codiedev 0.9.56 → 0.10.0-beta.2

package/dist/utils.js

@@ -64,6 +64,7 @@ exports.openCodeInstalled = openCodeInstalled;
 exports.installOpenCodeCapturePlugin = installOpenCodeCapturePlugin;
 exports.vscodeCopilotInstalled = vscodeCopilotInstalled;
 exports.upsertCodiedevHook = upsertCodiedevHook;
+exports.removeCodiedevHook = removeCodiedevHook;
 exports.installHook = installHook;
 exports.ensureDiscoveryHookInstalled = ensureDiscoveryHookInstalled;
 exports.ensureBackupHookInstalled = ensureBackupHookInstalled;
@@ -858,7 +859,7 @@ function buildCapturePayload(input) {
         sessionStartedAt: input.sessionStartedAt ?? undefined,
         interruptCount: input.interruptCount,
         rejectionCount: input.rejectionCount,
-        // final is only emitted when explicitly set (not for Codex).
+        // final is only emitted when explicitly set (omitted for Codex Stop).
         final: input.final,
         costUsd: input.costUsd,
     };
@@ -1058,11 +1059,15 @@ function openCodeInstalled() {
 /** Install a dormant global OpenCode adapter. Installing it unconditionally
  * keeps `codiedev connect` as the only setup step even when Codie/OpenCode is
  * installed later. OpenCode loads this file from its documented plugin dir. */
-function installOpenCodeCapturePlugin() {
+function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
     const start = resolveHookInvocation("session-start-opencode");
     const capture = resolveHookInvocation("capture-opencode");
     const finish = resolveHookInvocation("capture-opencode-final");
+    const backup = resolveHookInvocation("backup");
     const prompt = resolveHookInvocation("discover-codie");
+    const securityPre = resolveHookInvocation("security-pre-codie");
+    const securityPost = resolveHookInvocation("security-post-codie");
+    const securityFailure = resolveHookInvocation("security-failure-codie");
     const source = `// Managed by codiedev connect. Safe to remove and reinstall.\n` +
         `import { spawn, spawnSync } from "node:child_process";\n` +
         `import { mkdir, writeFile } from "node:fs/promises";\n` +
@@ -1071,9 +1076,15 @@ function installOpenCodeCapturePlugin() {
         `const START = ${JSON.stringify(start)};\n` +
         `const CAPTURE = ${JSON.stringify(capture)};\n` +
         `const FINISH = ${JSON.stringify(finish)};\n` +
+        `const BACKUP = ${JSON.stringify(backup)};\n` +
         `const PROMPT = ${JSON.stringify(prompt)};\n` +
+        `const SECURITY_PRE = ${JSON.stringify(securityPre)};\n` +
+        `const SECURITY_POST = ${JSON.stringify(securityPost)};\n` +
+        `const SECURITY_FAILURE = ${JSON.stringify(securityFailure)};\n` +
+        `const AGENT_SECURITY_ENABLED = ${JSON.stringify(agentSecurityEnabled)};\n` +
         `const fingerprints = new Map();\n\n` +
         `const transcriptPaths = new Map();\n\n` +
+        `const sessionDirectories = new Map();\n\n` +
         `function sessionId(event) {\n` +
         `  return event?.properties?.sessionID ?? event?.properties?.sessionId ?? event?.properties?.info?.id ?? null;\n` +
         `}\n\n` +
@@ -1095,9 +1106,36 @@ function installOpenCodeCapturePlugin() {
         `  } catch { return null; }\n` +
         `}\n\n` +
         `export const CodiedevCapture = async ({ client, directory, worktree }) => {\n` +
+        `  const enforce = async (invocation, payload) => {\n` +
+        `    const decision = invokeSync(invocation, payload);\n` +
+        `    const denied = decision?.decision === "block" || decision?.hookSpecificOutput?.permissionDecision === "deny";\n` +
+        `    const reason = denied ? (decision?.reason || decision?.hookSpecificOutput?.permissionDecisionReason || "Codie security policy blocked this action") : null;\n` +
+        `    if (!reason) return decision;\n` +
+        `    try { await client.tui.showToast({ title: "Codie Security", message: reason, variant: "error", duration: 10000 }); } catch {}\n` +
+        `    if (process.env.CODIEDEV_SECURITY_BLOCK_OUTPUT === "marker") {\n` +
+        `      process.stderr.write("__CODIEDEV_SECURITY_BLOCK__" + JSON.stringify({ reason }) + "\\n");\n` +
+        `      process.exit(1);\n` +
+        `    } else {\n` +
+        `      process.stderr.write("\\nCodie Security blocked this action:\\n" + reason + "\\n");\n` +
+        `    }\n` +
+        `    throw new Error(reason);\n` +
+        `  };\n` +
+        `  const resolveCwd = async (id, hint) => {\n` +
+        `    if (typeof hint === "string" && hint && hint !== "/") { sessionDirectories.set(id, hint); return hint; }\n` +
+        `    const remembered = sessionDirectories.get(id);\n` +
+        `    if (remembered) return remembered;\n` +
+        `    try {\n` +
+        `      const response = await client.session.get({ path: { id } });\n` +
+        `      const session = response?.data ?? response;\n` +
+        `      if (typeof session?.directory === "string" && session.directory) { sessionDirectories.set(id, session.directory); return session.directory; }\n` +
+        `    } catch {}\n` +
+        `    const fallback = worktree || directory || process.cwd();\n` +
+        `    sessionDirectories.set(id, fallback);\n` +
+        `    return fallback;\n` +
+        `  };\n` +
         `  const finalizeAll = () => {\n` +
         `    for (const [id, transcriptPath] of transcriptPaths) {\n` +
-        `      const cwd = worktree || directory || process.cwd();\n` +
+        `      const cwd = sessionDirectories.get(id) || worktree || directory || process.cwd();\n` +
         `      dispatchSync(FINISH, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
         `    }\n` +
         `  };\n` +
@@ -1105,16 +1143,29 @@ function installOpenCodeCapturePlugin() {
         `  return ({\n` +
         `  "chat.message": async (input, output) => {\n` +
         `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
-        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const cwd = await resolveCwd(id);\n` +
         `    const prompt = Array.isArray(output?.parts) ? output.parts.filter((part) => part?.type === "text").map((part) => part.text || "").join("\\n") : "";\n` +
-        `    const decision = invokeSync(PROMPT, { session_id: id, cwd, prompt });\n` +
+        `    const decision = await enforce(PROMPT, { session_id: id, cwd, prompt });\n` +
         `    const context = decision?.hookSpecificOutput?.additionalContext;\n` +
         `    if (context && Array.isArray(output?.parts)) output.parts.push({ type: "text", text: context });\n` +
         `  },\n` +
+        `  "tool.execute.before": async (input, output) => {\n` +
+        `    if (!AGENT_SECURITY_ENABLED) return;\n` +
+        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
+        `    const cwd = await resolveCwd(id);\n` +
+        `    await enforce(SECURITY_PRE, { sessionId: id, cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: output?.args ?? output });\n` +
+        `  },\n` +
+        `  "tool.execute.after": async (input, output) => {\n` +
+        `    if (!AGENT_SECURITY_ENABLED) return;\n` +
+        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
+        `    const cwd = await resolveCwd(id);\n` +
+        `    const payload = { sessionId: id, cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: input?.args, toolResponse: output };\n` +
+        `    dispatch(output?.error ? SECURITY_FAILURE : SECURITY_POST, payload);\n` +
+        `  },\n` +
         `  event: async ({ event }) => {\n` +
         `    const id = sessionId(event);\n` +
         `    if (!id) return;\n` +
-        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const cwd = await resolveCwd(id, event?.properties?.info?.directory);\n` +
         `    if (event.type === "session.created") {\n` +
         `      dispatch(START, { session_id: id, cwd, workspace_roots: [cwd] });\n` +
         `      return;\n` +
@@ -1123,6 +1174,7 @@ function installOpenCodeCapturePlugin() {
         `      const transcriptPath = transcriptPaths.get(id);\n` +
         `      if (transcriptPath) dispatch(FINISH, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
         `      transcriptPaths.delete(id);\n` +
+        `      sessionDirectories.delete(id);\n` +
         `      fingerprints.delete(id);\n` +
         `      return;\n` +
         `    }\n` +
@@ -1142,6 +1194,7 @@ function installOpenCodeCapturePlugin() {
         `      await writeFile(transcriptPath, JSON.stringify(list), { mode: 0o600 });\n` +
         `      transcriptPaths.set(id, transcriptPath);\n` +
         `      dispatch(CAPTURE, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
+        `      dispatch(BACKUP, { session_id: id, cwd, workspace_roots: [cwd] });\n` +
         `    } catch {}\n` +
         `  },\n` +
         `  });\n` +
@@ -1204,7 +1257,36 @@ function upsertCodiedevHook(hooks, eventName, subcommand, matcher = ".*") {
     });
     hooks[eventName] = filtered;
 }
-function installHook() {
+/** Remove Codiedev's entries for one event while preserving foreign hooks. */
+function removeCodiedevHook(hooks, eventName) {
+    const entries = hooks[eventName];
+    if (!Array.isArray(entries))
+        return false;
+    let changed = false;
+    const filtered = entries.flatMap((entry) => {
+        const record = entry;
+        const inner = record.hooks;
+        if (!Array.isArray(inner))
+            return [record];
+        const remaining = inner.filter((hook) => {
+            const remove = (0, detection_1.isCodiedevHookCommand)(hook.command);
+            if (remove)
+                changed = true;
+            return !remove;
+        });
+        if (remaining.length === 0)
+            return [];
+        return [{ ...record, hooks: remaining }];
+    });
+    if (!changed)
+        return false;
+    if (filtered.length === 0)
+        delete hooks[eventName];
+    else
+        hooks[eventName] = filtered;
+    return true;
+}
+function installHook(agentSecurityEnabled = true) {
     let settings = {};
     try {
         if (fs.existsSync(CLAUDE_SETTINGS_PATH)) {
@@ -1221,6 +1303,18 @@ function installHook() {
     const hooks = settings.hooks;
     // SessionEnd → capture (upload the finished session for the team library).
     upsertCodiedevHook(hooks, "SessionEnd", "capture");
+    // Tool boundaries → ADR shadow detection. PreToolUse is the eventual
+    // enforcement point; alert mode always returns allow.
+    if (agentSecurityEnabled) {
+        upsertCodiedevHook(hooks, "PreToolUse", "security-pre");
+        upsertCodiedevHook(hooks, "PostToolUse", "security-post");
+        upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure");
+    }
+    else {
+        removeCodiedevHook(hooks, "PreToolUse");
+        removeCodiedevHook(hooks, "PostToolUse");
+        removeCodiedevHook(hooks, "PostToolUseFailure");
+    }
     // UserPromptSubmit → discover (surface a matching team skill for the task).
     upsertCodiedevHook(hooks, "UserPromptSubmit", "discover");
     // Stop → backup (auto-back-up changed artifact files to your private library).
@@ -1322,7 +1416,7 @@ function ensureLimitHookInstalled() {
 //      shrinks that window and removes the intra-process version entirely.
 // The per-hook ensure* functions below are kept for tests/back-compat but are
 // no longer called from the hook entrypoint.
-function ensureAllCodiedevHooksInstalled() {
+function ensureAllCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?.agentSecurityEnabled === true) {
     try {
         if (!fs.existsSync(CLAUDE_SETTINGS_PATH))
             return; // not a Claude Code user
@@ -1335,8 +1429,17 @@ function ensureAllCodiedevHooksInstalled() {
             ["StopFailure", "limit", "rate_limit"],
             ["SessionStart", "session-start"],
         ];
+        if (agentSecurityEnabled) {
+            wanted.splice(1, 0, ["PreToolUse", "security-pre"], ["PostToolUse", "security-post"], ["PostToolUseFailure", "security-failure"]);
+        }
+        let changed = false;
+        if (!agentSecurityEnabled) {
+            for (const eventName of ["PreToolUse", "PostToolUse", "PostToolUseFailure"]) {
+                changed = removeCodiedevHook(hooks, eventName) || changed;
+            }
+        }
         const missing = wanted.filter(([eventName]) => !hasCodiedevHook(hooks, eventName));
-        if (missing.length === 0)
+        if (missing.length === 0 && !changed)
             return; // steady state: no write, no churn
         settings.hooks = hooks;
         for (const [eventName, subcommand, matcher] of missing) {
@@ -1751,7 +1854,7 @@ function installCodexMcp() {
 // Codex doesn't have a SessionEnd event yet — Stop fires after every turn.
 // The backend dedupes on (companyId, sessionId) and replaces the stored
 // transcript on re-upload, so the latest turn's snapshot wins.
-function installCodexHook() {
+function installCodexHook(agentSecurityEnabled = true) {
     let hooksFile = {};
     try {
         if (fs.existsSync(CODEX_HOOKS_PATH)) {
@@ -1766,9 +1869,8 @@ function installCodexHook() {
         hooksFile.hooks = {};
     }
     const hooks = hooksFile.hooks;
-    if (!hooks.Stop) {
+    if (!hooks.Stop)
         hooks.Stop = [];
-    }
     const existing = hooks.Stop;
     const filtered = existing.filter((hook) => {
         const inner = hook.hooks;
@@ -1776,6 +1878,9 @@ function installCodexHook() {
             return true;
         return !inner.some((h) => (0, detection_1.isCodiedevHookCommand)(h.command));
     });
+    // Codex has no StopFailure matcher. Its Stop transcript includes a
+    // structured rate-limit snapshot, so this tiny hook reports only when that
+    // snapshot says a boundary was reached.
     filtered.push({
         hooks: [
             {
@@ -1805,6 +1910,21 @@ function installCodexHook() {
         ],
     });
     hooks.Stop = filtered;
+    // Codex uses the same Claude-style matcher-group shape. Keep these as
+    // separate entries because Codex hook coverage is still evolving and a
+    // malformed/unavailable post hook must not interfere with PreToolUse.
+    if (agentSecurityEnabled) {
+        upsertCodiedevHook(hooks, "PreToolUse", "security-pre-codex");
+        upsertCodiedevHook(hooks, "PostToolUse", "security-post-codex");
+        upsertCodiedevHook(hooks, "PostToolUseFailure", "security-failure-codex");
+    }
+    else {
+        removeCodiedevHook(hooks, "PreToolUse");
+        removeCodiedevHook(hooks, "PostToolUse");
+        removeCodiedevHook(hooks, "PostToolUseFailure");
+    }
+    // Prompt guard + skill discovery. The guard runs locally before any prompt
+    // content can reach either the model or Codiedev's discovery endpoint.
     // Codex models UserPromptSubmit as a non-matcher event (the trust-key model
     // intentionally excludes it from MATCHER_EVENTS), so omit the matcher key.
     upsertCodiedevHook(hooks, "UserPromptSubmit", "discover-codex", null);
@@ -1862,7 +1982,7 @@ function ensureCodexLimitHookInstalled() {
 // `sessionEnd` fires when a conversation closes (completed, aborted, error,
 // window_close, user_close); the base stdin payload includes transcript_path
 // and session_id which `codiedev-hook capture-cursor` reads to upload.
-function installCursorHook() {
+function installCursorHook(agentSecurityEnabled = true) {
     if (!fs.existsSync(CURSOR_DIR)) {
         fs.mkdirSync(CURSOR_DIR, { recursive: true });
     }
@@ -1898,26 +2018,37 @@ function installCursorHook() {
         else
             hooks[eventName] = [...preserved, ...managed];
     };
+    // Cursor-native lifecycle names and flat hook entries. Capture only at the
+    // real IDE session boundary; backup at every completed agent turn. The
+    // Cursor-specific backup entrypoint keeps that non-final snapshot labeled
+    // and normalized as Cursor rather than accidentally treating it as Claude.
     replaceManaged("sessionStart", ["session-start-cursor"]);
     replaceManaged("sessionEnd", ["capture-cursor"]);
     replaceManaged("stop", ["backup-cursor"]);
-    // Cursor cannot inject dynamic context from beforeSubmitPrompt today.
-    // Remove older Codiedev discovery entries so prompts are not uploaded for
-    // a response the host will discard; preserve any third-party hooks.
-    replaceManaged("beforeSubmitPrompt", []);
+    if (agentSecurityEnabled) {
+        // Cursor supports blocking here, but not dynamic context injection.
+        replaceManaged("beforeSubmitPrompt", ["security-prompt-cursor"]);
+        replaceManaged("preToolUse", ["security-pre-cursor"]);
+        replaceManaged("postToolUse", ["security-post-cursor"]);
+        replaceManaged("postToolUseFailure", ["security-failure-cursor"]);
+    }
+    else {
+        replaceManaged("beforeSubmitPrompt", []);
+        replaceManaged("preToolUse", []);
+        replaceManaged("postToolUse", []);
+        replaceManaged("postToolUseFailure", []);
+    }
     fs.writeFileSync(CURSOR_HOOKS_PATH, JSON.stringify(hooksFile, null, 2), "utf8");
 }
-function ensureCursorCodiedevHooksInstalled() {
+/** Repair Cursor's complete flat hook set after upgrades or configuration
+ * drift. This is deliberately separate from Claude Code's nested-hook healer:
+ * the schemas and event names differ, and mixing them risks corrupting both. */
+function ensureCursorCodiedevHooksInstalled(agentSecurityEnabled = readConfig()?.agentSecurityEnabled === true) {
     try {
         if (!fs.existsSync(CURSOR_HOOKS_PATH))
             return;
         const parsed = JSON.parse(fs.readFileSync(CURSOR_HOOKS_PATH, "utf8"));
         const hooks = parsed.hooks ?? {};
-        const required = [
-            ["sessionStart", "session-start-cursor"],
-            ["sessionEnd", "capture-cursor"],
-            ["stop", "backup-cursor"],
-        ];
         const has = (eventName, subcommand) => {
             const entries = hooks[eventName];
             return Array.isArray(entries) && entries.some((entry) => {
@@ -1927,15 +2058,32 @@ function ensureCursorCodiedevHooksInstalled() {
                     && command.trim().endsWith(subcommand);
             });
         };
-        const promptEntries = hooks.beforeSubmitPrompt;
-        const hasStalePromptHook = Array.isArray(promptEntries) && promptEntries.some((entry) => (0, detection_1.isCodiedevHookCommand)(entry.command));
-        if (!required.every(([eventName, subcommand]) => has(eventName, subcommand)) ||
-            hasStalePromptHook) {
-            installCursorHook();
+        const required = [
+            ["sessionStart", "session-start-cursor"],
+            ["sessionEnd", "capture-cursor"],
+            ["stop", "backup-cursor"],
+            ...(agentSecurityEnabled
+                ? [
+                    ["beforeSubmitPrompt", "security-prompt-cursor"],
+                    ["preToolUse", "security-pre-cursor"],
+                    ["postToolUse", "security-post-cursor"],
+                    ["postToolUseFailure", "security-failure-cursor"],
+                ]
+                : []),
+        ];
+        const hasStaleSecurity = !agentSecurityEnabled && [
+            "beforeSubmitPrompt", "preToolUse", "postToolUse", "postToolUseFailure",
+        ].some((eventName) => {
+            const entries = hooks[eventName];
+            return Array.isArray(entries) && entries.some((entry) => (0, detection_1.isCodiedevHookCommand)(entry.command));
+        });
+        if (required.every(([eventName, subcommand]) => has(eventName, subcommand)) && !hasStaleSecurity) {
+            return;
         }
+        installCursorHook(agentSecurityEnabled);
     }
     catch {
-        // Best-effort repair only.
+        // Best-effort — a malformed third-party config must never block capture.
     }
 }
 function parseClaudeSteering(content) {
@@ -2254,6 +2402,8 @@ function normalizeOpenCodeTranscript(content) {
 //   {type:"response_item", payload:{type:"message", role, content:[{type:"input_text",text}|{type:"output_text",text}]}}
 //   {type:"response_item", payload:{type:"function_call", name, arguments, call_id}}
 //   {type:"response_item", payload:{type:"function_call_output", call_id, output}}
+//   {type:"response_item", payload:{type:"custom_tool_call", name, input, call_id}}
+//   {type:"response_item", payload:{type:"custom_tool_call_output", call_id, output}}
 //   {type:"event_msg", payload:{type:"token_count"|"agent_reasoning"|...}}
 //   {type:"turn_context", payload:{cwd, model, ...}}
 function parseCodexStats(content) {
@@ -2549,17 +2699,16 @@ exports.CAPTURE_THROTTLE_MS = 10 * 60 * 1000;
 // retry storms.
 exports.SWEEP_MIN_AGE_MS = exports.CAPTURE_THROTTLE_MS + 2 * 60 * 1000;
 // Map the hook's capture argv to the payload's `final` flag. EXPLICIT
-// ALLOWLIST: only claude-code's SessionEnd entrypoints ("capture", or the bare
-// hook with no subcommand) are a true final signal. capture-opencode/
+// ALLOWLIST: Claude Code and Cursor SessionEnd entrypoints are true final
+// signals. capture-opencode/
 // capture-desktop (per-turn snapshot) and capture-opencode-final/
 // capture-desktop-final (real session end) get an explicit false/true.
-// Cursor's capture-cursor is wired only to sessionEnd, so it is also a true
-// final signal. Everything else — capture-codex (Codex's Stop fires per-turn;
-// final:true would close the server-side session lease every turn) and any
-// FUTURE mode (e.g. a capture-windsurf added to resolveMode but not audited
-// here) — gets undefined, i.e. legacy server behaviour. Defaulting unknowns
-// to true would silently re-introduce the per-turn lease-close bug for every
-// new agent.
+// Everything else — capture-codex (Codex's Stop fires per-turn; final:true
+// would close the server-side session lease every turn), and any FUTURE mode
+// (e.g. a capture-windsurf added to resolveMode but not
+// audited here) — gets undefined, i.e. legacy server behaviour. Defaulting
+// unknowns to true would silently re-introduce the per-turn lease-close bug
+// for every new agent.
 function resolveCaptureFinal(argv2) {
     if (argv2 === "capture-opencode" || argv2 === "capture-desktop")
         return false;
@@ -2583,6 +2732,12 @@ function finishInputTmpFile(sessionId) {
     const safeId = String(sessionId ?? process.pid).replace(/[^A-Za-z0-9._-]/g, "_");
     return path.join(os.tmpdir(), `codiedev-finish-${safeId}-${process.pid}-${Date.now()}.json`);
 }
+// Immediate uploads must also own unique job files. A Codie/OpenCode runtime
+// emits idle + final captures almost simultaneously on process exit; when both
+// children shared codiedev-capture-<sid>.json, their uploader grandchildren
+// raced to read/unlink the same file and could lose the final handoff entirely.
+// Deferred uploads intentionally keep the stable per-session name because
+// overwriting it is how newer turns supersede older scheduled snapshots.
 function captureUploadTmpFile(sessionId, mode, pid = process.pid, now = Date.now()) {
     const id = String(sessionId ?? pid).replace(/[^A-Za-z0-9._-]/g, "_");
     return path.join(os.tmpdir(), mode === "immediate"
@@ -2767,6 +2922,14 @@ async function runCaptureUpload(jobFile, deps) {
             const { storageId } = await deps.uploadBytes(uploadUrl, Buffer.from(transcript, "base64"), "application/json");
             body = { ...body, transcriptStorageId: storageId };
             delete body.transcript;
+            // Persist the storage id before the metadata POST. Previously a failed
+            // captureSession request retried the entire direct upload, creating one
+            // unreferenced raw transcript blob per attempt. Once the PUT succeeds,
+            // every retry must reuse that exact blob.
+            job.body = body;
+            if (deps.writeFileSync) {
+                deps.writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });
+            }
         }
         await deps.post(job.url, body, job.token);
         // success — drop a "last session captured" breadcrumb (before removing the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.56",
+  "version": "0.10.0-beta.2",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -15,6 +15,9 @@
     "test:functional": "vitest run src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts",
     "test:harness-parity": "vitest run src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts",
     "test:harness-binaries": "node scripts/checkHarnessBinaries.mjs",
+    "test:security-beta": "vitest run src/__tests__/security.test.ts src/__tests__/securityCommandEntitlement.test.ts src/__tests__/securityDeepScan.test.ts src/__tests__/securityDoctor.test.ts src/__tests__/securityEntitlementInstall.test.ts src/__tests__/securityFeature.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityInventory.test.ts src/__tests__/securityPilot.test.ts src/__tests__/securityPolicy.test.ts src/__tests__/securitySession.test.ts src/__tests__/codexHookTrust.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts src/__tests__/limitEvent.functional.test.ts && tsc && node dist/cli.js security pilot --json",
+    "test:security-pilot": "vitest run src/__tests__/security.test.ts src/__tests__/securityInstall.test.ts src/__tests__/securityPilot.test.ts src/__tests__/codieSecurityAdapterWiring.test.ts && tsc && node dist/cli.js security pilot --json",
+    "test:opencode-attribution": "vitest run src/__tests__/repoResolver.test.ts src/__tests__/openCodeCapture.test.ts src/__tests__/openCodePluginGitRefs.test.ts src/__tests__/capturePayloadFinal.test.ts src/__tests__/captureDirectUpload.test.ts src/__tests__/resolveCaptureFinal.test.ts && tsc",
     "test:watch": "vitest"
   },
   "files": [
@@ -38,12 +41,18 @@
     "session-capture"
   ],
   "homepage": "https://codiedev.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Signal-and-Code/codiedev.git",
+    "directory": "packages/codiedev-cli"
+  },
   "license": "MIT",
   "engines": {
     "node": ">=18"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "devDependencies": {
     "@types/node": "^20.0.0",