codiedev 0.9.79 → 0.9.80

package/assets/opencode-plugin.mjs

@@ -10,6 +10,7 @@ import {
   trackWorkPath,
   workDirBySession,
 } from "./git-refs.mjs";
+import { freshGatewayKey } from "./session-key.mjs";
 
 const skillUseBySession = new Map();
 
@@ -60,6 +61,11 @@ export const CodiedevMetadata = async () => ({
     });
   },
   "chat.headers": async (input, output) => {
+    // Browser sign-in: the current 24h token, refreshed as it nears expiry,
+    // so a session open for days keeps working (see session-key.mjs). Exact
+    // "Authorization" key: per-call headers win over the apiKey-derived one.
+    const key = await freshGatewayKey();
+    if (key) output.headers.Authorization = `Bearer ${key}`;
     Object.assign(
       output.headers,
       buildAttributionHeaders({

package/assets/session-key.mjs

@@ -0,0 +1,48 @@
+// The gateway key for one model request, kept fresh for the whole session.
+//
+// With browser sign-in (`codiedev connect`), the key is a 24h access token.
+// The engine (OpenCode, pi) would otherwise hold the one it was launched
+// with until the session ends, so a session open for more than a day would
+// start failing. `codie` sets these variables only for a browser sign-in:
+//   CODIEDEV_SESSION_CONFIG  path to ~/.codiedev/config.json
+//   CODIEDEV_CLI_JS          the CLI entry (dist/cli.js)
+//   CODIEDEV_NODE            the node binary that runs it
+// Each request reads the current token from config (other codiedev
+// processes may have refreshed it). When it has under 30 minutes left, this
+// runs `codiedev session-refresh`, which refreshes under the shared lock
+// (cliSession.ts, specs/tla/CliSession.tla), then reads again.
+// No variables (pasted API token, CI): returns null and the launch key stands.
+
+import { execFile } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+export const REFRESH_WHEN_LEFT_MS = 30 * 60_000;
+
+function readSession(path) {
+  try {
+    const c = JSON.parse(readFileSync(path, "utf8"));
+    return c && c.auth && typeof c.token === "string" && c.token ? c : null;
+  } catch {
+    return null;
+  }
+}
+
+function runRefresh(env) {
+  return new Promise((resolve) => {
+    execFile(env.CODIEDEV_NODE, [env.CODIEDEV_CLI_JS, "session-refresh"], { timeout: 30_000, env }, () => resolve());
+  });
+}
+
+/** Fresh gateway key, or null when the session isn't a browser sign-in. */
+export async function freshGatewayKey(env = process.env, now = Date.now, refresh = runRefresh) {
+  const path = env.CODIEDEV_SESSION_CONFIG;
+  if (!path || !env.CODIEDEV_CLI_JS || !env.CODIEDEV_NODE) return null;
+  let session = readSession(path);
+  if (!session) return null;
+  const left = Number(session.auth.accessTokenExpiresAt) - now();
+  if (!(left > REFRESH_WHEN_LEFT_MS)) {
+    await refresh(env);
+    session = readSession(path) ?? session;
+  }
+  return session.token;
+}

package/dist/cli.js

@@ -15,6 +15,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const connect_1 = require("./connect");
+const cliSession_1 = require("./cliSession");
+const utils_1 = require("./utils");
 const push_1 = require("./commands/push");
 const delete_1 = require("./commands/delete");
 const pull_1 = require("./commands/pull");
@@ -45,8 +47,10 @@ Codiedev CLI
   someone left off across sessions and providers.
 
 Connect:
-  codiedev connect                       Link Claude Code / Codex / Cursor /
+  codiedev connect                       Sign in with your browser and link
+                                         Claude Code / Codex / Cursor /
                                          GitHub Copilot / pi to your org
+  codiedev logout                        Sign this machine out
   codiedev doctor                        Verify your setup after connecting
 
 Harness:
@@ -172,8 +176,9 @@ const COMMAND_HELP = {
     connect: `
 codiedev connect — link your agent CLI to Codiedev
 
-  Interactive setup. Prompts for an API token, then installs:
-    - ~/.codiedev/config.json            (token + org + tracked repos)
+  Opens your browser to sign in (approve once, no API key to copy), then
+  installs:
+    - ~/.codiedev/config.json            (sign-in + org + tracked repos)
     - ~/.claude/settings.json hook       (captures session transcripts)
     - ~/.claude/CLAUDE.md instructions   (teaches Claude the commands)
     - ~/.codex/hooks.json hook           (same, for Codex)
@@ -186,7 +191,27 @@ codiedev connect — link your agent CLI to Codiedev
 
   Re-run anytime to swap accounts or refresh the instruction block.
 
-  Get your token: https://codiedev.com/portal/integrations/claude-code
+  Over SSH or on a machine with no display it shows a link and a short code
+  instead: open the link on your laptop or phone, check the code, approve.
+  Detected automatically.
+
+  Options:
+    --token        Paste an API token instead of signing in with a browser
+                   (CI, or a machine with no browser anywhere). Create one at
+                   https://codiedev.com/portal/integrations/claude-code
+    --force, -f    Sign in again even if this machine is already connected.
+
+  Browser sign-in stores a 24-hour access token and a refresh token that
+  rotates on every use; nothing long-lived is saved. Revoke a machine from
+  Integrations in the portal, or run 'codiedev logout' on it.
+`.trim(),
+    logout: `
+codiedev logout — sign this machine out
+
+  Ends this machine's browser sign-in on the server and removes it from
+  ~/.codiedev/config.json. Device settings (ignored folders) are kept.
+  For a pasted API token, it's only forgotten locally: revoke it in the
+  portal under Integrations.
 `.trim(),
     push: `
 codiedev push — author or update an artifact
@@ -405,13 +430,15 @@ Run 'codiedev help <command>' for each, or see the quick list:
 
     codiedev help
 
-## Getting a token
+## Signing in
 
-  1. Log in to https://codiedev.com/portal/integrations/claude-code
-  2. Click "Create token"
-  3. Copy the cdv_... string and paste it into 'codiedev connect'
+  'codiedev connect' opens your browser; approve, and you're done. Nothing
+  long-lived is stored: a 24-hour access token plus a rotating refresh token.
 
-Tokens are per-user. Rotate any time by revoking + creating a new one.
+  Over SSH it shows a link and code to approve from your laptop or phone,
+  automatically. For CI, create a token at
+  https://codiedev.com/portal/integrations/claude-code and run
+  'codiedev connect --token'.
 `.trim();
 // Retired commands: say so instead of "Unknown command", since agent
 // instructions written by older installs may still reference them.
@@ -474,11 +501,41 @@ async function main() {
         console.log(`codiedev v${version_1.CLI_VERSION}`);
         return;
     }
+    // Browser sign-in: refresh the access token (under the shared lock) before
+    // the command reads config. No-op for pasted API tokens.
+    if (command !== "connect" && command !== "logout") {
+        const fresh = await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => null);
+        if (fresh?.status === "signed_out") {
+            console.error("\nYour Codiedev sign-in has ended (revoked or expired). Run `codiedev connect` to sign in again.\n");
+        }
+    }
     try {
         switch (command) {
             case "connect":
                 await (0, connect_1.runConnect)(rest);
                 return;
+            case "session-refresh": {
+                // Internal: the Codie engine's per-request hook asks for a fresh
+                // token when the current one has under 30 minutes left. Refreshes
+                // under the shared lock; prints nothing.
+                await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }, 60 * 60_000).catch(() => null);
+                return;
+            }
+            case "logout": {
+                const out = await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH });
+                if (!out.wasConnected) {
+                    console.log("This machine isn't signed in.");
+                }
+                else if (out.hadBrowserAuth) {
+                    console.log(out.serverRevoked
+                        ? "Signed out. This machine's sign-in is revoked."
+                        : "Signed out on this machine. Couldn't reach Codiedev to revoke the sign-in; revoke it under Integrations in the portal.");
+                }
+                else {
+                    console.log("Removed the API token from this machine. It still works elsewhere until you revoke it under Integrations in the portal.");
+                }
+                return;
+            }
             case "doctor":
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);

package/dist/cliSession.d.ts

@@ -0,0 +1,108 @@
+import type { CodiedevConfig } from "./utils";
+export interface BrowserAuth {
+    kind: "browser";
+    clientId: string;
+    refreshToken: string;
+    /** epoch ms when `token` (the access token) stops working */
+    accessTokenExpiresAt: number;
+}
+export interface TokenSet {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    clientId: string;
+}
+/** Default: refresh when less than 10 minutes remain. */
+export declare const DEFAULT_MIN_VALIDITY_MS: number;
+/** A lock older than this was left by a crashed process. Refresh calls time
+ * out well before it (REFRESH_TIMEOUT_MS), so a live holder never looks stale. */
+export declare const LOCK_STALE_MS = 30000;
+export interface SessionDeps {
+    configPath: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function readConfigAt(configPath: string): CodiedevConfig | null;
+/** rename(), retrying the transient Windows sharing errors. Exported for tests. */
+export declare function renameWithRetry(from: string, to: string, rename?: (a: string, b: string) => void, sleep?: (ms: number) => void): void;
+/**
+ * Write via temp file + rename so a concurrent reader never sees a torn file.
+ * If the rename still fails after ~1.6s of retries (a handle held that long),
+ * fall back to writing in place: a rare torn read beats failing `connect`.
+ */
+export declare function writeConfigAtomic(configPath: string, config: CodiedevConfig): void;
+export type FreshResult = {
+    status: "fresh";
+    config: CodiedevConfig;
+} | {
+    status: "refreshed";
+    config: CodiedevConfig;
+} | {
+    status: "adopted";
+    config: CodiedevConfig;
+} | {
+    status: "unavailable";
+    config: CodiedevConfig;
+} | {
+    status: "signed_out";
+    config: CodiedevConfig;
+} | {
+    status: "none";
+    config: CodiedevConfig | null;
+};
+/**
+ * Make sure config.token is a usable access token for at least
+ * `minValidityMs`. Never throws: auth problems surface as the next request's
+ * 401, which every command already explains.
+ */
+export declare function ensureFreshToken(deps: SessionDeps, minValidityMs?: number): Promise<FreshResult>;
+export declare function pkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function openBrowser(url: string): boolean;
+export interface LoginOptions {
+    backendUrl: string;
+    clientName?: string;
+    fetchImpl?: typeof fetch;
+    /** Test hook: called with the authorize URL instead of opening a browser. */
+    onAuthorizeUrl?: (url: string) => void;
+    log?: (line: string) => void;
+    now?: () => number;
+}
+/** Parse `code`/`state` (or `error`) out of a loopback callback URL. */
+export declare function parseCallback(input: string): {
+    code?: string;
+    state?: string;
+    error?: string;
+};
+export declare function browserLogin(opts: LoginOptions): Promise<TokenSet>;
+export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * True when a browser opened here can't reach the user: an SSH session, or a
+ * Linux box with no display. Then `connect` uses the device flow (a code the
+ * user approves on any device) instead of a loopback redirect, with no flag.
+ */
+export declare function isHeadless(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+export interface DeviceLoginOptions {
+    backendUrl: string;
+    clientName?: string;
+    fetchImpl?: typeof fetch;
+    log?: (line: string) => void;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    /** Test hook: receives the code + link instead of only printing them. */
+    onCode?: (info: {
+        userCode: string;
+        verificationUri: string;
+        verificationUriComplete: string;
+    }) => void;
+}
+export declare function deviceLogin(opts: DeviceLoginOptions): Promise<TokenSet>;
+/** `codiedev logout`: end a browser sign-in server-side, forget it locally. */
+export declare function logout(deps: SessionDeps): Promise<{
+    wasConnected: boolean;
+    hadBrowserAuth: boolean;
+    serverRevoked: boolean;
+}>;

package/dist/cliSession.js

@@ -0,0 +1,513 @@
+"use strict";
+// Browser sign-in for `codiedev connect`, and keeping its access token fresh.
+//
+// Sign-in is OAuth 2.1 authorization code + PKCE against the Codiedev
+// backend with a loopback redirect (RFC 8252): the CLI listens on
+// 127.0.0.1:<random port>, opens the portal's consent page, and exchanges the
+// returned code for a 24h access token (cdv_at_) and a 30-day refresh token
+// (cdv_rt_). No long-lived API key is saved.
+//
+// config.json keeps `token` = the current access token, so every existing
+// reader keeps working. Each process entry point (codiedev, codiedev-hook,
+// codie, the MCP server) calls ensureFreshToken() first; it refreshes when the
+// token is about to expire.
+//
+// Refresh tokens are single-use and the server treats reuse of a spent one as
+// theft (it revokes the whole sign-in). Many hooks run in parallel and share
+// config.json, so a refresh goes:
+//   1. read config, note the stale access token ("seen")
+//   2. take ~/.codiedev/refresh.lock
+//   3. re-read config; if the token is no longer "seen", another process
+//      already refreshed: use that, no network call
+//   4. else refresh, atomically replace config.json, release
+// specs/tla/CliSession.tla model-checks this: without step 2–3, two hooks can
+// both present the same refresh token and sign the user out.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_CODE_GRANT = exports.LOCK_STALE_MS = exports.DEFAULT_MIN_VALIDITY_MS = void 0;
+exports.readConfigAt = readConfigAt;
+exports.renameWithRetry = renameWithRetry;
+exports.writeConfigAtomic = writeConfigAtomic;
+exports.ensureFreshToken = ensureFreshToken;
+exports.pkcePair = pkcePair;
+exports.openBrowser = openBrowser;
+exports.parseCallback = parseCallback;
+exports.browserLogin = browserLogin;
+exports.isHeadless = isHeadless;
+exports.deviceLogin = deviceLogin;
+exports.logout = logout;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+/** Default: refresh when less than 10 minutes remain. */
+exports.DEFAULT_MIN_VALIDITY_MS = 10 * 60_000;
+/** A lock older than this was left by a crashed process. Refresh calls time
+ * out well before it (REFRESH_TIMEOUT_MS), so a live holder never looks stale. */
+exports.LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 20_000;
+const REFRESH_TIMEOUT_MS = 10_000;
+const LOGIN_TIMEOUT_MS = 10 * 60_000;
+// ─── config IO (atomic) ────────────────────────────────────────────────
+function readConfigAt(configPath) {
+    try {
+        return JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+// Windows refuses to replace a file another process holds without share-delete
+// (antivirus, the search indexer; Node's own readers do share). Those holds
+// last milliseconds, so retry like graceful-fs/write-file-atomic do.
+const RENAME_RETRY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_RETRY_MS = [10, 25, 50, 100, 200, 400, 800];
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/** rename(), retrying the transient Windows sharing errors. Exported for tests. */
+function renameWithRetry(from, to, rename = fs.renameSync, sleep = sleepSync) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (err) {
+            const code = err?.code ?? "";
+            if (!RENAME_RETRY_CODES.has(code) || attempt >= RENAME_RETRY_MS.length)
+                throw err;
+            sleep(RENAME_RETRY_MS[attempt]);
+        }
+    }
+}
+/**
+ * Write via temp file + rename so a concurrent reader never sees a torn file.
+ * If the rename still fails after ~1.6s of retries (a handle held that long),
+ * fall back to writing in place: a rare torn read beats failing `connect`.
+ */
+function writeConfigAtomic(configPath, config) {
+    const dir = path.dirname(configPath);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const data = JSON.stringify(config, null, 2);
+    const tmp = path.join(dir, `.config.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+    fs.writeFileSync(tmp, data, { encoding: "utf8", mode: 0o600 });
+    try {
+        fs.chmodSync(tmp, 0o600);
+        renameWithRetry(tmp, configPath);
+        return;
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { /* already gone */ }
+        if (!RENAME_RETRY_CODES.has(err?.code ?? ""))
+            throw err;
+    }
+    fs.writeFileSync(configPath, data, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+}
+// ─── refresh lock ──────────────────────────────────────────────────────
+function lockPathFor(configPath) {
+    return path.join(path.dirname(configPath), "refresh.lock");
+}
+function tryLock(lockPath, now) {
+    try {
+        const fd = fs.openSync(lockPath, "wx", 0o600);
+        fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: now }));
+        fs.closeSync(fd);
+        return true;
+    }
+    catch (err) {
+        if (err?.code !== "EEXIST")
+            throw err;
+        // Break a lock left by a crashed process.
+        try {
+            const age = now - fs.statSync(lockPath).mtimeMs;
+            if (age > exports.LOCK_STALE_MS)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+            /* raced with its owner releasing it: retry */
+        }
+        return false;
+    }
+}
+function unlock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch { /* already released */ }
+}
+function needsRefresh(config, now, minValidityMs) {
+    const auth = config.auth;
+    return !!auth && !!config.token && auth.accessTokenExpiresAt - now < minValidityMs;
+}
+async function postForm(fetchImpl, url, form, timeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form).toString(),
+            signal: ctl.signal,
+        });
+        return { status: res.status, body: (await res.json().catch(() => null)) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Make sure config.token is a usable access token for at least
+ * `minValidityMs`. Never throws: auth problems surface as the next request's
+ * 401, which every command already explains.
+ */
+async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDITY_MS) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const first = readConfigAt(deps.configPath);
+    if (!first?.auth)
+        return { status: "none", config: first };
+    if (!needsRefresh(first, now(), minValidityMs))
+        return { status: "fresh", config: first };
+    const seen = first.token;
+    const lockPath = lockPathFor(deps.configPath);
+    const deadline = now() + LOCK_WAIT_MS;
+    let locked = false;
+    try {
+        while (!(locked = tryLock(lockPath, now()))) {
+            if (now() > deadline)
+                return { status: "unavailable", config: first };
+            await sleep(50 + Math.floor(Math.random() * 100));
+        }
+        // Step 3: re-read under the lock.
+        const current = readConfigAt(deps.configPath);
+        if (!current?.auth)
+            return { status: "none", config: current };
+        if (current.token !== seen)
+            return { status: "adopted", config: current };
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${current.backendUrl}/oauth/token`, {
+                grant_type: "refresh_token",
+                client_id: current.auth.clientId,
+                refresh_token: current.auth.refreshToken,
+            }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            return { status: "unavailable", config: current };
+        }
+        if (res.status === 200 && typeof res.body?.access_token === "string" && typeof res.body.refresh_token === "string") {
+            const next = {
+                ...current,
+                token: res.body.access_token,
+                auth: {
+                    ...current.auth,
+                    refreshToken: res.body.refresh_token,
+                    accessTokenExpiresAt: now() + Number(res.body.expires_in ?? 0) * 1000,
+                },
+            };
+            writeConfigAtomic(deps.configPath, next);
+            return { status: "refreshed", config: next };
+        }
+        if (res.status === 400 && res.body?.error === "invalid_grant") {
+            // Revoked in the portal, signed out elsewhere, expired, or reuse was
+            // detected. Forget the credentials but keep device settings.
+            const out = { ...current, token: "" };
+            delete out.auth;
+            writeConfigAtomic(deps.configPath, out);
+            return { status: "signed_out", config: out };
+        }
+        return { status: "unavailable", config: current };
+    }
+    finally {
+        if (locked)
+            unlock(lockPath);
+    }
+}
+// ─── browser sign-in ───────────────────────────────────────────────────
+function base64Url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+    const verifier = base64Url(crypto.randomBytes(32));
+    const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function openBrowser(url) {
+    try {
+        const [cmd, args] = process.platform === "darwin"
+            ? ["open", [url]]
+            : process.platform === "win32"
+                ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+                : ["xdg-open", [url]];
+        const child = (0, child_process_1.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const DONE_PAGE = (ok, msg) => `<!doctype html><html><head><meta charset="utf-8">
+<title>Codiedev CLI</title><style>body{font-family:system-ui,sans-serif;display:grid;place-items:center;
+height:100vh;margin:0;background:#fbfbfa;color:#1f1f1f}main{max-width:28rem;text-align:center}
+h1{font-size:1.25rem}</style></head><body><main><h1>${ok ? "You're signed in" : "Sign-in didn't finish"}</h1>
+<p>${msg}</p></main></body></html>`;
+/** Parse `code`/`state` (or `error`) out of a loopback callback URL. */
+function parseCallback(input) {
+    try {
+        const u = new URL(input.trim());
+        return {
+            code: u.searchParams.get("code") ?? undefined,
+            state: u.searchParams.get("state") ?? undefined,
+            error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? undefined,
+        };
+    }
+    catch {
+        return { error: "That isn't the address from the browser's address bar." };
+    }
+}
+async function browserLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const state = base64Url(crypto.randomBytes(16));
+    const { verifier, challenge } = pkcePair();
+    let settle;
+    const result = new Promise((r) => (settle = r));
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        const cb = parseCallback(url.toString());
+        const ok = !cb.error && cb.state === state && !!cb.code;
+        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(DONE_PAGE(ok, ok
+            ? "You can close this tab and go back to your terminal."
+            : "Go back to your terminal and run <code>codiedev connect</code> again."));
+        if (cb.error)
+            settle({ error: cb.error });
+        else if (cb.state !== state)
+            settle({ error: "The sign-in response didn't match this request (state mismatch)." });
+        else
+            settle({ code: cb.code });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const timer = setTimeout(() => settle({ error: "Timed out waiting for the browser (10 minutes)." }), LOGIN_TIMEOUT_MS);
+    try {
+        const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+                redirect_uris: [redirectUri],
+            }),
+        });
+        if (reg.status !== 201)
+            throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+        const { client_id: clientId } = (await reg.json());
+        const authorize = new URL(`${opts.backendUrl}/oauth/authorize`);
+        authorize.search = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+            scope: "cli",
+        }).toString();
+        const link = authorize.toString();
+        if (opts.onAuthorizeUrl) {
+            opts.onAuthorizeUrl(link);
+        }
+        else {
+            log("Opening your browser to sign in…");
+            log(`If it doesn't open, visit:\n  ${link}\n`);
+            openBrowser(link);
+        }
+        const cb = await result;
+        if (cb.error || !cb.code)
+            throw new Error(cb.error ?? "Sign-in was cancelled.");
+        const tok = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, {
+            grant_type: "authorization_code",
+            code: cb.code,
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+        }, REFRESH_TIMEOUT_MS);
+        const body = tok.body;
+        if (tok.status !== 200 || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string") {
+            throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${tok.status}`}`);
+        }
+        if (body.scope !== "cli")
+            throw new Error("The server didn't grant CLI access.");
+        return {
+            accessToken: body.access_token,
+            refreshToken: body.refresh_token,
+            expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+            clientId,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        server.close();
+    }
+}
+// ─── device sign-in (SSH / headless) ──────────────────────────────────
+exports.DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * True when a browser opened here can't reach the user: an SSH session, or a
+ * Linux box with no display. Then `connect` uses the device flow (a code the
+ * user approves on any device) instead of a loopback redirect, with no flag.
+ */
+function isHeadless(env = process.env, platform = process.platform) {
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return true;
+    if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
+async function deviceLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+            redirect_uris: [],
+            grant_types: [exports.DEVICE_CODE_GRANT, "refresh_token"],
+        }),
+    });
+    if (reg.status !== 201)
+        throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+    const { client_id: clientId } = (await reg.json());
+    const start = await fetchImpl(`${opts.backendUrl}/oauth/device_authorization`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, scope: "cli" }).toString(),
+    });
+    const auth = (await start.json().catch(() => null));
+    if (start.status !== 200 || !auth?.device_code || !auth.user_code || !auth.verification_uri) {
+        throw new Error(`Sign-in setup failed: ${auth?.error_description ?? `HTTP ${start.status}`}`);
+    }
+    const complete = auth.verification_uri_complete ?? auth.verification_uri;
+    if (opts.onCode) {
+        opts.onCode({ userCode: auth.user_code, verificationUri: auth.verification_uri, verificationUriComplete: complete });
+    }
+    log("To sign in, open this link on any device (your laptop or phone) and approve:\n");
+    log(`  ${complete}\n`);
+    log(`Your code: ${auth.user_code}   (check it matches the page)\n`);
+    log("Waiting for approval…");
+    let intervalMs = Math.max(1, Number(auth.interval ?? 5)) * 1000;
+    const deadline = now() + Number(auth.expires_in ?? 600) * 1000;
+    for (;;) {
+        await sleep(intervalMs);
+        if (now() > deadline)
+            throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, { grant_type: exports.DEVICE_CODE_GRANT, device_code: auth.device_code, client_id: clientId }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            continue; // network blip: keep polling until the code expires
+        }
+        const body = res.body;
+        if (res.status === 200 && typeof body?.access_token === "string" && typeof body.refresh_token === "string") {
+            if (body.scope !== "cli")
+                throw new Error("The server didn't grant CLI access.");
+            return {
+                accessToken: body.access_token,
+                refreshToken: body.refresh_token,
+                expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+                clientId,
+            };
+        }
+        switch (body?.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                intervalMs += 5000;
+                continue;
+            case "access_denied":
+                throw new Error("Sign-in was denied in the browser.");
+            case "expired_token":
+                throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+            default:
+                throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${res.status}`}`);
+        }
+    }
+}
+/** `codiedev logout`: end a browser sign-in server-side, forget it locally. */
+async function logout(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const config = readConfigAt(deps.configPath);
+    if (!config?.token)
+        return { wasConnected: false, hadBrowserAuth: false, serverRevoked: false };
+    let serverRevoked = false;
+    const hadBrowserAuth = !!config.auth;
+    if (config.token && config.auth) {
+        try {
+            const res = await fetchImpl(`${config.backendUrl}/api/cli/logout`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${config.token}` },
+            });
+            serverRevoked = res.ok && (await res.json().catch(() => null))?.revoked === true;
+        }
+        catch {
+            /* offline: still forget locally; the portal can revoke it */
+        }
+    }
+    const out = { ...config, token: "" };
+    delete out.auth;
+    writeConfigAtomic(deps.configPath, out);
+    return { wasConnected: true, hadBrowserAuth, serverRevoked };
+}

package/dist/codie.js

@@ -59,6 +59,11 @@ const upgradeNudge_1 = require("./upgradeNudge");
 const codie_1 = require("./packs/codie");
 const paths_1 = require("./packs/paths");
 const managedPi_1 = require("./managedPi");
+const cliSession_1 = require("./cliSession");
+// The engine reads its gateway key once, at launch. With browser sign-in the
+// key is a 24h access token, so start every session with at least 12h left
+// (refreshing first if needed) instead of one that dies mid-task.
+const CODIE_MIN_TOKEN_VALIDITY_MS = 12 * 60 * 60_000;
 // How long to let the gateway finish booking the last request before asking
 // what the session cost.
 const USAGE_SETTLE_MS = 1200;
@@ -91,7 +96,8 @@ function existingInlineConfig() {
     }
 }
 // The one credential. `codiedev connect` wrote it; the gateway validates the
-// same userApiTokens row, so there is no second harness token to mint.
+// same userApiTokens row (a browser sign-in reports through its own row), so
+// there is no second harness token to mint.
 function connectedCodiedevConfig() {
     try {
         return JSON.parse(fs.readFileSync(path.join((0, configDir_1.codiedevStateDir)(), "config.json"), "utf8"));
@@ -171,7 +177,21 @@ function installBrandWordmarkUnsafe(runtime) {
 }
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
+    if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN) {
+        const fresh = await (0, cliSession_1.ensureFreshToken)({ configPath: path.join((0, configDir_1.codiedevStateDir)(), "config.json") }, CODIE_MIN_TOKEN_VALIDITY_MS);
+        if (fresh.status === "signed_out") {
+            throw new Error("Your Codiedev sign-in has ended. Run `codiedev connect` to sign in again");
+        }
+    }
     const connected = connectedCodiedevConfig();
+    // Browser sign-in: let the engine's per-request hook keep the 24h key
+    // fresh for sessions that run longer (assets/session-key.mjs). Not for an
+    // explicit key from the environment, and not for pasted API tokens.
+    if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN && connected.auth) {
+        process.env.CODIEDEV_SESSION_CONFIG = path.join((0, configDir_1.codiedevStateDir)(), "config.json");
+        process.env.CODIEDEV_CLI_JS = path.join(__dirname, "cli.js");
+        process.env.CODIEDEV_NODE = process.execPath;
+    }
     const key = process.env.CODIEDEV_GATEWAY_KEY ||
         process.env.CODIEDEV_TOKEN ||
         (typeof connected.token === "string" ? connected.token.trim() : "");

package/dist/configDir.d.ts

@@ -1 +1,10 @@
+/**
+ * The user's home, always absolute. $HOME can arrive relative or unexpanded ("~", ".", "") from a
+ * sandboxed shell or a wrapper; trusting it once wrote hook commands like ".codiedev/bin/…" into
+ * ~/.claude/settings.json, which only resolve when Claude Code starts in the home folder, so
+ * capture silently failed in every project. Fall back to the account's home from the OS.
+ */
+export declare function realHome(): string;
+/** $HOME when it's a real absolute path, else the OS account's home, else resolved against cwd. */
+export declare function pickHome(fromEnv: string | undefined, fromOs: string | undefined): string;
 export declare function codiedevStateDir(): string;

package/dist/configDir.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.realHome = realHome;
+exports.pickHome = pickHome;
 exports.codiedevStateDir = codiedevStateDir;
 // Single source of truth for where the CLI's config/state lives on disk.
 //
@@ -46,9 +48,31 @@ exports.codiedevStateDir = codiedevStateDir;
 // without creating a circular import.
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+/**
+ * The user's home, always absolute. $HOME can arrive relative or unexpanded ("~", ".", "") from a
+ * sandboxed shell or a wrapper; trusting it once wrote hook commands like ".codiedev/bin/…" into
+ * ~/.claude/settings.json, which only resolve when Claude Code starts in the home folder, so
+ * capture silently failed in every project. Fall back to the account's home from the OS.
+ */
+function realHome() {
+    let fromOs;
+    try {
+        fromOs = os.userInfo().homedir;
+    }
+    catch { /* no passwd entry */ }
+    return pickHome(os.homedir(), fromOs);
+}
+/** $HOME when it's a real absolute path, else the OS account's home, else resolved against cwd. */
+function pickHome(fromEnv, fromOs) {
+    if (fromEnv && path.isAbsolute(fromEnv) && !fromEnv.split(path.sep).includes("~"))
+        return fromEnv;
+    if (fromOs && path.isAbsolute(fromOs))
+        return fromOs;
+    return path.resolve(fromEnv || ".");
+}
 const CONFIG_DIR = process.env.CODIEDEV_CONFIG_DIR?.trim()
     ? path.resolve(process.env.CODIEDEV_CONFIG_DIR.trim())
-    : path.join(os.homedir(), ".codiedev");
+    : path.join(realHome(), ".codiedev");
 function codiedevStateDir() {
     return CONFIG_DIR;
 }

package/dist/connect.js

@@ -41,6 +41,7 @@ const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
@@ -60,6 +61,16 @@ const BACKEND_URL = process.env.CODIEDEV_URL || "https://cli.codiedev.com";
  * input in CI). Without a TTY there's no echo to suppress anyway, and
  * raw mode would error.
  */
+/** One visible line from the terminal (for yes/no questions). */
+function prompt(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
 function promptHidden(question) {
     return new Promise((resolve) => {
         const stdin = process.stdin;
@@ -168,16 +179,47 @@ async function runConnect(args = []) {
     // mint a fresh token from the portal — which is what bit Sonifi's first
     // engineer when he interpreted "no visible token" as "the old one is gone".
     const force = args.includes("--force") || args.includes("-f");
+    // `--token`: paste an API token instead of signing in (CI). Otherwise sign
+    // in with the browser: a loopback redirect on a desktop, a device code
+    // (approve on any device) over SSH or with no display, detected
+    // automatically. `--no-browser` / `--browser` force one or the other.
+    const pasteToken = args.includes("--token");
+    const useDevice = args.includes("--no-browser") || (!args.includes("--browser") && (0, cliSession_1.isHeadless)());
     console.log("\nWelcome to Codiedev CLI\n");
     await (0, upgradeNudge_1.maybePrintUpgradeNudge)();
     console.log("This will connect your coding agent to your Codiedev workspace and install");
     console.log("the session capture hook for org-wide session sharing.\n");
+    // A saved browser sign-in is reused only if it still works: refresh it
+    // first (a revoked one comes back signed out, with an empty token).
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const saved = (0, utils_1.readConfig)();
-    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force });
+    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force: force || pasteToken });
     let token;
+    let auth;
     if (decision.source === "reused") {
         token = decision.token;
-        console.log(`Reusing API token from ~/.codiedev/config.json (run with --force to use a new one).\n`);
+        auth = saved?.auth;
+        console.log(auth
+            ? `Reusing your browser sign-in from ~/.codiedev/config.json (run with --force to sign in again).\n`
+            : `Reusing API token from ~/.codiedev/config.json (run with --force to sign in again).\n`);
+    }
+    else if (!pasteToken) {
+        // Replacing a browser sign-in: end the old one so the portal doesn't
+        // keep listing it.
+        if (saved?.auth)
+            await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
+        const result = await (0, connectFlow_1.signInWithTokenFallback)({
+            signIn: () => useDevice ? (0, cliSession_1.deviceLogin)({ backendUrl: BACKEND_URL }) : (0, cliSession_1.browserLogin)({ backendUrl: BACKEND_URL }),
+            interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+            askYesNo: async (q) => /^y(es)?$/i.test((await prompt(q)).trim()),
+            askToken: promptHidden,
+            log: (line) => console.log(line),
+            error: (line) => console.error(line),
+        });
+        if (!result)
+            process.exit(1);
+        token = result.token;
+        auth = result.auth;
     }
     else {
         // Hidden prompt — masks the token with `*` as it's typed/pasted so it
@@ -217,6 +259,7 @@ async function runConnect(args = []) {
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
+        ...(auth ? { auth } : {}),
     };
     try {
         (0, utils_1.writeConfig)(config);

package/dist/connectFlow.d.ts

@@ -11,3 +11,24 @@ export type ConnectTokenResult = {
     source: "prompt-required";
 };
 export declare function resolveConnectToken(input: ConnectTokenInput): ConnectTokenResult;
+export interface SignInResult {
+    token: string;
+    auth?: import("./cliSession").BrowserAuth;
+}
+export interface SignInDeps {
+    /** Browser (loopback) or device-code sign-in; throws on failure. */
+    signIn: () => Promise<import("./cliSession").TokenSet>;
+    /** A person at a terminal who can answer prompts. */
+    interactive: boolean;
+    askYesNo: (question: string) => Promise<boolean>;
+    askToken: (question: string) => Promise<string>;
+    log: (line: string) => void;
+    error: (line: string) => void;
+}
+/**
+ * Browser sign-in, with the API-token paste as the way out: if the browser
+ * flow fails (blocked page, expired code, proxy) an interactive user is asked
+ * whether to paste a token instead, rather than being sent to rerun connect.
+ * Returns null when there's nothing to continue with (caller exits 1).
+ */
+export declare function signInWithTokenFallback(deps: SignInDeps): Promise<SignInResult | null>;

package/dist/connectFlow.js

@@ -10,6 +10,7 @@
 // generate a new one — leaving him thinking the old one had been lost.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveConnectToken = resolveConnectToken;
+exports.signInWithTokenFallback = signInWithTokenFallback;
 function resolveConnectToken(input) {
     if (input.force)
         return { source: "prompt-required" };
@@ -19,3 +20,43 @@ function resolveConnectToken(input) {
         return { source: "prompt-required" };
     return { source: "reused", token: input.savedConfig.token };
 }
+/**
+ * Browser sign-in, with the API-token paste as the way out: if the browser
+ * flow fails (blocked page, expired code, proxy) an interactive user is asked
+ * whether to paste a token instead, rather than being sent to rerun connect.
+ * Returns null when there's nothing to continue with (caller exits 1).
+ */
+async function signInWithTokenFallback(deps) {
+    deps.log("Prefer an API token? Press Ctrl+C and run `codiedev connect --token`.\n");
+    try {
+        const s = await deps.signIn();
+        deps.log("Signed in. No API key is stored on this machine.\n");
+        return {
+            token: s.accessToken,
+            auth: {
+                kind: "browser",
+                clientId: s.clientId,
+                refreshToken: s.refreshToken,
+                accessTokenExpiresAt: s.expiresAt,
+            },
+        };
+    }
+    catch (err) {
+        deps.error(`\nBrowser sign-in didn't finish: ${err.message}`);
+        if (!deps.interactive) {
+            deps.error("To paste an API token instead, run `codiedev connect --token`.");
+            return null;
+        }
+        if (!(await deps.askYesNo("Paste an API token instead? [y/N] "))) {
+            deps.error("Run `codiedev connect` to try again, or `codiedev connect --token` to paste a token.");
+            return null;
+        }
+        deps.log("Create one at https://codiedev.com/portal/integrations/claude-code\n");
+        const token = (await deps.askToken("Enter your Codiedev API token: ")).trim();
+        if (!token) {
+            deps.error("Error: API token is required.");
+            return null;
+        }
+        return { token };
+    }
+}

package/dist/hook.js

@@ -60,6 +60,8 @@ const captureExclusions_1 = require("./captureExclusions");
 const cursorHooks_1 = require("./cursorHooks");
 const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
+const cliSession_1 = require("./cliSession");
+const utils_2 = require("./utils");
 // Pure builder for the discovery additionalContext. Returns null when there are
 // no matches. The suggested `codiedev pull` command carries the EXACT top key
 // (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
@@ -440,6 +442,11 @@ function resolveMode(arg) {
     return "claude-code";
 }
 async function main() {
+    // Browser sign-in: refresh the access token under the shared lock before
+    // anything reads config (cliSession.ts). A no-op for pasted API tokens and
+    // for tokens with time left; never throws, never prints (hook stdout is
+    // the agent's).
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
     // Shared upload deps used by both "upload" and "upload-deferred" branches.
     // Extracted to keep both branches in lockstep — any new dep added here
     // automatically applies to the deferred path too.

package/dist/launcher.d.ts

@@ -8,13 +8,18 @@ export declare function launcherPath(): string;
 /** True iff `cmd` invokes the stable launcher (from any state dir). */
 export declare function usesLauncher(cmd: string | undefined): boolean;
 export declare function readInstallRecord(): InstallRecord | null;
+/**
+ * The hook script worth recording: absolute and present, and a global install over an npx cache
+ * copy (npm prunes ~/.npm/_npx, and hooks pointed there go quietly dead). Null = don't record.
+ */
+export declare function stableHookScript(hookScript: string, globalCandidates?: string[]): string | null;
 /** Point the launcher at `hookScript`. Atomic, so a hook mid-launch never reads half a file. */
-export declare function recordCurrentInstall(hookScript: string): boolean;
+export declare function recordCurrentInstall(requested: string): boolean;
 /**
  * Make sure the launcher exists and forwards to `hookScript`, returning the
  * launcher path to bake into hook configs — or null if the state dir is not
  * writable, in which case callers keep baking the direct path. Memoized:
  * one connect writes ~20 hook entries.
  */
-export declare function ensureLauncher(hookScript: string): string | null;
+export declare function ensureLauncher(requested: string): string | null;
 export declare function resetLauncherCacheForTests(): void;

package/dist/launcher.js

@@ -48,6 +48,7 @@ exports.LAUNCHER_FILE = void 0;
 exports.launcherPath = launcherPath;
 exports.usesLauncher = usesLauncher;
 exports.readInstallRecord = readInstallRecord;
+exports.stableHookScript = stableHookScript;
 exports.recordCurrentInstall = recordCurrentInstall;
 exports.ensureLauncher = ensureLauncher;
 exports.resetLauncherCacheForTests = resetLauncherCacheForTests;
@@ -114,8 +115,35 @@ function packageVersionFor(hookScript) {
         return undefined;
     }
 }
+/**
+ * The hook script worth recording: absolute and present, and a global install over an npx cache
+ * copy (npm prunes ~/.npm/_npx, and hooks pointed there go quietly dead). Null = don't record.
+ */
+function stableHookScript(hookScript, globalCandidates = globalHookScripts()) {
+    if (!hookScript || !path.isAbsolute(hookScript) || hookScript.includes(`${path.sep}~${path.sep}`))
+        return null;
+    if (!fs.existsSync(hookScript))
+        return null;
+    if (hookScript.includes(`${path.sep}_npx${path.sep}`)) {
+        const global = globalCandidates.find((p) => path.isAbsolute(p) && fs.existsSync(p));
+        if (global)
+            return global;
+    }
+    return hookScript;
+}
+/** Where a global `npm i -g codiedev` puts hook.js, next to the node running this. */
+function globalHookScripts() {
+    const prefix = path.dirname(path.dirname(process.execPath));
+    return [
+        path.join(prefix, "lib", "node_modules", "codiedev", "dist", "hook.js"),
+        path.join(prefix, "node_modules", "codiedev", "dist", "hook.js"),
+    ];
+}
 /** Point the launcher at `hookScript`. Atomic, so a hook mid-launch never reads half a file. */
-function recordCurrentInstall(hookScript) {
+function recordCurrentInstall(requested) {
+    const hookScript = stableHookScript(requested);
+    if (!hookScript)
+        return false;
     try {
         const record = {
             hookScript,
@@ -136,11 +164,17 @@ let ensuredFor;
  * writable, in which case callers keep baking the direct path. Memoized:
  * one connect writes ~20 hook entries.
  */
-function ensureLauncher(hookScript) {
+function ensureLauncher(requested) {
+    const hookScript = stableHookScript(requested);
+    if (!hookScript)
+        return null;
     if (ensuredFor !== undefined && ensuredFor === hookScript)
         return launcherPath();
     try {
         const target = launcherPath();
+        // A relative launcher path in a hook config only works from one folder; never bake one.
+        if (!path.isAbsolute(target))
+            return null;
         const source = launcherSource(hookScript);
         let current = null;
         try {

package/dist/managedPi.js

@@ -94,7 +94,8 @@ exports.BLOCKED_BASE_URL = "http://127.0.0.1:9/blocked-by-codiedev";
  * joins the captured pi session (same headers as the OpenCode metadata
  * plugin, assets/git-refs.mjs). */
 exports.GUARD_SOURCE = `// Written by Codiedev on every \`codie --pi\` launch. Edits are overwritten.
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { getProviders } from "@mariozechner/pi-ai";
 
 const PROVIDER = ${JSON.stringify(exports.PI_PROVIDER_ID)};
@@ -153,8 +154,23 @@ export default function (pi) {
     const p = String(event?.input?.path ?? "").replace(/\\\\/g, "/").match(/\\/([a-z0-9][a-z0-9_.:-]{0,119})\\/SKILL\\.md$/i);
     if (event?.toolName === "read" && !event.isError && p && skills.size < 50) skills.add(p[1]);
   });
+  // Browser sign-in: pi reads CODIEDEV_GATEWAY_KEY at request time, so put
+  // the current token there, refreshing it as it nears expiry (same logic as
+  // assets/session-key.mjs). Pasted API tokens: no variables, nothing changes.
+  const freshKey = async () => {
+    const env = process.env;
+    if (!env.CODIEDEV_SESSION_CONFIG || !env.CODIEDEV_CLI_JS || !env.CODIEDEV_NODE) return;
+    const read = () => { try { const c = JSON.parse(readFileSync(env.CODIEDEV_SESSION_CONFIG, "utf8")); return c && c.auth && c.token ? c : null; } catch { return null; } };
+    let s = read();
+    if (!s) return;
+    if (!(Number(s.auth.accessTokenExpiresAt) - Date.now() > 30 * 60000)) {
+      await new Promise((r) => execFile(env.CODIEDEV_NODE, [env.CODIEDEV_CLI_JS, "session-refresh"], { timeout: 30000 }, () => r()));
+      s = read() ?? s;
+    }
+    env.CODIEDEV_GATEWAY_KEY = s.token;
+  };
   // Before every model call in the turn: the agent may have switched branch.
-  pi.on("turn_start", async (_event, ctx) => tag(ctx));
+  pi.on("turn_start", async (_event, ctx) => { await freshKey(); tag(ctx); });
   pi.on("before_provider_request", (_event, ctx) => {
     // Belt and braces: the request is already headed for BLOCKED.
     if (!ours(ctx.model)) ctx.abort();

package/dist/mcp.js

@@ -51,6 +51,7 @@ const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const shared_1 = require("./commands/shared");
 const inboxFormat_1 = require("./inboxFormat");
 const PKG_NAME = "codiedev";
@@ -399,6 +400,8 @@ function emitTelemetry(config, event) {
     });
 }
 server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+    // Long-lived process: the access token may expire while it runs.
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const config = (0, utils_1.readConfig)();
     if (!config) {
         return {

package/dist/utils.d.ts

@@ -6,6 +6,7 @@ import type { CaptureLogEntry } from "./captureLog";
 import { codiedevStateDir } from "./configDir";
 export { inspectPiExtension, piExtensionPath } from "./piHooks";
 export { codiedevStateDir };
+import type { BrowserAuth } from "./cliSession";
 export interface CodiedevConfig {
     token: string;
     companyId: string;
@@ -20,6 +21,7 @@ export interface CodiedevConfig {
     deviceId?: string;
     deviceName?: string;
     captureIgnoredPaths?: string[];
+    auth?: BrowserAuth;
 }
 export declare const CONFIG_PATH: string;
 export declare function readConfig(): CodiedevConfig | null;

package/dist/utils.js

@@ -150,6 +150,7 @@ const piHooks_1 = require("./piHooks");
 var piHooks_2 = require("./piHooks");
 Object.defineProperty(exports, "inspectPiExtension", { enumerable: true, get: function () { return piHooks_2.inspectPiExtension; } });
 Object.defineProperty(exports, "piExtensionPath", { enumerable: true, get: function () { return piHooks_2.piExtensionPath; } });
+const cliSession_1 = require("./cliSession");
 const CONFIG_DIR = (0, configDir_1.codiedevStateDir)();
 exports.CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 function readConfig() {
@@ -171,12 +172,9 @@ function writeConfigAtPath(config, configDir, configPath) {
     if (!fs.existsSync(configDir)) {
         fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    // writeFile's mode does not replace permissions on a pre-existing file.
-    fs.chmodSync(configPath, 0o600);
+    // Temp file + rename: hooks read this file concurrently, and a torn read
+    // looks like "not connected". The temp file is created 0600.
+    (0, cliSession_1.writeConfigAtomic)(configPath, config);
 }
 // Parse a remote URL out of git-config INI text WITHOUT invoking git. Prefers
 // the "origin" remote; falls back to the first remote found. Returns null if
@@ -1038,7 +1036,11 @@ function resolveHookInvocation(subcommand, preferredNodePath) {
                 // Bake the stable launcher, not this install's path, so later
                 // upgrades (including pnpm's hashed dirs) never strand the hook.
                 const launcher = (0, launcher_1.ensureLauncher)(hookScript);
-                return { command: nodePath, args: [launcher ?? hookScript, subcommand] };
+                // No launcher and no stable install to point at (e.g. an npx cache under a bogus "~"):
+                // the npx fallback below beats baking a path that won't exist tomorrow.
+                if (launcher || (0, launcher_1.stableHookScript)(hookScript)) {
+                    return { command: nodePath, args: [launcher ?? hookScript, subcommand] };
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.79",
+  "version": "0.9.80",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",