@aimarket/warden 0.23.0 → 0.24.0

package/codex-hooks/scripts/flow-guard-state.mjs

@@ -0,0 +1,129 @@
+// GENERATED from src/flow-guard-state.ts by scripts/sync-flow-guard.mjs. Do not edit; run npm run build.
+/** Flow guard: per-session state under a lock, fingerprint files and the session log. */
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { flowPaths, stateDir, sessionKey } from './flow-guard-paths.mjs';
+import { MAX_TEXT } from './flow-guard-text.mjs';
+import { secretPattern } from './flow-guard-fingerprints.mjs';
+import { MAX_FRAGMENT_INDEX, MAX_FRAGMENT_SEEN, SHORT_SIZES } from './flow-guard-fragments.mjs';
+const MAX_SOURCES = 20;
+const MAX_PRIVATE = 50;
+const MAX_FP_BYTES = 32 * 1_048_576;
+export const EMPTY = { v: 1, untrusted: [], private: [], notified: false, full: false };
+export function readFlowState(path) {
+    try {
+        const s = JSON.parse(readFileSync(path, 'utf8'));
+        if (!s || s.v !== 1 || !Array.isArray(s.untrusted) || !Array.isArray(s.private))
+            throw new Error('invalid flow state');
+        if (s.credentialRead !== undefined && s.credentialRead !== true || s.credentialGrants !== undefined && (!Array.isArray(s.credentialGrants) || s.credentialGrants.length > 32 || !s.credentialGrants.every(v => typeof v === 'string' && /^[0-9a-f]{64}$/.test(v))))
+            throw new Error('invalid credential egress state');
+        if (s.answerReview !== undefined) {
+            const review = s.answerReview;
+            if (!review || !Number.isSafeInteger(review.turn) || review.turn < 1 || typeof review.discloseInstruction !== 'boolean' || !Array.isArray(review.sources) || review.sources.length > 4 ||
+                !review.sources.every(source => typeof source === 'string' && /^source-[0-9a-f]{16}$/.test(source)) || review.factsSha256 !== undefined && (typeof review.factsSha256 !== 'string' || !/^[0-9a-f]{64}$/.test(review.factsSha256)))
+                throw new Error('invalid answer review state');
+            if (review.constraintViolations !== undefined && (!Number.isSafeInteger(review.constraintViolations) || review.constraintViolations < 0 || review.constraintViolations > 2064))
+                throw new Error('invalid answer review constraints');
+        }
+        if (s.fragments !== undefined) {
+            const f = s.fragments;
+            if (!f || ![1, 2].includes(f.v))
+                throw new Error('invalid fragment state');
+            const valid = (r) => {
+                if (!r || typeof r.group !== 'string' || !/^[0-9a-f]{32}$/.test(r.group) || typeof r.hash !== 'string' || !/^[0-9a-f]{32}$/.test(r.hash) ||
+                    !Number.isSafeInteger(r.offset) || r.offset < 0 || r.offset > MAX_TEXT || r.edge !== undefined && r.edge !== true)
+                    return false;
+                if (f.v === 1)
+                    return r.size === undefined || Number.isSafeInteger(r.size) && r.size >= 1 && r.size <= 64;
+                return typeof r.size === 'number' && Number.isSafeInteger(r.size) && (r.edge ? r.size >= 5 && r.size <= 64 : SHORT_SIZES.includes(r.size));
+            };
+            if (!Array.isArray(f.index) || f.index.length > MAX_FRAGMENT_INDEX || !f.index.every(valid) ||
+                !Array.isArray(f.seen) || f.seen.length > MAX_FRAGMENT_SEEN || !f.seen.every(valid) || f.full !== undefined && f.full !== true)
+                throw new Error('invalid fragment state');
+        }
+        return s;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { ...EMPTY, untrusted: [], private: [] };
+        throw new Error('flow state cannot be read safely');
+    }
+}
+function withLock(path, action) {
+    const lock = `${path}.lock`;
+    let fd;
+    const deadline = Date.now() + 3000;
+    while (fd === undefined) {
+        try {
+            fd = openSync(lock, 'wx', 0o600);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            // A lock older than 10 s is a crashed hook: take it over rather than wedge the session.
+            try {
+                if (Date.now() - statSync(lock).mtimeMs > 10_000)
+                    unlinkSync(lock);
+            }
+            catch { /* raced */ }
+            if (Date.now() > deadline)
+                throw new Error('flow state is locked');
+            const until = Date.now() + 15;
+            while (Date.now() < until) { /* short spin; hooks are short-lived */ }
+        }
+    }
+    try {
+        return action();
+    }
+    finally {
+        closeSync(fd);
+        try {
+            unlinkSync(lock);
+        }
+        catch { /* gone */ }
+    }
+}
+function writeAtomic(path, value) {
+    const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temp, JSON.stringify(value), { mode: 0o600 });
+    renameSync(temp, path);
+}
+export function updateFlowState(path, change) {
+    return withLock(path, () => {
+        const s = readFlowState(path);
+        change(s);
+        s.untrusted = s.untrusted.slice(-MAX_SOURCES);
+        s.private = s.private.slice(-MAX_PRIVATE);
+        writeAtomic(path, s);
+        return s;
+    });
+}
+export function appendFp(path, fps) {
+    if (!fps.length)
+        return true;
+    let size = 0;
+    try {
+        size = statSync(path).size;
+    }
+    catch { /* new */ }
+    if (size > MAX_FP_BYTES)
+        return false;
+    appendFileSync(path, fps.join('\n') + '\n', { mode: 0o600 });
+    return true;
+}
+export function log(paths, entry) {
+    try {
+        mkdirSync(paths.dir, { recursive: true, mode: 0o700 });
+        appendFileSync(paths.log, JSON.stringify({ at: new Date().toISOString(), ...entry }) + '\n', { mode: 0o600 });
+    }
+    catch { /* best effort */ }
+}
+export function safeToolName(name) {
+    return /^[A-Za-z0-9_.:-]{1,100}$/.test(name) && !secretPattern([name]) ? name : '[unrecognized tool name]';
+}
+/** Display correlation only, never a pin or authority. No server-authored words. */
+export function warningSourceId(name) {
+    return `source-${sessionKey(name).slice(0, 16)}`;
+}
+export function flowStateExists(sessionId, env = process.env) {
+    return existsSync(flowPaths(stateDir(env), sessionId).state);
+}

package/codex-hooks/scripts/flow-guard-text.mjs

@@ -0,0 +1,46 @@
+// GENERATED from src/flow-guard-text.ts by scripts/sync-flow-guard.mjs. Do not edit; run npm run build.
+/** Flow guard: the text a call carries or a result returns, and the hosts named in it. */
+export const MAX_TEXT = 1_048_576;
+export function strings(value, out = [], budget = { left: MAX_TEXT }) {
+    if (budget.left <= 0)
+        return out;
+    if (typeof value === 'string') {
+        out.push(value.slice(0, budget.left));
+        budget.left -= value.length;
+    }
+    else if (Array.isArray(value)) {
+        // Explicit numeric arrays are another spelling of character codes. Never stringify arbitrary objects.
+        if (value.length >= 5 && value.length <= 4096 && value.every(v => typeof v === 'number' && Number.isSafeInteger(v)))
+            strings(value.join(' '), out, budget);
+        else
+            for (const v of value)
+                strings(v, out, budget);
+    }
+    else if (value && typeof value === 'object') {
+        const o = value;
+        for (const [key, v] of Object.entries(o)) {
+            if (budget.omitBinary && key === 'data' && (o.type === 'image' || o.type === 'audio'))
+                continue;
+            strings(v, out, budget);
+        }
+    }
+    return out;
+}
+// MCP binary blocks are not text. Their base64 must not exhaust the text budget before a screen's labels,
+// titles or JSON text blocks are read. Arguments still use strings() without this exemption: an outgoing
+// credential disguised as an image's data is still a credential leaving the session.
+export function responseStrings(value) {
+    return strings(value, [], { left: MAX_TEXT, omitBinary: true });
+}
+const URL_RE = /\b(?:https?|ftp|wss?):\/\/[^\s<>"']+/gi;
+export function hostsIn(texts) {
+    const hosts = new Set();
+    for (const t of texts)
+        for (const m of t.matchAll(URL_RE)) {
+            try {
+                hosts.add(new URL(m[0]).hostname.toLowerCase().replace(/\.$/, ''));
+            }
+            catch { /* an invalid URL grants no host permission */ }
+        }
+    return [...hosts];
+}

package/codex-hooks/scripts/flow-guard-types.mjs

@@ -0,0 +1,2 @@
+// GENERATED from src/flow-guard-types.ts by scripts/sync-flow-guard.mjs. Do not edit; run npm run build.
+export {};

package/codex-hooks/scripts/flow-guard-unattended.mjs

@@ -0,0 +1,22 @@
+// GENERATED from src/flow-guard-unattended.ts by scripts/sync-flow-guard.mjs. Do not edit; run npm run build.
+/** Reasons that are about data, never only about an action. */
+export const DATA_REASONS = new Set(['protected_settings', 'secret', 'secret_fragment',
+    'paste_after_secret', 'payload_incomplete', 'secret_tracking', 'personal_data', 'private_text', 'credential_egress',
+    'secret_to_file']);
+/** Whether an unattended run must refuse this decision. */
+export function refuses(decision, detail, block) {
+    if (decision.permissionDecision === 'deny' || block === 'all')
+        return true;
+    return !!detail.sensitive || (detail.reason !== undefined && DATA_REASONS.has(detail.reason));
+}
+/** `data` or `all` from an environment value; anything else is undefined. */
+export function blockMode(value) {
+    return value === 'all' || value === 'data' ? value : undefined;
+}
+/** File paths an apply_patch text adds, updates, moves or deletes. */
+export function patchFiles(patch) {
+    const out = [];
+    for (const m of patch.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$|^\*\*\* Move to: (.+)$/gm))
+        out.push((m[1] ?? m[2]).trim());
+    return [...new Set(out)];
+}

package/codex-hooks/scripts/flow-guard.mjs

@@ -0,0 +1,103 @@
+// GENERATED from src/flow-guard.ts by scripts/sync-flow-guard.mjs. Do not edit; run npm run build.
+/**
+ * Flow guard: break the "lethal trifecta" inside a running Claude Code session.
+ *
+ * Detecting injected instructions is a guess; the same sentence can be reworded,
+ * translated or hidden in data. What can be enforced is the combination that makes an
+ * injection costly: in one session the agent (1) reads text written by someone else,
+ * (2) reads the user's private data and (3) sends something off the machine. Text that
+ * arrives through (1) can then tell the model to read with (2) and send with (3).
+ *
+ * The guard watches every tool call through Claude Code's hooks and keeps per-session
+ * state. Once outside text is in the context ("tainted"), and private data has been read,
+ * a call that can send data out asks the user first (or is denied, by mode). Independently,
+ * a call that carries text the session read from private files is caught by fingerprint:
+ * secrets are denied outright, other private text asks. A tool call that would change the
+ * guard's own policy or Claude Code's hook settings never passes silently.
+ *
+ * It does not read the model's mind and does not need to recognise an attack. What it
+ * cannot see: prompts submitted before installation, text the model already holds from before the hook was
+ * installed, and harm that needs no outbound or destructive call (a wrong answer). For that last one the
+ * Stop hook can only tell the user which outside text the answer drew on.
+ *
+ * Dependency-free on purpose (node: built-ins only): the Claude Code plugin runs a copy of
+ * the compiled files on every tool call (claude-plugin/scripts/flow-guard*.mjs; a test keeps
+ * each copy identical to its dist/flow-guard*.js).
+ *
+ * This file is the public API and the hook entry point. The parts are flow-guard-*.ts: the shared
+ * types, state paths, operator policy, text extraction, call classification, screen tools,
+ * destinations, fingerprints, decoding, credential fragments, leak checks, session state, the
+ * PreToolUse and PostToolUse hooks, the prompt and Stop hooks (answer), and the flow-labels report.
+ */
+import { readFileSync } from 'node:fs';
+import { flowPre } from './flow-guard-pre.mjs';
+import { flowPost } from './flow-guard-post.mjs';
+import { flowPrompt, flowStop } from './flow-guard-answer.mjs';
+export { stateDir, flowPaths, isSecretPath, isProtectedPath } from './flow-guard-paths.mjs';
+export { DEFAULT_POLICY, loadPolicy, readPinnedTaskManifest, publicRequestDigest, hostMatches } from './flow-guard-policy.mjs';
+export { hostsIn } from './flow-guard-text.mjs';
+export { classifyShell, classifyCall, resultTaints } from './flow-guard-classify.mjs';
+export { screenFromResult, screenCall, screenObservation, screenTargetEvidence, screenTargetStamp, screenResponseEvidence, screenResponseStamp, screenSecretRead } from './flow-guard-screen.mjs';
+export { destinations, keepsDestination, resolvedContacts, namedByUser } from './flow-guard-destinations.mjs';
+export { normalizeText, fingerprints, withoutRecordIds, piiTokens, secretPattern, secretValues, secretTokens, tokenFingerprints, tokenWindows } from './flow-guard-fingerprints.mjs';
+export { spelledCandidates, characterCodeCandidates, natoCandidates, scanCandidates, candidates } from './flow-guard-decode.mjs';
+export { fragmentFingerprints, checkFragments } from './flow-guard-fragments.mjs';
+export { checkLeak, checkStream } from './flow-guard-leak.mjs';
+export { readFlowState, updateFlowState, flowStateExists } from './flow-guard-state.mjs';
+export { flowPre, flowApproval, flowScreenValidation } from './flow-guard-pre.mjs';
+export { flowPost } from './flow-guard-post.mjs';
+export { ownWords, flowPrompt, instructionText, lastAnswer, flowStop } from './flow-guard-answer.mjs';
+export { checkAnswerConstraints } from './flow-guard-constraints.mjs';
+export { unlabeledTools, flowLabelsReport } from './flow-guard-labels.mjs';
+/** Hook runner shared by the CLI and the plugin script: `pre`, `post`, `prompt` or `stop`, hook JSON on stdin, decision JSON on stdout. */
+export function runFlowHook(event, stdin, env = process.env) {
+    let input;
+    try {
+        input = JSON.parse(stdin || '{}');
+    }
+    catch {
+        return undefined;
+    }
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return undefined;
+    if (event === 'pre') {
+        const d = flowPre(input, env);
+        return d ? JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', ...d } }) : undefined;
+    }
+    if (event === 'prompt') {
+        flowPrompt(input, env);
+        return undefined;
+    }
+    if (event === 'stop') {
+        const o = flowStop(input, env);
+        return o ? JSON.stringify(o) : undefined;
+    }
+    if (event === 'post') {
+        const o = flowPost(input, env);
+        if (!o)
+            return undefined;
+        return JSON.stringify({ ...(o.systemMessage ? { systemMessage: o.systemMessage } : {}), ...(o.additionalContext ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: o.additionalContext } } : {}) });
+    }
+    return undefined;
+}
+export function flowGuardMain(argv = process.argv.slice(2)) {
+    const event = argv[0] || '';
+    let stdin = '';
+    try {
+        stdin = readFileSync(0, 'utf8');
+    }
+    catch {
+        return;
+    }
+    try {
+        const out = runFlowHook(event, stdin);
+        if (out)
+            process.stdout.write(out + '\n');
+    }
+    catch (err) {
+        // Never interpret corrupt/unreadable state as permission to execute a tool.
+        process.stderr.write(`warden flow guard: ${err instanceof Error ? err.message : String(err)}\n`);
+        if (event === 'pre')
+            process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'WARDEN flow guard could not safely check this call. Repair the guard state before retrying.' } }) + '\n');
+    }
+}

package/dist/flow-guard-codex.d.ts

@@ -0,0 +1,32 @@
+import { type UnattendedBlockMode } from './flow-guard-unattended.js';
+export type CodexBlockMode = UnattendedBlockMode;
+export interface CodexGuardCall {
+    name: string;
+    input: Record<string, unknown>;
+}
+/** The shell text of a Codex command: a string, or an argv where `bash -lc "<script>"` means its script. */
+export declare function commandText(value: unknown): string;
+/** One Codex tool call in the guard's (Claude Code) vocabulary: zero, one or, for a multi-file patch, several calls. */
+export declare function codexGuardCalls(toolName: string, rawInput: unknown): CodexGuardCall[];
+/** The guard's session id for a Codex session: namespaced, so it never shares state with a Claude Code session. */
+export declare function codexSession(input: Record<string, unknown>): string;
+export interface CodexHookOptions {
+    block?: CodexBlockMode;
+    env?: NodeJS.ProcessEnv;
+}
+/** PreToolUse: a deny, or undefined to let the call run. Never `ask` (Codex runs the call on `ask`). */
+export declare function codexPre(input: Record<string, unknown>, options?: CodexHookOptions): object | undefined;
+/** PostToolUse: records what the result brought in. A failure marks the session so that later calls are denied. */
+export declare function codexPost(input: Record<string, unknown>, options?: CodexHookOptions): object | undefined;
+/** UserPromptSubmit: the destinations the user's own message names. */
+export declare function codexPrompt(input: Record<string, unknown>, options?: CodexHookOptions): undefined;
+/** Stop: the guard's note on the answer. `decision: block` makes Codex continue once with the reason as the prompt. */
+export declare function codexStop(input: Record<string, unknown>, options?: CodexHookOptions): object | undefined;
+declare const EVENTS: readonly ['pre-tool-use', 'post-tool-use', 'user-prompt-submit', 'stop'];
+export type CodexHookEvent = typeof EVENTS[number];
+/** One hook run: the stdout line, or undefined. Throws only on bad input; the caller turns that into a deny. */
+export declare function runCodexHook(event: CodexHookEvent, stdin: string, options?: CodexHookOptions): string | undefined;
+/** `codex-hook.mjs <event>` reads the Codex hook JSON on stdin. Fails closed for PreToolUse. */
+export declare function codexHookMain(argv?: string[], options?: CodexHookOptions): number;
+export {};
+//# sourceMappingURL=flow-guard-codex.d.ts.map

package/dist/flow-guard-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-codex.d.ts","sourceRoot":"","sources":["../src/flow-guard-codex.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAkC,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtG,MAAM,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAEjD,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE;AAgBhF,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQlD;AAED,wHAAwH;AACxH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,cAAc,EAAE,CAwBrF;AAED,mHAAmH;AACnH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAGnE;AAUD,MAAM,WAAW,gBAAgB;IAAG,KAAK,CAAC,EAAE,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE;AAYrF,wGAAwG;AACxG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,GAAG,SAAS,CAoB3G;AAED,mHAAmH;AACnH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,GAAG,SAAS,CAkB5G;AAQD,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS,CAKrG;AAED,uHAAuH;AACvH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,GAAG,SAAS,CAI5G;AAED,QAAA,MAAM,MAAM,YAAI,cAAc,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,CAAU,CAAC;AACxF,MAAM,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AAEnD,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,GAAG,SAAS,CAQrH;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAM,EAA0B,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CAwB5G"}

package/dist/flow-guard-codex.js

@@ -0,0 +1,222 @@
+/**
+ * WARDEN flow guard for OpenAI Codex (CLI, desktop app, `codex exec`, a Multica runtime): the checks of the Claude
+ * Code plugin, through Codex's command hooks (`hooks.json`, `[hooks]` in `config.toml` or `requirements.toml`).
+ *
+ * Codex hooks speak nearly the Claude Code hook protocol: the same events, `tool_name`/`tool_input`/`tool_response`,
+ * `hookSpecificOutput.permissionDecision`. Three differences decide this adapter:
+ *
+ * - **No `ask`.** Codex does not support `permissionDecision: "ask"` in PreToolUse: the hook run counts as failed and
+ *   THE TOOL CALL CONTINUES. Passing the Claude Code decision through would let every questioned call run. Every
+ *   `ask` therefore becomes `deny` or a logged pass, by `block` (see flow-guard-unattended.ts); this adapter never
+ *   prints `ask`.
+ * - **A failed hook does not stop the call.** An exception in a hook, or output Codex cannot parse, lets the tool
+ *   run. Every path of PreToolUse that is not a clean "no decision" prints a deny, and a PostToolUse that could not
+ *   record its result marks the session, so every later call of that session is denied.
+ * - **Tool names.** Shell and unified exec arrive as `Bash` with `tool_input.command`; edits as `apply_patch` with the
+ *   patch in `tool_input.command`; MCP tools as `mcp__<server>__<tool>`; other local tools by their own name.
+ *   Subagent hooks carry the parent's `session_id`, so a session tree shares one guard state without extra work.
+ *
+ * Codex's own session ids are namespaced (`codex:<id>`) so they never share state with a Claude Code session.
+ * Hosted tools (Codex's own web search) run no local hook: what they bring in is not recorded. Turn web search off
+ * for a guarded agent (`web_search = "disabled"`) or accept that gap.
+ *
+ * Node built-ins and flow-guard parts only: `codex-plugin/scripts` holds copies that run without the package.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { flowPaths, stateDir } from './flow-guard-paths.js';
+import { flowPost } from './flow-guard-post.js';
+import { flowPrompt, flowStop } from './flow-guard-answer.js';
+import { flowPre } from './flow-guard-pre.js';
+import { log } from './flow-guard-state.js';
+import { blockMode, patchFiles, refuses } from './flow-guard-unattended.js';
+/** Local tools that only change Codex's own session state: no data in, no data out. */
+const IGNORED = new Set(['update_plan', 'request_user_input', 'list_mcp_resources', 'list_mcp_resource_templates']);
+const SHELLS = /^(?:\/(?:usr\/)?bin\/)?(?:ba|z|da|k)?sh$/;
+// A PostToolUse input carries the whole tool result (a large file read); too small a cap would skip fingerprinting it.
+const STDIN_BYTES = 16 * 1_048_576;
+function obj(v) {
+    return v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+}
+function str(v) {
+    return typeof v === 'string' ? v : undefined;
+}
+/** The shell text of a Codex command: a string, or an argv where `bash -lc "<script>"` means its script. */
+export function commandText(value) {
+    if (typeof value === 'string')
+        return value;
+    if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))
+        return value === undefined ? '' : JSON.stringify(value);
+    const argv = value;
+    const flag = argv.findIndex((a, i) => i > 0 && /^-[a-z]*c[a-z]*$/.test(a));
+    if (argv.length >= 3 && SHELLS.test(argv[0]) && flag > 0 && flag === argv.length - 2)
+        return argv[argv.length - 1];
+    // Quote each word, so a word with a space stays one word for the guard's shell parser.
+    return argv.map(a => /^[A-Za-z0-9_@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`).join(' ');
+}
+/** One Codex tool call in the guard's (Claude Code) vocabulary: zero, one or, for a multi-file patch, several calls. */
+export function codexGuardCalls(toolName, rawInput) {
+    const a = obj(rawInput);
+    if (IGNORED.has(toolName))
+        return [];
+    if (toolName.startsWith('mcp__'))
+        return [{ name: toolName, input: a }];
+    switch (toolName) {
+        case 'Bash':
+        case 'shell':
+        case 'exec_command':
+        case 'local_shell':
+        case 'unified_exec':
+            return [{ name: 'Bash', input: { command: commandText(a.command ?? a.cmd) } }];
+        case 'apply_patch':
+        case 'Edit':
+        case 'Write': {
+            const text = str(a.command) ?? str(a.patch) ?? str(a.input) ?? (typeof rawInput === 'string' ? rawInput : '');
+            const files = patchFiles(text);
+            // An unparsable patch is still a write of its whole text somewhere.
+            return (files.length ? files : ['']).map(f => ({ name: 'Write', input: { file_path: f, content: text } }));
+        }
+        case 'view_image': {
+            const path = str(a.path) ?? str(a.file_path);
+            return [{ name: 'Read', input: path ? { file_path: path } : {} }];
+        }
+        case 'write_stdin':
+            // Input to a running command: its text is what that command receives.
+            return [{ name: 'Bash', input: { command: str(a.chars) ?? str(a.input) ?? '' } }];
+    }
+    // Anything else (spawn_agent, a plugin's tool) is an unlabelled tool: its result is outside text, and it sends
+    // when its name or arguments say so.
+    return [{ name: `mcp__codex__${toolName.replace(/[^A-Za-z0-9_-]/g, '_')}`, input: a }];
+}
+/** The guard's session id for a Codex session: namespaced, so it never shares state with a Claude Code session. */
+export function codexSession(input) {
+    const id = str(input.session_id);
+    return id ? `codex:${id}` : '';
+}
+function brokenPath(env, sessionId) {
+    return join(stateDir(env), 'codex', 'broken', createHash('sha256').update(sessionId).digest('hex'));
+}
+function deny(reason) {
+    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } };
+}
+function settings(options) {
+    const env = options.env ?? process.env;
+    return { env, block: options.block ?? blockMode(env.WARDEN_CODEX_BLOCK) ?? 'data' };
+}
+function hookInput(input, call, sessionId) {
+    return { session_id: sessionId, tool_name: call.name, tool_input: call.input, cwd: str(input.cwd) || process.cwd(),
+        ...(input.tool_response !== undefined ? { tool_response: input.tool_response } : {}) };
+}
+/** PreToolUse: a deny, or undefined to let the call run. Never `ask` (Codex runs the call on `ask`). */
+export function codexPre(input, options = {}) {
+    const { env, block } = settings(options);
+    const sessionId = codexSession(input);
+    const tool = str(input.tool_name) ?? '';
+    if (!sessionId || !tool)
+        return deny('WARDEN flow guard got a Codex hook input without a session or tool name. Refused.');
+    if (existsSync(brokenPath(env, sessionId))) {
+        return deny('WARDEN flow guard could not record an earlier result of this session, so it cannot judge this call. Refused; start a new session.');
+    }
+    for (const call of codexGuardCalls(tool, input.tool_input)) {
+        const detail = {};
+        const decision = flowPre(hookInput(input, call, sessionId), env, 'hook', detail);
+        if (!decision)
+            continue;
+        const refused = refuses(decision, detail, block);
+        log(flowPaths(stateDir(env), sessionId), { event: 'codex', tool: call.name, decision: decision.permissionDecision,
+            reason: detail.reason, sensitive: !!detail.sensitive, resolution: refused ? 'refused' : 'allowed_unattended', block });
+        if (refused) {
+            return deny(`${decision.permissionDecisionReason}\nRefused by the WARDEN flow guard (Codex, block=${block}). Do not retry this call in another form; report what was refused.`);
+        }
+    }
+    return undefined;
+}
+/** PostToolUse: records what the result brought in. A failure marks the session so that later calls are denied. */
+export function codexPost(input, options = {}) {
+    const { env } = settings(options);
+    const sessionId = codexSession(input);
+    const tool = str(input.tool_name) ?? '';
+    if (!sessionId || !tool)
+        return undefined;
+    const warnings = [];
+    for (const call of codexGuardCalls(tool, input.tool_input)) {
+        let post;
+        try {
+            post = flowPost(hookInput(input, call, sessionId), env);
+        }
+        catch (err) {
+            markBroken(env, sessionId);
+            log(flowPaths(stateDir(env), sessionId), { event: 'codex', tool: call.name, resolution: 'record_failed', error: err instanceof Error ? err.name : 'error' });
+            continue;
+        }
+        const warning = post?.additionalContext || post?.systemMessage;
+        if (warning && !warnings.includes(warning))
+            warnings.push(warning);
+    }
+    return warnings.length ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: `[WARDEN] ${warnings.join('\n')}` } } : undefined;
+}
+function markBroken(env, sessionId) {
+    const path = brokenPath(env, sessionId);
+    mkdirSync(join(stateDir(env), 'codex', 'broken'), { recursive: true, mode: 0o700 });
+    writeFileSync(path, new Date().toISOString() + '\n', { mode: 0o600 });
+}
+/** UserPromptSubmit: the destinations the user's own message names. */
+export function codexPrompt(input, options = {}) {
+    const { env } = settings(options);
+    const sessionId = codexSession(input);
+    if (sessionId)
+        flowPrompt({ ...input, session_id: sessionId }, env);
+    return undefined;
+}
+/** Stop: the guard's note on the answer. `decision: block` makes Codex continue once with the reason as the prompt. */
+export function codexStop(input, options = {}) {
+    const { env } = settings(options);
+    const sessionId = codexSession(input);
+    return sessionId ? flowStop({ ...input, session_id: sessionId }, env) : undefined;
+}
+const EVENTS = ['pre-tool-use', 'post-tool-use', 'user-prompt-submit', 'stop'];
+/** One hook run: the stdout line, or undefined. Throws only on bad input; the caller turns that into a deny. */
+export function runCodexHook(event, stdin, options = {}) {
+    if (Buffer.byteLength(stdin) > STDIN_BYTES)
+        throw new Error('hook input too large');
+    const parsed = JSON.parse(stdin || '{}');
+    const input = obj(parsed);
+    if (input !== parsed)
+        throw new Error('hook input is not an object');
+    const out = event === 'pre-tool-use' ? codexPre(input, options) : event === 'post-tool-use' ? codexPost(input, options)
+        : event === 'user-prompt-submit' ? codexPrompt(input, options) : codexStop(input, options);
+    return out ? JSON.stringify(out) : undefined;
+}
+/** `codex-hook.mjs <event>` reads the Codex hook JSON on stdin. Fails closed for PreToolUse. */
+export function codexHookMain(argv = process.argv.slice(2), options = {}) {
+    const event = argv[0];
+    if (!EVENTS.includes(event)) {
+        process.stderr.write(`Usage: codex-hook.mjs ${EVENTS.join('|')}  (Codex command hook; reads the hook JSON on stdin)\n`);
+        // Codex reads a deny from stdout; a misconfigured PreToolUse hook must not let calls through.
+        process.stdout.write(JSON.stringify(deny('WARDEN Codex hook is misconfigured (unknown event). Refused.')) + '\n');
+        return 0;
+    }
+    let stdin = '';
+    try {
+        stdin = readFileSync(0, 'utf8');
+        const out = runCodexHook(event, stdin, options);
+        if (out)
+            process.stdout.write(out + '\n');
+    }
+    catch (err) {
+        process.stderr.write(`warden codex hook ${event}: ${err instanceof Error ? err.message : String(err)}\n`);
+        if (event === 'pre-tool-use')
+            process.stdout.write(JSON.stringify(deny('WARDEN flow guard could not safely check this call. Repair the guard state before retrying.')) + '\n');
+        if (event === 'post-tool-use') {
+            try {
+                const sessionId = codexSession(obj(JSON.parse(stdin || '{}')));
+                if (sessionId)
+                    markBroken(options.env ?? process.env, sessionId);
+            }
+            catch { /* the input itself is unreadable: nothing to mark */ }
+        }
+    }
+    return 0;
+}
+//# sourceMappingURL=flow-guard-codex.js.map

package/dist/flow-guard-codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-codex.js","sourceRoot":"","sources":["../src/flow-guard-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAA4B,MAAM,4BAA4B,CAAC;AAMtG,uFAAuF;AACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AACpH,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAC1D,uHAAuH;AACvH,MAAM,WAAW,GAAG,EAAE,GAAG,SAAS,CAAC;AAEnC,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAG,KAAiB,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACrH,uFAAuF;IACvF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3G,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAAiB;IACjE,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC;QAAC,KAAK,OAAO,CAAC;QAAC,KAAK,cAAc,CAAC;QAAC,KAAK,aAAa,CAAC;QAAC,KAAK,cAAc;YACrF,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,KAAK,aAAa,CAAC;QAAC,KAAK,MAAM,CAAC;QAAC,KAAK,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/B,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,aAAa;YAChB,sEAAsE;YACtE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,+GAA+G;IAC/G,qCAAqC;IACrC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,SAAiB;IAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,CAAC;AAC/H,CAAC;AAID,SAAS,QAAQ,CAAC,OAAyB;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAoB,EAAE,SAAiB;IACxF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;QAChH,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,QAAQ,CAAC,KAA8B,EAAE,OAAO,GAAqB,EAAE;IACrF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAC1H,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,mIAAmI,CAAC,CAAC;IACnJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;YAC/G,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;QACzH,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,wBAAwB,oDAAoD,KAAK,qEAAqE,CAAC,CAAC;QAClL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,SAAS,CAAC,KAA8B,EAAE,OAAO,GAAqB,EAAE;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QAChE,OAAO,GAAG,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7J,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,aAAa,CAAC;QAC/D,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,SAAiB;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,aAAa,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,KAA8B,EAAE,OAAO,GAAqB,EAAE;IACxF,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS;QAAE,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,SAAS,CAAC,KAA8B,EAAE,OAAO,GAAqB,EAAE;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,CAAU,CAAC;AAGxF,gHAAgH;AAChH,MAAM,UAAU,YAAY,CAAC,KAAqB,EAAE,KAAa,EAAE,OAAO,GAAqB,EAAE;IAC/F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACpF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;QACrH,CAAC,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,IAAI,GAAa,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,GAAqB,EAAE;IAClG,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAmB,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACxH,8FAA8F;QAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1G,IAAI,KAAK,KAAK,cAAc;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/K,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC/D,IAAI,SAAS;oBAAE,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/flow-guard-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow-guard-paths.d.ts","sourceRoot":"","sources":["../src/flow-guard-paths.ts"],"names":[],"mappings":"AAMA,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAErE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAG7C,GAAG;IAAQ,KAAK;IAA6B,EAAE;IAA2B,MAAM;IAAkC,GAAG;IAA+B,GAAG;IAA+B,IAAI;IAAgC,GAAG;EACvO;AAMD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAGD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAIhF;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAG7D;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,eAAO,MAAM,YAAY,QAAmI,CAAC;AAE7J,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAkBxG"}
+{"version":3,"file":"flow-guard-paths.d.ts","sourceRoot":"","sources":["../src/flow-guard-paths.ts"],"names":[],"mappings":"AAMA,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAErE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAG7C,GAAG;IAAQ,KAAK;IAA6B,EAAE;IAA2B,MAAM;IAAkC,GAAG;IAA+B,GAAG;IAA+B,IAAI;IAAgC,GAAG;EACvO;AAMD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAGD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAIhF;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAG7D;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,eAAO,MAAM,YAAY,QAAmI,CAAC;AAE7J,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAqBxG"}

package/dist/flow-guard-paths.js

@@ -39,7 +39,7 @@ export function inside(child, parent) {
     const p = parent.endsWith(sep) ? parent : parent + sep;
     return child === parent || child.startsWith(p);
 }
-const SECRET_PATH = /(^|\/)(\.ssh|\.aws|\.gnupg|\.kube|\.docker|\.config\/gh|\.config\/gcloud|\.azure|\.password-store|keychains?)(\/|$)|(^|\/)(\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.pgpass|id_(rsa|dsa|ecdsa|ed25519)[^/]*|[^/]*\.(pem|key|p12|pfx|kdbx|keystore|jks)|\.env(\.[^/]*)?|credentials?(\.[^/]*)?|secrets?(\.[^/]*)?)$|(^|\/)\.local\/share\/opencode\/auth\.json$|(^|\/)\.multica\/config\.json$/i;
+const SECRET_PATH = /(^|\/)(\.ssh|\.aws|\.gnupg|\.kube|\.docker|\.config\/gh|\.config\/gcloud|\.azure|\.password-store|keychains?)(\/|$)|(^|\/)(\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.pgpass|id_(rsa|dsa|ecdsa|ed25519)[^/]*|[^/]*\.(pem|key|p12|pfx|kdbx|keystore|jks)|\.env(\.[^/]*)?|credentials?(\.[^/]*)?|secrets?(\.[^/]*)?)$|(^|\/)\.local\/share\/opencode\/auth\.json$|(^|\/)\.multica\/config\.json$|(^|\/)\.codex\/auth\.json$/i;
 export function isSecretPath(path) {
     return SECRET_PATH.test(path.replace(/\\/g, '/'));
 }
@@ -67,6 +67,11 @@ export function isProtectedPath(path, cwd, env = process.env) {
         // OpenCode: its config and plugin folders load (or drop) the guard itself, globally and per project.
         if (/(^|\/)\.config\/opencode(\/|$)/.test(p) || /(^|\/)\.opencode(\/|$)/.test(p) || /(^|\/)opencode\.jsonc?$/.test(p))
             return true;
+        // Codex: user, project and system config layers load (or drop) its hooks, the guard among them.
+        if (/(^|\/)\.codex(\/|$)/.test(p) || inside(p, '/etc/codex'))
+            return true;
+        if (env.CODEX_HOME && inside(p, physicalPath(resolve(env.CODEX_HOME)).replace(/\\/g, '/')))
+            return true;
         if (/(^|\/)warden\.lock\.json$/.test(p) && inside(p, cwd.replace(/\\/g, '/')))
             return true;
         return false;