codiedev 0.9.34 → 0.9.36

package/dist/captureLog.d.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 export declare const CAPTURE_LOG_MAX_BYTES: number;
 export declare const CAPTURE_LOG_PATH: string;
 export interface CaptureLogEntry {
-    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr";
+    stage: "capture-finish" | "upload" | "upload-deferred" | "security" | "stderr";
     sessionId: string | undefined;
     outcome: string;
     detail?: string;

package/dist/cli.js

@@ -34,6 +34,7 @@ const share_1 = require("./commands/share");
 const send_1 = require("./commands/send");
 const react_1 = require("./commands/react");
 const capture_1 = require("./commands/capture");
+const security_1 = require("./commands/security");
 const version_1 = require("./version");
 const HELP = `
 Codiedev CLI
@@ -44,7 +45,13 @@ Codiedev CLI
 
 Connect:
   codiedev connect                       Link Claude Code / Codex to your org
-  codiedev doctor                        Verify your setup after connecting
+  codiedev doctor                        Verify setup, capture, and Agent Security
+  codiedev security pilot                Run safe synthetic policy checks
+  codiedev security inventory            Inventory MCPs, skills, hooks, plugins,
+                                         instructions, and editor extensions
+  codiedev security scan --deep          Run installed open-source scanners too
+  codiedev security sync                 Fetch administrator policy locally
+  codiedev security rollback --yes       Restore pre-update hook configuration
 
 Harness:
   codie                                  Launch the governed Codie harness.
@@ -453,6 +460,9 @@ async function main() {
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);
                 return;
+            case "security":
+                await (0, security_1.runSecurityCommand)(rest);
+                return;
             case "push":
                 await (0, push_1.runPush)(rest);
                 return;

package/dist/codie.js

@@ -231,7 +231,8 @@ async function main() {
         CODIEDEV_HEAD_SHA: git(["rev-parse", "HEAD"]),
         OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
     };
-    const result = (0, child_process_1.spawnSync)(runtime, parsed.args, { stdio: "inherit", env });
+    const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
+    const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, { stdio: "inherit", env });
     if (result.error)
         throw result.error;
     process.exitCode = result.status === null ? 1 : result.status;

package/dist/codieLauncher.d.ts

@@ -2,6 +2,13 @@ export interface CatalogModel {
     id: string;
     name?: string;
 }
+/**
+ * Pin non-interactive runs to the directory where `codie` was launched.
+ * OpenCode can reuse a previously-known project instance; without an explicit
+ * --dir, a real smoke run launched in a throwaway repo resumed the caller's
+ * main checkout and executed there. TUI mode already owns its cwd directly.
+ */
+export declare function withCodieWorkingDirectory(args: string[], cwd: string): string[];
 export declare function bareModel(value: unknown): string;
 export declare function buildCodieConfig({ existing, catalog, env, plugin, plugins, }: {
     existing?: Record<string, any>;

package/dist/codieLauncher.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = void 0;
+exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
 exports.bareModel = bareModel;
 exports.buildCodieConfig = buildCodieConfig;
 exports.withBrandPlugin = withBrandPlugin;
@@ -61,6 +62,19 @@ const DEFAULT_NAMES = {
     "z-ai/glm-5.2": "GLM 5.2 · Fireworks ZDR",
     "moonshotai/kimi-k2.7-code": "Kimi K2.7 Code · Fireworks ZDR",
 };
+/**
+ * Pin non-interactive runs to the directory where `codie` was launched.
+ * OpenCode can reuse a previously-known project instance; without an explicit
+ * --dir, a real smoke run launched in a throwaway repo resumed the caller's
+ * main checkout and executed there. TUI mode already owns its cwd directly.
+ */
+function withCodieWorkingDirectory(args, cwd) {
+    if (args[0] !== "run")
+        return args;
+    if (args.some((arg) => arg === "--dir" || arg.startsWith("--dir=")))
+        return args;
+    return [...args, "--dir", cwd];
+}
 function cleanBaseUrl(value) {
     return String(value || "https://gateway.codiedev.com/api/v1").replace(/\/+$/, "");
 }

package/dist/commands/doctor.js

@@ -45,6 +45,7 @@ const version_1 = require("../version");
 const upgradeNudge_1 = require("../upgradeNudge");
 const captureReadiness_1 = require("../captureReadiness");
 const captureLog_1 = require("../captureLog");
+const securityDoctor_1 = require("../securityDoctor");
 const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
 const CLAUDE_INSTRUCTIONS_PATH = path.join(os.homedir(), ".claude", "CLAUDE.md");
 const CODEX_HOOKS_PATH = path.join(os.homedir(), ".codex", "hooks.json");
@@ -482,6 +483,10 @@ async function runDoctor(_args) {
             detail: "not installed on this machine",
         });
     }
+    // Agent Security is part of installation health, not a separate setup
+    // concept. Keep `codiedev security doctor` as an alias for focused output,
+    // while the main doctor remains the one command users need to remember.
+    checks.push(...(0, securityDoctor_1.securityDoctorChecks)((0, securityDoctor_1.collectSecurityDoctorReport)()));
     // 8. gh / glab CLIs (optional — only needed for reverse-ticket from a
     // specific PR/MR URL; branch mode works without either).
     checks.push({

package/dist/commands/security.d.ts

@@ -0,0 +1 @@
+export declare function runSecurityCommand(args: string[]): Promise<void>;

package/dist/commands/security.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecurityCommand = runSecurityCommand;
+const securityInstall_1 = require("../securityInstall");
+const securityPilot_1 = require("../securityPilot");
+const securityPolicy_1 = require("../securityPolicy");
+const securityInventory_1 = require("../securityInventory");
+const securityDeepScan_1 = require("../securityDeepScan");
+const utils_1 = require("../utils");
+const securityDoctor_1 = require("../securityDoctor");
+function printPilot(json) {
+    const report = (0, securityPilot_1.runSyntheticSecurityPilot)();
+    if (json) {
+        console.log(JSON.stringify(report, null, 2));
+        return report.ok;
+    }
+    console.log("\nCodiedev security pilot — synthetic, side-effect-free validation\n");
+    for (const item of report.cases) {
+        console.log(`${item.passed ? "✓" : "✗"} ${item.surface}: ${item.name} (${item.actual})`);
+    }
+    console.log(`\n${report.ok ? "PASS" : "FAIL"}: ${report.cases.filter((item) => item.passed).length}/${report.cases.length} policy checks matched.`);
+    console.log("No commands were executed and no real credentials were used.\n");
+    return report.ok;
+}
+function printDoctor(json) {
+    const result = (0, securityDoctor_1.collectSecurityDoctorReport)();
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return result.ok;
+    }
+    console.log("\nCodiedev doctor — Agent Security details\n");
+    for (const check of (0, securityDoctor_1.securityDoctorChecks)(result)) {
+        const mark = check.status === "pass" ? "✓" : check.status === "warn" ? "!" : "✗";
+        console.log(`${mark} ${check.name}: ${check.detail}`);
+    }
+    console.log(`\n${result.ok ? "PASS" : "FAIL"}: ${result.ok ? "endpoint security is healthy" : "run `codiedev connect`, then repeat this check"}.\n`);
+    return result.ok;
+}
+async function runSecurityCommand(args) {
+    const subcommand = args.find((arg) => !arg.startsWith("-")) ?? "doctor";
+    const json = args.includes("--json");
+    if (subcommand === "inventory" || subcommand === "scan") {
+        const workspaceFlag = args.indexOf("--workspace");
+        const workspace = workspaceFlag >= 0 && args[workspaceFlag + 1]
+            ? args[workspaceFlag + 1]
+            : process.cwd();
+        const inventory = (0, securityInventory_1.buildSecurityInventory)({ workspace });
+        const deep = subcommand === "scan" && args.includes("--deep")
+            ? (0, securityDeepScan_1.runDeepSecurityScan)(inventory, {
+                workspace,
+                connectMcp: args.includes("--connect-mcp"),
+                supplyChain: args.includes("--supply-chain"),
+            })
+            : undefined;
+        const uploadableInventory = deep ? (0, securityDeepScan_1.mergeDeepScanFindings)(inventory, deep) : inventory;
+        let upload;
+        const config = (0, utils_1.readConfig)();
+        if (config && !args.includes("--no-upload")) {
+            try {
+                upload = await (0, securityInventory_1.uploadSecurityInventory)(uploadableInventory, config);
+            }
+            catch (error) {
+                if (!json)
+                    console.warn(`Inventory upload failed; local scan is still valid: ${error.message}`);
+            }
+        }
+        const output = { inventory: uploadableInventory, scanners: (0, securityInventory_1.scannerAvailability)(), ...(deep ? { deep } : {}), ...(upload ? { upload } : {}) };
+        if (json)
+            console.log(JSON.stringify(output, null, 2));
+        else {
+            const risky = inventory.components.filter((component) => component.findings.length > 0).length;
+            console.log(`\nCodiedev security inventory — ${inventory.components.length} components, ${risky} with local findings, ${inventory.drift.length} changed\n`);
+            const counts = new Map();
+            for (const component of inventory.components)
+                counts.set(component.kind, (counts.get(component.kind) ?? 0) + 1);
+            for (const [kind, count] of [...counts].sort())
+                console.log(`  ${kind}: ${count}`);
+            if (deep)
+                for (const run of deep.runs)
+                    console.log(`  ${run.scanner}: ${run.status} — ${run.detail}`);
+            if (upload)
+                console.log(`\nUploaded ${upload.accepted} component records to the security workspace.`);
+            console.log("\nUse --json for machine-readable hashes and findings. Use scan --deep for installed OSS scanners; --connect-mcp and --supply-chain are explicit because they start or download third-party code.\n");
+        }
+        return;
+    }
+    if (subcommand === "sync") {
+        const config = (0, utils_1.readConfig)();
+        if (!config) {
+            console.error("Not connected. Run `codiedev connect` first.");
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const policy = await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
+            if (json)
+                console.log(JSON.stringify({ ok: true, policy }, null, 2));
+            else {
+                const verification = (0, securityPolicy_1.verifyEndpointSecurityPolicySignature)(policy);
+                console.log(`Security policy v${policy.policyVersion} synced (${policy.enforcementMode} mode; ${verification.detail}).`);
+            }
+        }
+        catch (error) {
+            console.error(`Security policy sync failed: ${error.message}`);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    if (subcommand === "rollback") {
+        if (!args.includes("--yes")) {
+            console.error("Rollback overwrites the installed agent hook configurations. Re-run with `codiedev security rollback --yes` after confirming the snapshot shown by `codiedev doctor`.");
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const result = (0, securityInstall_1.restoreSecurityInstallSnapshot)((0, securityInstall_1.readSecurityInstallManifest)());
+            if (json)
+                console.log(JSON.stringify({ schemaVersion: 1, ok: true, ...result }, null, 2));
+            else
+                console.log(`Restored ${result.restored} hook configuration(s) from snapshot ${result.snapshotId}.`);
+        }
+        catch (error) {
+            console.error(`Rollback failed: ${error.message}`);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    const ok = subcommand === "pilot" || subcommand === "self-test"
+        ? printPilot(json)
+        : subcommand === "doctor" || subcommand === "status"
+            ? printDoctor(json)
+            : false;
+    if (!["pilot", "self-test", "doctor", "status"].includes(subcommand)) {
+        console.error("Usage: codiedev security <doctor|pilot|inventory|scan|sync|rollback> [--json] [--deep] [--connect-mcp] [--supply-chain] [--no-upload] [--yes]");
+    }
+    if (!ok)
+        process.exitCode = 1;
+}

package/dist/connect.js

@@ -39,11 +39,15 @@ const https = __importStar(require("https"));
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const utils_1 = require("./utils");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
 const shared_1 = require("./commands/shared");
+const securityInstall_1 = require("./securityInstall");
+const securityPolicy_1 = require("./securityPolicy");
 // cli.codiedev.com is a Convex custom domain on the prod deployment; the
 // underlying judicious-falcon-861.convex.site URL keeps serving, so configs
 // written by older CLI versions stay valid without a re-connect.
@@ -280,6 +284,15 @@ async function runConnect(args = []) {
     // /api/cli/markInstalled so the portal's "Connected" state reflects
     // what's actually wired up on this machine, not just "token validated."
     const installedTargets = [];
+    const home = os.homedir();
+    const securityConfigPaths = [
+        path.join(home, ".claude", "settings.json"),
+        path.join(home, ".codex", "hooks.json"),
+        path.join(home, ".config", "opencode", "plugins", "codiedev.js"),
+    ];
+    // Snapshot before any hook update. Rollback is intentionally not automatic:
+    // an administrator can inspect these 0600 copies before restoring them.
+    const securitySnapshot = (0, securityInstall_1.createSecurityInstallSnapshot)(securityConfigPaths);
     // Wrap each per-target write so we emit one install_target row each. The
     // existing user-visible behavior (console.warn on failure, continue) is
     // unchanged — telemetry just observes the outcome.
@@ -317,6 +330,33 @@ async function runConnect(args = []) {
     // a user connect Claude Code today and install the Codie harness tomorrow
     // without needing a second setup ritual.
     runInstall("opencode-capture-adapter", utils_1.installOpenCodeCapturePlugin, "OpenCode session capture adapter (~/.config/opencode/plugins/codiedev.js)", "opencode-capture");
+    // Record the exact installed hook bytes and the pre-update rollback files.
+    // This supplies health/integrity checks without requiring a package publish
+    // or trusting whichever `node` happens to be first on PATH later.
+    try {
+        const hookScriptPath = path.join(__dirname, "hook.js");
+        if (fs.existsSync(hookScriptPath)) {
+            const targets = [];
+            if (installedTargets.includes("claudeCode-hook"))
+                targets.push({ surface: "claude-code", configPath: securityConfigPaths[0] });
+            if (installedTargets.includes("codex-hook"))
+                targets.push({ surface: "codex", configPath: securityConfigPaths[1] });
+            if (installedTargets.includes("opencode-capture"))
+                targets.push({ surface: "codie-harness", configPath: securityConfigPaths[2] });
+            (0, securityInstall_1.writeSecurityInstallManifest)({ hookScriptPath, snapshot: securitySnapshot, targets });
+        }
+    }
+    catch (err) {
+        console.warn(`Warning: Security hooks installed, but integrity manifest could not be written — ${err.message}`);
+    }
+    // Prime the local cache after installation. Hooks read this file only, so
+    // an endpoint decision never depends on live network latency.
+    try {
+        await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
+    }
+    catch (err) {
+        console.warn(`Warning: Agent-security policy will use safe defaults until sync succeeds — ${err.message}`);
+    }
     // Tell the backend which targets we wired up so the portal's onboarding
     // card flips to "Connected" only when something actually installed —
     // not on bare token validation. Best-effort: a network failure here
@@ -355,5 +395,6 @@ async function runConnect(args = []) {
     }
     console.log();
     console.log("Run `codiedev doctor` to verify everything's wired up.");
+    console.log("Run `codiedev security pilot` to validate blocking safely.");
     console.log();
 }

package/dist/hook.js

@@ -45,6 +45,10 @@ const utils_1 = require("./utils");
 const limitEvent_1 = require("./limitEvent");
 const version_1 = require("./version");
 const captureLog_1 = require("./captureLog");
+const security_1 = require("./security");
+const securitySession_1 = require("./securitySession");
+const securityPolicy_1 = require("./securityPolicy");
+const securityInventory_1 = require("./securityInventory");
 const captureExclusions_1 = require("./captureExclusions");
 // Pure builder for the discovery additionalContext. Returns null when there are
 // no matches. The suggested `codiedev pull` command carries the EXACT top key
@@ -218,7 +222,7 @@ timeoutMs) {
 // postJson variant that returns the parsed response body — the upload-URL
 // handshake needs the { uploadUrl } the server hands back. No timeout: runs
 // only in detached uploader children, never on the shutdown clock.
-function postJsonForResponse(url, body, bearerToken) {
+function postJsonForResponse(url, body, bearerToken, timeoutMs) {
     return new Promise((resolve, reject) => {
         const parsed = new URL(url);
         const data = JSON.stringify(body);
@@ -252,10 +256,114 @@ function postJsonForResponse(url, body, bearerToken) {
             });
         });
         req.on("error", reject);
+        if (timeoutMs) {
+            req.setTimeout(timeoutMs, () => {
+                req.destroy(new Error(`timeout after ${timeoutMs}ms`));
+            });
+        }
         req.write(data);
         req.end();
     });
 }
+// Local policy runs synchronously before a tool executes. Workflow telemetry
+// is dispatched separately and fail-open, so a detector outage or timeout can
+// never delay or override the deterministic endpoint decision.
+async function runSecurityHook(hookInput, phase, source) {
+    const sessionId = hookInput.session_id ?? hookInput.sessionId;
+    const sessionSignal = phase === "pre" ? (0, securitySession_1.readSessionSecuritySignal)(sessionId) : undefined;
+    const localDecision = (0, security_1.evaluateToolSecurity)(hookInput, phase, (0, securityPolicy_1.readEndpointSecurityPolicy)(), source, sessionSignal);
+    if (phase === "post" && (0, security_1.securityInputHasSensitivePath)(hookInput)) {
+        (0, securitySession_1.recordSensitiveReadSignal)(sessionId);
+    }
+    const event = (0, security_1.buildSecurityWorkflowEvent)(hookInput, phase, source);
+    if (event) {
+        event.localDecision = localDecision.action;
+        event.localCategory = localDecision.category;
+    }
+    if (localDecision.action === "block" && phase === "pre") {
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "security",
+            sessionId: hookInput.session_id ?? hookInput.sessionId ?? "unknown",
+            outcome: "ok",
+            detail: `phase=${phase} localDecision=block category=${localDecision.category}`,
+        });
+        dispatchSecurityEventUpload(event);
+        process.stdout.write(JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: localDecision.reason,
+            },
+        }));
+        return;
+    }
+    if (!event)
+        return;
+    dispatchSecurityEventUpload(event);
+}
+function runPromptSecurityHook(hookInput, source) {
+    const decision = (0, security_1.evaluatePromptSecurity)(hookInput.prompt, (0, securityPolicy_1.readEndpointSecurityPolicy)(), source);
+    if (decision.action !== "block")
+        return false;
+    dispatchSecurityEventUpload((0, security_1.buildBlockedSecurityPromptEvent)(hookInput, source, decision.category ?? "secret_in_prompt"));
+    process.stdout.write(JSON.stringify({
+        decision: "block",
+        reason: decision.reason,
+    }));
+    return true;
+}
+function dispatchAllowedPromptSecurityEvent(hookInput, source) {
+    const event = (0, security_1.buildSecurityPromptEvent)(hookInput, source, Date.now, (0, securityPolicy_1.readEndpointSecurityPolicy)());
+    if (event)
+        dispatchSecurityEventUpload(event);
+}
+function dispatchSecurityEventUpload(event) {
+    if (!event || !(0, utils_1.readConfig)())
+        return;
+    try {
+        const child = (0, child_process_1.spawn)(process.execPath, [process.argv[1], "security-upload"], {
+            detached: true,
+            stdio: ["pipe", "ignore", "ignore"],
+        });
+        child.stdin?.end(JSON.stringify(event));
+        child.unref();
+    }
+    catch {
+        // Telemetry is best-effort and must never delay local enforcement.
+    }
+}
+async function runSecurityEventUpload() {
+    const config = (0, utils_1.readConfig)();
+    if (!config)
+        return;
+    const startedAt = Date.now();
+    try {
+        const raw = await readStdin();
+        const event = JSON.parse(raw);
+        const eventWithEndpoint = (0, security_1.withEndpointIdentity)(event, {
+            endpointId: config.deviceId,
+            endpointName: config.deviceName,
+            cliVersion: version_1.CLI_VERSION,
+        });
+        const result = await postJsonForResponse(`${config.backendUrl}/api/cli/securityEvent`, { ...eventWithEndpoint }, config.token, 1500);
+        if (result?.policy?.schemaVersion === 1)
+            (0, securityPolicy_1.writeEndpointSecurityPolicy)(result.policy);
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "security",
+            sessionId: event.sessionId,
+            outcome: "ok",
+            detail: `phase=${event.phase} elapsedMs=${Date.now() - startedAt} verdict=${String(result?.verdict ?? "unknown")}`,
+        });
+    }
+    catch (err) {
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "security",
+            sessionId: "upload",
+            outcome: "ERROR",
+            detail: `elapsedMs=${Date.now() - startedAt} ${err.message}`,
+        });
+    }
+}
 // Raw-bytes POST to a Convex storage upload URL (no auth header — the URL
 // itself is the one-time credential). Returns the parsed { storageId }.
 function postBytes(url, bytes, contentType) {
@@ -379,6 +487,20 @@ async function main() {
         }
         process.exit(0);
     }
+    // Daily component drift scan runs in a detached hook process. The parent
+    // SessionStart path only performs a timestamp read, so agent startup never
+    // waits for filesystem traversal or an inventory upload.
+    if (process.argv[2] === "security-inventory-upload") {
+        const config = (0, utils_1.readConfig)();
+        if (config) {
+            const inventory = (0, securityInventory_1.buildSecurityInventory)({ workspace: process.argv[3] || process.cwd() });
+            try {
+                await (0, securityInventory_1.uploadSecurityInventory)(inventory, config);
+            }
+            catch { /* retry after the daily inventory window */ }
+        }
+        process.exit(0);
+    }
     // Detached backup uploader child (spawned by runBackup below). The job file
     // carries only { root, files }; the child re-reads config from disk. No stdin
     // needed, so handle it before readStdin() like the capture uploader above.
@@ -415,6 +537,13 @@ async function main() {
         }
         process.exit(0);
     }
+    // Detached, best-effort security telemetry. Local policy decisions have
+    // already completed in the parent hook; this child can never delay or alter
+    // the developer's action.
+    if (process.argv[2] === "security-upload") {
+        await runSecurityEventUpload();
+        process.exit(0);
+    }
     let hookInput = {};
     try {
         const raw = await readStdin();
@@ -432,8 +561,32 @@ async function main() {
     if ((0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput)) {
         process.exit(0);
     }
+    const securityCommand = process.argv[2] ?? "";
+    const securityMatch = securityCommand.match(/^security-(pre|post|failure)(?:-(codex|codie))?$/);
+    if (securityMatch) {
+        const source = securityMatch[2] === "codex"
+            ? "codex"
+            : securityMatch[2] === "codie"
+                ? "codie-harness"
+                : "claude-code";
+        await runSecurityHook(hookInput, securityMatch[1], source);
+        process.exit(0);
+    }
     // UserPromptSubmit discovery path — separate from session capture.
-    if (process.argv[2] === "discover") {
+    const promptCommand = process.argv[2] ?? "";
+    if (process.argv[2] === "discover" ||
+        process.argv[2] === "discover-codex" ||
+        process.argv[2] === "discover-codie") {
+        const source = promptCommand === "discover-codex"
+            ? "codex"
+            : promptCommand === "discover-codie"
+                ? "codie-harness"
+                : "claude-code";
+        // Security runs first and locally. A blocked prompt is erased before it
+        // reaches the model, so discovery must not send it to the backend.
+        if (runPromptSecurityHook(hookInput, source))
+            return;
+        dispatchAllowedPromptSecurityEvent(hookInput, source);
         await runDiscover(hookInput.prompt);
         return;
     }
@@ -444,6 +597,16 @@ async function main() {
     }
     // SessionStart: post the capture-coverage denominator ping. Tiny + fast.
     if (process.argv[2] === "session-start" || process.argv[2] === "session-start-opencode") {
+        if ((0, securityInventory_1.securityInventoryDue)()) {
+            try {
+                const child = (0, child_process_1.spawn)(process.execPath, [process.argv[1], "security-inventory-upload", hookInput.cwd || process.cwd()], {
+                    detached: true,
+                    stdio: "ignore",
+                });
+                child.unref();
+            }
+            catch { /* daily inventory is best-effort */ }
+        }
         await runSessionStart(hookInput, process.argv[2] === "session-start-opencode" ? "opencode" : "claude-code");
         return;
     }
@@ -661,6 +824,7 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
     // worktree's branch+sha so all the resulting PRs attribute. branch/headSha
     // remain the primary (most-recent) values for back-compat.
     const keys = (0, utils_1.collectCaptureKeys)(captureDirs);
+    const gitRefs = (0, utils_1.collectCaptureGitRefs)(captureDirs);
     // Union the worktree-dir branches with the branches the agent actually
     // committed/pushed to (parsed from the transcript's git output). Like the
     // SHAs below, these are independent of end-of-session filesystem state, so
@@ -678,6 +842,7 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
     const authoredShas = (0, utils_1.parseAuthoredShas)(transcriptContent, workspaceRoot);
     const headShas = [...new Set([...keys.headShas, ...authoredShas])];
     const headSha = keys.headSha ?? headShas[0] ?? null;
+    const pullRequestUrls = (0, utils_1.parsePullRequestUrls)(transcriptContent);
     // Cost/velocity/steering signals parsed straight from the transcript we're
     // already holding — no extra hooks, no extra git/process calls. parseUsage
     // keeps the literal mode (it has its own desktop parser) and reads the RAW
@@ -700,6 +865,8 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
         headSha,
         branches,
         headShas,
+        gitRefs,
+        pullRequestUrls,
         inputTokens: usage.inputTokens,
         outputTokens: usage.outputTokens,
         cacheTokens: usage.cacheTokens,

package/dist/security.d.ts

@@ -1,5 +1,5 @@
 export type SecurityHookPhase = "pre" | "post" | "failure";
-export type AgentSurface = "claude-code" | "codex";
+export type AgentSurface = "claude-code" | "codex" | "codie-harness";
 export interface RawSecurityHookInput {
     session_id?: string;
     sessionId?: string;
@@ -17,6 +17,7 @@ export interface RawSecurityHookInput {
     duration_ms?: number;
     durationMs?: number;
     error?: unknown;
+    prompt?: string;
 }
 export interface SecurityWorkflowEvent {
     schemaVersion: 1;
@@ -30,5 +31,67 @@ export interface SecurityWorkflowEvent {
     toolDurationMs?: number;
     payload: unknown;
     redactionCount: number;
+    localDecision?: LocalSecurityAction;
+    localCategory?: LocalSecurityDecision["category"];
+    endpointId?: string;
+    endpointName?: string;
+    cliVersion?: string;
 }
+export type LocalSecurityAction = "allow" | "alert" | "block";
+export type SecurityCategory = "secret_in_prompt" | "secret_exfiltration" | "destructive_outside_workspace" | "sensitive_file_read" | "sensitive_file_write" | "protected_agent_config_write" | "unapproved_network_egress" | "untrusted_mcp_tool" | "unapproved_command" | "obfuscated_shell_command" | "package_install" | "sensitive_read_then_egress";
+export interface EndpointSecurityPolicy {
+    schemaVersion: 1;
+    policyVersion: number;
+    enforcementMode: "alert" | "block";
+    rules: Partial<Record<SecurityCategory, LocalSecurityAction>>;
+    constraints?: {
+        allowedMcpServers?: string[];
+        allowedHosts?: string[];
+        allowedCommands?: string[];
+    };
+    exceptions: Array<{
+        scope: "company" | "user" | "source" | "repository" | "tool" | "category";
+        scopeValue: string;
+    }>;
+    fetchedAt: number;
+    signature?: {
+        algorithm: "Ed25519";
+        keyId: string;
+        signedAt: number;
+        value: string;
+    };
+}
+export interface LocalSecurityDecision {
+    action: LocalSecurityAction;
+    category?: SecurityCategory;
+    reason?: string;
+}
+export declare function withEndpointIdentity(event: SecurityWorkflowEvent, identity: {
+    endpointId?: string;
+    endpointName?: string;
+    cliVersion?: string;
+}): SecurityWorkflowEvent;
+/**
+ * Runs before a user prompt reaches the model. This is intentionally narrow:
+ * block credential material, but allow safe references such as
+ * `$OPENAI_API_KEY` so developers can ask agents to use environment variables
+ * without pasting their values.
+ */
+export declare function evaluatePromptSecurity(prompt: string | undefined, policy?: EndpointSecurityPolicy, source?: AgentSurface): LocalSecurityDecision;
+/** Runs synchronously before a tool executes. No network or model is involved. */
+export declare function evaluateToolSecurity(input: RawSecurityHookInput, phase: SecurityHookPhase, policy?: EndpointSecurityPolicy, source?: AgentSurface, sessionContext?: {
+    sensitiveReadAt?: number;
+    now?: number;
+}): LocalSecurityDecision;
+export declare function securityInputHasSensitivePath(input: RawSecurityHookInput): boolean;
 export declare function buildSecurityWorkflowEvent(input: RawSecurityHookInput, phase: SecurityHookPhase, source: AgentSurface, now?: () => number): SecurityWorkflowEvent | null;
+/**
+ * Captures the intent side of the causal chain without weakening the local
+ * privacy boundary. A prompt that the deterministic policy blocks never
+ * becomes an uploadable event; allowed prompts are redacted and bounded using
+ * the same sanitizer as tool payloads.
+ */
+export declare function buildSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd" | "prompt">, source: AgentSurface, now?: () => number, policy?: EndpointSecurityPolicy): SecurityWorkflowEvent | null;
+/** Audit-safe evidence for a blocked prompt. The secret-bearing prompt is
+ * intentionally omitted; administrators still see that prevention occurred. */
+export declare function buildBlockedSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd">, source: AgentSurface, category: NonNullable<LocalSecurityDecision["category"]>, now?: () => number): SecurityWorkflowEvent | null;