codiedev 0.9.32 → 0.9.34

package/dist/cli.js

@@ -228,9 +228,13 @@ codiedev inbox — show messages from teammates
   Usage:
     codiedev inbox [--unread] [--limit N]
 
-  Lists pings with sender, subject artifact, and preview. Each row
+  Lists pings with sender, subject artifact, and preview. Each ping row
   shows a ping-id you can pass to 'codiedev read'.
 
+  Also lists feed posts and comments where a teammate @-mentioned you.
+  Those rows end in a portal link — the thread lives in the feed, so
+  read and reply to it there.
+
   Unread rows show as ● ; read rows as · .
 
   Examples:

package/dist/codie.js

@@ -53,6 +53,7 @@ const configDir_1 = require("./configDir");
 const codieLauncher_1 = require("./codieLauncher");
 const codieRuntime_1 = require("./codieRuntime");
 const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
+const upgradeNudge_1 = require("./upgradeNudge");
 function git(args) {
     const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     return result.status === 0 ? result.stdout.trim() : "";
@@ -177,6 +178,14 @@ async function main() {
     if (!key) {
         throw new Error("Connect your Codiedev account first with `codiedev connect`");
     }
+    // Before anything paints: once the OpenCode engine owns stdio, a prompt is
+    // unreadable. A successful in-place upgrade relaunches this command with the
+    // new package, so the stale process must stop here.
+    const update = await (0, upgradeNudge_1.maybeOfferUpgrade)();
+    if (update.relaunched) {
+        process.exitCode = update.status ?? 0;
+        return;
+    }
     const gatewayUrl = process.env.CODIEDEV_GATEWAY_URL || "https://gateway.codiedev.com/api/v1";
     const catalog = await (0, codieLauncher_1.fetchApprovedCatalog)({ baseUrl: gatewayUrl, key });
     const parsed = (0, codieLauncher_1.parseCodieArgs)(process.argv.slice(2));

package/dist/commands/inbox.d.ts

@@ -1,2 +1,3 @@
-export declare function runInbox(args: string[]): Promise<void>;
+import type { CodiedevConfig } from "../utils";
+export declare function runInbox(args: string[], configOverride?: CodiedevConfig): Promise<void>;
 export declare function runRead(args: string[]): Promise<void>;

package/dist/commands/inbox.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runInbox = runInbox;
 exports.runRead = runRead;
 const shared_1 = require("./shared");
+const inboxFormat_1 = require("../inboxFormat");
 function parseInboxArgs(args) {
     let unreadOnly = false;
     let limit;
@@ -23,9 +24,9 @@ function parseInboxArgs(args) {
     }
     return { unreadOnly, limit };
 }
-async function runInbox(args) {
+async function runInbox(args, configOverride) {
     const { unreadOnly, limit } = parseInboxArgs(args);
-    const config = (0, shared_1.requireConfig)();
+    const config = configOverride ?? (0, shared_1.requireConfig)();
     const start = Date.now();
     try {
         const res = await (0, shared_1.apiRequest)("GET", "/api/cli/inbox", {
@@ -40,26 +41,14 @@ async function runInbox(args) {
             ok: true,
             latencyMs: Date.now() - start,
         });
-        const pings = res.pings;
-        const unreadCount = pings.filter((p) => !p.readAt).length;
-        if (pings.length === 0) {
-            console.log(unreadOnly ? "No unread messages." : "Inbox is empty.");
-            return;
-        }
-        console.log(`Inbox · ${pings.length} ${unreadOnly ? "unread" : "recent"}${unreadOnly ? "" : ` · ${unreadCount} unread`}`);
-        console.log();
-        for (const p of pings) {
-            const dot = p.readAt ? "·" : "●";
-            const from = p.from?.name ?? "unknown";
-            const when = (0, shared_1.timeAgo)(p.createdAt);
-            const where = p.subjectKey ? ` · on ${p.subjectKey}` : "";
-            const preview = p.preview || "(no body)";
-            console.log(`${dot}  ${from}${where} · ${when}`);
-            console.log(`    ${preview}`);
-            console.log(`    id: ${p.pingId}`);
-            console.log();
+        for (const line of (0, inboxFormat_1.formatInbox)({
+            pings: res.pings,
+            mentions: res.mentions,
+            unreadOnly,
+            limit,
+        })) {
+            console.log(line);
         }
-        console.log(`Mark read: codiedev read <ping-id>`);
     }
     catch (err) {
         (0, shared_1.recordAgentEvent)(config, {

package/dist/inboxFormat.d.ts

@@ -0,0 +1,38 @@
+export interface InboxPing {
+    pingId: string;
+    createdAt: number;
+    readAt?: number;
+    from: {
+        name: string;
+        email: string;
+    } | null;
+    subjectKey: string | null;
+    subject: {
+        title?: string;
+    } | null;
+    preview: string;
+}
+export interface InboxMention {
+    mentionId: string;
+    createdAt: number;
+    readAt?: number | null;
+    from: {
+        name: string;
+        email: string;
+    } | null;
+    postTitle: string | null;
+    preview: string | null;
+    url: string | null;
+}
+/**
+ * Render the inbox for BOTH surfaces — `codiedev inbox` and the MCP
+ * `codiedev_inbox` tool an agent calls for "any messages?". Shared so the
+ * agent path can never drift back to pings-only while the human path shows
+ * mentions.
+ */
+export declare function formatInbox(opts: {
+    pings: InboxPing[];
+    mentions?: InboxMention[];
+    unreadOnly: boolean;
+    limit?: number;
+}): string[];

package/dist/inboxFormat.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatInbox = formatInbox;
+const shared_1 = require("./commands/shared");
+/**
+ * Render the inbox for BOTH surfaces — `codiedev inbox` and the MCP
+ * `codiedev_inbox` tool an agent calls for "any messages?". Shared so the
+ * agent path can never drift back to pings-only while the human path shows
+ * mentions.
+ */
+function formatInbox(opts) {
+    const mentions = opts.mentions ?? [];
+    // The backend applies `limit` to each source independently, so asking for N
+    // can return up to 2N — and with no `--limit` it defaults to 50 per source,
+    // i.e. 100 rows, twice the pre-change maximum. Cap the COMBINED list by
+    // recency, always (matching the backend's own default), so the header is
+    // truthful and `--limit` actually holds.
+    //
+    // Selected by identity rather than by a `createdAt >= cutoff` filter: rows
+    // tied on the cutoff millisecond are reachable (Convex freezes Date.now()
+    // per transaction, and seeded activity carries synthetic stamps) and a
+    // threshold filter lets every tied row through, overshooting the limit.
+    const DEFAULT_LIMIT = 50;
+    const cap = opts.limit ?? DEFAULT_LIMIT;
+    // Pings claim the budget first, then mentions fill whatever is left — both
+    // newest-first. Before this change pings owned the whole budget, so this is
+    // purely additive and can never hide a ping that used to be visible. A flat
+    // recency cap would instead let a busy feed evict every direct ping, and
+    // pings are the actionable half: they carry the id you reply to, and losing
+    // them all takes the mark-read footer with them.
+    const byRecency = (xs) => [...xs].sort((a, b) => b.createdAt - a.createdAt);
+    const keptPings = byRecency(opts.pings).slice(0, cap);
+    const keptMentions = byRecency(mentions).slice(0, Math.max(0, cap - keptPings.length));
+    const total = keptPings.length + keptMentions.length;
+    if (total === 0) {
+        return [opts.unreadOnly ? "No unread messages." : "Inbox is empty."];
+    }
+    const unreadCount = keptPings.filter((p) => !p.readAt).length +
+        keptMentions.filter((m) => !m.readAt).length;
+    const lines = [
+        `Inbox · ${total} ${opts.unreadOnly ? "unread" : "recent"}${opts.unreadOnly ? "" : ` · ${unreadCount} unread`}`,
+        "",
+    ];
+    for (const p of keptPings) {
+        const dot = p.readAt ? "·" : "●";
+        const from = p.from?.name ?? "unknown";
+        const where = p.subjectKey ? ` · on ${p.subjectKey}` : "";
+        lines.push(`${dot}  ${from}${where} · ${(0, shared_1.timeAgo)(p.createdAt)}`);
+        lines.push(`    ${p.preview || "(no body)"}`);
+        lines.push(`    id: ${p.pingId}`);
+        lines.push("");
+    }
+    // Mentions carry no CLI-side body to reply to — the thread lives in the feed
+    // — so each row ends in the deep link rather than an id.
+    for (const m of keptMentions) {
+        const dot = m.readAt ? "·" : "●";
+        const from = m.from?.name ?? "someone";
+        const where = m.postTitle ? ` · on “${m.postTitle}”` : "";
+        lines.push(`${dot}  ${from} mentioned you${where} · ${(0, shared_1.timeAgo)(m.createdAt)}`);
+        if (m.preview)
+            lines.push(`    ${m.preview}`);
+        if (m.url)
+            lines.push(`    ${m.url}`);
+        lines.push("");
+    }
+    if (keptPings.length > 0)
+        lines.push("Mark read: codiedev read <ping-id>");
+    return lines;
+}

package/dist/mcp.js

@@ -51,6 +51,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
 const shared_1 = require("./commands/shared");
+const inboxFormat_1 = require("./inboxFormat");
 const PKG_NAME = "codiedev";
 // Read version from the bundled package.json so the startup log + tool reports
 // always reflect the actually-installed version, rather than a stale constant.
@@ -748,33 +749,16 @@ async function handleInbox(args, config) {
         config,
         query: { unreadOnly: unreadOnly ? "1" : undefined, limit },
     });
-    if (res.pings.length === 0) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: unreadOnly ? "No unread messages." : "Inbox is empty.",
-                },
-            ],
-        };
-    }
-    const unreadCount = res.pings.filter((p) => !p.readAt).length;
-    const lines = [
-        `Inbox · ${res.pings.length} ${unreadOnly ? "unread" : "recent"}${unreadOnly ? "" : ` · ${unreadCount} unread`}`,
-        "",
-    ];
-    for (const p of res.pings) {
-        const status = p.readAt ? "·" : "●";
-        const from = p.from?.name ?? "unknown";
-        const where = p.subjectKey ? ` · on ${p.subjectKey}` : "";
-        lines.push(`${status} ${from}${where} · ${(0, shared_1.timeAgo)(p.createdAt)}`);
-        lines.push(`    ${p.preview || "(no body)"}`);
-        lines.push(`    id: ${p.pingId}`);
-        lines.push("");
-    }
-    return {
-        content: [{ type: "text", text: lines.join("\n") }],
-    };
+    // Shared with `codiedev inbox` so this agent-facing path can never drift
+    // back to pings-only. CLAUDE.md routes "any messages?" here, so a
+    // mentions-blind version reproduces the bug for agents.
+    const text = (0, inboxFormat_1.formatInbox)({
+        pings: res.pings,
+        mentions: res.mentions,
+        unreadOnly,
+        limit,
+    }).join("\n");
+    return { content: [{ type: "text", text }] };
 }
 async function handleNote(args, config) {
     const body = asString(args.body);

package/dist/scope.d.ts

@@ -0,0 +1,8 @@
+export interface ScopeInfo {
+    workspaceName: string;
+    matchedRepo: {
+        fullName: string;
+    } | null;
+}
+export declare function formatScope(info: ScopeInfo): string;
+export declare function printScope(info: ScopeInfo): void;

package/dist/scope.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatScope = formatScope;
+exports.printScope = printScope;
+function formatScope(info) {
+    if (!info.workspaceName)
+        return "→ unknown workspace";
+    if (info.matchedRepo) {
+        return `→ ${info.workspaceName} (matched ${info.matchedRepo.fullName})`;
+    }
+    return `→ ${info.workspaceName} (default profile, no repo match)`;
+}
+function printScope(info) {
+    console.log(formatScope(info));
+}

package/dist/security.d.ts

@@ -0,0 +1,34 @@
+export type SecurityHookPhase = "pre" | "post" | "failure";
+export type AgentSurface = "claude-code" | "codex";
+export interface RawSecurityHookInput {
+    session_id?: string;
+    sessionId?: string;
+    cwd?: string;
+    hook_event_name?: string;
+    hookEventName?: string;
+    tool_name?: string;
+    toolName?: string;
+    tool_input?: unknown;
+    toolInput?: unknown;
+    tool_response?: unknown;
+    toolResponse?: unknown;
+    tool_use_id?: string;
+    toolUseId?: string;
+    duration_ms?: number;
+    durationMs?: number;
+    error?: unknown;
+}
+export interface SecurityWorkflowEvent {
+    schemaVersion: 1;
+    source: AgentSurface;
+    phase: SecurityHookPhase;
+    sessionId: string;
+    toolName: string;
+    toolUseId?: string;
+    cwd?: string;
+    observedAt: number;
+    toolDurationMs?: number;
+    payload: unknown;
+    redactionCount: number;
+}
+export declare function buildSecurityWorkflowEvent(input: RawSecurityHookInput, phase: SecurityHookPhase, source: AgentSurface, now?: () => number): SecurityWorkflowEvent | null;

package/dist/security.js

@@ -0,0 +1,119 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityWorkflowEvent = buildSecurityWorkflowEvent;
+const crypto = __importStar(require("crypto"));
+const SECRET_KEY = /(?:api[_-]?key|access[_-]?token|auth[_-]?token|password|passwd|secret|private[_-]?key|client[_-]?secret)/i;
+const SECRET_VALUE_PATTERNS = [
+    /\b(?:sk|rk|pk)-(?:live|test|proj)?[-_A-Za-z0-9]{16,}\b/g,
+    /\bgh[opusr]_[A-Za-z0-9]{20,}\b/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+    /\bBearer\s+[A-Za-z0-9._~+\/-]{16,}=*\b/gi,
+];
+function fingerprint(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function redactString(value) {
+    let count = 0;
+    let redacted = value;
+    for (const pattern of SECRET_VALUE_PATTERNS) {
+        redacted = redacted.replace(pattern, (match) => {
+            count += 1;
+            return `[REDACTED_SECRET:${fingerprint(match)}]`;
+        });
+    }
+    // Keep hook payloads bounded. Full transcripts already use Codie's existing
+    // capture path; the detector only needs immediate causal context here.
+    if (redacted.length > 16_384)
+        redacted = `${redacted.slice(0, 16_384)}[TRUNCATED]`;
+    return { value: redacted, count };
+}
+function redact(value, key = "", depth = 0) {
+    if (depth > 8)
+        return { value: "[TRUNCATED_DEPTH]", count: 0 };
+    if (SECRET_KEY.test(key) && value !== null && value !== undefined) {
+        const text = typeof value === "string" ? value : JSON.stringify(value);
+        return { value: `[REDACTED_SECRET:${fingerprint(text)}]`, count: 1 };
+    }
+    if (typeof value === "string")
+        return redactString(value);
+    if (Array.isArray(value)) {
+        let count = 0;
+        const next = value.slice(0, 200).map((item) => {
+            const result = redact(item, key, depth + 1);
+            count += result.count;
+            return result.value;
+        });
+        return { value: next, count };
+    }
+    if (value && typeof value === "object") {
+        let count = 0;
+        const next = {};
+        for (const [childKey, childValue] of Object.entries(value).slice(0, 200)) {
+            const result = redact(childValue, childKey, depth + 1);
+            count += result.count;
+            next[childKey] = result.value;
+        }
+        return { value: next, count };
+    }
+    return { value, count: 0 };
+}
+function buildSecurityWorkflowEvent(input, phase, source, now = Date.now) {
+    const sessionId = input.session_id ?? input.sessionId ?? "";
+    const toolName = input.tool_name ?? input.toolName ?? "";
+    if (!sessionId || !toolName)
+        return null;
+    const rawPayload = {
+        input: input.tool_input ?? input.toolInput,
+        ...(phase === "post" ? { response: input.tool_response ?? input.toolResponse } : {}),
+        ...(phase === "failure" ? { error: input.error ?? input.tool_response ?? input.toolResponse } : {}),
+    };
+    const sanitized = redact(rawPayload);
+    const duration = input.duration_ms ?? input.durationMs;
+    return {
+        schemaVersion: 1,
+        source,
+        phase,
+        sessionId,
+        toolName,
+        toolUseId: input.tool_use_id ?? input.toolUseId,
+        cwd: input.cwd,
+        observedAt: now(),
+        toolDurationMs: typeof duration === "number" && Number.isFinite(duration) ? duration : undefined,
+        payload: sanitized.value,
+        redactionCount: sanitized.count,
+    };
+}

package/dist/upgradeNudge.d.ts

@@ -5,3 +5,20 @@
  * this feature existed.
  */
 export declare function maybePrintUpgradeNudge(): Promise<void>;
+export interface OfferOpts {
+    env?: NodeJS.ProcessEnv;
+    argv?: string[];
+    nowMs?: number;
+    fetchImpl?: typeof fetch;
+    log?: (line: string) => void;
+    isTty?: boolean;
+}
+/**
+ * Prompt-capable sibling of maybePrintUpgradeNudge. Call this before handing
+ * the terminal to a TUI. A successful upgrade relaunches the fresh CLI and
+ * tells the stale caller to stop rather than continuing with old modules.
+ */
+export declare function maybeOfferUpgrade(opts?: OfferOpts): Promise<{
+    relaunched: boolean;
+    status?: number;
+}>;

package/dist/upgradeNudge.js

@@ -43,8 +43,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.maybePrintUpgradeNudge = maybePrintUpgradeNudge;
+exports.maybeOfferUpgrade = maybeOfferUpgrade;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const version_1 = require("./version");
 const versionCheck_1 = require("./versionCheck");
 const configDir_1 = require("./configDir");
@@ -122,3 +124,190 @@ async function maybePrintUpgradeNudge() {
         console.log("");
     }
 }
+const OFFER_CACHE_NAME = ".update-offer-cache.json";
+// This runs before the harness paints, so the timeout is startup latency the
+// user feels. A missed check costs nothing; the next stale-cache launch tries
+// again.
+const OFFER_FETCH_TIMEOUT_MS = 1500;
+const UPGRADE_TIMEOUT_MS = 120_000;
+function offerCachePath(env) {
+    const base = env.CODIEDEV_CONFIG_DIR?.trim()
+        ? path.resolve(env.CODIEDEV_CONFIG_DIR.trim())
+        : (0, configDir_1.codiedevStateDir)();
+    return path.join(base, OFFER_CACHE_NAME);
+}
+function readOfferCache(env) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(offerCachePath(env), "utf8"));
+        if (typeof parsed.fetchedAt !== "number")
+            return null;
+        return {
+            latest: typeof parsed.latest === "string" ? parsed.latest : null,
+            fetchedAt: parsed.fetchedAt,
+            promptedAt: typeof parsed.promptedAt === "number" ? parsed.promptedAt : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// If this cannot be persisted, the whole feature stays off. Without memory,
+// every launch would refetch and re-nag on ephemeral or read-only filesystems.
+function writeOfferCache(entry, env) {
+    try {
+        const target = offerCachePath(env);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, JSON.stringify(entry), "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isCiEnvironment(env) {
+    return Boolean(env.CI || env.CONTINUOUS_INTEGRATION || env.GITHUB_ACTIONS || env.BUILD_NUMBER);
+}
+async function fetchLatest(fetchImpl) {
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), OFFER_FETCH_TIMEOUT_MS);
+        try {
+            const res = await fetchImpl(REGISTRY_URL, {
+                headers: { Accept: "application/json" },
+                signal: controller.signal,
+            });
+            if (!res.ok)
+                return null;
+            const json = (await res.json());
+            return typeof json.version === "string" ? json.version : null;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+// Single-keypress y/n prompt. EOF, Ctrl-C, lost raw mode, and tty errors all
+// default to no so update handling can never strand the launcher.
+function promptYesNo(question) {
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        process.stdout.write(question);
+        const wasRaw = stdin.isRaw;
+        try {
+            stdin.setRawMode(true);
+        }
+        catch {
+            process.stdout.write("\n");
+            resolve(false);
+            return;
+        }
+        stdin.resume();
+        let settled = false;
+        const settle = (yes) => {
+            if (settled)
+                return;
+            settled = true;
+            stdin.removeListener("data", onData);
+            stdin.removeListener("end", onGone);
+            stdin.removeListener("error", onGone);
+            try {
+                stdin.setRawMode(Boolean(wasRaw));
+            }
+            catch {
+                // Best-effort; the engine resets the tty when it starts.
+            }
+            stdin.pause();
+            process.stdout.write(`${yes ? "y" : "n"}\n`);
+            resolve(yes);
+        };
+        const onData = (chunk) => settle(String(chunk).trim().toLowerCase() === "y");
+        const onGone = () => settle(false);
+        stdin.once("data", onData);
+        stdin.once("end", onGone);
+        stdin.once("error", onGone);
+    });
+}
+function runUpgrade() {
+    const result = (0, child_process_1.spawnSync)("npm", ["i", "-g", "codiedev@latest"], {
+        stdio: "inherit",
+        timeout: UPGRADE_TIMEOUT_MS,
+        shell: process.platform === "win32",
+    });
+    return !result.error && result.status === 0;
+}
+/**
+ * Prompt-capable sibling of maybePrintUpgradeNudge. Call this before handing
+ * the terminal to a TUI. A successful upgrade relaunches the fresh CLI and
+ * tells the stale caller to stop rather than continuing with old modules.
+ */
+async function maybeOfferUpgrade(opts = {}) {
+    const env = opts.env ?? process.env;
+    const argv = opts.argv ?? process.argv;
+    const nowMs = opts.nowMs ?? Date.now();
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.error(line));
+    if (env.CODIEDEV_NO_UPDATE_CHECK)
+        return { relaunched: false };
+    const cache = readOfferCache(env);
+    let latest = cache?.latest ?? null;
+    let fetchedAt = cache?.fetchedAt ?? 0;
+    const promptedAt = cache?.promptedAt ?? 0;
+    if (!cache || nowMs - cache.fetchedAt > CACHE_TTL_MS) {
+        // Probe writability before paying the network cost.
+        if (!writeOfferCache(cache ?? { latest: null, fetchedAt: 0, promptedAt: 0 }, env)) {
+            return { relaunched: false };
+        }
+        latest = await fetchLatest(fetchImpl);
+        fetchedAt = nowMs;
+        if (!writeOfferCache({ latest, fetchedAt, promptedAt }, env)) {
+            return { relaunched: false };
+        }
+    }
+    const installKind = (0, versionCheck_1.resolveInstallKind)({
+        dirname: __dirname,
+        env,
+        existsSync: fs.existsSync,
+        readFileSync: fs.readFileSync,
+        accessSync: fs.accessSync,
+    });
+    const { action, command } = (0, versionCheck_1.decideUpdateAction)({
+        current: version_1.CLI_VERSION,
+        latest,
+        installKind,
+        isTty: opts.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        isCi: isCiEnvironment(env),
+        promptedAt,
+        nowMs,
+    });
+    if (action === "none")
+        return { relaunched: false };
+    log("");
+    log(`\x1b[33mcodiedev ${latest} is available\x1b[0m (you're on ${version_1.CLI_VERSION})`);
+    if (action === "notify") {
+        log(`  Upgrade: \x1b[36m${command}\x1b[0m`);
+        log("");
+        return { relaunched: false };
+    }
+    writeOfferCache({ latest, fetchedAt, promptedAt: nowMs }, env);
+    if (!(await promptYesNo("  Update now? [y/N] "))) {
+        log(`  Skipping. Upgrade later with \x1b[36m${command}\x1b[0m`);
+        log("");
+        return { relaunched: false };
+    }
+    if (!runUpgrade()) {
+        log(`\x1b[33mcodiedev: upgrade failed — continuing on ${version_1.CLI_VERSION}\x1b[0m`);
+        log(`  Try it by hand: \x1b[36m${command}\x1b[0m`);
+        log("");
+        return { relaunched: false };
+    }
+    const relaunch = (0, child_process_1.spawnSync)(process.execPath, [argv[1], ...argv.slice(2)], {
+        stdio: "inherit",
+        env: { ...env, CODIEDEV_NO_UPDATE_CHECK: "1" },
+    });
+    if (relaunch.error)
+        return { relaunched: false };
+    return { relaunched: true, status: relaunch.status === null ? 1 : relaunch.status };
+}

package/dist/versionCheck.d.ts

@@ -26,3 +26,43 @@ export interface UpdateWarningInput {
  * as-given and answers a single question — should the user see a nag?
  */
 export declare function shouldShowUpdateWarning(input: UpdateWarningInput): boolean;
+export type InstallKind = "npx" | "container" | "global" | "readonly";
+export interface InstallKindDeps {
+    dirname: string;
+    env: NodeJS.ProcessEnv;
+    existsSync: (p: string) => boolean;
+    readFileSync: (p: string, enc: string) => string;
+    accessSync: (p: string, mode?: number) => void;
+}
+/**
+ * npx       — running from npm's _npx cache; nothing to upgrade in place.
+ * container — baked into an image; the honest fix is rebuilding it.
+ * global    — a real install directory we can write to. Upgradable.
+ * readonly  — a real install directory we cannot write to (root-owned global
+ *             on a shared box, read-only mount). Needs sudo, so print rather
+ *             than attempt an upgrade that would EACCES.
+ */
+export declare function resolveInstallKind(deps: InstallKindDeps): InstallKind;
+export declare function upgradeCommand(kind: InstallKind, pkg?: string): string;
+export type UpdateAction = "none" | "notify" | "prompt";
+export interface UpdateActionInput {
+    current: string;
+    latest: string | null;
+    installKind: InstallKind;
+    isTty: boolean;
+    isCi: boolean;
+    promptedAt?: number;
+    nowMs: number;
+    cacheTtlMs?: number;
+    pkg?: string;
+}
+/**
+ * `promptedAt` makes a decline stick until the next window instead of asking
+ * on every launch. It is deliberately not keyed to a dismissed version:
+ * somebody who says no today should be asked again tomorrow, not silently
+ * stranded on that version forever.
+ */
+export declare function decideUpdateAction(input: UpdateActionInput): {
+    action: UpdateAction;
+    command: string;
+};

package/dist/versionCheck.js

@@ -7,6 +7,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseSemver = parseSemver;
 exports.compareSemver = compareSemver;
 exports.shouldShowUpdateWarning = shouldShowUpdateWarning;
+exports.resolveInstallKind = resolveInstallKind;
+exports.upgradeCommand = upgradeCommand;
+exports.decideUpdateAction = decideUpdateAction;
 function parseSemver(input) {
     if (!input)
         return null;
@@ -47,3 +50,68 @@ function shouldShowUpdateWarning(input) {
         return false;
     return compareSemver(input.current, input.latest) === -1;
 }
+/**
+ * npx       — running from npm's _npx cache; nothing to upgrade in place.
+ * container — baked into an image; the honest fix is rebuilding it.
+ * global    — a real install directory we can write to. Upgradable.
+ * readonly  — a real install directory we cannot write to (root-owned global
+ *             on a shared box, read-only mount). Needs sudo, so print rather
+ *             than attempt an upgrade that would EACCES.
+ */
+function resolveInstallKind(deps) {
+    if (/[\\/](?:_npx|\.npm[\\/]_npx)[\\/]/.test(deps.dirname))
+        return "npx";
+    if (deps.env.KUBERNETES_SERVICE_HOST)
+        return "container";
+    if (deps.existsSync("/.dockerenv"))
+        return "container";
+    try {
+        if (/docker|containerd|kubepods|lxc/.test(deps.readFileSync("/proc/1/cgroup", "utf8"))) {
+            return "container";
+        }
+    }
+    catch {
+        // not Linux, or no procfs — fall through to the writability probe
+    }
+    try {
+        // 2 = fs.constants.W_OK, inlined so this module stays fs-free.
+        deps.accessSync(deps.dirname, 2);
+        return "global";
+    }
+    catch {
+        return "readonly";
+    }
+}
+function upgradeCommand(kind, pkg = "codiedev") {
+    switch (kind) {
+        case "npx":
+            return `npx --package ${pkg}@latest codie`;
+        case "container":
+            return `rebuild your image (npm i -g ${pkg}@latest)`;
+        case "readonly":
+            return `sudo npm i -g ${pkg}@latest`;
+        default:
+            return `npm i -g ${pkg}@latest`;
+    }
+}
+/**
+ * `promptedAt` makes a decline stick until the next window instead of asking
+ * on every launch. It is deliberately not keyed to a dismissed version:
+ * somebody who says no today should be asked again tomorrow, not silently
+ * stranded on that version forever.
+ */
+function decideUpdateAction(input) {
+    const command = upgradeCommand(input.installKind, input.pkg);
+    const ttl = input.cacheTtlMs ?? 24 * 60 * 60 * 1000;
+    if (!input.latest || compareSemver(input.current, input.latest) !== -1) {
+        return { action: "none", command };
+    }
+    if (input.isCi || !input.isTty)
+        return { action: "none", command };
+    const promptedAt = input.promptedAt ?? 0;
+    const askedRecently = promptedAt > 0 && input.nowMs - promptedAt <= ttl;
+    if (input.installKind === "global" && !askedRecently) {
+        return { action: "prompt", command };
+    }
+    return { action: "notify", command };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",