codiedev 0.9.49 → 0.9.51

package/dist/codie.js

@@ -53,6 +53,7 @@ const configDir_1 = require("./configDir");
 const codieLauncher_1 = require("./codieLauncher");
 const codieRuntime_1 = require("./codieRuntime");
 const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
+const codieStartup_1 = require("./codieStartup");
 const upgradeNudge_1 = require("./upgradeNudge");
 function git(args) {
     const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -300,6 +301,10 @@ async function main() {
         process.exitCode = update.status ?? 0;
         return;
     }
+    const policyRefresh = await (0, codieStartup_1.refreshCodieSecurityPolicy)(connected);
+    if (policyRefresh.status === "cached") {
+        console.error(`codie: security policy refresh failed; using the cached policy (${policyRefresh.error})`);
+    }
     const gatewayUrl = process.env.CODIEDEV_GATEWAY_URL || "https://gateway.codiedev.com/api/v1";
     const catalog = await (0, codieLauncher_1.fetchApprovedCatalog)({ baseUrl: gatewayUrl, key });
     const parsed = (0, codieLauncher_1.parseCodieArgs)(process.argv.slice(2));
@@ -310,11 +315,20 @@ async function main() {
     }
     (0, codieLauncher_1.validateCodieArgs)(parsed.args, catalog);
     const stateDir = (0, configDir_1.codiedevStateDir)();
-    const runtime = (0, codieRuntimeInstall_1.ensureCodieRuntimeBinary)({
+    const runtime = await (0, codieRuntimeInstall_1.ensureCodieRuntimeBinary)({
         resolve: () => (0, codieRuntime_1.resolveCodieRuntime)({
             env: process.env,
             stateDir,
             existsSync: (candidate) => fs.existsSync(candidate),
+            readInstalledVersion: (candidate) => {
+                try {
+                    const value = JSON.parse(fs.readFileSync(candidate, "utf8"));
+                    return typeof value.version === "string" ? value.version : null;
+                }
+                catch {
+                    return null;
+                }
+            },
             resolveBundled: () => {
                 try {
                     return require.resolve("opencode-ai/bin/opencode.exe");
@@ -325,6 +339,16 @@ async function main() {
             },
         }),
         install: (missing) => (0, codieRuntimeInstall_1.installCodieRuntimeOnDisk)(missing, stateDir),
+        confirmUpdate: async (outdated) => {
+            console.error("");
+            console.error(`Codie harness ${outdated.expectedVersion} is available (you're on ${outdated.currentVersion}).`);
+            if (!process.stdin.isTTY || !process.stdout.isTTY) {
+                console.error("Restart `codie` in an interactive terminal to update the harness.");
+                console.error("");
+                return false;
+            }
+            return await (0, upgradeNudge_1.promptYesNo)("  Update the harness now? [y/N] ");
+        },
     });
     const metadataPlugin = (0, url_1.pathToFileURL)(assetPath("opencode-plugin.mjs")).href;
     const capturePlugin = (0, codieLauncher_1.resolveCapturePlugin)({ homeDir: os.homedir(), existsSync: fs.existsSync });

package/dist/codieRuntime.d.ts

@@ -1,4 +1,5 @@
 export declare const OPENCODE_RUNTIME_SPEC = "opencode-ai@1.18.4";
+export declare const OPENCODE_RUNTIME_VERSION: string;
 export declare const CODIE_MIN_NODE_MAJOR = 20;
 export type CodieRuntime = {
     kind: "ready";
@@ -8,12 +9,21 @@ export type CodieRuntime = {
     installDir: string;
     binary: string;
     spec: string;
+} | {
+    kind: "outdated";
+    installDir: string;
+    binary: string;
+    spec: string;
+    currentVersion: string;
+    expectedVersion: string;
 };
 export declare function codieRuntimeDir(stateDir: string): string;
-export declare function resolveCodieRuntime({ env, stateDir, existsSync, resolveBundled, }: {
+export declare function installedRuntimePackageJson(stateDir: string): string;
+export declare function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion, resolveBundled, }: {
     env: Record<string, string | undefined>;
     stateDir: string;
     existsSync: (candidate: string) => boolean;
+    readInstalledVersion?: (packageJson: string) => string | null;
     resolveBundled: () => string | null;
 }): CodieRuntime;
 export declare function assertCodieNodeVersion(version: string): void;

package/dist/codieRuntime.js

@@ -43,8 +43,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CODIE_MIN_NODE_MAJOR = exports.OPENCODE_RUNTIME_SPEC = void 0;
+exports.CODIE_MIN_NODE_MAJOR = exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC = void 0;
 exports.codieRuntimeDir = codieRuntimeDir;
+exports.installedRuntimePackageJson = installedRuntimePackageJson;
 exports.resolveCodieRuntime = resolveCodieRuntime;
 exports.assertCodieNodeVersion = assertCodieNodeVersion;
 const path = __importStar(require("path"));
@@ -52,6 +53,7 @@ const path = __importStar(require("path"));
 // recognizes byte-for-byte, so a floating version would silently regress the
 // terminal branding whenever OpenCode ships a new build.
 exports.OPENCODE_RUNTIME_SPEC = "opencode-ai@1.18.4";
+exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC.slice(exports.OPENCODE_RUNTIME_SPEC.lastIndexOf("@") + 1);
 // The harness needs 20; capture does not. package.json `engines` stays >=18 so
 // `codiedev connect` still installs for Node 18 users — this floor is enforced
 // at `codie` launch instead.
@@ -62,7 +64,10 @@ function codieRuntimeDir(stateDir) {
 function installedBinary(stateDir) {
     return path.join(codieRuntimeDir(stateDir), "node_modules", "opencode-ai", "bin", "opencode.exe");
 }
-function resolveCodieRuntime({ env, stateDir, existsSync, resolveBundled, }) {
+function installedRuntimePackageJson(stateDir) {
+    return path.join(codieRuntimeDir(stateDir), "node_modules", "opencode-ai", "package.json");
+}
+function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion, resolveBundled, }) {
     // 1. Explicit override — the air-gapped / pre-provisioned escape hatch.
     const override = env.CODIEDEV_OPENCODE_BINARY?.trim();
     if (override) {
@@ -78,8 +83,20 @@ function resolveCodieRuntime({ env, stateDir, existsSync, resolveBundled, }) {
         return { kind: "ready", binary: bundled };
     // 3. The lazily installed engine.
     const binary = installedBinary(stateDir);
-    if (existsSync(binary))
+    if (existsSync(binary)) {
+        const currentVersion = readInstalledVersion?.(installedRuntimePackageJson(stateDir)) ?? null;
+        if (currentVersion && currentVersion !== exports.OPENCODE_RUNTIME_VERSION) {
+            return {
+                kind: "outdated",
+                installDir: codieRuntimeDir(stateDir),
+                binary,
+                spec: exports.OPENCODE_RUNTIME_SPEC,
+                currentVersion,
+                expectedVersion: exports.OPENCODE_RUNTIME_VERSION,
+            };
+        }
         return { kind: "ready", binary };
+    }
     return { kind: "missing", installDir: codieRuntimeDir(stateDir), binary, spec: exports.OPENCODE_RUNTIME_SPEC };
 }
 function assertCodieNodeVersion(version) {

package/dist/codieRuntimeInstall.d.ts

@@ -1,9 +1,10 @@
 import { CodieRuntime } from "./codieRuntime";
+type InstallableCodieRuntime = Exclude<CodieRuntime, {
+    kind: "ready";
+}>;
 export declare function buildRuntimeInstallArgs(stagingDir: string, spec: string): string[];
 export interface InstallDeps {
-    runtime: Extract<CodieRuntime, {
-        kind: "missing";
-    }>;
+    runtime: InstallableCodieRuntime;
     makeStagingDir: () => string;
     run: (args: string[]) => {
         status: number | null;
@@ -15,13 +16,13 @@ export interface InstallDeps {
     log: (message: string) => void;
 }
 export declare function installCodieRuntime(deps: InstallDeps): void;
-export declare function ensureCodieRuntimeBinary({ resolve, install, }: {
+export declare function ensureCodieRuntimeBinary({ resolve, install, confirmUpdate, }: {
     resolve: () => CodieRuntime;
-    install: (runtime: Extract<CodieRuntime, {
-        kind: "missing";
-    }>) => void;
-}): string;
-export declare function installCodieRuntimeOnDisk(runtime: Extract<CodieRuntime, {
-    kind: "missing";
-}>, stateDir: string): void;
+    install: (runtime: InstallableCodieRuntime) => void;
+    confirmUpdate?: (runtime: Extract<CodieRuntime, {
+        kind: "outdated";
+    }>) => Promise<boolean>;
+}): Promise<string>;
+export declare function installCodieRuntimeOnDisk(runtime: InstallableCodieRuntime, stateDir: string): void;
 export declare function defaultStagingRoot(): string;
+export {};

package/dist/codieRuntimeInstall.js

@@ -98,10 +98,12 @@ function installCodieRuntime(deps) {
     }
 }
 // Resolve the engine, downloading it once if this is the first `codie` run.
-function ensureCodieRuntimeBinary({ resolve, install, }) {
+async function ensureCodieRuntimeBinary({ resolve, install, confirmUpdate = async () => false, }) {
     const runtime = resolve();
     if (runtime.kind === "ready")
         return runtime.binary;
+    if (runtime.kind === "outdated" && !(await confirmUpdate(runtime)))
+        return runtime.binary;
     install(runtime);
     return runtime.binary;
 }

package/dist/codieStartup.d.ts

@@ -0,0 +1,24 @@
+import type { AgentSurface, EndpointSecurityPolicy } from "./security";
+import type { AgentSecurityEntitlement } from "./securityFeature";
+export interface CodieStartupConfig extends AgentSecurityEntitlement {
+    backendUrl?: string;
+    token?: string;
+    companyId?: string;
+}
+export type CodiePolicyRefreshResult = {
+    status: "disabled";
+} | {
+    status: "synced";
+    policy: EndpointSecurityPolicy;
+} | {
+    status: "cached";
+    error: string;
+};
+/** Refresh the endpoint policy before Codie hands the terminal to OpenCode.
+ * Enforcement remains available offline because hooks keep using the last
+ * verified company-scoped policy when this best-effort refresh cannot land. */
+export declare function refreshCodieSecurityPolicy(config: CodieStartupConfig, syncPolicy?: (config: {
+    backendUrl: string;
+    token: string;
+    companyId: string;
+}, source?: AgentSurface) => Promise<EndpointSecurityPolicy>): Promise<CodiePolicyRefreshResult>;

package/dist/codieStartup.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshCodieSecurityPolicy = refreshCodieSecurityPolicy;
+const securityFeature_1 = require("./securityFeature");
+const securityPolicy_1 = require("./securityPolicy");
+/** Refresh the endpoint policy before Codie hands the terminal to OpenCode.
+ * Enforcement remains available offline because hooks keep using the last
+ * verified company-scoped policy when this best-effort refresh cannot land. */
+async function refreshCodieSecurityPolicy(config, syncPolicy = securityPolicy_1.syncEndpointSecurityPolicy) {
+    if (!(0, securityFeature_1.isAgentSecurityEnabled)(config))
+        return { status: "disabled" };
+    if (!config.backendUrl || !config.token || !config.companyId) {
+        return { status: "cached", error: "connected account details are incomplete" };
+    }
+    try {
+        const policy = await syncPolicy({
+            backendUrl: config.backendUrl,
+            token: config.token,
+            companyId: config.companyId,
+        }, "codie-harness");
+        return { status: "synced", policy };
+    }
+    catch (error) {
+        return {
+            status: "cached",
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}

package/dist/hook.js

@@ -366,7 +366,11 @@ async function runSecurityEventUpload() {
             endpointName: config.deviceName,
             cliVersion: version_1.CLI_VERSION,
         });
-        const result = await postJsonForResponse(`${config.backendUrl}/api/cli/securityEvent`, { ...eventWithEndpoint }, config.token, 1500);
+        const result = await postJsonForResponse(`${config.backendUrl}/api/cli/securityEvent`, { ...eventWithEndpoint }, config.token, 
+        // Leave room for a cold backend and durable scheduling. This uploader is
+        // detached, so the network budget never delays the developer's prompt or
+        // tool call. Policy refreshes use the separately signed sync endpoint.
+        5_000);
         if (result?.policy?.schemaVersion === 1) {
             (0, securityPolicy_1.writeEndpointSecurityPolicy)(result.policy, undefined, undefined, config.companyId);
         }

package/dist/repoResolver.js

@@ -13,14 +13,20 @@ function parseRemoteUrl(url) {
     let s = url.trim();
     if (s.endsWith(".git"))
         s = s.slice(0, -4);
-    const ssh = s.match(/^git@([^:]+):(.+)$/);
-    if (ssh) {
-        return { host: ssh[1].toLowerCase(), ownerName: ssh[2].toLowerCase() };
-    }
     const https = s.match(/^https?:\/\/([^/]+)\/(.+)$/);
     if (https) {
         return { host: https[1].toLowerCase(), ownerName: https[2].toLowerCase() };
     }
+    // Codie strips SSH userinfo before putting a remote in the gateway header,
+    // so `git@gitlab.com:owner/repo.git` arrives here as
+    // `gitlab.com:owner/repo.git`. Accept both forms; otherwise every SSH-cloned
+    // Harness checkout loses its repoId even though transcript capture can
+    // resolve the same raw remote correctly. Check this after URL forms so the
+    // colon in `https://` is never mistaken for an SCP separator.
+    const scp = s.match(/^(?:[^@\s]+@)?([^:/\s]+):(.+)$/);
+    if (scp) {
+        return { host: scp[1].toLowerCase(), ownerName: scp[2].toLowerCase() };
+    }
     return null;
 }
 function resolveRepoForCapture(input) {

package/dist/securityPolicy.d.ts

@@ -1,5 +1,13 @@
 import type { AgentSurface, EndpointSecurityPolicy } from "./security";
 export type TrustedPolicyKeys = Record<string, string>;
+/**
+ * Vendor policy roots are compiled into the endpoint binary. This prevents a
+ * compromised control-plane response from introducing the key that verifies
+ * that same response. Additional customer-managed roots may still be supplied
+ * through CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS, but they cannot replace the
+ * Codiedev production root with the same key id.
+ */
+export declare const BUILT_IN_POLICY_KEYS: TrustedPolicyKeys;
 export declare function trustedPolicyKeysFromEnvironment(env?: NodeJS.ProcessEnv): TrustedPolicyKeys;
 export declare function verifyEndpointSecurityPolicySignature(policy: EndpointSecurityPolicy, trustedKeys?: TrustedPolicyKeys): {
     ok: boolean;
@@ -21,4 +29,4 @@ export declare function syncEndpointSecurityPolicy(config: {
     backendUrl: string;
     token: string;
     companyId: string;
-}, source?: AgentSurface, timeoutMs?: number): Promise<EndpointSecurityPolicy>;
+}, source?: AgentSurface, timeoutMs?: number, stateDir?: string, trustedKeys?: TrustedPolicyKeys): Promise<EndpointSecurityPolicy>;

package/dist/securityPolicy.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILT_IN_POLICY_KEYS = void 0;
 exports.trustedPolicyKeysFromEnvironment = trustedPolicyKeysFromEnvironment;
 exports.verifyEndpointSecurityPolicySignature = verifyEndpointSecurityPolicySignature;
 exports.readEndpointSecurityPolicy = readEndpointSecurityPolicy;
@@ -52,6 +53,16 @@ function policyFile(companyId) {
     const scope = companyId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128);
     return `security-policy.${scope}.json`;
 }
+/**
+ * Vendor policy roots are compiled into the endpoint binary. This prevents a
+ * compromised control-plane response from introducing the key that verifies
+ * that same response. Additional customer-managed roots may still be supplied
+ * through CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS, but they cannot replace the
+ * Codiedev production root with the same key id.
+ */
+exports.BUILT_IN_POLICY_KEYS = {
+    "codiedev-prod-2026-01": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0H+UISjTn4zhd6Pk9YmrMBqnJEJmv9fXoavXorlV2cU=\n-----END PUBLIC KEY-----\n",
+};
 function stableJson(value) {
     if (Array.isArray(value))
         return `[${value.map(stableJson).join(",")}]`;
@@ -66,16 +77,17 @@ function stableJson(value) {
 function trustedPolicyKeysFromEnvironment(env = process.env) {
     const raw = env.CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS;
     if (!raw)
-        return {};
+        return { ...exports.BUILT_IN_POLICY_KEYS };
     try {
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-            return {};
-        return Object.fromEntries(Object.entries(parsed)
+            return { ...exports.BUILT_IN_POLICY_KEYS };
+        const configured = Object.fromEntries(Object.entries(parsed)
             .filter((entry) => typeof entry[1] === "string"));
+        return { ...configured, ...exports.BUILT_IN_POLICY_KEYS };
     }
     catch {
-        return {};
+        return { ...exports.BUILT_IN_POLICY_KEYS };
     }
 }
 function verifyEndpointSecurityPolicySignature(policy, trustedKeys = trustedPolicyKeysFromEnvironment()) {
@@ -134,7 +146,7 @@ function writeEndpointSecurityPolicy(policy, stateDir = (0, configDir_1.codiedev
     fs.chmodSync(temporary, 0o600);
     fs.renameSync(temporary, target);
 }
-async function syncEndpointSecurityPolicy(config, source, timeoutMs = 3_000) {
+async function syncEndpointSecurityPolicy(config, source, timeoutMs = 3_000, stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
     const url = new URL("/api/cli/securityPolicy", config.backendUrl);
     if (source)
         url.searchParams.set("source", source);
@@ -162,6 +174,6 @@ async function syncEndpointSecurityPolicy(config, source, timeoutMs = 3_000) {
         request.on("error", reject);
         request.end();
     });
-    writeEndpointSecurityPolicy(policy, undefined, undefined, config.companyId);
+    writeEndpointSecurityPolicy(policy, stateDir, trustedKeys, config.companyId);
     return policy;
 }

package/dist/upgradeNudge.d.ts

@@ -13,6 +13,7 @@ export interface OfferOpts {
     log?: (line: string) => void;
     isTty?: boolean;
 }
+export declare function promptYesNo(question: string): Promise<boolean>;
 /**
  * Prompt-capable sibling of maybePrintUpgradeNudge. Call this before handing
  * the terminal to a TUI. A successful upgrade relaunches the fresh CLI and

package/dist/upgradeNudge.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.maybePrintUpgradeNudge = maybePrintUpgradeNudge;
+exports.promptYesNo = promptYesNo;
 exports.maybeOfferUpgrade = maybeOfferUpgrade;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));

package/dist/utils.js

@@ -2787,6 +2787,14 @@ async function runCaptureUpload(jobFile, deps) {
             const { storageId } = await deps.uploadBytes(uploadUrl, Buffer.from(transcript, "base64"), "application/json");
             body = { ...body, transcriptStorageId: storageId };
             delete body.transcript;
+            // Persist the storage id before the metadata POST. Previously a failed
+            // captureSession request retried the entire direct upload, creating one
+            // unreferenced raw transcript blob per attempt. Once the PUT succeeds,
+            // every retry must reuse that exact blob.
+            job.body = body;
+            if (deps.writeFileSync) {
+                deps.writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });
+            }
         }
         await deps.post(job.url, body, job.token);
         // success — drop a "last session captured" breadcrumb (before removing the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.49",
+  "version": "0.9.51",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -14,6 +14,7 @@
     "test": "vitest run",
     "test:security-beta": "vitest run src/__tests__/security.test.ts src/__tests__/securityCommandEntitlement.test.ts src/__tests__/securityDeepScan.test.ts src/__tests__/securityDoctor.test.ts src/__tests__/securityEntitlementInstall.test.ts src/__tests__/securityFeature.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityInventory.test.ts src/__tests__/securityPilot.test.ts src/__tests__/securityPolicy.test.ts src/__tests__/securitySession.test.ts src/__tests__/codexHookTrust.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
     "test:security-pilot": "vitest run src/__tests__/security.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityPilot.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
+    "test:opencode-attribution": "vitest run src/__tests__/repoResolver.test.ts src/__tests__/openCodeCapture.test.ts src/__tests__/openCodePluginGitRefs.test.ts src/__tests__/capturePayloadFinal.test.ts src/__tests__/captureDirectUpload.test.ts src/__tests__/resolveCaptureFinal.test.ts && tsc",
     "test:watch": "vitest"
   },
   "files": [