codiedev 0.9.79 → 0.9.81

package/dist/scrub/scrubProviderRules.js

@@ -0,0 +1,149 @@
+"use strict";
+// GENERATED by scripts/security/gen-scrub-provider-rules.py; do not edit by hand.
+// Provider-prefix secret formats from Gitleaks (https://github.com/gitleaks/gitleaks, commit 5f6ec56cfa6f),
+// converted from Go RE2 to JavaScript. Gitleaks: MIT License, Copyright (c) 2019 Zachary Rice.
+// Mirrored byte-for-byte to packages/codiedev-cli/src/scrub/scrubProviderRules.ts.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_RULE_LABELS = exports.PROVIDER_RULES = void 0;
+exports.PROVIDER_RULES = [
+    { name: "1password-secret-key", re: new RegExp("\\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})|(?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b", "g"), entropy: 3.8, keywords: ["a3-"] },
+    { name: "1password-service-account-token", re: new RegExp("ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}", "g"), entropy: 4, keywords: ["ops_"] },
+    { name: "adobe-client-secret", re: new RegExp("\\b(p8e-[a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["p8e-"] },
+    { name: "age-secret-key", re: new RegExp("AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}", "g"), keywords: ["age-secret-key-1"] },
+    { name: "airtable-personnal-access-token", re: new RegExp("\\b(pat[A-Za-z0-9]{14}\\.[a-f0-9]{64})\\b", "g"), firstGroup: true, keywords: ["airtable"] },
+    { name: "alibaba-access-key-id", re: new RegExp("\\b(LTAI[a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["ltai"] },
+    { name: "artifactory-api-key", re: new RegExp("\\bAKCp[A-Za-z0-9]{69}\\b", "g"), entropy: 4.5, keywords: ["akcp"] },
+    { name: "artifactory-reference-token", re: new RegExp("\\bcmVmd[A-Za-z0-9]{59}\\b", "g"), entropy: 4.5, keywords: ["cmvmd"] },
+    { name: "clickhouse-cloud-api-secret-key", re: new RegExp("\\b(4b1d[A-Za-z0-9]{38})\\b", "g"), firstGroup: true, entropy: 3, keywords: ["4b1d"] },
+    { name: "clojars-api-token", re: new RegExp("CLOJARS_[a-z0-9]{60}", "gi"), entropy: 2, keywords: ["clojars_"] },
+    { name: "cloudflare-origin-ca-key", re: new RegExp("\\b(v1\\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["cloudflare", "v1.0-"] },
+    { name: "curl-auth-header", re: new RegExp("\\bcurl\\b(?:.*?|.*?(?:[\\r\\n]{1,2}.*?){1,5})[ \\t\\n\\r](?:-H|--header)(?:=|[ \\t]{0,5})(?:\"(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))\"|'(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))')(?:\\B|\\s|$)", "gi"), firstGroup: true, entropy: 2.75, keywords: ["curl"] },
+    { name: "curl-auth-user", re: new RegExp("\\bcurl\\b(?:.*|.*(?:[\\r\\n]{1,2}.*){1,5})[ \\t\\n\\r](?:-u|--user)(?:=|[ \\t]{0,5})(\"(:[^\"]{3,}|[^:\"]{3,}:|[^:\"]{3,}:[^\"]{3,})\"|'([^:']{3,}:[^']{3,})'|((?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w$@.-]+):(?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w${}@.-]+)))(?:\\s|$)", "g"), firstGroup: true, entropy: 2, keywords: ["curl"] },
+    { name: "databricks-api-token", re: new RegExp("\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["dapi"] },
+    { name: "digitalocean-access-token", re: new RegExp("\\b(doo_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["doo_v1_"] },
+    { name: "digitalocean-pat", re: new RegExp("\\b(dop_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["dop_v1_"] },
+    { name: "digitalocean-refresh-token", re: new RegExp("\\b(dor_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, keywords: ["dor_v1_"] },
+    { name: "doppler-api-token", re: new RegExp("dp\\.pt\\.[a-z0-9]{43}", "gi"), entropy: 2, keywords: ["dp.pt."] },
+    { name: "duffel-api-token", re: new RegExp("duffel_(?:test|live)_[a-z0-9_\\-=]{43}", "gi"), entropy: 2, keywords: ["duffel_"] },
+    { name: "dynatrace-api-token", re: new RegExp("dt0c01\\.[a-z0-9]{24}\\.[a-z0-9]{64}", "gi"), entropy: 4, keywords: ["dt0c01."] },
+    { name: "easypost-api-token", re: new RegExp("\\bEZAK[a-z0-9]{54}\\b", "gi"), entropy: 2, keywords: ["ezak"] },
+    { name: "easypost-test-api-token", re: new RegExp("\\bEZTK[a-z0-9]{54}\\b", "gi"), entropy: 2, keywords: ["eztk"] },
+    { name: "facebook-access-token", re: new RegExp("\\b(\\d{15,16}(\\||%)[0-9a-z\\-_]{27,40})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["facebook"] },
+    { name: "facebook-page-access-token", re: new RegExp("\\b(EAA[MC][a-z0-9]{100,})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 4, keywords: ["eaam", "eaac"] },
+    { name: "flutterwave-encryption-key", re: new RegExp("FLWSECK_TEST-[a-h0-9]{12}", "gi"), entropy: 2, keywords: ["flwseck_test"] },
+    { name: "flutterwave-secret-key", re: new RegExp("FLWSECK_TEST-[a-h0-9]{32}-X", "gi"), entropy: 2, keywords: ["flwseck_test"] },
+    { name: "flyio-access-token", re: new RegExp("\\b((?:fo1_[\\w-]{43}|fm1[ar]_[a-zA-Z0-9+\\/]{100,}={0,3}|fm2_[a-zA-Z0-9+\\/]{100,}={0,3}))(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["fo1_", "fm1", "fm2_"] },
+    { name: "frameio-api-token", re: new RegExp("fio-u-[a-z0-9\\-_=]{64}", "gi"), keywords: ["fio-u-"] },
+    { name: "grafana-api-key", re: new RegExp("\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["eyjrijoi"] },
+    { name: "grafana-cloud-api-token", re: new RegExp("\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["glc_"] },
+    { name: "grafana-service-account-token", re: new RegExp("\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["glsa_"] },
+    { name: "harness-api-key", re: new RegExp("(?:pat|sat)\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}", "g"), keywords: ["pat.", "sat."] },
+    { name: "heroku-api-key-v2", re: new RegExp("\\b((HRKU-AA[0-9a-zA-Z_-]{58}))(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["hrku-aa"] },
+    { name: "huggingface-access-token", re: new RegExp("\\b(hf_(?:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["hf_"] },
+    { name: "huggingface-organization-api-token", re: new RegExp("\\b(api_org_(?:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["api_org_"] },
+    { name: "infracost-api-token", re: new RegExp("\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["ico-"] },
+    { name: "intra42-client-secret", re: new RegExp("\\b(s-s4t2(?:ud|af)-[abcdef0123456789]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["intra", "s-s4t2ud-", "s-s4t2af-"] },
+    { name: "maxmind-license-key", re: new RegExp("\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["_mmk"] },
+    { name: "microsoft-teams-webhook", re: new RegExp("https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}", "g"), firstGroup: true, keywords: ["webhook.office.com", "webhookb2", "incomingwebhook"] },
+    { name: "notion-api-token", re: new RegExp("\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["ntn_"] },
+    { name: "octopus-deploy-api-key", re: new RegExp("\\b(API-[A-Z0-9]{26})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["api-"] },
+    { name: "openshift-user-token", re: new RegExp("\\b(sha256~[\\w-]{43})(?:[^\\w-]|$)", "g"), firstGroup: true, entropy: 3.5, keywords: ["sha256~"] },
+    { name: "perplexity-api-key", re: new RegExp("\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'\"\\s;]|\\\\|$|\\b)", "g"), firstGroup: true, entropy: 4, keywords: ["pplx-"] },
+    { name: "planetscale-api-token", re: new RegExp("\\b(pscale_tkn_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pscale_tkn_"] },
+    { name: "planetscale-oauth-token", re: new RegExp("\\b(pscale_oauth_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["pscale_oauth_"] },
+    { name: "planetscale-password", re: new RegExp("\\b(pscale_pw_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pscale_pw_"] },
+    { name: "postman-api-token", re: new RegExp("\\b(PMAK-[a-f0-9]{24}\\-[a-f0-9]{34})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pmak-"] },
+    { name: "prefect-api-token", re: new RegExp("\\b(pnu_[a-zA-Z0-9]{36})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["pnu_"] },
+    { name: "pulumi-api-token", re: new RegExp("\\b(pul-[a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["pul-"] },
+    { name: "pypi-upload-token", re: new RegExp("pypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}", "g"), entropy: 3, keywords: ["pypi-ageichlwas5vcmc"] },
+    { name: "readme-api-token", re: new RegExp("\\b(rdme_[a-z0-9]{70})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["rdme_"] },
+    { name: "rubygems-api-token", re: new RegExp("\\b(rubygems_[a-f0-9]{48})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["rubygems_"] },
+    { name: "scalingo-api-token", re: new RegExp("\\b(tk-us-[\\w-]{48})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["tk-us-"] },
+    { name: "sendinblue-api-token", re: new RegExp("\\b(xkeysib-[a-f0-9]{64}\\-[a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["xkeysib-"] },
+    { name: "sentry-org-token", re: new RegExp("\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}(?:[^a-zA-Z0-9+/]|$)", "g"), entropy: 4.5, keywords: ["sntrys_eyjpyxqio"] },
+    { name: "sentry-user-token", re: new RegExp("\\b(sntryu_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3.5, keywords: ["sntryu_"] },
+    { name: "settlemint-application-access-token", re: new RegExp("\\b(sm_aat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_aat"] },
+    { name: "settlemint-personal-access-token", re: new RegExp("\\b(sm_pat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_pat"] },
+    { name: "settlemint-service-access-token", re: new RegExp("\\b(sm_sat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_sat"] },
+    { name: "shippo-api-token", re: new RegExp("\\b(shippo_(?:live|test)_[a-fA-F0-9]{40})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["shippo_"] },
+    { name: "shopify-access-token", re: new RegExp("shpat_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpat_"] },
+    { name: "shopify-custom-access-token", re: new RegExp("shpca_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpca_"] },
+    { name: "shopify-private-app-access-token", re: new RegExp("shppa_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shppa_"] },
+    { name: "shopify-shared-secret", re: new RegExp("shpss_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpss_"] },
+    { name: "sidekiq-sensitive-url", re: new RegExp("\\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\\/|\\#|\\?|:]|$)", "gi"), firstGroup: true, keywords: ["gems.contribsys.com", "enterprise.contribsys.com"] },
+    { name: "sourcegraph-access-token", re: new RegExp("\\b(sgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}|sgp_[a-fA-F0-9]{40})\\b", "g"), firstGroup: true, entropy: 3, keywords: ["sgp_", "sourcegraph"] },
+    { name: "square-access-token", re: new RegExp("\\b((?:EAAA|sq0atp-)[\\w-]{22,60})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["sq0atp-", "eaaa"] },
+    { name: "vault-batch-token", re: new RegExp("\\b(hvb\\.[\\w-]{138,300})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["hvb."] },
+    { name: "vault-service-token", re: new RegExp("\\b(hvs\\.[\\w-]{90,120})", "g"), firstGroup: true, entropy: 3.5, keywords: ["hvs."] },
+];
+exports.PROVIDER_RULE_LABELS = {
+    "1password-secret-key": "1password secret key",
+    "1password-service-account-token": "1password service account token",
+    "adobe-client-secret": "Adobe client secret",
+    "age-secret-key": "Age secret key",
+    "airtable-personnal-access-token": "Airtable personnal access token",
+    "alibaba-access-key-id": "Alibaba access key id",
+    "artifactory-api-key": "Artifactory api key",
+    "artifactory-reference-token": "Artifactory reference token",
+    "clickhouse-cloud-api-secret-key": "Clickhouse cloud api secret key",
+    "clojars-api-token": "Clojars api token",
+    "cloudflare-origin-ca-key": "Cloudflare origin ca key",
+    "curl-auth-header": "Curl auth header",
+    "curl-auth-user": "Curl auth user",
+    "databricks-api-token": "Databricks api token",
+    "digitalocean-access-token": "Digitalocean access token",
+    "digitalocean-pat": "Digitalocean pat",
+    "digitalocean-refresh-token": "Digitalocean refresh token",
+    "doppler-api-token": "Doppler api token",
+    "duffel-api-token": "Duffel api token",
+    "dynatrace-api-token": "Dynatrace api token",
+    "easypost-api-token": "Easypost api token",
+    "easypost-test-api-token": "Easypost test api token",
+    "facebook-access-token": "Facebook access token",
+    "facebook-page-access-token": "Facebook page access token",
+    "flutterwave-encryption-key": "Flutterwave encryption key",
+    "flutterwave-secret-key": "Flutterwave secret key",
+    "flyio-access-token": "Flyio access token",
+    "frameio-api-token": "Frameio api token",
+    "grafana-api-key": "Grafana api key",
+    "grafana-cloud-api-token": "Grafana cloud api token",
+    "grafana-service-account-token": "Grafana service account token",
+    "harness-api-key": "Harness api key",
+    "heroku-api-key-v2": "Heroku api key v2",
+    "huggingface-access-token": "Huggingface access token",
+    "huggingface-organization-api-token": "Huggingface organization api token",
+    "infracost-api-token": "Infracost api token",
+    "intra42-client-secret": "Intra42 client secret",
+    "maxmind-license-key": "Maxmind license key",
+    "microsoft-teams-webhook": "Microsoft teams webhook",
+    "notion-api-token": "Notion api token",
+    "octopus-deploy-api-key": "Octopus deploy api key",
+    "openshift-user-token": "Openshift user token",
+    "perplexity-api-key": "Perplexity api key",
+    "planetscale-api-token": "Planetscale api token",
+    "planetscale-oauth-token": "Planetscale oauth token",
+    "planetscale-password": "Planetscale password",
+    "postman-api-token": "Postman api token",
+    "prefect-api-token": "Prefect api token",
+    "pulumi-api-token": "Pulumi api token",
+    "pypi-upload-token": "Pypi upload token",
+    "readme-api-token": "Readme api token",
+    "rubygems-api-token": "Rubygems api token",
+    "scalingo-api-token": "Scalingo api token",
+    "sendinblue-api-token": "Sendinblue api token",
+    "sentry-org-token": "Sentry org token",
+    "sentry-user-token": "Sentry user token",
+    "settlemint-application-access-token": "Settlemint application access token",
+    "settlemint-personal-access-token": "Settlemint personal access token",
+    "settlemint-service-access-token": "Settlemint service access token",
+    "shippo-api-token": "Shippo api token",
+    "shopify-access-token": "Shopify access token",
+    "shopify-custom-access-token": "Shopify custom access token",
+    "shopify-private-app-access-token": "Shopify private app access token",
+    "shopify-shared-secret": "Shopify shared secret",
+    "sidekiq-sensitive-url": "Sidekiq sensitive url",
+    "sourcegraph-access-token": "Sourcegraph access token",
+    "square-access-token": "Square access token",
+    "vault-batch-token": "Vault batch token",
+    "vault-service-token": "Vault service token",
+};

package/dist/utils.d.ts

@@ -6,6 +6,7 @@ import type { CaptureLogEntry } from "./captureLog";
 import { codiedevStateDir } from "./configDir";
 export { inspectPiExtension, piExtensionPath } from "./piHooks";
 export { codiedevStateDir };
+import type { BrowserAuth } from "./cliSession";
 export interface CodiedevConfig {
     token: string;
     companyId: string;
@@ -20,6 +21,7 @@ export interface CodiedevConfig {
     deviceId?: string;
     deviceName?: string;
     captureIgnoredPaths?: string[];
+    auth?: BrowserAuth;
 }
 export declare const CONFIG_PATH: string;
 export declare function readConfig(): CodiedevConfig | null;

package/dist/utils.js

@@ -150,6 +150,7 @@ const piHooks_1 = require("./piHooks");
 var piHooks_2 = require("./piHooks");
 Object.defineProperty(exports, "inspectPiExtension", { enumerable: true, get: function () { return piHooks_2.inspectPiExtension; } });
 Object.defineProperty(exports, "piExtensionPath", { enumerable: true, get: function () { return piHooks_2.piExtensionPath; } });
+const cliSession_1 = require("./cliSession");
 const CONFIG_DIR = (0, configDir_1.codiedevStateDir)();
 exports.CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 function readConfig() {
@@ -171,12 +172,9 @@ function writeConfigAtPath(config, configDir, configPath) {
     if (!fs.existsSync(configDir)) {
         fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    // writeFile's mode does not replace permissions on a pre-existing file.
-    fs.chmodSync(configPath, 0o600);
+    // Temp file + rename: hooks read this file concurrently, and a torn read
+    // looks like "not connected". The temp file is created 0600.
+    (0, cliSession_1.writeConfigAtomic)(configPath, config);
 }
 // Parse a remote URL out of git-config INI text WITHOUT invoking git. Prefers
 // the "origin" remote; falls back to the first remote found. Returns null if
@@ -1038,7 +1036,11 @@ function resolveHookInvocation(subcommand, preferredNodePath) {
                 // Bake the stable launcher, not this install's path, so later
                 // upgrades (including pnpm's hashed dirs) never strand the hook.
                 const launcher = (0, launcher_1.ensureLauncher)(hookScript);
-                return { command: nodePath, args: [launcher ?? hookScript, subcommand] };
+                // No launcher and no stable install to point at (e.g. an npx cache under a bogus "~"):
+                // the npx fallback below beats baking a path that won't exist tomorrow.
+                if (launcher || (0, launcher_1.stableHookScript)(hookScript)) {
+                    return { command: nodePath, args: [launcher ?? hookScript, subcommand] };
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.79",
+  "version": "0.9.81",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,13 +12,14 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
-    "test:functional": "vitest run src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
-    "test:harness-parity": "vitest run src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:functional": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:harness-parity": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
     "test:harness-binaries": "node scripts/checkHarnessBinaries.mjs",
     "test:watch": "vitest",
     "test:live-sources": "npm run build && node scripts/liveSourceParity.mjs",
     "test:ide-sources": "npm run build && node scripts/liveSourceParity.mjs --ide",
-    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts"
+    "test:metadata-parity": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts",
+    "test:local-scrub-live": "npm run build && node scripts/localScrubLive.mjs"
   },
   "files": [
     "dist",