codiedev 0.9.79 → 0.9.81

package/assets/opencode-plugin.mjs

@@ -10,6 +10,7 @@ import {
   trackWorkPath,
   workDirBySession,
 } from "./git-refs.mjs";
+import { freshGatewayKey } from "./session-key.mjs";
 
 const skillUseBySession = new Map();
 
@@ -60,6 +61,11 @@ export const CodiedevMetadata = async () => ({
     });
   },
   "chat.headers": async (input, output) => {
+    // Browser sign-in: the current 24h token, refreshed as it nears expiry,
+    // so a session open for days keeps working (see session-key.mjs). Exact
+    // "Authorization" key: per-call headers win over the apiKey-derived one.
+    const key = await freshGatewayKey();
+    if (key) output.headers.Authorization = `Bearer ${key}`;
     Object.assign(
       output.headers,
       buildAttributionHeaders({

package/assets/session-key.mjs

@@ -0,0 +1,48 @@
+// The gateway key for one model request, kept fresh for the whole session.
+//
+// With browser sign-in (`codiedev connect`), the key is a 24h access token.
+// The engine (OpenCode, pi) would otherwise hold the one it was launched
+// with until the session ends, so a session open for more than a day would
+// start failing. `codie` sets these variables only for a browser sign-in:
+//   CODIEDEV_SESSION_CONFIG  path to ~/.codiedev/config.json
+//   CODIEDEV_CLI_JS          the CLI entry (dist/cli.js)
+//   CODIEDEV_NODE            the node binary that runs it
+// Each request reads the current token from config (other codiedev
+// processes may have refreshed it). When it has under 30 minutes left, this
+// runs `codiedev session-refresh`, which refreshes under the shared lock
+// (cliSession.ts, specs/tla/CliSession.tla), then reads again.
+// No variables (pasted API token, CI): returns null and the launch key stands.
+
+import { execFile } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+export const REFRESH_WHEN_LEFT_MS = 30 * 60_000;
+
+function readSession(path) {
+  try {
+    const c = JSON.parse(readFileSync(path, "utf8"));
+    return c && c.auth && typeof c.token === "string" && c.token ? c : null;
+  } catch {
+    return null;
+  }
+}
+
+function runRefresh(env) {
+  return new Promise((resolve) => {
+    execFile(env.CODIEDEV_NODE, [env.CODIEDEV_CLI_JS, "session-refresh"], { timeout: 30_000, env }, () => resolve());
+  });
+}
+
+/** Fresh gateway key, or null when the session isn't a browser sign-in. */
+export async function freshGatewayKey(env = process.env, now = Date.now, refresh = runRefresh) {
+  const path = env.CODIEDEV_SESSION_CONFIG;
+  if (!path || !env.CODIEDEV_CLI_JS || !env.CODIEDEV_NODE) return null;
+  let session = readSession(path);
+  if (!session) return null;
+  const left = Number(session.auth.accessTokenExpiresAt) - now();
+  if (!(left > REFRESH_WHEN_LEFT_MS)) {
+    await refresh(env);
+    session = readSession(path) ?? session;
+  }
+  return session.token;
+}

package/dist/cli.js

@@ -13,8 +13,43 @@
  *   codiedev note "<text>"             — capture a thought
  *   codiedev help                      — show this help
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const connect_1 = require("./connect");
+const cliSession_1 = require("./cliSession");
+const utils_1 = require("./utils");
 const push_1 = require("./commands/push");
 const delete_1 = require("./commands/delete");
 const pull_1 = require("./commands/pull");
@@ -32,6 +67,7 @@ const capture_1 = require("./commands/capture");
 const pack_1 = require("./commands/pack");
 const traces_1 = require("./commands/traces");
 const evals_1 = require("./commands/evals");
+const agents_1 = require("./commands/agents");
 // --- starter packs phase 2 ---
 const hookGate_1 = require("./packs/hookGate");
 const sync_1 = require("./packs/sync");
@@ -45,8 +81,10 @@ Codiedev CLI
   someone left off across sessions and providers.
 
 Connect:
-  codiedev connect                       Link Claude Code / Codex / Cursor /
+  codiedev connect                       Sign in with your browser and link
+                                         Claude Code / Codex / Cursor /
                                          GitHub Copilot / pi to your org
+  codiedev logout                        Sign this machine out
   codiedev doctor                        Verify your setup after connecting
 
 Harness:
@@ -94,6 +132,9 @@ Starter packs:
   codiedev pack status                   Installed packs, up to date or not
 
 Traces (agents on the gateway):
+  codiedev agents init | deploy | run | runs | show | secrets | webhook
+                                         Deploy agents and run them in fresh sandboxes
+                                         (codiedev agents help)
   codiedev traces agents                 Agents you maintain, with saved test cases
   codiedev traces cases <agent> [--dataset name [--version n]] [--model id]
                                          Pull an agent's test cases (or one dataset)
@@ -117,6 +158,7 @@ Privacy:
   codiedev ignore <path>                 Never capture this folder or its children
   codiedev unignore <path>               Stop ignoring a folder
   codiedev ignored [path]                List ignored folders, or check one path
+  codiedev scrub [--dry-run]             Remove keys from past agent sessions on this machine
 
 Capture:
   codiedev note "<text>"                 Capture a passing thought
@@ -168,12 +210,14 @@ status sync never weakens it.
 const COMMAND_HELP = {
     pack: pack_1.PACK_HELP,
     traces: traces_1.TRACES_HELP,
+    agents: agents_1.AGENTS_HELP,
     evals: evals_1.EVALS_HELP,
     connect: `
 codiedev connect — link your agent CLI to Codiedev
 
-  Interactive setup. Prompts for an API token, then installs:
-    - ~/.codiedev/config.json            (token + org + tracked repos)
+  Opens your browser to sign in (approve once, no API key to copy), then
+  installs:
+    - ~/.codiedev/config.json            (sign-in + org + tracked repos)
     - ~/.claude/settings.json hook       (captures session transcripts)
     - ~/.claude/CLAUDE.md instructions   (teaches Claude the commands)
     - ~/.codex/hooks.json hook           (same, for Codex)
@@ -186,7 +230,27 @@ codiedev connect — link your agent CLI to Codiedev
 
   Re-run anytime to swap accounts or refresh the instruction block.
 
-  Get your token: https://codiedev.com/portal/integrations/claude-code
+  Over SSH or on a machine with no display it shows a link and a short code
+  instead: open the link on your laptop or phone, check the code, approve.
+  Detected automatically.
+
+  Options:
+    --token        Paste an API token instead of signing in with a browser
+                   (CI, or a machine with no browser anywhere). Create one at
+                   https://codiedev.com/portal/integrations/claude-code
+    --force, -f    Sign in again even if this machine is already connected.
+
+  Browser sign-in stores a 24-hour access token and a refresh token that
+  rotates on every use; nothing long-lived is saved. Revoke a machine from
+  Integrations in the portal, or run 'codiedev logout' on it.
+`.trim(),
+    logout: `
+codiedev logout — sign this machine out
+
+  Ends this machine's browser sign-in on the server and removes it from
+  ~/.codiedev/config.json. Device settings (ignored folders) are kept.
+  For a pasted API token, it's only forgotten locally: revoke it in the
+  portal under Integrations.
 `.trim(),
     push: `
 codiedev push — author or update an artifact
@@ -405,13 +469,15 @@ Run 'codiedev help <command>' for each, or see the quick list:
 
     codiedev help
 
-## Getting a token
+## Signing in
 
-  1. Log in to https://codiedev.com/portal/integrations/claude-code
-  2. Click "Create token"
-  3. Copy the cdv_... string and paste it into 'codiedev connect'
+  'codiedev connect' opens your browser; approve, and you're done. Nothing
+  long-lived is stored: a 24-hour access token plus a rotating refresh token.
 
-Tokens are per-user. Rotate any time by revoking + creating a new one.
+  Over SSH it shows a link and code to approve from your laptop or phone,
+  automatically. For CI, create a token at
+  https://codiedev.com/portal/integrations/claude-code and run
+  'codiedev connect --token'.
 `.trim();
 // Retired commands: say so instead of "Unknown command", since agent
 // instructions written by older installs may still reference them.
@@ -474,11 +540,41 @@ async function main() {
         console.log(`codiedev v${version_1.CLI_VERSION}`);
         return;
     }
+    // Browser sign-in: refresh the access token (under the shared lock) before
+    // the command reads config. No-op for pasted API tokens.
+    if (command !== "connect" && command !== "logout") {
+        const fresh = await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => null);
+        if (fresh?.status === "signed_out") {
+            console.error("\nYour Codiedev sign-in has ended (revoked or expired). Run `codiedev connect` to sign in again.\n");
+        }
+    }
     try {
         switch (command) {
             case "connect":
                 await (0, connect_1.runConnect)(rest);
                 return;
+            case "session-refresh": {
+                // Internal: the Codie engine's per-request hook asks for a fresh
+                // token when the current one has under 30 minutes left. Refreshes
+                // under the shared lock; prints nothing.
+                await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }, 60 * 60_000).catch(() => null);
+                return;
+            }
+            case "logout": {
+                const out = await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH });
+                if (!out.wasConnected) {
+                    console.log("This machine isn't signed in.");
+                }
+                else if (out.hadBrowserAuth) {
+                    console.log(out.serverRevoked
+                        ? "Signed out. This machine's sign-in is revoked."
+                        : "Signed out on this machine. Couldn't reach Codiedev to revoke the sign-in; revoke it under Integrations in the portal.");
+                }
+                else {
+                    console.log("Removed the API token from this machine. It still works elsewhere until you revoke it under Integrations in the portal.");
+                }
+                return;
+            }
             case "doctor":
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);
@@ -512,9 +608,17 @@ async function main() {
             case "read":
                 await (0, inbox_1.runRead)(rest);
                 return;
+            case "scrub": {
+                const { runScrubCommand } = await Promise.resolve().then(() => __importStar(require("./commands/scrub")));
+                process.exitCode = await runScrubCommand(rest);
+                return;
+            }
             case "note":
                 await (0, note_1.runNote)(rest);
                 return;
+            case "agents":
+                await (0, agents_1.runAgents)(rest);
+                return;
             case "promote":
             case "reverse-ticket":
             case "reverseTicket":

package/dist/cliSession.d.ts

@@ -0,0 +1,108 @@
+import type { CodiedevConfig } from "./utils";
+export interface BrowserAuth {
+    kind: "browser";
+    clientId: string;
+    refreshToken: string;
+    /** epoch ms when `token` (the access token) stops working */
+    accessTokenExpiresAt: number;
+}
+export interface TokenSet {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    clientId: string;
+}
+/** Default: refresh when less than 10 minutes remain. */
+export declare const DEFAULT_MIN_VALIDITY_MS: number;
+/** A lock older than this was left by a crashed process. Refresh calls time
+ * out well before it (REFRESH_TIMEOUT_MS), so a live holder never looks stale. */
+export declare const LOCK_STALE_MS = 30000;
+export interface SessionDeps {
+    configPath: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function readConfigAt(configPath: string): CodiedevConfig | null;
+/** rename(), retrying the transient Windows sharing errors. Exported for tests. */
+export declare function renameWithRetry(from: string, to: string, rename?: (a: string, b: string) => void, sleep?: (ms: number) => void): void;
+/**
+ * Write via temp file + rename so a concurrent reader never sees a torn file.
+ * If the rename still fails after ~1.6s of retries (a handle held that long),
+ * fall back to writing in place: a rare torn read beats failing `connect`.
+ */
+export declare function writeConfigAtomic(configPath: string, config: CodiedevConfig): void;
+export type FreshResult = {
+    status: "fresh";
+    config: CodiedevConfig;
+} | {
+    status: "refreshed";
+    config: CodiedevConfig;
+} | {
+    status: "adopted";
+    config: CodiedevConfig;
+} | {
+    status: "unavailable";
+    config: CodiedevConfig;
+} | {
+    status: "signed_out";
+    config: CodiedevConfig;
+} | {
+    status: "none";
+    config: CodiedevConfig | null;
+};
+/**
+ * Make sure config.token is a usable access token for at least
+ * `minValidityMs`. Never throws: auth problems surface as the next request's
+ * 401, which every command already explains.
+ */
+export declare function ensureFreshToken(deps: SessionDeps, minValidityMs?: number): Promise<FreshResult>;
+export declare function pkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function openBrowser(url: string): boolean;
+export interface LoginOptions {
+    backendUrl: string;
+    clientName?: string;
+    fetchImpl?: typeof fetch;
+    /** Test hook: called with the authorize URL instead of opening a browser. */
+    onAuthorizeUrl?: (url: string) => void;
+    log?: (line: string) => void;
+    now?: () => number;
+}
+/** Parse `code`/`state` (or `error`) out of a loopback callback URL. */
+export declare function parseCallback(input: string): {
+    code?: string;
+    state?: string;
+    error?: string;
+};
+export declare function browserLogin(opts: LoginOptions): Promise<TokenSet>;
+export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * True when a browser opened here can't reach the user: an SSH session, or a
+ * Linux box with no display. Then `connect` uses the device flow (a code the
+ * user approves on any device) instead of a loopback redirect, with no flag.
+ */
+export declare function isHeadless(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+export interface DeviceLoginOptions {
+    backendUrl: string;
+    clientName?: string;
+    fetchImpl?: typeof fetch;
+    log?: (line: string) => void;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    /** Test hook: receives the code + link instead of only printing them. */
+    onCode?: (info: {
+        userCode: string;
+        verificationUri: string;
+        verificationUriComplete: string;
+    }) => void;
+}
+export declare function deviceLogin(opts: DeviceLoginOptions): Promise<TokenSet>;
+/** `codiedev logout`: end a browser sign-in server-side, forget it locally. */
+export declare function logout(deps: SessionDeps): Promise<{
+    wasConnected: boolean;
+    hadBrowserAuth: boolean;
+    serverRevoked: boolean;
+}>;