codiedev 0.9.34 → 0.9.36

package/dist/securityPolicy.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trustedPolicyKeysFromEnvironment = trustedPolicyKeysFromEnvironment;
+exports.verifyEndpointSecurityPolicySignature = verifyEndpointSecurityPolicySignature;
+exports.readEndpointSecurityPolicy = readEndpointSecurityPolicy;
+exports.inspectEndpointSecurityPolicy = inspectEndpointSecurityPolicy;
+exports.writeEndpointSecurityPolicy = writeEndpointSecurityPolicy;
+exports.syncEndpointSecurityPolicy = syncEndpointSecurityPolicy;
+const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const path = __importStar(require("path"));
+const configDir_1 = require("./configDir");
+const POLICY_FILE = "security-policy.json";
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+function trustedPolicyKeysFromEnvironment(env = process.env) {
+    const raw = env.CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS;
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return Object.fromEntries(Object.entries(parsed)
+            .filter((entry) => typeof entry[1] === "string"));
+    }
+    catch {
+        return {};
+    }
+}
+function verifyEndpointSecurityPolicySignature(policy, trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const configuredKeys = Object.keys(trustedKeys);
+    if (configuredKeys.length === 0) {
+        return { ok: true, trusted: false, detail: "no endpoint policy public keys are pinned" };
+    }
+    const envelope = policy.signature;
+    if (!envelope || envelope.algorithm !== "Ed25519") {
+        return { ok: false, trusted: false, detail: "policy signature is missing" };
+    }
+    const publicKey = trustedKeys[envelope.keyId];
+    if (!publicKey)
+        return { ok: false, trusted: false, detail: `policy signing key ${envelope.keyId} is not trusted` };
+    const unsigned = { ...policy };
+    delete unsigned.signature;
+    try {
+        const ok = crypto.verify(null, Buffer.from(`${envelope.signedAt}.${stableJson(unsigned)}`), crypto.createPublicKey(publicKey), Buffer.from(envelope.value, "base64"));
+        return ok
+            ? { ok: true, trusted: true, detail: `verified with ${envelope.keyId}` }
+            : { ok: false, trusted: false, detail: "policy signature does not match its content" };
+    }
+    catch (error) {
+        return { ok: false, trusted: false, detail: `policy signature could not be verified: ${error.message}` };
+    }
+}
+function readEndpointSecurityPolicy(stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const inspection = inspectEndpointSecurityPolicy(stateDir, trustedKeys);
+    return inspection.verification.ok ? inspection.policy : undefined;
+}
+function inspectEndpointSecurityPolicy(stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const target = path.join(stateDir, POLICY_FILE);
+    if (!fs.existsSync(target)) {
+        return { exists: false, verification: { ok: true, trusted: false, detail: "no cached endpoint policy" } };
+    }
+    try {
+        const value = JSON.parse(fs.readFileSync(target, "utf8"));
+        if (value?.schemaVersion !== 1 || !["alert", "block"].includes(value.enforcementMode)) {
+            return { exists: true, verification: { ok: false, trusted: false, detail: "cached endpoint policy has an invalid schema" } };
+        }
+        const policy = value;
+        return { exists: true, policy, verification: verifyEndpointSecurityPolicySignature(policy, trustedKeys) };
+    }
+    catch (error) {
+        return { exists: true, verification: { ok: false, trusted: false, detail: `cached endpoint policy could not be read: ${error.message}` } };
+    }
+}
+function writeEndpointSecurityPolicy(policy, stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
+    const verification = verifyEndpointSecurityPolicySignature(policy, trustedKeys);
+    if (!verification.ok)
+        throw new Error(`Refusing untrusted endpoint policy: ${verification.detail}`);
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const target = path.join(stateDir, POLICY_FILE);
+    const temporary = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(policy, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(temporary, 0o600);
+    fs.renameSync(temporary, target);
+}
+async function syncEndpointSecurityPolicy(config, source, timeoutMs = 3_000) {
+    const url = new URL("/api/cli/securityPolicy", config.backendUrl);
+    if (source)
+        url.searchParams.set("source", source);
+    const transport = url.protocol === "https:" ? https : http;
+    const policy = await new Promise((resolve, reject) => {
+        const request = transport.request(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${config.token}`, Accept: "application/json" },
+        }, (response) => {
+            let raw = "";
+            response.setEncoding("utf8");
+            response.on("data", (chunk) => { raw += chunk; });
+            response.on("end", () => {
+                if ((response.statusCode ?? 500) >= 300)
+                    return reject(new Error(`policy_http_${response.statusCode}`));
+                try {
+                    resolve(JSON.parse(raw));
+                }
+                catch {
+                    reject(new Error("invalid policy response"));
+                }
+            });
+        });
+        request.setTimeout(timeoutMs, () => request.destroy(new Error(`policy sync timeout after ${timeoutMs}ms`)));
+        request.on("error", reject);
+        request.end();
+    });
+    writeEndpointSecurityPolicy(policy);
+    return policy;
+}

package/dist/securitySession.d.ts

@@ -0,0 +1,6 @@
+interface SessionSignal {
+    sensitiveReadAt?: number;
+}
+export declare function readSessionSecuritySignal(sessionId: string | undefined, stateDir?: string, now?: number): SessionSignal | undefined;
+export declare function recordSensitiveReadSignal(sessionId: string | undefined, stateDir?: string, now?: number): void;
+export {};

package/dist/securitySession.js

@@ -0,0 +1,72 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSessionSecuritySignal = readSessionSecuritySignal;
+exports.recordSensitiveReadSignal = recordSensitiveReadSignal;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const configDir_1 = require("./configDir");
+const SIGNAL_FILE = "security-session-signals.json";
+const MAX_AGE_MS = 2 * 60 * 60 * 1_000;
+function readSignals(stateDir, now) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(stateDir, SIGNAL_FILE), "utf8"));
+        if (parsed.schemaVersion !== 1 || !parsed.sessions || typeof parsed.sessions !== "object")
+            throw new Error("invalid signals");
+        parsed.sessions = Object.fromEntries(Object.entries(parsed.sessions)
+            .filter(([, signal]) => signal.sensitiveReadAt && now - signal.sensitiveReadAt <= MAX_AGE_MS)
+            .slice(-250));
+        return parsed;
+    }
+    catch {
+        return { schemaVersion: 1, sessions: {} };
+    }
+}
+function readSessionSecuritySignal(sessionId, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!sessionId)
+        return undefined;
+    return readSignals(stateDir, now).sessions[sessionId];
+}
+function recordSensitiveReadSignal(sessionId, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!sessionId)
+        return;
+    const signals = readSignals(stateDir, now);
+    signals.sessions[sessionId] = { sensitiveReadAt: now };
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const target = path.join(stateDir, SIGNAL_FILE);
+    const temporary = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(signals)}\n`, { mode: 0o600 });
+    fs.renameSync(temporary, target);
+}

package/dist/utils.d.ts

@@ -45,6 +45,13 @@ export declare function collectCaptureKeys(dirs: string[], getBranch?: (d: strin
     branches: string[];
     headShas: string[];
 };
+export type CaptureGitRef = {
+    repoUrl: string;
+    branch?: string;
+    headSha?: string;
+};
+export declare function collectCaptureGitRefs(dirs: string[], getRemote?: (d: string) => string | null, getBranch?: (d: string) => string | null, getSha?: (d: string) => string | null): CaptureGitRef[];
+export declare function parsePullRequestUrls(transcriptContent: string): string[];
 export declare function extractShaTokens(transcriptContent: string): string[];
 export declare function parseAuthoredBranches(transcriptContent: string): string[];
 export declare function parseAuthoredShas(transcriptContent: string, repoRoot: string, resolveFullBatch?: (shas: string[]) => Map<string, string>): string[];
@@ -64,6 +71,8 @@ export interface CapturePayloadInput {
     headSha?: string | null;
     branches?: string[];
     headShas?: string[];
+    gitRefs?: CaptureGitRef[];
+    pullRequestUrls?: string[];
     inputTokens?: number;
     outputTokens?: number;
     cacheTokens?: number;

package/dist/utils.js

@@ -46,6 +46,8 @@ exports.matchRepo = matchRepo;
 exports.resolveCaptureDir = resolveCaptureDir;
 exports.resolveCaptureDirs = resolveCaptureDirs;
 exports.collectCaptureKeys = collectCaptureKeys;
+exports.collectCaptureGitRefs = collectCaptureGitRefs;
+exports.parsePullRequestUrls = parsePullRequestUrls;
 exports.extractShaTokens = extractShaTokens;
 exports.parseAuthoredBranches = parseAuthoredBranches;
 exports.parseAuthoredShas = parseAuthoredShas;
@@ -450,6 +452,144 @@ function collectCaptureKeys(dirs, getBranch = getGitBranch, getSha = getGitHeadS
     }
     return { branch: branches[0] ?? null, headSha: headShas[0] ?? null, branches, headShas };
 }
+function collectCaptureGitRefs(dirs, getRemote = getGitRemoteUrl, getBranch = getGitBranch, getSha = getGitHeadSha) {
+    const out = [];
+    const seen = new Set();
+    for (const dir of dirs) {
+        const repoUrl = getRemote(dir)?.trim();
+        if (!repoUrl)
+            continue;
+        const branch = getBranch(dir)?.trim() || undefined;
+        const headSha = getSha(dir)?.trim().toLowerCase() || undefined;
+        if (!branch && !headSha)
+            continue;
+        const key = `${normalizeRepoUrl(repoUrl).toLowerCase()}::${branch ?? ""}::${headSha ?? ""}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ repoUrl, ...(branch ? { branch } : {}), ...(headSha ? { headSha } : {}) });
+    }
+    return out;
+}
+// Exact PR/MR URLs are the strongest provenance the transcript can provide.
+// Both `gh pr create` and `glab mr create` print one, and the OpenCode capture
+// is normalized through the same parser as Claude Code. A direct URL survives
+// branch deletion, squash/rebase, cherry-picks, and SessionEnd happening after
+// the PR was opened.
+function parsePullRequestUrls(transcriptContent) {
+    const out = [];
+    const createToolIds = new Set();
+    const isCreateCommand = (command) => {
+        if (typeof command !== "string")
+            return false;
+        // A combined `gh pr view || gh pr create` result is ambiguous: when the PR
+        // already exists, the VIEW half prints its URL and CREATE never runs.
+        if (/\b(?:gh\s+pr\s+(?:view|list|status)|glab\s+mr\s+(?:view|list))\b/i.test(command)) {
+            return false;
+        }
+        return command.split(/&&|\|\||;|\n/).some((statement) => /^(?:(?:env\s+)?[A-Z_][A-Z0-9_]*=\S+\s+)*(?:gh\s+pr\s+create|glab\s+mr\s+create)\b/i
+            .test(statement.trim()));
+    };
+    const scanText = (text) => {
+        const normalized = text.replace(/\\\//g, "/");
+        const candidates = normalized.match(/https?:\/\/[^\s<>"']+/gi) ?? [];
+        for (const raw of candidates) {
+            const trimmed = raw.replace(/[),.;:\]}]+$/g, "");
+            try {
+                const url = new URL(trimmed);
+                const path = url.pathname.replace(/\/+$/, "");
+                const isGithubPr = /^\/.+\/pull\/\d+$/i.test(path);
+                const isGitlabMr = /^\/.+\/-\/merge_requests\/\d+$/i.test(path);
+                if (!isGithubPr && !isGitlabMr)
+                    continue;
+                const canonical = `${url.protocol}//${url.host}${path}`;
+                if (!out.includes(canonical))
+                    out.push(canonical);
+            }
+            catch {
+                // Malformed tool output is ignored; capture remains best-effort.
+            }
+        }
+    };
+    const scanContent = (value) => {
+        if (typeof value === "string") {
+            scanText(value);
+            return;
+        }
+        if (!Array.isArray(value))
+            return;
+        for (const part of value) {
+            if (typeof part === "string")
+                scanText(part);
+            else if (part && typeof part === "object") {
+                const text = part.text;
+                if (typeof text === "string")
+                    scanText(text);
+            }
+        }
+    };
+    const entries = [];
+    for (const line of transcriptContent.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const entry = JSON.parse(line);
+            entries.push(entry);
+            const content = entry?.message?.content;
+            if (Array.isArray(content)) {
+                for (const block of content) {
+                    if (block?.type === "tool_use"
+                        && typeof block.id === "string"
+                        && isCreateCommand(block.input?.command)) {
+                        createToolIds.add(block.id);
+                    }
+                }
+            }
+            // Codex function calls carry arguments as serialized JSON.
+            if (entry?.type === "response_item"
+                && entry?.payload?.type === "function_call"
+                && typeof entry.payload.call_id === "string") {
+                let args = entry.payload.arguments;
+                if (typeof args === "string") {
+                    try {
+                        args = JSON.parse(args);
+                    }
+                    catch { /* leave as string */ }
+                }
+                if (isCreateCommand(args?.cmd ?? args?.command ?? args)) {
+                    createToolIds.add(entry.payload.call_id);
+                }
+            }
+        }
+        catch {
+            // Never regex the raw line: prompts and assistant prose can contain a PR
+            // URL, but only actual tool output is provenance.
+        }
+    }
+    // Second pass: a URL is proof only when it came from the result of the
+    // specific gh/glab CREATE call above. `gh pr view/list` also prints URLs and
+    // must never claim somebody else's already-existing PR for this session.
+    for (const entry of entries) {
+        const content = entry?.message?.content;
+        if (Array.isArray(content)) {
+            for (const block of content) {
+                if (block?.type === "tool_result"
+                    && typeof block.tool_use_id === "string"
+                    && createToolIds.has(block.tool_use_id)
+                    && block.is_error !== true) {
+                    scanContent(block.content);
+                }
+            }
+        }
+        if (entry?.type === "response_item"
+            && entry?.payload?.type === "function_call_output"
+            && typeof entry.payload.call_id === "string"
+            && createToolIds.has(entry.payload.call_id)) {
+            scanContent(entry.payload.output);
+        }
+    }
+    return out;
+}
 // Pull the commit SHAs the agent actually authored/pushed straight out of the
 // transcript's git command OUTPUT — independent of end-of-session filesystem
 // state. Catches: commit output "[branch 4c4e790]", push ranges
@@ -690,6 +830,10 @@ function buildCapturePayload(input) {
         // see no change; newer servers index the session under every key.
         branches: input.branches && input.branches.length ? input.branches : undefined,
         headShas: input.headShas && input.headShas.length ? input.headShas : undefined,
+        gitRefs: input.gitRefs && input.gitRefs.length ? input.gitRefs : undefined,
+        pullRequestUrls: input.pullRequestUrls && input.pullRequestUrls.length
+            ? input.pullRequestUrls
+            : undefined,
         transcript: input.transcriptBase64,
         messageCount: input.messageCount,
         toolCallCount: input.toolCallCount,
@@ -910,6 +1054,11 @@ function installOpenCodeCapturePlugin() {
     const start = resolveHookInvocation("session-start-opencode");
     const capture = resolveHookInvocation("capture-opencode");
     const finish = resolveHookInvocation("capture-opencode-final");
+    const backup = resolveHookInvocation("backup");
+    const prompt = resolveHookInvocation("discover-codie");
+    const securityPre = resolveHookInvocation("security-pre-codie");
+    const securityPost = resolveHookInvocation("security-post-codie");
+    const securityFailure = resolveHookInvocation("security-failure-codie");
     const source = `// Managed by codiedev connect. Safe to remove and reinstall.\n` +
         `import { spawn, spawnSync } from "node:child_process";\n` +
         `import { mkdir, writeFile } from "node:fs/promises";\n` +
@@ -918,6 +1067,11 @@ function installOpenCodeCapturePlugin() {
         `const START = ${JSON.stringify(start)};\n` +
         `const CAPTURE = ${JSON.stringify(capture)};\n` +
         `const FINISH = ${JSON.stringify(finish)};\n` +
+        `const BACKUP = ${JSON.stringify(backup)};\n` +
+        `const PROMPT = ${JSON.stringify(prompt)};\n` +
+        `const SECURITY_PRE = ${JSON.stringify(securityPre)};\n` +
+        `const SECURITY_POST = ${JSON.stringify(securityPost)};\n` +
+        `const SECURITY_FAILURE = ${JSON.stringify(securityFailure)};\n` +
         `const fingerprints = new Map();\n\n` +
         `const transcriptPaths = new Map();\n\n` +
         `function sessionId(event) {\n` +
@@ -933,6 +1087,18 @@ function installOpenCodeCapturePlugin() {
         `function dispatchSync(invocation, payload) {\n` +
         `  try { spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), stdio: ["pipe", "ignore", "ignore"], timeout: 1500 }); } catch {}\n` +
         `}\n\n` +
+        `function enforceSync(invocation, payload) {\n` +
+        `  const result = spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), encoding: "utf8", stdio: ["pipe", "pipe", "ignore"], timeout: 1500 });\n` +
+        `  if (result.error) return;\n` +
+        `  try {\n` +
+        `    const decision = JSON.parse(result.stdout || "{}");\n` +
+        `    const denied = decision?.decision === "block" || decision?.hookSpecificOutput?.permissionDecision === "deny";\n` +
+        `    if (denied) throw new Error(decision?.reason || decision?.hookSpecificOutput?.permissionDecisionReason || "Codie security policy blocked this action");\n` +
+        `  } catch (error) {\n` +
+        `    if (error instanceof SyntaxError) return;\n` +
+        `    throw error;\n` +
+        `  }\n` +
+        `}\n\n` +
         `export const CodiedevCapture = async ({ client, directory, worktree }) => {\n` +
         `  const finalizeAll = () => {\n` +
         `    for (const [id, transcriptPath] of transcriptPaths) {\n` +
@@ -942,6 +1108,21 @@ function installOpenCodeCapturePlugin() {
         `  };\n` +
         `  process.once("exit", finalizeAll);\n` +
         `  return ({\n` +
+        `  "chat.message": async (input, output) => {\n` +
+        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
+        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const prompt = Array.isArray(output?.parts) ? output.parts.filter((part) => part?.type === "text").map((part) => part.text || "").join("\\n") : "";\n` +
+        `    enforceSync(PROMPT, { sessionId: id, cwd, prompt });\n` +
+        `  },\n` +
+        `  "tool.execute.before": async (input, output) => {\n` +
+        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    enforceSync(SECURITY_PRE, { sessionId: input?.sessionID ?? input?.sessionId ?? "unknown", cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: output?.args ?? output });\n` +
+        `  },\n` +
+        `  "tool.execute.after": async (input, output) => {\n` +
+        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const payload = { sessionId: input?.sessionID ?? input?.sessionId ?? "unknown", cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: input?.args, toolResponse: output };\n` +
+        `    dispatch(output?.error ? SECURITY_FAILURE : SECURITY_POST, payload);\n` +
+        `  },\n` +
         `  event: async ({ event }) => {\n` +
         `    const id = sessionId(event);\n` +
         `    if (!id) return;\n` +
@@ -973,6 +1154,7 @@ function installOpenCodeCapturePlugin() {
         `      await writeFile(transcriptPath, JSON.stringify(list), { mode: 0o600 });\n` +
         `      transcriptPaths.set(id, transcriptPath);\n` +
         `      dispatch(CAPTURE, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
+        `      dispatch(BACKUP, { session_id: id, cwd, workspace_roots: [cwd] });\n` +
         `    } catch {}\n` +
         `  },\n` +
         `  });\n` +
@@ -1052,6 +1234,11 @@ function installHook() {
     const hooks = settings.hooks;
     // SessionEnd → capture (upload the finished session for the team library).
     upsertCodiedevHook(hooks, "SessionEnd", "capture");
+    // Tool boundaries → ADR shadow detection. PreToolUse is the eventual
+    // enforcement point; alert mode always returns allow.
+    upsertCodiedevHook(hooks, "PreToolUse", "security-pre");
+    upsertCodiedevHook(hooks, "PostToolUse", "security-post");
+    upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure");
     // UserPromptSubmit → discover (surface a matching team skill for the task).
     upsertCodiedevHook(hooks, "UserPromptSubmit", "discover");
     // Stop → backup (auto-back-up changed artifact files to your private library).
@@ -1161,6 +1348,9 @@ function ensureAllCodiedevHooksInstalled() {
         const hooks = (settings.hooks ?? {});
         const wanted = [
             ["SessionEnd", "capture"],
+            ["PreToolUse", "security-pre"],
+            ["PostToolUse", "security-post"],
+            ["PostToolUseFailure", "security-failure"],
             ["UserPromptSubmit", "discover"],
             ["Stop", "backup"],
             ["StopFailure", "limit", "rate_limit"],
@@ -1623,9 +1813,8 @@ function installCodexHook() {
         hooksFile.hooks = {};
     }
     const hooks = hooksFile.hooks;
-    if (!hooks.Stop) {
+    if (!hooks.Stop)
         hooks.Stop = [];
-    }
     const existing = hooks.Stop;
     const filtered = existing.filter((hook) => {
         const inner = hook.hooks;
@@ -1653,6 +1842,15 @@ function installCodexHook() {
         ],
     });
     hooks.Stop = filtered;
+    // Codex uses the same Claude-style matcher-group shape. Keep these as
+    // separate entries because Codex hook coverage is still evolving and a
+    // malformed/unavailable post hook must not interfere with PreToolUse.
+    upsertCodiedevHook(hooks, "PreToolUse", "security-pre-codex");
+    upsertCodiedevHook(hooks, "PostToolUse", "security-post-codex");
+    upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure-codex");
+    // Prompt guard + skill discovery. The guard runs locally before any prompt
+    // content can reach either the model or Codiedev's discovery endpoint.
+    upsertCodiedevHook(hooks, "UserPromptSubmit", "discover-codex");
     if (!fs.existsSync(CODEX_DIR)) {
         fs.mkdirSync(CODEX_DIR, { recursive: true });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.34",
+  "version": "0.9.36",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,6 +12,7 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
+    "test:security-pilot": "vitest run src/__tests__/security.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityPilot.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
     "test:watch": "vitest"
   },
   "files": [
@@ -35,12 +36,18 @@
     "session-capture"
   ],
   "homepage": "https://codiedev.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Signal-and-Code/codiedev.git",
+    "directory": "packages/codiedev-cli"
+  },
   "license": "MIT",
   "engines": {
     "node": ">=18"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/dist/scope.d.ts

@@ -1,8 +0,0 @@
-export interface ScopeInfo {
-    workspaceName: string;
-    matchedRepo: {
-        fullName: string;
-    } | null;
-}
-export declare function formatScope(info: ScopeInfo): string;
-export declare function printScope(info: ScopeInfo): void;

package/dist/scope.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.formatScope = formatScope;
-exports.printScope = printScope;
-function formatScope(info) {
-    if (!info.workspaceName)
-        return "→ unknown workspace";
-    if (info.matchedRepo) {
-        return `→ ${info.workspaceName} (matched ${info.matchedRepo.fullName})`;
-    }
-    return `→ ${info.workspaceName} (default profile, no repo match)`;
-}
-function printScope(info) {
-    console.log(formatScope(info));
-}