codiedev 0.9.20 → 0.9.22

package/dist/captureReadiness.d.ts

@@ -36,7 +36,20 @@ export interface CaptureActivitySummary {
     status: "pass" | "warn" | "fail";
     detail: string;
 }
-export declare function summarizeCaptureActivity(tailLines: string[], pendingJobCount: number): CaptureActivitySummary;
+/**
+ * When `text` (an error message, code, or capture.log detail) indicates a
+ * TLS-trust failure from SSL inspection, return the remediation hint;
+ * otherwise null.
+ */
+export declare function tlsInterceptionHint(text: string, host: string): string | null;
+/**
+ * Flatten a thrown fetch/network error to "<message> (<code>)". undici's
+ * fetch wraps the real failure in TypeError("fetch failed") with the cause
+ * chained on `.cause` — walk to the deepest cause so doctor reports the
+ * actual TLS/socket error instead of "fetch failed".
+ */
+export declare function describeFetchError(err: unknown): string;
+export declare function summarizeCaptureActivity(tailLines: string[], pendingJobCount: number, backendHost?: string): CaptureActivitySummary;
 export interface ServerCaptureResponse {
     found: boolean;
     latest: {

package/dist/captureReadiness.js

@@ -11,6 +11,8 @@ exports.assessCaptureReadiness = assessCaptureReadiness;
 exports.assessWorkspaceRepos = assessWorkspaceRepos;
 exports.formatRelativeAge = formatRelativeAge;
 exports.summarizeLastCapture = summarizeLastCapture;
+exports.tlsInterceptionHint = tlsInterceptionHint;
+exports.describeFetchError = describeFetchError;
 exports.summarizeCaptureActivity = summarizeCaptureActivity;
 exports.summarizeServerCapture = summarizeServerCapture;
 function assessCaptureReadiness(cwd, repos, deps) {
@@ -109,15 +111,56 @@ const STRUCTURED_LINE_RE = /^(\S+) (capture-finish|upload|upload-deferred|stderr
 function withSuffix(detail) {
     return `${detail} ${LOG_PATH_SUFFIX}`;
 }
+// TLS-trust failure phrases/codes. These are what Node's TLS stack emits when
+// a middlebox (corporate proxy / VPN doing SSL inspection) re-signs HTTPS with
+// an internal CA. Node uses its OWN bundled Mozilla trust store — NOT the OS
+// store — so installing the corporate cert system-wide fixes curl/git but not
+// the CLI; only NODE_EXTRA_CA_CERTS (or an IT bypass) does.
+// "certificate has expired" is deliberately absent: that's a server-side cert
+// problem, not interception, and the hint would mislead.
+const TLS_INTERCEPTION_RE = /self.signed certificate|unable to verify the first certificate|unable to get local issuer certificate|SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_VERIFY_LEAF_SIGNATURE|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|DEPTH_ZERO_SELF_SIGNED_CERT|CERT_UNTRUSTED/i;
+/**
+ * When `text` (an error message, code, or capture.log detail) indicates a
+ * TLS-trust failure from SSL inspection, return the remediation hint;
+ * otherwise null.
+ */
+function tlsInterceptionHint(text, host) {
+    if (!TLS_INTERCEPTION_RE.test(text))
+        return null;
+    return (`your network is intercepting TLS (corporate proxy/VPN). Node ignores the OS cert store — ` +
+        `set NODE_EXTRA_CA_CERTS to your corporate root CA file, or ask IT to bypass SSL inspection for ${host}`);
+}
+/**
+ * Flatten a thrown fetch/network error to "<message> (<code>)". undici's
+ * fetch wraps the real failure in TypeError("fetch failed") with the cause
+ * chained on `.cause` — walk to the deepest cause so doctor reports the
+ * actual TLS/socket error instead of "fetch failed".
+ */
+function describeFetchError(err) {
+    if (err === null || err === undefined)
+        return "unknown error";
+    if (typeof err !== "object")
+        return String(err);
+    let deepest = err;
+    while (deepest.cause && typeof deepest.cause === "object") {
+        deepest = deepest.cause;
+    }
+    const message = deepest.message || String(deepest);
+    return deepest.code ? `${message} (${deepest.code})` : message;
+}
 /**
  * Derive remediation text and status from the last failing upload-ish line.
  * Inspects the `detail` field of the log line for http= and msg= tokens.
  */
-function failDetail(rawLine, outcome, lineDetail) {
+function failDetail(rawLine, outcome, lineDetail, backendHost) {
     const d = lineDetail ?? "";
     const truncated = rawLine.slice(0, 140);
+    const tlsHint = tlsInterceptionHint(d, backendHost ?? "the capture host");
     let hint;
-    if (/http=40[13]/.test(d)) {
+    if (tlsHint) {
+        hint = tlsHint;
+    }
+    else if (/http=40[13]/.test(d)) {
         hint = `token invalid or expired — run \`codiedev connect\` with a fresh token`;
     }
     else if (/http=5/.test(d) || /fetch|network|ECONN|ETIMEDOUT/i.test(d)) {
@@ -131,7 +174,7 @@ function failDetail(rawLine, outcome, lineDetail) {
     }
     return withSuffix(`${hint} (${truncated})`);
 }
-function summarizeCaptureActivity(tailLines, pendingJobCount) {
+function summarizeCaptureActivity(tailLines, pendingJobCount, backendHost) {
     const parsed = [];
     for (const raw of tailLines) {
         const m = STRUCTURED_LINE_RE.exec(raw);
@@ -148,7 +191,7 @@ function summarizeCaptureActivity(tailLines, pendingJobCount) {
         if (last.outcome === "ERROR" || last.outcome === "gave-up") {
             return {
                 status: "fail",
-                detail: failDetail(last.raw, last.outcome, last.detail),
+                detail: failDetail(last.raw, last.outcome, last.detail, backendHost),
             };
         }
     }

package/dist/commands/doctor.js

@@ -154,7 +154,17 @@ async function runDoctor(_args) {
         status: "pass",
         detail: `connected to ${config.companyName}`,
     });
-    // 2. Token still valid + backend reachable (re-validate)
+    // 2. Token still valid + backend reachable (re-validate). The detail names
+    // the backend host so users (and their IT) can confirm which domain the CLI
+    // talks to — the same host capture uploads use, so this check exercises the
+    // exact TLS path a corporate proxy would intercept.
+    let backendHost = "the capture host";
+    try {
+        backendHost = new URL(config.backendUrl).host;
+    }
+    catch {
+        // malformed backendUrl in config — keep the generic placeholder
+    }
     try {
         const res = await fetch(`${config.backendUrl}/api/cli/validateToken`, {
             method: "POST",
@@ -168,21 +178,27 @@ async function runDoctor(_args) {
             checks.push({
                 name: "Backend reachable + token valid",
                 status: "pass",
+                detail: backendHost,
             });
         }
         else {
             checks.push({
                 name: "Backend reachable + token valid",
                 status: "fail",
-                detail: `HTTP ${res.status} — run \`codiedev connect\` with a fresh token`,
+                detail: `HTTP ${res.status} from ${backendHost} — run \`codiedev connect\` with a fresh token`,
             });
         }
     }
     catch (err) {
+        // fetch buries the real TLS/socket error in .cause ("fetch failed" alone
+        // is undiagnosable); unwrap it and, when it's an SSL-inspection signature,
+        // say what actually fixes it.
+        const desc = (0, captureReadiness_1.describeFetchError)(err);
+        const tlsHint = (0, captureReadiness_1.tlsInterceptionHint)(desc, backendHost);
         checks.push({
             name: "Backend reachable + token valid",
             status: "fail",
-            detail: err.message,
+            detail: tlsHint ? `${desc} — ${tlsHint}` : `${desc} (host: ${backendHost})`,
         });
     }
     // 3. Authenticated endpoint smoke test (inbox query)
@@ -322,7 +338,7 @@ async function runDoctor(_args) {
     catch {
         pendingJobCount = 0;
     }
-    const captureActivity = (0, captureReadiness_1.summarizeCaptureActivity)(logTail, pendingJobCount);
+    const captureActivity = (0, captureReadiness_1.summarizeCaptureActivity)(logTail, pendingJobCount, backendHost);
     checks.push({
         name: "Recent capture activity",
         status: captureActivity.status,

package/dist/commands/pull.d.ts

@@ -1 +1,2 @@
+export declare function candidateKeys(key: string): string[];
 export declare function runPull(args: string[]): Promise<void>;

package/dist/commands/pull.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.candidateKeys = candidateKeys;
 exports.runPull = runPull;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -69,21 +70,45 @@ function parseArgs(args) {
     }
     return { key, version, out };
 }
+// The backend stores skills under extension-bearing keys (e.g. "pr-push.md"),
+// and lookup is exact-match, so a bare "pr-push" 404s. Make pull forgiving: try
+// the key as given, then a ".md" fallback when it has no extension, so the
+// intuitive bare name (and the hook's suggested key) both resolve.
+function candidateKeys(key) {
+    if (/\.[a-z0-9]+$/i.test(key))
+        return [key];
+    return [key, `${key}.md`];
+}
 async function runPull(args) {
     const { key, version, out } = parseArgs(args);
     const config = (0, shared_1.requireConfig)();
+    const keys = candidateKeys(key);
     const start = Date.now();
     try {
-        const res = await (0, shared_1.apiRequest)("GET", "/api/cli/pull", {
-            config,
-            query: { key, version },
-        });
+        let res;
+        for (let i = 0; i < keys.length; i++) {
+            try {
+                res = await (0, shared_1.apiRequest)("GET", "/api/cli/pull", {
+                    config,
+                    query: { key: keys[i], version },
+                });
+                break;
+            }
+            catch (err) {
+                const e = err;
+                // A 404 on a non-final candidate is retryable (fall through to ".md");
+                // anything else — or the last candidate — propagates to the handler.
+                if (e.status === 404 && i < keys.length - 1)
+                    continue;
+                throw err;
+            }
+        }
+        const a = res.artifact;
         (0, shared_1.recordAgentEvent)(config, {
             tool: "codiedev_pull",
             ok: true,
             latencyMs: Date.now() - start,
         });
-        const a = res.artifact;
         if (out) {
             const absolute = path.isAbsolute(out) ? out : path.resolve(process.cwd(), out);
             fs.writeFileSync(absolute, a.markdown, "utf8");
@@ -108,7 +133,8 @@ async function runPull(args) {
             error: e.message,
         });
         if (e.status === 404) {
-            console.error(`Not found: ${key}${version ? ` v${version}` : ""}`);
+            const also = keys.length > 1 ? ` (also tried ${keys.slice(1).join(", ")})` : "";
+            console.error(`Not found: ${key}${version ? ` v${version}` : ""}${also}`);
         }
         else {
             console.error(`Pull failed: ${e.message}`);

package/dist/hook.d.ts

@@ -1,2 +1,6 @@
 #!/usr/bin/env node
-export {};
+export declare function buildDiscoveryContext(skills: Array<{
+    key: string;
+    title: string;
+    score: number;
+}>): string | null;

package/dist/hook.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDiscoveryContext = buildDiscoveryContext;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -74,6 +75,26 @@ function getJson(url, bearerToken) {
         req.end();
     });
 }
+// Pure builder for the discovery additionalContext. Returns null when there are
+// no matches. The suggested `codiedev pull` command carries the EXACT top key
+// (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
+// paraphrase the key (pr-push) and the extension-sensitive `pull` 404s.
+function buildDiscoveryContext(skills) {
+    if (skills.length === 0)
+        return null;
+    // Don't trust the API's ordering — rank by score so the suggested pull key is
+    // always the highest-confidence match.
+    const top = [...skills].sort((a, b) => b.score - a.score).slice(0, 3);
+    const lines = top
+        .map((s) => `- ${s.key} — ${(s.score * 100).toFixed(0)}% match`)
+        .join("\n");
+    return ("Your team has a CodieDev skill that fits this task — prefer it over improvising:\n" +
+        lines +
+        "\nPull and follow it now: `codiedev pull " +
+        top[0].key +
+        "`. It encodes the team's vetted " +
+        "approach. Skip it only if it clearly doesn't apply.");
+}
 // UserPromptSubmit: query skill discovery for the prompt and, if a team skill
 // clears the confidence threshold, inject it as additionalContext so the agent
 // can offer to pull+run it. Fully silent on miss/error — never blocks input.
@@ -86,15 +107,8 @@ async function runDiscover(prompt) {
     try {
         const res = await getJson(`${config.backendUrl}/api/cli/skill-discovery?q=${encodeURIComponent(prompt)}`, config.token);
         const skills = res?.skills ?? [];
-        if (skills.length > 0) {
-            const lines = skills
-                .slice(0, 3)
-                .map((s) => `- ${s.key} — ${(s.score * 100).toFixed(0)}% match`)
-                .join("\n");
-            const additionalContext = "Your team has a CodieDev skill that fits this task — prefer it over improvising:\n" +
-                lines +
-                "\nPull and follow it now: `codiedev pull <key>`. It encodes the team's vetted " +
-                "approach. Skip it only if it clearly doesn't apply.";
+        const additionalContext = buildDiscoveryContext(skills);
+        if (additionalContext) {
             process.stdout.write(JSON.stringify({
                 hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext },
             }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.20",
+  "version": "0.9.22",
   "description": "Connect Claude Code, Codex, Cursor, or VS Code Copilot to Codiedev for org-wide session capture and artifact collaboration",
   "bin": {
     "codiedev": "dist/cli.js",