codiedev 0.9.82 → 0.9.84

package/dist/cli.d.ts

@@ -9,6 +9,7 @@
  *   codiedev ping <user> "<msg>"       — send a message (optionally --with <key>)
  *   codiedev inbox                     — list pings (use --unread to filter)
  *   codiedev read <ping-id>            — mark read + show full message
+ *   codiedev reply <ping-id> "<msg>"   — answer a ping in its thread
  *   codiedev note "<text>"             — capture a thought
  *   codiedev help                      — show this help
  */

package/dist/cli.js

@@ -10,6 +10,7 @@
  *   codiedev ping <user> "<msg>"       — send a message (optionally --with <key>)
  *   codiedev inbox                     — list pings (use --unread to filter)
  *   codiedev read <ping-id>            — mark read + show full message
+ *   codiedev reply <ping-id> "<msg>"   — answer a ping in its thread
  *   codiedev note "<text>"             — capture a thought
  *   codiedev help                      — show this help
  */
@@ -53,8 +54,8 @@ const utils_1 = require("./utils");
 const push_1 = require("./commands/push");
 const delete_1 = require("./commands/delete");
 const pull_1 = require("./commands/pull");
-const ask_1 = require("./commands/ask");
 const ping_1 = require("./commands/ping");
+const reply_1 = require("./commands/reply");
 const inbox_1 = require("./commands/inbox");
 const note_1 = require("./commands/note");
 const doctor_1 = require("./commands/doctor");
@@ -100,19 +101,17 @@ Artifacts:
   codiedev delete <key> [-y]             Delete every version of an artifact you
                                          authored (clean up bad/test pushes).
                                          Asks for confirmation; -y to skip.
-  codiedev ask "<question>"              Ask a natural-language question of the
-                                         team's collective memory. Returns an
-                                         LLM-synthesized answer with citations
-                                         pointing at sessions + artifacts.
 
 Messaging:
-  codiedev ping <user> "<msg>" [--with <key>]
+  codiedev ping <user> "<msg>" [--with <key>] [--file <path>]
                                          Send a message to a teammate
   codiedev send <key> <user> ["<msg>"]   Share an artifact + ping in one step
   codiedev share <key> <user> [--role read|edit]
                                          Silently grant access (no notification)
   codiedev inbox [--unread] [--limit N]  Show messages
   codiedev read <ping-id>                Mark read + show full message
+  codiedev reply <ping-id> "<msg>" [--file <path>]
+                                         Answer a message in its thread
 
 Starter packs:
   codiedev pack list                     Packs assigned to your team
@@ -284,16 +283,36 @@ codiedev pull — fetch an artifact
 codiedev ping — send a teammate a message, optionally attached to an artifact
 
   Usage:
-    codiedev ping <user> "<message>" [--with <artifact-key>]
+    codiedev ping <user> "<message>" [--with <artifact-key>] [--file <path>]
 
   <user> resolves to a teammate in your org by first name, full name,
   or email. Ambiguous matches return a list — retry with the full email.
 
+  --file attaches a file (repeat for up to 10, 20 MB each). They see it
+  in their inbox and can open it in the portal.
+
   Teammates are notified by email and can reply from their own agent.
+  To answer a message you received, use 'codiedev reply' instead: it
+  keeps the exchange in one thread.
 
   Examples:
     codiedev ping <teammate> "thoughts on batch vs parallel?" --with spec-cart-clear.md
     codiedev ping <teammate>@example.com "can you take this one?"
+    codiedev ping <teammate> "shard timings from last night" --file ./timings.csv
+`.trim(),
+    reply: `
+codiedev reply — answer a message in its thread
+
+  Usage:
+    codiedev reply <ping-id> "<message>" [--file <path>]
+
+  Grab the ping-id from 'codiedev inbox'. The reply goes to whoever sent
+  that ping, stays in the same conversation, and marks their message
+  read and answered, so it stops showing as waiting on you.
+
+  Examples:
+    codiedev reply <ping-id> "yes, step 2 covers partial refunds"
+    codiedev reply <ping-id> "updated numbers attached" --file ./timings.csv
 `.trim(),
     inbox: `
 codiedev inbox — show messages from teammates
@@ -415,13 +434,12 @@ signal. The stored artifact type still follows the filename rule
 
 ## Portal
 
-Everything you do in the CLI is visible at:
+Messages you send and receive are also at:
 
     https://codiedev.com/portal/inbox
 
-Your CTO (or any non-technical teammate) can follow along without ever
-touching a terminal — they read the artifacts in the portal and get
-email notifications when pinged.
+A teammate can read and answer there without touching a terminal, and
+gets an email when pinged.
 
 ## Agent-native
 
@@ -564,8 +582,10 @@ async function main() {
                 await (0, pull_1.runPull)(rest);
                 return;
             case "ask":
-                await (0, ask_1.runAsk)(rest);
-                return;
+                // Removed 2026-11. Kept as a named case so the answer is a pointer,
+                // not "unknown command".
+                console.error('codiedev ask has been removed. Use: codiedev search "<query>"');
+                process.exit(1);
             case "ping":
                 await (0, ping_1.runPing)(rest);
                 return;
@@ -582,6 +602,9 @@ async function main() {
             case "read":
                 await (0, inbox_1.runRead)(rest);
                 return;
+            case "reply":
+                await (0, reply_1.runReply)(rest);
+                return;
             case "scrub": {
                 const { runScrubCommand } = await Promise.resolve().then(() => __importStar(require("./commands/scrub")));
                 process.exitCode = await runScrubCommand(rest);

package/dist/commands/inbox.js

@@ -107,7 +107,16 @@ async function runRead(args) {
         console.log();
         console.log(ping.body || "(empty)");
         console.log();
+        if (ping.attachments?.length) {
+            console.log(ping.attachments.length === 1 ? "File:" : "Files:");
+            for (const a of ping.attachments) {
+                console.log(`  ${(0, inboxFormat_1.fileList)([a])}`);
+                console.log(`    ${a.url ?? "(no longer stored)"}`);
+            }
+            console.log();
+        }
         console.log("✓ Marked as read");
+        console.log(`Reply: codiedev reply ${ping.pingId} "<message>"`);
         if (ping.subjectKey) {
             console.log(`Pull:  codiedev pull ${ping.subjectKey}`);
         }

package/dist/commands/ping.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPing = runPing;
 const shared_1 = require("./shared");
-function parseArgs(args) {
+const pingFiles_1 = require("./pingFiles");
+function parseArgs(allArgs) {
+    const { files, rest: args } = (0, pingFiles_1.takeFileArgs)(allArgs);
     let to;
     const positional = [];
     let subjectKey;
@@ -18,31 +20,33 @@ function parseArgs(args) {
             positional.push(a);
         }
     }
-    if (positional.length < 2) {
-        console.error("Usage: codiedev ping <user> \"<message>\" [--with <artifact-key>]");
+    // A file can stand in for the message.
+    if (positional.length < 2 && !(positional.length === 1 && files.length > 0)) {
+        console.error("Usage: codiedev ping <user> \"<message>\" [--with <artifact-key>] [--file <path>]");
         process.exit(1);
     }
     to = positional[0];
     // Join remaining positionals in case the shell split the message on spaces
     // despite quoting (happens with some escape sequences).
     const body = (0, shared_1.stripQuotes)(positional.slice(1).join(" "));
-    return { to, body, subjectKey };
+    return { to, body: body || (files.length ? "Sent a file." : ""), subjectKey, files };
 }
 async function runPing(args) {
-    const { to, body, subjectKey } = parseArgs(args);
+    const { to, body, subjectKey, files } = parseArgs(args);
     const config = (0, shared_1.requireConfig)();
     const start = Date.now();
     try {
+        const attachmentIds = await (0, pingFiles_1.uploadOrExit)(config, files);
         const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ping", {
             config,
-            body: { to, body, subjectKey },
+            body: { to, body, subjectKey, ...(attachmentIds.length ? { attachmentIds } : {}) },
         });
         (0, shared_1.recordAgentEvent)(config, {
             tool: "codiedev_ping",
             ok: true,
             latencyMs: Date.now() - start,
         });
-        console.log(`✓ Pinged ${res.recipient.name} <${res.recipient.email}>${subjectKey ? ` on ${subjectKey}` : ""}`);
+        console.log(`✓ Pinged ${res.recipient.name} <${res.recipient.email}>${subjectKey ? ` on ${subjectKey}` : ""}${files.length ? ` with ${files.length} file${files.length === 1 ? "" : "s"}` : ""}`);
     }
     catch (err) {
         const e = err;

package/dist/commands/pingFiles.d.ts

@@ -0,0 +1,22 @@
+import type { CodiedevConfig } from "../utils";
+export declare const MAX_PING_FILES = 10;
+export declare const MAX_PING_FILE_BYTES: number;
+export declare function contentTypeFor(fileName: string): string;
+export declare function formatBytes(bytes: number): string;
+/** Pull every `--file <path>` / `-f <path>` / `--file=<path>` out of argv,
+ *  returning the paths and the remaining args untouched. */
+export declare function takeFileArgs(args: string[]): {
+    files: string[];
+    rest: string[];
+};
+export type FileProblem = {
+    path: string;
+    reason: string;
+};
+/** Check every path before uploading any, so one bad path can't leave the
+ *  others uploaded and unsent. */
+export declare function checkFiles(paths: string[]): FileProblem[];
+/** Upload in order; the returned ids go in the ping's `attachmentIds`. */
+export declare function uploadPingFiles(config: CodiedevConfig, paths: string[]): Promise<string[]>;
+/** Validate, then upload. Prints the problems and exits on a bad path. */
+export declare function uploadOrExit(config: CodiedevConfig, paths: string[]): Promise<string[]>;

package/dist/commands/pingFiles.js

@@ -0,0 +1,155 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_PING_FILE_BYTES = exports.MAX_PING_FILES = void 0;
+exports.contentTypeFor = contentTypeFor;
+exports.formatBytes = formatBytes;
+exports.takeFileArgs = takeFileArgs;
+exports.checkFiles = checkFiles;
+exports.uploadPingFiles = uploadPingFiles;
+exports.uploadOrExit = uploadOrExit;
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const path_1 = __importDefault(require("path"));
+const version_1 = require("../version");
+// Files sent with `codiedev ping --file` / `codiedev reply --file`. The server
+// stores each one and hands back an id; the ping then names those ids. Limits
+// mirror the server's so a too-large file fails here, before the upload.
+exports.MAX_PING_FILES = 10;
+exports.MAX_PING_FILE_BYTES = 20 * 1024 * 1024;
+const CONTENT_TYPES = {
+    csv: "text/csv",
+    tsv: "text/tab-separated-values",
+    txt: "text/plain",
+    log: "text/plain",
+    md: "text/markdown",
+    json: "application/json",
+    yaml: "text/plain",
+    yml: "text/plain",
+    diff: "text/plain",
+    patch: "text/plain",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    pdf: "application/pdf",
+    zip: "application/zip",
+};
+function contentTypeFor(fileName) {
+    const ext = path_1.default.extname(fileName).slice(1).toLowerCase();
+    return CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${Math.round(bytes / 1024)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** Pull every `--file <path>` / `-f <path>` / `--file=<path>` out of argv,
+ *  returning the paths and the remaining args untouched. */
+function takeFileArgs(args) {
+    const files = [];
+    const rest = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if ((a === "--file" || a === "-f") && i + 1 < args.length)
+            files.push(args[++i]);
+        else if (a.startsWith("--file="))
+            files.push(a.slice("--file=".length));
+        else
+            rest.push(a);
+    }
+    return { files, rest };
+}
+/** Check every path before uploading any, so one bad path can't leave the
+ *  others uploaded and unsent. */
+function checkFiles(paths) {
+    const problems = [];
+    if (paths.length > exports.MAX_PING_FILES) {
+        problems.push({ path: "--file", reason: `at most ${exports.MAX_PING_FILES} files per message` });
+    }
+    for (const p of paths) {
+        let stat;
+        try {
+            stat = fs_1.default.statSync(p);
+        }
+        catch {
+            problems.push({ path: p, reason: "file not found" });
+            continue;
+        }
+        if (!stat.isFile())
+            problems.push({ path: p, reason: "not a file" });
+        else if (stat.size === 0)
+            problems.push({ path: p, reason: "file is empty" });
+        else if (stat.size > exports.MAX_PING_FILE_BYTES) {
+            problems.push({ path: p, reason: `larger than 20 MB (${formatBytes(stat.size)})` });
+        }
+    }
+    return problems;
+}
+function uploadOne(config, filePath) {
+    return new Promise((resolve, reject) => {
+        const name = path_1.default.basename(filePath);
+        const data = fs_1.default.readFileSync(filePath);
+        const url = new URL("/api/cli/ping-attachment", config.backendUrl);
+        url.searchParams.set("name", name);
+        const lib = url.protocol === "https:" ? https_1.default : http_1.default;
+        const req = lib.request({
+            hostname: url.hostname,
+            port: url.port || (url.protocol === "https:" ? 443 : 80),
+            path: url.pathname + url.search,
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${config.token}`,
+                "X-Codiedev-Cli-Version": version_1.CLI_VERSION,
+                "Content-Type": contentTypeFor(name),
+                "Content-Length": data.length,
+            },
+        }, (res) => {
+            let chunks = "";
+            res.on("data", (c) => (chunks += c));
+            res.on("end", () => {
+                let parsed = {};
+                try {
+                    parsed = chunks ? JSON.parse(chunks) : {};
+                }
+                catch {
+                    /* fall through to the status check */
+                }
+                if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300 && parsed.attachment?.id) {
+                    resolve(parsed.attachment.id);
+                }
+                else {
+                    reject(new Error(`${name}: ${parsed.error ?? `HTTP ${res.statusCode}`}`));
+                }
+            });
+        });
+        req.on("error", (err) => reject(new Error(`${name}: ${err.message}`)));
+        req.write(data);
+        req.end();
+    });
+}
+/** Upload in order; the returned ids go in the ping's `attachmentIds`. */
+async function uploadPingFiles(config, paths) {
+    const ids = [];
+    for (const p of paths)
+        ids.push(await uploadOne(config, p));
+    return ids;
+}
+/** Validate, then upload. Prints the problems and exits on a bad path. */
+async function uploadOrExit(config, paths) {
+    if (paths.length === 0)
+        return [];
+    const problems = checkFiles(paths);
+    if (problems.length) {
+        for (const p of problems)
+            console.error(`Can't attach ${p.path}: ${p.reason}`);
+        process.exit(1);
+    }
+    return await uploadPingFiles(config, paths);
+}

package/dist/commands/reply.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Answer a ping. Unlike a fresh `codiedev ping` back, this threads under the
+ * original and marks it read + replied, so it stops counting as waiting.
+ */
+export declare function runReply(args: string[]): Promise<void>;

package/dist/commands/reply.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runReply = runReply;
+const shared_1 = require("./shared");
+const pingFiles_1 = require("./pingFiles");
+const USAGE = 'Usage: codiedev reply <ping-id> "<message>" [--file <path>]';
+/**
+ * Answer a ping. Unlike a fresh `codiedev ping` back, this threads under the
+ * original and marks it read + replied, so it stops counting as waiting.
+ */
+async function runReply(args) {
+    const { files, rest } = (0, pingFiles_1.takeFileArgs)(args);
+    const positional = rest.filter((a) => !a.startsWith("--"));
+    const pingId = positional[0];
+    // Join the rest in case the shell split the message despite quoting.
+    const body = (0, shared_1.stripQuotes)(positional.slice(1).join(" "));
+    if (!pingId || (!body && files.length === 0)) {
+        console.error(USAGE);
+        process.exit(1);
+    }
+    const config = (0, shared_1.requireConfig)();
+    const start = Date.now();
+    try {
+        const attachmentIds = await (0, pingFiles_1.uploadOrExit)(config, files);
+        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/reply", {
+            config,
+            body: { pingId, body, ...(attachmentIds.length ? { attachmentIds } : {}) },
+        });
+        (0, shared_1.recordAgentEvent)(config, {
+            tool: "codiedev_reply",
+            ok: true,
+            latencyMs: Date.now() - start,
+        });
+        const to = res.recipient ? `${res.recipient.name} <${res.recipient.email}>` : "them";
+        const withFiles = files.length ? ` with ${files.length} file${files.length === 1 ? "" : "s"}` : "";
+        console.log(`✓ Replied to ${to}${withFiles}`);
+    }
+    catch (err) {
+        const e = err;
+        (0, shared_1.recordAgentEvent)(config, {
+            tool: "codiedev_reply",
+            ok: false,
+            latencyMs: Date.now() - start,
+            error: e.message,
+        });
+        if (e.status === 404 && /ping not found/.test(e.message)) {
+            console.error(`No ping ${pingId} addressed to you. Run 'codiedev inbox' for the ids.`);
+        }
+        else {
+            console.error(`Reply failed: ${e.message}`);
+        }
+        process.exit(1);
+    }
+}

package/dist/hook.js

@@ -54,6 +54,7 @@ const selfUpdate_1 = require("./selfUpdate");
 const version_1 = require("./version");
 // --- starter packs (SIG-113 phase 2): autosync, nudge ---
 const sync_1 = require("./packs/sync");
+const unreadNotice_1 = require("./unreadNotice");
 // --- end starter packs ---
 const captureLog_1 = require("./captureLog");
 const subagents_1 = require("./subagents");
@@ -267,25 +268,28 @@ async function postSessionSkip(config, sessionId, reason) {
 }
 // SessionStart: the capture-coverage denominator. Record that a session opened
 // so the backend can later compute captured ÷ started. Deliberately tiny — no
-// transcript read, no git — so it never slows session startup. Best-effort +
-// silent (SessionStart hook output is ignored by Claude Code).
+// transcript read, no git — so it never slows session startup. Best-effort.
+// The response may carry the person's unread-ping summary, which the caller
+// turns into a one-line notice; it rides on this request so the reminder
+// costs no extra round trip.
 async function runSessionStart(hookInput, source = "claude-code") {
     const config = (0, utils_1.readConfig)();
     if (!config)
-        return;
+        return undefined;
     if (hookInput.session_id) {
         try {
-            await postJson(`${config.backendUrl}/api/cli/sessionStart`, {
+            const res = await postJsonForResponse(`${config.backendUrl}/api/cli/sessionStart`, {
                 sessionId: hookInput.session_id,
                 startedAt: Date.now(),
                 source,
             }, config.token, PING_TIMEOUT_MS);
+            return res?.unreadPings;
         }
         catch {
             /* best-effort — never block session startup */
         }
     }
-    return;
+    return undefined;
 }
 function postJson(url, body, bearerToken, 
 // Socket timeout. Pass a SMALL value for tiny pings that run on (or near)
@@ -337,7 +341,10 @@ timeoutMs) {
 // postJson variant that returns the parsed response body — the upload-URL
 // handshake needs the { uploadUrl } the server hands back. No timeout: runs
 // only in detached uploader children, never on the shutdown clock.
-function postJsonForResponse(url, body, bearerToken) {
+function postJsonForResponse(url, body, bearerToken, 
+// Socket timeout for tiny pings on the session-start path: a black-holed
+// connection must not hang the hook. Unset = no timeout, as before.
+timeoutMs) {
     return new Promise((resolve, reject) => {
         const parsed = new URL(url);
         const data = JSON.stringify(body);
@@ -371,6 +378,11 @@ function postJsonForResponse(url, body, bearerToken) {
             });
         });
         req.on("error", reject);
+        if (timeoutMs) {
+            req.setTimeout(timeoutMs, () => {
+                req.destroy(new Error(`timeout after ${timeoutMs}ms`));
+            });
+        }
         req.write(data);
         req.end();
     });
@@ -658,7 +670,7 @@ async function main() {
         if (packNag && process.argv[2] === "session-start")
             process.stdout.write(`${packNag}\n`);
         // --- end starter packs ---
-        await runSessionStart(hookInput, process.argv[2] === "session-start-opencode"
+        const unreadPings = await runSessionStart(hookInput, process.argv[2] === "session-start-opencode"
             ? "opencode"
             : process.argv[2] === "session-start-cursor"
                 ? "cursor"
@@ -667,13 +679,21 @@ async function main() {
                     : process.argv[2] === "session-start-pi"
                         ? "pi"
                         : "claude-code");
+        // "A teammate is waiting on you." Claude Code reads SessionStart stdout
+        // into the session; Cursor and Copilot get it in their context below.
+        // OpenCode and pi ignore this hook's output, and Codex has no SessionStart.
+        const unreadNotice = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi"
+            ? null
+            : (0, unreadNotice_1.takeUnreadNotice)(unreadPings);
+        if (unreadNotice && process.argv[2] === "session-start")
+            process.stdout.write(`${unreadNotice}\n`);
         if ((0, utils_1.readConfig)() && (process.argv[2] === "session-start-cursor" || process.argv[2] === "session-start-copilot")) {
             const source = process.argv[2] === "session-start-cursor" ? "cursor" : "copilot";
             const { TEAM_SKILL_CONTEXT, teamSkillSessionOutput } = await Promise.resolve().then(() => __importStar(require("./teamSkillContext")));
             const prompt = hookInput.initialPrompt
                 ?? hookInput.initial_prompt;
             const discovered = typeof prompt === "string" ? await discoverContext(prompt) : null;
-            process.stdout.write(JSON.stringify(teamSkillSessionOutput(source, [TEAM_SKILL_CONTEXT, discovered, packNag].filter(Boolean).join("\n\n"))));
+            process.stdout.write(JSON.stringify(teamSkillSessionOutput(source, [TEAM_SKILL_CONTEXT, discovered, packNag, unreadNotice].filter(Boolean).join("\n\n"))));
         }
         return;
     }

package/dist/inboxFormat.d.ts

@@ -11,7 +11,17 @@ export interface InboxPing {
         title?: string;
     } | null;
     preview: string;
+    attachments?: Array<{
+        name: string;
+        size: number;
+        url?: string | null;
+    }>;
 }
+/** "shard-timings.csv (66 B), trace.log (1.2 MB)" */
+export declare function fileList(files: Array<{
+    name: string;
+    size: number;
+}>): string;
 export interface InboxMention {
     mentionId: string;
     createdAt: number;

package/dist/inboxFormat.js

@@ -1,7 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileList = fileList;
 exports.formatInbox = formatInbox;
 const shared_1 = require("./commands/shared");
+function fileSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${Math.round(bytes / 1024)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** "shard-timings.csv (66 B), trace.log (1.2 MB)" */
+function fileList(files) {
+    return files.map((f) => `${f.name} (${fileSize(f.size)})`).join(", ");
+}
 /**
  * Render the inbox for BOTH surfaces — `codiedev inbox` and the MCP
  * `codiedev_inbox` tool an agent calls for "any messages?". Shared so the
@@ -47,6 +59,9 @@ function formatInbox(opts) {
         const where = p.subjectKey ? ` · on ${p.subjectKey}` : "";
         lines.push(`${dot}  ${from}${where} · ${(0, shared_1.timeAgo)(p.createdAt)}`);
         lines.push(`    ${p.preview || "(no body)"}`);
+        if (p.attachments?.length) {
+            lines.push(`    ${p.attachments.length === 1 ? "file" : "files"}: ${fileList(p.attachments)}`);
+        }
         lines.push(`    id: ${p.pingId}`);
         lines.push("");
     }
@@ -63,7 +78,9 @@ function formatInbox(opts) {
             lines.push(`    ${m.url}`);
         lines.push("");
     }
-    if (keptPings.length > 0)
+    if (keptPings.length > 0) {
         lines.push("Mark read: codiedev read <ping-id>");
+        lines.push('Reply:     codiedev reply <ping-id> "<message>"');
+    }
     return lines;
 }

package/dist/launcher.d.ts

@@ -8,9 +8,14 @@ export declare function launcherPath(): string;
 /** True iff `cmd` invokes the stable launcher (from any state dir). */
 export declare function usesLauncher(cmd: string | undefined): boolean;
 export declare function readInstallRecord(): InstallRecord | null;
+/** True if `p` is inside the OS temp folder (real paths, so /var vs /private/var on macOS match). */
+export declare function isInTempDir(p: string, tmp?: string): boolean;
 /**
  * The hook script worth recording: absolute and present, and a global install over an npx cache
  * copy (npm prunes ~/.npm/_npx, and hooks pointed there go quietly dead). Null = don't record.
+ * Never a build in the temp folder: test runs stage one there, delete it, and if that landed in
+ * the real install.json every hook went quietly dead. CODIEDEV_ALLOW_TEMP_HOOK=1 (the CLI's own
+ * test setup) lets sandboxed tests use one.
  */
 export declare function stableHookScript(hookScript: string, globalCandidates?: string[]): string | null;
 /** Point the launcher at `hookScript`. Atomic, so a hook mid-launch never reads half a file. */

package/dist/launcher.js

@@ -48,16 +48,18 @@ exports.LAUNCHER_FILE = void 0;
 exports.launcherPath = launcherPath;
 exports.usesLauncher = usesLauncher;
 exports.readInstallRecord = readInstallRecord;
+exports.isInTempDir = isInTempDir;
 exports.stableHookScript = stableHookScript;
 exports.recordCurrentInstall = recordCurrentInstall;
 exports.ensureLauncher = ensureLauncher;
 exports.resetLauncherCacheForTests = resetLauncherCacheForTests;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const configDir_1 = require("./configDir");
 exports.LAUNCHER_FILE = "codiedev-hook-launcher.cjs";
 // Bump when LAUNCHER_SOURCE changes so existing launchers get rewritten.
-const LAUNCHER_REVISION = 1;
+const LAUNCHER_REVISION = 2;
 function launcherPath() {
     return path.join((0, configDir_1.codiedevStateDir)(), "bin", exports.LAUNCHER_FILE);
 }
@@ -85,6 +87,12 @@ try {
   if (rec && typeof rec.hookScript === "string" && fs.existsSync(rec.hookScript)) target = rec.hookScript;
 } catch {}
 if (!target && fs.existsSync(FALLBACK)) target = FALLBACK;
+if (!target) {
+  // Both stranded (e.g. a deleted temp build): use a global install next to this node.
+  const prefix = path.dirname(path.dirname(process.execPath));
+  target = [path.join(prefix, "lib", "node_modules", "codiedev", "dist", "hook.js"),
+    path.join(prefix, "node_modules", "codiedev", "dist", "hook.js")].find((p) => fs.existsSync(p)) || null;
+}
 if (!target) process.exit(0);
 process.env.CODIEDEV_VIA_LAUNCHER = "1";
 process.argv[1] = target;
@@ -115,15 +123,34 @@ function packageVersionFor(hookScript) {
         return undefined;
     }
 }
+/** True if `p` is inside the OS temp folder (real paths, so /var vs /private/var on macOS match). */
+function isInTempDir(p, tmp = os.tmpdir()) {
+    const real = (x) => {
+        try {
+            return fs.realpathSync(x);
+        }
+        catch {
+            return path.resolve(x);
+        }
+    };
+    const rel = path.relative(real(tmp), real(p));
+    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
 /**
  * The hook script worth recording: absolute and present, and a global install over an npx cache
  * copy (npm prunes ~/.npm/_npx, and hooks pointed there go quietly dead). Null = don't record.
+ * Never a build in the temp folder: test runs stage one there, delete it, and if that landed in
+ * the real install.json every hook went quietly dead. CODIEDEV_ALLOW_TEMP_HOOK=1 (the CLI's own
+ * test setup) lets sandboxed tests use one.
  */
 function stableHookScript(hookScript, globalCandidates = globalHookScripts()) {
     if (!hookScript || !path.isAbsolute(hookScript) || hookScript.includes(`${path.sep}~${path.sep}`))
         return null;
     if (!fs.existsSync(hookScript))
         return null;
+    if (process.env.CODIEDEV_ALLOW_TEMP_HOOK !== "1" && isInTempDir(hookScript)) {
+        return globalCandidates.find((p) => path.isAbsolute(p) && fs.existsSync(p) && !isInTempDir(p)) ?? null;
+    }
     if (hookScript.includes(`${path.sep}_npx${path.sep}`)) {
         const global = globalCandidates.find((p) => path.isAbsolute(p) && fs.existsSync(p));
         if (global)

package/dist/mcp.js

@@ -291,9 +291,7 @@ const TOOLS = [
             "when the user asks 'has anyone solved X?', 'find me the spec on Y', " +
             "or 'look for prior work on Z'. Always search before pushing a new " +
             "artifact so the user doesn't duplicate work. Returns ranked hits " +
-            "with title, type, filename key, and a snippet. For open-ended " +
-            "questions where the user wants a synthesized answer (not just a list " +
-            "of hits), prefer codiedev_ask instead.",
+            "with title, type, filename key, and a snippet.",
         inputSchema: {
             type: "object",
             properties: {
@@ -303,32 +301,6 @@ const TOOLS = [
             required: ["query"],
         },
     },
-    {
-        name: "codiedev_ask",
-        description: "Ask a natural-language question of the team's collective memory and " +
-            "get a synthesized answer with citations. Searches across both " +
-            "auto-extracted artifacts (specs / decisions / bugfixes) AND raw " +
-            "session transcripts, then has an LLM compose an answer that cites " +
-            "the actual sources. Use when the user asks 'why did we…?', 'what " +
-            "does the team know about X?', 'has anyone done Y here before?', " +
-            "'who decided Z and why?', or any open-ended question about prior " +
-            "work where they want context, not just a hit list. For exact-match " +
-            "lookups (find me spec-x), prefer codiedev_pull. For browsing or " +
-            "filtering by kind/tag, prefer codiedev_get_library. For surfacing " +
-            "ranked hits without LLM synthesis, prefer codiedev_search.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                question: {
-                    type: "string",
-                    description: "Natural-language question. Open-ended is fine — e.g. 'why " +
-                        "did we drop pg-bouncer?' or 'how does the team think about " +
-                        "feature flags?'.",
-                },
-            },
-            required: ["question"],
-        },
-    },
     {
         name: "codiedev_get_library",
         description: "List artifacts in the team library — both docs (spec / decision / " +
@@ -467,8 +439,6 @@ async function dispatchTool(name, args, config) {
             return await handleShareWith(args, config);
         case "codiedev_send_to":
             return await handleSendTo(args, config);
-        case "codiedev_ask":
-            return await handleAsk(args, config);
         case "codiedev_search":
             return await handleSearch(args, config);
         case "codiedev_get_library":
@@ -740,23 +710,6 @@ async function handleSearch(args, config) {
     }
     return { content: [{ type: "text", text: lines.join("\n") }] };
 }
-async function handleAsk(args, config) {
-    const question = asString(args.question);
-    if (!question)
-        throw new Error("question required");
-    const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ask", { config, body: { question } });
-    const lines = [res.answer];
-    if (res.citations && res.citations.length > 0) {
-        lines.push("", "Sources:");
-        for (const c of res.citations) {
-            const label = c.kind === "artifact"
-                ? `[${c.type}] ${c.title}`
-                : `[session] ${c.title}`;
-            lines.push(`  • ${label}`);
-        }
-    }
-    return { content: [{ type: "text", text: lines.join("\n") }] };
-}
 async function handleGetLibrary(args, config) {
     const scope = asStringOrUndefined(args.scope);
     const type = asStringOrUndefined(args.type);

package/dist/teamSkillContext.d.ts

@@ -1,5 +1,5 @@
 /** Session-start context uses each client's supported output contract. */
-export declare const TEAM_SKILL_CONTEXT = "This machine is connected to Codiedev, the team's artifact and skill library.\nBefore a substantial coding task, run codiedev search \"<brief task description>\" and reuse a relevant team skill by running codiedev pull <exact-key> and following its instructions. If no skill fits, continue the task.\nUse codiedev push <file.md> to share an artifact when asked, codiedev ask \"<question>\" for team knowledge, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.";
+export declare const TEAM_SKILL_CONTEXT = "This machine is connected to Codiedev, the team's artifact and skill library.\nBefore a substantial coding task, run codiedev search \"<brief task description>\" and reuse a relevant team skill by running codiedev pull <exact-key> and following its instructions. If no skill fits, continue the task.\nUse codiedev push <file.md> to share an artifact when asked, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.";
 export declare function teamSkillSessionOutput(source: "cursor" | "copilot", context?: string): {
     additional_context: string;
     additionalContext?: undefined;

package/dist/teamSkillContext.js

@@ -5,7 +5,7 @@ exports.teamSkillSessionOutput = teamSkillSessionOutput;
 /** Session-start context uses each client's supported output contract. */
 exports.TEAM_SKILL_CONTEXT = `This machine is connected to Codiedev, the team's artifact and skill library.
 Before a substantial coding task, run codiedev search "<brief task description>" and reuse a relevant team skill by running codiedev pull <exact-key> and following its instructions. If no skill fits, continue the task.
-Use codiedev push <file.md> to share an artifact when asked, codiedev ask "<question>" for team knowledge, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.`;
+Use codiedev push <file.md> to share an artifact when asked, and codiedev inbox to check messages. Use codiedev --help for other commands. If codiedev is unavailable, use npx codiedev@latest.`;
 function teamSkillSessionOutput(source, context = exports.TEAM_SKILL_CONTEXT) {
     return source === "cursor" ? { additional_context: context } : { additionalContext: context };
 }

package/dist/unreadNotice.d.ts

@@ -0,0 +1,22 @@
+export interface UnreadPings {
+    count: number;
+    newestPingId: string | null;
+    from: string[];
+    senderCount?: number;
+}
+/** Repeat an unchanged notice at most this often. A new ping always shows. */
+export declare const UNREAD_NOTICE_INTERVAL_MS: number;
+export declare function parseUnreadPings(value: unknown): UnreadPings | null;
+/** The line added to the session's context. Written for the agent: it says
+ *  what is waiting and what to do about it. */
+export declare function unreadNoticeLine(u: UnreadPings): string;
+/**
+ * Returns the notice to print, or null. Shown when the newest unread ping is
+ * one we haven't announced, or the same pile is still there a day later.
+ * Records that it spoke; any failure is silent — never slow or break a
+ * session start over a reminder.
+ */
+export declare function takeUnreadNotice(value: unknown, options?: {
+    dir?: string;
+    now?: number;
+}): string | null;

package/dist/unreadNotice.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNREAD_NOTICE_INTERVAL_MS = void 0;
+exports.parseUnreadPings = parseUnreadPings;
+exports.unreadNoticeLine = unreadNoticeLine;
+exports.takeUnreadNotice = takeUnreadNotice;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const configDir_1 = require("./configDir");
+/** Repeat an unchanged notice at most this often. A new ping always shows. */
+exports.UNREAD_NOTICE_INTERVAL_MS = 20 * 60 * 60 * 1000;
+const STATE_FILE = "unread-notice.json";
+function parseUnreadPings(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const v = value;
+    if (typeof v.count !== "number" || !Number.isFinite(v.count) || v.count <= 0)
+        return null;
+    return {
+        count: Math.floor(v.count),
+        newestPingId: typeof v.newestPingId === "string" ? v.newestPingId : null,
+        from: Array.isArray(v.from) ? v.from.filter((n) => typeof n === "string" && n.trim() !== "") : [],
+        senderCount: typeof v.senderCount === "number" ? v.senderCount : undefined,
+    };
+}
+function nameList(from, senderCount) {
+    if (from.length === 0)
+        return "";
+    const others = Math.max(0, senderCount - from.length);
+    const names = others > 0 ? [...from, `${others} other${others === 1 ? "" : "s"}`] : from;
+    if (names.length === 1)
+        return ` from ${names[0]}`;
+    return ` from ${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
+/** The line added to the session's context. Written for the agent: it says
+ *  what is waiting and what to do about it. */
+function unreadNoticeLine(u) {
+    const who = nameList(u.from, u.senderCount ?? u.from.length);
+    return (`Codiedev: ${u.count} unread message${u.count === 1 ? "" : "s"}${who}. ` +
+        "Tell the user at the start of your first reply, and offer to show them with `codiedev inbox --unread`. " +
+        'Answer one with `codiedev reply <ping-id> "<message>"`.');
+}
+function readState(dir) {
+    try {
+        const raw = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, STATE_FILE), "utf8"));
+        if (typeof raw?.at !== "number")
+            return null;
+        return { newestPingId: typeof raw.newestPingId === "string" ? raw.newestPingId : null, at: raw.at };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Returns the notice to print, or null. Shown when the newest unread ping is
+ * one we haven't announced, or the same pile is still there a day later.
+ * Records that it spoke; any failure is silent — never slow or break a
+ * session start over a reminder.
+ */
+function takeUnreadNotice(value, options = {}) {
+    try {
+        const unread = parseUnreadPings(value);
+        if (!unread)
+            return null;
+        const dir = options.dir ?? (0, configDir_1.codiedevStateDir)();
+        const now = options.now ?? Date.now();
+        const last = readState(dir);
+        const sameNewest = !!last && last.newestPingId === unread.newestPingId;
+        if (sameNewest && last.at <= now && now - last.at < exports.UNREAD_NOTICE_INTERVAL_MS)
+            return null;
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dir, STATE_FILE), JSON.stringify({ newestPingId: unread.newestPingId, at: now }));
+        return unreadNoticeLine(unread);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils.js

@@ -1673,14 +1673,14 @@ thought, use the \`codiedev\` CLI via Bash:**
 | "push this spec" / "save this as a skill" | \`codiedev push <file.md>\` |
 | "pull X" / "grab the latest spec-X" / "what did a teammate push?" | \`codiedev pull <key>\` |
 | "delete X" / "remove that test push" / "rm spec-old" | \`codiedev delete <key>\` (always confirm with the user first) |
-| "ping a teammate about this" / "ask someone for their take" | \`codiedev ping <name> "<msg>" [--with <key>]\` |
+| "ping a teammate about this" / "ask someone for their take" / "send them this file" | \`codiedev ping <name> "<msg>" [--with <key>] [--file <path>]\` |
 | "any messages?" / "check my inbox" / "what did a teammate say?" | \`codiedev inbox\` |
 | "read that reply" / "mark that ping read" | \`codiedev read <ping-id>\` |
+| "reply to that" / "tell them X" (answering a message from \`codiedev inbox\`) | \`codiedev reply <ping-id> "<msg>" [--file <path>]\` (not a new ping: this threads it and marks theirs answered) |
 | "note that X is a follow-up" / "remember X" | \`codiedev note "<text>"\` |
 | "share with a teammate" / "give someone access" (no notification) | \`codiedev share <key> <name> [--role read\\|edit]\` |
 | "send this to a teammate" / "ask someone to look at this" | \`codiedev send <key> <name> ["<msg>"]\` |
 | "find something about X" / "has anyone solved Y?" | \`codiedev search "<query>" [--limit N]\` |
-| "why did we…?" / "what does the team know about X?" | \`codiedev ask "<question>"\` (synthesized answer + citations) |
 | "show my library" / "what artifacts exist?" | \`codiedev library [--scope mine\\|shared\\|all] [--kind doc\\|skill]\` |
 | "run my agent's test cases" / "check the dataset on model Y" / "run v2 of the dataset" | \`codiedev traces cases <agent> [--dataset <name> [--version <n>]] [--model <id>]\` (writes cases + RUN_CASES.md + results.json; follow it, then \`codiedev traces report <results.json>\`) |
 | "how are my agents doing?" / "what's failing this week?" / "show the booking agent's failed runs" / "why did run X fail?" | \`codiedev traces overview\`; \`codiedev traces runs <agent> [--failed] [--flag <issue>] [--days n]\`; \`codiedev traces run <run> --agent <name>\` (add \`--json\` to read the data yourself) |
@@ -1695,9 +1695,10 @@ thought, use the \`codiedev\` CLI via Bash:**
 is classified into one of two kinds at upload time:
 
 - **skill** — the file has SKILL.md frontmatter (\`name:\` + \`description:\`
-  inside a \`---\` block). Lands under \`Artifacts → Skills tab\` and is
+  inside a \`---\` block). Shows on the Skills page in the portal and is
   invokable as a slash command (\`/<name>\`).
-- **doc** — everything else. Lands under \`Artifacts → My artifacts\`.
+- **doc** — everything else. Lives in the library: list it with
+  \`codiedev library\`, fetch it with \`codiedev pull <key>\`.
 
 Detection is content-based, not filename-based. The filename prefix
 (\`spec-\` / \`decision-\` / \`proposal-\` / \`bugfix-\` / \`review-\` /

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.82",
+  "version": "0.9.84",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",

package/dist/commands/ask.d.ts

@@ -1 +0,0 @@
-export declare function runAsk(args: string[]): Promise<void>;

package/dist/commands/ask.js

@@ -1,58 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runAsk = runAsk;
-const shared_1 = require("./shared");
-function parseArgs(args) {
-    // Everything after the command, joined back into a question string. Allows
-    // both quoted and unquoted forms: `codiedev ask "why pg-bouncer?"` or
-    // `codiedev ask why did we drop pg-bouncer`.
-    const question = args
-        .filter((a) => !a.startsWith("--"))
-        .join(" ")
-        .trim();
-    if (!question) {
-        console.error('Usage: codiedev ask "<question>"');
-        console.error('Example: codiedev ask "why did we drop pg-bouncer?"');
-        process.exit(1);
-    }
-    return { question };
-}
-async function runAsk(args) {
-    const { question } = parseArgs(args);
-    const config = (0, shared_1.requireConfig)();
-    const start = Date.now();
-    try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ask", {
-            config,
-            body: { question },
-        });
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_ask",
-            ok: true,
-            latencyMs: Date.now() - start,
-        });
-        console.log("");
-        console.log(res.answer);
-        if (res.citations.length > 0) {
-            console.log("");
-            console.log("Sources:");
-            for (const c of res.citations) {
-                const label = c.kind === "artifact"
-                    ? `[${c.type}] ${c.title}`
-                    : `[session] ${c.title}`;
-                console.log(`  • ${label}`);
-            }
-        }
-        console.log("");
-    }
-    catch (err) {
-        (0, shared_1.recordAgentEvent)(config, {
-            tool: "codiedev_ask",
-            ok: false,
-            latencyMs: Date.now() - start,
-            error: err.message,
-        });
-        console.error(`Ask failed: ${err.message}`);
-        process.exit(1);
-    }
-}