codiedev 0.9.23 → 0.9.25

package/dist/commands/doctor.js

@@ -165,6 +165,9 @@ async function runDoctor(_args) {
     catch {
         // malformed backendUrl in config — keep the generic placeholder
     }
+    // Live tracked-repo list fetched from validateToken below. Null until (and
+    // unless) the backend answers; the checks fall back to `config.repos`.
+    let liveRepos = null;
     try {
         const res = await fetch(`${config.backendUrl}/api/cli/validateToken`, {
             method: "POST",
@@ -180,6 +183,21 @@ async function runDoctor(_args) {
                 status: "pass",
                 detail: backendHost,
             });
+            // validateToken returns the company's CURRENT tracked repos. Capture
+            // them: the repo-resolution checks below must reflect what the SERVER
+            // will resolve at capture time (repoResolver.ts resolves against the
+            // live list), not the possibly-stale `config.repos` frozen at the last
+            // `connect`. A repo linked in the portal after that connect otherwise
+            // reports a false "isn't a tracked repo — link it in the portal" here
+            // even though sessions/MRs for it attribute fine server-side.
+            try {
+                const data = (await res.json());
+                if (Array.isArray(data.repos))
+                    liveRepos = data.repos;
+            }
+            catch {
+                liveRepos = null; // malformed body → fall back to the cached list
+            }
         }
         else {
             checks.push({
@@ -219,13 +237,46 @@ async function runDoctor(_args) {
             detail: err.message,
         });
     }
-    // 4. Tracked repos
-    const repoCount = config.repos?.length ?? 0;
+    // 4. Tracked repos. Prefer the live list from validateToken over the cache:
+    // a repo linked after the last `connect` is tracked server-side but absent
+    // from `config.repos`, and resolving against the stale cache is exactly what
+    // produced the false "isn't a tracked repo — link it in the portal" warning.
+    // Treat an EMPTY live list as "no usable live data", NOT an authoritative
+    // zero: a transient permission glitch / backend hiccup can return `repos: []`,
+    // and both driving the checks from it AND healing the cache to empty would be
+    // wrong — the write would durably break every offline doctor run (and the
+    // capture hook's providedRepoId) until the next successful connect. So when
+    // live is empty, fall back to the cache and skip the write, exactly like
+    // backend-unreachable. A genuinely repo-less company also has an empty cache,
+    // so it still reports "0 repos" correctly.
+    const trackedRepos = liveRepos !== null && liveRepos.length > 0 ? liveRepos : (config.repos ?? []);
+    // Detect drift by CONTENT, not count: a same-size swap (one repo removed +
+    // another added between connects) or a repo whose path/URL changed while its
+    // id stayed stable (GitLab move/rename — exactly the SONIFI migration case)
+    // both leave the count unchanged. A length-only check would skip the heal and
+    // leave the capture hook's cache — and its advisory providedRepoId — stale.
+    const canonRepos = (rs) => JSON.stringify([...rs].map((r) => [r.repoId, r.url, r.fullName]).sort());
+    const cacheRefreshed = liveRepos !== null &&
+        liveRepos.length > 0 &&
+        canonRepos(liveRepos) !== canonRepos(config.repos ?? []);
+    // Heal the on-disk cache so the capture hook (which reads `config.repos` for
+    // the advisory providedRepoId) stops trailing the portal too. Best-effort:
+    // doctor must never fail because the config couldn't be rewritten.
+    if (cacheRefreshed && liveRepos) {
+        try {
+            (0, utils_1.writeConfig)({ ...config, repos: liveRepos, lastSynced: new Date().toISOString() });
+        }
+        catch {
+            // read-only home / permission issue — the in-memory list still drives
+            // the checks below; the user just re-syncs on the next `connect`.
+        }
+    }
+    const repoCount = trackedRepos.length;
     checks.push({
         name: "Tracked repos",
         status: repoCount > 0 ? "pass" : "warn",
         detail: repoCount > 0
-            ? `${repoCount} repo${repoCount === 1 ? "" : "s"}`
+            ? `${repoCount} repo${repoCount === 1 ? "" : "s"}${cacheRefreshed ? " (refreshed from portal)" : ""}`
             : "0 — link repos in the portal so sessions get captured",
     });
     // 4b. Capture readiness — the part that actually decides whether a session
@@ -234,7 +285,7 @@ async function runDoctor(_args) {
     // last one?" — the blind spot behind lean-container / submodule / no-remote
     // zeros.
     const cwd = process.cwd();
-    const readiness = (0, captureReadiness_1.assessCaptureReadiness)(cwd, config.repos ?? [], {
+    const readiness = (0, captureReadiness_1.assessCaptureReadiness)(cwd, trackedRepos, {
         exec: (cmd, dir) => (0, child_process_1.execSync)(cmd, { cwd: dir, stdio: ["pipe", "pipe", "pipe"] }).toString(),
         getRemoteUrl: utils_1.getGitRemoteUrl,
         matchRepo: utils_1.matchRepo,
@@ -247,7 +298,7 @@ async function runDoctor(_args) {
     // instead of flatly warning "not a work tree / no remote" — the exact output
     // that made working workspace-root setups read as broken.
     const workspaceScan = readiness.gitOnPath && !readiness.insideWorkTree
-        ? (0, captureReadiness_1.assessWorkspaceRepos)(cwd, config.repos ?? [], {
+        ? (0, captureReadiness_1.assessWorkspaceRepos)(cwd, trackedRepos, {
             listChildDirs: (dir) => fs
                 .readdirSync(dir, { withFileTypes: true })
                 .filter((e) => e.isDirectory())

package/dist/hook.js

@@ -241,6 +241,84 @@ timeoutMs) {
         req.end();
     });
 }
+// postJson variant that returns the parsed response body — the upload-URL
+// handshake needs the { uploadUrl } the server hands back. No timeout: runs
+// only in detached uploader children, never on the shutdown clock.
+function postJsonForResponse(url, body, bearerToken) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const data = JSON.stringify(body);
+        const lib = parsed.protocol === "https:" ? https : http;
+        const req = lib.request({
+            hostname: parsed.hostname,
+            port: parsed.port || (parsed.protocol === "https:" ? 443 : 80),
+            path: parsed.pathname + parsed.search,
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Content-Length": Buffer.byteLength(data),
+                Authorization: `Bearer ${bearerToken}`,
+                "X-Codiedev-Cli-Version": version_1.CLI_VERSION,
+            },
+        }, (res) => {
+            let responseData = "";
+            res.on("data", (chunk) => (responseData += chunk));
+            res.on("end", () => {
+                if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+                    try {
+                        resolve(JSON.parse(responseData));
+                    }
+                    catch {
+                        reject(new Error(`HTTP ${res.statusCode}: unparseable response`));
+                    }
+                }
+                else {
+                    reject(new Error(`HTTP ${res.statusCode}: ${responseData}`));
+                }
+            });
+        });
+        req.on("error", reject);
+        req.write(data);
+        req.end();
+    });
+}
+// Raw-bytes POST to a Convex storage upload URL (no auth header — the URL
+// itself is the one-time credential). Returns the parsed { storageId }.
+function postBytes(url, bytes, contentType) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const lib = parsed.protocol === "https:" ? https : http;
+        const req = lib.request({
+            hostname: parsed.hostname,
+            port: parsed.port || (parsed.protocol === "https:" ? 443 : 80),
+            path: parsed.pathname + parsed.search,
+            method: "POST",
+            headers: {
+                "Content-Type": contentType,
+                "Content-Length": bytes.length,
+            },
+        }, (res) => {
+            let responseData = "";
+            res.on("data", (chunk) => (responseData += chunk));
+            res.on("end", () => {
+                if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+                    try {
+                        resolve(JSON.parse(responseData));
+                    }
+                    catch {
+                        reject(new Error(`HTTP ${res.statusCode}: unparseable response`));
+                    }
+                }
+                else {
+                    reject(new Error(`HTTP ${res.statusCode}: ${responseData}`));
+                }
+            });
+        });
+        req.on("error", reject);
+        req.write(bytes);
+        req.end();
+    });
+}
 // Short leash for the tiny coverage pings (sessionStart / sessionSkip): they
 // carry a few bytes and must never stall a hook. 3s is generous for a ping
 // and a hard bound for the shutdown clock.
@@ -270,6 +348,12 @@ async function main() {
     function makeUploadDeps() {
         return {
             post: postJson,
+            // Direct-to-storage flow for big transcripts (see utils.ts
+            // DIRECT_UPLOAD_THRESHOLD_CHARS): fetch a one-time upload URL, then
+            // POST the raw bytes to it. Keeps ~7MB+ transcripts out of the
+            // backend's 64MB captureSession isolate.
+            requestJson: postJsonForResponse,
+            uploadBytes: postBytes,
             readFileSync: fs.readFileSync,
             unlinkSync: fs.unlinkSync,
             // Persist a bumped attempt count on failure so a later sweep retries
@@ -508,17 +592,18 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
     try {
         transcriptContent = fs.readFileSync(transcript_path, "utf8");
     }
-    catch {
-        // Previously the one fully-silent gap in the detached child: no log, no
-        // server signal. Diagnose it — deleted/rotated transcript, permissions,
-        // unmounted path.
+    catch (err) {
+        // ENOENT → "no-transcript" (phantom desktop-app helper session, excluded
+        // from coverage server-side); anything else → "transcript-unreadable:<code>"
+        // (real transcript, read failed — a genuine, diagnosable loss).
+        const reason = (0, utils_1.transcriptReadSkipReason)(err);
         (0, captureLog_1.appendCaptureLog)({
             stage: "capture-finish",
             sessionId: session_id,
             outcome: "skip",
-            detail: "transcript-unreadable",
+            detail: reason,
         });
-        await postSessionSkip(config, session_id, "transcript-unreadable");
+        await postSessionSkip(config, session_id, reason);
         return;
     }
     // Resolve repo URL. Codex embeds it in session_meta; CC and Cursor both

package/dist/utils.d.ts

@@ -67,6 +67,8 @@ export interface CapturePayloadInput {
 }
 export declare function buildCapturePayload(input: CapturePayloadInput): Record<string, unknown>;
 export declare function hashToken(token: string): string;
+export declare function extractHookNodePath(cmd: string | undefined): string | undefined;
+export declare function resetStableNodeCacheForTests(): void;
 export declare function claudeCodeInstalled(): boolean;
 export declare function codexInstalled(): boolean;
 export declare function cursorInstalled(): boolean;
@@ -248,8 +250,11 @@ export declare function pruneCaptureStateDir(deps?: {
     };
     unlinkSync: (p: string) => void;
 }, dir?: string, now?: number): void;
+export declare const DIRECT_UPLOAD_THRESHOLD_CHARS = 2000000;
 interface UploadDeps {
     post: (url: string, body: Record<string, unknown>, token: string) => Promise<void>;
+    requestJson?: (url: string, body: Record<string, unknown>, token: string) => Promise<any>;
+    uploadBytes?: (url: string, bytes: Buffer, contentType: string) => Promise<any>;
     readFileSync: typeof fs.readFileSync;
     unlinkSync: typeof fs.unlinkSync;
     writeFileSync?: typeof fs.writeFileSync;
@@ -286,4 +291,5 @@ interface DeferredUploadDeps extends UploadDeps {
     sleep?: (ms: number) => Promise<void>;
 }
 export declare function runDeferredUpload(jobFile: string, delayMs: number, deps: DeferredUploadDeps): Promise<void>;
+export declare function transcriptReadSkipReason(err: unknown): string;
 export {};

package/dist/utils.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.FINISH_ORPHAN_AGE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = void 0;
+exports.DIRECT_UPLOAD_THRESHOLD_CHARS = exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS = exports.FINISH_ORPHAN_AGE_MS = exports.CLAIM_STALE_MS = exports.UPLOAD_TTL_MS = exports.MAX_UPLOAD_ATTEMPTS = void 0;
 exports.readConfig = readConfig;
 exports.writeConfig = writeConfig;
 exports.parseGitRemoteFromConfig = parseGitRemoteFromConfig;
@@ -52,6 +52,8 @@ exports.getGitBranch = getGitBranch;
 exports.getGitHeadSha = getGitHeadSha;
 exports.buildCapturePayload = buildCapturePayload;
 exports.hashToken = hashToken;
+exports.extractHookNodePath = extractHookNodePath;
+exports.resetStableNodeCacheForTests = resetStableNodeCacheForTests;
 exports.claudeCodeInstalled = claudeCodeInstalled;
 exports.codexInstalled = codexInstalled;
 exports.cursorInstalled = cursorInstalled;
@@ -99,6 +101,7 @@ exports.writeLastCapture = writeLastCapture;
 exports.readLastCapture = readLastCapture;
 exports.runCaptureUpload = runCaptureUpload;
 exports.runDeferredUpload = runDeferredUpload;
+exports.transcriptReadSkipReason = transcriptReadSkipReason;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
@@ -732,7 +735,94 @@ const VSCODE_USER_MCP_PATH = path.join(VSCODE_USER_DIR, "mcp.json");
 function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function resolveHookCommand(subcommand) {
+// Pull the `<node>` prefix out of a codiedev hook command we previously wrote.
+// Commands take the form `'<node>' '<hookScript>' <subcommand>` (each path
+// single-quoted by shellQuote). Returns undefined for the legacy
+// `npx codiedev-hook <subcommand>` form (no explicit node path) or if the
+// command doesn't start with a quoted token. Exported for unit testing.
+function extractHookNodePath(cmd) {
+    if (!cmd)
+        return undefined;
+    // Match the first single-quoted token, honoring shellQuote's `'\''` escape.
+    const m = cmd.match(/^'((?:[^']|'\\'')*)'/);
+    if (!m)
+        return undefined;
+    return m[1].replace(/'\\''/g, "'");
+}
+// `process.execPath` is the *resolved* path to the running node binary, so under
+// Homebrew it's the version-specific Cellar path (e.g.
+// /opt/homebrew/Cellar/node/26.4.0/bin/node). Baking that into the hook means a
+// later `brew upgrade node` moves the Cellar dir and the hook path 404s. Prefer
+// a stable alias for the *same* binary:
+//   1. A node path from a hook we previously wrote that still resolves — usually
+//      a symlink the user deliberately pinned (e.g. /opt/homebrew/bin/node). A
+//      re-`connect`/self-heal then honors it instead of clobbering it.
+//   2. Otherwise, `node` as found on PATH when it points at the binary we're
+//      running (the Homebrew symlink, an nvm `current` alias, etc.).
+//   3. Last resort: the resolved `process.execPath`. Always valid right now, and
+//      still an absolute path a GUI-launched agent can execute without PATH.
+function realpathOrSelf(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+// A stable `node` alias on PATH (Homebrew symlink, nvm `current`, …) that points
+// at the very binary we're running, or undefined if none. `installHook` writes
+// five hooks per run, so memoize: `command -v node` is a synchronous subprocess
+// spawn and its result can't change within a process. `null` = "looked, none".
+let cachedStableNodeOnPath;
+// Test-only: the memo lives for the process lifetime, so suites that stage
+// their own PATH/symlink fixtures must clear it between tests.
+function resetStableNodeCacheForTests() {
+    cachedStableNodeOnPath = undefined;
+}
+function stableNodeOnPath() {
+    if (cachedStableNodeOnPath !== undefined) {
+        return cachedStableNodeOnPath ?? undefined;
+    }
+    const execReal = realpathOrSelf(process.execPath);
+    try {
+        const onPath = (0, child_process_1.execSync)("command -v node", {
+            stdio: ["pipe", "pipe", "pipe"],
+        })
+            .toString()
+            .trim();
+        if (onPath && onPath !== process.execPath && realpathOrSelf(onPath) === execReal) {
+            cachedStableNodeOnPath = onPath;
+            return onPath;
+        }
+    }
+    catch {
+        // No node on PATH (e.g. GUI-launched agent) — fall through.
+    }
+    cachedStableNodeOnPath = null;
+    return undefined;
+}
+function resolveHookNodePath(preferredNodePath) {
+    const execReal = realpathOrSelf(process.execPath);
+    // 1. Honor a still-working node path from the existing hook — but only when
+    //    it's a *different* string than the resolved realpath. If the existing
+    //    path already IS `process.execPath` it's the version-specific realpath we
+    //    want to upgrade away from (that's the Homebrew bug), so fall through to
+    //    hunt for a stable alias in step 2.
+    if (preferredNodePath &&
+        preferredNodePath !== process.execPath &&
+        fs.existsSync(preferredNodePath) &&
+        realpathOrSelf(preferredNodePath) === execReal) {
+        return preferredNodePath;
+    }
+    // 2. Prefer a stable `node` on PATH over the version-specific realpath.
+    const onPath = stableNodeOnPath();
+    if (onPath)
+        return onPath;
+    // 3. Last resort: the resolved absolute path. Always valid right now, and
+    //    still an absolute path a GUI-launched agent can execute without PATH.
+    return process.execPath;
+}
+function resolveHookCommand(subcommand, preferredNodePath) {
     try {
         const cliEntry = process.argv[1];
         if (cliEntry) {
@@ -740,7 +830,8 @@ function resolveHookCommand(subcommand) {
             const distDir = path.dirname(realCli);
             const hookScript = path.join(distDir, "hook.js");
             if (fs.existsSync(hookScript)) {
-                return `${shellQuote(process.execPath)} ${shellQuote(hookScript)} ${subcommand}`;
+                const nodePath = resolveHookNodePath(preferredNodePath);
+                return `${shellQuote(nodePath)} ${shellQuote(hookScript)} ${subcommand}`;
             }
         }
     }
@@ -797,6 +888,22 @@ function upsertCodiedevHook(hooks, eventName, subcommand, matcher = ".*") {
     if (!hooks[eventName])
         hooks[eventName] = [];
     const existing = hooks[eventName];
+    // Before stripping the old codiedev entry, remember the node path it used so a
+    // re-run/upgrade can honor a stable symlink the user pinned instead of
+    // overwriting it with the version-specific `process.execPath` (see
+    // resolveHookNodePath). Done in an explicit scan rather than as a side effect
+    // of the filter predicate below, which stays a pure predicate.
+    let preservedNodePath;
+    for (const hook of existing) {
+        const inner = hook.hooks;
+        if (!Array.isArray(inner))
+            continue;
+        const codiedevInner = inner.find((h) => (0, detection_1.isCodiedevHookCommand)(h.command));
+        if (codiedevInner) {
+            preservedNodePath = extractHookNodePath(codiedevInner.command);
+            break;
+        }
+    }
     const filtered = existing.filter((hook) => {
         const inner = hook.hooks;
         if (Array.isArray(inner)) {
@@ -806,7 +913,7 @@ function upsertCodiedevHook(hooks, eventName, subcommand, matcher = ".*") {
     });
     filtered.push({
         matcher,
-        hooks: [{ type: "command", command: resolveHookCommand(subcommand) }],
+        hooks: [{ type: "command", command: resolveHookCommand(subcommand, preservedNodePath) }],
     });
     hooks[eventName] = filtered;
 }
@@ -2028,6 +2135,13 @@ function pruneCaptureStateDir(deps = fs, dir = CAPTURE_STATE_DIR, now = Date.now
         // dir missing/unreadable — nothing to prune
     }
 }
+// Base64 length above which the transcript goes straight to storage instead
+// of inline in the captureSession JSON body. The backend's HTTP-action
+// isolate has a 64MB cap and inline base64 amplifies ~8x in memory (request
+// text + parsed JSON + decode output all resident) — ~7MB transcripts OOM it
+// (observed live 2026-07-02). 2M base64 chars ≈ 1.5MB raw: far below the
+// cliff, while per-turn snapshots (typically KBs) skip the extra roundtrips.
+exports.DIRECT_UPLOAD_THRESHOLD_CHARS = 2_000_000;
 // "Last session captured" breadcrumb. Written next to config.json on a
 // successful capture upload; read by `codiedev doctor` so a user can confirm
 // their most recent session actually landed (the single hardest thing to
@@ -2086,7 +2200,22 @@ async function runCaptureUpload(jobFile, deps) {
     }
     const sessionId = job.body?.sessionId;
     try {
-        await deps.post(job.url, job.body, job.token);
+        // Big transcript + capable deps → direct-to-storage: fetch a one-time
+        // upload URL, PUT the raw bytes, send captureSession the storageId. Any
+        // step failing throws into the retry path below, same as a failed POST.
+        let body = job.body;
+        const transcript = body?.transcript;
+        if (transcript &&
+            transcript.length > exports.DIRECT_UPLOAD_THRESHOLD_CHARS &&
+            deps.requestJson &&
+            deps.uploadBytes) {
+            const uploadUrlEndpoint = job.url.replace(/\/api\/captureSession$/, "/api/captureUploadUrl");
+            const { uploadUrl } = await deps.requestJson(uploadUrlEndpoint, {}, job.token);
+            const { storageId } = await deps.uploadBytes(uploadUrl, Buffer.from(transcript, "base64"), "application/json");
+            body = { ...body, transcriptStorageId: storageId };
+            delete body.transcript;
+        }
+        await deps.post(job.url, body, job.token);
         // success — drop a "last session captured" breadcrumb (before removing the
         // job) so doctor can confirm the most recent session actually landed.
         if (deps.recordSuccess) {
@@ -2225,3 +2354,15 @@ async function runDeferredUpload(jobFile, delayMs, deps) {
     }
     await runCaptureUpload(claimed, deps);
 }
+// Classify a transcript read failure at capture time. ENOENT = the transcript
+// never existed: a desktop-app phantom helper session (SessionStart/End hooks
+// fire, no conversation ever happens), not lost work — the backend excludes
+// "no-transcript" from coverage. Anything else means a real transcript was
+// there but the read failed: a genuine loss, tagged with the errno so it stays
+// diagnosable from the server side.
+function transcriptReadSkipReason(err) {
+    const code = err?.code;
+    if (code === "ENOENT")
+        return "no-transcript";
+    return `transcript-unreadable:${code || "unknown"}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.23",
+  "version": "0.9.25",
   "description": "Connect Claude Code, Codex, Cursor, or VS Code Copilot to Codiedev for org-wide session capture and artifact collaboration",
   "bin": {
     "codiedev": "dist/cli.js",