@assuredloop/orca-bot-kit 0.25.4 → 0.25.6

package/README.md

@@ -643,13 +643,14 @@ npm run mutate                # the mutation audit, on what your branch changed
 
 The tests come in two layers, and every test file belongs to one of them.
 
-`npm test` is `test/*.test.js`: unit tests and end-to-end runs of the CLI in a
-throwaway folder, with a fake `orca` on PATH. It needs nothing but Node, so
-[GitHub Actions](.github/workflows/ci.yml) runs it on every pull request, split
-into shards that run side by side, on Node 25.8.0, the current line. A release
-runs every shard on 25.8.0 and again on 24.21.0, the floor `engines.node`
-promises users, with only the kit's own dependencies installed, before anything
-is published.
+`npm test` is `test/*.test.js` and `test/dev/*.test.js`: unit tests and
+end-to-end runs of the CLI in a throwaway folder, with a fake `orca` on PATH. It
+needs nothing but Node, so [GitHub Actions](.github/workflows/ci.yml) runs it on
+every pull request, split into shards that run side by side, on Node 25.8.0, the
+current line. A release runs every shard on 25.8.0 and again on 24.21.0, the
+floor `engines.node` promises users, with only the kit's own dependencies
+installed, before anything is published. The floor leaves out `test/dev/`, the
+tests that need a development tool.
 
 `npm run test:system` is `test/system/*.test.js`: the real `obk` against the
 real Orca and the real harnesses on your own machine. No CI runner can do that,

package/SETUP.md

@@ -248,6 +248,26 @@ Bash(<kit> temp answer:*)
 Ask the user, and only after their yes run
 `obk bot change --bots <their path> --bot <bot> --allow 'Bash(<kit> temp answer:*)'`.
 
+A long-lived session's two screens go through the kit as well, not through the
+keys. On Codex's hooks review, run
+`obk session trust-hooks --bots <their path> --bot <bot> --session <session>`.
+On Claude Code's `Teach auto mode` screen, run
+`obk session answer --bots <their path> --bot <bot> --session <session>`.
+A long-lived session is Bot Father's, so run them from outside the fleet's tabs,
+as you do here, or from a Bot Father session. A session of any other bot is
+refused. They make the same checks as the temp commands. Before either
+trust-hooks command trusts hooks, the kit checks that the hooks on the review
+are its own: the bot's `.codex/hooks.json` holds only the kit's hooks, and the
+count on the screen is the number of the kit's hooks that Codex does not trust
+yet. When it refuses, it says what it saw: type nothing, and tell them what it
+said. Use the keys in the table for the screens the kit does not answer.
+The kit reads Codex's trust from the caller's `CODEX_HOME`, else `~/.codex`;
+a bot run under another `CODEX_HOME` is outside what the kit can see.
+The kit also records the extra arguments it launched each session with, and
+refuses when they mention hooks, or when there is no record. A Codex that
+someone started again by hand in that tab, with other flags, is outside what
+the kit records.
+
 **Anything you do not recognise: type nothing.** Tell them what is on the
 screen and which tab it is in, and wait. A keypress into a menu you have not read
 is how a harness quits back to the shell.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assuredloop/orca-bot-kit",
-  "version": "0.25.4",
+  "version": "0.25.6",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -23,8 +23,9 @@
     "SETUP.md"
   ],
   "scripts": {
-    "test": "node --test test/*.test.js",
-    "test:shard": "node --test --test-shard=$SHARD test/*.test.js",
+    "test": "node --test test/*.test.js test/dev/*.test.js",
+    "test:shard": "node --test --test-shard=$SHARD test/*.test.js test/dev/*.test.js",
+    "test:floor": "node --test --test-shard=$SHARD test/*.test.js",
     "test:system": "node scripts/test-system.js",
     "mutate": "node scripts/mutate.js"
   },

package/rules/mail.md

@@ -8,6 +8,10 @@ To reach another session, ask the kit for the road rather than guessing an
 address: `"${OBK_CLI:-obk}" message to --bots <bots> --to <bot>/<session>`. It
 answers with the address and the command that carries it.
 
+If your harness refuses a message, do not send it again by another road. Tell
+your maker or your user, with the harness's reason. A refusal can mean a missing
+permission rule, which they can add through the kit after the user's yes.
+
 Mail is queued, not an interruption. Read it when you finish what you are on.
 
 Ask for a reply when you need one, and send one when you were asked for one.

package/skills/obk-bot-building/SKILL.md

@@ -335,6 +335,19 @@ only after a second look), refuses any other screen, and checks that it went. It
 rule is `Bash(<kit> temp answer:*)`, `<kit>` the kit's CLI path as the
 command prints it; ask the user before `obk bot change --allow` adds it.
 
+A long-lived session's two screens go through the kit too: Codex's hooks
+review with `obk session trust-hooks --bots <bots> --bot <bot> --session
+<session>`, and Claude Code's `Teach auto mode` screen with `obk session
+answer --bots <bots> --bot <bot> --session <session>`. A long-lived session is
+Bot Father's: the caller is a Bot Father session or the user, from outside the
+fleet's tabs, and a session of any other bot is refused. They make the same
+checks as the temp commands. Before either trust-hooks command trusts hooks,
+it checks that the hooks on the review are the kit's own: the bot's
+`.codex/hooks.json` holds only the kit's, and the count on the screen is the
+number of the kit's hooks Codex does not trust yet. A refusal says what it
+saw; then type nothing and take it to the user. The keys in the table are for
+the screens the kit does not answer.
+
 Where the kit says no session came up, the shell swallowed the launch line,
 usually while it was asking its own question. Answer the shell, then close
 that one tab (`<orca> terminal close --terminal <handle> --tab`) and run

package/src/book.js

@@ -28,6 +28,9 @@ const HEADER = `# What Orca calls this bot on this machine, and where each of it
 # \`rules\` is a stamp of the bot's AGENTS.md as the session last read it, so a
 # change to it after the session started can be told apart.
 #
+# \`launched_with\` is the extra arguments the kit typed on the session's last
+# launch line, as bot.yaml's extra_args gave them then.
+#
 # \`retired\` holds what the book knew about each session \`obk retire\` took off
 # the bot, with when, so the conversations it had are still accounted for.
 #

package/src/cli.js

@@ -31,7 +31,7 @@ import { readRoster } from './roster.js';
 import { buildAgents, buildRules, CODEX_CAP } from './rules.js';
 import { addSkill, buildSkills, linkSkills, removeSkill } from './skills.js';
 import { addSource, fetchSources } from './sources.js';
-import { answerTemp, listRoles, makeTemp, optionsLine, retireTemp, trustHooks } from './temp.js';
+import { answerSession, answerTemp, listRoles, makeTemp, optionsLine, retireTemp, trustHooks, trustSessionHooks } from './temp.js';
 import { readUsage } from './usage.js';
 import { BOT_FATHER, bringUp, ownMailbox } from './up.js';
 
@@ -139,7 +139,8 @@ Usage:
                             of a Codex temporary session it made with "Trust
                             all and continue", and check the review went. It
                             refuses anything else on that screen, and types
-                            nothing then.
+                            nothing then. It refuses, as obk session
+                            trust-hooks does, hooks that are not the kit's.
   obk temp answer --bots <path> --name <session>
                             Run in the maker's own tab: answer Claude Code's
                             "Teach auto mode" screen on a temporary session it
@@ -266,6 +267,19 @@ Usage:
                             next starts where it stopped, so no call is counted
                             twice. It counts tokens and never money: what a
                             token costs is looked up live by whoever is asking.
+  obk session trust-hooks --bots <path> --bot <bot> --session <name>
+                            Run by Bot Father or the user: answer the hooks
+                            review of a long-lived Codex session with "Trust
+                            all and continue", as obk temp trust-hooks does,
+                            and check the review went. It refuses when the
+                            bot's .codex/hooks.json holds a hook that is not
+                            the kit's, or when the review counts other hooks
+                            than the kit's own that Codex does not trust yet.
+  obk session answer --bots <path> --bot <bot> --session <name>
+                            Run by Bot Father or the user: answer Claude Code's
+                            "Teach auto mode" screen on a long-lived session
+                            with Not now, as obk temp answer does, and check
+                            the screen went.
   obk session record --bots <path> --bot <bot>
                             For the kit's own hook, not for typing: it reads
                             what the harness says about a session starting on
@@ -337,6 +351,8 @@ const COMMANDS = {
   'session mail': ['bots', 'bot'],
   'session name': ['bots', 'bot'],
   'session mailbox': ['bots', 'bot', 'session'],
+  'session trust-hooks': ['bots', 'bot', 'session'],
+  'session answer': ['bots', 'bot', 'session'],
   'temp make': ['bots', 'name'],
   'temp roles': ['bots'],
   'temp retire': ['bots', 'name'],
@@ -845,6 +861,26 @@ const commands = {
     };
   },
 
+  async 'session trust-hooks'(bots, values) {
+    const tab = callerTab(bots, true);
+    refuseWhenOrcaIsDown();
+    const trusted = await trustSessionHooks(bots, { tab, bot: values.bot, session: values.session });
+    return {
+      answer: { bots, ...trusted },
+      lines: [`trusted    ${trusted.bot} ${trusted.session}'s hooks: chose "Trust all and continue" on its hooks review, and the review has gone`],
+    };
+  },
+
+  async 'session answer'(bots, values) {
+    const tab = callerTab(bots, true);
+    refuseWhenOrcaIsDown();
+    const answered = await answerSession(bots, { tab, bot: values.bot, session: values.session });
+    return {
+      answer: { bots, ...answered },
+      lines: [`answered   ${answered.bot} ${answered.session}: sent ${answered.sent} to its "Teach auto mode about your environment?" screen, and the screen has gone`],
+    };
+  },
+
   'bot create'(bots, values) {
     const made = createBot(bots, { name: values.name, harness: values.harness, charter: values.charter });
     // The bot's AGENTS.md is the rules build's, here as everywhere else, so
@@ -1262,7 +1298,12 @@ const commands = {
 function toLines(answer, bots, where) {
   if (answer.trouble !== undefined) return [`             ${answer.trouble}`];
   if (answer.transport === 'native') {
-    return [`             Write to ${answer.address} with your own harness's messaging. The kit does not carry that road.`];
+    // A refused call is not re-sent by another road (PRD 6.9), so the answer
+    // says what to do instead, before the bot needs it (#521).
+    return [
+      `             Write to ${answer.address} with your own harness's messaging. The kit does not carry that road.`,
+      "             If your harness refuses that call, do not send the message again by another road. Tell your maker or your user that it was refused, with the harness's reason. A refusal can mean a missing permission rule, which they can add through the kit after the user's yes.",
+    ];
   }
   return [
     ...(answer.unnamed === true

package/src/hook-trust.js

@@ -0,0 +1,179 @@
+// Which of a Codex bot's hooks Codex does not trust yet, so that the kit
+// trusts only its own (#506).
+//
+// "Trust all and continue" on Codex's hooks review trusts every hook the
+// review counts, from every source Codex reads: the user's own files, Orca's
+// hooks among them, `-c` flags, plugins, and each `.codex/` folder from the git
+// root down (tech notes, section 3). So the kit answers a review only when the
+// bot's `.codex/hooks.json` holds the kit's hooks and nothing else, and the
+// count on the screen is the number of those that Codex does not trust yet.
+//
+// Codex keeps its trust in the user's config.toml, one table a hook, keyed by
+// the file, the event and the hook's place in it, with a hash of the hook. The
+// kit reads only those tables' headers and their `trusted_hash` lines: the
+// rest of the file can hold the user's secrets, and nothing of it is kept or
+// said. A file it cannot read that way for one of its hooks is one where it
+// cannot tell, and it refuses (the architect's ruling on #506).
+
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { hooksFileOf, readSettings, runsThisKit } from './hooks.js';
+
+/** The events whose hooks Codex hashes with no matcher, whatever the group says. */
+const NO_MATCHER = new Set(['user_prompt_submit', 'stop', 'interrupt']);
+
+/** A hook's timeout when its entry gives none, in seconds, as Codex takes it. */
+const DEFAULT_TIMEOUT = 600;
+
+/**
+ * How many of the hooks in the bot at `home`'s `.codex/hooks.json` Codex does
+ * not trust yet: `{ untrusted, file }`. It throws, with `nothing` at the end,
+ * when the file holds a hook that is not the kit's own as this kit writes it,
+ * or when the kit cannot tell whether Codex trusts one.
+ */
+export function untrustedKitHooks(home, run, nothing) {
+  const file = hooksFileOf(home, 'codex');
+  const settings = readSettings(file, "the kit's hooks");
+  const hooks = settings.hooks ?? {};
+  if (hooks === null || typeof hooks !== 'object' || Array.isArray(hooks)) {
+    throw new Error(`${run}: ${file} has a hooks entry that is not a mapping of events, so the kit cannot tell which hooks its review covers. ${nothing}`);
+  }
+  const ours = [];
+  const foreign = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) {
+      foreign.push(`${event}: ${JSON.stringify(groups)}`);
+      continue;
+    }
+    groups.forEach((group, at) => {
+      if (!Array.isArray(group?.hooks)) {
+        foreign.push(`${event}: ${JSON.stringify(group)}`);
+        return;
+      }
+      group.hooks.forEach((hook, handler) => {
+        if (runsThisKit(hook)) ours.push({ event: snake(event), at, handler, hash: hashOf(snake(event), group.matcher, hook) });
+        else foreign.push(`${event}: ${typeof hook?.command === 'string' ? hook.command : JSON.stringify(hook)}`);
+      });
+    });
+  }
+  if (foreign.length > 0) {
+    throw new Error(`${run}: ${file} holds hooks that are not the kit's own as this kit writes them, and "Trust all and continue" would let them run outside the sandbox: ${foreign.join('; ')}. ${nothing}`);
+  }
+
+  // Codex names the file by the path it found it at; the kit knows the bot
+  // home by its real path, and looks under both.
+  const files = [...new Set([file, realOr(file)])];
+  const keysOf = (hook) => files.map((one) => `${one}:${hook.event}:${hook.at}:${hook.handler}`);
+  const trusted = trustedHashes(ours.flatMap(keysOf), run, nothing);
+  const untrusted = ours.filter((hook) => !keysOf(hook).some((key) => trusted.get(key) === hook.hash)).length;
+  return { untrusted, file };
+}
+
+/** An event's name as Codex writes it in a key and a hash: `SessionStart` is `session_start`. */
+const snake = (event) => event.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+
+/**
+ * The hash Codex trusts a command hook at: SHA-256, in hex, of its event, its
+ * group's matcher and the hook as Codex reads it, as JSON with every key
+ * sorted (Codex 0.162.0, tech notes, section 3).
+ */
+function hashOf(event, matcher, hook) {
+  const handler = {
+    type: 'command',
+    command: hook.command,
+    timeout: hook.timeout ?? DEFAULT_TIMEOUT,
+    async: hook.async === true,
+    ...(hook.statusMessage === undefined ? {} : { statusMessage: hook.statusMessage }),
+  };
+  const identity = {
+    event_name: event,
+    ...(matcher === undefined || matcher === null || NO_MATCHER.has(event) ? {} : { matcher }),
+    hooks: [handler],
+  };
+  return `sha256:${createHash('sha256').update(sorted(identity)).digest('hex')}`;
+}
+
+/** A value as JSON with every object's keys sorted, and no spaces. */
+const sorted = (value) => {
+  if (Array.isArray(value)) return `[${value.map(sorted).join(',')}]`;
+  if (value !== null && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${sorted(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+};
+
+const realOr = (file) => {
+  try {
+    return realpathSync(file);
+  } catch {
+    return file;
+  }
+};
+
+const HEADER = /^\s*\[\s*hooks\.state\."((?:[^"\\]|\\.)*)"\s*\]\s*(?:#.*)?$/;
+const TRUSTED = /^\s*trusted_hash\s*=\s*"(sha256:[0-9a-f]{64})"\s*(?:#.*)?$/;
+const ANY_TABLE = /^\s*\[/;
+
+/** The short escapes of a TOML basic string. */
+const SHORT = { b: '\b', t: '\t', n: '\n', f: '\f', r: '\r', e: '\x1b', '"': '"', '\\': '\\' };
+
+/**
+ * Text with a TOML basic string's escapes decoded, as Codex reads them: a key
+ * written `\u002f` is the key with a `/` in it (the review of PR #517). An
+ * escape TOML does not have is left as it is.
+ */
+const unescaped = (text) => text.replace(/\\(?:u([0-9A-Fa-f]{4})|U([0-9A-Fa-f]{8})|x([0-9A-Fa-f]{2})|(.))/g, (all, u4, u8, x2, one) => {
+  const code = u4 ?? u8 ?? x2;
+  if (code === undefined) return SHORT[one] ?? all;
+  const point = parseInt(code, 16);
+  return point <= 0x10ffff ? String.fromCodePoint(point) : all;
+});
+
+/**
+ * The `trusted_hash` for each of `keys` that has one, by key, from the
+ * config.toml the session's Codex uses: `$CODEX_HOME`'s, or else
+ * `~/.codex`'s. No file is no trust. A key the file holds in any other form
+ * than a `[hooks.state."<key>"]` table with a `trusted_hash` line, or holds
+ * twice, is one the kit cannot tell, and it throws.
+ */
+function trustedHashes(keys, run, nothing) {
+  const file = path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'config.toml');
+  if (!existsSync(file)) return new Map();
+  const wanted = new Set(keys);
+  const text = readFileSync(file, 'utf8');
+  const cannotTell = (key, how) =>
+    new Error(`${run}: ${file} holds Codex's trust for the kit's hook ${key} ${how}, so the kit cannot tell whether Codex trusts it. ${nothing}`);
+
+  const found = new Map();
+  const headers = new Set();
+  let table;
+  for (const line of text.split(/\r?\n/)) {
+    const header = HEADER.exec(line);
+    if (header !== null) {
+      table = unescaped(header[1]);
+      if (wanted.has(table)) {
+        if (headers.has(table)) throw cannotTell(table, 'twice');
+        headers.add(table);
+      }
+      continue;
+    }
+    if (ANY_TABLE.test(line)) {
+      table = undefined;
+      continue;
+    }
+    const hash = TRUSTED.exec(line);
+    if (hash !== null && wanted.has(table)) found.set(table, hash[1]);
+  }
+  // A key in any other form is one the kit cannot read: as it stands, which
+  // a literal string keeps, backslashes and all, or with a basic string's
+  // escapes decoded (the review of PR #517).
+  const decoded = unescaped(text);
+  for (const key of wanted) {
+    if (headers.has(key) && !found.has(key)) throw cannotTell(key, 'in a table with no trusted_hash line the kit reads');
+    if (!headers.has(key) && (text.includes(key) || decoded.includes(key))) throw cannotTell(key, 'in a form the kit does not read');
+  }
+  return found;
+}

package/src/hooks.js

@@ -20,6 +20,9 @@ import { ownCli, shellWord } from './launch.js';
 /** Where each harness reads a project's hooks, inside the bot home. */
 const HOOK_FILE = { claude: '.claude/settings.json', codex: '.codex/hooks.json' };
 
+/** The hooks file `harness` reads in the bot at `home`. */
+export const hooksFileOf = (home, harness) => path.join(home, HOOK_FILE[harness]);
+
 /**
  * The one thing the kit asks to be told: a session beginning. Both harnesses
  * report it whenever a session starts, resumes or is begun again by the user —
@@ -381,6 +384,14 @@ const KIT_NUDGE = new RegExp(String.raw`^(${WORD}) session nudge --bots ${WORD}
 const KIT_MAIL = new RegExp(String.raw`^(${WORD}) session mail --bots ${WORD} --bot ${WORD} 2>/dev/null \|\| true$`);
 const KIT_NAME = new RegExp(String.raw`^(${WORD}) session name --bots ${WORD} --bot ${WORD} 2>/dev/null \|\| true$`);
 
+/**
+ * Whether a hook entry is one of the kit's own as this kit writes it: a
+ * command of exactly a shape the kit writes, run by `cli`, the kit running now
+ * (#506). One that runs some other program, even another `obk`, is not.
+ */
+export const runsThisKit = (hook, cli = ownCli()) =>
+  hook?.type === 'command' && [KIT_HOOK, KIT_SENT, KIT_NUDGE, KIT_NAME].some((pattern) => programOf(hook.command, pattern) === cli);
+
 /** The program a bot made before the kit named itself by path runs. */
 const BARE = 'obk';
 

package/src/orca.js

@@ -284,8 +284,22 @@ export function asFolderProject(setupId, title) {
  * Take a bot's Orca project away: the setup, the project and the repo record,
  * in one call (tech notes, section 1). Only after its tabs are closed: a
  * project taken away first leaves tabs no command line can reach.
+ *
+ * With `--force`, because the caller has made those checks itself: Orca's next
+ * release refuses a plain delete of a project with saved workspace details,
+ * which a bot's project keeps after its tabs close (#528). Orca 1.4.223 does
+ * not know the flag and refuses it before it changes anything, so then the
+ * plain delete is sent, which it takes with no such guard.
  */
-export const deleteProject = (setupId) => orca(['project', 'setup-delete', '--setup', setupId]);
+export function deleteProject(setupId) {
+  const plain = ['project', 'setup-delete', '--setup', setupId];
+  try {
+    return orca([...plain, '--force']);
+  } catch (error) {
+    if (error.code !== 'invalid_argument' || !error.reason?.includes('Unknown flag --force')) throw error;
+    return orca(plain);
+  }
+}
 
 /** Said after a run that made or renamed a project, whatever `tellWindow` answered, and after a removal `reloadWindow` could not follow. */
 export const RELOAD_LINE = "If Orca's sidebar does not show it, reload the window with Cmd+Shift+R.";

package/src/temp.js

@@ -1,7 +1,9 @@
 // `obk temp make` and `obk temp retire`: a session's own temporary sessions
 // (PRD 6.4, #227). And `obk temp trust-hooks` and `obk temp answer`, the
 // answers a maker gives its Codex run's hooks review (#238) and its Claude
-// session's Teach auto mode form (#489).
+// session's Teach auto mode form (#489). And `obk session trust-hooks` and
+// `obk session answer`, the same answers to a long-lived session's screens,
+// given by Bot Father or the user (#506), on the same code.
 //
 // Any long-lived session can make a temporary session of its own bot for a
 // piece of work, and retire it when the work is done, without Bot Father, who
@@ -31,11 +33,12 @@ import { setTimeout as pause } from 'node:timers/promises';
 
 import { readBook, takeLineTurn, TYPING_HELD, TYPING_WAIT_MS, updateBook } from './book.js';
 import { addSession, dropSession, NAME, readBot, tempRoles } from './bot.js';
+import { untrustedKitHooks } from './hook-trust.js';
 import { DEFAULT_APPROVAL, harnessOf, isShortPrompt, ownCli, shellWord, startPrompt, workDirOf } from './launch.js';
-import { sessionInTab } from './message.js';
+import { findSession, sessionInTab } from './message.js';
 import { orca, screenRows, tabs } from './orca.js';
 import { retireSession } from './retire.js';
-import { bringUp, promptPath } from './up.js';
+import { BOT_FATHER, bringUp, promptPath } from './up.js';
 
 /** The settings a temporary session takes from its maker unless told otherwise. */
 const INHERITED = ['model', 'effort', 'context', 'approval'];
@@ -342,26 +345,72 @@ const REVIEW_GONE_MS = 5000;
  */
 export async function trustHooks(bots, { tab, name }) {
   const caller = callerIn(bots, tab, 'trust-hooks', "answer a run's hooks review");
+  const { bot, session } = ownTemp(caller, name, 'answer for', 'Nothing was typed.');
+  await trustAll({ bots, run: `${caller.bot}/${name}`, bot: caller.bot, home: caller.home, session: name, harness: harnessOf(session, bot.harness) }, 'temp');
+  return { bot: caller.bot, session: name, maker: caller.session };
+}
+
+/** Shell text the shell passes on as it is, split at its spaces: what the kit's own launch line leaves unquoted, and spaces. */
+const SHELL_PLAIN = /^[A-Za-z0-9,._+:@%/= -]*$/;
+
+/** A count row of Codex's hooks review: `1 hook is new or changed.`, `3 hooks are new or changed.` */
+const HOOKS_COUNT = /^ *(\d+) hooks? (?:is|are) new or changed\. *$/;
+
+/**
+ * Answer `target`'s hooks review with "Trust all and continue", for `temp
+ * trust-hooks` or `session trust-hooks` (`kind`). "Trust all" lets every hook
+ * the review counts run outside the sandbox, so first the bot's
+ * `.codex/hooks.json` must hold the kit's own hooks alone, and the review's
+ * count row must be the number of them Codex does not trust yet (#506, R4).
+ * Codex also takes hook trust, and hooks, from the session's own `-c` flags,
+ * which its extra_args can carry. What it was started with is the book's
+ * `launched_with`, which the kit writes at each launch: when that names hooks
+ * at all, or there is none, the kit cannot tell the count, and refuses (the
+ * review of PR #517). The arguments are not quoted: they can hold a secret.
+ */
+async function trustAll(target, kind) {
   const nothing = 'Nothing was typed.';
-  const { bot, session } = ownTemp(caller, name, 'answer for', nothing);
-  const run = `${caller.bot}/${name}`;
-  const harness = harnessOf(session, bot.harness);
-  if (harness !== 'codex') {
-    throw new Error(`${run} runs on ${harness}, and temp trust-hooks answers a Codex run's "${HOOKS_REVIEW}" alone. ${nothing}`);
+  if (target.harness !== 'codex') {
+    throw new Error(`${target.run} runs on ${target.harness}, and ${kind} trust-hooks answers a Codex session's "${HOOKS_REVIEW}" alone. ${nothing}`);
+  }
+  const launchedWith = readBook(target.home).sessions[target.session]?.launched_with;
+  if (launchedWith === undefined) {
+    throw new Error(`${target.run}'s book entry does not say what extra arguments it was launched with: it was started before the kit kept that record, or not by the kit. Codex takes hooks and their trust from a session's own -c flags as well, so the kit cannot tell which hooks its review covers. Start it again with the kit, then run this again: ${shellWord(ownCli())} restart --bots ${shellWord(target.bots)} --bot ${target.bot} --session ${target.session}. ${nothing}`);
+  }
+  // A list is the arguments themselves. A string is shell text, which the
+  // shell reads before Codex does (`'h''ooks'` is `hooks`), so it is read only
+  // when it holds nothing the shell would change (the review of PR #517).
+  if (typeof launchedWith === 'string' && !SHELL_PLAIN.test(launchedWith)) {
+    throw new Error(`${target.run} was launched with extra arguments written as shell text the kit does not read, and Codex takes hooks and their trust from a session's own -c flags as well, so the kit cannot tell which hooks its review covers. ${nothing}`);
+  }
+  const words = typeof launchedWith === 'string' ? launchedWith.split(' ') : [launchedWith].flat().map(String);
+  if (words.some((word) => /hooks/i.test(word))) {
+    throw new Error(`${target.run} was launched with extra arguments that mention hooks, and Codex takes hooks and their trust from a session's own -c flags as well, so the kit cannot tell which hooks its review covers. ${nothing}`);
   }
-  await answerScreen(caller, name, {
+  // `--profile <name>` (`-p`) adds `<name>.config.toml` from Codex's home as a
+  // second user layer, and Codex reads hook trust from it too (codex-rs
+  // 0.162.0, cli/src/main.rs:1954-1962, config/src/loader/mod.rs:290-332).
+  if (words.some((word) => /profile/i.test(word) || /^-[^-]*p/.test(word))) {
+    throw new Error(`${target.run} was launched with a Codex profile, whose own config file can hold hook trust the kit does not read, so the kit cannot tell which hooks its review covers. ${nothing}`);
+  }
+  const { untrusted, file } = untrustedKitHooks(target.home, target.run, nothing);
+  await answerScreen(target, {
     what: 'hooks review',
     mark: HOOKS_REVIEW,
     done: `"${TRUST_ALL}" was chosen on its hooks review`,
     answer(rows, { send }) {
       const keys = keysToTrustAll(rows);
       if (keys === undefined) {
-        throw new Error(`${run}'s screen shows no "${HOOKS_REVIEW}" with its choices, so there is nothing for this to answer. It shows: ${shown(rows)}. ${nothing}`);
+        throw new Error(`${target.run}'s screen shows no "${HOOKS_REVIEW}" with its choices, so there is nothing for this to answer. It shows: ${shown(rows)}. ${nothing}`);
+      }
+      const counts = rows.filter((row) => HOOKS_COUNT.test(row));
+      if (counts.length !== 1 || Number(HOOKS_COUNT.exec(counts[0])[1]) !== untrusted) {
+        const saw = counts.length === 0 ? 'shows no row that says how many hooks it covers' : `says "${counts.map((row) => row.trim()).join('" and "')}"`;
+        throw new Error(`${target.run}'s hooks review ${saw}, but ${untrusted} of the kit's own hooks in ${file} are not trusted by Codex yet, so the review may cover hooks that are not the kit's, and "${TRUST_ALL}" would let them run outside the sandbox. ${nothing}`);
       }
       send(keys);
     },
   });
-  return { bot: caller.bot, session: name, maker: caller.session };
 }
 
 /**
@@ -386,23 +435,22 @@ function shown(rows) {
 }
 
 /**
- * Answer a screen of `name`, a temporary session the caller made: under the
- * session's turn for a line (#482), read its screen and hand it to
- * `answer(rows, { send, look })`, which sends keys with `send`, may read the
- * screen again with `look`, and throws when the screen is not its to answer.
- * Then wait for `mark` to leave the screen. `what` names the screen and `done`
- * says what was sent, for the sentences that refuse or fail; `done` may be a
- * function of what `answer` returned.
+ * Answer a screen of the session `target`, `{ run, home, session }`, `run`
+ * being its `<bot>/<session>`: under the session's turn for a line (#482),
+ * read its screen and hand it to `answer(rows, { send, look })`, which sends
+ * keys with `send`, may read the screen again with `look`, and throws when the
+ * screen is not its to answer. Then wait for `mark` to leave the screen.
+ * `what` names the screen and `done` says what was sent, for the sentences
+ * that refuse or fail; `done` may be a function of what `answer` returned.
  */
-async function answerScreen(caller, name, { what, mark, done, answer }) {
-  const run = `${caller.bot}/${name}`;
+async function answerScreen({ run, home, session }, { what, mark, done, answer }) {
   const nothing = 'Nothing was typed.';
-  const tabId = readBook(caller.home).sessions[name]?.tab;
-  const handle = tabId === undefined ? undefined : tabs(caller.home).find((one) => one.tabId === tabId)?.handle;
+  const tabId = readBook(home).sessions[session]?.tab;
+  const handle = tabId === undefined ? undefined : tabs(home).find((one) => one.tabId === tabId)?.handle;
   if (handle === undefined) {
     throw new Error(`${run} has no tab open in Orca, so there is no ${what} of its to answer. ${nothing}`);
   }
-  const turn = takeLineTurn(caller.home, name, TYPING_WAIT_MS);
+  const turn = takeLineTurn(home, session, TYPING_WAIT_MS);
   if (turn === undefined) throw new Error(`${run}: ${TYPING_HELD}.`);
   let answered;
   try {
@@ -540,18 +588,27 @@ const wholeScreen = (rows) => rows.filter((row) => row.trim() !== '').map((row)
  */
 export async function answerTemp(bots, { tab, name }) {
   const caller = callerIn(bots, tab, 'answer', "answer a session's first-run screen");
+  ownTemp(caller, name, 'answer for', 'Nothing was typed.');
+  const sent = await answerTeach({ run: `${caller.bot}/${name}`, home: caller.home, session: name }, 'temp');
+  return { bot: caller.bot, session: name, maker: caller.session, sent };
+}
+
+/**
+ * Answer `target`'s Teach auto mode screen with Not now, for `temp answer` or
+ * `session answer` (`kind`). Returns what answered it.
+ */
+function answerTeach(target, kind) {
+  const { run } = target;
   const nothing = 'Nothing was typed.';
-  ownTemp(caller, name, 'answer for', nothing);
-  const run = `${caller.bot}/${name}`;
-  const sent = await answerScreen(caller, name, {
+  return answerScreen(target, {
     what: `"${TEACH_TITLE}"`,
     mark: TEACH_TITLE,
     done: (said) => `${said} was sent to its Teach auto mode screen`,
     answer(rows, { send, look }) {
       const seen = teachScreen(rows);
       if (seen.misfit !== undefined) {
-        const hooks = rows.some((row) => row.includes(HOOKS_REVIEW)) ? ` A Codex run's "${HOOKS_REVIEW}" is answered with temp trust-hooks.` : '';
-        throw new Error(`${run}'s screen is not one temp answer answers: ${seen.misfit}.${hooks} ${nothing} It shows:\n${wholeScreen(rows)}`);
+        const hooks = rows.some((row) => row.includes(HOOKS_REVIEW)) ? ` A Codex session's "${HOOKS_REVIEW}" is answered with ${kind} trust-hooks.` : '';
+        throw new Error(`${run}'s screen is not one ${kind} answer answers: ${seen.misfit}.${hooks} ${nothing} It shows:\n${wholeScreen(rows)}`);
       }
       if (seen.shape === TEACH_SHAPES[0]) {
         send('\x1b');
@@ -574,7 +631,55 @@ export async function answerTemp(bots, { tab, name }) {
       return `"${NOT_NOW_CHOICE}"`;
     },
   });
-  return { bot: caller.bot, session: name, maker: caller.session, sent };
+}
+
+/**
+ * `obk session trust-hooks`: answer the hooks review of `bot`/`session`, a
+ * long-lived Codex session, as `temp trust-hooks` answers a temporary one's
+ * (#506). Returns `{ bot, session }`.
+ */
+export async function trustSessionHooks(bots, { tab, bot, session }) {
+  const target = longLivedTarget(bots, { tab, bot, session }, 'trust-hooks');
+  await trustAll(target, 'session');
+  return { bot: target.bot, session: target.session };
+}
+
+/**
+ * `obk session answer`: answer the Teach auto mode screen of `bot`/`session`,
+ * a long-lived Claude Code session, as `temp answer` answers a temporary
+ * one's (#506). Returns `{ bot, session, sent }`.
+ */
+export async function answerSession(bots, { tab, bot, session }) {
+  const target = longLivedTarget(bots, { tab, bot, session }, 'answer');
+  const sent = await answerTeach(target, 'session');
+  return { bot: target.bot, session: target.session, sent };
+}
+
+/**
+ * The long-lived session `bot`/`session`, whose first-run screen `session
+ * <verb>` answers, or a refusal. A long-lived session is Bot Father's, so the
+ * caller is a session of Bot Father's, or no session of this fleet: the user,
+ * or an assistant of theirs (#506, R2). A temporary session's screen is its
+ * maker's to answer, with the temp command.
+ */
+function longLivedTarget(bots, { tab, bot, session }, verb) {
+  const nothing = 'Nothing was typed.';
+  const caller = tab === undefined ? undefined : sessionInTab(bots, tab);
+  if (caller !== undefined && caller.bot !== BOT_FATHER) {
+    throw new Error(`session ${verb} runs in ${caller.bot}/${caller.session}'s tab, but a long-lived session is Bot Father's: Bot Father (${BOT_FATHER}) or the user answers its first-run screen. ${nothing}`);
+  }
+  let found;
+  try {
+    found = findSession(bots, `${bot}/${session}`);
+  } catch (error) {
+    throw new Error(`${error.message} ${nothing}`);
+  }
+  const run = `${found.bot}/${found.session}`;
+  const temporary = readBook(found.home).sessions[found.session]?.temporary;
+  if (temporary !== undefined) {
+    throw new Error(`${run} is a temporary session ${temporary.maker} made, so its first-run screen is ${temporary.maker}'s to answer, with temp ${verb} run in ${temporary.maker}'s tab. ${nothing}`);
+  }
+  return { bots, run, bot: found.bot, session: found.session, home: found.home, harness: found.harness };
 }
 
 /**

package/src/up.js

@@ -309,7 +309,10 @@ async function bringUpSession(bots, home, live, session, bot, title) {
       // for a person or Bot Father to settle — added to whatever was already noted,
       // because this run's scan cannot see what an earlier one found. The kit never
       // settles it itself.
-      let entry = { ...current.sessions[session.name], tab: made.tabId, launched, rules };
+      // The extra arguments typed on this line, as the kit's own record of what
+      // this harness was started with: bot.yaml says only what the next launch
+      // gets, and trust-hooks asks what this one got (#506).
+      let entry = { ...current.sessions[session.name], tab: made.tabId, launched, launched_with: session.extra_args ?? [], rules };
       if (rules === undefined) delete entry.rules;
       held = entry.session;
       // Before the line is typed, so the hook finds no id here and takes the one