codiedev 0.9.78 → 0.9.80

package/dist/commands/tracesLabel.js

@@ -0,0 +1,356 @@
+"use strict";
+// `codiedev traces overview | runs | run | score | scores | score-kinds |
+// queue | judge | import | add-example | versions | save-version`: what the
+// Traces portal shows and does (agents, runs, failures, scores, review
+// queues, automatic scoring, datasets), so a coding agent can do it from
+// plain words ("put this week's failed runs in the Week 44 queue"). Each
+// calls a /api/cli/traces/* route that runs the portal's own code, with the
+// same permissions.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseArgs = parseArgs;
+exports.scoreValue = scoreValue;
+exports.runScore = runScore;
+exports.runScores = runScores;
+exports.runQueue = runQueue;
+exports.runJudge = runJudge;
+exports.runImport = runImport;
+exports.runAddExample = runAddExample;
+exports.runVersions = runVersions;
+exports.runSaveVersion = runSaveVersion;
+exports.runOverview = runOverview;
+exports.runRuns = runRuns;
+exports.runRun = runRun;
+exports.runScoreKinds = runScoreKinds;
+exports.runQueueCreate = runQueueCreate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const shared_1 = require("./shared");
+const BOOL_FLAGS = new Set(["--failed", "--on", "--off", "--json"]);
+function parseArgs(args) {
+    const out = { positional: [], flags: {}, bools: new Set(), runs: [] };
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (BOOL_FLAGS.has(a)) {
+            out.bools.add(a);
+            continue;
+        }
+        if (a.startsWith("--")) {
+            const eq = a.indexOf("=");
+            const name = eq > 0 ? a.slice(0, eq) : a;
+            const value = eq > 0 ? a.slice(eq + 1) : args[++i];
+            if (value === undefined)
+                throw new Error(`${name} needs a value`);
+            if (name === "--run")
+                out.runs.push(value);
+            else
+                out.flags[name] = value;
+            continue;
+        }
+        out.positional.push(a);
+    }
+    return out;
+}
+/** "4" → 4, "true" → true, anything else as text (a category). */
+function scoreValue(raw) {
+    const t = raw.trim();
+    if (/^(true|false)$/i.test(t))
+        return t.toLowerCase() === "true";
+    if (t !== "" && Number.isFinite(Number(t)))
+        return Number(t);
+    return t;
+}
+async function call(config, tool, method, route, opts) {
+    const start = Date.now();
+    try {
+        const res = await (0, shared_1.apiRequest)(method, `/api/cli/traces/${route}`, { config, ...opts });
+        (0, shared_1.recordAgentEvent)(config, { tool, ok: true, latencyMs: Date.now() - start });
+        return res;
+    }
+    catch (err) {
+        const e = err;
+        (0, shared_1.recordAgentEvent)(config, { tool, ok: false, latencyMs: Date.now() - start, error: e.message });
+        console.error(e.message);
+        process.exit(1);
+    }
+}
+function usage(text) {
+    console.error(`Usage: ${text}`);
+    process.exit(1);
+}
+async function runScore(args, config) {
+    const p = parseArgs(args);
+    const [run, name, value] = p.positional;
+    if (!run || !name || value === undefined)
+        usage("codiedev traces score <run> <score> <value> [--agent name] [--comment text] [--step n]");
+    const res = await call(config, "codiedev_traces_score", "POST", "score", {
+        body: { run, name, value: scoreValue(value), agent: p.flags["--agent"], comment: p.flags["--comment"], ...(p.flags["--step"] ? { step: Number(p.flags["--step"]) } : {}) },
+    });
+    console.log(`✓ Scored ${res.runId}: ${name} = ${value}`);
+}
+async function runScores(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    if (!agent)
+        usage("codiedev traces scores <agent> [--days n] [--json]");
+    const res = await call(config, "codiedev_traces_scores", "GET", "scores", { query: { agent, days: p.flags["--days"] ?? "7" } });
+    if (p.bools.has("--json")) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+    }
+    if (!res.summary.length)
+        console.log(`No scores on ${res.agent} in the last ${p.flags["--days"] ?? 7} days.`);
+    for (const s of res.summary) {
+        const head = s.dataType === "boolean" && s.average !== null ? `${Math.round(s.average * 100)}% true`
+            : s.dataType === "numeric" && s.average !== null ? `avg ${Math.round(s.average * 100) / 100}`
+                : s.categories.map((c) => `${c.label} ${c.count}`).join(", ");
+        const from = [s.bySource.annotation ? `${s.bySource.annotation} people` : "", s.bySource.api ? `${s.bySource.api} your app` : "", s.bySource.judge ? `${s.bySource.judge} judge` : ""].filter(Boolean).join(", ");
+        console.log(`${s.name.padEnd(24)} ${head.padEnd(28)} ${s.count} scores (${from})`);
+    }
+    if (res.kinds.length)
+        console.log(`\nScore kinds: ${res.kinds.map((k) => `${k.name} (${k.dataType === "numeric" ? `${k.min ?? ""}–${k.max ?? ""}` : k.dataType === "boolean" ? "true/false" : k.categories.join("/")})`).join(", ")}`);
+}
+async function runQueue(args, config) {
+    const [verb, ...rest] = args;
+    if (verb === "list" || verb === undefined) {
+        const res = await call(config, "codiedev_traces_queue_list", "GET", "queues", {});
+        const live = res.queues.filter((q) => !q.archived);
+        if (!live.length)
+            console.log("No review queues yet. Make one in Codiedev → Traces → Review.");
+        for (const q of live)
+            console.log(`${q.name.padEnd(28)} ${String(q.pending).padStart(4)} to review  ${String(q.done).padStart(4)} done  ${q.scoreNames.join(", ")}`);
+        return;
+    }
+    if (verb === "create")
+        return runQueueCreate(rest, config);
+    if (verb !== "add")
+        usage("codiedev traces queue list | queue create <name> [--scores a,b] | queue add <queue> --agent <name> [--failed] [--days n] [--run id ...]");
+    const p = parseArgs(rest);
+    const queue = p.positional[0];
+    if (!queue || (!p.flags["--agent"] && !p.runs.length))
+        usage("codiedev traces queue add <queue> --agent <name> [--failed] [--days n] [--run id ...]");
+    const res = await call(config, "codiedev_traces_queue_add", "POST", "queue", {
+        body: { queue, agent: p.flags["--agent"], failed: p.bools.has("--failed"), ...(p.flags["--days"] ? { days: Number(p.flags["--days"]) } : {}), ...(p.runs.length ? { runs: p.runs } : {}) },
+    });
+    console.log(`✓ Added ${res.added} ${res.added === 1 ? "run" : "runs"} to ${res.queue}${res.skipped ? ` (${res.skipped} already there or not yours)` : ""}. Review them in Codiedev → Traces → Review.`);
+}
+function printJudge(agent, judge) {
+    if (!judge || judge === "none") {
+        console.log(`Automatic scoring isn't set up for ${agent}.`);
+        return;
+    }
+    console.log(`${agent}: automatic scoring ${judge.enabled ? "on" : "off"}`);
+    console.log(`  scores ${judge.scoreNames.join(", ")} · ${Math.round(judge.sampleRate * 100)}% of runs, up to ${judge.dailyMaxRuns}/day · ${judge.model}`);
+    if (judge.judgeKey)
+        console.log(`  billed to ${judge.judgeKey.name}${judge.judgeKey.monthlyBudgetUsd !== null ? ` ($${judge.judgeKey.monthlyBudgetUsd}/mo)` : ""} · ${judge.judgedToday} judged in 24h${judge.errorsToday ? `, ${judge.errorsToday} failed` : ""}`);
+    if (judge.lastError)
+        console.log(`  last problem: ${judge.lastError}`);
+}
+async function runJudge(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    const help = "codiedev traces judge <agent> [--on | --off] [--scores a,b] [--instructions text] [--model id] [--sample percent] [--daily n] [--budget usd | --key cdvm_…]";
+    if (!agent)
+        usage(help);
+    const changing = p.bools.has("--on") || p.bools.has("--off") || Object.keys(p.flags).length > 0;
+    if (!changing) {
+        const res = await call(config, "codiedev_traces_judge", "GET", "judge", { query: { agent } });
+        printJudge(res.agent, res.judge);
+        return;
+    }
+    const res = await call(config, "codiedev_traces_judge_set", "POST", "judge", {
+        body: {
+            agent,
+            ...(p.bools.has("--on") ? { enabled: true } : p.bools.has("--off") ? { enabled: false } : {}),
+            ...(p.flags["--scores"] ? { scores: p.flags["--scores"].split(",").map((s) => s.trim()).filter(Boolean) } : {}),
+            ...(p.flags["--instructions"] ? { instructions: p.flags["--instructions"] } : {}),
+            ...(p.flags["--model"] ? { model: p.flags["--model"] } : {}),
+            ...(p.flags["--sample"] ? { sampleRate: Number(p.flags["--sample"]) / 100 } : {}),
+            ...(p.flags["--daily"] ? { dailyMaxRuns: Number(p.flags["--daily"]) } : {}),
+            ...(p.flags["--budget"] ? { newKeyBudgetUsd: Number(p.flags["--budget"]) } : {}),
+            ...(p.flags["--key"] ? { pastedKey: p.flags["--key"] } : {}),
+        },
+    });
+    printJudge(res.agent, res.judge);
+}
+async function runImport(args, config) {
+    const p = parseArgs(args);
+    const [agent, file] = p.positional;
+    const dataset = p.flags["--dataset"];
+    if (!agent || !file || !dataset)
+        usage("codiedev traces import <agent> <file.csv|file.jsonl> --dataset <name>");
+    let text;
+    try {
+        text = fs.readFileSync(path.resolve(process.cwd(), file), "utf8");
+    }
+    catch (err) {
+        console.error(`Couldn't read ${file}: ${err.message}`);
+        process.exit(1);
+    }
+    const res = await call(config, "codiedev_traces_import", "POST", "examples", { body: { agent, dataset, text } });
+    console.log(`✓ Imported ${res.added} ${res.added === 1 ? "example" : "examples"} into ${dataset} for ${agent}.`);
+    for (const e of res.errors.slice(0, 10))
+        console.log(`  skipped${e.line ? ` line ${e.line}` : ""}: ${e.error}`);
+}
+async function runAddExample(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    const dataset = p.flags["--dataset"];
+    const input = p.flags["--input"];
+    if (!agent || !dataset || !input)
+        usage("codiedev traces add-example <agent> --dataset <name> --input <text> [--expected <text>] [--name <text>]");
+    await call(config, "codiedev_traces_add_example", "POST", "examples", { body: { agent, dataset, input, expected: p.flags["--expected"], name: p.flags["--name"] } });
+    console.log(`✓ Added an example to ${dataset} for ${agent}.`);
+}
+async function runVersions(args, config) {
+    const dataset = parseArgs(args).positional[0];
+    if (!dataset)
+        usage("codiedev traces versions <dataset>");
+    const res = await call(config, "codiedev_traces_versions", "GET", "versions", { query: { dataset } });
+    if (!res.versions.length)
+        console.log(`${dataset} has no saved versions. Save one with: codiedev traces save-version "${dataset}"`);
+    for (const v of res.versions)
+        console.log(`v${v.version}  ${String(v.cases).padStart(4)} cases  ${new Date(v.createdAt).toISOString().slice(0, 10)}  +${v.added} −${v.removed} ${v.changed} edited${v.note ? `  ${v.note}` : ""}`);
+    if (res.unsaved)
+        console.log(`Unsaved since v${res.versions[0].version}: +${res.unsaved.added} −${res.unsaved.removed} ${res.unsaved.changed} edited`);
+}
+async function runSaveVersion(args, config) {
+    const p = parseArgs(args);
+    const dataset = p.positional[0];
+    if (!dataset)
+        usage("codiedev traces save-version <dataset> [--note text]");
+    const res = await call(config, "codiedev_traces_save_version", "POST", "versions", { body: { dataset, note: p.flags["--note"] } });
+    console.log(`✓ Saved ${dataset} as v${res.version} (${res.cases} cases). Run it later with --dataset "${dataset}" --version ${res.version}.`);
+}
+const usd = (n) => (n === 0 ? "$0" : n < 0.01 ? "<$0.01" : `$${n.toFixed(2)}`);
+const json = (p, value) => { if (p.bools.has("--json")) {
+    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+    return true;
+} return false; };
+async function runOverview(args, config) {
+    const p = parseArgs(args);
+    const res = await call(config, "codiedev_traces_overview", "GET", "overview", { query: { days: p.flags["--days"] ?? "7" } });
+    if (json(p, res))
+        return;
+    if (!res.agents.length) {
+        console.log("No agents you can see yet. Connect one in Codiedev → Traces.");
+        return;
+    }
+    console.log(`Agents, last ${res.range}:`);
+    for (const a of res.agents)
+        console.log(`  ${a.name.padEnd(28)} ${String(a.runs).padStart(6)} runs  ${String(a.failedRuns).padStart(5)} failed  ${usd(a.spend7dUsd).padStart(9)} 7d spend  ${a.keepsPromptsDays ? `prompts ${a.keepsPromptsDays}d` : "metadata only"}${a.spike ? "  spend spike" : ""}${a.budgetBlock ? "  budget block" : ""}`);
+    if (res.issues.length) {
+        console.log("\nWhat's going wrong:");
+        for (const i of res.issues)
+            console.log(`  ${i.label.padEnd(18)} ${String(i.runs).padStart(5)} runs  ${usd(i.wastedUsd).padStart(9)} wasted  ${i.agents.join(", ")}${i.exampleRun ? `  e.g. ${i.exampleRun}` : ""}`);
+    }
+}
+async function runRuns(args, config) {
+    const p = parseArgs(args);
+    const agent = p.positional[0];
+    if (!agent)
+        usage("codiedev traces runs <agent> [--failed] [--flag errors|truncated|tool_loop|context_overflow|budget_block] [--model id] [--verdict pass|fail] [--days n] [--limit n] [--json]");
+    const res = await call(config, "codiedev_traces_runs", "GET", "runs", {
+        query: { agent, days: p.flags["--days"] ?? "7", ...(p.bools.has("--failed") ? { failed: "1" } : {}), ...(p.flags["--flag"] ? { flag: p.flags["--flag"] } : {}), ...(p.flags["--model"] ? { model: p.flags["--model"] } : {}), ...(p.flags["--verdict"] ? { verdict: p.flags["--verdict"] } : {}), limit: p.flags["--limit"] ?? "50" },
+    });
+    if (json(p, res))
+        return;
+    console.log(`${res.total} ${res.total === 1 ? "run" : "runs"} for ${res.agent}, last ${res.range}${res.total > res.runs.length ? ` (newest ${res.runs.length})` : ""}:`);
+    for (const r of res.runs)
+        console.log(`  ${r.startedAt.slice(0, 16).replace("T", " ")}  ${r.status === "failed" ? "FAIL" : " ok "}  ${r.runId.padEnd(24)} ${String(r.steps).padStart(3)} calls ${usd(r.costUsd).padStart(8)}  ${r.model ?? ""}${r.flags.length ? `  [${r.flags.join(", ")}]` : ""}${r.verdict ? `  marked ${r.verdict}` : ""}`);
+    if (res.runs.length)
+        console.log(`\nOpen one: codiedev traces run ${res.runs[0].runId} --agent "${res.agent}"`);
+}
+async function runRun(args, config) {
+    const p = parseArgs(args);
+    const run = p.positional[0];
+    if (!run)
+        usage("codiedev traces run <run> [--agent name] [--json]");
+    const res = await call(config, "codiedev_traces_run", "GET", "run", { query: { run, ...(p.flags["--agent"] ? { agent: p.flags["--agent"] } : {}) } });
+    if (json(p, res))
+        return;
+    const r = res.run;
+    console.log(`${r.title} · ${r.id}`);
+    console.log(`${new Date(r.startedAt).toISOString().slice(0, 16).replace("T", " ")} · ${r.status === "failed" ? "FAILED" : "ok"} · ${Math.round(r.durationMs / 100) / 10}s · ${usd(r.costUsd)}${r.flags.length ? ` · ${r.flags.join(", ")}` : ""}`);
+    if (r.diagnosis)
+        console.log(`\nWhat went wrong: ${r.diagnosis.title}\n  ${r.diagnosis.why}\n\nFix (for your coding agent):\n${r.diagnosis.fix.split("\n").map((l) => `  ${l}`).join("\n")}`);
+    if (r.annotation)
+        console.log(`\nMarked ${r.annotation.verdict} by ${r.annotation.by}${r.annotation.reason ? `: ${r.annotation.reason}` : ""}`);
+    if (res.scores.length)
+        console.log(`\nScores: ${res.scores.map((s) => `${s.name} ${s.text}${s.step ? ` (step ${s.step})` : ""} by ${s.by ?? s.source}${s.comment ? ` "${s.comment}"` : ""}`).join("; ")}`);
+    console.log("\nSteps:");
+    for (const s of r.spans.filter((x) => x.kind !== "run")) {
+        console.log(`  ${s.kind === "tool" ? "tool" : "call"}  ${s.name}  ${Math.round(s.durationMs)}ms${s.costUsd !== undefined ? `  ${usd(s.costUsd)}` : ""}${s.finishReason ? `  finish: ${s.finishReason}` : ""}${s.statusCode && s.statusCode >= 400 ? `  HTTP ${s.statusCode}` : ""}${s.flag ? `  [${s.flag}]` : ""}${s.note ? `  ${s.note}` : ""}`);
+        if (s.input)
+            console.log(`      prompt: ${s.input.replace(/\s+/g, " ").slice(0, 300)}`);
+        if (s.output)
+            console.log(`      reply:  ${s.output.replace(/\s+/g, " ").slice(0, 300)}`);
+    }
+    if (!r.bodiesVisible)
+        console.log("\n(Prompts and replies are shown only to the agent's maintainers.)");
+}
+async function runScoreKinds(args, config) {
+    const [verb, ...rest] = args;
+    if (verb === "add") {
+        const p = parseArgs(rest);
+        const name = p.positional[0];
+        const type = p.flags["--type"];
+        if (!name || !type)
+            usage("codiedev traces score-kinds add <name> --type number|categories|boolean [--min n --max n] [--categories a,b,c] [--description text]");
+        const dataType = type === "number" || type === "numeric" ? "numeric" : type === "categories" || type === "categorical" ? "categorical" : type === "boolean" || type === "bool" ? "boolean" : type;
+        await call(config, "codiedev_traces_score_kind_add", "POST", "score-kinds", {
+            body: { name, type: dataType, ...(p.flags["--min"] ? { min: Number(p.flags["--min"]) } : {}), ...(p.flags["--max"] ? { max: Number(p.flags["--max"]) } : {}), ...(p.flags["--categories"] ? { categories: p.flags["--categories"].split(",").map((c) => c.trim()) } : {}), ...(p.flags["--description"] ? { description: p.flags["--description"] } : {}) },
+        });
+        console.log(`✓ Added score kind ${name}.`);
+        return;
+    }
+    const p = parseArgs(verb === undefined || verb === "list" ? rest : args);
+    const res = await call(config, "codiedev_traces_score_kinds", "GET", "score-kinds", {});
+    if (json(p, res))
+        return;
+    const live = res.kinds.filter((k) => !k.archived);
+    if (!live.length)
+        console.log("No score kinds yet. Add one: codiedev traces score-kinds add helpfulness --type number --min 1 --max 5");
+    for (const k of live)
+        console.log(`  ${k.name.padEnd(24)} ${k.dataType === "numeric" ? `number ${k.min ?? ""}–${k.max ?? ""}` : k.dataType === "boolean" ? "true / false" : k.categories.join(" / ")}${k.description ? `  ${k.description}` : ""}`);
+}
+async function runQueueCreate(args, config) {
+    const p = parseArgs(args);
+    const name = p.positional[0];
+    if (!name)
+        usage("codiedev traces queue create <name> [--scores a,b] [--description text]");
+    await call(config, "codiedev_traces_queue_create", "POST", "queues", { body: { name, scores: (p.flags["--scores"] ?? "").split(",").map((s) => s.trim()).filter(Boolean), ...(p.flags["--description"] ? { description: p.flags["--description"] } : {}) } });
+    console.log(`✓ Created review queue ${name}. Add runs: codiedev traces queue add "${name}" --agent <name> --failed`);
+}

package/dist/configDir.d.ts

@@ -1 +1,10 @@
+/**
+ * The user's home, always absolute. $HOME can arrive relative or unexpanded ("~", ".", "") from a
+ * sandboxed shell or a wrapper; trusting it once wrote hook commands like ".codiedev/bin/…" into
+ * ~/.claude/settings.json, which only resolve when Claude Code starts in the home folder, so
+ * capture silently failed in every project. Fall back to the account's home from the OS.
+ */
+export declare function realHome(): string;
+/** $HOME when it's a real absolute path, else the OS account's home, else resolved against cwd. */
+export declare function pickHome(fromEnv: string | undefined, fromOs: string | undefined): string;
 export declare function codiedevStateDir(): string;

package/dist/configDir.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.realHome = realHome;
+exports.pickHome = pickHome;
 exports.codiedevStateDir = codiedevStateDir;
 // Single source of truth for where the CLI's config/state lives on disk.
 //
@@ -46,9 +48,31 @@ exports.codiedevStateDir = codiedevStateDir;
 // without creating a circular import.
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+/**
+ * The user's home, always absolute. $HOME can arrive relative or unexpanded ("~", ".", "") from a
+ * sandboxed shell or a wrapper; trusting it once wrote hook commands like ".codiedev/bin/…" into
+ * ~/.claude/settings.json, which only resolve when Claude Code starts in the home folder, so
+ * capture silently failed in every project. Fall back to the account's home from the OS.
+ */
+function realHome() {
+    let fromOs;
+    try {
+        fromOs = os.userInfo().homedir;
+    }
+    catch { /* no passwd entry */ }
+    return pickHome(os.homedir(), fromOs);
+}
+/** $HOME when it's a real absolute path, else the OS account's home, else resolved against cwd. */
+function pickHome(fromEnv, fromOs) {
+    if (fromEnv && path.isAbsolute(fromEnv) && !fromEnv.split(path.sep).includes("~"))
+        return fromEnv;
+    if (fromOs && path.isAbsolute(fromOs))
+        return fromOs;
+    return path.resolve(fromEnv || ".");
+}
 const CONFIG_DIR = process.env.CODIEDEV_CONFIG_DIR?.trim()
     ? path.resolve(process.env.CODIEDEV_CONFIG_DIR.trim())
-    : path.join(os.homedir(), ".codiedev");
+    : path.join(realHome(), ".codiedev");
 function codiedevStateDir() {
     return CONFIG_DIR;
 }

package/dist/connect.js

@@ -41,6 +41,7 @@ const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
@@ -60,6 +61,16 @@ const BACKEND_URL = process.env.CODIEDEV_URL || "https://cli.codiedev.com";
  * input in CI). Without a TTY there's no echo to suppress anyway, and
  * raw mode would error.
  */
+/** One visible line from the terminal (for yes/no questions). */
+function prompt(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
 function promptHidden(question) {
     return new Promise((resolve) => {
         const stdin = process.stdin;
@@ -168,16 +179,47 @@ async function runConnect(args = []) {
     // mint a fresh token from the portal — which is what bit Sonifi's first
     // engineer when he interpreted "no visible token" as "the old one is gone".
     const force = args.includes("--force") || args.includes("-f");
+    // `--token`: paste an API token instead of signing in (CI). Otherwise sign
+    // in with the browser: a loopback redirect on a desktop, a device code
+    // (approve on any device) over SSH or with no display, detected
+    // automatically. `--no-browser` / `--browser` force one or the other.
+    const pasteToken = args.includes("--token");
+    const useDevice = args.includes("--no-browser") || (!args.includes("--browser") && (0, cliSession_1.isHeadless)());
     console.log("\nWelcome to Codiedev CLI\n");
     await (0, upgradeNudge_1.maybePrintUpgradeNudge)();
     console.log("This will connect your coding agent to your Codiedev workspace and install");
     console.log("the session capture hook for org-wide session sharing.\n");
+    // A saved browser sign-in is reused only if it still works: refresh it
+    // first (a revoked one comes back signed out, with an empty token).
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const saved = (0, utils_1.readConfig)();
-    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force });
+    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force: force || pasteToken });
     let token;
+    let auth;
     if (decision.source === "reused") {
         token = decision.token;
-        console.log(`Reusing API token from ~/.codiedev/config.json (run with --force to use a new one).\n`);
+        auth = saved?.auth;
+        console.log(auth
+            ? `Reusing your browser sign-in from ~/.codiedev/config.json (run with --force to sign in again).\n`
+            : `Reusing API token from ~/.codiedev/config.json (run with --force to sign in again).\n`);
+    }
+    else if (!pasteToken) {
+        // Replacing a browser sign-in: end the old one so the portal doesn't
+        // keep listing it.
+        if (saved?.auth)
+            await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
+        const result = await (0, connectFlow_1.signInWithTokenFallback)({
+            signIn: () => useDevice ? (0, cliSession_1.deviceLogin)({ backendUrl: BACKEND_URL }) : (0, cliSession_1.browserLogin)({ backendUrl: BACKEND_URL }),
+            interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+            askYesNo: async (q) => /^y(es)?$/i.test((await prompt(q)).trim()),
+            askToken: promptHidden,
+            log: (line) => console.log(line),
+            error: (line) => console.error(line),
+        });
+        if (!result)
+            process.exit(1);
+        token = result.token;
+        auth = result.auth;
     }
     else {
         // Hidden prompt — masks the token with `*` as it's typed/pasted so it
@@ -217,6 +259,7 @@ async function runConnect(args = []) {
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
+        ...(auth ? { auth } : {}),
     };
     try {
         (0, utils_1.writeConfig)(config);

package/dist/connectFlow.d.ts

@@ -11,3 +11,24 @@ export type ConnectTokenResult = {
     source: "prompt-required";
 };
 export declare function resolveConnectToken(input: ConnectTokenInput): ConnectTokenResult;
+export interface SignInResult {
+    token: string;
+    auth?: import("./cliSession").BrowserAuth;
+}
+export interface SignInDeps {
+    /** Browser (loopback) or device-code sign-in; throws on failure. */
+    signIn: () => Promise<import("./cliSession").TokenSet>;
+    /** A person at a terminal who can answer prompts. */
+    interactive: boolean;
+    askYesNo: (question: string) => Promise<boolean>;
+    askToken: (question: string) => Promise<string>;
+    log: (line: string) => void;
+    error: (line: string) => void;
+}
+/**
+ * Browser sign-in, with the API-token paste as the way out: if the browser
+ * flow fails (blocked page, expired code, proxy) an interactive user is asked
+ * whether to paste a token instead, rather than being sent to rerun connect.
+ * Returns null when there's nothing to continue with (caller exits 1).
+ */
+export declare function signInWithTokenFallback(deps: SignInDeps): Promise<SignInResult | null>;

package/dist/connectFlow.js

@@ -10,6 +10,7 @@
 // generate a new one — leaving him thinking the old one had been lost.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveConnectToken = resolveConnectToken;
+exports.signInWithTokenFallback = signInWithTokenFallback;
 function resolveConnectToken(input) {
     if (input.force)
         return { source: "prompt-required" };
@@ -19,3 +20,43 @@ function resolveConnectToken(input) {
         return { source: "prompt-required" };
     return { source: "reused", token: input.savedConfig.token };
 }
+/**
+ * Browser sign-in, with the API-token paste as the way out: if the browser
+ * flow fails (blocked page, expired code, proxy) an interactive user is asked
+ * whether to paste a token instead, rather than being sent to rerun connect.
+ * Returns null when there's nothing to continue with (caller exits 1).
+ */
+async function signInWithTokenFallback(deps) {
+    deps.log("Prefer an API token? Press Ctrl+C and run `codiedev connect --token`.\n");
+    try {
+        const s = await deps.signIn();
+        deps.log("Signed in. No API key is stored on this machine.\n");
+        return {
+            token: s.accessToken,
+            auth: {
+                kind: "browser",
+                clientId: s.clientId,
+                refreshToken: s.refreshToken,
+                accessTokenExpiresAt: s.expiresAt,
+            },
+        };
+    }
+    catch (err) {
+        deps.error(`\nBrowser sign-in didn't finish: ${err.message}`);
+        if (!deps.interactive) {
+            deps.error("To paste an API token instead, run `codiedev connect --token`.");
+            return null;
+        }
+        if (!(await deps.askYesNo("Paste an API token instead? [y/N] "))) {
+            deps.error("Run `codiedev connect` to try again, or `codiedev connect --token` to paste a token.");
+            return null;
+        }
+        deps.log("Create one at https://codiedev.com/portal/integrations/claude-code\n");
+        const token = (await deps.askToken("Enter your Codiedev API token: ")).trim();
+        if (!token) {
+            deps.error("Error: API token is required.");
+            return null;
+        }
+        return { token };
+    }
+}

package/dist/hook.js

@@ -60,6 +60,8 @@ const captureExclusions_1 = require("./captureExclusions");
 const cursorHooks_1 = require("./cursorHooks");
 const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
+const cliSession_1 = require("./cliSession");
+const utils_2 = require("./utils");
 // Pure builder for the discovery additionalContext. Returns null when there are
 // no matches. The suggested `codiedev pull` command carries the EXACT top key
 // (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
@@ -440,6 +442,11 @@ function resolveMode(arg) {
     return "claude-code";
 }
 async function main() {
+    // Browser sign-in: refresh the access token under the shared lock before
+    // anything reads config (cliSession.ts). A no-op for pasted API tokens and
+    // for tokens with time left; never throws, never prints (hook stdout is
+    // the agent's).
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
     // Shared upload deps used by both "upload" and "upload-deferred" branches.
     // Extracted to keep both branches in lockstep — any new dep added here
     // automatically applies to the deferred path too.

package/dist/launcher.d.ts

@@ -8,13 +8,18 @@ export declare function launcherPath(): string;
 /** True iff `cmd` invokes the stable launcher (from any state dir). */
 export declare function usesLauncher(cmd: string | undefined): boolean;
 export declare function readInstallRecord(): InstallRecord | null;
+/**
+ * The hook script worth recording: absolute and present, and a global install over an npx cache
+ * copy (npm prunes ~/.npm/_npx, and hooks pointed there go quietly dead). Null = don't record.
+ */
+export declare function stableHookScript(hookScript: string, globalCandidates?: string[]): string | null;
 /** Point the launcher at `hookScript`. Atomic, so a hook mid-launch never reads half a file. */
-export declare function recordCurrentInstall(hookScript: string): boolean;
+export declare function recordCurrentInstall(requested: string): boolean;
 /**
  * Make sure the launcher exists and forwards to `hookScript`, returning the
  * launcher path to bake into hook configs — or null if the state dir is not
  * writable, in which case callers keep baking the direct path. Memoized:
  * one connect writes ~20 hook entries.
  */
-export declare function ensureLauncher(hookScript: string): string | null;
+export declare function ensureLauncher(requested: string): string | null;
 export declare function resetLauncherCacheForTests(): void;