@agentguard-run/burn 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.2 (2026-09-03)
+
+- Codex: `status` and `init codex --write` now say, every time, that the
+  hook must be trusted once with `/hooks` inside Codex. Verified that an
+  untrusted hook stalls `codex exec` with no output the first time a spawn
+  would be gated, from `hooks.json` and from `config.toml` alike.
+- Verified the installed Claude Code hook end to end from the global
+  install: 0.2s on a 1.95B-token transcript, decision recorded.
+
 ## 0.2.1 (2026-09-03)
 
 Finishing the product so it can be used, and a live Codex canary.

package/README.md

@@ -155,8 +155,15 @@ spawn through with the reason on the ledger. Two things the docs got wrong
 and the wire settled: the tool arrives as `spawn_agent` (the docs say it
 "matches as Agent"; the matcher covers both), and project-local hooks only
 load when the project is trusted. The captured payloads are in
-`fixtures/codex-0.151.0-pretooluse.json` and drive a test. After
-`init codex --write`, trust the hook once with `/hooks` inside Codex.
+`fixtures/codex-0.151.0-pretooluse.json` and drive a test.
+
+One step Codex makes you do by hand: after `init codex --write`, open
+`codex`, run `/hooks`, and trust the AgentGuard hook. Codex requires this
+once per hook source, and there is no CLI for it. Until it is done,
+`codex exec` stalls the first time a spawn would be gated (verified: it
+hangs with no output; the same with hooks defined in `config.toml`).
+`status` repeats this under the codex line because it cannot see whether
+trust was granted.
 
 **Cursor** is verified against the documented schema (`permission`,
 `user_message`, `agent_message`; `~/.cursor/hooks.json` with `failClosed`),

package/dist/src/cli.js

@@ -163,7 +163,7 @@ async function main(argv) {
                 process.stderr.write(`init: host must be claude, cursor or codex\n`);
                 return 64;
             }
-            const label = { claude: '', cursor: 'Cursor support is BETA: verified against the documented hook schema, not yet against every installed build. "failClosed": true means a crashed hook denies the subagent.', codex: 'Codex support is BETA: a live deny, allow and override canary passed on codex-cli 0.151.0; transcript usage is best-effort and marked estimated. Trust the hook once with /hooks inside Codex.' }[target];
+            const label = { claude: '', cursor: 'Cursor support is BETA: verified against the documented hook schema, not yet against every installed build. "failClosed": true means a crashed hook denies the subagent.', codex: 'Codex support is BETA: a live deny, allow and override canary passed on codex-cli 0.151.0; transcript usage is best-effort and marked estimated.\nONE MORE STEP: open codex, run /hooks, and trust the AgentGuard hook. Codex requires this once per hook source; until then `codex exec` stalls the first time a spawn would be gated.' }[target];
             const tail = `Installed in ${policy.mode} mode. Nothing is blocked until you run: agentguard-burn enforce\n`;
             if (has('--write')) {
                 let result;

package/dist/src/status.js

@@ -68,6 +68,12 @@ function renderHostHealth(hosts) {
         else
             state = `installed, hook command ok  (${h.file.replace(process.env.HOME ?? '', '~')})`;
         lines.push(`  ${name.padEnd(13)} ${state}`);
+        if (h.host === 'codex' && h.installed && h.commandExists) {
+            // Codex requires a one-time trust of each hook source. We cannot see
+            // whether it has been granted, and an untrusted hook stalls codex exec
+            // the first time it would fire, so say it every time.
+            lines.push(`  ${''.padEnd(13)} trust it once: open codex, run /hooks, trust the AgentGuard hook. Until then codex exec stalls when a spawn would be gated.`);
+        }
     }
     return lines.join('\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentguard-run/burn",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Local runaway-agent circuit breaker for AI coding agents and local model runtimes. One policy across Claude Code, Cursor, Codex, Ollama, vLLM, LM Studio and raw orchestrators: detects fan-out storms and sustained token burn, blocks the next spawn, and proves what happened with content-free signed receipts. Nothing leaves the machine.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",