codiedev 0.9.80 → 0.9.82

package/dist/scrub/scrubProviderRules.js

@@ -0,0 +1,149 @@
+"use strict";
+// GENERATED by scripts/security/gen-scrub-provider-rules.py; do not edit by hand.
+// Provider-prefix secret formats from Gitleaks (https://github.com/gitleaks/gitleaks, commit 5f6ec56cfa6f),
+// converted from Go RE2 to JavaScript. Gitleaks: MIT License, Copyright (c) 2019 Zachary Rice.
+// Mirrored byte-for-byte to packages/codiedev-cli/src/scrub/scrubProviderRules.ts.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_RULE_LABELS = exports.PROVIDER_RULES = void 0;
+exports.PROVIDER_RULES = [
+    { name: "1password-secret-key", re: new RegExp("\\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})|(?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b", "g"), entropy: 3.8, keywords: ["a3-"] },
+    { name: "1password-service-account-token", re: new RegExp("ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}", "g"), entropy: 4, keywords: ["ops_"] },
+    { name: "adobe-client-secret", re: new RegExp("\\b(p8e-[a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["p8e-"] },
+    { name: "age-secret-key", re: new RegExp("AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}", "g"), keywords: ["age-secret-key-1"] },
+    { name: "airtable-personnal-access-token", re: new RegExp("\\b(pat[A-Za-z0-9]{14}\\.[a-f0-9]{64})\\b", "g"), firstGroup: true, keywords: ["airtable"] },
+    { name: "alibaba-access-key-id", re: new RegExp("\\b(LTAI[a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["ltai"] },
+    { name: "artifactory-api-key", re: new RegExp("\\bAKCp[A-Za-z0-9]{69}\\b", "g"), entropy: 4.5, keywords: ["akcp"] },
+    { name: "artifactory-reference-token", re: new RegExp("\\bcmVmd[A-Za-z0-9]{59}\\b", "g"), entropy: 4.5, keywords: ["cmvmd"] },
+    { name: "clickhouse-cloud-api-secret-key", re: new RegExp("\\b(4b1d[A-Za-z0-9]{38})\\b", "g"), firstGroup: true, entropy: 3, keywords: ["4b1d"] },
+    { name: "clojars-api-token", re: new RegExp("CLOJARS_[a-z0-9]{60}", "gi"), entropy: 2, keywords: ["clojars_"] },
+    { name: "cloudflare-origin-ca-key", re: new RegExp("\\b(v1\\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["cloudflare", "v1.0-"] },
+    { name: "curl-auth-header", re: new RegExp("\\bcurl\\b(?:.*?|.*?(?:[\\r\\n]{1,2}.*?){1,5})[ \\t\\n\\r](?:-H|--header)(?:=|[ \\t]{0,5})(?:\"(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))\"|'(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))')(?:\\B|\\s|$)", "gi"), firstGroup: true, entropy: 2.75, keywords: ["curl"] },
+    { name: "curl-auth-user", re: new RegExp("\\bcurl\\b(?:.*|.*(?:[\\r\\n]{1,2}.*){1,5})[ \\t\\n\\r](?:-u|--user)(?:=|[ \\t]{0,5})(\"(:[^\"]{3,}|[^:\"]{3,}:|[^:\"]{3,}:[^\"]{3,})\"|'([^:']{3,}:[^']{3,})'|((?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w$@.-]+):(?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w${}@.-]+)))(?:\\s|$)", "g"), firstGroup: true, entropy: 2, keywords: ["curl"] },
+    { name: "databricks-api-token", re: new RegExp("\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["dapi"] },
+    { name: "digitalocean-access-token", re: new RegExp("\\b(doo_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["doo_v1_"] },
+    { name: "digitalocean-pat", re: new RegExp("\\b(dop_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["dop_v1_"] },
+    { name: "digitalocean-refresh-token", re: new RegExp("\\b(dor_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, keywords: ["dor_v1_"] },
+    { name: "doppler-api-token", re: new RegExp("dp\\.pt\\.[a-z0-9]{43}", "gi"), entropy: 2, keywords: ["dp.pt."] },
+    { name: "duffel-api-token", re: new RegExp("duffel_(?:test|live)_[a-z0-9_\\-=]{43}", "gi"), entropy: 2, keywords: ["duffel_"] },
+    { name: "dynatrace-api-token", re: new RegExp("dt0c01\\.[a-z0-9]{24}\\.[a-z0-9]{64}", "gi"), entropy: 4, keywords: ["dt0c01."] },
+    { name: "easypost-api-token", re: new RegExp("\\bEZAK[a-z0-9]{54}\\b", "gi"), entropy: 2, keywords: ["ezak"] },
+    { name: "easypost-test-api-token", re: new RegExp("\\bEZTK[a-z0-9]{54}\\b", "gi"), entropy: 2, keywords: ["eztk"] },
+    { name: "facebook-access-token", re: new RegExp("\\b(\\d{15,16}(\\||%)[0-9a-z\\-_]{27,40})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["facebook"] },
+    { name: "facebook-page-access-token", re: new RegExp("\\b(EAA[MC][a-z0-9]{100,})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 4, keywords: ["eaam", "eaac"] },
+    { name: "flutterwave-encryption-key", re: new RegExp("FLWSECK_TEST-[a-h0-9]{12}", "gi"), entropy: 2, keywords: ["flwseck_test"] },
+    { name: "flutterwave-secret-key", re: new RegExp("FLWSECK_TEST-[a-h0-9]{32}-X", "gi"), entropy: 2, keywords: ["flwseck_test"] },
+    { name: "flyio-access-token", re: new RegExp("\\b((?:fo1_[\\w-]{43}|fm1[ar]_[a-zA-Z0-9+\\/]{100,}={0,3}|fm2_[a-zA-Z0-9+\\/]{100,}={0,3}))(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["fo1_", "fm1", "fm2_"] },
+    { name: "frameio-api-token", re: new RegExp("fio-u-[a-z0-9\\-_=]{64}", "gi"), keywords: ["fio-u-"] },
+    { name: "grafana-api-key", re: new RegExp("\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["eyjrijoi"] },
+    { name: "grafana-cloud-api-token", re: new RegExp("\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["glc_"] },
+    { name: "grafana-service-account-token", re: new RegExp("\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["glsa_"] },
+    { name: "harness-api-key", re: new RegExp("(?:pat|sat)\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}", "g"), keywords: ["pat.", "sat."] },
+    { name: "heroku-api-key-v2", re: new RegExp("\\b((HRKU-AA[0-9a-zA-Z_-]{58}))(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["hrku-aa"] },
+    { name: "huggingface-access-token", re: new RegExp("\\b(hf_(?:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["hf_"] },
+    { name: "huggingface-organization-api-token", re: new RegExp("\\b(api_org_(?:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["api_org_"] },
+    { name: "infracost-api-token", re: new RegExp("\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["ico-"] },
+    { name: "intra42-client-secret", re: new RegExp("\\b(s-s4t2(?:ud|af)-[abcdef0123456789]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["intra", "s-s4t2ud-", "s-s4t2af-"] },
+    { name: "maxmind-license-key", re: new RegExp("\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["_mmk"] },
+    { name: "microsoft-teams-webhook", re: new RegExp("https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}", "g"), firstGroup: true, keywords: ["webhook.office.com", "webhookb2", "incomingwebhook"] },
+    { name: "notion-api-token", re: new RegExp("\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["ntn_"] },
+    { name: "octopus-deploy-api-key", re: new RegExp("\\b(API-[A-Z0-9]{26})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["api-"] },
+    { name: "openshift-user-token", re: new RegExp("\\b(sha256~[\\w-]{43})(?:[^\\w-]|$)", "g"), firstGroup: true, entropy: 3.5, keywords: ["sha256~"] },
+    { name: "perplexity-api-key", re: new RegExp("\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'\"\\s;]|\\\\|$|\\b)", "g"), firstGroup: true, entropy: 4, keywords: ["pplx-"] },
+    { name: "planetscale-api-token", re: new RegExp("\\b(pscale_tkn_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pscale_tkn_"] },
+    { name: "planetscale-oauth-token", re: new RegExp("\\b(pscale_oauth_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["pscale_oauth_"] },
+    { name: "planetscale-password", re: new RegExp("\\b(pscale_pw_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pscale_pw_"] },
+    { name: "postman-api-token", re: new RegExp("\\b(PMAK-[a-f0-9]{24}\\-[a-f0-9]{34})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pmak-"] },
+    { name: "prefect-api-token", re: new RegExp("\\b(pnu_[a-zA-Z0-9]{36})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["pnu_"] },
+    { name: "pulumi-api-token", re: new RegExp("\\b(pul-[a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["pul-"] },
+    { name: "pypi-upload-token", re: new RegExp("pypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}", "g"), entropy: 3, keywords: ["pypi-ageichlwas5vcmc"] },
+    { name: "readme-api-token", re: new RegExp("\\b(rdme_[a-z0-9]{70})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["rdme_"] },
+    { name: "rubygems-api-token", re: new RegExp("\\b(rubygems_[a-f0-9]{48})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["rubygems_"] },
+    { name: "scalingo-api-token", re: new RegExp("\\b(tk-us-[\\w-]{48})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["tk-us-"] },
+    { name: "sendinblue-api-token", re: new RegExp("\\b(xkeysib-[a-f0-9]{64}\\-[a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["xkeysib-"] },
+    { name: "sentry-org-token", re: new RegExp("\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}(?:[^a-zA-Z0-9+/]|$)", "g"), entropy: 4.5, keywords: ["sntrys_eyjpyxqio"] },
+    { name: "sentry-user-token", re: new RegExp("\\b(sntryu_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3.5, keywords: ["sntryu_"] },
+    { name: "settlemint-application-access-token", re: new RegExp("\\b(sm_aat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_aat"] },
+    { name: "settlemint-personal-access-token", re: new RegExp("\\b(sm_pat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_pat"] },
+    { name: "settlemint-service-access-token", re: new RegExp("\\b(sm_sat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_sat"] },
+    { name: "shippo-api-token", re: new RegExp("\\b(shippo_(?:live|test)_[a-fA-F0-9]{40})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["shippo_"] },
+    { name: "shopify-access-token", re: new RegExp("shpat_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpat_"] },
+    { name: "shopify-custom-access-token", re: new RegExp("shpca_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpca_"] },
+    { name: "shopify-private-app-access-token", re: new RegExp("shppa_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shppa_"] },
+    { name: "shopify-shared-secret", re: new RegExp("shpss_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpss_"] },
+    { name: "sidekiq-sensitive-url", re: new RegExp("\\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\\/|\\#|\\?|:]|$)", "gi"), firstGroup: true, keywords: ["gems.contribsys.com", "enterprise.contribsys.com"] },
+    { name: "sourcegraph-access-token", re: new RegExp("\\b(sgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}|sgp_[a-fA-F0-9]{40})\\b", "g"), firstGroup: true, entropy: 3, keywords: ["sgp_", "sourcegraph"] },
+    { name: "square-access-token", re: new RegExp("\\b((?:EAAA|sq0atp-)[\\w-]{22,60})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["sq0atp-", "eaaa"] },
+    { name: "vault-batch-token", re: new RegExp("\\b(hvb\\.[\\w-]{138,300})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["hvb."] },
+    { name: "vault-service-token", re: new RegExp("\\b(hvs\\.[\\w-]{90,120})", "g"), firstGroup: true, entropy: 3.5, keywords: ["hvs."] },
+];
+exports.PROVIDER_RULE_LABELS = {
+    "1password-secret-key": "1password secret key",
+    "1password-service-account-token": "1password service account token",
+    "adobe-client-secret": "Adobe client secret",
+    "age-secret-key": "Age secret key",
+    "airtable-personnal-access-token": "Airtable personnal access token",
+    "alibaba-access-key-id": "Alibaba access key id",
+    "artifactory-api-key": "Artifactory api key",
+    "artifactory-reference-token": "Artifactory reference token",
+    "clickhouse-cloud-api-secret-key": "Clickhouse cloud api secret key",
+    "clojars-api-token": "Clojars api token",
+    "cloudflare-origin-ca-key": "Cloudflare origin ca key",
+    "curl-auth-header": "Curl auth header",
+    "curl-auth-user": "Curl auth user",
+    "databricks-api-token": "Databricks api token",
+    "digitalocean-access-token": "Digitalocean access token",
+    "digitalocean-pat": "Digitalocean pat",
+    "digitalocean-refresh-token": "Digitalocean refresh token",
+    "doppler-api-token": "Doppler api token",
+    "duffel-api-token": "Duffel api token",
+    "dynatrace-api-token": "Dynatrace api token",
+    "easypost-api-token": "Easypost api token",
+    "easypost-test-api-token": "Easypost test api token",
+    "facebook-access-token": "Facebook access token",
+    "facebook-page-access-token": "Facebook page access token",
+    "flutterwave-encryption-key": "Flutterwave encryption key",
+    "flutterwave-secret-key": "Flutterwave secret key",
+    "flyio-access-token": "Flyio access token",
+    "frameio-api-token": "Frameio api token",
+    "grafana-api-key": "Grafana api key",
+    "grafana-cloud-api-token": "Grafana cloud api token",
+    "grafana-service-account-token": "Grafana service account token",
+    "harness-api-key": "Harness api key",
+    "heroku-api-key-v2": "Heroku api key v2",
+    "huggingface-access-token": "Huggingface access token",
+    "huggingface-organization-api-token": "Huggingface organization api token",
+    "infracost-api-token": "Infracost api token",
+    "intra42-client-secret": "Intra42 client secret",
+    "maxmind-license-key": "Maxmind license key",
+    "microsoft-teams-webhook": "Microsoft teams webhook",
+    "notion-api-token": "Notion api token",
+    "octopus-deploy-api-key": "Octopus deploy api key",
+    "openshift-user-token": "Openshift user token",
+    "perplexity-api-key": "Perplexity api key",
+    "planetscale-api-token": "Planetscale api token",
+    "planetscale-oauth-token": "Planetscale oauth token",
+    "planetscale-password": "Planetscale password",
+    "postman-api-token": "Postman api token",
+    "prefect-api-token": "Prefect api token",
+    "pulumi-api-token": "Pulumi api token",
+    "pypi-upload-token": "Pypi upload token",
+    "readme-api-token": "Readme api token",
+    "rubygems-api-token": "Rubygems api token",
+    "scalingo-api-token": "Scalingo api token",
+    "sendinblue-api-token": "Sendinblue api token",
+    "sentry-org-token": "Sentry org token",
+    "sentry-user-token": "Sentry user token",
+    "settlemint-application-access-token": "Settlemint application access token",
+    "settlemint-personal-access-token": "Settlemint personal access token",
+    "settlemint-service-access-token": "Settlemint service access token",
+    "shippo-api-token": "Shippo api token",
+    "shopify-access-token": "Shopify access token",
+    "shopify-custom-access-token": "Shopify custom access token",
+    "shopify-private-app-access-token": "Shopify private app access token",
+    "shopify-shared-secret": "Shopify shared secret",
+    "sidekiq-sensitive-url": "Sidekiq sensitive url",
+    "sourcegraph-access-token": "Sourcegraph access token",
+    "square-access-token": "Square access token",
+    "vault-batch-token": "Vault batch token",
+    "vault-service-token": "Vault service token",
+};

package/dist/utils.js

@@ -1677,7 +1677,6 @@ thought, use the \`codiedev\` CLI via Bash:**
 | "any messages?" / "check my inbox" / "what did a teammate say?" | \`codiedev inbox\` |
 | "read that reply" / "mark that ping read" | \`codiedev read <ping-id>\` |
 | "note that X is a follow-up" / "remember X" | \`codiedev note "<text>"\` |
-| "create a ticket" / "scope this into tickets" / "ticket this for me" | \`codiedev create-ticket [optional-inline-prompt]\` |
 | "share with a teammate" / "give someone access" (no notification) | \`codiedev share <key> <name> [--role read\\|edit]\` |
 | "send this to a teammate" / "ask someone to look at this" | \`codiedev send <key> <name> ["<msg>"]\` |
 | "find something about X" / "has anyone solved Y?" | \`codiedev search "<query>" [--limit N]\` |
@@ -1726,11 +1725,6 @@ iterate rather than duplicating.
 notification). \`codiedev send\` both grants access AND pings the
 recipient. Use send when the user is actively looping someone in.
 
-**\`create-ticket\` flow:** when invoked without \`--submit\`, the CLI prints
-skill instructions you should follow. Step 1 is asking the user about repos.
-Step 4 calls \`codiedev create-ticket --submit <path>\` with the plan JSON.
-Tell the user the portal URL when the submit returns.
-
 **Errors:**
 - "not connected" → user needs to run \`npx codiedev connect\` with their
   API token from https://codiedev.com/portal/integrations/claude-code

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.80",
+  "version": "0.9.82",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,13 +12,14 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
-    "test:functional": "vitest run src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
-    "test:harness-parity": "vitest run src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:functional": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:harness-parity": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
     "test:harness-binaries": "node scripts/checkHarnessBinaries.mjs",
     "test:watch": "vitest",
     "test:live-sources": "npm run build && node scripts/liveSourceParity.mjs",
     "test:ide-sources": "npm run build && node scripts/liveSourceParity.mjs --ide",
-    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts"
+    "test:metadata-parity": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts",
+    "test:local-scrub-live": "npm run build && node scripts/localScrubLive.mjs"
   },
   "files": [
     "dist",

package/dist/commands/createTicket.d.ts

@@ -1,27 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function substitutePrompt(protocol: string, prompt: string | undefined): string;
-interface ConnectedRepo {
-    repoId: string;
-    fullName: string;
-}
-export declare function validatePlanHasRepo(parsedPlan: any): string | null;
-export declare function resolveRepoIds(fullNames: string[], repos: ConnectedRepo[]): string[];
-export interface CreateTicketArgs {
-    mode: "bare" | "submit";
-    prompt?: string;
-    submitSource?: "stdin" | string;
-}
-export declare function parseCreateTicketArgs(args: string[]): CreateTicketArgs;
-export declare function runCreateTicket(args: string[]): Promise<void>;
-/**
- * Bare-mode entrypoint. Fetches the protocol body from the backend so we can
- * iterate on it without shipping a new CLI, substitutes the user's prompt,
- * and writes the result to stdout for the agent to follow. Hard-errors on
- * fetch failure rather than falling back to a stale local copy — the whole
- * point of moving the protocol server-side is that the freshest version is
- * the only version.
- */
-export declare function runBare(config: CodiedevConfig, prompt: string | undefined): Promise<void>;
-export declare function runSubmit(config: CodiedevConfig, rawJson: string): Promise<void>;
-export declare function readSubmitInput(source: "stdin" | string): string;
-export {};

package/dist/commands/createTicket.js

@@ -1,192 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.substitutePrompt = substitutePrompt;
-exports.validatePlanHasRepo = validatePlanHasRepo;
-exports.resolveRepoIds = resolveRepoIds;
-exports.parseCreateTicketArgs = parseCreateTicketArgs;
-exports.runCreateTicket = runCreateTicket;
-exports.runBare = runBare;
-exports.runSubmit = runSubmit;
-exports.readSubmitInput = readSubmitInput;
-const fs = __importStar(require("node:fs"));
-const shared_1 = require("./shared");
-const PROMPT_PLACEHOLDER = "{{USER_PROMPT}}";
-const MISSING_PROMPT_FALLBACK = "(not yet provided — ask the user a single combined question that covers both the intent AND repo locations: \"What are you working on, and is this in a single repo or multiple? If multiple, give me the paths.\" Skip Step 1 since you've folded it into this question. Then proceed to Step 2.)";
-function substitutePrompt(protocol, prompt) {
-    return protocol.replace(PROMPT_PLACEHOLDER, prompt && prompt.length > 0 ? prompt : MISSING_PROMPT_FALLBACK);
-}
-function validatePlanHasRepo(parsedPlan) {
-    const fullNames = Array.isArray(parsedPlan?.repoFullNames) ? parsedPlan.repoFullNames : [];
-    const explicitIds = Array.isArray(parsedPlan?.repoIds) ? parsedPlan.repoIds : [];
-    if (fullNames.length === 0 && explicitIds.length === 0) {
-        return "Plan must include at least one repo (repoFullNames: ['owner/name'] or repoIds: [...])";
-    }
-    return null;
-}
-function resolveRepoIds(fullNames, repos) {
-    const lookup = new Map();
-    for (const r of repos) {
-        lookup.set(r.fullName.toLowerCase(), r.repoId);
-    }
-    const ids = [];
-    for (const fn of fullNames) {
-        const id = lookup.get(fn.toLowerCase());
-        if (!id) {
-            throw new Error(`Repo "${fn}" is not connected to your Codiedev account. Run \`codiedev connect\` to refresh, or push the missing repo through Settings.`);
-        }
-        ids.push(id);
-    }
-    return ids;
-}
-function parseCreateTicketArgs(args) {
-    let mode = "bare";
-    let prompt;
-    let submitSource;
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a === "--submit" && i + 1 < args.length) {
-            mode = "submit";
-            const next = args[++i];
-            submitSource = next === "-" ? "stdin" : next;
-        }
-        else if (a.startsWith("--submit=")) {
-            mode = "submit";
-            const v = a.slice("--submit=".length);
-            submitSource = v === "-" ? "stdin" : v;
-        }
-        else if (!a.startsWith("--") && !prompt && mode === "bare") {
-            prompt = a;
-        }
-    }
-    return { mode, prompt, submitSource };
-}
-async function runCreateTicket(args) {
-    const parsed = parseCreateTicketArgs(args);
-    if (parsed.mode === "bare") {
-        const config = (0, shared_1.requireConfig)();
-        await runBare(config, parsed.prompt);
-        return;
-    }
-    // submit mode
-    if (!parsed.submitSource) {
-        console.error("--submit requires a path or '-' for stdin");
-        process.exit(1);
-    }
-    const config = (0, shared_1.requireConfig)();
-    let raw;
-    try {
-        raw = readSubmitInput(parsed.submitSource);
-    }
-    catch (err) {
-        console.error(`Failed to read plan: ${err.message}`);
-        process.exit(1);
-    }
-    // Translate fullNames → IDs before submitting
-    let parsedPlan;
-    try {
-        parsedPlan = JSON.parse(raw);
-    }
-    catch (err) {
-        console.error(`Plan JSON did not parse: ${err.message}`);
-        process.exit(1);
-    }
-    const validationError = validatePlanHasRepo(parsedPlan);
-    if (validationError) {
-        console.error(validationError);
-        process.exit(1);
-    }
-    const fullNames = Array.isArray(parsedPlan.repoFullNames) ? parsedPlan.repoFullNames : [];
-    const explicitIds = Array.isArray(parsedPlan.repoIds) ? parsedPlan.repoIds : [];
-    if (fullNames.length > 0 && explicitIds.length === 0) {
-        parsedPlan.repoIds = resolveRepoIds(fullNames, config.repos);
-    }
-    for (const t of parsedPlan.plan?.tickets ?? []) {
-        if (t.targetRepoFullName && !t.targetRepoId) {
-            const ids = resolveRepoIds([t.targetRepoFullName], config.repos);
-            t.targetRepoId = ids[0];
-        }
-    }
-    await runSubmit(config, JSON.stringify(parsedPlan));
-}
-/**
- * Bare-mode entrypoint. Fetches the protocol body from the backend so we can
- * iterate on it without shipping a new CLI, substitutes the user's prompt,
- * and writes the result to stdout for the agent to follow. Hard-errors on
- * fetch failure rather than falling back to a stale local copy — the whole
- * point of moving the protocol server-side is that the freshest version is
- * the only version.
- */
-async function runBare(config, prompt) {
-    let res;
-    try {
-        res = await (0, shared_1.apiRequest)("GET", "/api/cli/createTicketProtocol", { config });
-    }
-    catch (err) {
-        console.error(`Failed to fetch create-ticket protocol: ${err.message}. Check your network connection and re-run.`);
-        process.exit(1);
-    }
-    process.stdout.write(substitutePrompt(res.protocol, prompt));
-}
-async function runSubmit(config, rawJson) {
-    let payload;
-    try {
-        payload = JSON.parse(rawJson);
-    }
-    catch (err) {
-        throw new Error(`Plan JSON did not parse — emit valid JSON matching the schema printed by \`codiedev create-ticket\`. Original error: ${err.message}`);
-    }
-    if (!payload.plan || !payload.prompt || !payload.repoIds) {
-        throw new Error("Plan JSON missing one of: plan, prompt, repoIds");
-    }
-    const res = await (0, shared_1.withTelemetry)(config, "codiedev_create_ticket", () => (0, shared_1.apiRequest)("POST", "/api/cli/createPlan", {
-        config,
-        body: payload,
-    }));
-    const portalHost = (process.env.CODIEDEV_PORTAL_URL || "https://codiedev.com").replace(/\/$/, "");
-    const portalLink = res.portalUrl.startsWith("http")
-        ? res.portalUrl
-        : `${portalHost}${res.portalUrl}`;
-    console.log(`✓ Created ${res.ticketCount} ticket(s).`);
-    console.log(`  portal: ${portalLink}`);
-    console.log("");
-    console.log("Open in your portal to review and push to Jira.");
-}
-function readSubmitInput(source) {
-    if (source === "stdin") {
-        return fs.readFileSync(0, "utf8");
-    }
-    return fs.readFileSync(source, "utf8");
-}