default if value is None else value\n\n    def get_versioned(self, key: str) -> \"tuple[Any, int]\":\n        \"\"\"(value, version); (None, 0) when the key isn't set.\"\"\"\n        if _STATE_PATH:\n            row = _local_state().get(key)\n            return (row[\"value\"], row[\"version\"]) if row else (None, 0)\n        res = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode({'key': key, 'agent': _agent()})}\", ok=(404,))\n        if res.get(\"_status\") == 404:\n            return None, 0\n        return json.loads(res[\"value\"]), int(res[\"version\"])\n\n    def set(self, key: str, value: Any, if_version: \"int | None\" = None, ttl: \"float | None\" = None) -> int:\n        \"\"\"Store value; returns the new version. Raises StateConflict when\n        if_version is given and the key is at another version (0 = unset).\"\"\"\n        return self._write(key, value, if_version, ttl)\n\n    def delete(self, key: str, if_version: \"int | None\" = None) -> None:\n        self._write(key, None, if_version, None)\n\n    def list(self, prefix: str = \"\", values: bool = False) -> \"list[dict]\":  # noqa: A003\n        \"\"\"Keys (and with values=True, values) starting with prefix.\"\"\"\n        if _STATE_PATH:\n            rows = sorted((k, r) for k, r in _local_state().items() if k.startswith(prefix))\n            return [{\"key\": k, \"version\": r[\"version\"], **({\"value\": r[\"value\"]} if values else {})} for k, r in rows]\n        keys: list = []\n        after = None\n        while True:\n            params = {\"prefix\": prefix, \"values\": \"1\" if values else \"0\", \"limit\": 200, \"agent\": _agent()}\n            if after:\n                params[\"after\"] = after\n            page = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode(params)}\")\n            for row in page[\"keys\"]:\n                if \"value\" in row:\n                    row[\"value\"] = json.loads(row[\"value\"])\n            keys.extend(page[\"keys\"])\n            after = page.get(\"next\")\n            if not after:\n                return keys\n\n    def update(self, key: str, fn, default: Any = None, retries: int = 10) -> Any:\n        \"\"\"Read-modify-write that's safe with runs in parallel: fn(old) -> new,\n        retried if another run wrote first. Returns the new value.\"\"\"\n        for _ in range(retries):\n            value, version = self.get_versioned(key)\n            new = fn(default if value is None else value)\n            try:\n                self.set(key, new, if_version=version)\n                return new\n            except StateConflict:\n                time.sleep(0.05)\n        raise StateConflict(key, -1)\n\n    def _write(self, key: str, value: Any, if_version: \"int | None\", ttl: \"float | None\") -> int:\n        if _STATE_PATH:\n            data = _local_state()\n            current = data.get(key, {}).get(\"version\", 0)\n            if if_version is not None and if_version != current:\n                raise StateConflict(key, current)\n            if value is None:\n                data.pop(key, None)\n            else:\n                data[key] = {\"value\": value, \"version\": current + 1}\n            with open(_STATE_PATH, \"w\") as f:\n                json.dump(data, f, indent=2)\n            return 0 if value is None else current + 1\n        body: dict = {\"key\": key, \"value\": value, \"agent\": _agent()}\n        if if_version is not None:\n            body[\"ifVersion\"] = if_version\n        if ttl:\n            body[\"ttlSec\"] = int(ttl)\n        res = _request(\"POST\", \"/api/agents/v1/state\", body, ok=(409,))\n        if res.get(\"_status\") == 409:\n            raise StateConflict(key, int(res.get(\"version\", 0)))\n        return int(res.get(\"version\", 0))\n\n\ndef _agent() -> str:\n    # Inside a run the run token picks the agent; a CLI token needs it named.\n    return os.environ.get(\"CODIEDEV_AGENT\", \"\")\n\n\ndef _local_state() -> dict:\n    try:\n        with open(_STATE_PATH or \"\") as f:\n            return json.load(f)\n    except (FileNotFoundError, ValueError):\n        return {}\n\n\nstate = _State()\n\n\ndef step(name: str, fn, ttl: float = 7 * 86400) -> Any:\n    \"\"\"Run fn() once for this run and remember its (JSON) result: if the run\n    is retried after a failure, finished steps return their saved result\n    instead of running again. Use it around side effects (posting a reply,\n    charging a card) so a retry doesn't repeat them.\"\"\"\n    key = f\"step/{os.environ.get('CODIEDEV_RUN_ID', 'local')}/{name}\"\n    value, version = state.get_versioned(key)\n    if version:\n        return value[\"result\"]\n    result = fn()\n    state.set(key, {\"result\": result}, ttl=ttl)\n    return result\n\n\n_SELF = object()\n\n\ndef request_approval(\n    title: str,\n    details: Any = None,\n    options: \"list[str] | None\" = None,\n    approvers: \"list[str] | None\" = None,\n    then: Any = _SELF,\n    context: Any = None,\n    expires_in: \"float | None\" = None,\n) -> dict:\n    \"\"\"Ask a person to decide. It shows in Codiedev (Agents → Approvals) and\n    at the returned [\"url\"], which you can post anywhere (Slack, email).\n\n    When it's decided, a run of `then` (this agent by default; None for no\n    run) starts with input {\"approval\": {\"decision\", \"comment\", \"decidedBy\",\n    ...}, \"context\": context}. If nobody decides within expires_in seconds\n    (default 7 days), it starts with decision \"expired\". Usually the run\n    ends after asking, so nothing runs (or costs) while it waits.\n    options default to [\"approve\", \"reject\"]; approvers (emails) limit who\n    can decide (admins always can).\"\"\"\n    body: dict = {\"title\": title, \"details\": details, \"options\": options, \"approvers\": approvers, \"context\": context}\n    if then is not _SELF:\n        body[\"onDecision\"] = then\n    if expires_in:\n        body[\"expiresSec\"] = int(expires_in)\n    if os.environ.get(\"CODIEDEV_LOCAL\") == \"1\":\n        print(f\"[local] approval requested: {title} ({', '.join(options or ['approve', 'reject'])}); not sent on a local run\", flush=True)\n        return {\"id\": f\"local-{int(time.time())}\", \"status\": \"pending\", \"url\": None, \"title\": title}\n    return _request(\"POST\", \"/api/agents/v1/approvals\", {k: v for k, v in body.items() if v is not None or k == \"onDecision\"})\n\n\ndef get_approval(approval_id: str) -> dict:\n    \"\"\"An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment.\"\"\"\n    return _request(\"GET\", f\"/api/agents/v1/approvals?id={urllib.parse.quote(approval_id)}\")\n\n\ndef openai(**kwargs):\n    \"\"\"An OpenAI client on the Codiedev gateway, with trace headers for this run.\"\"\"\n    from openai import OpenAI\n\n    headers = {\n        \"X-Codiedev-Workload\": os.environ.get(\"CODIEDEV_AGENT\", \"local-agent\"),\n        \"X-Codiedev-Run-Id\": os.environ.get(\"CODIEDEV_RUN_ID\", f\"local-{int(time.time())}\"),\n        \"X-Codiedev-Environment\": \"production\" if os.environ.get(\"CODIEDEV_RUN_ID\") else \"development\",\n    }\n    headers.update(kwargs.pop(\"default_headers\", {}) or {})\n    return OpenAI(\n        base_url=os.environ.get(\"CODIEDEV_GATEWAY_URL\", \"https://gateway.codiedev.com/api/v1\"),\n        api_key=os.environ.get(\"CODIEDEV_API_KEY\") or os.environ.get(\"CODIEDEV_TOKEN\"),\n        default_headers=headers,\n        **kwargs,\n    )\n";
-exports.jsIndex = "// Codiedev agents SDK for JavaScript and TypeScript, preinstalled in every\n// run. Same primitive as the Python SDK (codiedev_agents.py):\n//\n//   import * as agents from \"codiedev-agents\";\n//   const task = agents.input();                    // this run's input (JSON)\n//   const llm = await agents.openai();              // OpenAI client on the Codiedev gateway, traced\n//   const child = await agents.run(\"summarize\", { text });  // another agent, as a child run\n//   agents.output({ summary: child.output });       // this run's result\n//   agents.respond({ text: \"on it\" });              // what a webhook caller waiting (?wait=) gets back\n//   await agents.state.get(\"cursor\");               // per-agent storage that outlives runs\n//   await agents.step(\"post\", () => post());        // done once per run, even across retries\n//   await agents.start(\"triage\", input, { delaySec: 3600 });  // start a run later\n//   await agents.requestApproval(\"Refund $120?\", { context });  // a person decides; a run acts on it\n//\n// Outside a run, set CODIEDEV_TOKEN and CODIEDEV_AGENTS_URL and call run() the same way.\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst INPUT_PATH = process.env.CODIEDEV_INPUT_PATH || \"/agent/.codiedev/input.json\";\nconst OUTPUT_PATH = process.env.CODIEDEV_OUTPUT_PATH || \"/agent/.codiedev/output.json\";\nconst REQUEST_PATH = process.env.CODIEDEV_REQUEST_PATH || \"/agent/.codiedev/request.json\";\nconst RESPONSE_PATH = process.env.CODIEDEV_RESPONSE_PATH || \"/agent/.codiedev/response.json\";\n// Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\nconst STATE_PATH = process.env.CODIEDEV_STATE_PATH;\n// Inside a run the run token picks the agent; a CLI token needs it named.\nconst AGENT = process.env.CODIEDEV_AGENT || \"\";\nconst DONE = new Set([\"succeeded\", \"failed\", \"cancelled\"]);\n\n/** state.set(..., { ifVersion }) found the key at another version. */\nexport class StateConflict extends Error {\n  constructor(key, version) {\n    super(`state ${JSON.stringify(key)} changed (now version ${version})`);\n    this.key = key;\n    this.version = version;\n  }\n}\n\nexport class AgentRunError extends Error {\n  constructor(run) {\n    super(`${run.agent} run ${run.id} ${run.status}: ${run.error || \"no error message\"}`);\n    this.run = run;\n  }\n}\n\nfunction readJson(file) {\n  try {\n    return JSON.parse(fs.readFileSync(file, \"utf8\"));\n  } catch (err) {\n    if (err.code === \"ENOENT\") return null;\n    throw err;\n  }\n}\n\n/** This run's input, parsed from JSON (`fallback` when started without one). */\nexport function input(fallback = null) {\n  const value = readJson(INPUT_PATH);\n  return value ?? fallback;\n}\n\n/** Set this run's result. Must be JSON-serializable; the last call wins. */\nexport function output(value) {\n  fs.mkdirSync(path.dirname(OUTPUT_PATH), { recursive: true });\n  fs.writeFileSync(OUTPUT_PATH, JSON.stringify(value));\n}\n\n/** What a webhook caller gets back when it waits for the run (?wait=N): a\n *  string is sent as text, anything else as JSON. Without it, a waiting\n *  caller gets the run's output. */\nexport function respond(body = null, { status = 200, headers = {} } = {}) {\n  fs.mkdirSync(path.dirname(RESPONSE_PATH), { recursive: true });\n  fs.writeFileSync(RESPONSE_PATH, JSON.stringify({ status, headers, body }));\n}\n\n/** This run's attempt: 1, or 2+ when it's a retry of a failed attempt. */\nexport function attempt() {\n  return Number(process.env.CODIEDEV_ATTEMPT || \"1\");\n}\n\n/** For a webhook run: { method, query, headers, body } with the raw body, to verify a signature. */\nexport function request() {\n  return readJson(REQUEST_PATH);\n}\n\nfunction base() {\n  const url = (process.env.CODIEDEV_AGENTS_URL || \"\").replace(/\\/$/, \"\");\n  if (!url) throw new Error(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\");\n  return url;\n}\n\nfunction token() {\n  const t = process.env.CODIEDEV_RUN_TOKEN || process.env.CODIEDEV_TOKEN;\n  if (!t) throw new Error(\"Set CODIEDEV_TOKEN to your Codiedev CLI token (inside a run it's set for you)\");\n  return t;\n}\n\nasync function call(method, route, body, ok = []) {\n  const res = await fetch(`${base()}${route}`, {\n    method,\n    headers: { Authorization: `Bearer ${token()}`, \"Content-Type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const text = await res.text();\n  let data = {};\n  try {\n    data = text ? JSON.parse(text) : {};\n  } catch {\n    data = { error: text };\n  }\n  if (ok.includes(res.status)) return { _status: res.status, ...data };\n  if (!res.ok) throw new Error(`Codiedev agents API ${res.status}: ${data.error || text}`);\n  return data;\n}\n\n/** Start a run and return its id without waiting. delaySec (up to 7 days)\n *  starts it later; retries overrides the agent's retries. */\nexport async function start(agent, input = null, { idempotencyKey, delaySec, retries } = {}) {\n  return (await call(\"POST\", \"/api/agents/v1/run\", {\n    agent,\n    input,\n    ...(idempotencyKey ? { idempotencyKey } : {}),\n    ...(delaySec ? { delaySec } : {}),\n    ...(retries !== undefined ? { retries } : {}),\n  })).runId;\n}\n\nfunction localState() {\n  try {\n    return JSON.parse(fs.readFileSync(STATE_PATH, \"utf8\"));\n  } catch {\n    return {};\n  }\n}\n\nasync function writeState(key, value, { ifVersion, ttlSec } = {}) {\n  if (STATE_PATH) {\n    const data = localState();\n    const current = data[key]?.version ?? 0;\n    if (ifVersion !== undefined && ifVersion !== current) throw new StateConflict(key, current);\n    if (value === null) delete data[key];\n    else data[key] = { value, version: current + 1 };\n    fs.writeFileSync(STATE_PATH, JSON.stringify(data, null, 2));\n    return value === null ? 0 : current + 1;\n  }\n  const res = await call(\"POST\", \"/api/agents/v1/state\", { key, value, agent: AGENT, ...(ifVersion !== undefined ? { ifVersion } : {}), ...(ttlSec ? { ttlSec } : {}) }, [409]);\n  if (res._status === 409) throw new StateConflict(key, res.version ?? 0);\n  return res.version ?? 0;\n}\n\n/** Per-agent key-value storage that outlives runs (values: any JSON, up to\n *  64 KB; 1,000 keys). Every write bumps the key's version; pass ifVersion\n *  to write only if nobody else did since you read it. */\nexport const state = {\n  async get(key, fallback = null) {\n    const { value } = await state.getVersioned(key);\n    return value ?? fallback;\n  },\n  /** { value, version }; { value: null, version: 0 } when the key isn't set. */\n  async getVersioned(key) {\n    if (STATE_PATH) {\n      const row = localState()[key];\n      return row ? { value: row.value, version: row.version } : { value: null, version: 0 };\n    }\n    const res = await call(\"GET\", `/api/agents/v1/state?${new URLSearchParams({ key, agent: AGENT })}`, undefined, [404]);\n    if (res._status === 404) return { value: null, version: 0 };\n    return { value: JSON.parse(res.value), version: res.version };\n  },\n  /** Store value; returns the new version. Throws StateConflict on an ifVersion mismatch (0 = unset). */\n  set(key, value, { ifVersion, ttlSec } = {}) {\n    return writeState(key, value, { ifVersion, ttlSec });\n  },\n  async delete(key, { ifVersion } = {}) {\n    await writeState(key, null, { ifVersion });\n  },\n  /** Keys (and with values: true, values) starting with prefix. */\n  async list(prefix = \"\", { values = false } = {}) {\n    if (STATE_PATH) {\n      return Object.entries(localState())\n        .filter(([k]) => k.startsWith(prefix))\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([key, row]) => ({ key, version: row.version, ...(values ? { value: row.value } : {}) }));\n    }\n    const out = [];\n    let after = null;\n    do {\n      const q = new URLSearchParams({ prefix, values: values ? \"1\" : \"0\", limit: \"200\", agent: AGENT, ...(after ? { after } : {}) });\n      const page = await call(\"GET\", `/api/agents/v1/state?${q}`);\n      out.push(...page.keys.map((row) => (\"value\" in row ? { ...row, value: JSON.parse(row.value) } : row)));\n      after = page.next;\n    } while (after);\n    return out;\n  },\n  /** Read-modify-write that's safe with runs in parallel: fn(old) => new, retried if another run wrote first. */\n  async update(key, fn, fallback = null, retries = 10) {\n    for (let i = 0; i < retries; i++) {\n      const { value, version } = await state.getVersioned(key);\n      const next = await fn(value ?? fallback);\n      try {\n        await state.set(key, next, { ifVersion: version });\n        return next;\n      } catch (err) {\n        if (!(err instanceof StateConflict)) throw err;\n        await new Promise((resolve) => setTimeout(resolve, 50));\n      }\n    }\n    throw new StateConflict(key, -1);\n  },\n};\n\n/** Run fn() once for this run and remember its (JSON) result: if the run is\n *  retried after a failure, finished steps return their saved result instead\n *  of running again. Use it around side effects so a retry doesn't repeat them. */\nexport async function step(name, fn, { ttlSec = 7 * 86400 } = {}) {\n  const key = `step/${process.env.CODIEDEV_RUN_ID || \"local\"}/${name}`;\n  const { value, version } = await state.getVersioned(key);\n  if (version) return value.result;\n  const result = await fn();\n  await state.set(key, { result: result ?? null }, { ttlSec });\n  return result;\n}\n\n/** Ask a person to decide. It shows in Codiedev (Agents → Approvals) and at\n *  the returned .url, which you can post anywhere. When it's decided, a run of\n *  `then` (this agent by default; null for none) starts with input\n *  { approval: { decision, comment, decidedBy, ... }, context }. Undecided\n *  after expiresSec (default 7 days): decision \"expired\". */\nexport async function requestApproval(title, { details, options, approvers, then, context, expiresSec } = {}) {\n  if (process.env.CODIEDEV_LOCAL === \"1\") {\n    console.log(`[local] approval requested: ${title} (${(options || [\"approve\", \"reject\"]).join(\", \")}); not sent on a local run`);\n    return { id: `local-${Date.now()}`, status: \"pending\", url: null, title };\n  }\n  return call(\"POST\", \"/api/agents/v1/approvals\", {\n    title,\n    ...(details !== undefined ? { details } : {}),\n    ...(options ? { options } : {}),\n    ...(approvers ? { approvers } : {}),\n    ...(then !== undefined ? { onDecision: then } : {}),\n    ...(context !== undefined ? { context } : {}),\n    ...(expiresSec ? { expiresSec } : {}),\n  });\n}\n\n/** An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment. */\nexport async function getApproval(id) {\n  return call(\"GET\", `/api/agents/v1/approvals?id=${encodeURIComponent(id)}`);\n}\n\n/** A run's status, input, output (parsed), error, log and children. */\nexport async function get(runId) {\n  const run = await call(\"GET\", `/api/agents/v1/run?id=${encodeURIComponent(runId)}`);\n  if (typeof run.output === \"string\") {\n    try {\n      run.output = JSON.parse(run.output);\n    } catch {\n      // not JSON: keep the string\n    }\n  }\n  return run;\n}\n\n/** Run an agent and wait for it; its result is `.output`. Inside a run this\n *  starts a child run. Throws AgentRunError if it fails unless check is false. */\nexport async function run(agent, input = null, { timeoutMs = 900_000, pollMs = 2000, check = true, idempotencyKey } = {}) {\n  const id = await start(agent, input, { idempotencyKey });\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const r = await get(id);\n    if (DONE.has(r.status)) {\n      if (check && r.status !== \"succeeded\") throw new AgentRunError(r);\n      return r;\n    }\n    if (Date.now() > deadline) throw new Error(`${agent} run ${id} still ${r.status} after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** Options for `new OpenAI(...)` on the Codiedev gateway, with this run's trace headers. */\nexport function openaiOptions(extra = {}) {\n  const inRun = !!process.env.CODIEDEV_RUN_ID;\n  return {\n    baseURL: process.env.CODIEDEV_GATEWAY_URL || \"https://gateway.codiedev.com/api/v1\",\n    apiKey: process.env.CODIEDEV_API_KEY || process.env.CODIEDEV_TOKEN,\n    ...extra,\n    defaultHeaders: {\n      \"X-Codiedev-Workload\": process.env.CODIEDEV_AGENT || \"local-agent\",\n      \"X-Codiedev-Run-Id\": process.env.CODIEDEV_RUN_ID || `local-${Date.now()}`,\n      \"X-Codiedev-Environment\": inRun ? \"production\" : \"development\",\n      ...(extra.defaultHeaders || {}),\n    },\n  };\n}\n\n/** An OpenAI client on the Codiedev gateway (the `openai` package is preinstalled). */\nexport async function openai(extra = {}) {\n  const { default: OpenAI } = await import(\"openai\");\n  return new OpenAI(openaiOptions(extra));\n}\n";
-exports.jsTypes = "/* eslint-disable @typescript-eslint/no-explicit-any -- defaults are `any` on purpose: agent code reads its own JSON input/state without declaring types first. */\nexport type RunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\";\nexport interface Run<O = unknown> {\n  id: string;\n  agent: string;\n  version: number;\n  status: RunStatus;\n  trigger: \"cli\" | \"api\" | \"portal\" | \"schedule\" | \"webhook\" | \"child\" | \"approval\";\n  parentRunId: string | null;\n  rootRunId: string | null;\n  depth: number;\n  attempt: number;\n  maxAttempts: number;\n  scheduledFor: number | null;\n  input: string | null;\n  output: O;\n  error: string | null;\n  logTail: string | null;\n  durationMs: number | null;\n  children: Run[];\n}\nexport interface WebhookRequest { method: string; query: Record<string, string>; headers: Record<string, string>; body: string }\nexport interface Approval {\n  id: string;\n  agent: string;\n  title: string;\n  details: string | null;\n  options: string[];\n  status: \"pending\" | \"decided\" | \"expired\" | \"cancelled\";\n  decision: string | null;\n  comment: string | null;\n  decidedBy: string | null;\n  url: string | null;\n  resumeRunId: string | null;\n}\n/** The input a run started by a decision gets. */\nexport interface ApprovalInput<C = any> {\n  approval: { id: string; title: string; decision: string; comment: string | null; decidedBy: string | null; decidedAt: number; requestedByRun: string | null };\n  context: C;\n}\nexport class AgentRunError extends Error { run: Run }\nexport class StateConflict extends Error { key: string; version: number }\nexport function input<T = any>(fallback?: T): T;\nexport function output(value: unknown): void;\nexport function request(): WebhookRequest | null;\nexport function respond(body?: unknown, opts?: { status?: number; headers?: Record<string, string> }): void;\nexport function attempt(): number;\nexport function start(agent: string, input?: unknown, opts?: { idempotencyKey?: string; delaySec?: number; retries?: number }): Promise<string>;\nexport function get<O = any>(runId: string): Promise<Run<O>>;\nexport function run<O = any>(agent: string, input?: unknown, opts?: { timeoutMs?: number; pollMs?: number; check?: boolean; idempotencyKey?: string }): Promise<Run<O>>;\nexport const state: {\n  get<T = any>(key: string, fallback?: T): Promise<T>;\n  getVersioned<T = any>(key: string): Promise<{ value: T | null; version: number }>;\n  set(key: string, value: unknown, opts?: { ifVersion?: number; ttlSec?: number }): Promise<number>;\n  delete(key: string, opts?: { ifVersion?: number }): Promise<void>;\n  list(prefix?: string, opts?: { values?: boolean }): Promise<Array<{ key: string; version: number; value?: any }>>;\n  update<T = any>(key: string, fn: (old: T) => T | Promise<T>, fallback?: T, retries?: number): Promise<T>;\n};\nexport function step<T>(name: string, fn: () => T | Promise<T>, opts?: { ttlSec?: number }): Promise<T>;\nexport function requestApproval<C = any>(title: string, opts?: { details?: unknown; options?: string[]; approvers?: string[]; then?: string | null; context?: C; expiresSec?: number }): Promise<Approval>;\nexport function getApproval(id: string): Promise<Approval>;\nexport function openaiOptions(extra?: Record<string, unknown>): { baseURL: string; apiKey: string | undefined; defaultHeaders: Record<string, string> };\nexport function openai(extra?: Record<string, unknown>): Promise<import(\"openai\").default>;";
+exports.python = "\"\"\"Codiedev agents SDK — the run primitive, from Python.\n\nInside a deployed agent (everything is already configured):\n\n    import codiedev_agents as agents\n\n    task = agents.input()                      # this run's input (JSON)\n    llm = agents.openai()                      # OpenAI client on the Codiedev gateway, traced\n    child = agents.run(\"summarize\", {\"text\": ...})   # start another agent as a child run\n    agents.output({\"summary\": child[\"output\"]})      # this run's result\n    agents.request()                           # webhook runs: method, headers, raw body\n    agents.respond({\"text\": \"on it\"})          # what a webhook caller waiting (?wait=) gets back\n\n    agents.state.get(\"cursor\")                 # per-agent storage that outlives runs\n    agents.state.set(\"cursor\", 42)\n    agents.step(\"fetch\", lambda: fetch())      # done once per run, even across retries\n    agents.start(\"triage\", {...}, delay=3600)  # start a run later (up to 7 days)\n    agents.request_approval(\"Refund $120?\", context={...})  # a person decides; a run acts on it\n    agents.attempt()                           # 1, or 2+ when this run is a retry\n\nOutside a run (a script, a notebook, another service), set CODIEDEV_TOKEN\n(your CLI token) and CODIEDEV_AGENTS_URL, then call agents.run() the same way.\nStandard library only, so it drops into any project.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nfrom typing import Any\n\n__all__ = [\n    \"input\", \"output\", \"request\", \"respond\", \"run\", \"start\", \"get\", \"openai\", \"attempt\",\n    \"state\", \"step\", \"request_approval\", \"get_approval\", \"AgentRunError\", \"StateConflict\",\n]\n\n_INPUT_PATH = os.environ.get(\"CODIEDEV_INPUT_PATH\", \"/agent/.codiedev/input.json\")\n_OUTPUT_PATH = os.environ.get(\"CODIEDEV_OUTPUT_PATH\", \"/agent/.codiedev/output.json\")\n_REQUEST_PATH = os.environ.get(\"CODIEDEV_REQUEST_PATH\", \"/agent/.codiedev/request.json\")\n_RESPONSE_PATH = os.environ.get(\"CODIEDEV_RESPONSE_PATH\", \"/agent/.codiedev/response.json\")\n# Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\n_STATE_PATH = os.environ.get(\"CODIEDEV_STATE_PATH\")\n_DONE = {\"succeeded\", \"failed\", \"cancelled\"}\n\n\nclass StateConflict(RuntimeError):\n    \"\"\"state.set(..., if_version=n) found the key at another version.\"\"\"\n\n    def __init__(self, key: str, version: int):\n        super().__init__(f\"state {key!r} changed (now version {version})\")\n        self.key = key\n        self.version = version\n\n\nclass AgentRunError(RuntimeError):\n    def __init__(self, run: dict):\n        super().__init__(f\"{run.get('agent')} run {run.get('id')} {run.get('status')}: {run.get('error') or 'no error message'}\")\n        self.run = run\n\n\ndef input(default: Any = None) -> Any:  # noqa: A001 - mirrors output()\n    \"\"\"This run's input, parsed from JSON (None when started without one).\"\"\"\n    try:\n        with open(_INPUT_PATH) as f:\n            value = json.load(f)\n    except FileNotFoundError:\n        return default\n    return default if value is None else value\n\n\ndef output(value: Any) -> None:\n    \"\"\"Set this run's result. Must be JSON-serializable; the last call wins.\"\"\"\n    os.makedirs(os.path.dirname(_OUTPUT_PATH), exist_ok=True)\n    with open(_OUTPUT_PATH, \"w\") as f:\n        json.dump(value, f)\n\n\ndef respond(body: Any = None, status: int = 200, headers: \"dict | None\" = None) -> None:\n    \"\"\"What a webhook caller gets back when it waits for the run (?wait=N):\n    a string is sent as text, anything else as JSON. Without respond(), a\n    waiting caller gets the run's output.\"\"\"\n    os.makedirs(os.path.dirname(_RESPONSE_PATH), exist_ok=True)\n    with open(_RESPONSE_PATH, \"w\") as f:\n        json.dump({\"status\": status, \"headers\": headers or {}, \"body\": body}, f)\n\n\ndef attempt() -> int:\n    \"\"\"This run's attempt: 1, or 2+ when it's a retry of a failed attempt.\"\"\"\n    return int(os.environ.get(\"CODIEDEV_ATTEMPT\", \"1\"))\n\n\ndef request() -> \"dict | None\":\n    \"\"\"For a webhook run: {\"method\", \"query\", \"headers\", \"body\"} with the raw\n    body, to verify the sender's signature. None for other runs.\"\"\"\n    try:\n        with open(_REQUEST_PATH) as f:\n            return json.load(f)\n    except FileNotFoundError:\n        return None\n\n\ndef _base() -> str:\n    url = os.environ.get(\"CODIEDEV_AGENTS_URL\", \"\").rstrip(\"/\")\n    if not url:\n        raise RuntimeError(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\")\n    return url\n\n\ndef _token() -> str:\n    # Inside a run: the run's token. A connected agent (running outside Codiedev): its own key.\n    # Otherwise: your CLI token.\n    key = os.environ.get(\"CODIEDEV_API_KEY\", \"\")\n    token = os.environ.get(\"CODIEDEV_RUN_TOKEN\") or (key if key.startswith(\"cdvm_\") else None) or os.environ.get(\"CODIEDEV_TOKEN\")\n    if not token:\n        raise RuntimeError(\"Set CODIEDEV_API_KEY to your connected agent's key, or CODIEDEV_TOKEN to your CLI token (inside a run it's set for you)\")\n    return token\n\n\ndef _request(method: str, path: str, body: dict | None = None, ok: tuple[int, ...] = ()) -> dict:\n    req = urllib.request.Request(\n        f\"{_base()}{path}\",\n        method=method,\n        data=json.dumps(body).encode() if body is not None else None,\n        headers={\"Authorization\": f\"Bearer {_token()}\", \"Content-Type\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, timeout=30) as res:\n            return json.loads(res.read() or b\"{}\")\n    except urllib.error.HTTPError as err:\n        detail = err.read().decode(errors=\"replace\")\n        if err.code in ok:\n            return {\"_status\": err.code, **json.loads(detail or \"{}\")}\n        try:\n            detail = json.loads(detail).get(\"error\", detail)\n        except ValueError:\n            pass\n        raise RuntimeError(f\"Codiedev agents API {err.code}: {detail}\") from None\n\n\ndef start(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    idempotency_key: str | None = None,\n    delay: float | None = None,\n    retries: int | None = None,\n) -> str:\n    \"\"\"Start a run and return its id without waiting. With an idempotency key,\n    a second start within a day returns the first run's id. delay (seconds,\n    up to 7 days) starts it later; retries overrides the agent's retries.\"\"\"\n    body: dict = {\"agent\": agent, \"input\": input}\n    if idempotency_key:\n        body[\"idempotencyKey\"] = idempotency_key\n    if delay:\n        body[\"delaySec\"] = int(delay)\n    if retries is not None:\n        body[\"retries\"] = retries\n    return _request(\"POST\", \"/api/agents/v1/run\", body)[\"runId\"]\n\n\ndef get(run_id: str) -> dict:\n    \"\"\"A run's status, input, output (parsed), error, log tail and children.\"\"\"\n    run = _request(\"GET\", f\"/api/agents/v1/run?id={run_id}\")\n    if isinstance(run.get(\"output\"), str):\n        try:\n            run[\"output\"] = json.loads(run[\"output\"])\n        except ValueError:\n            pass\n    return run\n\n\ndef run(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    timeout: float = 900,\n    poll: float = 2.0,\n    check: bool = True,\n    idempotency_key: str | None = None,\n) -> dict:\n    \"\"\"Run an agent and wait for it. Returns the run; its result is run[\"output\"].\n\n    Inside a run this starts a child run, so the chain shows as one tree.\n    Raises AgentRunError if it fails (pass check=False to get the run anyway).\n    \"\"\"\n    run_id = start(agent, input, idempotency_key)\n    deadline = time.monotonic() + timeout\n    while True:\n        result = get(run_id)\n        if result.get(\"status\") in _DONE:\n            if check and result[\"status\"] != \"succeeded\":\n                raise AgentRunError(result)\n            return result\n        if time.monotonic() > deadline:\n            raise TimeoutError(f\"{agent} run {run_id} still {result.get('status')} after {timeout}s\")\n        time.sleep(poll)\n\n\nclass _State:\n    \"\"\"Per-agent key-value storage that outlives runs (values: any JSON, up\n    to 64 KB; 1,000 keys). Every write bumps the key's version; pass\n    if_version to write only if nobody else did since you read it.\"\"\"\n\n    def get(self, key: str, default: Any = None) -> Any:\n        value, _ = self.get_versioned(key)\n        return default if value is None else value\n\n    def get_versioned(self, key: str) -> \"tuple[Any, int]\":\n        \"\"\"(value, version); (None, 0) when the key isn't set.\"\"\"\n        if _STATE_PATH:\n            row = _local_state().get(key)\n            return (row[\"value\"], row[\"version\"]) if row else (None, 0)\n        res = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode({'key': key, 'agent': _agent()})}\", ok=(404,))\n        if res.get(\"_status\") == 404:\n            return None, 0\n        return json.loads(res[\"value\"]), int(res[\"version\"])\n\n    def set(self, key: str, value: Any, if_version: \"int | None\" = None, ttl: \"float | None\" = None) -> int:\n        \"\"\"Store value; returns the new version. Raises StateConflict when\n        if_version is given and the key is at another version (0 = unset).\"\"\"\n        return self._write(key, value, if_version, ttl)\n\n    def delete(self, key: str, if_version: \"int | None\" = None) -> None:\n        self._write(key, None, if_version, None)\n\n    def list(self, prefix: str = \"\", values: bool = False) -> \"list[dict]\":  # noqa: A003\n        \"\"\"Keys (and with values=True, values) starting with prefix.\"\"\"\n        if _STATE_PATH:\n            rows = sorted((k, r) for k, r in _local_state().items() if k.startswith(prefix))\n            return [{\"key\": k, \"version\": r[\"version\"], **({\"value\": r[\"value\"]} if values else {})} for k, r in rows]\n        keys: list = []\n        after = None\n        while True:\n            params = {\"prefix\": prefix, \"values\": \"1\" if values else \"0\", \"limit\": 200, \"agent\": _agent()}\n            if after:\n                params[\"after\"] = after\n            page = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode(params)}\")\n            for row in page[\"keys\"]:\n                if \"value\" in row:\n                    row[\"value\"] = json.loads(row[\"value\"])\n            keys.extend(page[\"keys\"])\n            after = page.get(\"next\")\n            if not after:\n                return keys\n\n    def update(self, key: str, fn, default: Any = None, retries: int = 10) -> Any:\n        \"\"\"Read-modify-write that's safe with runs in parallel: fn(old) -> new,\n        retried if another run wrote first. Returns the new value.\"\"\"\n        for _ in range(retries):\n            value, version = self.get_versioned(key)\n            new = fn(default if value is None else value)\n            try:\n                self.set(key, new, if_version=version)\n                return new\n            except StateConflict:\n                time.sleep(0.05)\n        raise StateConflict(key, -1)\n\n    def _write(self, key: str, value: Any, if_version: \"int | None\", ttl: \"float | None\") -> int:\n        if _STATE_PATH:\n            data = _local_state()\n            current = data.get(key, {}).get(\"version\", 0)\n            if if_version is not None and if_version != current:\n                raise StateConflict(key, current)\n            if value is None:\n                data.pop(key, None)\n            else:\n                data[key] = {\"value\": value, \"version\": current + 1}\n            with open(_STATE_PATH, \"w\") as f:\n                json.dump(data, f, indent=2)\n            return 0 if value is None else current + 1\n        body: dict = {\"key\": key, \"value\": value, \"agent\": _agent()}\n        if if_version is not None:\n            body[\"ifVersion\"] = if_version\n        if ttl:\n            body[\"ttlSec\"] = int(ttl)\n        res = _request(\"POST\", \"/api/agents/v1/state\", body, ok=(409,))\n        if res.get(\"_status\") == 409:\n            raise StateConflict(key, int(res.get(\"version\", 0)))\n        return int(res.get(\"version\", 0))\n\n\ndef _agent() -> str:\n    # Inside a run the run token picks the agent; a CLI token needs it named.\n    return os.environ.get(\"CODIEDEV_AGENT\", \"\")\n\n\ndef _local_state() -> dict:\n    try:\n        with open(_STATE_PATH or \"\") as f:\n            return json.load(f)\n    except (FileNotFoundError, ValueError):\n        return {}\n\n\nstate = _State()\n\n\ndef step(name: str, fn, ttl: float = 7 * 86400) -> Any:\n    \"\"\"Run fn() once for this run and remember its (JSON) result: if the run\n    is retried after a failure, finished steps return their saved result\n    instead of running again. Use it around side effects (posting a reply,\n    charging a card) so a retry doesn't repeat them.\"\"\"\n    key = f\"step/{os.environ.get('CODIEDEV_RUN_ID', 'local')}/{name}\"\n    value, version = state.get_versioned(key)\n    if version:\n        return value[\"result\"]\n    result = fn()\n    state.set(key, {\"result\": result}, ttl=ttl)\n    return result\n\n\n_SELF = object()\n\n\ndef request_approval(\n    title: str,\n    details: Any = None,\n    options: \"list[str] | None\" = None,\n    approvers: \"list[str] | None\" = None,\n    teams: \"list[str] | None\" = None,\n    fields: \"list[dict] | None\" = None,\n    then: Any = _SELF,\n    context: Any = None,\n    expires_in: \"float | None\" = None,\n) -> dict:\n    \"\"\"Ask a person to decide. It shows in Codiedev (Agents → Approvals) and\n    at the returned [\"url\"], which you can post anywhere (Slack, email).\n\n    When it's decided, a run of `then` (this agent by default; None for no\n    run) starts with input {\"approval\": {\"decision\", \"comment\", \"decidedBy\",\n    ...}, \"context\": context}. If nobody decides within expires_in seconds\n    (default 7 days), it starts with decision \"expired\". Usually the run\n    ends after asking, so nothing runs (or costs) while it waits.\n    options default to [\"approve\", \"reject\"]; approvers (emails) and teams\n    (team names, e.g. [\"Finance\"]) limit who can decide (admins always can).\n    Apps your company connects (Agents → Approvals → Apps) are told about it\n    by webhook and can decide on a person's behalf.\n\n    fields asks the person to fill something in as they decide, e.g.\n    [{\"name\": \"rating\", \"type\": \"rating\"}, {\"name\": \"why\", \"type\": \"textarea\"}]\n    (types: text, textarea, number, rating, select, multiselect, boolean;\n    required, label, help, options, min, max, default). What they entered\n    arrives as input[\"approval\"][\"values\"]. With fields and no options, the\n    only choice is \"submit\".\"\"\"\n    body: dict = {\"title\": title, \"details\": details, \"options\": options, \"approvers\": approvers, \"teams\": teams, \"fields\": fields, \"context\": context}\n    if then is not _SELF:\n        body[\"onDecision\"] = then\n    if expires_in:\n        body[\"expiresSec\"] = int(expires_in)\n    if os.environ.get(\"CODIEDEV_LOCAL\") == \"1\":\n        print(f\"[local] approval requested: {title} ({', '.join(options or (['submit'] if fields else ['approve', 'reject']))}); not sent on a local run\", flush=True)\n        return {\"id\": f\"local-{int(time.time())}\", \"status\": \"pending\", \"url\": None, \"title\": title}\n    return _request(\"POST\", \"/api/agents/v1/approvals\", {k: v for k, v in body.items() if v is not None or k == \"onDecision\"})\n\n\ndef get_approval(approval_id: str) -> dict:\n    \"\"\"An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment.\"\"\"\n    return _request(\"GET\", f\"/api/agents/v1/approvals?id={urllib.parse.quote(approval_id)}\")\n\n\ndef wait_for_approval(approval_id: str, timeout: float = 3600, poll: float = 15) -> dict:\n    \"\"\"Wait until a person decides (or it expires), then return the approval. For agents that keep\n    running while they wait, like a connected agent; a run inside Codiedev usually ends instead and\n    is started again with the decision.\"\"\"\n    deadline = time.time() + timeout\n    while True:\n        a = get_approval(approval_id)\n        if a.get(\"status\") != \"pending\":\n            return a\n        if time.time() > deadline:\n            raise TimeoutError(f\"approval {approval_id} still pending after {timeout}s\")\n        time.sleep(poll)\n\n\ndef openai(**kwargs):\n    \"\"\"An OpenAI client on the Codiedev gateway, with trace headers for this run.\"\"\"\n    from openai import OpenAI\n\n    headers = {\n        \"X-Codiedev-Workload\": os.environ.get(\"CODIEDEV_AGENT\", \"local-agent\"),\n        \"X-Codiedev-Run-Id\": os.environ.get(\"CODIEDEV_RUN_ID\", f\"local-{int(time.time())}\"),\n        \"X-Codiedev-Environment\": \"production\" if os.environ.get(\"CODIEDEV_RUN_ID\") else \"development\",\n    }\n    headers.update(kwargs.pop(\"default_headers\", {}) or {})\n    return OpenAI(\n        base_url=os.environ.get(\"CODIEDEV_GATEWAY_URL\", \"https://gateway.codiedev.com/api/v1\"),\n        api_key=os.environ.get(\"CODIEDEV_API_KEY\") or os.environ.get(\"CODIEDEV_TOKEN\"),\n        default_headers=headers,\n        **kwargs,\n    )\n";
+exports.jsIndex = "// Codiedev agents SDK for JavaScript and TypeScript, preinstalled in every\n// run. Same primitive as the Python SDK (codiedev_agents.py):\n//\n//   import * as agents from \"codiedev-agents\";\n//   const task = agents.input();                    // this run's input (JSON)\n//   const llm = await agents.openai();              // OpenAI client on the Codiedev gateway, traced\n//   const child = await agents.run(\"summarize\", { text });  // another agent, as a child run\n//   agents.output({ summary: child.output });       // this run's result\n//   agents.respond({ text: \"on it\" });              // what a webhook caller waiting (?wait=) gets back\n//   await agents.state.get(\"cursor\");               // per-agent storage that outlives runs\n//   await agents.step(\"post\", () => post());        // done once per run, even across retries\n//   await agents.start(\"triage\", input, { delaySec: 3600 });  // start a run later\n//   await agents.requestApproval(\"Refund $120?\", { context });  // a person decides; a run acts on it\n//\n// Outside a run, set CODIEDEV_TOKEN and CODIEDEV_AGENTS_URL and call run() the same way.\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst INPUT_PATH = process.env.CODIEDEV_INPUT_PATH || \"/agent/.codiedev/input.json\";\nconst OUTPUT_PATH = process.env.CODIEDEV_OUTPUT_PATH || \"/agent/.codiedev/output.json\";\nconst REQUEST_PATH = process.env.CODIEDEV_REQUEST_PATH || \"/agent/.codiedev/request.json\";\nconst RESPONSE_PATH = process.env.CODIEDEV_RESPONSE_PATH || \"/agent/.codiedev/response.json\";\n// Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\nconst STATE_PATH = process.env.CODIEDEV_STATE_PATH;\n// Inside a run the run token picks the agent; a CLI token needs it named.\nconst AGENT = process.env.CODIEDEV_AGENT || \"\";\nconst DONE = new Set([\"succeeded\", \"failed\", \"cancelled\"]);\n\n/** state.set(..., { ifVersion }) found the key at another version. */\nexport class StateConflict extends Error {\n  constructor(key, version) {\n    super(`state ${JSON.stringify(key)} changed (now version ${version})`);\n    this.key = key;\n    this.version = version;\n  }\n}\n\nexport class AgentRunError extends Error {\n  constructor(run) {\n    super(`${run.agent} run ${run.id} ${run.status}: ${run.error || \"no error message\"}`);\n    this.run = run;\n  }\n}\n\nfunction readJson(file) {\n  try {\n    return JSON.parse(fs.readFileSync(file, \"utf8\"));\n  } catch (err) {\n    if (err.code === \"ENOENT\") return null;\n    throw err;\n  }\n}\n\n/** This run's input, parsed from JSON (`fallback` when started without one). */\nexport function input(fallback = null) {\n  const value = readJson(INPUT_PATH);\n  return value ?? fallback;\n}\n\n/** Set this run's result. Must be JSON-serializable; the last call wins. */\nexport function output(value) {\n  fs.mkdirSync(path.dirname(OUTPUT_PATH), { recursive: true });\n  fs.writeFileSync(OUTPUT_PATH, JSON.stringify(value));\n}\n\n/** What a webhook caller gets back when it waits for the run (?wait=N): a\n *  string is sent as text, anything else as JSON. Without it, a waiting\n *  caller gets the run's output. */\nexport function respond(body = null, { status = 200, headers = {} } = {}) {\n  fs.mkdirSync(path.dirname(RESPONSE_PATH), { recursive: true });\n  fs.writeFileSync(RESPONSE_PATH, JSON.stringify({ status, headers, body }));\n}\n\n/** This run's attempt: 1, or 2+ when it's a retry of a failed attempt. */\nexport function attempt() {\n  return Number(process.env.CODIEDEV_ATTEMPT || \"1\");\n}\n\n/** For a webhook run: { method, query, headers, body } with the raw body, to verify a signature. */\nexport function request() {\n  return readJson(REQUEST_PATH);\n}\n\nfunction base() {\n  const url = (process.env.CODIEDEV_AGENTS_URL || \"\").replace(/\\/$/, \"\");\n  if (!url) throw new Error(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\");\n  return url;\n}\n\nfunction token() {\n  // Inside a run: the run's token. A connected agent (running outside Codiedev): its own key.\n  // Otherwise: your CLI token.\n  const key = process.env.CODIEDEV_API_KEY || \"\";\n  const t = process.env.CODIEDEV_RUN_TOKEN || (key.startsWith(\"cdvm_\") ? key : \"\") || process.env.CODIEDEV_TOKEN;\n  if (!t) throw new Error(\"Set CODIEDEV_API_KEY to your connected agent's key, or CODIEDEV_TOKEN to your CLI token (inside a run it's set for you)\");\n  return t;\n}\n\nasync function call(method, route, body, ok = []) {\n  const res = await fetch(`${base()}${route}`, {\n    method,\n    headers: { Authorization: `Bearer ${token()}`, \"Content-Type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const text = await res.text();\n  let data = {};\n  try {\n    data = text ? JSON.parse(text) : {};\n  } catch {\n    data = { error: text };\n  }\n  if (ok.includes(res.status)) return { _status: res.status, ...data };\n  if (!res.ok) throw new Error(`Codiedev agents API ${res.status}: ${data.error || text}`);\n  return data;\n}\n\n/** Start a run and return its id without waiting. delaySec (up to 7 days)\n *  starts it later; retries overrides the agent's retries. */\nexport async function start(agent, input = null, { idempotencyKey, delaySec, retries } = {}) {\n  return (await call(\"POST\", \"/api/agents/v1/run\", {\n    agent,\n    input,\n    ...(idempotencyKey ? { idempotencyKey } : {}),\n    ...(delaySec ? { delaySec } : {}),\n    ...(retries !== undefined ? { retries } : {}),\n  })).runId;\n}\n\nfunction localState() {\n  try {\n    return JSON.parse(fs.readFileSync(STATE_PATH, \"utf8\"));\n  } catch {\n    return {};\n  }\n}\n\nasync function writeState(key, value, { ifVersion, ttlSec } = {}) {\n  if (STATE_PATH) {\n    const data = localState();\n    const current = data[key]?.version ?? 0;\n    if (ifVersion !== undefined && ifVersion !== current) throw new StateConflict(key, current);\n    if (value === null) delete data[key];\n    else data[key] = { value, version: current + 1 };\n    fs.writeFileSync(STATE_PATH, JSON.stringify(data, null, 2));\n    return value === null ? 0 : current + 1;\n  }\n  const res = await call(\"POST\", \"/api/agents/v1/state\", { key, value, agent: AGENT, ...(ifVersion !== undefined ? { ifVersion } : {}), ...(ttlSec ? { ttlSec } : {}) }, [409]);\n  if (res._status === 409) throw new StateConflict(key, res.version ?? 0);\n  return res.version ?? 0;\n}\n\n/** Per-agent key-value storage that outlives runs (values: any JSON, up to\n *  64 KB; 1,000 keys). Every write bumps the key's version; pass ifVersion\n *  to write only if nobody else did since you read it. */\nexport const state = {\n  async get(key, fallback = null) {\n    const { value } = await state.getVersioned(key);\n    return value ?? fallback;\n  },\n  /** { value, version }; { value: null, version: 0 } when the key isn't set. */\n  async getVersioned(key) {\n    if (STATE_PATH) {\n      const row = localState()[key];\n      return row ? { value: row.value, version: row.version } : { value: null, version: 0 };\n    }\n    const res = await call(\"GET\", `/api/agents/v1/state?${new URLSearchParams({ key, agent: AGENT })}`, undefined, [404]);\n    if (res._status === 404) return { value: null, version: 0 };\n    return { value: JSON.parse(res.value), version: res.version };\n  },\n  /** Store value; returns the new version. Throws StateConflict on an ifVersion mismatch (0 = unset). */\n  set(key, value, { ifVersion, ttlSec } = {}) {\n    return writeState(key, value, { ifVersion, ttlSec });\n  },\n  async delete(key, { ifVersion } = {}) {\n    await writeState(key, null, { ifVersion });\n  },\n  /** Keys (and with values: true, values) starting with prefix. */\n  async list(prefix = \"\", { values = false } = {}) {\n    if (STATE_PATH) {\n      return Object.entries(localState())\n        .filter(([k]) => k.startsWith(prefix))\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([key, row]) => ({ key, version: row.version, ...(values ? { value: row.value } : {}) }));\n    }\n    const out = [];\n    let after = null;\n    do {\n      const q = new URLSearchParams({ prefix, values: values ? \"1\" : \"0\", limit: \"200\", agent: AGENT, ...(after ? { after } : {}) });\n      const page = await call(\"GET\", `/api/agents/v1/state?${q}`);\n      out.push(...page.keys.map((row) => (\"value\" in row ? { ...row, value: JSON.parse(row.value) } : row)));\n      after = page.next;\n    } while (after);\n    return out;\n  },\n  /** Read-modify-write that's safe with runs in parallel: fn(old) => new, retried if another run wrote first. */\n  async update(key, fn, fallback = null, retries = 10) {\n    for (let i = 0; i < retries; i++) {\n      const { value, version } = await state.getVersioned(key);\n      const next = await fn(value ?? fallback);\n      try {\n        await state.set(key, next, { ifVersion: version });\n        return next;\n      } catch (err) {\n        if (!(err instanceof StateConflict)) throw err;\n        await new Promise((resolve) => setTimeout(resolve, 50));\n      }\n    }\n    throw new StateConflict(key, -1);\n  },\n};\n\n/** Run fn() once for this run and remember its (JSON) result: if the run is\n *  retried after a failure, finished steps return their saved result instead\n *  of running again. Use it around side effects so a retry doesn't repeat them. */\nexport async function step(name, fn, { ttlSec = 7 * 86400 } = {}) {\n  const key = `step/${process.env.CODIEDEV_RUN_ID || \"local\"}/${name}`;\n  const { value, version } = await state.getVersioned(key);\n  if (version) return value.result;\n  const result = await fn();\n  await state.set(key, { result: result ?? null }, { ttlSec });\n  return result;\n}\n\n/** Ask a person to decide. It shows in Codiedev (Agents → Approvals) and at\n *  the returned .url, which you can post anywhere. When it's decided, a run of\n *  `then` (this agent by default; null for none) starts with input\n *  { approval: { decision, comment, decidedBy, ... }, context }. Undecided\n *  after expiresSec (default 7 days): decision \"expired\". */\nexport async function requestApproval(title, { details, options, approvers, teams, fields, then, context, expiresSec } = {}) {\n  if (process.env.CODIEDEV_LOCAL === \"1\") {\n    console.log(`[local] approval requested: ${title} (${(options || (fields ? [\"submit\"] : [\"approve\", \"reject\"])).join(\", \")}); not sent on a local run`);\n    return { id: `local-${Date.now()}`, status: \"pending\", url: null, title };\n  }\n  return call(\"POST\", \"/api/agents/v1/approvals\", {\n    title,\n    ...(details !== undefined ? { details } : {}),\n    ...(options ? { options } : {}),\n    ...(approvers ? { approvers } : {}),\n    ...(teams ? { teams } : {}),\n    ...(fields ? { fields } : {}),\n    ...(then !== undefined ? { onDecision: then } : {}),\n    ...(context !== undefined ? { context } : {}),\n    ...(expiresSec ? { expiresSec } : {}),\n  });\n}\n\n/** An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment. */\nexport async function getApproval(id) {\n  return call(\"GET\", `/api/agents/v1/approvals?id=${encodeURIComponent(id)}`);\n}\n\n/** Wait until a person decides (or it expires), then return the approval. For agents that keep\n *  running while they wait, like a connected agent; a run inside Codiedev usually ends instead and\n *  is started again with the decision. */\nexport async function waitForApproval(id, { timeoutMs = 3_600_000, pollMs = 15_000 } = {}) {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const a = await getApproval(id);\n    if (a.status !== \"pending\") return a;\n    if (Date.now() > deadline) throw new Error(`approval ${id} still pending after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** A run's status, input, output (parsed), error, log and children. */\nexport async function get(runId) {\n  const run = await call(\"GET\", `/api/agents/v1/run?id=${encodeURIComponent(runId)}`);\n  if (typeof run.output === \"string\") {\n    try {\n      run.output = JSON.parse(run.output);\n    } catch {\n      // not JSON: keep the string\n    }\n  }\n  return run;\n}\n\n/** Run an agent and wait for it; its result is `.output`. Inside a run this\n *  starts a child run. Throws AgentRunError if it fails unless check is false. */\nexport async function run(agent, input = null, { timeoutMs = 900_000, pollMs = 2000, check = true, idempotencyKey } = {}) {\n  const id = await start(agent, input, { idempotencyKey });\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const r = await get(id);\n    if (DONE.has(r.status)) {\n      if (check && r.status !== \"succeeded\") throw new AgentRunError(r);\n      return r;\n    }\n    if (Date.now() > deadline) throw new Error(`${agent} run ${id} still ${r.status} after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** Options for `new OpenAI(...)` on the Codiedev gateway, with this run's trace headers. */\nexport function openaiOptions(extra = {}) {\n  const inRun = !!process.env.CODIEDEV_RUN_ID;\n  return {\n    baseURL: process.env.CODIEDEV_GATEWAY_URL || \"https://gateway.codiedev.com/api/v1\",\n    apiKey: process.env.CODIEDEV_API_KEY || process.env.CODIEDEV_TOKEN,\n    ...extra,\n    defaultHeaders: {\n      \"X-Codiedev-Workload\": process.env.CODIEDEV_AGENT || \"local-agent\",\n      \"X-Codiedev-Run-Id\": process.env.CODIEDEV_RUN_ID || `local-${Date.now()}`,\n      \"X-Codiedev-Environment\": inRun ? \"production\" : \"development\",\n      ...(extra.defaultHeaders || {}),\n    },\n  };\n}\n\n/** An OpenAI client on the Codiedev gateway (the `openai` package is preinstalled). */\nexport async function openai(extra = {}) {\n  const { default: OpenAI } = await import(\"openai\");\n  return new OpenAI(openaiOptions(extra));\n}\n";
+exports.jsTypes = "/* eslint-disable @typescript-eslint/no-explicit-any -- defaults are `any` on purpose: agent code reads its own JSON input/state without declaring types first. */\nexport type RunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\";\nexport interface Run<O = unknown> {\n  id: string;\n  agent: string;\n  version: number;\n  status: RunStatus;\n  trigger: \"cli\" | \"api\" | \"portal\" | \"schedule\" | \"webhook\" | \"child\" | \"approval\";\n  parentRunId: string | null;\n  rootRunId: string | null;\n  depth: number;\n  attempt: number;\n  maxAttempts: number;\n  scheduledFor: number | null;\n  input: string | null;\n  output: O;\n  error: string | null;\n  logTail: string | null;\n  durationMs: number | null;\n  children: Run[];\n}\nexport interface WebhookRequest { method: string; query: Record<string, string>; headers: Record<string, string>; body: string }\nexport interface Approval {\n  id: string;\n  agent: string;\n  title: string;\n  details: string | null;\n  options: string[];\n  status: \"pending\" | \"decided\" | \"expired\" | \"cancelled\";\n  decision: string | null;\n  comment: string | null;\n  decidedBy: string | null;\n  /** The approval app that sent the decision on decidedBy's behalf; null when decided in Codiedev. */\n  decidedVia: string | null;\n  approvers: string[];\n  approverTeams: Array<{ id: string; name: string }>;\n  /** The form the person fills in, if the approval asked for one. */\n  fields: ApprovalField[];\n  /** What they entered, by field name (null until decided). */\n  values: Record<string, any> | null;\n  url: string | null;\n  resumeRunId: string | null;\n}\n/** One thing a person fills in when they decide. */\nexport interface ApprovalField {\n  name: string;\n  type: \"text\" | \"textarea\" | \"number\" | \"rating\" | \"select\" | \"multiselect\" | \"boolean\";\n  label?: string;\n  help?: string;\n  required?: boolean;\n  /** select / multiselect choices */\n  options?: string[];\n  /** number bounds; rating scale 1–max (default 5) */\n  min?: number;\n  max?: number;\n  /** prefilled, e.g. a proposed amount for the person to correct */\n  default?: unknown;\n}\n/** The input a run started by a decision gets. */\nexport interface ApprovalInput<C = any, V = Record<string, any>> {\n  approval: { id: string; title: string; decision: string; comment: string | null; values: V; decidedBy: string | null; decidedVia: string | null; decidedAt: number; requestedByRun: string | null };\n  context: C;\n}\nexport class AgentRunError extends Error { run: Run }\nexport class StateConflict extends Error { key: string; version: number }\nexport function input<T = any>(fallback?: T): T;\nexport function output(value: unknown): void;\nexport function request(): WebhookRequest | null;\nexport function respond(body?: unknown, opts?: { status?: number; headers?: Record<string, string> }): void;\nexport function attempt(): number;\nexport function start(agent: string, input?: unknown, opts?: { idempotencyKey?: string; delaySec?: number; retries?: number }): Promise<string>;\nexport function get<O = any>(runId: string): Promise<Run<O>>;\nexport function run<O = any>(agent: string, input?: unknown, opts?: { timeoutMs?: number; pollMs?: number; check?: boolean; idempotencyKey?: string }): Promise<Run<O>>;\nexport const state: {\n  get<T = any>(key: string, fallback?: T): Promise<T>;\n  getVersioned<T = any>(key: string): Promise<{ value: T | null; version: number }>;\n  set(key: string, value: unknown, opts?: { ifVersion?: number; ttlSec?: number }): Promise<number>;\n  delete(key: string, opts?: { ifVersion?: number }): Promise<void>;\n  list(prefix?: string, opts?: { values?: boolean }): Promise<Array<{ key: string; version: number; value?: any }>>;\n  update<T = any>(key: string, fn: (old: T) => T | Promise<T>, fallback?: T, retries?: number): Promise<T>;\n};\nexport function step<T>(name: string, fn: () => T | Promise<T>, opts?: { ttlSec?: number }): Promise<T>;\nexport function requestApproval<C = any>(title: string, opts?: { details?: unknown; options?: string[]; approvers?: string[]; teams?: string[]; fields?: ApprovalField[]; then?: string | null; context?: C; expiresSec?: number }): Promise<Approval>;\nexport function getApproval(id: string): Promise<Approval>;\nexport function waitForApproval(id: string, opts?: { timeoutMs?: number; pollMs?: number }): Promise<Approval>;\nexport function openaiOptions(extra?: Record<string, unknown>): { baseURL: string; apiKey: string | undefined; defaultHeaders: Record<string, string> };\nexport function openai(extra?: Record<string, unknown>): Promise<import(\"openai\").default>;";
 exports.jsPackage = "{\n  \"name\": \"codiedev-agents\",\n  \"version\": \"0.1.0\",\n  \"description\": \"Codiedev agents SDK: this run's input and output, chaining, and a traced OpenAI client.\",\n  \"type\": \"module\",\n  \"main\": \"./index.mjs\",\n  \"types\": \"./index.d.ts\",\n  \"exports\": { \".\": { \"types\": \"./index.d.ts\", \"default\": \"./index.mjs\" } }\n}\n";

package/dist/connect.js

@@ -41,12 +41,22 @@ const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
 const shared_1 = require("./commands/shared");
 const harnessDirs_1 = require("./harnessDirs");
 const BACKEND_URL = process.env.CODIEDEV_URL || "https://cli.codiedev.com";
+function prompt(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
 function promptHidden(question) {
     return new Promise((resolve) => {
         const stdin = process.stdin;
@@ -143,16 +153,39 @@ function postJson(url, body, extraHeaders = {}) {
 }
 async function runConnect(args = []) {
     const force = args.includes("--force") || args.includes("-f");
+    const pasteToken = args.includes("--token");
+    const useDevice = args.includes("--no-browser") || (!args.includes("--browser") && (0, cliSession_1.isHeadless)());
     console.log("\nWelcome to Codiedev CLI\n");
     await (0, upgradeNudge_1.maybePrintUpgradeNudge)();
     console.log("This will connect your coding agent to your Codiedev workspace and install");
     console.log("the session capture hook for org-wide session sharing.\n");
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const saved = (0, utils_1.readConfig)();
-    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force });
+    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force: force || pasteToken });
     let token;
+    let auth;
     if (decision.source === "reused") {
         token = decision.token;
-        console.log(`Reusing API token from ~/.codiedev/config.json (run with --force to use a new one).\n`);
+        auth = saved?.auth;
+        console.log(auth
+            ? `Reusing your browser sign-in from ~/.codiedev/config.json (run with --force to sign in again).\n`
+            : `Reusing API token from ~/.codiedev/config.json (run with --force to sign in again).\n`);
+    }
+    else if (!pasteToken) {
+        if (saved?.auth)
+            await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
+        const result = await (0, connectFlow_1.signInWithTokenFallback)({
+            signIn: () => useDevice ? (0, cliSession_1.deviceLogin)({ backendUrl: BACKEND_URL }) : (0, cliSession_1.browserLogin)({ backendUrl: BACKEND_URL }),
+            interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+            askYesNo: async (q) => /^y(es)?$/i.test((await prompt(q)).trim()),
+            askToken: promptHidden,
+            log: (line) => console.log(line),
+            error: (line) => console.error(line),
+        });
+        if (!result)
+            process.exit(1);
+        token = result.token;
+        auth = result.auth;
     }
     else {
         token = await promptHidden("Enter your Codiedev API token: ");
@@ -189,6 +222,7 @@ async function runConnect(args = []) {
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
+        ...(auth ? { auth } : {}),
     };
     try {
         (0, utils_1.writeConfig)(config);

package/dist/connectFlow.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveConnectToken = resolveConnectToken;
+exports.signInWithTokenFallback = signInWithTokenFallback;
 function resolveConnectToken(input) {
     if (input.force)
         return { source: "prompt-required" };
@@ -10,3 +11,37 @@ function resolveConnectToken(input) {
         return { source: "prompt-required" };
     return { source: "reused", token: input.savedConfig.token };
 }
+async function signInWithTokenFallback(deps) {
+    deps.log("Prefer an API token? Press Ctrl+C and run `codiedev connect --token`.\n");
+    try {
+        const s = await deps.signIn();
+        deps.log("Signed in. No API key is stored on this machine.\n");
+        return {
+            token: s.accessToken,
+            auth: {
+                kind: "browser",
+                clientId: s.clientId,
+                refreshToken: s.refreshToken,
+                accessTokenExpiresAt: s.expiresAt,
+            },
+        };
+    }
+    catch (err) {
+        deps.error(`\nBrowser sign-in didn't finish: ${err.message}`);
+        if (!deps.interactive) {
+            deps.error("To paste an API token instead, run `codiedev connect --token`.");
+            return null;
+        }
+        if (!(await deps.askYesNo("Paste an API token instead? [y/N] "))) {
+            deps.error("Run `codiedev connect` to try again, or `codiedev connect --token` to paste a token.");
+            return null;
+        }
+        deps.log("Create one at https://codiedev.com/portal/integrations/claude-code\n");
+        const token = (await deps.askToken("Enter your Codiedev API token: ")).trim();
+        if (!token) {
+            deps.error("Error: API token is required.");
+            return null;
+        }
+        return { token };
+    }
+}

package/dist/hook.js

@@ -58,6 +58,8 @@ const captureExclusions_1 = require("./captureExclusions");
 const cursorHooks_1 = require("./cursorHooks");
 const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
+const cliSession_1 = require("./cliSession");
+const utils_2 = require("./utils");
 function buildDiscoveryContext(skills) {
     if (skills.length === 0)
         return null;
@@ -380,6 +382,7 @@ function resolveMode(arg) {
     return "claude-code";
 }
 async function main() {
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
     function makeUploadDeps() {
         return {
             post: postJson,

package/dist/mcp.js

@@ -41,6 +41,7 @@ const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const shared_1 = require("./commands/shared");
 const inboxFormat_1 = require("./inboxFormat");
 const PKG_NAME = "codiedev";
@@ -375,6 +376,7 @@ function emitTelemetry(config, event) {
     });
 }
 server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const config = (0, utils_1.readConfig)();
     if (!config) {
         return {

package/dist/utils.js

@@ -152,6 +152,7 @@ const piHooks_1 = require("./piHooks");
 var piHooks_2 = require("./piHooks");
 Object.defineProperty(exports, "inspectPiExtension", { enumerable: true, get: function () { return piHooks_2.inspectPiExtension; } });
 Object.defineProperty(exports, "piExtensionPath", { enumerable: true, get: function () { return piHooks_2.piExtensionPath; } });
+const cliSession_1 = require("./cliSession");
 const CONFIG_DIR = (0, configDir_1.codiedevStateDir)();
 exports.CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 function readConfig() {
@@ -172,11 +173,7 @@ function writeConfigAtPath(config, configDir, configPath) {
     if (!fs.existsSync(configDir)) {
         fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    fs.chmodSync(configPath, 0o600);
+    (0, cliSession_1.writeConfigAtomic)(configPath, config);
 }
 function parseGitRemoteFromConfig(configText) {
     const remotes = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.10.0-beta.6",
+  "version": "0.10.0-beta.8",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration \u2014 and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",