codiedev 0.9.21 → 0.9.23

package/dist/commands/pull.d.ts

@@ -1 +1,2 @@
+export declare function candidateKeys(key: string): string[];
 export declare function runPull(args: string[]): Promise<void>;

package/dist/commands/pull.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.candidateKeys = candidateKeys;
 exports.runPull = runPull;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -69,21 +70,45 @@ function parseArgs(args) {
     }
     return { key, version, out };
 }
+// The backend stores skills under extension-bearing keys (e.g. "pr-push.md"),
+// and lookup is exact-match, so a bare "pr-push" 404s. Make pull forgiving: try
+// the key as given, then a ".md" fallback when it has no extension, so the
+// intuitive bare name (and the hook's suggested key) both resolve.
+function candidateKeys(key) {
+    if (/\.[a-z0-9]+$/i.test(key))
+        return [key];
+    return [key, `${key}.md`];
+}
 async function runPull(args) {
     const { key, version, out } = parseArgs(args);
     const config = (0, shared_1.requireConfig)();
+    const keys = candidateKeys(key);
     const start = Date.now();
     try {
-        const res = await (0, shared_1.apiRequest)("GET", "/api/cli/pull", {
-            config,
-            query: { key, version },
-        });
+        let res;
+        for (let i = 0; i < keys.length; i++) {
+            try {
+                res = await (0, shared_1.apiRequest)("GET", "/api/cli/pull", {
+                    config,
+                    query: { key: keys[i], version },
+                });
+                break;
+            }
+            catch (err) {
+                const e = err;
+                // A 404 on a non-final candidate is retryable (fall through to ".md");
+                // anything else — or the last candidate — propagates to the handler.
+                if (e.status === 404 && i < keys.length - 1)
+                    continue;
+                throw err;
+            }
+        }
+        const a = res.artifact;
         (0, shared_1.recordAgentEvent)(config, {
             tool: "codiedev_pull",
             ok: true,
             latencyMs: Date.now() - start,
         });
-        const a = res.artifact;
         if (out) {
             const absolute = path.isAbsolute(out) ? out : path.resolve(process.cwd(), out);
             fs.writeFileSync(absolute, a.markdown, "utf8");
@@ -108,7 +133,8 @@ async function runPull(args) {
             error: e.message,
         });
         if (e.status === 404) {
-            console.error(`Not found: ${key}${version ? ` v${version}` : ""}`);
+            const also = keys.length > 1 ? ` (also tried ${keys.slice(1).join(", ")})` : "";
+            console.error(`Not found: ${key}${version ? ` v${version}` : ""}${also}`);
         }
         else {
             console.error(`Pull failed: ${e.message}`);

package/dist/hook.d.ts

@@ -1,2 +1,6 @@
 #!/usr/bin/env node
-export {};
+export declare function buildDiscoveryContext(skills: Array<{
+    key: string;
+    title: string;
+    score: number;
+}>): string | null;

package/dist/hook.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDiscoveryContext = buildDiscoveryContext;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -74,6 +75,26 @@ function getJson(url, bearerToken) {
         req.end();
     });
 }
+// Pure builder for the discovery additionalContext. Returns null when there are
+// no matches. The suggested `codiedev pull` command carries the EXACT top key
+// (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
+// paraphrase the key (pr-push) and the extension-sensitive `pull` 404s.
+function buildDiscoveryContext(skills) {
+    if (skills.length === 0)
+        return null;
+    // Don't trust the API's ordering — rank by score so the suggested pull key is
+    // always the highest-confidence match.
+    const top = [...skills].sort((a, b) => b.score - a.score).slice(0, 3);
+    const lines = top
+        .map((s) => `- ${s.key} — ${(s.score * 100).toFixed(0)}% match`)
+        .join("\n");
+    return ("Your team has a CodieDev skill that fits this task — prefer it over improvising:\n" +
+        lines +
+        "\nPull and follow it now: `codiedev pull " +
+        top[0].key +
+        "`. It encodes the team's vetted " +
+        "approach. Skip it only if it clearly doesn't apply.");
+}
 // UserPromptSubmit: query skill discovery for the prompt and, if a team skill
 // clears the confidence threshold, inject it as additionalContext so the agent
 // can offer to pull+run it. Fully silent on miss/error — never blocks input.
@@ -86,15 +107,8 @@ async function runDiscover(prompt) {
     try {
         const res = await getJson(`${config.backendUrl}/api/cli/skill-discovery?q=${encodeURIComponent(prompt)}`, config.token);
         const skills = res?.skills ?? [];
-        if (skills.length > 0) {
-            const lines = skills
-                .slice(0, 3)
-                .map((s) => `- ${s.key} — ${(s.score * 100).toFixed(0)}% match`)
-                .join("\n");
-            const additionalContext = "Your team has a CodieDev skill that fits this task — prefer it over improvising:\n" +
-                lines +
-                "\nPull and follow it now: `codiedev pull <key>`. It encodes the team's vetted " +
-                "approach. Skip it only if it clearly doesn't apply.";
+        const additionalContext = buildDiscoveryContext(skills);
+        if (additionalContext) {
             process.stdout.write(JSON.stringify({
                 hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext },
             }));
@@ -144,6 +158,20 @@ async function runStopFailure(hookInput) {
     }
     process.exit(0);
 }
+// Skip-reason ping: this session is ending WITHOUT a capture, and here's why.
+// Turns silent coverage loss into per-reason buckets on the admin Capture
+// Health panel (patches the session's aiSessionStarts row server-side). Tiny
+// like the sessionStart ping. Best-effort, never throws.
+async function postSessionSkip(config, sessionId, reason) {
+    if (!sessionId)
+        return;
+    try {
+        await postJson(`${config.backendUrl}/api/cli/sessionSkip`, { sessionId, reason, at: Date.now() }, config.token, PING_TIMEOUT_MS);
+    }
+    catch {
+        /* best-effort */
+    }
+}
 // SessionStart: the capture-coverage denominator. Record that a session opened
 // so the backend can later compute captured ÷ started. Deliberately tiny — no
 // transcript read, no git — so it never slows session startup. Best-effort +
@@ -158,7 +186,7 @@ async function runSessionStart(hookInput) {
                 sessionId: hookInput.session_id,
                 startedAt: Date.now(),
                 source: "claude-code",
-            }, config.token);
+            }, config.token, PING_TIMEOUT_MS);
         }
         catch {
             /* best-effort — never block session startup */
@@ -166,7 +194,13 @@ async function runSessionStart(hookInput) {
     }
     process.exit(0);
 }
-function postJson(url, body, bearerToken) {
+function postJson(url, body, bearerToken, 
+// Socket timeout. Pass a SMALL value for tiny pings that run on (or near)
+// Claude Code's shutdown clock — a black-holed connection (proxy dropping
+// packets without RST) otherwise hangs the hook until CC kills it. Leave
+// unset for transcript uploads, which legitimately take a while on slow
+// corporate links and already run in detached children with retry.
+timeoutMs) {
     return new Promise((resolve, reject) => {
         const parsed = new URL(url);
         const data = JSON.stringify(body);
@@ -198,10 +232,19 @@ function postJson(url, body, bearerToken) {
             });
         });
         req.on("error", reject);
+        if (timeoutMs) {
+            req.setTimeout(timeoutMs, () => {
+                req.destroy(new Error(`timeout after ${timeoutMs}ms`));
+            });
+        }
         req.write(data);
         req.end();
     });
 }
+// Short leash for the tiny coverage pings (sessionStart / sessionSkip): they
+// carry a few bytes and must never stall a hook. 3s is generous for a ping
+// and a hard bound for the shutdown clock.
+const PING_TIMEOUT_MS = 3000;
 async function readStdin() {
     return new Promise((resolve, reject) => {
         let data = "";
@@ -329,14 +372,12 @@ async function main() {
         await runSessionStart(hookInput);
         return;
     }
-    // Self-heal: a user who upgraded the CLI but hasn't re-run `connect` gets the
-    // discovery + auto-backup + limit hooks wired on their next SessionEnd, without
-    // re-connecting. Cheap (settings.json read, writes only when missing), so it
-    // stays inline; the costly transcript/git work is what moves to the child.
-    (0, utils_1.ensureDiscoveryHookInstalled)();
-    (0, utils_1.ensureBackupHookInstalled)();
-    (0, utils_1.ensureLimitHookInstalled)();
-    (0, utils_1.ensureSessionStartHookInstalled)();
+    // Self-heal: a user who upgraded the CLI but hasn't re-run `connect` gets
+    // every codiedev hook — INCLUDING SessionEnd→capture, which previously had
+    // no self-heal and could stay stripped forever while SessionStart kept
+    // pinging (the Sonifi "starts arrive, captures never" loss) — re-wired on
+    // their next Stop/SessionEnd. One read + one write, only when missing.
+    (0, utils_1.ensureAllCodiedevHooksInstalled)();
     const { session_id, transcript_path, cwd, workspace_roots } = hookInput;
     const workspaceRoot = workspace_roots && workspace_roots.length > 0
         ? workspace_roots[0]
@@ -393,9 +434,14 @@ async function main() {
     // finished and the upload went through, but CC had already given up waiting.
     const config = (0, utils_1.readConfig)();
     if (!config) {
+        // No config = no token; nothing can be sent, not even a skip ping.
         process.exit(0);
     }
     if (!transcript_path) {
+        // Nothing to capture — but say so, instead of leaving a start ping with
+        // no matching capture (silent coverage loss). One tiny POST; the rare
+        // no-transcript case has no other work on the shutdown clock.
+        await postSessionSkip(config, session_id, "no-transcript-path");
         process.exit(0);
     }
     try {
@@ -434,8 +480,10 @@ async function runCaptureFinish(input) {
     if (!config)
         return;
     const { session_id, transcript_path, cwd, workspace_roots } = input;
-    if (!transcript_path)
+    if (!transcript_path) {
+        await postSessionSkip(config, session_id, "no-transcript-path");
         return;
+    }
     // Log that this child has started processing — the first diagnostic proof
     // that the detached capture-finish child actually ran (visible in doctor).
     (0, captureLog_1.appendCaptureLog)({ stage: "capture-finish", sessionId: session_id, outcome: "start" });
@@ -461,6 +509,16 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
         transcriptContent = fs.readFileSync(transcript_path, "utf8");
     }
     catch {
+        // Previously the one fully-silent gap in the detached child: no log, no
+        // server signal. Diagnose it — deleted/rotated transcript, permissions,
+        // unmounted path.
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "capture-finish",
+            sessionId: session_id,
+            outcome: "skip",
+            detail: "transcript-unreadable",
+        });
+        await postSessionSkip(config, session_id, "transcript-unreadable");
         return;
     }
     // Resolve repo URL. Codex embeds it in session_meta; CC and Cursor both
@@ -579,6 +637,14 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
             // Retry any earlier capture jobs that failed to upload (transient network
             // blips), excluding the one we just dispatched. Best-effort, detached.
             // Skip the sweep on deferred path — the deferred child will handle uploading.
+            //
+            // Orphan pings are COLLECTED and awaited below: this child process calls
+            // process.exit(0) as soon as runCaptureFinish resolves, so a
+            // fire-and-forget POST here would be killed mid-flight — after the
+            // orphan file was already unlinked, i.e. the loss would stay invisible
+            // forever. The await is off the shutdown clock (detached child) and
+            // bounded by PING_TIMEOUT_MS.
+            const orphanPings = [];
             (0, utils_1.sweepPendingCaptures)({
                 dir: os.tmpdir(),
                 readdirSync: fs.readdirSync,
@@ -589,7 +655,15 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
                 exclude: tmpFile,
                 openSync: fs.openSync,
                 closeSync: fs.closeSync,
+                // Orphaned finish-inputs (capture-finish child died before writing an
+                // upload job): unrecoverable payload, but report the loss so it lands
+                // as a skip-reason instead of a silent coverage hole.
+                unlinkSync: fs.unlinkSync,
+                reportOrphan: (sid) => {
+                    orphanPings.push(postSessionSkip(config, sid, "finish-orphaned"));
+                },
             });
+            await Promise.all(orphanPings);
         }
         else {
             // Deferred: write the job file (newer turns overwrite = supersede), then

package/dist/utils.d.ts

@@ -81,6 +81,7 @@ export declare function installHook(): void;
 export declare function ensureDiscoveryHookInstalled(): void;
 export declare function ensureBackupHookInstalled(): void;
 export declare function ensureLimitHookInstalled(): void;
+export declare function ensureAllCodiedevHooksInstalled(): void;
 export declare function ensureSessionStartHookInstalled(): void;
 export declare function installClaudeCodeInstructions(): void;
 export declare function installCodexInstructions(): void;
@@ -206,8 +207,11 @@ interface SweepDeps {
     openSync?: typeof fs.openSync;
     closeSync?: typeof fs.closeSync;
     pruneState?: () => void;
+    unlinkSync?: (p: string) => void;
+    reportOrphan?: (sessionId: string | undefined) => void;
 }
 export declare const CLAIM_STALE_MS: number;
+export declare const FINISH_ORPHAN_AGE_MS: number;
 export declare function sweepPendingCaptures(deps: SweepDeps): void;
 export declare const CAPTURE_THROTTLE_MS: number;
 export declare const SWEEP_MIN_AGE_MS: number;

package/dist/utils.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = void 0;
+exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.FINISH_ORPHAN_AGE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = void 0;
 exports.readConfig = readConfig;
 exports.writeConfig = writeConfig;
 exports.parseGitRemoteFromConfig = parseGitRemoteFromConfig;
@@ -61,6 +61,7 @@ exports.installHook = installHook;
 exports.ensureDiscoveryHookInstalled = ensureDiscoveryHookInstalled;
 exports.ensureBackupHookInstalled = ensureBackupHookInstalled;
 exports.ensureLimitHookInstalled = ensureLimitHookInstalled;
+exports.ensureAllCodiedevHooksInstalled = ensureAllCodiedevHooksInstalled;
 exports.ensureSessionStartHookInstalled = ensureSessionStartHookInstalled;
 exports.installClaudeCodeInstructions = installClaudeCodeInstructions;
 exports.installCodexInstructions = installCodexInstructions;
@@ -913,6 +914,61 @@ function ensureLimitHookInstalled() {
     }
     catch { /* best-effort */ }
 }
+// Self-heal ALL codiedev hooks in one read → one write. This replaces calling
+// the four per-hook ensure* functions in sequence, and fixes two real losses
+// seen in the field (Sonifi, 2026-07):
+//   1. The SessionEnd → capture hook — the one that actually uploads sessions
+//      — had NO self-heal at all: it was written once at `connect` and never
+//      repaired. Anything that stripped it (IT-managed dotfiles baseline, the
+//      race below) left SessionStart pinging forever while captures silently
+//      stopped — the exact "start pings arrive, captures never" signature.
+//   2. Each per-hook ensure* did its own read-modify-write of settings.json
+//      with no locking; two concurrent Claude Code sessions repairing
+//      different hooks could lose each other's writes. One read + one write
+//      shrinks that window and removes the intra-process version entirely.
+// The per-hook ensure* functions below are kept for tests/back-compat but are
+// no longer called from the hook entrypoint.
+function ensureAllCodiedevHooksInstalled() {
+    try {
+        if (!fs.existsSync(CLAUDE_SETTINGS_PATH))
+            return; // not a Claude Code user
+        const settings = JSON.parse(fs.readFileSync(CLAUDE_SETTINGS_PATH, "utf8"));
+        const hooks = (settings.hooks ?? {});
+        const wanted = [
+            ["SessionEnd", "capture"],
+            ["UserPromptSubmit", "discover"],
+            ["Stop", "backup"],
+            ["StopFailure", "limit", "rate_limit"],
+            ["SessionStart", "session-start"],
+        ];
+        const missing = wanted.filter(([eventName]) => !hasCodiedevHook(hooks, eventName));
+        if (missing.length === 0)
+            return; // steady state: no write, no churn
+        settings.hooks = hooks;
+        for (const [eventName, subcommand, matcher] of missing) {
+            upsertCodiedevHook(hooks, eventName, subcommand, matcher);
+        }
+        fs.writeFileSync(CLAUDE_SETTINGS_PATH, JSON.stringify(settings, null, 2), "utf8");
+    }
+    catch {
+        // Best-effort — never block a session on self-heal.
+    }
+}
+function hasCodiedevHook(hooks, eventName) {
+    const entries = hooks[eventName] ?? [];
+    // A malformed (non-array) event value would make `.some` throw and — under
+    // ensureAll's single try/catch — abort EVERY heal, including the capture
+    // heal. Report "present" instead: leave the foreign/corrupt key alone and
+    // keep healing the other events (the per-hook fault isolation the old
+    // ensure* functions had).
+    if (!Array.isArray(entries))
+        return true;
+    return entries.some((hook) => {
+        const inner = hook.hooks;
+        return (Array.isArray(inner) &&
+            inner.some((h) => (0, detection_1.isCodiedevHookCommand)(h.command)));
+    });
+}
 // Self-heal: ensure the SessionStart → session-start hook is present without a
 // full `connect` re-run, mirroring ensureLimitHookInstalled. Called from the
 // capture hook so an upgraded-but-not-reconnected user starts emitting the
@@ -1733,6 +1789,11 @@ function dispatchDeferredUpload(job, hookScriptPath, deps, delayMs) {
 // A claimed job whose uploader hasn't finished after this long is presumed
 // crashed and gets renamed back to its canonical name for a later retry.
 exports.CLAIM_STALE_MS = 15 * 60 * 1000;
+// A finish-input file older than this is an orphan: its capture-finish child
+// normally consumes + unlinks it within seconds, so an hour-old file means the
+// child died (spawn failure, OOM/AV kill, machine sleep). Generous so we never
+// race a legitimately slow child.
+exports.FINISH_ORPHAN_AGE_MS = 60 * 60 * 1000;
 // Retry kept-on-failure capture jobs: re-dispatch each pending
 // `codiedev-capture-*.json` to the detached uploader (which bumps attempts /
 // gives up at the cap). Best-effort — never throws into the hook.
@@ -1770,6 +1831,37 @@ function sweepPendingCaptures(deps) {
             // raced another sweeper or the uploader just finished — fine
         }
     }
+    // Orphaned finish-inputs: the FIRST detached child (capture-finish) died
+    // before it could build an upload job. That path has no retry queue — the
+    // payload is gone — but the loss must not stay invisible: report the
+    // sessionId (filename embeds it: codiedev-finish-<sid>-<pid>-<ts>.json) so
+    // it lands as a skip-reason, then clean the file up.
+    if (deps.unlinkSync) {
+        for (const f of files) {
+            const m = /^codiedev-finish-(.+)-\d+-\d+\.json$/.exec(f);
+            if (!m)
+                continue;
+            const orphanPath = path.join(deps.dir, f);
+            try {
+                if (now - deps.statSync(orphanPath).mtimeMs < exports.FINISH_ORPHAN_AGE_MS)
+                    continue;
+                deps.unlinkSync(orphanPath);
+                // finishInputTmpFile falls back to the PID when the hook had no
+                // session_id (codiedev-finish-<pid>-<pid>-<ts>.json). A pure-digit
+                // capture is that fallback, not a session id — reporting it would
+                // create a phantom session row server-side. Real session ids are
+                // UUIDs and never all-digits.
+                const sid = /^\d+$/.test(m[1]) ? undefined : m[1];
+                try {
+                    deps.reportOrphan?.(sid);
+                }
+                catch { /* report is best-effort */ }
+            }
+            catch {
+                // raced its owner or another sweeper — fine
+            }
+        }
+    }
     const jobs = files
         .filter((f) => /^codiedev-capture-.*\.json$/.test(f))
         .map((f) => path.join(deps.dir, f))
@@ -2046,10 +2138,30 @@ async function runCaptureUpload(jobFile, deps) {
                 }
                 catch { /* log is best-effort */ }
             }
+            // Unlink FIRST: if the skip ping below hangs (no timeout on injected
+            // post impls), a still-present job file would be reclaimed by the
+            // 15-min stale-claim sweep and re-enter this give-up path forever.
             try {
                 deps.unlinkSync(jobFile);
             }
             catch { /* gone */ }
+            // Tell the server this capture is permanently lost and why. The full
+            // transcript POST may be what's blocked (proxy/DLP body inspection) —
+            // this tiny ping often still passes, turning an invisible loss into a
+            // per-reason bucket on the admin Capture Health panel.
+            if (sessionId) {
+                try {
+                    const skipUrl = job.url.replace(/\/api\/captureSession$/, "/api/cli/sessionSkip");
+                    if (skipUrl !== job.url) {
+                        await deps.post(skipUrl, {
+                            sessionId,
+                            reason: expired ? "upload-gave-up:ttl" : "upload-gave-up:attempts",
+                            at: now,
+                        }, job.token);
+                    }
+                }
+                catch { /* best-effort — the ping may be blocked too */ }
+            }
             return;
         }
         // Log the error before persisting the retry bump.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.21",
+  "version": "0.9.23",
   "description": "Connect Claude Code, Codex, Cursor, or VS Code Copilot to Codiedev for org-wide session capture and artifact collaboration",
   "bin": {
     "codiedev": "dist/cli.js",