codiedev 0.9.78 → 0.9.80

package/dist/launcher.js

@@ -48,6 +48,7 @@ exports.LAUNCHER_FILE = void 0;
 exports.launcherPath = launcherPath;
 exports.usesLauncher = usesLauncher;
 exports.readInstallRecord = readInstallRecord;
+exports.stableHookScript = stableHookScript;
 exports.recordCurrentInstall = recordCurrentInstall;
 exports.ensureLauncher = ensureLauncher;
 exports.resetLauncherCacheForTests = resetLauncherCacheForTests;
@@ -114,8 +115,35 @@ function packageVersionFor(hookScript) {
         return undefined;
     }
 }
+/**
+ * The hook script worth recording: absolute and present, and a global install over an npx cache
+ * copy (npm prunes ~/.npm/_npx, and hooks pointed there go quietly dead). Null = don't record.
+ */
+function stableHookScript(hookScript, globalCandidates = globalHookScripts()) {
+    if (!hookScript || !path.isAbsolute(hookScript) || hookScript.includes(`${path.sep}~${path.sep}`))
+        return null;
+    if (!fs.existsSync(hookScript))
+        return null;
+    if (hookScript.includes(`${path.sep}_npx${path.sep}`)) {
+        const global = globalCandidates.find((p) => path.isAbsolute(p) && fs.existsSync(p));
+        if (global)
+            return global;
+    }
+    return hookScript;
+}
+/** Where a global `npm i -g codiedev` puts hook.js, next to the node running this. */
+function globalHookScripts() {
+    const prefix = path.dirname(path.dirname(process.execPath));
+    return [
+        path.join(prefix, "lib", "node_modules", "codiedev", "dist", "hook.js"),
+        path.join(prefix, "node_modules", "codiedev", "dist", "hook.js"),
+    ];
+}
 /** Point the launcher at `hookScript`. Atomic, so a hook mid-launch never reads half a file. */
-function recordCurrentInstall(hookScript) {
+function recordCurrentInstall(requested) {
+    const hookScript = stableHookScript(requested);
+    if (!hookScript)
+        return false;
     try {
         const record = {
             hookScript,
@@ -136,11 +164,17 @@ let ensuredFor;
  * writable, in which case callers keep baking the direct path. Memoized:
  * one connect writes ~20 hook entries.
  */
-function ensureLauncher(hookScript) {
+function ensureLauncher(requested) {
+    const hookScript = stableHookScript(requested);
+    if (!hookScript)
+        return null;
     if (ensuredFor !== undefined && ensuredFor === hookScript)
         return launcherPath();
     try {
         const target = launcherPath();
+        // A relative launcher path in a hook config only works from one folder; never bake one.
+        if (!path.isAbsolute(target))
+            return null;
         const source = launcherSource(hookScript);
         let current = null;
         try {

package/dist/managedPi.js

@@ -94,7 +94,8 @@ exports.BLOCKED_BASE_URL = "http://127.0.0.1:9/blocked-by-codiedev";
  * joins the captured pi session (same headers as the OpenCode metadata
  * plugin, assets/git-refs.mjs). */
 exports.GUARD_SOURCE = `// Written by Codiedev on every \`codie --pi\` launch. Edits are overwritten.
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { getProviders } from "@mariozechner/pi-ai";
 
 const PROVIDER = ${JSON.stringify(exports.PI_PROVIDER_ID)};
@@ -153,8 +154,23 @@ export default function (pi) {
     const p = String(event?.input?.path ?? "").replace(/\\\\/g, "/").match(/\\/([a-z0-9][a-z0-9_.:-]{0,119})\\/SKILL\\.md$/i);
     if (event?.toolName === "read" && !event.isError && p && skills.size < 50) skills.add(p[1]);
   });
+  // Browser sign-in: pi reads CODIEDEV_GATEWAY_KEY at request time, so put
+  // the current token there, refreshing it as it nears expiry (same logic as
+  // assets/session-key.mjs). Pasted API tokens: no variables, nothing changes.
+  const freshKey = async () => {
+    const env = process.env;
+    if (!env.CODIEDEV_SESSION_CONFIG || !env.CODIEDEV_CLI_JS || !env.CODIEDEV_NODE) return;
+    const read = () => { try { const c = JSON.parse(readFileSync(env.CODIEDEV_SESSION_CONFIG, "utf8")); return c && c.auth && c.token ? c : null; } catch { return null; } };
+    let s = read();
+    if (!s) return;
+    if (!(Number(s.auth.accessTokenExpiresAt) - Date.now() > 30 * 60000)) {
+      await new Promise((r) => execFile(env.CODIEDEV_NODE, [env.CODIEDEV_CLI_JS, "session-refresh"], { timeout: 30000 }, () => r()));
+      s = read() ?? s;
+    }
+    env.CODIEDEV_GATEWAY_KEY = s.token;
+  };
   // Before every model call in the turn: the agent may have switched branch.
-  pi.on("turn_start", async (_event, ctx) => tag(ctx));
+  pi.on("turn_start", async (_event, ctx) => { await freshKey(); tag(ctx); });
   pi.on("before_provider_request", (_event, ctx) => {
     // Belt and braces: the request is already headed for BLOCKED.
     if (!ours(ctx.model)) ctx.abort();

package/dist/mcp.js

@@ -51,6 +51,7 @@ const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const shared_1 = require("./commands/shared");
 const inboxFormat_1 = require("./inboxFormat");
 const PKG_NAME = "codiedev";
@@ -399,6 +400,8 @@ function emitTelemetry(config, event) {
     });
 }
 server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+    // Long-lived process: the access token may expire while it runs.
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const config = (0, utils_1.readConfig)();
     if (!config) {
         return {

package/dist/utils.d.ts

@@ -6,6 +6,7 @@ import type { CaptureLogEntry } from "./captureLog";
 import { codiedevStateDir } from "./configDir";
 export { inspectPiExtension, piExtensionPath } from "./piHooks";
 export { codiedevStateDir };
+import type { BrowserAuth } from "./cliSession";
 export interface CodiedevConfig {
     token: string;
     companyId: string;
@@ -20,6 +21,7 @@ export interface CodiedevConfig {
     deviceId?: string;
     deviceName?: string;
     captureIgnoredPaths?: string[];
+    auth?: BrowserAuth;
 }
 export declare const CONFIG_PATH: string;
 export declare function readConfig(): CodiedevConfig | null;

package/dist/utils.js

@@ -150,6 +150,7 @@ const piHooks_1 = require("./piHooks");
 var piHooks_2 = require("./piHooks");
 Object.defineProperty(exports, "inspectPiExtension", { enumerable: true, get: function () { return piHooks_2.inspectPiExtension; } });
 Object.defineProperty(exports, "piExtensionPath", { enumerable: true, get: function () { return piHooks_2.piExtensionPath; } });
+const cliSession_1 = require("./cliSession");
 const CONFIG_DIR = (0, configDir_1.codiedevStateDir)();
 exports.CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 function readConfig() {
@@ -171,12 +172,9 @@ function writeConfigAtPath(config, configDir, configPath) {
     if (!fs.existsSync(configDir)) {
         fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    // writeFile's mode does not replace permissions on a pre-existing file.
-    fs.chmodSync(configPath, 0o600);
+    // Temp file + rename: hooks read this file concurrently, and a torn read
+    // looks like "not connected". The temp file is created 0600.
+    (0, cliSession_1.writeConfigAtomic)(configPath, config);
 }
 // Parse a remote URL out of git-config INI text WITHOUT invoking git. Prefers
 // the "origin" remote; falls back to the first remote found. Returns null if
@@ -1038,7 +1036,11 @@ function resolveHookInvocation(subcommand, preferredNodePath) {
                 // Bake the stable launcher, not this install's path, so later
                 // upgrades (including pnpm's hashed dirs) never strand the hook.
                 const launcher = (0, launcher_1.ensureLauncher)(hookScript);
-                return { command: nodePath, args: [launcher ?? hookScript, subcommand] };
+                // No launcher and no stable install to point at (e.g. an npx cache under a bogus "~"):
+                // the npx fallback below beats baking a path that won't exist tomorrow.
+                if (launcher || (0, launcher_1.stableHookScript)(hookScript)) {
+                    return { command: nodePath, args: [launcher ?? hookScript, subcommand] };
+                }
             }
         }
     }
@@ -1681,7 +1683,13 @@ thought, use the \`codiedev\` CLI via Bash:**
 | "find something about X" / "has anyone solved Y?" | \`codiedev search "<query>" [--limit N]\` |
 | "why did we…?" / "what does the team know about X?" | \`codiedev ask "<question>"\` (synthesized answer + citations) |
 | "show my library" / "what artifacts exist?" | \`codiedev library [--scope mine\\|shared\\|all] [--kind doc\\|skill]\` |
-| "run my agent's test cases" / "check the dataset on model Y" | \`codiedev traces cases <agent> [--dataset <name>] [--model <id>]\` (writes cases + RUN_CASES.md + results.json; follow it, then \`codiedev traces report <results.json>\`) |
+| "run my agent's test cases" / "check the dataset on model Y" / "run v2 of the dataset" | \`codiedev traces cases <agent> [--dataset <name> [--version <n>]] [--model <id>]\` (writes cases + RUN_CASES.md + results.json; follow it, then \`codiedev traces report <results.json>\`) |
+| "how are my agents doing?" / "what's failing this week?" / "show the booking agent's failed runs" / "why did run X fail?" | \`codiedev traces overview\`; \`codiedev traces runs <agent> [--failed] [--flag <issue>] [--days n]\`; \`codiedev traces run <run> --agent <name>\` (add \`--json\` to read the data yourself) |
+| "add a helpfulness 1–5 score" / "make a review queue for tone" | \`codiedev traces score-kinds add <name> --type number --min 1 --max 5\`; \`codiedev traces queue create <name> --scores <a,b>\` |
+| "score that run 4 for helpfulness" / "how is my agent scoring?" | \`codiedev traces score <run> <score> <value> [--agent <name>] [--comment <why>]\`; \`codiedev traces scores <agent>\` |
+| "put this week's failed runs in the review queue" | \`codiedev traces queue list\`; \`codiedev traces queue add <queue> --agent <name> [--failed] [--days n]\` |
+| "have a judge score 10% of my agent's runs" / "turn off automatic scoring" | \`codiedev traces judge <agent> --on --scores <a,b> --sample 10 [--budget 25]\`; \`--off\`; no flags shows it |
+| "import these test cases from a CSV" / "add an example to the dataset" / "save the dataset as a version" | \`codiedev traces import <agent> <file> --dataset <name>\`; \`codiedev traces add-example <agent> --dataset <name> --input "…" [--expected "…"]\`; \`codiedev traces save-version <dataset>\`; \`codiedev traces versions <dataset>\` |
 | "what was the last eval on X?" / "file these eval results" | \`codiedev evals last <subject>\` before starting a related eval; \`codiedev evals report <run.json>\` after each variant runs (scores only — \`codiedev evals help\` for the shape) |
 
 **Just push the file — we'll figure out where it goes.** Every artifact

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.78",
+  "version": "0.9.80",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",