codiedev 0.9.49 → 0.9.50

package/dist/hook.js

@@ -366,7 +366,11 @@ async function runSecurityEventUpload() {
             endpointName: config.deviceName,
             cliVersion: version_1.CLI_VERSION,
         });
-        const result = await postJsonForResponse(`${config.backendUrl}/api/cli/securityEvent`, { ...eventWithEndpoint }, config.token, 1500);
+        const result = await postJsonForResponse(`${config.backendUrl}/api/cli/securityEvent`, { ...eventWithEndpoint }, config.token, 
+        // Leave room for a cold backend and durable scheduling. This uploader is
+        // detached, so the network budget never delays the developer's prompt or
+        // tool call. Policy refreshes use the separately signed sync endpoint.
+        5_000);
         if (result?.policy?.schemaVersion === 1) {
             (0, securityPolicy_1.writeEndpointSecurityPolicy)(result.policy, undefined, undefined, config.companyId);
         }

package/dist/securityPolicy.d.ts

@@ -1,5 +1,13 @@
 import type { AgentSurface, EndpointSecurityPolicy } from "./security";
 export type TrustedPolicyKeys = Record<string, string>;
+/**
+ * Vendor policy roots are compiled into the endpoint binary. This prevents a
+ * compromised control-plane response from introducing the key that verifies
+ * that same response. Additional customer-managed roots may still be supplied
+ * through CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS, but they cannot replace the
+ * Codiedev production root with the same key id.
+ */
+export declare const BUILT_IN_POLICY_KEYS: TrustedPolicyKeys;
 export declare function trustedPolicyKeysFromEnvironment(env?: NodeJS.ProcessEnv): TrustedPolicyKeys;
 export declare function verifyEndpointSecurityPolicySignature(policy: EndpointSecurityPolicy, trustedKeys?: TrustedPolicyKeys): {
     ok: boolean;

package/dist/securityPolicy.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILT_IN_POLICY_KEYS = void 0;
 exports.trustedPolicyKeysFromEnvironment = trustedPolicyKeysFromEnvironment;
 exports.verifyEndpointSecurityPolicySignature = verifyEndpointSecurityPolicySignature;
 exports.readEndpointSecurityPolicy = readEndpointSecurityPolicy;
@@ -52,6 +53,16 @@ function policyFile(companyId) {
     const scope = companyId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128);
     return `security-policy.${scope}.json`;
 }
+/**
+ * Vendor policy roots are compiled into the endpoint binary. This prevents a
+ * compromised control-plane response from introducing the key that verifies
+ * that same response. Additional customer-managed roots may still be supplied
+ * through CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS, but they cannot replace the
+ * Codiedev production root with the same key id.
+ */
+exports.BUILT_IN_POLICY_KEYS = {
+    "codiedev-prod-2026-01": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0H+UISjTn4zhd6Pk9YmrMBqnJEJmv9fXoavXorlV2cU=\n-----END PUBLIC KEY-----\n",
+};
 function stableJson(value) {
     if (Array.isArray(value))
         return `[${value.map(stableJson).join(",")}]`;
@@ -66,16 +77,17 @@ function stableJson(value) {
 function trustedPolicyKeysFromEnvironment(env = process.env) {
     const raw = env.CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS;
     if (!raw)
-        return {};
+        return { ...exports.BUILT_IN_POLICY_KEYS };
     try {
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-            return {};
-        return Object.fromEntries(Object.entries(parsed)
+            return { ...exports.BUILT_IN_POLICY_KEYS };
+        const configured = Object.fromEntries(Object.entries(parsed)
             .filter((entry) => typeof entry[1] === "string"));
+        return { ...configured, ...exports.BUILT_IN_POLICY_KEYS };
     }
     catch {
-        return {};
+        return { ...exports.BUILT_IN_POLICY_KEYS };
     }
 }
 function verifyEndpointSecurityPolicySignature(policy, trustedKeys = trustedPolicyKeysFromEnvironment()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.49",
+  "version": "0.9.50",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",