codiedev 0.9.80 → 0.10.0-beta.10

package/dist/packs/sync.js

@@ -42,11 +42,6 @@ exports.decideSync = decideSync;
 exports.cliEntry = cliEntry;
 exports.maybeSpawnPackSync = maybeSpawnPackSync;
 exports.packNagLine = packNagLine;
-// Background auto-update and the "pack has updates" nudge.
-//
-// Hot-path rule: maybeSpawnPackSync and packNagLine run inside session-start
-// hooks and every `codiedev` command, so they only stat/read tiny local files
-// and, at most once an hour, spawn a detached child. No network here, ever.
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -54,16 +49,11 @@ const child_process_1 = require("child_process");
 const paths_1 = require("./paths");
 const store_1 = require("./store");
 exports.SYNC_INTERVAL_MS = 60 * 60 * 1000;
-/** CI mode: a pack-scoped CI key (`cdvci_…`) or CI=true. No auto-sync, no
- * nudge, no server writes, no pruning — CI machines are ephemeral and CI keys
- * can only read packs. */
 function isPackCiMode(env = process.env) {
     const ci = (env.CI ?? "").trim().toLowerCase();
     return (env.CODIEDEV_TOKEN ?? "").trim().startsWith("cdvci_") || ci === "true" || ci === "1";
 }
 exports.NAG_INTERVAL_MS = 24 * 60 * 60 * 1000;
-// With nothing installed and a fresh "your team has no packs" answer, only
-// re-ask once a day so a newly assigned pack still arrives.
 exports.EMPTY_RECHECK_MS = 24 * 60 * 60 * 1000;
 function readStatusCache(root) {
     try {
@@ -85,7 +75,6 @@ function writeStatusCache(root, cache) {
         (0, store_1.writeFileAtomic)((0, paths_1.statusCachePath)(root), JSON.stringify(cache) + "\n");
     }
     catch {
-        // best-effort
     }
 }
 function mtime(file) {
@@ -97,7 +86,6 @@ function mtime(file) {
     }
 }
 function registryNonEmpty(root) {
-    // installed.json is tiny; `{"packs":{}}` means nothing is installed.
     try {
         const parsed = JSON.parse(fs.readFileSync((0, paths_1.registryPath)(root), "utf8"));
         return Boolean(parsed?.packs && Object.keys(parsed.packs).length > 0);
@@ -110,7 +98,6 @@ function autosyncDisabled(env) {
     const v = (env.CODIEDEV_PACK_AUTOSYNC ?? "").trim().toLowerCase();
     return v === "0" || v === "false" || v === "off" || v === "no";
 }
-/** Pure decision for the hourly background sync. */
 function decideSync(root, env, now) {
     const last = mtime((0, paths_1.lastSyncPath)(root));
     if (last !== null && now - last < exports.SYNC_INTERVAL_MS && last <= now)
@@ -120,15 +107,11 @@ function decideSync(root, env, now) {
         if (cache && cache.available === 0 && now - cache.checkedAt < exports.EMPTY_RECHECK_MS)
             return "no-packs";
     }
-    // Opted out of auto-install: still refresh the cached status (read-only,
-    // no install, no pruning) so the outdated nudge can tell them.
     return autosyncDisabled(env) ? "spawn-check" : "spawn-install";
 }
 function cliEntry() {
-    // dist/packs/sync.js → dist/cli.js
     return path.join(__dirname, "..", "cli.js");
 }
-/** Called from session-start hooks. Never throws, never waits. */
 function maybeSpawnPackSync(options = {}) {
     try {
         if (options.connected === false)
@@ -141,7 +124,6 @@ function maybeSpawnPackSync(options = {}) {
         const decision = decideSync(root, env, now);
         if (decision !== "spawn-install" && decision !== "spawn-check")
             return decision;
-        // Stamp first so concurrent session starts don't each spawn a sync.
         fs.mkdirSync(root, { recursive: true });
         fs.writeFileSync((0, paths_1.lastSyncPath)(root), String(now));
         const time = new Date(now);
@@ -162,8 +144,6 @@ function maybeSpawnPackSync(options = {}) {
         return "error";
     }
 }
-/** One-line nudge when the cached status shows an outdated pack, at most once
- * a day. Returns null (and records nothing) when there's nothing to say. */
 function packNagLine(options = {}) {
     try {
         const env = options.env ?? process.env;

package/dist/piHooks.js

@@ -39,21 +39,9 @@ exports.isPiTranscriptEmpty = isPiTranscriptEmpty;
 exports.piLaunchFromArgv = piLaunchFromArgv;
 exports.piExtensionPath = piExtensionPath;
 exports.inspectPiExtension = inspectPiExtension;
-// pi (@mariozechner/pi-coding-agent). pi has no hook config; it loads
-// TypeScript extensions from <agentDir>/extensions/, so Codiedev installs one
-// there (see installPiExtension in utils.ts) that forwards pi's events to the
-// same hook subcommands every other harness uses.
-//
-// pi writes its own session JSONL (<agentDir>/sessions/--<cwd>--/<ts>_<id>.jsonl)
-// and the extension passes that path as transcript_path. This file turns it
-// into the Claude Code shape the shared capture pipeline parses.
-//
-// Imports only node built-ins and harnessDirs (no utils.ts) so hook.ts,
-// utils.ts and securityInstall.ts can all import it without a cycle.
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const harnessDirs_1 = require("./harnessDirs");
-/** customType of the context message the Codiedev extension injects. */
 exports.PI_CONTEXT_CUSTOM_TYPE = "codiedev";
 const SKILL_EXPANSION = /^<skill name="([^"]{1,200})" location="[^"]*">/;
 const num = (n) => (typeof n === "number" && Number.isFinite(n) ? Math.max(0, n) : 0);
@@ -74,36 +62,20 @@ function userBlocks(content) {
         return [];
     return content.flatMap((block) => block?.type === "text" && typeof block.text === "string"
         ? [{ type: "text", text: block.text }]
-        // Image bytes never leave the machine; keep that one was attached.
         : block?.type === "image" ? [{ type: "text", text: "[image]" }] : []);
 }
-/** `/x/skills/review/SKILL.md` → "review". pi's agent loads a listed skill by
- * reading its SKILL.md; that read IS the invocation (docs/skills.md). */
 function skillFromPath(value) {
     if (typeof value !== "string")
         return null;
     const m = value.replace(/\\/g, "/").match(/\/([^/]+)\/SKILL\.md$/);
     return m ? m[1] : null;
 }
-/** A provider error's HTTP status, when pi kept it at the front ("429 …"). */
 function errorCode(message) {
     return message.match(/^\s*(\d{3})\b/)?.[1] ?? "";
 }
-/**
- * pi session JSONL → Claude Code-shaped JSONL.
- *
- * Every message entry is kept in file order, abandoned /tree branches
- * included: they were real model calls and real tokens. Usage is pi's own
- * per-call record (`input` is already the uncached part). Skill runs, user
- * interrupts and provider errors become the records the shared parsers read:
- * `pi.skill_invoked`, Claude's interrupt marker and a native `agent.error`.
- */
 function normalizePiTranscript(content) {
     const out = [];
     const skillReads = new Map();
-    // pi retries a failed provider call on its own (and fires agent_end after
-    // each try). Every error in one retry streak carries the streak's first
-    // time, so limit events, which dedupe on time, count the hit once.
     let errorStreakAt;
     const push = (record) => out.push(JSON.stringify(record));
     for (const line of content.split("\n")) {
@@ -114,7 +86,7 @@ function normalizePiTranscript(content) {
             entry = JSON.parse(line);
         }
         catch {
-            continue; // pi may be mid-append
+            continue;
         }
         if (!entry || typeof entry !== "object")
             continue;
@@ -150,7 +122,6 @@ function normalizePiTranscript(content) {
             }
             const usage = message.usage ?? {};
             const tokens = num(usage.input) + num(usage.output) + num(usage.cacheRead) + num(usage.cacheWrite);
-            // A failed call records all-zero usage; it was not a billed request.
             const measured = tokens > 0 || message.stopReason !== "error";
             push({
                 type: "assistant",
@@ -175,8 +146,6 @@ function normalizePiTranscript(content) {
                 push({ type: "user", timestamp, message: { role: "user", content: [{ type: "text", text: "[Request interrupted by user]" }] } });
             }
             if (message.stopReason === "error" && typeof message.errorMessage === "string") {
-                // The call's own time, not the entry's write time, so interim and
-                // final captures agree.
                 errorStreakAt ??= typeof message.timestamp === "number" ? new Date(message.timestamp).toISOString() : timestamp;
                 push({
                     type: "agent.error",
@@ -202,18 +171,15 @@ function normalizePiTranscript(content) {
             });
             continue;
         }
-        // `!cmd` typed by the user: shown to the model like any user turn.
         if (message.role === "bashExecution" && typeof message.command === "string") {
             push({ type: "user", uuid, timestamp, message: { role: "user", content: [{ type: "text", text: `<bash-input>${message.command}</bash-input>` }] } });
         }
     }
     return out.join("\n") + (out.length ? "\n" : "");
 }
-/** pi writes the session header at startup; no message yet means nothing to capture. */
 function isPiTranscriptEmpty(content) {
     return !content.split("\n").some((line) => line.includes('"type":"message"'));
 }
-/** How pi was launched, from its own argv (the extension runs in pi's process). */
 function piLaunchFromArgv(argv) {
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
@@ -232,8 +198,7 @@ function piLaunchFromArgv(argv) {
 function piExtensionPath(agentDir = (0, harnessDirs_1.piAgentDir)()) {
     return path.join(agentDir, "extensions", "codiedev.ts");
 }
-/** What `doctor` and the security install check report for pi. */
-function inspectPiExtension(file = piExtensionPath(), security = false) {
+function inspectPiExtension(file = piExtensionPath()) {
     if (!fs.existsSync(file))
         return { status: "not-installed", detail: `${file} not found` };
     let source;
@@ -243,15 +208,9 @@ function inspectPiExtension(file = piExtensionPath(), security = false) {
     catch {
         return { status: "fail", detail: `${file} unreadable` };
     }
-    const expected = security
-        ? ["discover-pi", "security-pre-pi", "security-post-pi"]
-        : ["session-start-pi", "backup-pi", "capture-pi-final"];
-    // Quoted: "backup-pi" must not match inside some longer subcommand.
+    const expected = ["session-start-pi", "backup-pi", "capture-pi-final"];
     const missing = expected.filter((subcommand) => !source.includes(JSON.stringify(subcommand)));
     if (missing.length)
         return { status: "fail", detail: `missing ${missing.join(", ")} — re-run \`codiedev connect\`` };
-    if (security && source.includes("const AGENT_SECURITY_ENABLED = false;")) {
-        return { status: "fail", detail: "installed with agent security off — re-run `codiedev connect`" };
-    }
-    return { status: "pass", detail: security ? "prompt guard and tool telemetry installed" : `session start, capture and backup events (${(0, harnessDirs_1.displayPath)(file)})` };
+    return { status: "pass", detail: `session start, capture and backup events (${(0, harnessDirs_1.displayPath)(file)})` };
 }

package/dist/piRuntime.js

@@ -37,13 +37,6 @@ exports.PI_RUNTIME_SPEC = exports.PI_VERSION = exports.PI_PACKAGE = void 0;
 exports.piRuntimeDir = piRuntimeDir;
 exports.installedPiEntry = installedPiEntry;
 exports.ensurePiRuntime = ensurePiRuntime;
-// pi for `codie --pi`, installed on first use like the Codie engine
-// (codieRuntimeInstall.ts): developers never run a second npm install, and
-// every machine runs the version Codiedev tested its capture against.
-//
-// pi is plain JavaScript, so it runs on the same Node as `codie` from its
-// package entry: no PATH lookup, no Windows .cmd shim, and no dependency on
-// whatever `pi` (if any) the developer installed globally.
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
@@ -57,7 +50,6 @@ function piRuntimeDir(stateDir) {
 function packageDir(installDir) {
     return path.join(installDir, "node_modules", ...exports.PI_PACKAGE.split("/"));
 }
-/** The installed pi's CLI entry, when it is the pinned version. */
 function installedPiEntry(installDir, readFile = (f) => fs.readFileSync(f, "utf8")) {
     try {
         const pkg = JSON.parse(readFile(path.join(packageDir(installDir), "package.json")));
@@ -70,15 +62,8 @@ function installedPiEntry(installDir, readFile = (f) => fs.readFileSync(f, "utf8
         return null;
     }
 }
-// One retry rides out a dropped connection or registry blip; a second
-// failure is a real problem (offline, blocked registry) and is reported.
 const INSTALL_ATTEMPTS = 2;
 const INSTALL_RETRY_DELAY_MS = 5_000;
-/**
- * The pi CLI entry to run, installing the pinned version first if it is
- * missing or a different version. Staged then renamed, so an interrupted
- * download never leaves a half-installed pi that looks ready.
- */
 function ensurePiRuntime(deps) {
     const installDir = piRuntimeDir(deps.stateDir);
     const exists = deps.exists ?? fs.existsSync;
@@ -109,7 +94,6 @@ function ensurePiRuntime(deps) {
             const result = run((0, codieRuntimeInstall_1.buildRuntimeInstallArgs)(staging, exports.PI_RUNTIME_SPEC));
             if (result.status !== 0)
                 throw new Error(result.stderr?.trim() || `npm exited with ${result.status}`);
-            // Trust the artifact, not the exit code.
             const staged = installedPiEntry(staging, readFile);
             if (!staged || !exists(staged)) {
                 throw new Error(`the install did not produce pi. Check that ${exports.PI_RUNTIME_SPEC} is available from your npm registry.`);
@@ -125,8 +109,6 @@ function ensurePiRuntime(deps) {
             log(`pi install failed (${message.split("\n")[0]}); retrying.`);
         }
         finally {
-            // No-op after a successful promote; otherwise it keeps a ~200MB staging
-            // dir from being orphaned.
             remove(staging);
         }
         sleep(INSTALL_RETRY_DELAY_MS);

package/dist/repoResolver.js

@@ -1,12 +1,4 @@
 "use strict";
-// Pure resolver — given a captured remoteUrl, an optional client-cached
-// repoId, and the company's current repo list, decide which repoId (if any)
-// the session belongs to. Used both inline by the CLI hook and (mirrored
-// in convex/repoResolver.ts) by the /api/captureSession endpoint so that
-// repos added after the user's last `connect` still get matched.
-//
-// "unmatched" is intentional — the backend will accept the session anyway
-// and surface it for triage rather than silently dropping it.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveRepoForCapture = resolveRepoForCapture;
 function parseRemoteUrl(url) {
@@ -17,12 +9,6 @@ function parseRemoteUrl(url) {
     if (https) {
         return { host: https[1].toLowerCase(), ownerName: https[2].toLowerCase() };
     }
-    // Codie strips SSH userinfo before putting a remote in the gateway header,
-    // so `git@gitlab.com:owner/repo.git` arrives here as
-    // `gitlab.com:owner/repo.git`. Accept both forms; otherwise every SSH-cloned
-    // Harness checkout loses its repoId even though transcript capture can
-    // resolve the same raw remote correctly. Check this after URL forms so the
-    // colon in `https://` is never mistaken for an SCP separator.
     const scp = s.match(/^(?:[^@\s]+@)?([^:/\s]+):([^/]+\/.+)$/);
     if (scp) {
         return { host: scp[1].toLowerCase(), ownerName: scp[2].toLowerCase() };
@@ -31,11 +17,6 @@ function parseRemoteUrl(url) {
 }
 function resolveRepoForCapture(input) {
     const { remoteUrl, providedRepoId, companyRepos } = input;
-    // The remoteUrl is the ground truth of where the work happened — resolve it
-    // FIRST. A buggy client can send a wrong-but-valid providedRepoId (the Sonifi
-    // case: client matchRepo stamped every session with the org's first repo), so
-    // we must not blindly trust it over the URL. Keep providedRepoId only when it
-    // AGREES with the URL match, or when the URL can't be resolved at all.
     const parsed = remoteUrl ? parseRemoteUrl(remoteUrl) : null;
     const urlMatch = parsed
         ? companyRepos.find((r) => `${r.owner}/${r.name}`.toLowerCase() === parsed.ownerName)

package/dist/secret.js

@@ -1,7 +1,4 @@
 "use strict";
-// Display helpers for credential-shaped strings. Use anywhere a token /
-// secret might end up in user-visible output (logs, success lines, error
-// messages) so a stray `console.log` can't leak the full value.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.maskToken = maskToken;
 const PREFIX_LEN = 12;

package/dist/selfUpdate.js

@@ -1,15 +1,4 @@
 "use strict";
-// Background self-update for the hook path.
-//
-// Onboarded developers never run `connect`/`doctor`/`codie` again — only the
-// harness hooks fire — so the interactive nudges in upgradeNudge.ts never
-// reach them. This module lets any hook invocation spawn a detached child
-// (at most once per day) that upgrades the exact install the hook is running
-// from. Harness configs bake the absolute path to dist/hook.js, so the next
-// hook call picks up the new code with no config change.
-//
-// Split like versionCheck.ts: `planSelfUpdate` is pure and unit-tested; the IO
-// (state file, lock, registry fetch, package-manager spawn) is below it.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -63,16 +52,10 @@ const captureLog_1 = require("./captureLog");
 const launcher_1 = require("./launcher");
 const utils_1 = require("./utils");
 const PKG = "codiedev";
-const DAY_MS = 24 * 60 * 60 * 1000;
+const SELF_UPDATE_INTERVAL_MS = 2 * 60 * 60 * 1000;
 const LOCK_STALE_MS = 10 * 60 * 1000;
 const INSTALL_TIMEOUT_MS = 5 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 5_000;
-/**
- * Decide which package manager owns this install, from where hook.js really
- * lives. We only ever upgrade the install we are running from: running
- * whatever `npm` is first on PATH would, under nvm/Homebrew mixes, upgrade a
- * different global tree than the one the harness config points at.
- */
 function planSelfUpdate(deps) {
     const { env } = deps;
     if (env.CODIEDEV_NO_UPDATE_CHECK || env.CODIEDEV_NO_AUTO_UPDATE) {
@@ -89,30 +72,21 @@ function planSelfUpdate(deps) {
     const pkgDir = path.dirname(path.dirname(deps.hookScriptReal));
     if (!deps.isWritable(pkgDir))
         return { kind: "skip", reason: "readonly" };
-    // pnpm puts every global install in a fresh hashed dir
-    // (global/v11/<hash>/node_modules/codiedev). That is only safe to upgrade
-    // when the hook runs through the stable launcher, which runSelfUpdate
-    // re-points at the new dir; a direct-path config would stay on the old copy.
     if (/\/\.pnpm\/|\/pnpm\/global\/|\/global\/v\d+\/[^/]+\/node_modules\/codiedev\/|\/store\/v\d+\/links\//.test(p)) {
         return deps.viaLauncher ? { kind: "pnpm" } : { kind: "skip", reason: "pnpm-direct" };
     }
-    // $BUN_INSTALL/install/global — ~/.bun by default, but BUN_INSTALL is often
-    // customized, so match the layout rather than the directory name.
     if (/\/install\/global\/node_modules\/codiedev\/dist\/hook\.js$/.test(p))
         return { kind: "bun" };
-    // npm global: <prefix>/lib/node_modules/codiedev/dist/hook.js on unix,
-    // <prefix>/node_modules/codiedev/dist/hook.js on Windows.
     const unix = p.match(/^(.*)\/lib\/node_modules\/codiedev\/dist\/hook\.js$/);
     if (unix && deps.platform !== "win32")
         return { kind: "npm", prefix: unix[1] };
     const win = p.match(/^(.*)\/node_modules\/codiedev\/dist\/hook\.js$/);
     if (win && deps.platform === "win32")
         return { kind: "npm", prefix: win[1] };
-    // A repo checkout, a project-local install, or a layout we don't know.
     return { kind: "skip", reason: "unmanaged" };
 }
 function isSelfUpdateDue(state, nowMs) {
-    return !state || nowMs - state.lastAttemptAt > DAY_MS;
+    return !state || nowMs - state.lastAttemptAt > SELF_UPDATE_INTERVAL_MS;
 }
 function statePath() {
     return path.join((0, configDir_1.codiedevStateDir)(), ".self-update.json");
@@ -139,11 +113,6 @@ function writeState(state) {
         return false;
     }
 }
-/**
- * Called on every hook invocation, so the not-due path is one small file read.
- * Stamps the attempt before spawning so a burst of parallel hooks spawns one
- * child, not one each; the child's lock covers whatever still slips through.
- */
 function maybeSpawnSelfUpdate(hookEntry) {
     try {
         if (!hookEntry || process.env.CODIEDEV_NO_AUTO_UPDATE || process.env.CODIEDEV_NO_UPDATE_CHECK)
@@ -156,24 +125,16 @@ function maybeSpawnSelfUpdate(hookEntry) {
         const child = (0, child_process_1.spawn)(process.execPath, [hookEntry, "self-update"], {
             detached: true,
             stdio: "ignore",
-            // detached on Windows opens a console window unless hidden.
             windowsHide: true,
         });
         child.unref();
     }
     catch {
-        // Best-effort; a failed spawn retries tomorrow.
     }
 }
 function instructionsVersionPath() {
     return path.join((0, configDir_1.codiedevStateDir)(), ".instructions-version");
 }
-/**
- * First hook call on a new CLI version (self-updated or installed by hand)
- * re-renders the codiedev block in the harness instruction files, so they
- * stop listing commands this version no longer has. The steady-state cost is
- * one small file read. Honors the same opt-outs as the self-update.
- */
 function maybeRefreshInstructions(refresh = utils_1.refreshInstalledInstructions) {
     if (process.env.CODIEDEV_NO_AUTO_UPDATE || process.env.CODIEDEV_NO_UPDATE_CHECK)
         return;
@@ -184,7 +145,6 @@ function maybeRefreshInstructions(refresh = utils_1.refreshInstalledInstructions
                 return;
         }
         catch {
-            // No marker yet: first run on a version that ships this check.
         }
         const refreshed = refresh();
         fs.mkdirSync((0, configDir_1.codiedevStateDir)(), { recursive: true });
@@ -199,7 +159,6 @@ function maybeRefreshInstructions(refresh = utils_1.refreshInstalledInstructions
         }
     }
     catch {
-        // Best-effort; retried on the next hook call.
     }
 }
 function acquireLock() {
@@ -217,7 +176,6 @@ function acquireLock() {
             }
         }
         catch {
-            // Lost the race to another child.
         }
         return false;
     }
@@ -225,8 +183,6 @@ function acquireLock() {
 function detectContainer(env) {
     if (env.KUBERNETES_SERVICE_HOST)
         return true;
-    // /run/.containerenv is podman's marker (e.g. Sonifi's dev containers);
-    // cgroup v2 hosts report a bare "0::/" there, so the cgroup probe misses it.
     if (fs.existsSync("/.dockerenv") || fs.existsSync("/run/.containerenv"))
         return true;
     try {
@@ -262,18 +218,11 @@ async function fetchLatest(env) {
 }
 function installCommand(plan, version, env) {
     const spec = `${PKG}@${version}`;
-    // Pass an env-level registry override explicitly so the install always
-    // hits the registry fetchLatest just read from (not every manager honors
-    // npm_config_registry for global installs).
     const configured = env.npm_config_registry || env.NPM_CONFIG_REGISTRY;
     const registry = configured ? ["--registry", registryBase(env)] : [];
     switch (plan.kind) {
         case "npm": {
             const args = ["i", "-g", "--prefix", plan.prefix, "--no-fund", "--no-audit", ...registry, spec];
-            // Run the npm that ships beside the node running us (it owns this
-            // prefix even when PATH resolves a different node), through its JS
-            // entry. That avoids spawning npm.cmd, which on Windows needs a shell
-            // and would split a prefix like C:\Users\First Last\… on the space.
             const execDir = path.dirname(process.execPath);
             const npmCli = [
                 path.join(execDir, "node_modules", "npm", "bin", "npm-cli.js"),
@@ -284,7 +233,6 @@ function installCommand(plan, version, env) {
             return { cmd: process.platform === "win32" ? "npm.cmd" : "npm", args, shell: process.platform === "win32" };
         }
         case "pnpm":
-            // pnpm on Windows is usually a .cmd shim; these args carry no paths.
             return { cmd: "pnpm", args: ["add", "-g", ...registry, spec], shell: process.platform === "win32" };
         case "bun":
             return { cmd: "bun", args: ["add", "-g", ...registry, spec] };
@@ -292,14 +240,7 @@ function installCommand(plan, version, env) {
             return null;
     }
 }
-// package.json "bin" names. npm writes a .cmd, a .ps1 and a bare shim for each.
 exports.BIN_NAMES = ["codiedev", "codiedev-hook", "codie"];
-/**
- * The .ps1 shims missing from a Windows npm prefix. The IT kit deletes them so
- * PowerShell falls back to the .cmd shims, which run under the Restricted
- * execution policy Windows client machines default to; `npm i -g` puts them
- * back, so an update must delete again exactly the ones that were gone.
- */
 function missingPs1Shims(prefix, exists = fs.existsSync) {
     return exports.BIN_NAMES.map((name) => path.join(prefix, `${name}.ps1`)).filter((p) => !exists(p));
 }
@@ -312,12 +253,6 @@ function readVersionAt(hookScript) {
         return null;
     }
 }
-/**
- * Where the just-installed copy lives. npm/bun reinstall in place. pnpm's
- * `root -g` is <root>/node_modules up to v10 but the bare global/v11 parent
- * from v11 on, with each install in a hashed child — so check both shapes and
- * take the copy that is actually at the version we just installed.
- */
 function findInstalledHookScript(plan, hookEntry, version, pnpmRoot = pnpmGlobalRoot) {
     if (plan.kind !== "pnpm")
         return readVersionAt(hookEntry) === version ? hookEntry : null;
@@ -331,7 +266,6 @@ function findInstalledHookScript(plan, hookEntry, version, pnpmRoot = pnpmGlobal
         }
     }
     catch {
-        // root vanished between calls
     }
     for (const candidate of candidates) {
         if (readVersionAt(candidate) !== version)
@@ -340,7 +274,6 @@ function findInstalledHookScript(plan, hookEntry, version, pnpmRoot = pnpmGlobal
             return fs.realpathSync(candidate);
         }
         catch {
-            // dangling link; keep looking
         }
     }
     return null;
@@ -355,7 +288,6 @@ function pnpmGlobalRoot() {
     const dir = root.status === 0 ? root.stdout.trim() : "";
     return dir || null;
 }
-/** Body of the detached `codiedev-hook self-update` child. Never throws. */
 async function runSelfUpdate(hookEntry) {
     const env = process.env;
     const now = Date.now();
@@ -396,8 +328,6 @@ async function runSelfUpdate(hookEntry) {
     if (plan.kind === "skip")
         return finish(`skip:${plan.reason}`);
     if (!acquireLock()) {
-        // Another child is mid-install and owns the state file; overwriting it
-        // here would report "skip:locked" while that install is still running.
         (0, captureLog_1.appendCaptureLog)({ stage: "self-update", sessionId: undefined, outcome: "ok", detail: "result=skip:locked" });
         return { lastAttemptAt: now, lastResult: "skip:locked" };
     }
@@ -426,12 +356,8 @@ async function runSelfUpdate(hookEntry) {
                 fs.rmSync(shim, { force: true });
             }
             catch {
-                // Best-effort: a leftover .ps1 only matters under a Restricted policy.
             }
         }
-        // Re-point the launcher. npm/bun reinstall in place; pnpm lands in a new
-        // hashed dir. Only switch once the new copy is on disk at the new version,
-        // so a half-finished install can never strand the hooks.
         const installed = findInstalledHookScript(plan, hookScriptReal, latest);
         if (!installed) {
             return finish("error:not-found-after-install", { toVersion: latest });
@@ -445,7 +371,6 @@ async function runSelfUpdate(hookEntry) {
             fs.rmSync(lockPath(), { recursive: true, force: true });
         }
         catch {
-            // A stale lock self-expires after LOCK_STALE_MS.
         }
     }
 }

package/dist/skillMarker.js

@@ -1,33 +1,19 @@
 "use strict";
-// Skill identity marker. Two authors can each publish a skill with the same
-// name ("/ticket"); a session's transcript only records the name it ran. A
-// company skill written to disk therefore carries the artifact it came from:
-//
-//   <!-- codiedev:artifact=<artifact id> -->
-//
-// appended after the body (frontmatter untouched, invisible when rendered).
-// When the harness loads the skill, the marker lands in the transcript and
-// parseCaptureSignals reports it as signals.skillInvocationArtifacts, so the
-// portal attributes the run to the exact skill. `push` strips it, so a
-// re-pushed copy never claims someone else's artifact id.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.looksLikeSkill = looksLikeSkill;
 exports.stripSkillMarker = stripSkillMarker;
 exports.stampSkillMarker = stampSkillMarker;
 const ID = /^[a-z0-9]{16,64}$/i;
 const LINE = /^[ \t]*<!--\s*codiedev:artifact=[a-z0-9]+\s*-->[ \t]*(?:\r?\n|$)/gim;
-/** Is this a SKILL.md-style file (frontmatter with name + description)? */
 function looksLikeSkill(markdown) {
     const fm = markdown.match(/^?---\r?\n([\s\S]*?)\r?\n---/);
     if (!fm)
         return false;
     return /^name\s*:/im.test(fm[1]) && /^description\s*:/im.test(fm[1]);
 }
-/** Remove every marker line (idempotent). */
 function stripSkillMarker(markdown) {
     return markdown.replace(LINE, "");
 }
-/** Stamp (or re-stamp) the marker. Leaves the text alone for a bad id. */
 function stampSkillMarker(markdown, artifactId) {
     if (!artifactId || !ID.test(artifactId))
         return markdown;

package/dist/subagents.js

@@ -12,27 +12,12 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const captureSignals_1 = require("./captureSignals");
 const transcriptModels_1 = require("./transcriptModels");
-/**
- * Claude Code writes each subagent's transcript next to its parent's:
- *
- *   ~/.claude/projects/<project>/<sessionId>.jsonl                 (parent)
- *   ~/.claude/projects/<project>/<sessionId>/subagents/agent-*.jsonl
- *
- * Lines there carry `isSidechain: true` and the parent's sessionId. They are
- * part of the parent session's work, not sessions of their own: their skill
- * runs, tool calls and token usage fold into the parent's signals and usage,
- * and they are never uploaded separately. Other harnesses (Codex, Codie,
- * Cursor) keep sub-agents inside the one transcript or don't have them, so
- * this is Claude Code only.
- */
 exports.SUBAGENT_LIMITS = { files: 20, bytes: 20 * 1024 * 1024 };
 function subagentDir(transcriptPath, sessionId) {
     const dir = node_path_1.default.dirname(transcriptPath);
     const id = sessionId || node_path_1.default.basename(transcriptPath).replace(/\.jsonl$/i, "");
     return node_path_1.default.join(dir, id, "subagents");
 }
-/** Read the session's subagent transcripts in full, up to 20 files / 20 MB
- *  in total (oldest first); anything past that is counted as truncated. */
 function readSubagentTranscripts(transcriptPath, sessionId, limits = exports.SUBAGENT_LIMITS) {
     const dir = subagentDir(transcriptPath, sessionId);
     let names;
@@ -73,8 +58,6 @@ function readSubagentTranscripts(transcriptPath, sessionId, limits = exports.SUB
     }
     return { contents, count: files.length, truncated };
 }
-/** Parent signals plus every subagent's skill runs, pulls and tool calls.
- *  Launch values, timing and record counts stay the parent's own. */
 function foldSubagentSignals(parent, subs, source) {
     if (subs.count === 0)
         return parent;
@@ -121,7 +104,6 @@ function foldSubagentSignals(parent, subs, source) {
         truncated,
     };
 }
-/** Parent model usage plus each subagent's, summed per model. */
 function foldSubagentModelUsage(parent, subs, source) {
     if (subs.contents.length === 0)
         return parent;

package/dist/teamSkillContext.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TEAM_SKILL_CONTEXT = void 0;
 exports.teamSkillSessionOutput = teamSkillSessionOutput;
-/** Session-start context uses each client's supported output contract. */
 exports.TEAM_SKILL_CONTEXT = `This machine is connected to Codiedev, the team's artifact and skill library.
 Before a substantial coding task, run codiedev search "<brief task description>" and reuse a relevant team skill by running codiedev pull <exact-key> and following its instructions. If no skill fits, continue the task.
 Use codiedev push <file.md> to share an artifact when asked, codiedev ask "<question>" for team knowledge, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.`;