codiedev 0.9.51 → 0.9.53

package/dist/codieStartup.js

@@ -1,29 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.refreshCodieSecurityPolicy = refreshCodieSecurityPolicy;
-const securityFeature_1 = require("./securityFeature");
-const securityPolicy_1 = require("./securityPolicy");
-/** Refresh the endpoint policy before Codie hands the terminal to OpenCode.
- * Enforcement remains available offline because hooks keep using the last
- * verified company-scoped policy when this best-effort refresh cannot land. */
-async function refreshCodieSecurityPolicy(config, syncPolicy = securityPolicy_1.syncEndpointSecurityPolicy) {
-    if (!(0, securityFeature_1.isAgentSecurityEnabled)(config))
-        return { status: "disabled" };
-    if (!config.backendUrl || !config.token || !config.companyId) {
-        return { status: "cached", error: "connected account details are incomplete" };
-    }
-    try {
-        const policy = await syncPolicy({
-            backendUrl: config.backendUrl,
-            token: config.token,
-            companyId: config.companyId,
-        }, "codie-harness");
-        return { status: "synced", policy };
-    }
-    catch (error) {
-        return {
-            status: "cached",
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-}

package/dist/commands/post.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runPost(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/post.js

@@ -1,96 +0,0 @@
-"use strict";
-// `codiedev post --title ... --body ... [--intent share|...] [--filename ...]
-// [--mention NAME ...] [--tag X ...]` — publish to the team feed. Intended
-// for broad-team reach: announcing a skill, asking who knows about X,
-// proposing a change. Use `codiedev send` to address a single teammate.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runPost = runPost;
-const shared_1 = require("./shared");
-const VALID_INTENTS = new Set([
-    "share",
-    "request_review",
-    "request_expertise",
-    "link_share",
-    "rfc",
-]);
-const VALID_FORMATS = new Set(["article", "quick", "workflow", "review"]);
-function parseArgs(args) {
-    let title;
-    let body;
-    let intent;
-    let filename;
-    let format;
-    const mentions = [];
-    const tags = [];
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        const next = (k) => a === k && i + 1 < args.length ? args[++i] : a.startsWith(k + "=") ? a.slice(k.length + 1) : undefined;
-        let v;
-        if ((v = next("--title")) !== undefined)
-            title = v;
-        else if ((v = next("--body")) !== undefined)
-            body = v;
-        else if ((v = next("--intent")) !== undefined)
-            intent = v;
-        else if ((v = next("--filename")) !== undefined)
-            filename = v;
-        else if ((v = next("--format")) !== undefined)
-            format = v;
-        else if ((v = next("--mention")) !== undefined)
-            mentions.push(v);
-        else if ((v = next("--tag")) !== undefined)
-            tags.push(v);
-    }
-    if (!title || !title.trim()) {
-        console.error('Usage: codiedev post --title "<title>" --body "<body>" [--intent share|request_review|request_expertise|link_share|rfc] [--filename <key>] [--mention <name>]...');
-        process.exit(1);
-    }
-    if (!body || !body.trim()) {
-        console.error("--body required");
-        process.exit(1);
-    }
-    if (intent && !VALID_INTENTS.has(intent)) {
-        console.error(`Invalid --intent. Valid: ${[...VALID_INTENTS].join(", ")}`);
-        process.exit(1);
-    }
-    if (format && !VALID_FORMATS.has(format)) {
-        console.error(`Invalid --format. Valid: ${[...VALID_FORMATS].join(", ")}`);
-        process.exit(1);
-    }
-    return { title, body, intent, filename, format, mentions, tags };
-}
-async function runPost(args, configOverride) {
-    const parsed = parseArgs(args);
-    const config = configOverride ?? (0, shared_1.requireConfig)();
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/post-to-feed", {
-            config,
-            body: {
-                title: parsed.title,
-                body: parsed.body,
-                intent: parsed.intent,
-                filename: parsed.filename,
-                format: parsed.format,
-                mentions: parsed.mentions.length > 0 ? parsed.mentions : undefined,
-                tags: parsed.tags.length > 0 ? parsed.tags : undefined,
-            },
-        });
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_post_to_feed",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        console.log(`Posted to the team feed${res.postId ? ` (id: ${res.postId})` : ""}.`);
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_post_to_feed",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Post failed: ${err.message}`);
-        process.exit(1);
-    }
-}

package/dist/commands/security.d.ts

@@ -1 +0,0 @@
-export declare function runSecurityCommand(args: string[]): Promise<void>;

package/dist/commands/security.js

@@ -1,156 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runSecurityCommand = runSecurityCommand;
-const securityInstall_1 = require("../securityInstall");
-const securityPilot_1 = require("../securityPilot");
-const securityPolicy_1 = require("../securityPolicy");
-const securityInventory_1 = require("../securityInventory");
-const securityDeepScan_1 = require("../securityDeepScan");
-const utils_1 = require("../utils");
-const securityDoctor_1 = require("../securityDoctor");
-const securityFeature_1 = require("../securityFeature");
-const SECURITY_USAGE = "Usage: codiedev security <doctor|pilot|inventory|scan|sync|rollback> [--json] [--deep] [--connect-mcp] [--supply-chain] [--no-upload] [--yes]";
-function printPilot(json) {
-    const report = (0, securityPilot_1.runSyntheticSecurityPilot)();
-    if (json) {
-        console.log(JSON.stringify(report, null, 2));
-        return report.ok;
-    }
-    console.log("\nCodiedev security pilot — synthetic, side-effect-free validation\n");
-    for (const item of report.cases) {
-        console.log(`${item.passed ? "✓" : "✗"} ${item.surface}: ${item.name} (${item.actual})`);
-    }
-    console.log(`\n${report.ok ? "PASS" : "FAIL"}: ${report.cases.filter((item) => item.passed).length}/${report.cases.length} policy checks matched.`);
-    console.log("No commands were executed and no real credentials were used.\n");
-    return report.ok;
-}
-function printDoctor(json, companyId) {
-    const result = (0, securityDoctor_1.collectSecurityDoctorReport)(companyId);
-    if (json) {
-        console.log(JSON.stringify(result, null, 2));
-        return result.ok;
-    }
-    console.log("\nCodiedev doctor — Agent Security details\n");
-    for (const check of (0, securityDoctor_1.securityDoctorChecks)(result)) {
-        const mark = check.status === "pass" ? "✓" : check.status === "warn" ? "!" : "✗";
-        console.log(`${mark} ${check.name}: ${check.detail}`);
-    }
-    console.log(`\n${result.ok ? "PASS" : "FAIL"}: ${result.ok ? "endpoint security is healthy" : "run `codiedev connect`, then repeat this check"}.\n`);
-    return result.ok;
-}
-async function runSecurityCommand(args) {
-    const subcommand = args.find((arg) => !arg.startsWith("-")) ?? "doctor";
-    const json = args.includes("--json");
-    if (args.includes("--help") || args.includes("-h") || subcommand === "help") {
-        console.log(SECURITY_USAGE);
-        return;
-    }
-    const connectedConfig = (0, utils_1.readConfig)();
-    const requiresEntitlement = !["pilot", "self-test"].includes(subcommand);
-    if (requiresEntitlement && (!connectedConfig || !(0, securityFeature_1.isAgentSecurityEnabled)(connectedConfig))) {
-        const detail = connectedConfig
-            ? `Agent Security is not enabled for ${connectedConfig.companyName}.`
-            : "Not connected. Run `codiedev connect` first.";
-        if (json)
-            console.log(JSON.stringify({ schemaVersion: 1, enabled: false, detail }, null, 2));
-        else
-            console.log(`\n${detail}\n`);
-        return;
-    }
-    if (subcommand === "inventory" || subcommand === "scan") {
-        const workspaceFlag = args.indexOf("--workspace");
-        const workspace = workspaceFlag >= 0 && args[workspaceFlag + 1]
-            ? args[workspaceFlag + 1]
-            : process.cwd();
-        const inventory = (0, securityInventory_1.buildSecurityInventory)({ workspace });
-        const deep = subcommand === "scan" && args.includes("--deep")
-            ? (0, securityDeepScan_1.runDeepSecurityScan)(inventory, {
-                workspace,
-                connectMcp: args.includes("--connect-mcp"),
-                supplyChain: args.includes("--supply-chain"),
-            })
-            : undefined;
-        const uploadableInventory = deep ? (0, securityDeepScan_1.mergeDeepScanFindings)(inventory, deep) : inventory;
-        let upload;
-        const config = (0, utils_1.readConfig)();
-        if (config && !args.includes("--no-upload")) {
-            try {
-                upload = await (0, securityInventory_1.uploadSecurityInventory)(uploadableInventory, config);
-            }
-            catch (error) {
-                if (!json)
-                    console.warn(`Inventory upload failed; local scan is still valid: ${error.message}`);
-            }
-        }
-        const output = { inventory: uploadableInventory, scanners: (0, securityInventory_1.scannerAvailability)(), ...(deep ? { deep } : {}), ...(upload ? { upload } : {}) };
-        if (json)
-            console.log(JSON.stringify(output, null, 2));
-        else {
-            const risky = inventory.components.filter((component) => component.findings.length > 0).length;
-            console.log(`\nCodiedev security inventory — ${inventory.components.length} components, ${risky} with local findings, ${inventory.drift.length} changed\n`);
-            const counts = new Map();
-            for (const component of inventory.components)
-                counts.set(component.kind, (counts.get(component.kind) ?? 0) + 1);
-            for (const [kind, count] of [...counts].sort())
-                console.log(`  ${kind}: ${count}`);
-            if (deep)
-                for (const run of deep.runs)
-                    console.log(`  ${run.scanner}: ${run.status} — ${run.detail}`);
-            if (upload)
-                console.log(`\nUploaded ${upload.accepted} component records to the security workspace.`);
-            console.log("\nUse --json for machine-readable hashes and findings. Use scan --deep for installed OSS scanners; --connect-mcp and --supply-chain are explicit because they start or download third-party code.\n");
-        }
-        return;
-    }
-    if (subcommand === "sync") {
-        const config = (0, utils_1.readConfig)();
-        if (!config) {
-            console.error("Not connected. Run `codiedev connect` first.");
-            process.exitCode = 1;
-            return;
-        }
-        try {
-            const policy = await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
-            if (json)
-                console.log(JSON.stringify({ ok: true, policy }, null, 2));
-            else {
-                const verification = (0, securityPolicy_1.verifyEndpointSecurityPolicySignature)(policy);
-                console.log(`Security policy v${policy.policyVersion} synced (${policy.enforcementMode} mode; ${verification.detail}).`);
-            }
-        }
-        catch (error) {
-            console.error(`Security policy sync failed: ${error.message}`);
-            process.exitCode = 1;
-        }
-        return;
-    }
-    if (subcommand === "rollback") {
-        if (!args.includes("--yes")) {
-            console.error("Rollback overwrites the installed agent hook configurations. Re-run with `codiedev security rollback --yes` after confirming the snapshot shown by `codiedev doctor`.");
-            process.exitCode = 1;
-            return;
-        }
-        try {
-            const result = (0, securityInstall_1.restoreSecurityInstallSnapshot)((0, securityInstall_1.readSecurityInstallManifest)());
-            if (json)
-                console.log(JSON.stringify({ schemaVersion: 1, ok: true, ...result }, null, 2));
-            else
-                console.log(`Restored ${result.restored} hook configuration(s) from snapshot ${result.snapshotId}.`);
-        }
-        catch (error) {
-            console.error(`Rollback failed: ${error.message}`);
-            process.exitCode = 1;
-        }
-        return;
-    }
-    const ok = subcommand === "pilot" || subcommand === "self-test"
-        ? printPilot(json)
-        : subcommand === "doctor" || subcommand === "status"
-            ? printDoctor(json, connectedConfig.companyId)
-            : false;
-    if (!["pilot", "self-test", "doctor", "status"].includes(subcommand)) {
-        console.error(SECURITY_USAGE);
-    }
-    if (!ok)
-        process.exitCode = 1;
-}

package/dist/security.d.ts

@@ -1,97 +0,0 @@
-export type SecurityHookPhase = "pre" | "post" | "failure";
-export type AgentSurface = "claude-code" | "codex" | "codie-harness";
-export interface RawSecurityHookInput {
-    session_id?: string;
-    sessionId?: string;
-    cwd?: string;
-    hook_event_name?: string;
-    hookEventName?: string;
-    tool_name?: string;
-    toolName?: string;
-    tool_input?: unknown;
-    toolInput?: unknown;
-    tool_response?: unknown;
-    toolResponse?: unknown;
-    tool_use_id?: string;
-    toolUseId?: string;
-    duration_ms?: number;
-    durationMs?: number;
-    error?: unknown;
-    prompt?: string;
-}
-export interface SecurityWorkflowEvent {
-    schemaVersion: 1;
-    source: AgentSurface;
-    phase: SecurityHookPhase;
-    sessionId: string;
-    toolName: string;
-    toolUseId?: string;
-    cwd?: string;
-    observedAt: number;
-    toolDurationMs?: number;
-    payload: unknown;
-    redactionCount: number;
-    localDecision?: LocalSecurityAction;
-    localCategory?: LocalSecurityDecision["category"];
-    endpointId?: string;
-    endpointName?: string;
-    cliVersion?: string;
-}
-export type LocalSecurityAction = "allow" | "alert" | "block";
-export type SecurityCategory = "secret_in_prompt" | "secret_exfiltration" | "destructive_outside_workspace" | "sensitive_file_read" | "sensitive_file_write" | "protected_agent_config_write" | "unapproved_network_egress" | "untrusted_mcp_tool" | "unapproved_command" | "obfuscated_shell_command" | "package_install" | "sensitive_read_then_egress";
-export interface EndpointSecurityPolicy {
-    schemaVersion: 1;
-    policyVersion: number;
-    enforcementMode: "alert" | "block";
-    rules: Partial<Record<SecurityCategory, LocalSecurityAction>>;
-    constraints?: {
-        allowedMcpServers?: string[];
-        allowedHosts?: string[];
-        allowedCommands?: string[];
-    };
-    exceptions: Array<{
-        scope: "company" | "user" | "source" | "repository" | "tool" | "category";
-        scopeValue: string;
-    }>;
-    fetchedAt: number;
-    signature?: {
-        algorithm: "Ed25519";
-        keyId: string;
-        signedAt: number;
-        value: string;
-    };
-}
-export interface LocalSecurityDecision {
-    action: LocalSecurityAction;
-    category?: SecurityCategory;
-    reason?: string;
-}
-export declare function withEndpointIdentity(event: SecurityWorkflowEvent, identity: {
-    endpointId?: string;
-    endpointName?: string;
-    cliVersion?: string;
-}): SecurityWorkflowEvent;
-/**
- * Runs before a user prompt reaches the model. This is intentionally narrow:
- * block credential material, but allow safe references such as
- * `$OPENAI_API_KEY` so developers can ask agents to use environment variables
- * without pasting their values.
- */
-export declare function evaluatePromptSecurity(prompt: string | undefined, policy?: EndpointSecurityPolicy, source?: AgentSurface): LocalSecurityDecision;
-/** Runs synchronously before a tool executes. No network or model is involved. */
-export declare function evaluateToolSecurity(input: RawSecurityHookInput, phase: SecurityHookPhase, policy?: EndpointSecurityPolicy, source?: AgentSurface, sessionContext?: {
-    sensitiveReadAt?: number;
-    now?: number;
-}): LocalSecurityDecision;
-export declare function securityInputHasSensitivePath(input: RawSecurityHookInput): boolean;
-export declare function buildSecurityWorkflowEvent(input: RawSecurityHookInput, phase: SecurityHookPhase, source: AgentSurface, now?: () => number): SecurityWorkflowEvent | null;
-/**
- * Captures the intent side of the causal chain without weakening the local
- * privacy boundary. A prompt that the deterministic policy blocks never
- * becomes an uploadable event; allowed prompts are redacted and bounded using
- * the same sanitizer as tool payloads.
- */
-export declare function buildSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd" | "prompt">, source: AgentSurface, now?: () => number, policy?: EndpointSecurityPolicy): SecurityWorkflowEvent | null;
-/** Audit-safe evidence for a blocked prompt. The secret-bearing prompt is
- * intentionally omitted; administrators still see that prevention occurred. */
-export declare function buildBlockedSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd">, source: AgentSurface, category: NonNullable<LocalSecurityDecision["category"]>, now?: () => number): SecurityWorkflowEvent | null;