codiedev 0.9.33 → 0.9.34

package/dist/codie.js

@@ -53,6 +53,7 @@ const configDir_1 = require("./configDir");
 const codieLauncher_1 = require("./codieLauncher");
 const codieRuntime_1 = require("./codieRuntime");
 const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
+const upgradeNudge_1 = require("./upgradeNudge");
 function git(args) {
     const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     return result.status === 0 ? result.stdout.trim() : "";
@@ -177,6 +178,14 @@ async function main() {
     if (!key) {
         throw new Error("Connect your Codiedev account first with `codiedev connect`");
     }
+    // Before anything paints: once the OpenCode engine owns stdio, a prompt is
+    // unreadable. A successful in-place upgrade relaunches this command with the
+    // new package, so the stale process must stop here.
+    const update = await (0, upgradeNudge_1.maybeOfferUpgrade)();
+    if (update.relaunched) {
+        process.exitCode = update.status ?? 0;
+        return;
+    }
     const gatewayUrl = process.env.CODIEDEV_GATEWAY_URL || "https://gateway.codiedev.com/api/v1";
     const catalog = await (0, codieLauncher_1.fetchApprovedCatalog)({ baseUrl: gatewayUrl, key });
     const parsed = (0, codieLauncher_1.parseCodieArgs)(process.argv.slice(2));

package/dist/scope.d.ts

@@ -0,0 +1,8 @@
+export interface ScopeInfo {
+    workspaceName: string;
+    matchedRepo: {
+        fullName: string;
+    } | null;
+}
+export declare function formatScope(info: ScopeInfo): string;
+export declare function printScope(info: ScopeInfo): void;

package/dist/scope.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatScope = formatScope;
+exports.printScope = printScope;
+function formatScope(info) {
+    if (!info.workspaceName)
+        return "→ unknown workspace";
+    if (info.matchedRepo) {
+        return `→ ${info.workspaceName} (matched ${info.matchedRepo.fullName})`;
+    }
+    return `→ ${info.workspaceName} (default profile, no repo match)`;
+}
+function printScope(info) {
+    console.log(formatScope(info));
+}

package/dist/security.d.ts

@@ -0,0 +1,34 @@
+export type SecurityHookPhase = "pre" | "post" | "failure";
+export type AgentSurface = "claude-code" | "codex";
+export interface RawSecurityHookInput {
+    session_id?: string;
+    sessionId?: string;
+    cwd?: string;
+    hook_event_name?: string;
+    hookEventName?: string;
+    tool_name?: string;
+    toolName?: string;
+    tool_input?: unknown;
+    toolInput?: unknown;
+    tool_response?: unknown;
+    toolResponse?: unknown;
+    tool_use_id?: string;
+    toolUseId?: string;
+    duration_ms?: number;
+    durationMs?: number;
+    error?: unknown;
+}
+export interface SecurityWorkflowEvent {
+    schemaVersion: 1;
+    source: AgentSurface;
+    phase: SecurityHookPhase;
+    sessionId: string;
+    toolName: string;
+    toolUseId?: string;
+    cwd?: string;
+    observedAt: number;
+    toolDurationMs?: number;
+    payload: unknown;
+    redactionCount: number;
+}
+export declare function buildSecurityWorkflowEvent(input: RawSecurityHookInput, phase: SecurityHookPhase, source: AgentSurface, now?: () => number): SecurityWorkflowEvent | null;

package/dist/security.js

@@ -0,0 +1,119 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityWorkflowEvent = buildSecurityWorkflowEvent;
+const crypto = __importStar(require("crypto"));
+const SECRET_KEY = /(?:api[_-]?key|access[_-]?token|auth[_-]?token|password|passwd|secret|private[_-]?key|client[_-]?secret)/i;
+const SECRET_VALUE_PATTERNS = [
+    /\b(?:sk|rk|pk)-(?:live|test|proj)?[-_A-Za-z0-9]{16,}\b/g,
+    /\bgh[opusr]_[A-Za-z0-9]{20,}\b/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+    /\bBearer\s+[A-Za-z0-9._~+\/-]{16,}=*\b/gi,
+];
+function fingerprint(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function redactString(value) {
+    let count = 0;
+    let redacted = value;
+    for (const pattern of SECRET_VALUE_PATTERNS) {
+        redacted = redacted.replace(pattern, (match) => {
+            count += 1;
+            return `[REDACTED_SECRET:${fingerprint(match)}]`;
+        });
+    }
+    // Keep hook payloads bounded. Full transcripts already use Codie's existing
+    // capture path; the detector only needs immediate causal context here.
+    if (redacted.length > 16_384)
+        redacted = `${redacted.slice(0, 16_384)}[TRUNCATED]`;
+    return { value: redacted, count };
+}
+function redact(value, key = "", depth = 0) {
+    if (depth > 8)
+        return { value: "[TRUNCATED_DEPTH]", count: 0 };
+    if (SECRET_KEY.test(key) && value !== null && value !== undefined) {
+        const text = typeof value === "string" ? value : JSON.stringify(value);
+        return { value: `[REDACTED_SECRET:${fingerprint(text)}]`, count: 1 };
+    }
+    if (typeof value === "string")
+        return redactString(value);
+    if (Array.isArray(value)) {
+        let count = 0;
+        const next = value.slice(0, 200).map((item) => {
+            const result = redact(item, key, depth + 1);
+            count += result.count;
+            return result.value;
+        });
+        return { value: next, count };
+    }
+    if (value && typeof value === "object") {
+        let count = 0;
+        const next = {};
+        for (const [childKey, childValue] of Object.entries(value).slice(0, 200)) {
+            const result = redact(childValue, childKey, depth + 1);
+            count += result.count;
+            next[childKey] = result.value;
+        }
+        return { value: next, count };
+    }
+    return { value, count: 0 };
+}
+function buildSecurityWorkflowEvent(input, phase, source, now = Date.now) {
+    const sessionId = input.session_id ?? input.sessionId ?? "";
+    const toolName = input.tool_name ?? input.toolName ?? "";
+    if (!sessionId || !toolName)
+        return null;
+    const rawPayload = {
+        input: input.tool_input ?? input.toolInput,
+        ...(phase === "post" ? { response: input.tool_response ?? input.toolResponse } : {}),
+        ...(phase === "failure" ? { error: input.error ?? input.tool_response ?? input.toolResponse } : {}),
+    };
+    const sanitized = redact(rawPayload);
+    const duration = input.duration_ms ?? input.durationMs;
+    return {
+        schemaVersion: 1,
+        source,
+        phase,
+        sessionId,
+        toolName,
+        toolUseId: input.tool_use_id ?? input.toolUseId,
+        cwd: input.cwd,
+        observedAt: now(),
+        toolDurationMs: typeof duration === "number" && Number.isFinite(duration) ? duration : undefined,
+        payload: sanitized.value,
+        redactionCount: sanitized.count,
+    };
+}

package/dist/upgradeNudge.d.ts

@@ -5,3 +5,20 @@
  * this feature existed.
  */
 export declare function maybePrintUpgradeNudge(): Promise<void>;
+export interface OfferOpts {
+    env?: NodeJS.ProcessEnv;
+    argv?: string[];
+    nowMs?: number;
+    fetchImpl?: typeof fetch;
+    log?: (line: string) => void;
+    isTty?: boolean;
+}
+/**
+ * Prompt-capable sibling of maybePrintUpgradeNudge. Call this before handing
+ * the terminal to a TUI. A successful upgrade relaunches the fresh CLI and
+ * tells the stale caller to stop rather than continuing with old modules.
+ */
+export declare function maybeOfferUpgrade(opts?: OfferOpts): Promise<{
+    relaunched: boolean;
+    status?: number;
+}>;

package/dist/upgradeNudge.js

@@ -43,8 +43,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.maybePrintUpgradeNudge = maybePrintUpgradeNudge;
+exports.maybeOfferUpgrade = maybeOfferUpgrade;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const version_1 = require("./version");
 const versionCheck_1 = require("./versionCheck");
 const configDir_1 = require("./configDir");
@@ -122,3 +124,190 @@ async function maybePrintUpgradeNudge() {
         console.log("");
     }
 }
+const OFFER_CACHE_NAME = ".update-offer-cache.json";
+// This runs before the harness paints, so the timeout is startup latency the
+// user feels. A missed check costs nothing; the next stale-cache launch tries
+// again.
+const OFFER_FETCH_TIMEOUT_MS = 1500;
+const UPGRADE_TIMEOUT_MS = 120_000;
+function offerCachePath(env) {
+    const base = env.CODIEDEV_CONFIG_DIR?.trim()
+        ? path.resolve(env.CODIEDEV_CONFIG_DIR.trim())
+        : (0, configDir_1.codiedevStateDir)();
+    return path.join(base, OFFER_CACHE_NAME);
+}
+function readOfferCache(env) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(offerCachePath(env), "utf8"));
+        if (typeof parsed.fetchedAt !== "number")
+            return null;
+        return {
+            latest: typeof parsed.latest === "string" ? parsed.latest : null,
+            fetchedAt: parsed.fetchedAt,
+            promptedAt: typeof parsed.promptedAt === "number" ? parsed.promptedAt : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// If this cannot be persisted, the whole feature stays off. Without memory,
+// every launch would refetch and re-nag on ephemeral or read-only filesystems.
+function writeOfferCache(entry, env) {
+    try {
+        const target = offerCachePath(env);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, JSON.stringify(entry), "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isCiEnvironment(env) {
+    return Boolean(env.CI || env.CONTINUOUS_INTEGRATION || env.GITHUB_ACTIONS || env.BUILD_NUMBER);
+}
+async function fetchLatest(fetchImpl) {
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), OFFER_FETCH_TIMEOUT_MS);
+        try {
+            const res = await fetchImpl(REGISTRY_URL, {
+                headers: { Accept: "application/json" },
+                signal: controller.signal,
+            });
+            if (!res.ok)
+                return null;
+            const json = (await res.json());
+            return typeof json.version === "string" ? json.version : null;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+// Single-keypress y/n prompt. EOF, Ctrl-C, lost raw mode, and tty errors all
+// default to no so update handling can never strand the launcher.
+function promptYesNo(question) {
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        process.stdout.write(question);
+        const wasRaw = stdin.isRaw;
+        try {
+            stdin.setRawMode(true);
+        }
+        catch {
+            process.stdout.write("\n");
+            resolve(false);
+            return;
+        }
+        stdin.resume();
+        let settled = false;
+        const settle = (yes) => {
+            if (settled)
+                return;
+            settled = true;
+            stdin.removeListener("data", onData);
+            stdin.removeListener("end", onGone);
+            stdin.removeListener("error", onGone);
+            try {
+                stdin.setRawMode(Boolean(wasRaw));
+            }
+            catch {
+                // Best-effort; the engine resets the tty when it starts.
+            }
+            stdin.pause();
+            process.stdout.write(`${yes ? "y" : "n"}\n`);
+            resolve(yes);
+        };
+        const onData = (chunk) => settle(String(chunk).trim().toLowerCase() === "y");
+        const onGone = () => settle(false);
+        stdin.once("data", onData);
+        stdin.once("end", onGone);
+        stdin.once("error", onGone);
+    });
+}
+function runUpgrade() {
+    const result = (0, child_process_1.spawnSync)("npm", ["i", "-g", "codiedev@latest"], {
+        stdio: "inherit",
+        timeout: UPGRADE_TIMEOUT_MS,
+        shell: process.platform === "win32",
+    });
+    return !result.error && result.status === 0;
+}
+/**
+ * Prompt-capable sibling of maybePrintUpgradeNudge. Call this before handing
+ * the terminal to a TUI. A successful upgrade relaunches the fresh CLI and
+ * tells the stale caller to stop rather than continuing with old modules.
+ */
+async function maybeOfferUpgrade(opts = {}) {
+    const env = opts.env ?? process.env;
+    const argv = opts.argv ?? process.argv;
+    const nowMs = opts.nowMs ?? Date.now();
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.error(line));
+    if (env.CODIEDEV_NO_UPDATE_CHECK)
+        return { relaunched: false };
+    const cache = readOfferCache(env);
+    let latest = cache?.latest ?? null;
+    let fetchedAt = cache?.fetchedAt ?? 0;
+    const promptedAt = cache?.promptedAt ?? 0;
+    if (!cache || nowMs - cache.fetchedAt > CACHE_TTL_MS) {
+        // Probe writability before paying the network cost.
+        if (!writeOfferCache(cache ?? { latest: null, fetchedAt: 0, promptedAt: 0 }, env)) {
+            return { relaunched: false };
+        }
+        latest = await fetchLatest(fetchImpl);
+        fetchedAt = nowMs;
+        if (!writeOfferCache({ latest, fetchedAt, promptedAt }, env)) {
+            return { relaunched: false };
+        }
+    }
+    const installKind = (0, versionCheck_1.resolveInstallKind)({
+        dirname: __dirname,
+        env,
+        existsSync: fs.existsSync,
+        readFileSync: fs.readFileSync,
+        accessSync: fs.accessSync,
+    });
+    const { action, command } = (0, versionCheck_1.decideUpdateAction)({
+        current: version_1.CLI_VERSION,
+        latest,
+        installKind,
+        isTty: opts.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        isCi: isCiEnvironment(env),
+        promptedAt,
+        nowMs,
+    });
+    if (action === "none")
+        return { relaunched: false };
+    log("");
+    log(`\x1b[33mcodiedev ${latest} is available\x1b[0m (you're on ${version_1.CLI_VERSION})`);
+    if (action === "notify") {
+        log(`  Upgrade: \x1b[36m${command}\x1b[0m`);
+        log("");
+        return { relaunched: false };
+    }
+    writeOfferCache({ latest, fetchedAt, promptedAt: nowMs }, env);
+    if (!(await promptYesNo("  Update now? [y/N] "))) {
+        log(`  Skipping. Upgrade later with \x1b[36m${command}\x1b[0m`);
+        log("");
+        return { relaunched: false };
+    }
+    if (!runUpgrade()) {
+        log(`\x1b[33mcodiedev: upgrade failed — continuing on ${version_1.CLI_VERSION}\x1b[0m`);
+        log(`  Try it by hand: \x1b[36m${command}\x1b[0m`);
+        log("");
+        return { relaunched: false };
+    }
+    const relaunch = (0, child_process_1.spawnSync)(process.execPath, [argv[1], ...argv.slice(2)], {
+        stdio: "inherit",
+        env: { ...env, CODIEDEV_NO_UPDATE_CHECK: "1" },
+    });
+    if (relaunch.error)
+        return { relaunched: false };
+    return { relaunched: true, status: relaunch.status === null ? 1 : relaunch.status };
+}

package/dist/versionCheck.d.ts

@@ -26,3 +26,43 @@ export interface UpdateWarningInput {
  * as-given and answers a single question — should the user see a nag?
  */
 export declare function shouldShowUpdateWarning(input: UpdateWarningInput): boolean;
+export type InstallKind = "npx" | "container" | "global" | "readonly";
+export interface InstallKindDeps {
+    dirname: string;
+    env: NodeJS.ProcessEnv;
+    existsSync: (p: string) => boolean;
+    readFileSync: (p: string, enc: string) => string;
+    accessSync: (p: string, mode?: number) => void;
+}
+/**
+ * npx       — running from npm's _npx cache; nothing to upgrade in place.
+ * container — baked into an image; the honest fix is rebuilding it.
+ * global    — a real install directory we can write to. Upgradable.
+ * readonly  — a real install directory we cannot write to (root-owned global
+ *             on a shared box, read-only mount). Needs sudo, so print rather
+ *             than attempt an upgrade that would EACCES.
+ */
+export declare function resolveInstallKind(deps: InstallKindDeps): InstallKind;
+export declare function upgradeCommand(kind: InstallKind, pkg?: string): string;
+export type UpdateAction = "none" | "notify" | "prompt";
+export interface UpdateActionInput {
+    current: string;
+    latest: string | null;
+    installKind: InstallKind;
+    isTty: boolean;
+    isCi: boolean;
+    promptedAt?: number;
+    nowMs: number;
+    cacheTtlMs?: number;
+    pkg?: string;
+}
+/**
+ * `promptedAt` makes a decline stick until the next window instead of asking
+ * on every launch. It is deliberately not keyed to a dismissed version:
+ * somebody who says no today should be asked again tomorrow, not silently
+ * stranded on that version forever.
+ */
+export declare function decideUpdateAction(input: UpdateActionInput): {
+    action: UpdateAction;
+    command: string;
+};

package/dist/versionCheck.js

@@ -7,6 +7,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseSemver = parseSemver;
 exports.compareSemver = compareSemver;
 exports.shouldShowUpdateWarning = shouldShowUpdateWarning;
+exports.resolveInstallKind = resolveInstallKind;
+exports.upgradeCommand = upgradeCommand;
+exports.decideUpdateAction = decideUpdateAction;
 function parseSemver(input) {
     if (!input)
         return null;
@@ -47,3 +50,68 @@ function shouldShowUpdateWarning(input) {
         return false;
     return compareSemver(input.current, input.latest) === -1;
 }
+/**
+ * npx       — running from npm's _npx cache; nothing to upgrade in place.
+ * container — baked into an image; the honest fix is rebuilding it.
+ * global    — a real install directory we can write to. Upgradable.
+ * readonly  — a real install directory we cannot write to (root-owned global
+ *             on a shared box, read-only mount). Needs sudo, so print rather
+ *             than attempt an upgrade that would EACCES.
+ */
+function resolveInstallKind(deps) {
+    if (/[\\/](?:_npx|\.npm[\\/]_npx)[\\/]/.test(deps.dirname))
+        return "npx";
+    if (deps.env.KUBERNETES_SERVICE_HOST)
+        return "container";
+    if (deps.existsSync("/.dockerenv"))
+        return "container";
+    try {
+        if (/docker|containerd|kubepods|lxc/.test(deps.readFileSync("/proc/1/cgroup", "utf8"))) {
+            return "container";
+        }
+    }
+    catch {
+        // not Linux, or no procfs — fall through to the writability probe
+    }
+    try {
+        // 2 = fs.constants.W_OK, inlined so this module stays fs-free.
+        deps.accessSync(deps.dirname, 2);
+        return "global";
+    }
+    catch {
+        return "readonly";
+    }
+}
+function upgradeCommand(kind, pkg = "codiedev") {
+    switch (kind) {
+        case "npx":
+            return `npx --package ${pkg}@latest codie`;
+        case "container":
+            return `rebuild your image (npm i -g ${pkg}@latest)`;
+        case "readonly":
+            return `sudo npm i -g ${pkg}@latest`;
+        default:
+            return `npm i -g ${pkg}@latest`;
+    }
+}
+/**
+ * `promptedAt` makes a decline stick until the next window instead of asking
+ * on every launch. It is deliberately not keyed to a dismissed version:
+ * somebody who says no today should be asked again tomorrow, not silently
+ * stranded on that version forever.
+ */
+function decideUpdateAction(input) {
+    const command = upgradeCommand(input.installKind, input.pkg);
+    const ttl = input.cacheTtlMs ?? 24 * 60 * 60 * 1000;
+    if (!input.latest || compareSemver(input.current, input.latest) !== -1) {
+        return { action: "none", command };
+    }
+    if (input.isCi || !input.isTty)
+        return { action: "none", command };
+    const promptedAt = input.promptedAt ?? 0;
+    const askedRecently = promptedAt > 0 && input.nowMs - promptedAt <= ttl;
+    if (input.installKind === "global" && !askedRecently) {
+        return { action: "prompt", command };
+    }
+    return { action: "notify", command };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.33",
+  "version": "0.9.34",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",