codiedev 0.9.22 → 0.9.23

package/dist/hook.js

@@ -158,6 +158,20 @@ async function runStopFailure(hookInput) {
     }
     process.exit(0);
 }
+// Skip-reason ping: this session is ending WITHOUT a capture, and here's why.
+// Turns silent coverage loss into per-reason buckets on the admin Capture
+// Health panel (patches the session's aiSessionStarts row server-side). Tiny
+// like the sessionStart ping. Best-effort, never throws.
+async function postSessionSkip(config, sessionId, reason) {
+    if (!sessionId)
+        return;
+    try {
+        await postJson(`${config.backendUrl}/api/cli/sessionSkip`, { sessionId, reason, at: Date.now() }, config.token, PING_TIMEOUT_MS);
+    }
+    catch {
+        /* best-effort */
+    }
+}
 // SessionStart: the capture-coverage denominator. Record that a session opened
 // so the backend can later compute captured ÷ started. Deliberately tiny — no
 // transcript read, no git — so it never slows session startup. Best-effort +
@@ -172,7 +186,7 @@ async function runSessionStart(hookInput) {
                 sessionId: hookInput.session_id,
                 startedAt: Date.now(),
                 source: "claude-code",
-            }, config.token);
+            }, config.token, PING_TIMEOUT_MS);
         }
         catch {
             /* best-effort — never block session startup */
@@ -180,7 +194,13 @@ async function runSessionStart(hookInput) {
     }
     process.exit(0);
 }
-function postJson(url, body, bearerToken) {
+function postJson(url, body, bearerToken, 
+// Socket timeout. Pass a SMALL value for tiny pings that run on (or near)
+// Claude Code's shutdown clock — a black-holed connection (proxy dropping
+// packets without RST) otherwise hangs the hook until CC kills it. Leave
+// unset for transcript uploads, which legitimately take a while on slow
+// corporate links and already run in detached children with retry.
+timeoutMs) {
     return new Promise((resolve, reject) => {
         const parsed = new URL(url);
         const data = JSON.stringify(body);
@@ -212,10 +232,19 @@ function postJson(url, body, bearerToken) {
             });
         });
         req.on("error", reject);
+        if (timeoutMs) {
+            req.setTimeout(timeoutMs, () => {
+                req.destroy(new Error(`timeout after ${timeoutMs}ms`));
+            });
+        }
         req.write(data);
         req.end();
     });
 }
+// Short leash for the tiny coverage pings (sessionStart / sessionSkip): they
+// carry a few bytes and must never stall a hook. 3s is generous for a ping
+// and a hard bound for the shutdown clock.
+const PING_TIMEOUT_MS = 3000;
 async function readStdin() {
     return new Promise((resolve, reject) => {
         let data = "";
@@ -343,14 +372,12 @@ async function main() {
         await runSessionStart(hookInput);
         return;
     }
-    // Self-heal: a user who upgraded the CLI but hasn't re-run `connect` gets the
-    // discovery + auto-backup + limit hooks wired on their next SessionEnd, without
-    // re-connecting. Cheap (settings.json read, writes only when missing), so it
-    // stays inline; the costly transcript/git work is what moves to the child.
-    (0, utils_1.ensureDiscoveryHookInstalled)();
-    (0, utils_1.ensureBackupHookInstalled)();
-    (0, utils_1.ensureLimitHookInstalled)();
-    (0, utils_1.ensureSessionStartHookInstalled)();
+    // Self-heal: a user who upgraded the CLI but hasn't re-run `connect` gets
+    // every codiedev hook — INCLUDING SessionEnd→capture, which previously had
+    // no self-heal and could stay stripped forever while SessionStart kept
+    // pinging (the Sonifi "starts arrive, captures never" loss) — re-wired on
+    // their next Stop/SessionEnd. One read + one write, only when missing.
+    (0, utils_1.ensureAllCodiedevHooksInstalled)();
     const { session_id, transcript_path, cwd, workspace_roots } = hookInput;
     const workspaceRoot = workspace_roots && workspace_roots.length > 0
         ? workspace_roots[0]
@@ -407,9 +434,14 @@ async function main() {
     // finished and the upload went through, but CC had already given up waiting.
     const config = (0, utils_1.readConfig)();
     if (!config) {
+        // No config = no token; nothing can be sent, not even a skip ping.
         process.exit(0);
     }
     if (!transcript_path) {
+        // Nothing to capture — but say so, instead of leaving a start ping with
+        // no matching capture (silent coverage loss). One tiny POST; the rare
+        // no-transcript case has no other work on the shutdown clock.
+        await postSessionSkip(config, session_id, "no-transcript-path");
         process.exit(0);
     }
     try {
@@ -448,8 +480,10 @@ async function runCaptureFinish(input) {
     if (!config)
         return;
     const { session_id, transcript_path, cwd, workspace_roots } = input;
-    if (!transcript_path)
+    if (!transcript_path) {
+        await postSessionSkip(config, session_id, "no-transcript-path");
         return;
+    }
     // Log that this child has started processing — the first diagnostic proof
     // that the detached capture-finish child actually ran (visible in doctor).
     (0, captureLog_1.appendCaptureLog)({ stage: "capture-finish", sessionId: session_id, outcome: "start" });
@@ -475,6 +509,16 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
         transcriptContent = fs.readFileSync(transcript_path, "utf8");
     }
     catch {
+        // Previously the one fully-silent gap in the detached child: no log, no
+        // server signal. Diagnose it — deleted/rotated transcript, permissions,
+        // unmounted path.
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "capture-finish",
+            sessionId: session_id,
+            outcome: "skip",
+            detail: "transcript-unreadable",
+        });
+        await postSessionSkip(config, session_id, "transcript-unreadable");
         return;
     }
     // Resolve repo URL. Codex embeds it in session_meta; CC and Cursor both
@@ -593,6 +637,14 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
             // Retry any earlier capture jobs that failed to upload (transient network
             // blips), excluding the one we just dispatched. Best-effort, detached.
             // Skip the sweep on deferred path — the deferred child will handle uploading.
+            //
+            // Orphan pings are COLLECTED and awaited below: this child process calls
+            // process.exit(0) as soon as runCaptureFinish resolves, so a
+            // fire-and-forget POST here would be killed mid-flight — after the
+            // orphan file was already unlinked, i.e. the loss would stay invisible
+            // forever. The await is off the shutdown clock (detached child) and
+            // bounded by PING_TIMEOUT_MS.
+            const orphanPings = [];
             (0, utils_1.sweepPendingCaptures)({
                 dir: os.tmpdir(),
                 readdirSync: fs.readdirSync,
@@ -603,7 +655,15 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
                 exclude: tmpFile,
                 openSync: fs.openSync,
                 closeSync: fs.closeSync,
+                // Orphaned finish-inputs (capture-finish child died before writing an
+                // upload job): unrecoverable payload, but report the loss so it lands
+                // as a skip-reason instead of a silent coverage hole.
+                unlinkSync: fs.unlinkSync,
+                reportOrphan: (sid) => {
+                    orphanPings.push(postSessionSkip(config, sid, "finish-orphaned"));
+                },
             });
+            await Promise.all(orphanPings);
         }
         else {
             // Deferred: write the job file (newer turns overwrite = supersede), then

package/dist/utils.d.ts

@@ -81,6 +81,7 @@ export declare function installHook(): void;
 export declare function ensureDiscoveryHookInstalled(): void;
 export declare function ensureBackupHookInstalled(): void;
 export declare function ensureLimitHookInstalled(): void;
+export declare function ensureAllCodiedevHooksInstalled(): void;
 export declare function ensureSessionStartHookInstalled(): void;
 export declare function installClaudeCodeInstructions(): void;
 export declare function installCodexInstructions(): void;
@@ -206,8 +207,11 @@ interface SweepDeps {
     openSync?: typeof fs.openSync;
     closeSync?: typeof fs.closeSync;
     pruneState?: () => void;
+    unlinkSync?: (p: string) => void;
+    reportOrphan?: (sessionId: string | undefined) => void;
 }
 export declare const CLAIM_STALE_MS: number;
+export declare const FINISH_ORPHAN_AGE_MS: number;
 export declare function sweepPendingCaptures(deps: SweepDeps): void;
 export declare const CAPTURE_THROTTLE_MS: number;
 export declare const SWEEP_MIN_AGE_MS: number;

package/dist/utils.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = void 0;
+exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.FINISH_ORPHAN_AGE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = void 0;
 exports.readConfig = readConfig;
 exports.writeConfig = writeConfig;
 exports.parseGitRemoteFromConfig = parseGitRemoteFromConfig;
@@ -61,6 +61,7 @@ exports.installHook = installHook;
 exports.ensureDiscoveryHookInstalled = ensureDiscoveryHookInstalled;
 exports.ensureBackupHookInstalled = ensureBackupHookInstalled;
 exports.ensureLimitHookInstalled = ensureLimitHookInstalled;
+exports.ensureAllCodiedevHooksInstalled = ensureAllCodiedevHooksInstalled;
 exports.ensureSessionStartHookInstalled = ensureSessionStartHookInstalled;
 exports.installClaudeCodeInstructions = installClaudeCodeInstructions;
 exports.installCodexInstructions = installCodexInstructions;
@@ -913,6 +914,61 @@ function ensureLimitHookInstalled() {
     }
     catch { /* best-effort */ }
 }
+// Self-heal ALL codiedev hooks in one read → one write. This replaces calling
+// the four per-hook ensure* functions in sequence, and fixes two real losses
+// seen in the field (Sonifi, 2026-07):
+//   1. The SessionEnd → capture hook — the one that actually uploads sessions
+//      — had NO self-heal at all: it was written once at `connect` and never
+//      repaired. Anything that stripped it (IT-managed dotfiles baseline, the
+//      race below) left SessionStart pinging forever while captures silently
+//      stopped — the exact "start pings arrive, captures never" signature.
+//   2. Each per-hook ensure* did its own read-modify-write of settings.json
+//      with no locking; two concurrent Claude Code sessions repairing
+//      different hooks could lose each other's writes. One read + one write
+//      shrinks that window and removes the intra-process version entirely.
+// The per-hook ensure* functions below are kept for tests/back-compat but are
+// no longer called from the hook entrypoint.
+function ensureAllCodiedevHooksInstalled() {
+    try {
+        if (!fs.existsSync(CLAUDE_SETTINGS_PATH))
+            return; // not a Claude Code user
+        const settings = JSON.parse(fs.readFileSync(CLAUDE_SETTINGS_PATH, "utf8"));
+        const hooks = (settings.hooks ?? {});
+        const wanted = [
+            ["SessionEnd", "capture"],
+            ["UserPromptSubmit", "discover"],
+            ["Stop", "backup"],
+            ["StopFailure", "limit", "rate_limit"],
+            ["SessionStart", "session-start"],
+        ];
+        const missing = wanted.filter(([eventName]) => !hasCodiedevHook(hooks, eventName));
+        if (missing.length === 0)
+            return; // steady state: no write, no churn
+        settings.hooks = hooks;
+        for (const [eventName, subcommand, matcher] of missing) {
+            upsertCodiedevHook(hooks, eventName, subcommand, matcher);
+        }
+        fs.writeFileSync(CLAUDE_SETTINGS_PATH, JSON.stringify(settings, null, 2), "utf8");
+    }
+    catch {
+        // Best-effort — never block a session on self-heal.
+    }
+}
+function hasCodiedevHook(hooks, eventName) {
+    const entries = hooks[eventName] ?? [];
+    // A malformed (non-array) event value would make `.some` throw and — under
+    // ensureAll's single try/catch — abort EVERY heal, including the capture
+    // heal. Report "present" instead: leave the foreign/corrupt key alone and
+    // keep healing the other events (the per-hook fault isolation the old
+    // ensure* functions had).
+    if (!Array.isArray(entries))
+        return true;
+    return entries.some((hook) => {
+        const inner = hook.hooks;
+        return (Array.isArray(inner) &&
+            inner.some((h) => (0, detection_1.isCodiedevHookCommand)(h.command)));
+    });
+}
 // Self-heal: ensure the SessionStart → session-start hook is present without a
 // full `connect` re-run, mirroring ensureLimitHookInstalled. Called from the
 // capture hook so an upgraded-but-not-reconnected user starts emitting the
@@ -1733,6 +1789,11 @@ function dispatchDeferredUpload(job, hookScriptPath, deps, delayMs) {
 // A claimed job whose uploader hasn't finished after this long is presumed
 // crashed and gets renamed back to its canonical name for a later retry.
 exports.CLAIM_STALE_MS = 15 * 60 * 1000;
+// A finish-input file older than this is an orphan: its capture-finish child
+// normally consumes + unlinks it within seconds, so an hour-old file means the
+// child died (spawn failure, OOM/AV kill, machine sleep). Generous so we never
+// race a legitimately slow child.
+exports.FINISH_ORPHAN_AGE_MS = 60 * 60 * 1000;
 // Retry kept-on-failure capture jobs: re-dispatch each pending
 // `codiedev-capture-*.json` to the detached uploader (which bumps attempts /
 // gives up at the cap). Best-effort — never throws into the hook.
@@ -1770,6 +1831,37 @@ function sweepPendingCaptures(deps) {
             // raced another sweeper or the uploader just finished — fine
         }
     }
+    // Orphaned finish-inputs: the FIRST detached child (capture-finish) died
+    // before it could build an upload job. That path has no retry queue — the
+    // payload is gone — but the loss must not stay invisible: report the
+    // sessionId (filename embeds it: codiedev-finish-<sid>-<pid>-<ts>.json) so
+    // it lands as a skip-reason, then clean the file up.
+    if (deps.unlinkSync) {
+        for (const f of files) {
+            const m = /^codiedev-finish-(.+)-\d+-\d+\.json$/.exec(f);
+            if (!m)
+                continue;
+            const orphanPath = path.join(deps.dir, f);
+            try {
+                if (now - deps.statSync(orphanPath).mtimeMs < exports.FINISH_ORPHAN_AGE_MS)
+                    continue;
+                deps.unlinkSync(orphanPath);
+                // finishInputTmpFile falls back to the PID when the hook had no
+                // session_id (codiedev-finish-<pid>-<pid>-<ts>.json). A pure-digit
+                // capture is that fallback, not a session id — reporting it would
+                // create a phantom session row server-side. Real session ids are
+                // UUIDs and never all-digits.
+                const sid = /^\d+$/.test(m[1]) ? undefined : m[1];
+                try {
+                    deps.reportOrphan?.(sid);
+                }
+                catch { /* report is best-effort */ }
+            }
+            catch {
+                // raced its owner or another sweeper — fine
+            }
+        }
+    }
     const jobs = files
         .filter((f) => /^codiedev-capture-.*\.json$/.test(f))
         .map((f) => path.join(deps.dir, f))
@@ -2046,10 +2138,30 @@ async function runCaptureUpload(jobFile, deps) {
                 }
                 catch { /* log is best-effort */ }
             }
+            // Unlink FIRST: if the skip ping below hangs (no timeout on injected
+            // post impls), a still-present job file would be reclaimed by the
+            // 15-min stale-claim sweep and re-enter this give-up path forever.
             try {
                 deps.unlinkSync(jobFile);
             }
             catch { /* gone */ }
+            // Tell the server this capture is permanently lost and why. The full
+            // transcript POST may be what's blocked (proxy/DLP body inspection) —
+            // this tiny ping often still passes, turning an invisible loss into a
+            // per-reason bucket on the admin Capture Health panel.
+            if (sessionId) {
+                try {
+                    const skipUrl = job.url.replace(/\/api\/captureSession$/, "/api/cli/sessionSkip");
+                    if (skipUrl !== job.url) {
+                        await deps.post(skipUrl, {
+                            sessionId,
+                            reason: expired ? "upload-gave-up:ttl" : "upload-gave-up:attempts",
+                            at: now,
+                        }, job.token);
+                    }
+                }
+                catch { /* best-effort — the ping may be blocked too */ }
+            }
             return;
         }
         // Log the error before persisting the retry bump.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.22",
+  "version": "0.9.23",
   "description": "Connect Claude Code, Codex, Cursor, or VS Code Copilot to Codiedev for org-wide session capture and artifact collaboration",
   "bin": {
     "codiedev": "dist/cli.js",