codiedev 0.9.79 → 0.9.81

package/dist/commands/agentsSdk.generated.d.ts

@@ -0,0 +1,4 @@
+export declare const python = "\"\"\"Codiedev agents SDK \u2014 the run primitive, from Python.\n\nInside a deployed agent (everything is already configured):\n\n    import codiedev_agents as agents\n\n    task = agents.input()                      # this run's input (JSON)\n    llm = agents.openai()                      # OpenAI client on the Codiedev gateway, traced\n    child = agents.run(\"summarize\", {\"text\": ...})   # start another agent as a child run\n    agents.output({\"summary\": child[\"output\"]})      # this run's result\n    agents.request()                           # webhook runs: method, headers, raw body\n    agents.respond({\"text\": \"on it\"})          # what a webhook caller waiting (?wait=) gets back\n\n    agents.state.get(\"cursor\")                 # per-agent storage that outlives runs\n    agents.state.set(\"cursor\", 42)\n    agents.step(\"fetch\", lambda: fetch())      # done once per run, even across retries\n    agents.start(\"triage\", {...}, delay=3600)  # start a run later (up to 7 days)\n    agents.request_approval(\"Refund $120?\", context={...})  # a person decides; a run acts on it\n    agents.attempt()                           # 1, or 2+ when this run is a retry\n\nOutside a run (a script, a notebook, another service), set CODIEDEV_TOKEN\n(your CLI token) and CODIEDEV_AGENTS_URL, then call agents.run() the same way.\nStandard library only, so it drops into any project.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nfrom typing import Any\n\n__all__ = [\n    \"input\", \"output\", \"request\", \"respond\", \"run\", \"start\", \"get\", \"openai\", \"attempt\",\n    \"state\", \"step\", \"request_approval\", \"get_approval\", \"AgentRunError\", \"StateConflict\",\n]\n\n_INPUT_PATH = os.environ.get(\"CODIEDEV_INPUT_PATH\", \"/agent/.codiedev/input.json\")\n_OUTPUT_PATH = os.environ.get(\"CODIEDEV_OUTPUT_PATH\", \"/agent/.codiedev/output.json\")\n_REQUEST_PATH = os.environ.get(\"CODIEDEV_REQUEST_PATH\", \"/agent/.codiedev/request.json\")\n_RESPONSE_PATH = os.environ.get(\"CODIEDEV_RESPONSE_PATH\", \"/agent/.codiedev/response.json\")\n# Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\n_STATE_PATH = os.environ.get(\"CODIEDEV_STATE_PATH\")\n_DONE = {\"succeeded\", \"failed\", \"cancelled\"}\n\n\nclass StateConflict(RuntimeError):\n    \"\"\"state.set(..., if_version=n) found the key at another version.\"\"\"\n\n    def __init__(self, key: str, version: int):\n        super().__init__(f\"state {key!r} changed (now version {version})\")\n        self.key = key\n        self.version = version\n\n\nclass AgentRunError(RuntimeError):\n    def __init__(self, run: dict):\n        super().__init__(f\"{run.get('agent')} run {run.get('id')} {run.get('status')}: {run.get('error') or 'no error message'}\")\n        self.run = run\n\n\ndef input(default: Any = None) -> Any:  # noqa: A001 - mirrors output()\n    \"\"\"This run's input, parsed from JSON (None when started without one).\"\"\"\n    try:\n        with open(_INPUT_PATH) as f:\n            value = json.load(f)\n    except FileNotFoundError:\n        return default\n    return default if value is None else value\n\n\ndef output(value: Any) -> None:\n    \"\"\"Set this run's result. Must be JSON-serializable; the last call wins.\"\"\"\n    os.makedirs(os.path.dirname(_OUTPUT_PATH), exist_ok=True)\n    with open(_OUTPUT_PATH, \"w\") as f:\n        json.dump(value, f)\n\n\ndef respond(body: Any = None, status: int = 200, headers: \"dict | None\" = None) -> None:\n    \"\"\"What a webhook caller gets back when it waits for the run (?wait=N):\n    a string is sent as text, anything else as JSON. Without respond(), a\n    waiting caller gets the run's output.\"\"\"\n    os.makedirs(os.path.dirname(_RESPONSE_PATH), exist_ok=True)\n    with open(_RESPONSE_PATH, \"w\") as f:\n        json.dump({\"status\": status, \"headers\": headers or {}, \"body\": body}, f)\n\n\ndef attempt() -> int:\n    \"\"\"This run's attempt: 1, or 2+ when it's a retry of a failed attempt.\"\"\"\n    return int(os.environ.get(\"CODIEDEV_ATTEMPT\", \"1\"))\n\n\ndef request() -> \"dict | None\":\n    \"\"\"For a webhook run: {\"method\", \"query\", \"headers\", \"body\"} with the raw\n    body, to verify the sender's signature. None for other runs.\"\"\"\n    try:\n        with open(_REQUEST_PATH) as f:\n            return json.load(f)\n    except FileNotFoundError:\n        return None\n\n\ndef _base() -> str:\n    url = os.environ.get(\"CODIEDEV_AGENTS_URL\", \"\").rstrip(\"/\")\n    if not url:\n        raise RuntimeError(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\")\n    return url\n\n\ndef _token() -> str:\n    # Inside a run: the run's token. A connected agent (running outside Codiedev): its own key.\n    # Otherwise: your CLI token.\n    key = os.environ.get(\"CODIEDEV_API_KEY\", \"\")\n    token = os.environ.get(\"CODIEDEV_RUN_TOKEN\") or (key if key.startswith(\"cdvm_\") else None) or os.environ.get(\"CODIEDEV_TOKEN\")\n    if not token:\n        raise RuntimeError(\"Set CODIEDEV_API_KEY to your connected agent's key, or CODIEDEV_TOKEN to your CLI token (inside a run it's set for you)\")\n    return token\n\n\ndef _request(method: str, path: str, body: dict | None = None, ok: tuple[int, ...] = ()) -> dict:\n    req = urllib.request.Request(\n        f\"{_base()}{path}\",\n        method=method,\n        data=json.dumps(body).encode() if body is not None else None,\n        headers={\"Authorization\": f\"Bearer {_token()}\", \"Content-Type\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, timeout=30) as res:\n            return json.loads(res.read() or b\"{}\")\n    except urllib.error.HTTPError as err:\n        detail = err.read().decode(errors=\"replace\")\n        if err.code in ok:\n            return {\"_status\": err.code, **json.loads(detail or \"{}\")}\n        try:\n            detail = json.loads(detail).get(\"error\", detail)\n        except ValueError:\n            pass\n        raise RuntimeError(f\"Codiedev agents API {err.code}: {detail}\") from None\n\n\ndef start(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    idempotency_key: str | None = None,\n    delay: float | None = None,\n    retries: int | None = None,\n) -> str:\n    \"\"\"Start a run and return its id without waiting. With an idempotency key,\n    a second start within a day returns the first run's id. delay (seconds,\n    up to 7 days) starts it later; retries overrides the agent's retries.\"\"\"\n    body: dict = {\"agent\": agent, \"input\": input}\n    if idempotency_key:\n        body[\"idempotencyKey\"] = idempotency_key\n    if delay:\n        body[\"delaySec\"] = int(delay)\n    if retries is not None:\n        body[\"retries\"] = retries\n    return _request(\"POST\", \"/api/agents/v1/run\", body)[\"runId\"]\n\n\ndef get(run_id: str) -> dict:\n    \"\"\"A run's status, input, output (parsed), error, log tail and children.\"\"\"\n    run = _request(\"GET\", f\"/api/agents/v1/run?id={run_id}\")\n    if isinstance(run.get(\"output\"), str):\n        try:\n            run[\"output\"] = json.loads(run[\"output\"])\n        except ValueError:\n            pass\n    return run\n\n\ndef run(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    timeout: float = 900,\n    poll: float = 2.0,\n    check: bool = True,\n    idempotency_key: str | None = None,\n) -> dict:\n    \"\"\"Run an agent and wait for it. Returns the run; its result is run[\"output\"].\n\n    Inside a run this starts a child run, so the chain shows as one tree.\n    Raises AgentRunError if it fails (pass check=False to get the run anyway).\n    \"\"\"\n    run_id = start(agent, input, idempotency_key)\n    deadline = time.monotonic() + timeout\n    while True:\n        result = get(run_id)\n        if result.get(\"status\") in _DONE:\n            if check and result[\"status\"] != \"succeeded\":\n                raise AgentRunError(result)\n            return result\n        if time.monotonic() > deadline:\n            raise TimeoutError(f\"{agent} run {run_id} still {result.get('status')} after {timeout}s\")\n        time.sleep(poll)\n\n\nclass _State:\n    \"\"\"Per-agent key-value storage that outlives runs (values: any JSON, up\n    to 64 KB; 1,000 keys). Every write bumps the key's version; pass\n    if_version to write only if nobody else did since you read it.\"\"\"\n\n    def get(self, key: str, default: Any = None) -> Any:\n        value, _ = self.get_versioned(key)\n        return default if value is None else value\n\n    def get_versioned(self, key: str) -> \"tuple[Any, int]\":\n        \"\"\"(value, version); (None, 0) when the key isn't set.\"\"\"\n        if _STATE_PATH:\n            row = _local_state().get(key)\n            return (row[\"value\"], row[\"version\"]) if row else (None, 0)\n        res = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode({'key': key, 'agent': _agent()})}\", ok=(404,))\n        if res.get(\"_status\") == 404:\n            return None, 0\n        return json.loads(res[\"value\"]), int(res[\"version\"])\n\n    def set(self, key: str, value: Any, if_version: \"int | None\" = None, ttl: \"float | None\" = None) -> int:\n        \"\"\"Store value; returns the new version. Raises StateConflict when\n        if_version is given and the key is at another version (0 = unset).\"\"\"\n        return self._write(key, value, if_version, ttl)\n\n    def delete(self, key: str, if_version: \"int | None\" = None) -> None:\n        self._write(key, None, if_version, None)\n\n    def list(self, prefix: str = \"\", values: bool = False) -> \"list[dict]\":  # noqa: A003\n        \"\"\"Keys (and with values=True, values) starting with prefix.\"\"\"\n        if _STATE_PATH:\n            rows = sorted((k, r) for k, r in _local_state().items() if k.startswith(prefix))\n            return [{\"key\": k, \"version\": r[\"version\"], **({\"value\": r[\"value\"]} if values else {})} for k, r in rows]\n        keys: list = []\n        after = None\n        while True:\n            params = {\"prefix\": prefix, \"values\": \"1\" if values else \"0\", \"limit\": 200, \"agent\": _agent()}\n            if after:\n                params[\"after\"] = after\n            page = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode(params)}\")\n            for row in page[\"keys\"]:\n                if \"value\" in row:\n                    row[\"value\"] = json.loads(row[\"value\"])\n            keys.extend(page[\"keys\"])\n            after = page.get(\"next\")\n            if not after:\n                return keys\n\n    def update(self, key: str, fn, default: Any = None, retries: int = 10) -> Any:\n        \"\"\"Read-modify-write that's safe with runs in parallel: fn(old) -> new,\n        retried if another run wrote first. Returns the new value.\"\"\"\n        for _ in range(retries):\n            value, version = self.get_versioned(key)\n            new = fn(default if value is None else value)\n            try:\n                self.set(key, new, if_version=version)\n                return new\n            except StateConflict:\n                time.sleep(0.05)\n        raise StateConflict(key, -1)\n\n    def _write(self, key: str, value: Any, if_version: \"int | None\", ttl: \"float | None\") -> int:\n        if _STATE_PATH:\n            data = _local_state()\n            current = data.get(key, {}).get(\"version\", 0)\n            if if_version is not None and if_version != current:\n                raise StateConflict(key, current)\n            if value is None:\n                data.pop(key, None)\n            else:\n                data[key] = {\"value\": value, \"version\": current + 1}\n            with open(_STATE_PATH, \"w\") as f:\n                json.dump(data, f, indent=2)\n            return 0 if value is None else current + 1\n        body: dict = {\"key\": key, \"value\": value, \"agent\": _agent()}\n        if if_version is not None:\n            body[\"ifVersion\"] = if_version\n        if ttl:\n            body[\"ttlSec\"] = int(ttl)\n        res = _request(\"POST\", \"/api/agents/v1/state\", body, ok=(409,))\n        if res.get(\"_status\") == 409:\n            raise StateConflict(key, int(res.get(\"version\", 0)))\n        return int(res.get(\"version\", 0))\n\n\ndef _agent() -> str:\n    # Inside a run the run token picks the agent; a CLI token needs it named.\n    return os.environ.get(\"CODIEDEV_AGENT\", \"\")\n\n\ndef _local_state() -> dict:\n    try:\n        with open(_STATE_PATH or \"\") as f:\n            return json.load(f)\n    except (FileNotFoundError, ValueError):\n        return {}\n\n\nstate = _State()\n\n\ndef step(name: str, fn, ttl: float = 7 * 86400) -> Any:\n    \"\"\"Run fn() once for this run and remember its (JSON) result: if the run\n    is retried after a failure, finished steps return their saved result\n    instead of running again. Use it around side effects (posting a reply,\n    charging a card) so a retry doesn't repeat them.\"\"\"\n    key = f\"step/{os.environ.get('CODIEDEV_RUN_ID', 'local')}/{name}\"\n    value, version = state.get_versioned(key)\n    if version:\n        return value[\"result\"]\n    result = fn()\n    state.set(key, {\"result\": result}, ttl=ttl)\n    return result\n\n\n_SELF = object()\n\n\ndef request_approval(\n    title: str,\n    details: Any = None,\n    options: \"list[str] | None\" = None,\n    approvers: \"list[str] | None\" = None,\n    teams: \"list[str] | None\" = None,\n    fields: \"list[dict] | None\" = None,\n    then: Any = _SELF,\n    context: Any = None,\n    expires_in: \"float | None\" = None,\n) -> dict:\n    \"\"\"Ask a person to decide. It shows in Codiedev (Agents \u2192 Approvals) and\n    at the returned [\"url\"], which you can post anywhere (Slack, email).\n\n    When it's decided, a run of `then` (this agent by default; None for no\n    run) starts with input {\"approval\": {\"decision\", \"comment\", \"decidedBy\",\n    ...}, \"context\": context}. If nobody decides within expires_in seconds\n    (default 7 days), it starts with decision \"expired\". Usually the run\n    ends after asking, so nothing runs (or costs) while it waits.\n    options default to [\"approve\", \"reject\"]; approvers (emails) and teams\n    (team names, e.g. [\"Finance\"]) limit who can decide (admins always can).\n    Apps your company connects (Agents \u2192 Approvals \u2192 Apps) are told about it\n    by webhook and can decide on a person's behalf.\n\n    fields asks the person to fill something in as they decide, e.g.\n    [{\"name\": \"rating\", \"type\": \"rating\"}, {\"name\": \"why\", \"type\": \"textarea\"}]\n    (types: text, textarea, number, rating, select, multiselect, boolean;\n    required, label, help, options, min, max, default). What they entered\n    arrives as input[\"approval\"][\"values\"]. With fields and no options, the\n    only choice is \"submit\".\"\"\"\n    body: dict = {\"title\": title, \"details\": details, \"options\": options, \"approvers\": approvers, \"teams\": teams, \"fields\": fields, \"context\": context}\n    if then is not _SELF:\n        body[\"onDecision\"] = then\n    if expires_in:\n        body[\"expiresSec\"] = int(expires_in)\n    if os.environ.get(\"CODIEDEV_LOCAL\") == \"1\":\n        print(f\"[local] approval requested: {title} ({', '.join(options or (['submit'] if fields else ['approve', 'reject']))}); not sent on a local run\", flush=True)\n        return {\"id\": f\"local-{int(time.time())}\", \"status\": \"pending\", \"url\": None, \"title\": title}\n    return _request(\"POST\", \"/api/agents/v1/approvals\", {k: v for k, v in body.items() if v is not None or k == \"onDecision\"})\n\n\ndef get_approval(approval_id: str) -> dict:\n    \"\"\"An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment.\"\"\"\n    return _request(\"GET\", f\"/api/agents/v1/approvals?id={urllib.parse.quote(approval_id)}\")\n\n\ndef wait_for_approval(approval_id: str, timeout: float = 3600, poll: float = 15) -> dict:\n    \"\"\"Wait until a person decides (or it expires), then return the approval. For agents that keep\n    running while they wait, like a connected agent; a run inside Codiedev usually ends instead and\n    is started again with the decision.\"\"\"\n    deadline = time.time() + timeout\n    while True:\n        a = get_approval(approval_id)\n        if a.get(\"status\") != \"pending\":\n            return a\n        if time.time() > deadline:\n            raise TimeoutError(f\"approval {approval_id} still pending after {timeout}s\")\n        time.sleep(poll)\n\n\ndef openai(**kwargs):\n    \"\"\"An OpenAI client on the Codiedev gateway, with trace headers for this run.\"\"\"\n    from openai import OpenAI\n\n    headers = {\n        \"X-Codiedev-Workload\": os.environ.get(\"CODIEDEV_AGENT\", \"local-agent\"),\n        \"X-Codiedev-Run-Id\": os.environ.get(\"CODIEDEV_RUN_ID\", f\"local-{int(time.time())}\"),\n        \"X-Codiedev-Environment\": \"production\" if os.environ.get(\"CODIEDEV_RUN_ID\") else \"development\",\n    }\n    headers.update(kwargs.pop(\"default_headers\", {}) or {})\n    return OpenAI(\n        base_url=os.environ.get(\"CODIEDEV_GATEWAY_URL\", \"https://gateway.codiedev.com/api/v1\"),\n        api_key=os.environ.get(\"CODIEDEV_API_KEY\") or os.environ.get(\"CODIEDEV_TOKEN\"),\n        default_headers=headers,\n        **kwargs,\n    )\n";
+export declare const jsIndex = "// Codiedev agents SDK for JavaScript and TypeScript, preinstalled in every\n// run. Same primitive as the Python SDK (codiedev_agents.py):\n//\n//   import * as agents from \"codiedev-agents\";\n//   const task = agents.input();                    // this run's input (JSON)\n//   const llm = await agents.openai();              // OpenAI client on the Codiedev gateway, traced\n//   const child = await agents.run(\"summarize\", { text });  // another agent, as a child run\n//   agents.output({ summary: child.output });       // this run's result\n//   agents.respond({ text: \"on it\" });              // what a webhook caller waiting (?wait=) gets back\n//   await agents.state.get(\"cursor\");               // per-agent storage that outlives runs\n//   await agents.step(\"post\", () => post());        // done once per run, even across retries\n//   await agents.start(\"triage\", input, { delaySec: 3600 });  // start a run later\n//   await agents.requestApproval(\"Refund $120?\", { context });  // a person decides; a run acts on it\n//\n// Outside a run, set CODIEDEV_TOKEN and CODIEDEV_AGENTS_URL and call run() the same way.\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst INPUT_PATH = process.env.CODIEDEV_INPUT_PATH || \"/agent/.codiedev/input.json\";\nconst OUTPUT_PATH = process.env.CODIEDEV_OUTPUT_PATH || \"/agent/.codiedev/output.json\";\nconst REQUEST_PATH = process.env.CODIEDEV_REQUEST_PATH || \"/agent/.codiedev/request.json\";\nconst RESPONSE_PATH = process.env.CODIEDEV_RESPONSE_PATH || \"/agent/.codiedev/response.json\";\n// Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\nconst STATE_PATH = process.env.CODIEDEV_STATE_PATH;\n// Inside a run the run token picks the agent; a CLI token needs it named.\nconst AGENT = process.env.CODIEDEV_AGENT || \"\";\nconst DONE = new Set([\"succeeded\", \"failed\", \"cancelled\"]);\n\n/** state.set(..., { ifVersion }) found the key at another version. */\nexport class StateConflict extends Error {\n  constructor(key, version) {\n    super(`state ${JSON.stringify(key)} changed (now version ${version})`);\n    this.key = key;\n    this.version = version;\n  }\n}\n\nexport class AgentRunError extends Error {\n  constructor(run) {\n    super(`${run.agent} run ${run.id} ${run.status}: ${run.error || \"no error message\"}`);\n    this.run = run;\n  }\n}\n\nfunction readJson(file) {\n  try {\n    return JSON.parse(fs.readFileSync(file, \"utf8\"));\n  } catch (err) {\n    if (err.code === \"ENOENT\") return null;\n    throw err;\n  }\n}\n\n/** This run's input, parsed from JSON (`fallback` when started without one). */\nexport function input(fallback = null) {\n  const value = readJson(INPUT_PATH);\n  return value ?? fallback;\n}\n\n/** Set this run's result. Must be JSON-serializable; the last call wins. */\nexport function output(value) {\n  fs.mkdirSync(path.dirname(OUTPUT_PATH), { recursive: true });\n  fs.writeFileSync(OUTPUT_PATH, JSON.stringify(value));\n}\n\n/** What a webhook caller gets back when it waits for the run (?wait=N): a\n *  string is sent as text, anything else as JSON. Without it, a waiting\n *  caller gets the run's output. */\nexport function respond(body = null, { status = 200, headers = {} } = {}) {\n  fs.mkdirSync(path.dirname(RESPONSE_PATH), { recursive: true });\n  fs.writeFileSync(RESPONSE_PATH, JSON.stringify({ status, headers, body }));\n}\n\n/** This run's attempt: 1, or 2+ when it's a retry of a failed attempt. */\nexport function attempt() {\n  return Number(process.env.CODIEDEV_ATTEMPT || \"1\");\n}\n\n/** For a webhook run: { method, query, headers, body } with the raw body, to verify a signature. */\nexport function request() {\n  return readJson(REQUEST_PATH);\n}\n\nfunction base() {\n  const url = (process.env.CODIEDEV_AGENTS_URL || \"\").replace(/\\/$/, \"\");\n  if (!url) throw new Error(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\");\n  return url;\n}\n\nfunction token() {\n  // Inside a run: the run's token. A connected agent (running outside Codiedev): its own key.\n  // Otherwise: your CLI token.\n  const key = process.env.CODIEDEV_API_KEY || \"\";\n  const t = process.env.CODIEDEV_RUN_TOKEN || (key.startsWith(\"cdvm_\") ? key : \"\") || process.env.CODIEDEV_TOKEN;\n  if (!t) throw new Error(\"Set CODIEDEV_API_KEY to your connected agent's key, or CODIEDEV_TOKEN to your CLI token (inside a run it's set for you)\");\n  return t;\n}\n\nasync function call(method, route, body, ok = []) {\n  const res = await fetch(`${base()}${route}`, {\n    method,\n    headers: { Authorization: `Bearer ${token()}`, \"Content-Type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const text = await res.text();\n  let data = {};\n  try {\n    data = text ? JSON.parse(text) : {};\n  } catch {\n    data = { error: text };\n  }\n  if (ok.includes(res.status)) return { _status: res.status, ...data };\n  if (!res.ok) throw new Error(`Codiedev agents API ${res.status}: ${data.error || text}`);\n  return data;\n}\n\n/** Start a run and return its id without waiting. delaySec (up to 7 days)\n *  starts it later; retries overrides the agent's retries. */\nexport async function start(agent, input = null, { idempotencyKey, delaySec, retries } = {}) {\n  return (await call(\"POST\", \"/api/agents/v1/run\", {\n    agent,\n    input,\n    ...(idempotencyKey ? { idempotencyKey } : {}),\n    ...(delaySec ? { delaySec } : {}),\n    ...(retries !== undefined ? { retries } : {}),\n  })).runId;\n}\n\nfunction localState() {\n  try {\n    return JSON.parse(fs.readFileSync(STATE_PATH, \"utf8\"));\n  } catch {\n    return {};\n  }\n}\n\nasync function writeState(key, value, { ifVersion, ttlSec } = {}) {\n  if (STATE_PATH) {\n    const data = localState();\n    const current = data[key]?.version ?? 0;\n    if (ifVersion !== undefined && ifVersion !== current) throw new StateConflict(key, current);\n    if (value === null) delete data[key];\n    else data[key] = { value, version: current + 1 };\n    fs.writeFileSync(STATE_PATH, JSON.stringify(data, null, 2));\n    return value === null ? 0 : current + 1;\n  }\n  const res = await call(\"POST\", \"/api/agents/v1/state\", { key, value, agent: AGENT, ...(ifVersion !== undefined ? { ifVersion } : {}), ...(ttlSec ? { ttlSec } : {}) }, [409]);\n  if (res._status === 409) throw new StateConflict(key, res.version ?? 0);\n  return res.version ?? 0;\n}\n\n/** Per-agent key-value storage that outlives runs (values: any JSON, up to\n *  64 KB; 1,000 keys). Every write bumps the key's version; pass ifVersion\n *  to write only if nobody else did since you read it. */\nexport const state = {\n  async get(key, fallback = null) {\n    const { value } = await state.getVersioned(key);\n    return value ?? fallback;\n  },\n  /** { value, version }; { value: null, version: 0 } when the key isn't set. */\n  async getVersioned(key) {\n    if (STATE_PATH) {\n      const row = localState()[key];\n      return row ? { value: row.value, version: row.version } : { value: null, version: 0 };\n    }\n    const res = await call(\"GET\", `/api/agents/v1/state?${new URLSearchParams({ key, agent: AGENT })}`, undefined, [404]);\n    if (res._status === 404) return { value: null, version: 0 };\n    return { value: JSON.parse(res.value), version: res.version };\n  },\n  /** Store value; returns the new version. Throws StateConflict on an ifVersion mismatch (0 = unset). */\n  set(key, value, { ifVersion, ttlSec } = {}) {\n    return writeState(key, value, { ifVersion, ttlSec });\n  },\n  async delete(key, { ifVersion } = {}) {\n    await writeState(key, null, { ifVersion });\n  },\n  /** Keys (and with values: true, values) starting with prefix. */\n  async list(prefix = \"\", { values = false } = {}) {\n    if (STATE_PATH) {\n      return Object.entries(localState())\n        .filter(([k]) => k.startsWith(prefix))\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([key, row]) => ({ key, version: row.version, ...(values ? { value: row.value } : {}) }));\n    }\n    const out = [];\n    let after = null;\n    do {\n      const q = new URLSearchParams({ prefix, values: values ? \"1\" : \"0\", limit: \"200\", agent: AGENT, ...(after ? { after } : {}) });\n      const page = await call(\"GET\", `/api/agents/v1/state?${q}`);\n      out.push(...page.keys.map((row) => (\"value\" in row ? { ...row, value: JSON.parse(row.value) } : row)));\n      after = page.next;\n    } while (after);\n    return out;\n  },\n  /** Read-modify-write that's safe with runs in parallel: fn(old) => new, retried if another run wrote first. */\n  async update(key, fn, fallback = null, retries = 10) {\n    for (let i = 0; i < retries; i++) {\n      const { value, version } = await state.getVersioned(key);\n      const next = await fn(value ?? fallback);\n      try {\n        await state.set(key, next, { ifVersion: version });\n        return next;\n      } catch (err) {\n        if (!(err instanceof StateConflict)) throw err;\n        await new Promise((resolve) => setTimeout(resolve, 50));\n      }\n    }\n    throw new StateConflict(key, -1);\n  },\n};\n\n/** Run fn() once for this run and remember its (JSON) result: if the run is\n *  retried after a failure, finished steps return their saved result instead\n *  of running again. Use it around side effects so a retry doesn't repeat them. */\nexport async function step(name, fn, { ttlSec = 7 * 86400 } = {}) {\n  const key = `step/${process.env.CODIEDEV_RUN_ID || \"local\"}/${name}`;\n  const { value, version } = await state.getVersioned(key);\n  if (version) return value.result;\n  const result = await fn();\n  await state.set(key, { result: result ?? null }, { ttlSec });\n  return result;\n}\n\n/** Ask a person to decide. It shows in Codiedev (Agents \u2192 Approvals) and at\n *  the returned .url, which you can post anywhere. When it's decided, a run of\n *  `then` (this agent by default; null for none) starts with input\n *  { approval: { decision, comment, decidedBy, ... }, context }. Undecided\n *  after expiresSec (default 7 days): decision \"expired\". */\nexport async function requestApproval(title, { details, options, approvers, teams, fields, then, context, expiresSec } = {}) {\n  if (process.env.CODIEDEV_LOCAL === \"1\") {\n    console.log(`[local] approval requested: ${title} (${(options || (fields ? [\"submit\"] : [\"approve\", \"reject\"])).join(\", \")}); not sent on a local run`);\n    return { id: `local-${Date.now()}`, status: \"pending\", url: null, title };\n  }\n  return call(\"POST\", \"/api/agents/v1/approvals\", {\n    title,\n    ...(details !== undefined ? { details } : {}),\n    ...(options ? { options } : {}),\n    ...(approvers ? { approvers } : {}),\n    ...(teams ? { teams } : {}),\n    ...(fields ? { fields } : {}),\n    ...(then !== undefined ? { onDecision: then } : {}),\n    ...(context !== undefined ? { context } : {}),\n    ...(expiresSec ? { expiresSec } : {}),\n  });\n}\n\n/** An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment. */\nexport async function getApproval(id) {\n  return call(\"GET\", `/api/agents/v1/approvals?id=${encodeURIComponent(id)}`);\n}\n\n/** Wait until a person decides (or it expires), then return the approval. For agents that keep\n *  running while they wait, like a connected agent; a run inside Codiedev usually ends instead and\n *  is started again with the decision. */\nexport async function waitForApproval(id, { timeoutMs = 3_600_000, pollMs = 15_000 } = {}) {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const a = await getApproval(id);\n    if (a.status !== \"pending\") return a;\n    if (Date.now() > deadline) throw new Error(`approval ${id} still pending after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** A run's status, input, output (parsed), error, log and children. */\nexport async function get(runId) {\n  const run = await call(\"GET\", `/api/agents/v1/run?id=${encodeURIComponent(runId)}`);\n  if (typeof run.output === \"string\") {\n    try {\n      run.output = JSON.parse(run.output);\n    } catch {\n      // not JSON: keep the string\n    }\n  }\n  return run;\n}\n\n/** Run an agent and wait for it; its result is `.output`. Inside a run this\n *  starts a child run. Throws AgentRunError if it fails unless check is false. */\nexport async function run(agent, input = null, { timeoutMs = 900_000, pollMs = 2000, check = true, idempotencyKey } = {}) {\n  const id = await start(agent, input, { idempotencyKey });\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const r = await get(id);\n    if (DONE.has(r.status)) {\n      if (check && r.status !== \"succeeded\") throw new AgentRunError(r);\n      return r;\n    }\n    if (Date.now() > deadline) throw new Error(`${agent} run ${id} still ${r.status} after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** Options for `new OpenAI(...)` on the Codiedev gateway, with this run's trace headers. */\nexport function openaiOptions(extra = {}) {\n  const inRun = !!process.env.CODIEDEV_RUN_ID;\n  return {\n    baseURL: process.env.CODIEDEV_GATEWAY_URL || \"https://gateway.codiedev.com/api/v1\",\n    apiKey: process.env.CODIEDEV_API_KEY || process.env.CODIEDEV_TOKEN,\n    ...extra,\n    defaultHeaders: {\n      \"X-Codiedev-Workload\": process.env.CODIEDEV_AGENT || \"local-agent\",\n      \"X-Codiedev-Run-Id\": process.env.CODIEDEV_RUN_ID || `local-${Date.now()}`,\n      \"X-Codiedev-Environment\": inRun ? \"production\" : \"development\",\n      ...(extra.defaultHeaders || {}),\n    },\n  };\n}\n\n/** An OpenAI client on the Codiedev gateway (the `openai` package is preinstalled). */\nexport async function openai(extra = {}) {\n  const { default: OpenAI } = await import(\"openai\");\n  return new OpenAI(openaiOptions(extra));\n}\n";
+export declare const jsTypes = "/* eslint-disable @typescript-eslint/no-explicit-any -- defaults are `any` on purpose: agent code reads its own JSON input/state without declaring types first. */\nexport type RunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\";\nexport interface Run<O = unknown> {\n  id: string;\n  agent: string;\n  version: number;\n  status: RunStatus;\n  trigger: \"cli\" | \"api\" | \"portal\" | \"schedule\" | \"webhook\" | \"child\" | \"approval\";\n  parentRunId: string | null;\n  rootRunId: string | null;\n  depth: number;\n  attempt: number;\n  maxAttempts: number;\n  scheduledFor: number | null;\n  input: string | null;\n  output: O;\n  error: string | null;\n  logTail: string | null;\n  durationMs: number | null;\n  children: Run[];\n}\nexport interface WebhookRequest { method: string; query: Record<string, string>; headers: Record<string, string>; body: string }\nexport interface Approval {\n  id: string;\n  agent: string;\n  title: string;\n  details: string | null;\n  options: string[];\n  status: \"pending\" | \"decided\" | \"expired\" | \"cancelled\";\n  decision: string | null;\n  comment: string | null;\n  decidedBy: string | null;\n  /** The approval app that sent the decision on decidedBy's behalf; null when decided in Codiedev. */\n  decidedVia: string | null;\n  approvers: string[];\n  approverTeams: Array<{ id: string; name: string }>;\n  /** The form the person fills in, if the approval asked for one. */\n  fields: ApprovalField[];\n  /** What they entered, by field name (null until decided). */\n  values: Record<string, any> | null;\n  url: string | null;\n  resumeRunId: string | null;\n}\n/** One thing a person fills in when they decide. */\nexport interface ApprovalField {\n  name: string;\n  type: \"text\" | \"textarea\" | \"number\" | \"rating\" | \"select\" | \"multiselect\" | \"boolean\";\n  label?: string;\n  help?: string;\n  required?: boolean;\n  /** select / multiselect choices */\n  options?: string[];\n  /** number bounds; rating scale 1\u2013max (default 5) */\n  min?: number;\n  max?: number;\n  /** prefilled, e.g. a proposed amount for the person to correct */\n  default?: unknown;\n}\n/** The input a run started by a decision gets. */\nexport interface ApprovalInput<C = any, V = Record<string, any>> {\n  approval: { id: string; title: string; decision: string; comment: string | null; values: V; decidedBy: string | null; decidedVia: string | null; decidedAt: number; requestedByRun: string | null };\n  context: C;\n}\nexport class AgentRunError extends Error { run: Run }\nexport class StateConflict extends Error { key: string; version: number }\nexport function input<T = any>(fallback?: T): T;\nexport function output(value: unknown): void;\nexport function request(): WebhookRequest | null;\nexport function respond(body?: unknown, opts?: { status?: number; headers?: Record<string, string> }): void;\nexport function attempt(): number;\nexport function start(agent: string, input?: unknown, opts?: { idempotencyKey?: string; delaySec?: number; retries?: number }): Promise<string>;\nexport function get<O = any>(runId: string): Promise<Run<O>>;\nexport function run<O = any>(agent: string, input?: unknown, opts?: { timeoutMs?: number; pollMs?: number; check?: boolean; idempotencyKey?: string }): Promise<Run<O>>;\nexport const state: {\n  get<T = any>(key: string, fallback?: T): Promise<T>;\n  getVersioned<T = any>(key: string): Promise<{ value: T | null; version: number }>;\n  set(key: string, value: unknown, opts?: { ifVersion?: number; ttlSec?: number }): Promise<number>;\n  delete(key: string, opts?: { ifVersion?: number }): Promise<void>;\n  list(prefix?: string, opts?: { values?: boolean }): Promise<Array<{ key: string; version: number; value?: any }>>;\n  update<T = any>(key: string, fn: (old: T) => T | Promise<T>, fallback?: T, retries?: number): Promise<T>;\n};\nexport function step<T>(name: string, fn: () => T | Promise<T>, opts?: { ttlSec?: number }): Promise<T>;\nexport function requestApproval<C = any>(title: string, opts?: { details?: unknown; options?: string[]; approvers?: string[]; teams?: string[]; fields?: ApprovalField[]; then?: string | null; context?: C; expiresSec?: number }): Promise<Approval>;\nexport function getApproval(id: string): Promise<Approval>;\nexport function waitForApproval(id: string, opts?: { timeoutMs?: number; pollMs?: number }): Promise<Approval>;\nexport function openaiOptions(extra?: Record<string, unknown>): { baseURL: string; apiKey: string | undefined; defaultHeaders: Record<string, string> };\nexport function openai(extra?: Record<string, unknown>): Promise<import(\"openai\").default>;";
+export declare const jsPackage = "{\n  \"name\": \"codiedev-agents\",\n  \"version\": \"0.1.0\",\n  \"description\": \"Codiedev agents SDK: this run's input and output, chaining, and a traced OpenAI client.\",\n  \"type\": \"module\",\n  \"main\": \"./index.mjs\",\n  \"types\": \"./index.d.ts\",\n  \"exports\": { \".\": { \"types\": \"./index.d.ts\", \"default\": \"./index.mjs\" } }\n}\n";

package/dist/commands/agentsSdk.generated.js

@@ -0,0 +1,10 @@
+"use strict";
+// Generated by scripts/sync-agents-sdk.mjs. Don't edit; change the source
+// (modal/agent_runtime, packages/codiedev-cli/agent-templates) and run
+// `node scripts/sync-agents-sdk.mjs`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsPackage = exports.jsTypes = exports.jsIndex = exports.python = void 0;
+exports.python = "\"\"\"Codiedev agents SDK — the run primitive, from Python.\n\nInside a deployed agent (everything is already configured):\n\n    import codiedev_agents as agents\n\n    task = agents.input()                      # this run's input (JSON)\n    llm = agents.openai()                      # OpenAI client on the Codiedev gateway, traced\n    child = agents.run(\"summarize\", {\"text\": ...})   # start another agent as a child run\n    agents.output({\"summary\": child[\"output\"]})      # this run's result\n    agents.request()                           # webhook runs: method, headers, raw body\n    agents.respond({\"text\": \"on it\"})          # what a webhook caller waiting (?wait=) gets back\n\n    agents.state.get(\"cursor\")                 # per-agent storage that outlives runs\n    agents.state.set(\"cursor\", 42)\n    agents.step(\"fetch\", lambda: fetch())      # done once per run, even across retries\n    agents.start(\"triage\", {...}, delay=3600)  # start a run later (up to 7 days)\n    agents.request_approval(\"Refund $120?\", context={...})  # a person decides; a run acts on it\n    agents.attempt()                           # 1, or 2+ when this run is a retry\n\nOutside a run (a script, a notebook, another service), set CODIEDEV_TOKEN\n(your CLI token) and CODIEDEV_AGENTS_URL, then call agents.run() the same way.\nStandard library only, so it drops into any project.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nfrom typing import Any\n\n__all__ = [\n    \"input\", \"output\", \"request\", \"respond\", \"run\", \"start\", \"get\", \"openai\", \"attempt\",\n    \"state\", \"step\", \"request_approval\", \"get_approval\", \"AgentRunError\", \"StateConflict\",\n]\n\n_INPUT_PATH = os.environ.get(\"CODIEDEV_INPUT_PATH\", \"/agent/.codiedev/input.json\")\n_OUTPUT_PATH = os.environ.get(\"CODIEDEV_OUTPUT_PATH\", \"/agent/.codiedev/output.json\")\n_REQUEST_PATH = os.environ.get(\"CODIEDEV_REQUEST_PATH\", \"/agent/.codiedev/request.json\")\n_RESPONSE_PATH = os.environ.get(\"CODIEDEV_RESPONSE_PATH\", \"/agent/.codiedev/response.json\")\n# Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\n_STATE_PATH = os.environ.get(\"CODIEDEV_STATE_PATH\")\n_DONE = {\"succeeded\", \"failed\", \"cancelled\"}\n\n\nclass StateConflict(RuntimeError):\n    \"\"\"state.set(..., if_version=n) found the key at another version.\"\"\"\n\n    def __init__(self, key: str, version: int):\n        super().__init__(f\"state {key!r} changed (now version {version})\")\n        self.key = key\n        self.version = version\n\n\nclass AgentRunError(RuntimeError):\n    def __init__(self, run: dict):\n        super().__init__(f\"{run.get('agent')} run {run.get('id')} {run.get('status')}: {run.get('error') or 'no error message'}\")\n        self.run = run\n\n\ndef input(default: Any = None) -> Any:  # noqa: A001 - mirrors output()\n    \"\"\"This run's input, parsed from JSON (None when started without one).\"\"\"\n    try:\n        with open(_INPUT_PATH) as f:\n            value = json.load(f)\n    except FileNotFoundError:\n        return default\n    return default if value is None else value\n\n\ndef output(value: Any) -> None:\n    \"\"\"Set this run's result. Must be JSON-serializable; the last call wins.\"\"\"\n    os.makedirs(os.path.dirname(_OUTPUT_PATH), exist_ok=True)\n    with open(_OUTPUT_PATH, \"w\") as f:\n        json.dump(value, f)\n\n\ndef respond(body: Any = None, status: int = 200, headers: \"dict | None\" = None) -> None:\n    \"\"\"What a webhook caller gets back when it waits for the run (?wait=N):\n    a string is sent as text, anything else as JSON. Without respond(), a\n    waiting caller gets the run's output.\"\"\"\n    os.makedirs(os.path.dirname(_RESPONSE_PATH), exist_ok=True)\n    with open(_RESPONSE_PATH, \"w\") as f:\n        json.dump({\"status\": status, \"headers\": headers or {}, \"body\": body}, f)\n\n\ndef attempt() -> int:\n    \"\"\"This run's attempt: 1, or 2+ when it's a retry of a failed attempt.\"\"\"\n    return int(os.environ.get(\"CODIEDEV_ATTEMPT\", \"1\"))\n\n\ndef request() -> \"dict | None\":\n    \"\"\"For a webhook run: {\"method\", \"query\", \"headers\", \"body\"} with the raw\n    body, to verify the sender's signature. None for other runs.\"\"\"\n    try:\n        with open(_REQUEST_PATH) as f:\n            return json.load(f)\n    except FileNotFoundError:\n        return None\n\n\ndef _base() -> str:\n    url = os.environ.get(\"CODIEDEV_AGENTS_URL\", \"\").rstrip(\"/\")\n    if not url:\n        raise RuntimeError(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\")\n    return url\n\n\ndef _token() -> str:\n    # Inside a run: the run's token. A connected agent (running outside Codiedev): its own key.\n    # Otherwise: your CLI token.\n    key = os.environ.get(\"CODIEDEV_API_KEY\", \"\")\n    token = os.environ.get(\"CODIEDEV_RUN_TOKEN\") or (key if key.startswith(\"cdvm_\") else None) or os.environ.get(\"CODIEDEV_TOKEN\")\n    if not token:\n        raise RuntimeError(\"Set CODIEDEV_API_KEY to your connected agent's key, or CODIEDEV_TOKEN to your CLI token (inside a run it's set for you)\")\n    return token\n\n\ndef _request(method: str, path: str, body: dict | None = None, ok: tuple[int, ...] = ()) -> dict:\n    req = urllib.request.Request(\n        f\"{_base()}{path}\",\n        method=method,\n        data=json.dumps(body).encode() if body is not None else None,\n        headers={\"Authorization\": f\"Bearer {_token()}\", \"Content-Type\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, timeout=30) as res:\n            return json.loads(res.read() or b\"{}\")\n    except urllib.error.HTTPError as err:\n        detail = err.read().decode(errors=\"replace\")\n        if err.code in ok:\n            return {\"_status\": err.code, **json.loads(detail or \"{}\")}\n        try:\n            detail = json.loads(detail).get(\"error\", detail)\n        except ValueError:\n            pass\n        raise RuntimeError(f\"Codiedev agents API {err.code}: {detail}\") from None\n\n\ndef start(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    idempotency_key: str | None = None,\n    delay: float | None = None,\n    retries: int | None = None,\n) -> str:\n    \"\"\"Start a run and return its id without waiting. With an idempotency key,\n    a second start within a day returns the first run's id. delay (seconds,\n    up to 7 days) starts it later; retries overrides the agent's retries.\"\"\"\n    body: dict = {\"agent\": agent, \"input\": input}\n    if idempotency_key:\n        body[\"idempotencyKey\"] = idempotency_key\n    if delay:\n        body[\"delaySec\"] = int(delay)\n    if retries is not None:\n        body[\"retries\"] = retries\n    return _request(\"POST\", \"/api/agents/v1/run\", body)[\"runId\"]\n\n\ndef get(run_id: str) -> dict:\n    \"\"\"A run's status, input, output (parsed), error, log tail and children.\"\"\"\n    run = _request(\"GET\", f\"/api/agents/v1/run?id={run_id}\")\n    if isinstance(run.get(\"output\"), str):\n        try:\n            run[\"output\"] = json.loads(run[\"output\"])\n        except ValueError:\n            pass\n    return run\n\n\ndef run(\n    agent: str,\n    input: Any = None,  # noqa: A002\n    timeout: float = 900,\n    poll: float = 2.0,\n    check: bool = True,\n    idempotency_key: str | None = None,\n) -> dict:\n    \"\"\"Run an agent and wait for it. Returns the run; its result is run[\"output\"].\n\n    Inside a run this starts a child run, so the chain shows as one tree.\n    Raises AgentRunError if it fails (pass check=False to get the run anyway).\n    \"\"\"\n    run_id = start(agent, input, idempotency_key)\n    deadline = time.monotonic() + timeout\n    while True:\n        result = get(run_id)\n        if result.get(\"status\") in _DONE:\n            if check and result[\"status\"] != \"succeeded\":\n                raise AgentRunError(result)\n            return result\n        if time.monotonic() > deadline:\n            raise TimeoutError(f\"{agent} run {run_id} still {result.get('status')} after {timeout}s\")\n        time.sleep(poll)\n\n\nclass _State:\n    \"\"\"Per-agent key-value storage that outlives runs (values: any JSON, up\n    to 64 KB; 1,000 keys). Every write bumps the key's version; pass\n    if_version to write only if nobody else did since you read it.\"\"\"\n\n    def get(self, key: str, default: Any = None) -> Any:\n        value, _ = self.get_versioned(key)\n        return default if value is None else value\n\n    def get_versioned(self, key: str) -> \"tuple[Any, int]\":\n        \"\"\"(value, version); (None, 0) when the key isn't set.\"\"\"\n        if _STATE_PATH:\n            row = _local_state().get(key)\n            return (row[\"value\"], row[\"version\"]) if row else (None, 0)\n        res = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode({'key': key, 'agent': _agent()})}\", ok=(404,))\n        if res.get(\"_status\") == 404:\n            return None, 0\n        return json.loads(res[\"value\"]), int(res[\"version\"])\n\n    def set(self, key: str, value: Any, if_version: \"int | None\" = None, ttl: \"float | None\" = None) -> int:\n        \"\"\"Store value; returns the new version. Raises StateConflict when\n        if_version is given and the key is at another version (0 = unset).\"\"\"\n        return self._write(key, value, if_version, ttl)\n\n    def delete(self, key: str, if_version: \"int | None\" = None) -> None:\n        self._write(key, None, if_version, None)\n\n    def list(self, prefix: str = \"\", values: bool = False) -> \"list[dict]\":  # noqa: A003\n        \"\"\"Keys (and with values=True, values) starting with prefix.\"\"\"\n        if _STATE_PATH:\n            rows = sorted((k, r) for k, r in _local_state().items() if k.startswith(prefix))\n            return [{\"key\": k, \"version\": r[\"version\"], **({\"value\": r[\"value\"]} if values else {})} for k, r in rows]\n        keys: list = []\n        after = None\n        while True:\n            params = {\"prefix\": prefix, \"values\": \"1\" if values else \"0\", \"limit\": 200, \"agent\": _agent()}\n            if after:\n                params[\"after\"] = after\n            page = _request(\"GET\", f\"/api/agents/v1/state?{urllib.parse.urlencode(params)}\")\n            for row in page[\"keys\"]:\n                if \"value\" in row:\n                    row[\"value\"] = json.loads(row[\"value\"])\n            keys.extend(page[\"keys\"])\n            after = page.get(\"next\")\n            if not after:\n                return keys\n\n    def update(self, key: str, fn, default: Any = None, retries: int = 10) -> Any:\n        \"\"\"Read-modify-write that's safe with runs in parallel: fn(old) -> new,\n        retried if another run wrote first. Returns the new value.\"\"\"\n        for _ in range(retries):\n            value, version = self.get_versioned(key)\n            new = fn(default if value is None else value)\n            try:\n                self.set(key, new, if_version=version)\n                return new\n            except StateConflict:\n                time.sleep(0.05)\n        raise StateConflict(key, -1)\n\n    def _write(self, key: str, value: Any, if_version: \"int | None\", ttl: \"float | None\") -> int:\n        if _STATE_PATH:\n            data = _local_state()\n            current = data.get(key, {}).get(\"version\", 0)\n            if if_version is not None and if_version != current:\n                raise StateConflict(key, current)\n            if value is None:\n                data.pop(key, None)\n            else:\n                data[key] = {\"value\": value, \"version\": current + 1}\n            with open(_STATE_PATH, \"w\") as f:\n                json.dump(data, f, indent=2)\n            return 0 if value is None else current + 1\n        body: dict = {\"key\": key, \"value\": value, \"agent\": _agent()}\n        if if_version is not None:\n            body[\"ifVersion\"] = if_version\n        if ttl:\n            body[\"ttlSec\"] = int(ttl)\n        res = _request(\"POST\", \"/api/agents/v1/state\", body, ok=(409,))\n        if res.get(\"_status\") == 409:\n            raise StateConflict(key, int(res.get(\"version\", 0)))\n        return int(res.get(\"version\", 0))\n\n\ndef _agent() -> str:\n    # Inside a run the run token picks the agent; a CLI token needs it named.\n    return os.environ.get(\"CODIEDEV_AGENT\", \"\")\n\n\ndef _local_state() -> dict:\n    try:\n        with open(_STATE_PATH or \"\") as f:\n            return json.load(f)\n    except (FileNotFoundError, ValueError):\n        return {}\n\n\nstate = _State()\n\n\ndef step(name: str, fn, ttl: float = 7 * 86400) -> Any:\n    \"\"\"Run fn() once for this run and remember its (JSON) result: if the run\n    is retried after a failure, finished steps return their saved result\n    instead of running again. Use it around side effects (posting a reply,\n    charging a card) so a retry doesn't repeat them.\"\"\"\n    key = f\"step/{os.environ.get('CODIEDEV_RUN_ID', 'local')}/{name}\"\n    value, version = state.get_versioned(key)\n    if version:\n        return value[\"result\"]\n    result = fn()\n    state.set(key, {\"result\": result}, ttl=ttl)\n    return result\n\n\n_SELF = object()\n\n\ndef request_approval(\n    title: str,\n    details: Any = None,\n    options: \"list[str] | None\" = None,\n    approvers: \"list[str] | None\" = None,\n    teams: \"list[str] | None\" = None,\n    fields: \"list[dict] | None\" = None,\n    then: Any = _SELF,\n    context: Any = None,\n    expires_in: \"float | None\" = None,\n) -> dict:\n    \"\"\"Ask a person to decide. It shows in Codiedev (Agents → Approvals) and\n    at the returned [\"url\"], which you can post anywhere (Slack, email).\n\n    When it's decided, a run of `then` (this agent by default; None for no\n    run) starts with input {\"approval\": {\"decision\", \"comment\", \"decidedBy\",\n    ...}, \"context\": context}. If nobody decides within expires_in seconds\n    (default 7 days), it starts with decision \"expired\". Usually the run\n    ends after asking, so nothing runs (or costs) while it waits.\n    options default to [\"approve\", \"reject\"]; approvers (emails) and teams\n    (team names, e.g. [\"Finance\"]) limit who can decide (admins always can).\n    Apps your company connects (Agents → Approvals → Apps) are told about it\n    by webhook and can decide on a person's behalf.\n\n    fields asks the person to fill something in as they decide, e.g.\n    [{\"name\": \"rating\", \"type\": \"rating\"}, {\"name\": \"why\", \"type\": \"textarea\"}]\n    (types: text, textarea, number, rating, select, multiselect, boolean;\n    required, label, help, options, min, max, default). What they entered\n    arrives as input[\"approval\"][\"values\"]. With fields and no options, the\n    only choice is \"submit\".\"\"\"\n    body: dict = {\"title\": title, \"details\": details, \"options\": options, \"approvers\": approvers, \"teams\": teams, \"fields\": fields, \"context\": context}\n    if then is not _SELF:\n        body[\"onDecision\"] = then\n    if expires_in:\n        body[\"expiresSec\"] = int(expires_in)\n    if os.environ.get(\"CODIEDEV_LOCAL\") == \"1\":\n        print(f\"[local] approval requested: {title} ({', '.join(options or (['submit'] if fields else ['approve', 'reject']))}); not sent on a local run\", flush=True)\n        return {\"id\": f\"local-{int(time.time())}\", \"status\": \"pending\", \"url\": None, \"title\": title}\n    return _request(\"POST\", \"/api/agents/v1/approvals\", {k: v for k, v in body.items() if v is not None or k == \"onDecision\"})\n\n\ndef get_approval(approval_id: str) -> dict:\n    \"\"\"An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment.\"\"\"\n    return _request(\"GET\", f\"/api/agents/v1/approvals?id={urllib.parse.quote(approval_id)}\")\n\n\ndef wait_for_approval(approval_id: str, timeout: float = 3600, poll: float = 15) -> dict:\n    \"\"\"Wait until a person decides (or it expires), then return the approval. For agents that keep\n    running while they wait, like a connected agent; a run inside Codiedev usually ends instead and\n    is started again with the decision.\"\"\"\n    deadline = time.time() + timeout\n    while True:\n        a = get_approval(approval_id)\n        if a.get(\"status\") != \"pending\":\n            return a\n        if time.time() > deadline:\n            raise TimeoutError(f\"approval {approval_id} still pending after {timeout}s\")\n        time.sleep(poll)\n\n\ndef openai(**kwargs):\n    \"\"\"An OpenAI client on the Codiedev gateway, with trace headers for this run.\"\"\"\n    from openai import OpenAI\n\n    headers = {\n        \"X-Codiedev-Workload\": os.environ.get(\"CODIEDEV_AGENT\", \"local-agent\"),\n        \"X-Codiedev-Run-Id\": os.environ.get(\"CODIEDEV_RUN_ID\", f\"local-{int(time.time())}\"),\n        \"X-Codiedev-Environment\": \"production\" if os.environ.get(\"CODIEDEV_RUN_ID\") else \"development\",\n    }\n    headers.update(kwargs.pop(\"default_headers\", {}) or {})\n    return OpenAI(\n        base_url=os.environ.get(\"CODIEDEV_GATEWAY_URL\", \"https://gateway.codiedev.com/api/v1\"),\n        api_key=os.environ.get(\"CODIEDEV_API_KEY\") or os.environ.get(\"CODIEDEV_TOKEN\"),\n        default_headers=headers,\n        **kwargs,\n    )\n";
+exports.jsIndex = "// Codiedev agents SDK for JavaScript and TypeScript, preinstalled in every\n// run. Same primitive as the Python SDK (codiedev_agents.py):\n//\n//   import * as agents from \"codiedev-agents\";\n//   const task = agents.input();                    // this run's input (JSON)\n//   const llm = await agents.openai();              // OpenAI client on the Codiedev gateway, traced\n//   const child = await agents.run(\"summarize\", { text });  // another agent, as a child run\n//   agents.output({ summary: child.output });       // this run's result\n//   agents.respond({ text: \"on it\" });              // what a webhook caller waiting (?wait=) gets back\n//   await agents.state.get(\"cursor\");               // per-agent storage that outlives runs\n//   await agents.step(\"post\", () => post());        // done once per run, even across retries\n//   await agents.start(\"triage\", input, { delaySec: 3600 });  // start a run later\n//   await agents.requestApproval(\"Refund $120?\", { context });  // a person decides; a run acts on it\n//\n// Outside a run, set CODIEDEV_TOKEN and CODIEDEV_AGENTS_URL and call run() the same way.\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst INPUT_PATH = process.env.CODIEDEV_INPUT_PATH || \"/agent/.codiedev/input.json\";\nconst OUTPUT_PATH = process.env.CODIEDEV_OUTPUT_PATH || \"/agent/.codiedev/output.json\";\nconst REQUEST_PATH = process.env.CODIEDEV_REQUEST_PATH || \"/agent/.codiedev/request.json\";\nconst RESPONSE_PATH = process.env.CODIEDEV_RESPONSE_PATH || \"/agent/.codiedev/response.json\";\n// Set by `codiedev agents run --local`: state lives in this file instead of Codiedev.\nconst STATE_PATH = process.env.CODIEDEV_STATE_PATH;\n// Inside a run the run token picks the agent; a CLI token needs it named.\nconst AGENT = process.env.CODIEDEV_AGENT || \"\";\nconst DONE = new Set([\"succeeded\", \"failed\", \"cancelled\"]);\n\n/** state.set(..., { ifVersion }) found the key at another version. */\nexport class StateConflict extends Error {\n  constructor(key, version) {\n    super(`state ${JSON.stringify(key)} changed (now version ${version})`);\n    this.key = key;\n    this.version = version;\n  }\n}\n\nexport class AgentRunError extends Error {\n  constructor(run) {\n    super(`${run.agent} run ${run.id} ${run.status}: ${run.error || \"no error message\"}`);\n    this.run = run;\n  }\n}\n\nfunction readJson(file) {\n  try {\n    return JSON.parse(fs.readFileSync(file, \"utf8\"));\n  } catch (err) {\n    if (err.code === \"ENOENT\") return null;\n    throw err;\n  }\n}\n\n/** This run's input, parsed from JSON (`fallback` when started without one). */\nexport function input(fallback = null) {\n  const value = readJson(INPUT_PATH);\n  return value ?? fallback;\n}\n\n/** Set this run's result. Must be JSON-serializable; the last call wins. */\nexport function output(value) {\n  fs.mkdirSync(path.dirname(OUTPUT_PATH), { recursive: true });\n  fs.writeFileSync(OUTPUT_PATH, JSON.stringify(value));\n}\n\n/** What a webhook caller gets back when it waits for the run (?wait=N): a\n *  string is sent as text, anything else as JSON. Without it, a waiting\n *  caller gets the run's output. */\nexport function respond(body = null, { status = 200, headers = {} } = {}) {\n  fs.mkdirSync(path.dirname(RESPONSE_PATH), { recursive: true });\n  fs.writeFileSync(RESPONSE_PATH, JSON.stringify({ status, headers, body }));\n}\n\n/** This run's attempt: 1, or 2+ when it's a retry of a failed attempt. */\nexport function attempt() {\n  return Number(process.env.CODIEDEV_ATTEMPT || \"1\");\n}\n\n/** For a webhook run: { method, query, headers, body } with the raw body, to verify a signature. */\nexport function request() {\n  return readJson(REQUEST_PATH);\n}\n\nfunction base() {\n  const url = (process.env.CODIEDEV_AGENTS_URL || \"\").replace(/\\/$/, \"\");\n  if (!url) throw new Error(\"Set CODIEDEV_AGENTS_URL (it's set for you inside a run)\");\n  return url;\n}\n\nfunction token() {\n  // Inside a run: the run's token. A connected agent (running outside Codiedev): its own key.\n  // Otherwise: your CLI token.\n  const key = process.env.CODIEDEV_API_KEY || \"\";\n  const t = process.env.CODIEDEV_RUN_TOKEN || (key.startsWith(\"cdvm_\") ? key : \"\") || process.env.CODIEDEV_TOKEN;\n  if (!t) throw new Error(\"Set CODIEDEV_API_KEY to your connected agent's key, or CODIEDEV_TOKEN to your CLI token (inside a run it's set for you)\");\n  return t;\n}\n\nasync function call(method, route, body, ok = []) {\n  const res = await fetch(`${base()}${route}`, {\n    method,\n    headers: { Authorization: `Bearer ${token()}`, \"Content-Type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const text = await res.text();\n  let data = {};\n  try {\n    data = text ? JSON.parse(text) : {};\n  } catch {\n    data = { error: text };\n  }\n  if (ok.includes(res.status)) return { _status: res.status, ...data };\n  if (!res.ok) throw new Error(`Codiedev agents API ${res.status}: ${data.error || text}`);\n  return data;\n}\n\n/** Start a run and return its id without waiting. delaySec (up to 7 days)\n *  starts it later; retries overrides the agent's retries. */\nexport async function start(agent, input = null, { idempotencyKey, delaySec, retries } = {}) {\n  return (await call(\"POST\", \"/api/agents/v1/run\", {\n    agent,\n    input,\n    ...(idempotencyKey ? { idempotencyKey } : {}),\n    ...(delaySec ? { delaySec } : {}),\n    ...(retries !== undefined ? { retries } : {}),\n  })).runId;\n}\n\nfunction localState() {\n  try {\n    return JSON.parse(fs.readFileSync(STATE_PATH, \"utf8\"));\n  } catch {\n    return {};\n  }\n}\n\nasync function writeState(key, value, { ifVersion, ttlSec } = {}) {\n  if (STATE_PATH) {\n    const data = localState();\n    const current = data[key]?.version ?? 0;\n    if (ifVersion !== undefined && ifVersion !== current) throw new StateConflict(key, current);\n    if (value === null) delete data[key];\n    else data[key] = { value, version: current + 1 };\n    fs.writeFileSync(STATE_PATH, JSON.stringify(data, null, 2));\n    return value === null ? 0 : current + 1;\n  }\n  const res = await call(\"POST\", \"/api/agents/v1/state\", { key, value, agent: AGENT, ...(ifVersion !== undefined ? { ifVersion } : {}), ...(ttlSec ? { ttlSec } : {}) }, [409]);\n  if (res._status === 409) throw new StateConflict(key, res.version ?? 0);\n  return res.version ?? 0;\n}\n\n/** Per-agent key-value storage that outlives runs (values: any JSON, up to\n *  64 KB; 1,000 keys). Every write bumps the key's version; pass ifVersion\n *  to write only if nobody else did since you read it. */\nexport const state = {\n  async get(key, fallback = null) {\n    const { value } = await state.getVersioned(key);\n    return value ?? fallback;\n  },\n  /** { value, version }; { value: null, version: 0 } when the key isn't set. */\n  async getVersioned(key) {\n    if (STATE_PATH) {\n      const row = localState()[key];\n      return row ? { value: row.value, version: row.version } : { value: null, version: 0 };\n    }\n    const res = await call(\"GET\", `/api/agents/v1/state?${new URLSearchParams({ key, agent: AGENT })}`, undefined, [404]);\n    if (res._status === 404) return { value: null, version: 0 };\n    return { value: JSON.parse(res.value), version: res.version };\n  },\n  /** Store value; returns the new version. Throws StateConflict on an ifVersion mismatch (0 = unset). */\n  set(key, value, { ifVersion, ttlSec } = {}) {\n    return writeState(key, value, { ifVersion, ttlSec });\n  },\n  async delete(key, { ifVersion } = {}) {\n    await writeState(key, null, { ifVersion });\n  },\n  /** Keys (and with values: true, values) starting with prefix. */\n  async list(prefix = \"\", { values = false } = {}) {\n    if (STATE_PATH) {\n      return Object.entries(localState())\n        .filter(([k]) => k.startsWith(prefix))\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([key, row]) => ({ key, version: row.version, ...(values ? { value: row.value } : {}) }));\n    }\n    const out = [];\n    let after = null;\n    do {\n      const q = new URLSearchParams({ prefix, values: values ? \"1\" : \"0\", limit: \"200\", agent: AGENT, ...(after ? { after } : {}) });\n      const page = await call(\"GET\", `/api/agents/v1/state?${q}`);\n      out.push(...page.keys.map((row) => (\"value\" in row ? { ...row, value: JSON.parse(row.value) } : row)));\n      after = page.next;\n    } while (after);\n    return out;\n  },\n  /** Read-modify-write that's safe with runs in parallel: fn(old) => new, retried if another run wrote first. */\n  async update(key, fn, fallback = null, retries = 10) {\n    for (let i = 0; i < retries; i++) {\n      const { value, version } = await state.getVersioned(key);\n      const next = await fn(value ?? fallback);\n      try {\n        await state.set(key, next, { ifVersion: version });\n        return next;\n      } catch (err) {\n        if (!(err instanceof StateConflict)) throw err;\n        await new Promise((resolve) => setTimeout(resolve, 50));\n      }\n    }\n    throw new StateConflict(key, -1);\n  },\n};\n\n/** Run fn() once for this run and remember its (JSON) result: if the run is\n *  retried after a failure, finished steps return their saved result instead\n *  of running again. Use it around side effects so a retry doesn't repeat them. */\nexport async function step(name, fn, { ttlSec = 7 * 86400 } = {}) {\n  const key = `step/${process.env.CODIEDEV_RUN_ID || \"local\"}/${name}`;\n  const { value, version } = await state.getVersioned(key);\n  if (version) return value.result;\n  const result = await fn();\n  await state.set(key, { result: result ?? null }, { ttlSec });\n  return result;\n}\n\n/** Ask a person to decide. It shows in Codiedev (Agents → Approvals) and at\n *  the returned .url, which you can post anywhere. When it's decided, a run of\n *  `then` (this agent by default; null for none) starts with input\n *  { approval: { decision, comment, decidedBy, ... }, context }. Undecided\n *  after expiresSec (default 7 days): decision \"expired\". */\nexport async function requestApproval(title, { details, options, approvers, teams, fields, then, context, expiresSec } = {}) {\n  if (process.env.CODIEDEV_LOCAL === \"1\") {\n    console.log(`[local] approval requested: ${title} (${(options || (fields ? [\"submit\"] : [\"approve\", \"reject\"])).join(\", \")}); not sent on a local run`);\n    return { id: `local-${Date.now()}`, status: \"pending\", url: null, title };\n  }\n  return call(\"POST\", \"/api/agents/v1/approvals\", {\n    title,\n    ...(details !== undefined ? { details } : {}),\n    ...(options ? { options } : {}),\n    ...(approvers ? { approvers } : {}),\n    ...(teams ? { teams } : {}),\n    ...(fields ? { fields } : {}),\n    ...(then !== undefined ? { onDecision: then } : {}),\n    ...(context !== undefined ? { context } : {}),\n    ...(expiresSec ? { expiresSec } : {}),\n  });\n}\n\n/** An approval's status (\"pending\", \"decided\", \"expired\"), decision and comment. */\nexport async function getApproval(id) {\n  return call(\"GET\", `/api/agents/v1/approvals?id=${encodeURIComponent(id)}`);\n}\n\n/** Wait until a person decides (or it expires), then return the approval. For agents that keep\n *  running while they wait, like a connected agent; a run inside Codiedev usually ends instead and\n *  is started again with the decision. */\nexport async function waitForApproval(id, { timeoutMs = 3_600_000, pollMs = 15_000 } = {}) {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const a = await getApproval(id);\n    if (a.status !== \"pending\") return a;\n    if (Date.now() > deadline) throw new Error(`approval ${id} still pending after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** A run's status, input, output (parsed), error, log and children. */\nexport async function get(runId) {\n  const run = await call(\"GET\", `/api/agents/v1/run?id=${encodeURIComponent(runId)}`);\n  if (typeof run.output === \"string\") {\n    try {\n      run.output = JSON.parse(run.output);\n    } catch {\n      // not JSON: keep the string\n    }\n  }\n  return run;\n}\n\n/** Run an agent and wait for it; its result is `.output`. Inside a run this\n *  starts a child run. Throws AgentRunError if it fails unless check is false. */\nexport async function run(agent, input = null, { timeoutMs = 900_000, pollMs = 2000, check = true, idempotencyKey } = {}) {\n  const id = await start(agent, input, { idempotencyKey });\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const r = await get(id);\n    if (DONE.has(r.status)) {\n      if (check && r.status !== \"succeeded\") throw new AgentRunError(r);\n      return r;\n    }\n    if (Date.now() > deadline) throw new Error(`${agent} run ${id} still ${r.status} after ${timeoutMs / 1000}s`);\n    await new Promise((resolve) => setTimeout(resolve, pollMs));\n  }\n}\n\n/** Options for `new OpenAI(...)` on the Codiedev gateway, with this run's trace headers. */\nexport function openaiOptions(extra = {}) {\n  const inRun = !!process.env.CODIEDEV_RUN_ID;\n  return {\n    baseURL: process.env.CODIEDEV_GATEWAY_URL || \"https://gateway.codiedev.com/api/v1\",\n    apiKey: process.env.CODIEDEV_API_KEY || process.env.CODIEDEV_TOKEN,\n    ...extra,\n    defaultHeaders: {\n      \"X-Codiedev-Workload\": process.env.CODIEDEV_AGENT || \"local-agent\",\n      \"X-Codiedev-Run-Id\": process.env.CODIEDEV_RUN_ID || `local-${Date.now()}`,\n      \"X-Codiedev-Environment\": inRun ? \"production\" : \"development\",\n      ...(extra.defaultHeaders || {}),\n    },\n  };\n}\n\n/** An OpenAI client on the Codiedev gateway (the `openai` package is preinstalled). */\nexport async function openai(extra = {}) {\n  const { default: OpenAI } = await import(\"openai\");\n  return new OpenAI(openaiOptions(extra));\n}\n";
+exports.jsTypes = "/* eslint-disable @typescript-eslint/no-explicit-any -- defaults are `any` on purpose: agent code reads its own JSON input/state without declaring types first. */\nexport type RunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\";\nexport interface Run<O = unknown> {\n  id: string;\n  agent: string;\n  version: number;\n  status: RunStatus;\n  trigger: \"cli\" | \"api\" | \"portal\" | \"schedule\" | \"webhook\" | \"child\" | \"approval\";\n  parentRunId: string | null;\n  rootRunId: string | null;\n  depth: number;\n  attempt: number;\n  maxAttempts: number;\n  scheduledFor: number | null;\n  input: string | null;\n  output: O;\n  error: string | null;\n  logTail: string | null;\n  durationMs: number | null;\n  children: Run[];\n}\nexport interface WebhookRequest { method: string; query: Record<string, string>; headers: Record<string, string>; body: string }\nexport interface Approval {\n  id: string;\n  agent: string;\n  title: string;\n  details: string | null;\n  options: string[];\n  status: \"pending\" | \"decided\" | \"expired\" | \"cancelled\";\n  decision: string | null;\n  comment: string | null;\n  decidedBy: string | null;\n  /** The approval app that sent the decision on decidedBy's behalf; null when decided in Codiedev. */\n  decidedVia: string | null;\n  approvers: string[];\n  approverTeams: Array<{ id: string; name: string }>;\n  /** The form the person fills in, if the approval asked for one. */\n  fields: ApprovalField[];\n  /** What they entered, by field name (null until decided). */\n  values: Record<string, any> | null;\n  url: string | null;\n  resumeRunId: string | null;\n}\n/** One thing a person fills in when they decide. */\nexport interface ApprovalField {\n  name: string;\n  type: \"text\" | \"textarea\" | \"number\" | \"rating\" | \"select\" | \"multiselect\" | \"boolean\";\n  label?: string;\n  help?: string;\n  required?: boolean;\n  /** select / multiselect choices */\n  options?: string[];\n  /** number bounds; rating scale 1–max (default 5) */\n  min?: number;\n  max?: number;\n  /** prefilled, e.g. a proposed amount for the person to correct */\n  default?: unknown;\n}\n/** The input a run started by a decision gets. */\nexport interface ApprovalInput<C = any, V = Record<string, any>> {\n  approval: { id: string; title: string; decision: string; comment: string | null; values: V; decidedBy: string | null; decidedVia: string | null; decidedAt: number; requestedByRun: string | null };\n  context: C;\n}\nexport class AgentRunError extends Error { run: Run }\nexport class StateConflict extends Error { key: string; version: number }\nexport function input<T = any>(fallback?: T): T;\nexport function output(value: unknown): void;\nexport function request(): WebhookRequest | null;\nexport function respond(body?: unknown, opts?: { status?: number; headers?: Record<string, string> }): void;\nexport function attempt(): number;\nexport function start(agent: string, input?: unknown, opts?: { idempotencyKey?: string; delaySec?: number; retries?: number }): Promise<string>;\nexport function get<O = any>(runId: string): Promise<Run<O>>;\nexport function run<O = any>(agent: string, input?: unknown, opts?: { timeoutMs?: number; pollMs?: number; check?: boolean; idempotencyKey?: string }): Promise<Run<O>>;\nexport const state: {\n  get<T = any>(key: string, fallback?: T): Promise<T>;\n  getVersioned<T = any>(key: string): Promise<{ value: T | null; version: number }>;\n  set(key: string, value: unknown, opts?: { ifVersion?: number; ttlSec?: number }): Promise<number>;\n  delete(key: string, opts?: { ifVersion?: number }): Promise<void>;\n  list(prefix?: string, opts?: { values?: boolean }): Promise<Array<{ key: string; version: number; value?: any }>>;\n  update<T = any>(key: string, fn: (old: T) => T | Promise<T>, fallback?: T, retries?: number): Promise<T>;\n};\nexport function step<T>(name: string, fn: () => T | Promise<T>, opts?: { ttlSec?: number }): Promise<T>;\nexport function requestApproval<C = any>(title: string, opts?: { details?: unknown; options?: string[]; approvers?: string[]; teams?: string[]; fields?: ApprovalField[]; then?: string | null; context?: C; expiresSec?: number }): Promise<Approval>;\nexport function getApproval(id: string): Promise<Approval>;\nexport function waitForApproval(id: string, opts?: { timeoutMs?: number; pollMs?: number }): Promise<Approval>;\nexport function openaiOptions(extra?: Record<string, unknown>): { baseURL: string; apiKey: string | undefined; defaultHeaders: Record<string, string> };\nexport function openai(extra?: Record<string, unknown>): Promise<import(\"openai\").default>;";
+exports.jsPackage = "{\n  \"name\": \"codiedev-agents\",\n  \"version\": \"0.1.0\",\n  \"description\": \"Codiedev agents SDK: this run's input and output, chaining, and a traced OpenAI client.\",\n  \"type\": \"module\",\n  \"main\": \"./index.mjs\",\n  \"types\": \"./index.d.ts\",\n  \"exports\": { \".\": { \"types\": \"./index.d.ts\", \"default\": \"./index.mjs\" } }\n}\n";

package/dist/commands/scrub.d.ts

@@ -0,0 +1,11 @@
+import { type RunSummary } from "../localScrub";
+export declare const SCRUB_HELP = "codiedev scrub \u2014 remove keys from past agent sessions on this machine\n\nUsage:\n  codiedev scrub [--dry-run] [--path <file>]... [--session <id>]... [--min-age <minutes>]\n\nCleans the session files Claude Code, Codex, Cursor, Copilot, OpenCode/Codie\nand pi keep locally, using the same rules as the Codiedev server. Each key is\nreplaced with [REDACTED:<kind>]. Sessions changed in the last hour are skipped\nso open sessions are never touched. When signed in, what was found (session,\nkey type and last 4, removed or not) shows on your Security page; the keys\nthemselves never leave this machine.\n\n  --dry-run          Count what would be cleaned; change nothing\n  --path <file>      Only this file (repeatable)\n  --session <id>     With --path <opencode.db>: only this OpenCode/Codie session\n  --min-age <min>    Skip files changed in the last <min> minutes (default 60)\n\nThe hourly background run can also remove your own secrets (values from\nyour credential files and .env files) if your admin allows it. It reads\n~/.aws/credentials, ~/.npmrc, ~/.pypirc, ~/.netrc, ~/.git-credentials,\n~/.config/gh/hosts.yml, ~/.docker/config.json, ~/.config/hub,\n~/.gem/credentials, ~/.config/openai/credentials, and .env / .env.* in the\nrepos your sessions start in. Values stay on this machine; only if your admin\nchose to check uploaded sessions too is a keyed fingerprint of each sent.\n";
+export declare function parseScrubArgs(args: string[]): {
+    dryRun: boolean;
+    only?: string[];
+    onlySessions?: string[];
+    minAgeMs: number;
+    help: boolean;
+};
+export declare function formatScrubSummary(s: RunSummary): string;
+export declare function runScrubCommand(args: string[]): Promise<number>;

package/dist/commands/scrub.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCRUB_HELP = void 0;
+exports.parseScrubArgs = parseScrubArgs;
+exports.formatScrubSummary = formatScrubSummary;
+exports.runScrubCommand = runScrubCommand;
+// `codiedev scrub`: run the local session scrub now, in the foreground.
+// The same scrub runs on its own in the background from session-start hooks
+// (hourly); this is for checking it or forcing a pass.
+const localScrub_1 = require("../localScrub");
+exports.SCRUB_HELP = `codiedev scrub — remove keys from past agent sessions on this machine
+
+Usage:
+  codiedev scrub [--dry-run] [--path <file>]... [--session <id>]... [--min-age <minutes>]
+
+Cleans the session files Claude Code, Codex, Cursor, Copilot, OpenCode/Codie
+and pi keep locally, using the same rules as the Codiedev server. Each key is
+replaced with [REDACTED:<kind>]. Sessions changed in the last hour are skipped
+so open sessions are never touched. When signed in, what was found (session,
+key type and last 4, removed or not) shows on your Security page; the keys
+themselves never leave this machine.
+
+  --dry-run          Count what would be cleaned; change nothing
+  --path <file>      Only this file (repeatable)
+  --session <id>     With --path <opencode.db>: only this OpenCode/Codie session
+  --min-age <min>    Skip files changed in the last <min> minutes (default 60)
+
+The hourly background run can also remove your own secrets (values from
+your credential files and .env files) if your admin allows it. It reads
+~/.aws/credentials, ~/.npmrc, ~/.pypirc, ~/.netrc, ~/.git-credentials,
+~/.config/gh/hosts.yml, ~/.docker/config.json, ~/.config/hub,
+~/.gem/credentials, ~/.config/openai/credentials, and .env / .env.* in the
+repos your sessions start in. Values stay on this machine; only if your admin
+chose to check uploaded sessions too is a keyed fingerprint of each sent.
+`;
+function parseScrubArgs(args) {
+    let dryRun = false;
+    let help = false;
+    const only = [];
+    const sessions = [];
+    let minAgeMs = localScrub_1.MIN_AGE_MS;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--dry-run")
+            dryRun = true;
+        else if (a === "--help" || a === "-h")
+            help = true;
+        else if (a === "--path" && args[i + 1])
+            only.push(args[++i]);
+        else if (a === "--session" && args[i + 1])
+            sessions.push(args[++i]);
+        else if (a === "--min-age" && args[i + 1]) {
+            const m = Number(args[++i]);
+            if (Number.isFinite(m) && m >= 0)
+                minAgeMs = m * 60_000;
+        }
+    }
+    return { dryRun, help, minAgeMs, ...(only.length ? { only } : {}), ...(sessions.length ? { onlySessions: sessions } : {}) };
+}
+function formatScrubSummary(s) {
+    const lines = [];
+    const verb = s.dryRun ? "Would remove" : "Removed";
+    lines.push(s.redactions === 0
+        ? `No keys found in ${s.scanned} session file${s.scanned === 1 ? "" : "s"} checked.`
+        : `${verb} ${s.redactions} key${s.redactions === 1 ? "" : "s"}${s.dryRun ? "" : ` from ${s.cleaned} file${s.cleaned === 1 ? "" : "s"}`} (${s.scanned} checked).`);
+    for (const [h, t] of Object.entries(s.byHarness))
+        lines.push(`  ${h}: ${t.redactions} in ${t.files} file${t.files === 1 ? "" : "s"}`);
+    if (s.skippedRecent)
+        lines.push(`Skipped ${s.skippedRecent} changed in the last hour (may be open).`);
+    if (s.skippedLarge)
+        lines.push(`Skipped ${s.skippedLarge} over 100 MB.`);
+    if (s.changedWhileCleaning)
+        lines.push(`Left ${s.changedWhileCleaning} alone: changed while cleaning.`);
+    if (s.errors)
+        lines.push(`${s.errors} couldn't be read or written.`);
+    if (s.unfinished)
+        lines.push("Stopped at the time limit; the next run continues.");
+    if (s.leftInCursor.keys > 0) {
+        const { keys, chats } = s.leftInCursor;
+        lines.push(`${keys} key${keys === 1 ? " is" : "s are"} still in ${chats} Cursor chat${chats === 1 ? "" : "s"}. ` +
+            "Cursor's own chat store can't be cleaned without breaking the chat; delete those chats in Cursor to remove them.");
+    }
+    return lines.join("\n");
+}
+async function runScrubCommand(args) {
+    const opts = parseScrubArgs(args);
+    if (opts.help) {
+        console.log(exports.SCRUB_HELP);
+        return 0;
+    }
+    const summary = await (0, localScrub_1.runAndReport)({
+        dryRun: opts.dryRun,
+        only: opts.only,
+        onlySessions: opts.onlySessions,
+        minAgeMs: opts.minAgeMs,
+        budgetMs: 10 * 60_000,
+    });
+    console.log(formatScrubSummary(summary));
+    if (summary.reported)
+        console.log("Sent to your Security page in Codiedev (key type and last 4 only, never the key).");
+    return summary.errors > 0 ? 1 : 0;
+}

package/dist/configDir.d.ts

@@ -1 +1,10 @@
+/**
+ * The user's home, always absolute. $HOME can arrive relative or unexpanded ("~", ".", "") from a
+ * sandboxed shell or a wrapper; trusting it once wrote hook commands like ".codiedev/bin/…" into
+ * ~/.claude/settings.json, which only resolve when Claude Code starts in the home folder, so
+ * capture silently failed in every project. Fall back to the account's home from the OS.
+ */
+export declare function realHome(): string;
+/** $HOME when it's a real absolute path, else the OS account's home, else resolved against cwd. */
+export declare function pickHome(fromEnv: string | undefined, fromOs: string | undefined): string;
 export declare function codiedevStateDir(): string;

package/dist/configDir.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.realHome = realHome;
+exports.pickHome = pickHome;
 exports.codiedevStateDir = codiedevStateDir;
 // Single source of truth for where the CLI's config/state lives on disk.
 //
@@ -46,9 +48,31 @@ exports.codiedevStateDir = codiedevStateDir;
 // without creating a circular import.
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+/**
+ * The user's home, always absolute. $HOME can arrive relative or unexpanded ("~", ".", "") from a
+ * sandboxed shell or a wrapper; trusting it once wrote hook commands like ".codiedev/bin/…" into
+ * ~/.claude/settings.json, which only resolve when Claude Code starts in the home folder, so
+ * capture silently failed in every project. Fall back to the account's home from the OS.
+ */
+function realHome() {
+    let fromOs;
+    try {
+        fromOs = os.userInfo().homedir;
+    }
+    catch { /* no passwd entry */ }
+    return pickHome(os.homedir(), fromOs);
+}
+/** $HOME when it's a real absolute path, else the OS account's home, else resolved against cwd. */
+function pickHome(fromEnv, fromOs) {
+    if (fromEnv && path.isAbsolute(fromEnv) && !fromEnv.split(path.sep).includes("~"))
+        return fromEnv;
+    if (fromOs && path.isAbsolute(fromOs))
+        return fromOs;
+    return path.resolve(fromEnv || ".");
+}
 const CONFIG_DIR = process.env.CODIEDEV_CONFIG_DIR?.trim()
     ? path.resolve(process.env.CODIEDEV_CONFIG_DIR.trim())
-    : path.join(os.homedir(), ".codiedev");
+    : path.join(realHome(), ".codiedev");
 function codiedevStateDir() {
     return CONFIG_DIR;
 }

package/dist/connect.js

@@ -41,6 +41,7 @@ const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const cliSession_1 = require("./cliSession");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
@@ -60,6 +61,16 @@ const BACKEND_URL = process.env.CODIEDEV_URL || "https://cli.codiedev.com";
  * input in CI). Without a TTY there's no echo to suppress anyway, and
  * raw mode would error.
  */
+/** One visible line from the terminal (for yes/no questions). */
+function prompt(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
 function promptHidden(question) {
     return new Promise((resolve) => {
         const stdin = process.stdin;
@@ -168,16 +179,47 @@ async function runConnect(args = []) {
     // mint a fresh token from the portal — which is what bit Sonifi's first
     // engineer when he interpreted "no visible token" as "the old one is gone".
     const force = args.includes("--force") || args.includes("-f");
+    // `--token`: paste an API token instead of signing in (CI). Otherwise sign
+    // in with the browser: a loopback redirect on a desktop, a device code
+    // (approve on any device) over SSH or with no display, detected
+    // automatically. `--no-browser` / `--browser` force one or the other.
+    const pasteToken = args.includes("--token");
+    const useDevice = args.includes("--no-browser") || (!args.includes("--browser") && (0, cliSession_1.isHeadless)());
     console.log("\nWelcome to Codiedev CLI\n");
     await (0, upgradeNudge_1.maybePrintUpgradeNudge)();
     console.log("This will connect your coding agent to your Codiedev workspace and install");
     console.log("the session capture hook for org-wide session sharing.\n");
+    // A saved browser sign-in is reused only if it still works: refresh it
+    // first (a revoked one comes back signed out, with an empty token).
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
     const saved = (0, utils_1.readConfig)();
-    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force });
+    const decision = (0, connectFlow_1.resolveConnectToken)({ savedConfig: saved, force: force || pasteToken });
     let token;
+    let auth;
     if (decision.source === "reused") {
         token = decision.token;
-        console.log(`Reusing API token from ~/.codiedev/config.json (run with --force to use a new one).\n`);
+        auth = saved?.auth;
+        console.log(auth
+            ? `Reusing your browser sign-in from ~/.codiedev/config.json (run with --force to sign in again).\n`
+            : `Reusing API token from ~/.codiedev/config.json (run with --force to sign in again).\n`);
+    }
+    else if (!pasteToken) {
+        // Replacing a browser sign-in: end the old one so the portal doesn't
+        // keep listing it.
+        if (saved?.auth)
+            await (0, cliSession_1.logout)({ configPath: utils_1.CONFIG_PATH }).catch(() => undefined);
+        const result = await (0, connectFlow_1.signInWithTokenFallback)({
+            signIn: () => useDevice ? (0, cliSession_1.deviceLogin)({ backendUrl: BACKEND_URL }) : (0, cliSession_1.browserLogin)({ backendUrl: BACKEND_URL }),
+            interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+            askYesNo: async (q) => /^y(es)?$/i.test((await prompt(q)).trim()),
+            askToken: promptHidden,
+            log: (line) => console.log(line),
+            error: (line) => console.error(line),
+        });
+        if (!result)
+            process.exit(1);
+        token = result.token;
+        auth = result.auth;
     }
     else {
         // Hidden prompt — masks the token with `*` as it's typed/pasted so it
@@ -217,6 +259,7 @@ async function runConnect(args = []) {
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
+        ...(auth ? { auth } : {}),
     };
     try {
         (0, utils_1.writeConfig)(config);

package/dist/connectFlow.d.ts

@@ -11,3 +11,24 @@ export type ConnectTokenResult = {
     source: "prompt-required";
 };
 export declare function resolveConnectToken(input: ConnectTokenInput): ConnectTokenResult;
+export interface SignInResult {
+    token: string;
+    auth?: import("./cliSession").BrowserAuth;
+}
+export interface SignInDeps {
+    /** Browser (loopback) or device-code sign-in; throws on failure. */
+    signIn: () => Promise<import("./cliSession").TokenSet>;
+    /** A person at a terminal who can answer prompts. */
+    interactive: boolean;
+    askYesNo: (question: string) => Promise<boolean>;
+    askToken: (question: string) => Promise<string>;
+    log: (line: string) => void;
+    error: (line: string) => void;
+}
+/**
+ * Browser sign-in, with the API-token paste as the way out: if the browser
+ * flow fails (blocked page, expired code, proxy) an interactive user is asked
+ * whether to paste a token instead, rather than being sent to rerun connect.
+ * Returns null when there's nothing to continue with (caller exits 1).
+ */
+export declare function signInWithTokenFallback(deps: SignInDeps): Promise<SignInResult | null>;

package/dist/connectFlow.js

@@ -10,6 +10,7 @@
 // generate a new one — leaving him thinking the old one had been lost.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveConnectToken = resolveConnectToken;
+exports.signInWithTokenFallback = signInWithTokenFallback;
 function resolveConnectToken(input) {
     if (input.force)
         return { source: "prompt-required" };
@@ -19,3 +20,43 @@ function resolveConnectToken(input) {
         return { source: "prompt-required" };
     return { source: "reused", token: input.savedConfig.token };
 }
+/**
+ * Browser sign-in, with the API-token paste as the way out: if the browser
+ * flow fails (blocked page, expired code, proxy) an interactive user is asked
+ * whether to paste a token instead, rather than being sent to rerun connect.
+ * Returns null when there's nothing to continue with (caller exits 1).
+ */
+async function signInWithTokenFallback(deps) {
+    deps.log("Prefer an API token? Press Ctrl+C and run `codiedev connect --token`.\n");
+    try {
+        const s = await deps.signIn();
+        deps.log("Signed in. No API key is stored on this machine.\n");
+        return {
+            token: s.accessToken,
+            auth: {
+                kind: "browser",
+                clientId: s.clientId,
+                refreshToken: s.refreshToken,
+                accessTokenExpiresAt: s.expiresAt,
+            },
+        };
+    }
+    catch (err) {
+        deps.error(`\nBrowser sign-in didn't finish: ${err.message}`);
+        if (!deps.interactive) {
+            deps.error("To paste an API token instead, run `codiedev connect --token`.");
+            return null;
+        }
+        if (!(await deps.askYesNo("Paste an API token instead? [y/N] "))) {
+            deps.error("Run `codiedev connect` to try again, or `codiedev connect --token` to paste a token.");
+            return null;
+        }
+        deps.log("Create one at https://codiedev.com/portal/integrations/claude-code\n");
+        const token = (await deps.askToken("Enter your Codiedev API token: ")).trim();
+        if (!token) {
+            deps.error("Error: API token is required.");
+            return null;
+        }
+        return { token };
+    }
+}

package/dist/hook.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildDiscoveryContext = buildDiscoveryContext;
+const localScrub_1 = require("./localScrub");
 const captureSignals_1 = require("./captureSignals");
 const transcriptModels_1 = require("./transcriptModels");
 const fs = __importStar(require("fs"));
@@ -60,6 +61,8 @@ const captureExclusions_1 = require("./captureExclusions");
 const cursorHooks_1 = require("./cursorHooks");
 const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
+const cliSession_1 = require("./cliSession");
+const utils_2 = require("./utils");
 // Pure builder for the discovery additionalContext. Returns null when there are
 // no matches. The suggested `codiedev pull` command carries the EXACT top key
 // (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
@@ -440,6 +443,11 @@ function resolveMode(arg) {
     return "claude-code";
 }
 async function main() {
+    // Browser sign-in: refresh the access token under the shared lock before
+    // anything reads config (cliSession.ts). A no-op for pasted API tokens and
+    // for tokens with time left; never throws, never prints (hook stdout is
+    // the agent's).
+    await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
     // Shared upload deps used by both "upload" and "upload-deferred" branches.
     // Extracted to keep both branches in lockstep — any new dep added here
     // automatically applies to the deferred path too.
@@ -535,6 +543,18 @@ async function main() {
         }
         process.exit(0);
     }
+    // Detached local session scrub (see localScrub.ts). No stdin.
+    if (process.argv[2] === "local-scrub") {
+        try {
+            const { runScheduledScrub } = await Promise.resolve().then(() => __importStar(require("./localScrub")));
+            // Off unless the person or their company turned it on.
+            await runScheduledScrub();
+        }
+        catch {
+            // best-effort — never throw out of the detached child
+        }
+        process.exit(0);
+    }
     // Detached daily self-upgrade of this install (see selfUpdate.ts).
     if (process.argv[2] === "self-update") {
         await (0, selfUpdate_1.runSelfUpdate)(process.argv[1]);
@@ -606,6 +626,9 @@ async function main() {
             // --- starter packs: Codex has no SessionStart hook; same hourly throttle ---
             (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
             // --- end starter packs ---
+            // Local session scrub: Codex has no SessionStart, so its first prompt
+            // starts it (hourly throttle inside).
+            (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
         }
         if (process.argv[2] !== "discover-copilot")
             await runDiscover(hookInput.prompt);
@@ -628,6 +651,8 @@ async function main() {
         process.argv[2] === "session-start-pi") {
         // --- starter packs: hourly detached `pack install --quiet` + daily nudge ---
         (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
+        // Local session scrub of past sessions on this machine (hourly, detached).
+        (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
         const packNag = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi" ? null : (0, sync_1.packNagLine)();
         // Claude Code adds SessionStart stdout to the session context.
         if (packNag && process.argv[2] === "session-start")