codiedev 0.9.51 → 0.9.52

package/dist/captureLog.d.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 export declare const CAPTURE_LOG_MAX_BYTES: number;
 export declare const CAPTURE_LOG_PATH: string;
 export interface CaptureLogEntry {
-    stage: "capture-finish" | "upload" | "upload-deferred" | "security" | "stderr";
+    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr";
     sessionId: string | undefined;
     outcome: string;
     detail?: string;

package/dist/cli.js

@@ -34,7 +34,6 @@ const share_1 = require("./commands/share");
 const send_1 = require("./commands/send");
 const react_1 = require("./commands/react");
 const capture_1 = require("./commands/capture");
-const security_1 = require("./commands/security");
 const version_1 = require("./version");
 const HELP = `
 Codiedev CLI
@@ -45,13 +44,7 @@ Codiedev CLI
 
 Connect:
   codiedev connect                       Link Claude Code / Codex to your org
-  codiedev doctor                        Verify setup, capture, and Agent Security
-  codiedev security pilot                Run safe synthetic policy checks
-  codiedev security inventory            Inventory MCPs, skills, hooks, plugins,
-                                         instructions, and editor extensions
-  codiedev security scan --deep          Run installed open-source scanners too
-  codiedev security sync                 Fetch administrator policy locally
-  codiedev security rollback --yes       Restore pre-update hook configuration
+  codiedev doctor                        Verify your setup after connecting
 
 Harness:
   codie                                  Launch the governed Codie harness.
@@ -460,9 +453,6 @@ async function main() {
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);
                 return;
-            case "security":
-                await (0, security_1.runSecurityCommand)(rest);
-                return;
             case "push":
                 await (0, push_1.runPush)(rest);
                 return;

package/dist/codie.js

@@ -53,7 +53,6 @@ const configDir_1 = require("./configDir");
 const codieLauncher_1 = require("./codieLauncher");
 const codieRuntime_1 = require("./codieRuntime");
 const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
-const codieStartup_1 = require("./codieStartup");
 const upgradeNudge_1 = require("./upgradeNudge");
 function git(args) {
     const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -170,120 +169,6 @@ function installBrandWordmarkUnsafe(runtime) {
             (0, child_process_1.spawnSync)("codesign", ["--force", "--sign", "-", runtime], { stdio: "ignore" });
     }
 }
-async function runNonInteractive(runtime, runtimeArgs, env) {
-    const detached = process.platform !== "win32";
-    const child = (0, child_process_1.spawn)(runtime, runtimeArgs, {
-        stdio: ["pipe", "pipe", "pipe"],
-        env,
-        detached,
-    });
-    if (child.stdin)
-        process.stdin.pipe(child.stdin);
-    const signalChild = (signal) => {
-        if (detached && child.pid) {
-            try {
-                process.kill(-child.pid, signal);
-                return;
-            }
-            catch {
-                // Fall back to the direct child if its process group already exited.
-            }
-        }
-        child.kill(signal);
-    };
-    const forwardInterrupt = () => signalChild("SIGINT");
-    const forwardTermination = () => signalChild("SIGTERM");
-    process.once("SIGINT", forwardInterrupt);
-    process.once("SIGTERM", forwardTermination);
-    return await new Promise((resolve, reject) => {
-        let blockReason;
-        const errorPrefixes = [Buffer.from("\x1b[91m\x1b[1mError:"), Buffer.from("Error: {")];
-        const retainedPrefixBytes = Math.max(...errorPrefixes.map((prefix) => prefix.length)) - 1;
-        // OpenCode's generic UnknownError and the adapter's private reason can be
-        // delivered in either order — and the generic block can arrive on stdout
-        // or stderr. Gate both streams by content, retaining only a possible final
-        // error block. Ordinary output stays streaming apart from the few bytes
-        // needed to recognize a split prefix.
-        const createOutputGate = (write) => {
-            let tail = Buffer.alloc(0);
-            let possibleError;
-            return {
-                push(chunk, blocked) {
-                    if (blocked) {
-                        if (possibleError)
-                            possibleError.push(Buffer.from(chunk));
-                        return;
-                    }
-                    if (possibleError) {
-                        possibleError.push(Buffer.from(chunk));
-                        return;
-                    }
-                    const combined = Buffer.concat([tail, chunk]);
-                    let errorStart = -1;
-                    for (const prefix of errorPrefixes) {
-                        const index = combined.indexOf(prefix);
-                        if (index >= 0 && (errorStart < 0 || index < errorStart))
-                            errorStart = index;
-                    }
-                    if (errorStart >= 0) {
-                        if (errorStart > 0)
-                            write(combined.subarray(0, errorStart));
-                        possibleError = [combined.subarray(errorStart)];
-                        tail = Buffer.alloc(0);
-                        return;
-                    }
-                    const flushBytes = Math.max(0, combined.length - retainedPrefixBytes);
-                    if (flushBytes > 0)
-                        write(combined.subarray(0, flushBytes));
-                    tail = combined.subarray(flushBytes);
-                },
-                finish(blocked) {
-                    if (tail.length > 0)
-                        write(tail);
-                    const heldError = possibleError ? Buffer.concat(possibleError).toString() : "";
-                    const genericBlockError = heldError.includes("UnknownError") &&
-                        heldError.includes("Unexpected server error");
-                    if (heldError && (!blocked || !genericBlockError))
-                        write(heldError);
-                },
-            };
-        };
-        const stdoutGate = createOutputGate((chunk) => process.stdout.write(chunk));
-        const stderrGate = createOutputGate((chunk) => process.stderr.write(chunk));
-        child.stdout?.on("data", (chunk) => {
-            stdoutGate.push(Buffer.from(chunk), Boolean(blockReason));
-        });
-        child.stderr?.on("data", (chunk) => {
-            const text = chunk.toString();
-            const reason = (0, codieLauncher_1.extractCodieSecurityBlock)(text);
-            if (reason) {
-                blockReason = reason;
-                signalChild("SIGTERM");
-                return;
-            }
-            stderrGate.push(Buffer.from(chunk), Boolean(blockReason));
-        });
-        child.once("error", (error) => {
-            if (child.stdin)
-                process.stdin.unpipe(child.stdin);
-            process.removeListener("SIGINT", forwardInterrupt);
-            process.removeListener("SIGTERM", forwardTermination);
-            reject(error);
-        });
-        child.once("close", (status) => {
-            if (child.stdin)
-                process.stdin.unpipe(child.stdin);
-            process.removeListener("SIGINT", forwardInterrupt);
-            process.removeListener("SIGTERM", forwardTermination);
-            stdoutGate.finish(Boolean(blockReason));
-            stderrGate.finish(Boolean(blockReason));
-            if (blockReason) {
-                console.error(`Codie Security blocked this action:\n${blockReason}`);
-            }
-            resolve(status);
-        });
-    });
-}
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
     const connected = connectedCodiedevConfig();
@@ -301,10 +186,6 @@ async function main() {
         process.exitCode = update.status ?? 0;
         return;
     }
-    const policyRefresh = await (0, codieStartup_1.refreshCodieSecurityPolicy)(connected);
-    if (policyRefresh.status === "cached") {
-        console.error(`codie: security policy refresh failed; using the cached policy (${policyRefresh.error})`);
-    }
     const gatewayUrl = process.env.CODIEDEV_GATEWAY_URL || "https://gateway.codiedev.com/api/v1";
     const catalog = await (0, codieLauncher_1.fetchApprovedCatalog)({ baseUrl: gatewayUrl, key });
     const parsed = (0, codieLauncher_1.parseCodieArgs)(process.argv.slice(2));
@@ -315,20 +196,11 @@ async function main() {
     }
     (0, codieLauncher_1.validateCodieArgs)(parsed.args, catalog);
     const stateDir = (0, configDir_1.codiedevStateDir)();
-    const runtime = await (0, codieRuntimeInstall_1.ensureCodieRuntimeBinary)({
+    const runtime = (0, codieRuntimeInstall_1.ensureCodieRuntimeBinary)({
         resolve: () => (0, codieRuntime_1.resolveCodieRuntime)({
             env: process.env,
             stateDir,
             existsSync: (candidate) => fs.existsSync(candidate),
-            readInstalledVersion: (candidate) => {
-                try {
-                    const value = JSON.parse(fs.readFileSync(candidate, "utf8"));
-                    return typeof value.version === "string" ? value.version : null;
-                }
-                catch {
-                    return null;
-                }
-            },
             resolveBundled: () => {
                 try {
                     return require.resolve("opencode-ai/bin/opencode.exe");
@@ -339,16 +211,6 @@ async function main() {
             },
         }),
         install: (missing) => (0, codieRuntimeInstall_1.installCodieRuntimeOnDisk)(missing, stateDir),
-        confirmUpdate: async (outdated) => {
-            console.error("");
-            console.error(`Codie harness ${outdated.expectedVersion} is available (you're on ${outdated.currentVersion}).`);
-            if (!process.stdin.isTTY || !process.stdout.isTTY) {
-                console.error("Restart `codie` in an interactive terminal to update the harness.");
-                console.error("");
-                return false;
-            }
-            return await (0, upgradeNudge_1.promptYesNo)("  Update the harness now? [y/N] ");
-        },
     });
     const metadataPlugin = (0, url_1.pathToFileURL)(assetPath("opencode-plugin.mjs")).href;
     const capturePlugin = (0, codieLauncher_1.resolveCapturePlugin)({ homeDir: os.homedir(), existsSync: fs.existsSync });
@@ -370,13 +232,6 @@ async function main() {
         OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
     };
     const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
-    const nonInteractiveRun = runtimeArgs[0] === "run";
-    if (nonInteractiveRun)
-        env.CODIEDEV_SECURITY_BLOCK_OUTPUT = "marker";
-    if (nonInteractiveRun) {
-        process.exitCode = (await runNonInteractive(runtime, runtimeArgs, env)) ?? 1;
-        return;
-    }
     const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, { stdio: "inherit", env });
     if (result.error)
         throw result.error;

package/dist/codieLauncher.d.ts

@@ -2,11 +2,6 @@ export interface CatalogModel {
     id: string;
     name?: string;
 }
-export declare const CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
-/** Extract the private adapter marker used to carry a local block reason
- * across OpenCode's generic 500 boundary. The marker never contains prompt or
- * tool input — only the deterministic policy reason. */
-export declare function extractCodieSecurityBlock(stderr: string): string | undefined;
 /**
  * Pin non-interactive runs to the directory where `codie` was launched.
  * OpenCode can reuse a previously-known project instance; without an explicit

package/dist/codieLauncher.js

@@ -42,8 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.CODIE_SECURITY_BLOCK_MARKER = void 0;
-exports.extractCodieSecurityBlock = extractCodieSecurityBlock;
+exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = void 0;
 exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
 exports.bareModel = bareModel;
 exports.buildCodieConfig = buildCodieConfig;
@@ -63,26 +62,6 @@ const DEFAULT_NAMES = {
     "z-ai/glm-5.2": "GLM 5.2 · Fireworks ZDR",
     "moonshotai/kimi-k2.7-code": "Kimi K2.7 Code · Fireworks ZDR",
 };
-exports.CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
-/** Extract the private adapter marker used to carry a local block reason
- * across OpenCode's generic 500 boundary. The marker never contains prompt or
- * tool input — only the deterministic policy reason. */
-function extractCodieSecurityBlock(stderr) {
-    for (const line of stderr.split(/\r?\n/)) {
-        const markerIndex = line.indexOf(exports.CODIE_SECURITY_BLOCK_MARKER);
-        if (markerIndex < 0)
-            continue;
-        try {
-            const parsed = JSON.parse(line.slice(markerIndex + exports.CODIE_SECURITY_BLOCK_MARKER.length));
-            if (typeof parsed?.reason === "string" && parsed.reason.trim())
-                return parsed.reason.trim();
-        }
-        catch {
-            // Ignore malformed or foreign stderr and preserve the original runtime error.
-        }
-    }
-    return undefined;
-}
 /**
  * Pin non-interactive runs to the directory where `codie` was launched.
  * OpenCode can reuse a previously-known project instance; without an explicit

package/dist/codieRuntime.d.ts

@@ -1,5 +1,4 @@
 export declare const OPENCODE_RUNTIME_SPEC = "opencode-ai@1.18.4";
-export declare const OPENCODE_RUNTIME_VERSION: string;
 export declare const CODIE_MIN_NODE_MAJOR = 20;
 export type CodieRuntime = {
     kind: "ready";
@@ -9,21 +8,12 @@ export type CodieRuntime = {
     installDir: string;
     binary: string;
     spec: string;
-} | {
-    kind: "outdated";
-    installDir: string;
-    binary: string;
-    spec: string;
-    currentVersion: string;
-    expectedVersion: string;
 };
 export declare function codieRuntimeDir(stateDir: string): string;
-export declare function installedRuntimePackageJson(stateDir: string): string;
-export declare function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion, resolveBundled, }: {
+export declare function resolveCodieRuntime({ env, stateDir, existsSync, resolveBundled, }: {
     env: Record<string, string | undefined>;
     stateDir: string;
     existsSync: (candidate: string) => boolean;
-    readInstalledVersion?: (packageJson: string) => string | null;
     resolveBundled: () => string | null;
 }): CodieRuntime;
 export declare function assertCodieNodeVersion(version: string): void;

package/dist/codieRuntime.js

@@ -43,9 +43,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CODIE_MIN_NODE_MAJOR = exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC = void 0;
+exports.CODIE_MIN_NODE_MAJOR = exports.OPENCODE_RUNTIME_SPEC = void 0;
 exports.codieRuntimeDir = codieRuntimeDir;
-exports.installedRuntimePackageJson = installedRuntimePackageJson;
 exports.resolveCodieRuntime = resolveCodieRuntime;
 exports.assertCodieNodeVersion = assertCodieNodeVersion;
 const path = __importStar(require("path"));
@@ -53,7 +52,6 @@ const path = __importStar(require("path"));
 // recognizes byte-for-byte, so a floating version would silently regress the
 // terminal branding whenever OpenCode ships a new build.
 exports.OPENCODE_RUNTIME_SPEC = "opencode-ai@1.18.4";
-exports.OPENCODE_RUNTIME_VERSION = exports.OPENCODE_RUNTIME_SPEC.slice(exports.OPENCODE_RUNTIME_SPEC.lastIndexOf("@") + 1);
 // The harness needs 20; capture does not. package.json `engines` stays >=18 so
 // `codiedev connect` still installs for Node 18 users — this floor is enforced
 // at `codie` launch instead.
@@ -64,10 +62,7 @@ function codieRuntimeDir(stateDir) {
 function installedBinary(stateDir) {
     return path.join(codieRuntimeDir(stateDir), "node_modules", "opencode-ai", "bin", "opencode.exe");
 }
-function installedRuntimePackageJson(stateDir) {
-    return path.join(codieRuntimeDir(stateDir), "node_modules", "opencode-ai", "package.json");
-}
-function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion, resolveBundled, }) {
+function resolveCodieRuntime({ env, stateDir, existsSync, resolveBundled, }) {
     // 1. Explicit override — the air-gapped / pre-provisioned escape hatch.
     const override = env.CODIEDEV_OPENCODE_BINARY?.trim();
     if (override) {
@@ -83,20 +78,8 @@ function resolveCodieRuntime({ env, stateDir, existsSync, readInstalledVersion,
         return { kind: "ready", binary: bundled };
     // 3. The lazily installed engine.
     const binary = installedBinary(stateDir);
-    if (existsSync(binary)) {
-        const currentVersion = readInstalledVersion?.(installedRuntimePackageJson(stateDir)) ?? null;
-        if (currentVersion && currentVersion !== exports.OPENCODE_RUNTIME_VERSION) {
-            return {
-                kind: "outdated",
-                installDir: codieRuntimeDir(stateDir),
-                binary,
-                spec: exports.OPENCODE_RUNTIME_SPEC,
-                currentVersion,
-                expectedVersion: exports.OPENCODE_RUNTIME_VERSION,
-            };
-        }
+    if (existsSync(binary))
         return { kind: "ready", binary };
-    }
     return { kind: "missing", installDir: codieRuntimeDir(stateDir), binary, spec: exports.OPENCODE_RUNTIME_SPEC };
 }
 function assertCodieNodeVersion(version) {

package/dist/codieRuntimeInstall.d.ts

@@ -1,10 +1,9 @@
 import { CodieRuntime } from "./codieRuntime";
-type InstallableCodieRuntime = Exclude<CodieRuntime, {
-    kind: "ready";
-}>;
 export declare function buildRuntimeInstallArgs(stagingDir: string, spec: string): string[];
 export interface InstallDeps {
-    runtime: InstallableCodieRuntime;
+    runtime: Extract<CodieRuntime, {
+        kind: "missing";
+    }>;
     makeStagingDir: () => string;
     run: (args: string[]) => {
         status: number | null;
@@ -16,13 +15,13 @@ export interface InstallDeps {
     log: (message: string) => void;
 }
 export declare function installCodieRuntime(deps: InstallDeps): void;
-export declare function ensureCodieRuntimeBinary({ resolve, install, confirmUpdate, }: {
+export declare function ensureCodieRuntimeBinary({ resolve, install, }: {
     resolve: () => CodieRuntime;
-    install: (runtime: InstallableCodieRuntime) => void;
-    confirmUpdate?: (runtime: Extract<CodieRuntime, {
-        kind: "outdated";
-    }>) => Promise<boolean>;
-}): Promise<string>;
-export declare function installCodieRuntimeOnDisk(runtime: InstallableCodieRuntime, stateDir: string): void;
+    install: (runtime: Extract<CodieRuntime, {
+        kind: "missing";
+    }>) => void;
+}): string;
+export declare function installCodieRuntimeOnDisk(runtime: Extract<CodieRuntime, {
+    kind: "missing";
+}>, stateDir: string): void;
 export declare function defaultStagingRoot(): string;
-export {};

package/dist/codieRuntimeInstall.js

@@ -98,12 +98,10 @@ function installCodieRuntime(deps) {
     }
 }
 // Resolve the engine, downloading it once if this is the first `codie` run.
-async function ensureCodieRuntimeBinary({ resolve, install, confirmUpdate = async () => false, }) {
+function ensureCodieRuntimeBinary({ resolve, install, }) {
     const runtime = resolve();
     if (runtime.kind === "ready")
         return runtime.binary;
-    if (runtime.kind === "outdated" && !(await confirmUpdate(runtime)))
-        return runtime.binary;
     install(runtime);
     return runtime.binary;
 }

package/dist/commands/doctor.js

@@ -45,8 +45,6 @@ const version_1 = require("../version");
 const upgradeNudge_1 = require("../upgradeNudge");
 const captureReadiness_1 = require("../captureReadiness");
 const captureLog_1 = require("../captureLog");
-const securityDoctor_1 = require("../securityDoctor");
-const securityFeature_1 = require("../securityFeature");
 const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
 const CLAUDE_INSTRUCTIONS_PATH = path.join(os.homedir(), ".claude", "CLAUDE.md");
 const CODEX_HOOKS_PATH = path.join(os.homedir(), ".codex", "hooks.json");
@@ -484,12 +482,6 @@ async function runDoctor(_args) {
             detail: "not installed on this machine",
         });
     }
-    // Agent Security is part of installation health, not a separate setup
-    // concept. Keep `codiedev security doctor` as an alias for focused output,
-    // while the main doctor remains the one command users need to remember.
-    if ((0, securityFeature_1.isAgentSecurityEnabled)(config)) {
-        checks.push(...(0, securityDoctor_1.securityDoctorChecks)((0, securityDoctor_1.collectSecurityDoctorReport)(config.companyId)));
-    }
     // 8. gh / glab CLIs (optional — only needed for reverse-ticket from a
     // specific PR/MR URL; branch mode works without either).
     checks.push({

package/dist/connect.js

@@ -39,16 +39,11 @@ const https = __importStar(require("https"));
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
 const utils_1 = require("./utils");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
 const shared_1 = require("./commands/shared");
-const securityInstall_1 = require("./securityInstall");
-const securityPolicy_1 = require("./securityPolicy");
-const securityFeature_1 = require("./securityFeature");
 // cli.codiedev.com is a Convex custom domain on the prod deployment; the
 // underlying judicious-falcon-861.convex.site URL keeps serving, so configs
 // written by older CLI versions stay valid without a re-connect.
@@ -205,7 +200,6 @@ async function runConnect(args = []) {
     // Extract fields from response
     const companyId = responseData.companyId;
     const companyName = responseData.companyName;
-    const agentSecurityEnabled = responseData.agentSecurityEnabled === true;
     const repos = responseData.repos ?? [];
     if (!companyId || !companyName) {
         console.error("\nError: Invalid response from server. Token may be invalid.");
@@ -218,7 +212,6 @@ async function runConnect(args = []) {
         repos,
         lastSynced: new Date().toISOString(),
         backendUrl: BACKEND_URL,
-        agentSecurityEnabled,
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
@@ -287,16 +280,6 @@ async function runConnect(args = []) {
     // /api/cli/markInstalled so the portal's "Connected" state reflects
     // what's actually wired up on this machine, not just "token validated."
     const installedTargets = [];
-    const home = os.homedir();
-    const securityConfigPaths = [
-        path.join(home, ".claude", "settings.json"),
-        path.join(home, ".codex", "hooks.json"),
-        path.join(home, ".config", "opencode", "plugins", "codiedev.js"),
-        path.join(home, ".codex", "config.toml"),
-    ];
-    // Snapshot before any hook update. Rollback is intentionally not automatic:
-    // an administrator can inspect these 0600 copies before restoring them.
-    const securitySnapshot = (0, securityInstall_1.createSecurityInstallSnapshot)(securityConfigPaths);
     // Wrap each per-target write so we emit one install_target row each. The
     // existing user-visible behavior (console.warn on failure, continue) is
     // unchanged — telemetry just observes the outcome.
@@ -319,11 +302,11 @@ async function runConnect(args = []) {
         }
     };
     if (hasClaude) {
-        runInstall("claude-code-hook", () => (0, utils_1.installHook)(agentSecurityEnabled), "Claude Code SessionEnd (capture) + UserPromptSubmit (skill discovery) + Stop (auto-backup) hooks (~/.claude/settings.json)", "claudeCode-hook");
+        runInstall("claude-code-hook", utils_1.installHook, "Claude Code SessionEnd (capture) + UserPromptSubmit (skill discovery) + Stop (auto-backup) hooks (~/.claude/settings.json)", "claudeCode-hook");
         runInstall("claude-code-instructions", utils_1.installClaudeCodeInstructions, "Claude Code agent instructions (~/.claude/CLAUDE.md)", "claudeCode-instructions");
     }
     if (hasCodex) {
-        runInstall("codex-hook", () => (0, utils_1.installCodexHook)(agentSecurityEnabled), "Codex Stop (capture + auto-backup) hooks (~/.codex/hooks.json)", "codex-hook");
+        runInstall("codex-hook", utils_1.installCodexHook, "Codex Stop (capture + auto-backup) hooks (~/.codex/hooks.json)", "codex-hook");
         runInstall("codex-instructions", utils_1.installCodexInstructions, "Codex agent instructions (~/.codex/AGENTS.md)", "codex-instructions");
     }
     if (hasCursor) {
@@ -333,36 +316,7 @@ async function runConnect(args = []) {
     // Always stage the adapter. It is dormant until OpenCode starts, which lets
     // a user connect Claude Code today and install the Codie harness tomorrow
     // without needing a second setup ritual.
-    runInstall("opencode-capture-adapter", () => (0, utils_1.installOpenCodeCapturePlugin)(agentSecurityEnabled), "OpenCode session capture adapter (~/.config/opencode/plugins/codiedev.js)", "opencode-capture");
-    // Record the exact installed hook bytes and the pre-update rollback files.
-    // This supplies health/integrity checks without requiring a package publish
-    // or trusting whichever `node` happens to be first on PATH later.
-    try {
-        const hookScriptPath = path.join(__dirname, "hook.js");
-        if (agentSecurityEnabled && fs.existsSync(hookScriptPath)) {
-            const targets = [];
-            if (installedTargets.includes("claudeCode-hook"))
-                targets.push({ surface: "claude-code", configPath: securityConfigPaths[0] });
-            if (installedTargets.includes("codex-hook"))
-                targets.push({ surface: "codex", configPath: securityConfigPaths[1] });
-            if (installedTargets.includes("opencode-capture"))
-                targets.push({ surface: "codie-harness", configPath: securityConfigPaths[2] });
-            (0, securityInstall_1.writeSecurityInstallManifest)({ hookScriptPath, snapshot: securitySnapshot, targets });
-        }
-    }
-    catch (err) {
-        console.warn(`Warning: Security hooks installed, but integrity manifest could not be written — ${err.message}`);
-    }
-    // Prime the local cache after installation. Hooks read this file only, so
-    // an endpoint decision never depends on live network latency.
-    if (agentSecurityEnabled) {
-        try {
-            await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
-        }
-        catch (err) {
-            console.warn(`Warning: Agent-security policy will use safe defaults until sync succeeds — ${err.message}`);
-        }
-    }
+    runInstall("opencode-capture-adapter", utils_1.installOpenCodeCapturePlugin, "OpenCode session capture adapter (~/.config/opencode/plugins/codiedev.js)", "opencode-capture");
     // Tell the backend which targets we wired up so the portal's onboarding
     // card flips to "Connected" only when something actually installed —
     // not on bare token validation. Best-effort: a network failure here
@@ -401,8 +355,5 @@ async function runConnect(args = []) {
     }
     console.log();
     console.log("Run `codiedev doctor` to verify everything's wired up.");
-    if ((0, securityFeature_1.isAgentSecurityEnabled)(config)) {
-        console.log("Run `codiedev security pilot` to validate blocking safely.");
-    }
     console.log();
 }