codiedev 0.9.78 → 0.9.80

package/dist/cliSession.js

@@ -0,0 +1,513 @@
+"use strict";
+// Browser sign-in for `codiedev connect`, and keeping its access token fresh.
+//
+// Sign-in is OAuth 2.1 authorization code + PKCE against the Codiedev
+// backend with a loopback redirect (RFC 8252): the CLI listens on
+// 127.0.0.1:<random port>, opens the portal's consent page, and exchanges the
+// returned code for a 24h access token (cdv_at_) and a 30-day refresh token
+// (cdv_rt_). No long-lived API key is saved.
+//
+// config.json keeps `token` = the current access token, so every existing
+// reader keeps working. Each process entry point (codiedev, codiedev-hook,
+// codie, the MCP server) calls ensureFreshToken() first; it refreshes when the
+// token is about to expire.
+//
+// Refresh tokens are single-use and the server treats reuse of a spent one as
+// theft (it revokes the whole sign-in). Many hooks run in parallel and share
+// config.json, so a refresh goes:
+//   1. read config, note the stale access token ("seen")
+//   2. take ~/.codiedev/refresh.lock
+//   3. re-read config; if the token is no longer "seen", another process
+//      already refreshed: use that, no network call
+//   4. else refresh, atomically replace config.json, release
+// specs/tla/CliSession.tla model-checks this: without step 2–3, two hooks can
+// both present the same refresh token and sign the user out.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_CODE_GRANT = exports.LOCK_STALE_MS = exports.DEFAULT_MIN_VALIDITY_MS = void 0;
+exports.readConfigAt = readConfigAt;
+exports.renameWithRetry = renameWithRetry;
+exports.writeConfigAtomic = writeConfigAtomic;
+exports.ensureFreshToken = ensureFreshToken;
+exports.pkcePair = pkcePair;
+exports.openBrowser = openBrowser;
+exports.parseCallback = parseCallback;
+exports.browserLogin = browserLogin;
+exports.isHeadless = isHeadless;
+exports.deviceLogin = deviceLogin;
+exports.logout = logout;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+/** Default: refresh when less than 10 minutes remain. */
+exports.DEFAULT_MIN_VALIDITY_MS = 10 * 60_000;
+/** A lock older than this was left by a crashed process. Refresh calls time
+ * out well before it (REFRESH_TIMEOUT_MS), so a live holder never looks stale. */
+exports.LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 20_000;
+const REFRESH_TIMEOUT_MS = 10_000;
+const LOGIN_TIMEOUT_MS = 10 * 60_000;
+// ─── config IO (atomic) ────────────────────────────────────────────────
+function readConfigAt(configPath) {
+    try {
+        return JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+// Windows refuses to replace a file another process holds without share-delete
+// (antivirus, the search indexer; Node's own readers do share). Those holds
+// last milliseconds, so retry like graceful-fs/write-file-atomic do.
+const RENAME_RETRY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_RETRY_MS = [10, 25, 50, 100, 200, 400, 800];
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/** rename(), retrying the transient Windows sharing errors. Exported for tests. */
+function renameWithRetry(from, to, rename = fs.renameSync, sleep = sleepSync) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (err) {
+            const code = err?.code ?? "";
+            if (!RENAME_RETRY_CODES.has(code) || attempt >= RENAME_RETRY_MS.length)
+                throw err;
+            sleep(RENAME_RETRY_MS[attempt]);
+        }
+    }
+}
+/**
+ * Write via temp file + rename so a concurrent reader never sees a torn file.
+ * If the rename still fails after ~1.6s of retries (a handle held that long),
+ * fall back to writing in place: a rare torn read beats failing `connect`.
+ */
+function writeConfigAtomic(configPath, config) {
+    const dir = path.dirname(configPath);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const data = JSON.stringify(config, null, 2);
+    const tmp = path.join(dir, `.config.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+    fs.writeFileSync(tmp, data, { encoding: "utf8", mode: 0o600 });
+    try {
+        fs.chmodSync(tmp, 0o600);
+        renameWithRetry(tmp, configPath);
+        return;
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { /* already gone */ }
+        if (!RENAME_RETRY_CODES.has(err?.code ?? ""))
+            throw err;
+    }
+    fs.writeFileSync(configPath, data, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+}
+// ─── refresh lock ──────────────────────────────────────────────────────
+function lockPathFor(configPath) {
+    return path.join(path.dirname(configPath), "refresh.lock");
+}
+function tryLock(lockPath, now) {
+    try {
+        const fd = fs.openSync(lockPath, "wx", 0o600);
+        fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: now }));
+        fs.closeSync(fd);
+        return true;
+    }
+    catch (err) {
+        if (err?.code !== "EEXIST")
+            throw err;
+        // Break a lock left by a crashed process.
+        try {
+            const age = now - fs.statSync(lockPath).mtimeMs;
+            if (age > exports.LOCK_STALE_MS)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+            /* raced with its owner releasing it: retry */
+        }
+        return false;
+    }
+}
+function unlock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch { /* already released */ }
+}
+function needsRefresh(config, now, minValidityMs) {
+    const auth = config.auth;
+    return !!auth && !!config.token && auth.accessTokenExpiresAt - now < minValidityMs;
+}
+async function postForm(fetchImpl, url, form, timeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form).toString(),
+            signal: ctl.signal,
+        });
+        return { status: res.status, body: (await res.json().catch(() => null)) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Make sure config.token is a usable access token for at least
+ * `minValidityMs`. Never throws: auth problems surface as the next request's
+ * 401, which every command already explains.
+ */
+async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDITY_MS) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const first = readConfigAt(deps.configPath);
+    if (!first?.auth)
+        return { status: "none", config: first };
+    if (!needsRefresh(first, now(), minValidityMs))
+        return { status: "fresh", config: first };
+    const seen = first.token;
+    const lockPath = lockPathFor(deps.configPath);
+    const deadline = now() + LOCK_WAIT_MS;
+    let locked = false;
+    try {
+        while (!(locked = tryLock(lockPath, now()))) {
+            if (now() > deadline)
+                return { status: "unavailable", config: first };
+            await sleep(50 + Math.floor(Math.random() * 100));
+        }
+        // Step 3: re-read under the lock.
+        const current = readConfigAt(deps.configPath);
+        if (!current?.auth)
+            return { status: "none", config: current };
+        if (current.token !== seen)
+            return { status: "adopted", config: current };
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${current.backendUrl}/oauth/token`, {
+                grant_type: "refresh_token",
+                client_id: current.auth.clientId,
+                refresh_token: current.auth.refreshToken,
+            }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            return { status: "unavailable", config: current };
+        }
+        if (res.status === 200 && typeof res.body?.access_token === "string" && typeof res.body.refresh_token === "string") {
+            const next = {
+                ...current,
+                token: res.body.access_token,
+                auth: {
+                    ...current.auth,
+                    refreshToken: res.body.refresh_token,
+                    accessTokenExpiresAt: now() + Number(res.body.expires_in ?? 0) * 1000,
+                },
+            };
+            writeConfigAtomic(deps.configPath, next);
+            return { status: "refreshed", config: next };
+        }
+        if (res.status === 400 && res.body?.error === "invalid_grant") {
+            // Revoked in the portal, signed out elsewhere, expired, or reuse was
+            // detected. Forget the credentials but keep device settings.
+            const out = { ...current, token: "" };
+            delete out.auth;
+            writeConfigAtomic(deps.configPath, out);
+            return { status: "signed_out", config: out };
+        }
+        return { status: "unavailable", config: current };
+    }
+    finally {
+        if (locked)
+            unlock(lockPath);
+    }
+}
+// ─── browser sign-in ───────────────────────────────────────────────────
+function base64Url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+    const verifier = base64Url(crypto.randomBytes(32));
+    const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function openBrowser(url) {
+    try {
+        const [cmd, args] = process.platform === "darwin"
+            ? ["open", [url]]
+            : process.platform === "win32"
+                ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+                : ["xdg-open", [url]];
+        const child = (0, child_process_1.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const DONE_PAGE = (ok, msg) => `<!doctype html><html><head><meta charset="utf-8">
+<title>Codiedev CLI</title><style>body{font-family:system-ui,sans-serif;display:grid;place-items:center;
+height:100vh;margin:0;background:#fbfbfa;color:#1f1f1f}main{max-width:28rem;text-align:center}
+h1{font-size:1.25rem}</style></head><body><main><h1>${ok ? "You're signed in" : "Sign-in didn't finish"}</h1>
+<p>${msg}</p></main></body></html>`;
+/** Parse `code`/`state` (or `error`) out of a loopback callback URL. */
+function parseCallback(input) {
+    try {
+        const u = new URL(input.trim());
+        return {
+            code: u.searchParams.get("code") ?? undefined,
+            state: u.searchParams.get("state") ?? undefined,
+            error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? undefined,
+        };
+    }
+    catch {
+        return { error: "That isn't the address from the browser's address bar." };
+    }
+}
+async function browserLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const state = base64Url(crypto.randomBytes(16));
+    const { verifier, challenge } = pkcePair();
+    let settle;
+    const result = new Promise((r) => (settle = r));
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        const cb = parseCallback(url.toString());
+        const ok = !cb.error && cb.state === state && !!cb.code;
+        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(DONE_PAGE(ok, ok
+            ? "You can close this tab and go back to your terminal."
+            : "Go back to your terminal and run <code>codiedev connect</code> again."));
+        if (cb.error)
+            settle({ error: cb.error });
+        else if (cb.state !== state)
+            settle({ error: "The sign-in response didn't match this request (state mismatch)." });
+        else
+            settle({ code: cb.code });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const timer = setTimeout(() => settle({ error: "Timed out waiting for the browser (10 minutes)." }), LOGIN_TIMEOUT_MS);
+    try {
+        const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+                redirect_uris: [redirectUri],
+            }),
+        });
+        if (reg.status !== 201)
+            throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+        const { client_id: clientId } = (await reg.json());
+        const authorize = new URL(`${opts.backendUrl}/oauth/authorize`);
+        authorize.search = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+            scope: "cli",
+        }).toString();
+        const link = authorize.toString();
+        if (opts.onAuthorizeUrl) {
+            opts.onAuthorizeUrl(link);
+        }
+        else {
+            log("Opening your browser to sign in…");
+            log(`If it doesn't open, visit:\n  ${link}\n`);
+            openBrowser(link);
+        }
+        const cb = await result;
+        if (cb.error || !cb.code)
+            throw new Error(cb.error ?? "Sign-in was cancelled.");
+        const tok = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, {
+            grant_type: "authorization_code",
+            code: cb.code,
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+        }, REFRESH_TIMEOUT_MS);
+        const body = tok.body;
+        if (tok.status !== 200 || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string") {
+            throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${tok.status}`}`);
+        }
+        if (body.scope !== "cli")
+            throw new Error("The server didn't grant CLI access.");
+        return {
+            accessToken: body.access_token,
+            refreshToken: body.refresh_token,
+            expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+            clientId,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        server.close();
+    }
+}
+// ─── device sign-in (SSH / headless) ──────────────────────────────────
+exports.DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * True when a browser opened here can't reach the user: an SSH session, or a
+ * Linux box with no display. Then `connect` uses the device flow (a code the
+ * user approves on any device) instead of a loopback redirect, with no flag.
+ */
+function isHeadless(env = process.env, platform = process.platform) {
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return true;
+    if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
+async function deviceLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+            redirect_uris: [],
+            grant_types: [exports.DEVICE_CODE_GRANT, "refresh_token"],
+        }),
+    });
+    if (reg.status !== 201)
+        throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+    const { client_id: clientId } = (await reg.json());
+    const start = await fetchImpl(`${opts.backendUrl}/oauth/device_authorization`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, scope: "cli" }).toString(),
+    });
+    const auth = (await start.json().catch(() => null));
+    if (start.status !== 200 || !auth?.device_code || !auth.user_code || !auth.verification_uri) {
+        throw new Error(`Sign-in setup failed: ${auth?.error_description ?? `HTTP ${start.status}`}`);
+    }
+    const complete = auth.verification_uri_complete ?? auth.verification_uri;
+    if (opts.onCode) {
+        opts.onCode({ userCode: auth.user_code, verificationUri: auth.verification_uri, verificationUriComplete: complete });
+    }
+    log("To sign in, open this link on any device (your laptop or phone) and approve:\n");
+    log(`  ${complete}\n`);
+    log(`Your code: ${auth.user_code}   (check it matches the page)\n`);
+    log("Waiting for approval…");
+    let intervalMs = Math.max(1, Number(auth.interval ?? 5)) * 1000;
+    const deadline = now() + Number(auth.expires_in ?? 600) * 1000;
+    for (;;) {
+        await sleep(intervalMs);
+        if (now() > deadline)
+            throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, { grant_type: exports.DEVICE_CODE_GRANT, device_code: auth.device_code, client_id: clientId }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            continue; // network blip: keep polling until the code expires
+        }
+        const body = res.body;
+        if (res.status === 200 && typeof body?.access_token === "string" && typeof body.refresh_token === "string") {
+            if (body.scope !== "cli")
+                throw new Error("The server didn't grant CLI access.");
+            return {
+                accessToken: body.access_token,
+                refreshToken: body.refresh_token,
+                expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+                clientId,
+            };
+        }
+        switch (body?.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                intervalMs += 5000;
+                continue;
+            case "access_denied":
+                throw new Error("Sign-in was denied in the browser.");
+            case "expired_token":
+                throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+            default:
+                throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${res.status}`}`);
+        }
+    }
+}
+/** `codiedev logout`: end a browser sign-in server-side, forget it locally. */
+async function logout(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const config = readConfigAt(deps.configPath);
+    if (!config?.token)
+        return { wasConnected: false, hadBrowserAuth: false, serverRevoked: false };
+    let serverRevoked = false;
+    const hadBrowserAuth = !!config.auth;
+    if (config.token && config.auth) {
+        try {
+            const res = await fetchImpl(`${config.backendUrl}/api/cli/logout`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${config.token}` },
+            });
+            serverRevoked = res.ok && (await res.json().catch(() => null))?.revoked === true;
+        }
+        catch {
+            /* offline: still forget locally; the portal can revoke it */
+        }
+    }
+    const out = { ...config, token: "" };
+    delete out.auth;
+    writeConfigAtomic(deps.configPath, out);
+    return { wasConnected: true, hadBrowserAuth, serverRevoked };
+}

package/dist/codie.js

@@ -59,6 +59,11 @@ const upgradeNudge_1 = require("./upgradeNudge");
 const codie_1 = require("./packs/codie");
 const paths_1 = require("./packs/paths");
 const managedPi_1 = require("./managedPi");
+const cliSession_1 = require("./cliSession");
+// The engine reads its gateway key once, at launch. With browser sign-in the
+// key is a 24h access token, so start every session with at least 12h left
+// (refreshing first if needed) instead of one that dies mid-task.
+const CODIE_MIN_TOKEN_VALIDITY_MS = 12 * 60 * 60_000;
 // How long to let the gateway finish booking the last request before asking
 // what the session cost.
 const USAGE_SETTLE_MS = 1200;
@@ -91,7 +96,8 @@ function existingInlineConfig() {
     }
 }
 // The one credential. `codiedev connect` wrote it; the gateway validates the
-// same userApiTokens row, so there is no second harness token to mint.
+// same userApiTokens row (a browser sign-in reports through its own row), so
+// there is no second harness token to mint.
 function connectedCodiedevConfig() {
     try {
         return JSON.parse(fs.readFileSync(path.join((0, configDir_1.codiedevStateDir)(), "config.json"), "utf8"));
@@ -171,7 +177,21 @@ function installBrandWordmarkUnsafe(runtime) {
 }
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
+    if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN) {
+        const fresh = await (0, cliSession_1.ensureFreshToken)({ configPath: path.join((0, configDir_1.codiedevStateDir)(), "config.json") }, CODIE_MIN_TOKEN_VALIDITY_MS);
+        if (fresh.status === "signed_out") {
+            throw new Error("Your Codiedev sign-in has ended. Run `codiedev connect` to sign in again");
+        }
+    }
     const connected = connectedCodiedevConfig();
+    // Browser sign-in: let the engine's per-request hook keep the 24h key
+    // fresh for sessions that run longer (assets/session-key.mjs). Not for an
+    // explicit key from the environment, and not for pasted API tokens.
+    if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN && connected.auth) {
+        process.env.CODIEDEV_SESSION_CONFIG = path.join((0, configDir_1.codiedevStateDir)(), "config.json");
+        process.env.CODIEDEV_CLI_JS = path.join(__dirname, "cli.js");
+        process.env.CODIEDEV_NODE = process.execPath;
+    }
     const key = process.env.CODIEDEV_GATEWAY_KEY ||
         process.env.CODIEDEV_TOKEN ||
         (typeof connected.token === "string" ? connected.token.trim() : "");

package/dist/commands/traces.js

@@ -2,6 +2,7 @@
 // `codiedev traces agents`
 // `codiedev traces cases <agent> [--dataset name] [--model id] [--out dir] [--json]`
 // `codiedev traces report <results.json> [--harness name]`
+// (scores, review queues, automatic scoring and datasets: ./tracesLabel.ts)
 //
 // Test cases are runs an engineer saved from Codiedev → Traces. They run in
 // the engineer's coding agent, not in the portal: `cases` writes them into the
@@ -51,8 +52,9 @@ exports.runTraces = runTraces;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const shared_1 = require("./shared");
+const tracesLabel_1 = require("./tracesLabel");
 exports.TRACES_HELP = `
-codiedev traces — test cases saved from Codiedev → Traces
+codiedev traces — test cases, scores, review queues and automatic scoring from Codiedev → Traces
 
   codiedev traces agents                 Agents you maintain, with saved case counts
   codiedev traces cases <agent> [--dataset name [--version n]] [--case id[,id]] [--model id] [--out dir] [--json]
@@ -66,6 +68,36 @@ codiedev traces — test cases saved from Codiedev → Traces
                                          Send the filled-in results back, so
                                          Traces shows the pass rate for that model
 
+  codiedev traces overview [--days n] [--json]
+                                         Every agent you can see: runs, failures,
+                                         spend, and what's going wrong most
+  codiedev traces runs <agent> [--failed] [--flag name] [--model id] [--verdict pass|fail] [--days n] [--limit n] [--json]
+                                         An agent's runs, newest first
+  codiedev traces run <run> [--agent name] [--json]
+                                         One run: steps, what went wrong and the fix,
+                                         scores, prompts and replies (maintainers)
+  codiedev traces score-kinds [add <name> --type number|categories|boolean [--min n --max n] [--categories a,b]]
+                                         List or add the kinds of score your team uses
+  codiedev traces queue create <name> [--scores a,b] [--description text]
+  codiedev traces score <run> <score> <value> [--agent name] [--comment text] [--step n]
+                                         Score a run (a portal run id agent~run, or
+                                         the agent's own run id with --agent)
+  codiedev traces scores <agent> [--days n] [--json]
+                                         Each score's average or mix, and the score kinds
+  codiedev traces queue list             Review queues and how many are left
+  codiedev traces queue add <queue> --agent <name> [--failed] [--days n] [--run id ...]
+                                         File runs into a queue for people to review
+  codiedev traces judge <agent> [--on | --off] [--scores a,b] [--instructions text]
+        [--model id] [--sample percent] [--daily n] [--budget usd | --key cdvm_…]
+                                         Show or set automatic scoring (a judge model
+                                         scores a sample of runs, billed to your key)
+  codiedev traces import <agent> <file.csv|file.jsonl> --dataset <name>
+                                         Add examples from a file (input, expected, name)
+  codiedev traces add-example <agent> --dataset <name> --input <text> [--expected <text>] [--name <text>]
+  codiedev traces versions <dataset>     A dataset's saved versions and what changed
+  codiedev traces save-version <dataset> [--note text]
+                                         Save the dataset as its next version
+
   <agent> is the agent's name (its API key name) or id. Only an agent's
   maintainers can pull its cases or report on them.
 `.trim();
@@ -295,6 +327,30 @@ async function runTraces(args, configOverride) {
         return runCases(rest, configOverride ?? (0, shared_1.requireConfig)());
     if (sub === "report")
         return runReport(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "overview")
+        return (0, tracesLabel_1.runOverview)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "runs")
+        return (0, tracesLabel_1.runRuns)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "run")
+        return (0, tracesLabel_1.runRun)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "score-kinds")
+        return (0, tracesLabel_1.runScoreKinds)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "score")
+        return (0, tracesLabel_1.runScore)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "scores")
+        return (0, tracesLabel_1.runScores)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "queue")
+        return (0, tracesLabel_1.runQueue)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "judge")
+        return (0, tracesLabel_1.runJudge)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "import")
+        return (0, tracesLabel_1.runImport)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "add-example")
+        return (0, tracesLabel_1.runAddExample)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "versions")
+        return (0, tracesLabel_1.runVersions)(rest, configOverride ?? (0, shared_1.requireConfig)());
+    if (sub === "save-version")
+        return (0, tracesLabel_1.runSaveVersion)(rest, configOverride ?? (0, shared_1.requireConfig)());
     console.log(exports.TRACES_HELP);
     if (sub && sub !== "help")
         process.exit(1);

package/dist/commands/tracesLabel.d.ts

@@ -0,0 +1,24 @@
+import type { CodiedevConfig } from "../utils";
+type Parsed = {
+    positional: string[];
+    flags: Record<string, string>;
+    bools: Set<string>;
+    runs: string[];
+};
+export declare function parseArgs(args: string[]): Parsed;
+/** "4" → 4, "true" → true, anything else as text (a category). */
+export declare function scoreValue(raw: string): number | boolean | string;
+export declare function runScore(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runScores(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runQueue(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runJudge(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runImport(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runAddExample(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runVersions(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runSaveVersion(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runOverview(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runRuns(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runRun(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runScoreKinds(args: string[], config: CodiedevConfig): Promise<void>;
+export declare function runQueueCreate(args: string[], config: CodiedevConfig): Promise<void>;
+export {};