codiedev 0.9.47 → 0.9.49

package/dist/codie.js

@@ -172,10 +172,12 @@ function installBrandWordmarkUnsafe(runtime) {
 async function runNonInteractive(runtime, runtimeArgs, env) {
     const detached = process.platform !== "win32";
     const child = (0, child_process_1.spawn)(runtime, runtimeArgs, {
-        stdio: ["inherit", "pipe", "pipe"],
+        stdio: ["pipe", "pipe", "pipe"],
         env,
         detached,
     });
+    if (child.stdin)
+        process.stdin.pipe(child.stdin);
     const signalChild = (signal) => {
         if (detached && child.pid) {
             try {
@@ -261,11 +263,15 @@ async function runNonInteractive(runtime, runtimeArgs, env) {
             stderrGate.push(Buffer.from(chunk), Boolean(blockReason));
         });
         child.once("error", (error) => {
+            if (child.stdin)
+                process.stdin.unpipe(child.stdin);
             process.removeListener("SIGINT", forwardInterrupt);
             process.removeListener("SIGTERM", forwardTermination);
             reject(error);
         });
         child.once("close", (status) => {
+            if (child.stdin)
+                process.stdin.unpipe(child.stdin);
             process.removeListener("SIGINT", forwardInterrupt);
             process.removeListener("SIGTERM", forwardTermination);
             stdoutGate.finish(Boolean(blockReason));

package/dist/commands/security.js

@@ -9,6 +9,7 @@ const securityDeepScan_1 = require("../securityDeepScan");
 const utils_1 = require("../utils");
 const securityDoctor_1 = require("../securityDoctor");
 const securityFeature_1 = require("../securityFeature");
+const SECURITY_USAGE = "Usage: codiedev security <doctor|pilot|inventory|scan|sync|rollback> [--json] [--deep] [--connect-mcp] [--supply-chain] [--no-upload] [--yes]";
 function printPilot(json) {
     const report = (0, securityPilot_1.runSyntheticSecurityPilot)();
     if (json) {
@@ -40,6 +41,10 @@ function printDoctor(json, companyId) {
 async function runSecurityCommand(args) {
     const subcommand = args.find((arg) => !arg.startsWith("-")) ?? "doctor";
     const json = args.includes("--json");
+    if (args.includes("--help") || args.includes("-h") || subcommand === "help") {
+        console.log(SECURITY_USAGE);
+        return;
+    }
     const connectedConfig = (0, utils_1.readConfig)();
     const requiresEntitlement = !["pilot", "self-test"].includes(subcommand);
     if (requiresEntitlement && (!connectedConfig || !(0, securityFeature_1.isAgentSecurityEnabled)(connectedConfig))) {
@@ -144,7 +149,7 @@ async function runSecurityCommand(args) {
             ? printDoctor(json, connectedConfig.companyId)
             : false;
     if (!["pilot", "self-test", "doctor", "status"].includes(subcommand)) {
-        console.error("Usage: codiedev security <doctor|pilot|inventory|scan|sync|rollback> [--json] [--deep] [--connect-mcp] [--supply-chain] [--no-upload] [--yes]");
+        console.error(SECURITY_USAGE);
     }
     if (!ok)
         process.exitCode = 1;

package/dist/security.js

@@ -81,6 +81,13 @@ function effectivePolicyAction(policy, category, fallback, source, input) {
     const configured = policy.rules[category] ?? fallback;
     return policy.enforcementMode === "alert" && configured === "block" ? "alert" : configured;
 }
+function policyActionPrefix(action) {
+    if (action === "block")
+        return "Codie blocked";
+    if (action === "alert")
+        return "Codie detected";
+    return "Codie detected but allowed";
+}
 const SECRET_KEY = /(?:api[_-]?key|access[_-]?token|auth[_-]?token|password|passwd|secret|private[_-]?key|client[_-]?secret)/i;
 const SECRET_VALUE_PATTERNS = [
     /\b(?:sk|rk|pk)-(?:live|test|proj)?[-_A-Za-z0-9]{16,}\b/g,
@@ -131,7 +138,7 @@ function evaluatePromptSecurity(prompt, policy, source) {
     return {
         action,
         category: "secret_in_prompt",
-        reason: "Codie blocked this prompt because it appears to contain an API key, password, or credential. Remove the secret value and reference the environment variable by name instead (for example, $OPENAI_API_KEY).",
+        reason: policyActionPrefix(action) + " this prompt because it appears to contain an API key, password, or credential. Remove the secret value and reference the environment variable by name instead (for example, $OPENAI_API_KEY).",
     };
 }
 function serializedToolInput(input) {
@@ -196,18 +203,20 @@ function evaluateToolSecurity(input, phase, policy, source, sessionContext) {
     if (!serialized)
         return { action: "allow" };
     if (destructiveTargetOutsideWorkspace(serialized, input.cwd)) {
+        const action = effectivePolicyAction(policy, "destructive_outside_workspace", "block", source, input);
         return {
-            action: effectivePolicyAction(policy, "destructive_outside_workspace", "block", source, input),
+            action,
             category: "destructive_outside_workspace",
-            reason: "Codie blocked a destructive command targeting files outside the approved workspace.",
+            reason: policyActionPrefix(action) + " a destructive command targeting files outside the approved workspace.",
         };
     }
     const hasNetworkEgress = /\b(?:curl|wget)\b|https?:\/\//i.test(serialized);
     if (hasNetworkEgress && containsSecretValue(serialized)) {
+        const action = effectivePolicyAction(policy, "secret_exfiltration", "block", source, input);
         return {
-            action: effectivePolicyAction(policy, "secret_exfiltration", "block", source, input),
+            action,
             category: "secret_exfiltration",
-            reason: "Codie blocked a command that would send credential material to an external destination.",
+            reason: policyActionPrefix(action) + " a command that would send credential material to an external destination.",
         };
     }
     if (hasNetworkEgress &&
@@ -221,17 +230,19 @@ function evaluateToolSecurity(input, phase, policy, source, sessionContext) {
     }
     const writeOperation = isWriteOperation(input, serialized);
     if (writeOperation && SENSITIVE_PATH.test(serialized)) {
+        const action = effectivePolicyAction(policy, "sensitive_file_write", "block", source, input);
         return {
-            action: effectivePolicyAction(policy, "sensitive_file_write", "block", source, input),
+            action,
             category: "sensitive_file_write",
-            reason: "Codie blocked a write to a credential-bearing file.",
+            reason: policyActionPrefix(action) + " a write to a credential-bearing file.",
         };
     }
     if (writeOperation && PROTECTED_AGENT_CONFIG.test(serialized)) {
+        const action = effectivePolicyAction(policy, "protected_agent_config_write", "block", source, input);
         return {
-            action: effectivePolicyAction(policy, "protected_agent_config_write", "block", source, input),
+            action,
             category: "protected_agent_config_write",
-            reason: "Codie blocked an agent from modifying its own hooks, policy, MCP, or instruction configuration.",
+            reason: policyActionPrefix(action) + " an agent modifying its own hooks, policy, MCP, or instruction configuration.",
         };
     }
     const server = mcpServerName(input);

package/dist/securityInventory.js

@@ -313,10 +313,18 @@ function collectCodexToml(filePath, homeDir, workspace, components) {
     if (!raw)
         return;
     const text = raw.toString("utf8");
-    const sections = [...text.matchAll(/^\[mcp_servers\.(["']?)([^\]"']+)\1\]\s*$([\s\S]*?)(?=^\[|\s*$)/gm)];
-    for (const section of sections) {
-        const name = section[2].trim();
-        const body = section[3].trim();
+    const lines = text.split(/\r?\n/);
+    for (let index = 0; index < lines.length; index += 1) {
+        const section = lines[index].match(/^\s*\[mcp_servers\.(?:"([^"]+)"|'([^']+)'|([^\]]+))\]\s*(?:#.*)?$/);
+        if (!section)
+            continue;
+        const name = (section[1] ?? section[2] ?? section[3] ?? "").trim();
+        const bodyLines = [];
+        for (index += 1; index < lines.length && !/^\s*\[/.test(lines[index]); index += 1) {
+            bodyLines.push(lines[index]);
+        }
+        index -= 1;
+        const body = bodyLines.join("\n").trim();
         components.push(makeComponent({
             kind: "mcp-server", name, sourcePath: filePath, homeDir, workspace,
             content: body, findings: commandFindings(body),
@@ -443,11 +451,13 @@ function buildSecurityInventory(options = {}) {
         path.join(homeDir, ".config", "opencode", "opencode.jsonc"),
         path.join(homeDir, ".config", "Code", "User", "mcp.json"),
         path.join(homeDir, ".config", "Cursor", "User", "mcp.json"),
+        path.join(homeDir, ".codex", "hooks.json"),
         path.join(homeDir, "Library", "Application Support", "Code", "User", "mcp.json"),
         path.join(homeDir, "Library", "Application Support", "Cursor", "User", "mcp.json"),
         path.join(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
         path.join(workspace, ".mcp.json"), path.join(workspace, ".cursor", "mcp.json"),
         path.join(workspace, ".vscode", "mcp.json"),
+        path.join(workspace, ".codex", "hooks.json"),
         path.join(workspace, ".claude", "settings.json"), path.join(workspace, ".claude", "settings.local.json"),
         path.join(workspace, "opencode.json"), path.join(workspace, "opencode.jsonc"),
     ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.47",
+  "version": "0.9.49",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,6 +12,7 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
+    "test:security-beta": "vitest run src/__tests__/security.test.ts src/__tests__/securityCommandEntitlement.test.ts src/__tests__/securityDeepScan.test.ts src/__tests__/securityDoctor.test.ts src/__tests__/securityEntitlementInstall.test.ts src/__tests__/securityFeature.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityInventory.test.ts src/__tests__/securityPilot.test.ts src/__tests__/securityPolicy.test.ts src/__tests__/securitySession.test.ts src/__tests__/codexHookTrust.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
     "test:security-pilot": "vitest run src/__tests__/security.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityPilot.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
     "test:watch": "vitest"
   },