codiedev 0.9.66 → 0.9.68

package/dist/captureSignals.d.ts

@@ -15,6 +15,13 @@ export type CaptureSignals = {
         skill: string;
         count: number;
     }>;
+    /** Which skill ARTIFACT an invocation ran, when the loaded skill content
+     *  carried a `codiedev:artifact=<id>` marker. Lets the server tell two
+     *  authors' same-named skills apart. Absent when no marker was seen. */
+    skillInvocationArtifacts?: Array<{
+        skill: string;
+        artifactId: string;
+    }>;
     skillPulls: string[];
     toolCalls: Array<{
         name: string;

package/dist/captureSignals.js

@@ -24,6 +24,17 @@ function parseCaptureSignals(content, source) {
     let parsedRecords = 0, truncated = false;
     let premiumRequests, nanoAiu;
     let cursorSubagents;
+    // The skill content a harness loads after an invocation follows it in the
+    // transcript; a marker there names the artifact the invocation ran.
+    const artifacts = new Map();
+    let lastInvoked = null;
+    const marker = (text) => {
+        if (!lastInvoked || artifacts.has(lastInvoked))
+            return;
+        const m = text.match(/codiedev:artifact=([a-z0-9]{16,64})/i);
+        if (m && artifacts.size < LIMIT)
+            artifacts.set(lastInvoked, m[1]);
+    };
     const addSkill = (set, value) => {
         const key = skillKey(value);
         if (!key || key.length > 200 || !/^[a-z0-9][a-z0-9_:/.-]*$/i.test(key))
@@ -33,8 +44,10 @@ function parseCaptureSignals(content, source) {
             return;
         }
         set.add(key);
-        if (set === invocations)
+        if (set === invocations) {
             invocationCounts.set(key, (invocationCounts.get(key) ?? 0) + 1);
+            lastInvoked = key;
+        }
     };
     const command = (value) => {
         if (typeof value !== "string")
@@ -113,14 +126,19 @@ function parseCaptureSignals(content, source) {
             for (const part of blocks) {
                 if (part?.type === "tool_use")
                     tool(part.name, part.id, part.input);
+                if (part?.type === "tool_result")
+                    marker(typeof part.content === "string" ? part.content : JSON.stringify(part.content ?? ""));
                 if (part?.type === "text" && e.type === "user") {
                     for (const match of String(part.text ?? "").matchAll(/<command-name>\/?([a-z0-9:_-]+)<\/command-name>/gi))
                         addSkill(invocations, match[1]);
+                    marker(String(part.text ?? ""));
                 }
             }
-        if (typeof blocks === "string" && e.type === "user")
+        if (typeof blocks === "string" && e.type === "user") {
             for (const match of blocks.matchAll(/<command-name>\/?([a-z0-9:_-]+)<\/command-name>/gi))
                 addSkill(invocations, match[1]);
+            marker(blocks);
+        }
         if (e.type === "response_item" &&
             ["function_call", "custom_tool_call"].includes(e.payload?.type))
             tool(e.payload.name, e.payload.call_id, e.payload.arguments ?? e.payload.input);
@@ -150,6 +168,9 @@ function parseCaptureSignals(content, source) {
         skillInvocationCounts: [...invocationCounts]
             .map(([skill, count]) => ({ skill, count }))
             .sort((a, b) => a.skill.localeCompare(b.skill)),
+        ...(artifacts.size
+            ? { skillInvocationArtifacts: [...artifacts].map(([skill, artifactId]) => ({ skill, artifactId })).sort((a, b) => a.skill.localeCompare(b.skill)) }
+            : {}),
         skillPulls: [...pulls].sort(),
         toolCalls: [...tools]
             .map(([name, calls]) => ({ name, calls }))

package/dist/cli.js

@@ -29,6 +29,11 @@ const library_1 = require("./commands/library");
 const share_1 = require("./commands/share");
 const send_1 = require("./commands/send");
 const capture_1 = require("./commands/capture");
+const pack_1 = require("./commands/pack");
+// --- starter packs phase 2 ---
+const hookGate_1 = require("./packs/hookGate");
+const sync_1 = require("./packs/sync");
+// --- end starter packs ---
 const version_1 = require("./version");
 const HELP = `
 Codiedev CLI
@@ -78,6 +83,14 @@ Messaging:
   codiedev inbox [--unread] [--limit N]  Show messages
   codiedev read <ping-id>                Mark read + show full message
 
+Starter packs:
+  codiedev pack list                     Packs assigned to your team
+  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie]
+                       [--dry-run] [--json]
+                                         Install a pack (or all) into every
+                                         detected tool
+  codiedev pack status                   Installed packs, up to date or not
+
 Discovery:
   codiedev search "<query>"              Semantic search across the team's
                                          captured sessions and artifacts
@@ -138,6 +151,7 @@ locally before any capture leaves your machine, so an offline or failed portal
 status sync never weakens it.
 `.trim();
 const COMMAND_HELP = {
+    pack: pack_1.PACK_HELP,
     connect: `
 codiedev connect — link your agent CLI to Codiedev
 
@@ -394,6 +408,20 @@ function removedCommand(command) {
 }
 async function main() {
     const [, , command, ...rest] = process.argv;
+    // --- starter packs: hook-gate runs inside agent hooks; stdout/stderr and
+    // the exit code belong to the wrapped command, so nothing else may run. ---
+    if (command === "hook-gate") {
+        (0, hookGate_1.runHookGateCli)(rest);
+        return;
+    }
+    // Daily "pack has updates" nudge from the cached status (local read only).
+    // stderr, so piped/--json output stays clean.
+    if (command && !["pack", "packs", "help", "docs", "version", "--version", "-v", "--help", "-h"].includes(command) && !rest.includes("--json")) {
+        const nag = (0, sync_1.packNagLine)();
+        if (nag)
+            console.error(`\n${nag}\n`);
+    }
+    // --- end starter packs ---
     if (!command || command === "--help" || command === "-h") {
         console.log(HELP);
         return;
@@ -496,6 +524,10 @@ async function main() {
             case "ignored":
                 await (0, capture_1.runCaptureCommand)([command, ...rest]);
                 return;
+            case "pack":
+            case "packs":
+                await (0, pack_1.runPack)(rest);
+                return;
             case "capture":
                 // Back-compat alias for the earlier `codiedev capture <sub>` form.
                 await (0, capture_1.runCaptureCommand)(rest);

package/dist/codexHookTrust.d.ts

@@ -31,4 +31,10 @@ export declare function inspectCodexHookTrust(configPath: string, hooksPath: str
     total: number;
     trusted: number;
 };
+/** Trust entries for every command handler in a pack's hooks.json. */
+export declare function packCodexHookTrustEntries(hooksPath: string, hooksFile: unknown): CodexHookTrustEntry[];
+/** Regenerate the pack trust block from scratch with exactly `entries`.
+ * Entries for packs that were removed or whose hooks changed disappear; the
+ * `codiedev-hook-trust` block and all other config are left untouched. */
+export declare function writeCodexPackHookTrust(configPath: string, entries: CodexHookTrustEntry[]): CodexHookTrustEntry[];
 export {};

package/dist/codexHookTrust.js

@@ -37,6 +37,8 @@ exports.codexCommandHookHash = codexCommandHookHash;
 exports.codiedevCodexHookTrustEntries = codiedevCodexHookTrustEntries;
 exports.writeCodexHookTrust = writeCodexHookTrust;
 exports.inspectCodexHookTrust = inspectCodexHookTrust;
+exports.packCodexHookTrustEntries = packCodexHookTrustEntries;
+exports.writeCodexPackHookTrust = writeCodexPackHookTrust;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -226,3 +228,74 @@ function inspectCodexHookTrust(configPath, hooksPath, hooksFile, requiredSubcomm
     }).length;
     return { ok: entries.length > 0 && trusted === entries.length, total: entries.length, trusted };
 }
+// ---------------------------------------------------------------------------
+// Starter-pack hook trust (SIG-113). `codiedev pack install` is an explicit
+// install action for admin-approved pack hooks, so it trusts every command
+// handler in the installed pack's hooks.json (not only Codiedev's own). These
+// live in their own managed block so `codiedev connect` and `pack install`
+// never clobber each other's entries.
+const PACK_TRUST_BEGIN = "# codiedev-pack-trust:begin";
+const PACK_TRUST_END = "# codiedev-pack-trust:end";
+/** Trust entries for every command handler in a pack's hooks.json. */
+function packCodexHookTrustEntries(hooksPath, hooksFile) {
+    const events = hooksFile?.hooks;
+    if (!events || typeof events !== "object")
+        return [];
+    const source = normalizedHooksPath(hooksPath);
+    const entries = [];
+    for (const [eventName, groupsValue] of Object.entries(events)) {
+        const eventLabel = EVENT_LABELS[eventName];
+        if (!eventLabel || !Array.isArray(groupsValue))
+            continue;
+        groupsValue.forEach((groupValue, groupIndex) => {
+            const group = groupValue;
+            if (!group || !Array.isArray(group.hooks))
+                return;
+            group.hooks.forEach((handlerValue, handlerIndex) => {
+                const handler = handlerValue;
+                if (!handler || handler.type !== "command" || typeof handler.command !== "string")
+                    return;
+                entries.push({
+                    key: `${source}:${eventLabel}:${groupIndex}:${handlerIndex}`,
+                    eventName,
+                    command: handler.command,
+                    currentHash: codexCommandHookHash(eventName, group, handler),
+                });
+            });
+        });
+    }
+    return entries;
+}
+/** Regenerate the pack trust block from scratch with exactly `entries`.
+ * Entries for packs that were removed or whose hooks changed disappear; the
+ * `codiedev-hook-trust` block and all other config are left untouched. */
+function writeCodexPackHookTrust(configPath, entries) {
+    let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+    existing = existing.replace(new RegExp(`\\n?${PACK_TRUST_BEGIN}\\n[\\s\\S]*?${PACK_TRUST_END}\\n?`, "g"), "\n");
+    let lines = existing.split("\n");
+    // A stray table for the same key outside our block would make the TOML
+    // invalid (duplicate table) — drop it so ours is authoritative.
+    for (const entry of entries)
+        lines = removeTable(lines, tableHeader(entry.key));
+    const base = lines.join("\n").trimEnd();
+    if (entries.length === 0) {
+        const next = base ? `${base}\n` : "";
+        if (!fs.existsSync(configPath) && !next)
+            return entries;
+        fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+        fs.chmodSync(configPath, 0o600);
+        return entries;
+    }
+    const trustBlock = entries.flatMap((entry) => [
+        tableHeader(entry.key),
+        "enabled = true",
+        `trusted_hash = ${JSON.stringify(entry.currentHash)}`,
+        "",
+    ]).join("\n");
+    const next = `${base}${base ? "\n\n" : ""}${PACK_TRUST_BEGIN}\n${trustBlock}${PACK_TRUST_END}\n`;
+    fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+    return entries;
+}

package/dist/codie.js

@@ -56,6 +56,8 @@ const codieUsage_1 = require("./codieUsage");
 const codieRuntime_1 = require("./codieRuntime");
 const codieRuntimeInstall_1 = require("./codieRuntimeInstall");
 const upgradeNudge_1 = require("./upgradeNudge");
+const codie_1 = require("./packs/codie");
+const paths_1 = require("./packs/paths");
 // How long to let the gateway finish booking the last request before asking
 // what the session cost.
 const USAGE_SETTLE_MS = 1200;
@@ -97,6 +99,24 @@ function connectedCodiedevConfig() {
         return {};
     }
 }
+// Starter packs (`codiedev pack install`) reach Codie here: skills, agents and
+// the hook shim are merged into the inline config at launch. Best-effort — a
+// broken pack must never stop the harness from starting.
+function withStarterPacks(existing, approved, catalog) {
+    try {
+        // Agent levels (opus/sonnet/haiku) resolve against this account's catalog.
+        const packs = (0, codie_1.codiePackConfig)((0, paths_1.packsRoot)(), { approvedModels: approved, catalog });
+        if (process.env.CODIEDEV_DEBUG) {
+            for (const note of packs.notes)
+                console.error(`codie: starter pack ${note}`);
+        }
+        return (0, codie_1.mergeCodiePackConfig)(existing, packs);
+    }
+    catch (error) {
+        console.error(`codie: skipping starter packs (${error instanceof Error ? error.message : error})`);
+        return existing;
+    }
+}
 function assetPath(name) {
     // dist/codie.js → ../assets/<name>; src/codie.ts → ../assets/<name>.
     return path.join(__dirname, "..", "assets", name);
@@ -210,7 +230,7 @@ async function main() {
     (0, codieBrandInstall_1.installTuiPlugin)();
     installBrandWordmark(runtime);
     const config = (0, codieLauncher_1.buildCodieConfig)({
-        existing: existingInlineConfig(),
+        existing: withStarterPacks(existingInlineConfig(), new Set(catalog.map((model) => (0, codieLauncher_1.bareModel)(model.id)).filter(Boolean)), catalog),
         catalog,
         env: { ...process.env, ...parsed.overrides, CODIEDEV_GATEWAY_URL: gatewayUrl },
         plugins: [capturePlugin, metadataPlugin],

package/dist/commands/pack.d.ts

@@ -0,0 +1,54 @@
+import { CodiedevConfig } from "../utils";
+import { InstallOptions, PackInstallResult, PackUninstallResult } from "../packs/install";
+import { HarnessName } from "../packs/harnesses";
+import { PackManifest } from "../packs/manifest";
+export declare const DEFAULT_BACKEND_URL = "https://cli.codiedev.com";
+/** CODIEDEV_TOKEN alone is enough: no ~/.codiedev/config.json needed (CI).
+ * CODIEDEV_URL defaults to production. Otherwise the connected config. */
+export declare function resolvePackConfig(env?: NodeJS.ProcessEnv): CodiedevConfig | null;
+/** In CI, `--harness` defaults to claude when it's on PATH; anything else is
+ * ambiguous on a build box, so say what was found. */
+export declare function ciHarnesses(args: PackArgs, env: NodeJS.ProcessEnv, home?: string): HarnessName[];
+export interface PackArgs {
+    sub?: string;
+    slug?: string;
+    harnesses?: HarnessName[];
+    dryRun: boolean;
+    json: boolean;
+    quiet?: boolean;
+    noPrune?: boolean;
+    out?: string;
+    git?: boolean;
+    manifest?: boolean;
+}
+export declare function parsePackArgs(args: string[]): PackArgs;
+export declare function runList(config: CodiedevConfig, json: boolean, overrides?: Partial<InstallOptions>): Promise<void>;
+export interface InstallRun {
+    installed: PackInstallResult[];
+    removed: PackUninstallResult[];
+    /** Installed slugs the server no longer serves (only populated by --dry-run). */
+    wouldRemove: string[];
+}
+export declare function runInstall(config: CodiedevConfig, args: PackArgs, overrides?: Partial<InstallOptions>): Promise<InstallRun>;
+export declare function runStatus(config: CodiedevConfig, json: boolean, overrides?: Partial<InstallOptions>, options?: {
+    prune?: boolean;
+}): Promise<{
+    installed: Array<Record<string, unknown>>;
+    removed: PackUninstallResult[];
+    notInstalled: string[];
+    offline: boolean;
+}>;
+export declare function runPack(args: string[]): Promise<void>;
+/** Init (if needed) and commit everything under `dir`. Uses the user's git
+ * identity when configured, a neutral Codiedev one otherwise (fresh CI). */
+export declare function commitExport(dir: string, message: string): string;
+/** Write a CI-committable copy of the pack: `<out>/plugins/<slug>/…` plus
+ * `<out>/.claude-plugin/marketplace.json` (existing entries for other packs
+ * in the same folder are kept). */
+export declare function exportPluginFolder(out: string, manifest: PackManifest): string;
+export declare function runExport(config: CodiedevConfig, args: PackArgs): Promise<{
+    written: string;
+    commit?: string;
+}>;
+export declare function runApply(config: CodiedevConfig, args: PackArgs): Promise<Record<string, unknown>>;
+export declare const PACK_HELP = "Usage:\n  codiedev pack list                     Packs assigned to your team\n  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie] [--dry-run] [--json] [--quiet]\n                                         Install one pack, or every pack that applies\n  codiedev pack status [--json]          Installed packs and whether they're up to date\n  codiedev pack export <slug> --out <dir> [--git] [--manifest]\n                                         Write the pack as a Claude-format plugin folder plus\n                                         .claude-plugin/marketplace.json (commit it for CI).\n                                         --git inits the folder and commits; --manifest writes\n                                         an editable <slug>.pack.md instead\n  codiedev pack apply <pack.md>          Create or update a pack from a pack.md\n\nCursor: packs are copied to ~/.cursor/plugins/local/codiedev-<slug>/. A Cursor\nteam admin can disable \"user local plugin imports\"; then Cursor ignores them.\n\nAuto-update: session starts run `codiedev pack install --quiet` in the background\nabout once an hour. Opt out with CODIEDEV_PACK_AUTOSYNC=0.\n\nHooks for specific skills only: codiedev hook-gate --skills a,b --cmd-b64 <base64url of the command>\n(the pack editor writes this; the command runs via /bin/sh, or cmd.exe on Windows)\n\nCI: set CODIEDEV_TOKEN to a pack CI key (cdvci_\u2026, from the pack's page in the portal).\nNo `codiedev connect` or config file is needed. CI mode (a cdvci_ key, or CI=true)\nnever auto-syncs, reports or prunes, installs the one pack the key can see, defaults\n--harness to claude when it's on PATH, and exits non-zero unless every requested tool\ngot the pack. Skills from a pack are /<pack-slug>:<skill> in Claude Code.\n\n  GitLab CI (.gitlab-ci.yml; add CODIEDEV_TOKEN and ANTHROPIC_API_KEY as masked\n  CI/CD variables):\n    pack-scan:\n      image: node:22\n      script:\n        - npm i -g codiedev @anthropic-ai/claude-code\n        - codiedev pack install --harness claude\n        - claude -p \"/platform-starter:healthcare-scan\" --output-format text\n\n  GitHub Actions (repository secrets CODIEDEV_TOKEN and ANTHROPIC_API_KEY):\n    - uses: actions/setup-node@v4\n      with: { node-version: 22 }\n    - run: npm i -g codiedev @anthropic-ai/claude-code\n    - run: codiedev pack install --harness claude\n      env:\n        CODIEDEV_TOKEN: ${{ secrets.CODIEDEV_TOKEN }}\n    - run: claude -p \"/platform-starter:healthcare-scan\" --output-format text\n      env:\n        ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n\n  Or vendor the plugin into the repo instead of installing at build time:\n    codiedev pack export <slug> --out .codiedev/packs";