@brunobracaioli/aibrain 0.4.0-beta.11 → 0.4.0-beta.13

package/dist/guardrails-plugin.mjs

@@ -6,11 +6,18 @@
  * Node executable plus the dispatcher inside the installed package; nothing
  * comes from the server (ADR-0048).
  */
-import { access, mkdir, writeFile } from 'node:fs/promises';
+import { access, mkdir, realpath, writeFile } from 'node:fs/promises';
 import { isAbsolute, join } from 'node:path';
 import { hookById } from './extensions-catalog.mjs';
 import { enabledHookIds, preferencesPath, readPreferences } from './extensions-preferences.mjs';
 import { readStoredLocale, resolvePackLocale } from './engineering-pack.mjs';
+import {
+  codexHookConfigArgs,
+  codexHooksLine,
+  codexHooksValue,
+  summarizeCodexHooks,
+} from './codex-hooks.mjs';
+import { readCodexHookList } from './codex-permissions.mjs';
 
 export const GUARDRAILS_PLUGIN_NAME = 'aisac-guardrails';
 const PLUGIN_VERSION = '1.0.0';
@@ -147,3 +154,54 @@ export async function prepareGuardrails(input) {
     line: `AISAC Engineering: ${enabled.length} guardrail${enabled.length === 1 ? '' : 's'} on (aisac hooks to change them).`,
   };
 }
+
+/**
+ * What Codex reports for the AISAC hooks the user has on, read with Codex's own
+ * `hooks/list` for the exact flags the monitor passes (spec FR6, E6b). Null when
+ * no Codex hook is enabled or the package lacks the dispatcher; `summary` is null
+ * when the listing failed.
+ * @param {{ root: string, packageRoot: string, executable: string, cwd: string, profile: string | undefined, environment: NodeJS.ProcessEnv }} input
+ * @param {{ listHooks?: typeof readCodexHookList }} [dependencies]
+ * @returns {Promise<{ enabled: string[], summary: import('./codex-hooks.mjs').CodexHooksSummary | null } | null>}
+ */
+export async function readCodexGuardrails(input, dependencies = {}) {
+  const listHooks = dependencies.listHooks ?? readCodexHookList;
+  const enabled = enabledHookIds(await readPreferences(input.root)).filter(
+    (id) => hookById(id)?.clients.includes('codex') === true,
+  );
+  if (enabled.length === 0) return null;
+  // The monitor resolves the same file from its own folder; both use the real path.
+  const dispatcher = await realpath(join(input.packageRoot, DISPATCHER)).catch(() => null);
+  if (dispatcher === null || !safeAbsolute(dispatcher) || !safeAbsolute(process.execPath))
+    return null;
+  const paths = { node: process.execPath, dispatcher };
+  const summary = await listHooks({
+    executable: input.executable,
+    cwd: input.cwd,
+    profile: input.profile,
+    environment: input.environment,
+    configArgs: codexHookConfigArgs(paths),
+  }).then(
+    (listed) => summarizeCodexHooks(listed, paths, enabled),
+    () => null,
+  );
+  return { enabled, summary };
+}
+
+/**
+ * The guardrails for a licensed Codex launch: the value the launcher hands the
+ * monitor, and the launch line. The line comes from `hooks/list`, so a guardrail
+ * that waits for the user's review in `/hooks` is never called on.
+ * @param {{ root: string, packageRoot: string, executable: string, cwd: string, profile: string | undefined, environment: NodeJS.ProcessEnv }} input
+ * @param {{ listHooks?: typeof readCodexHookList }} [dependencies]
+ * @returns {Promise<{ value: string, line: string } | null>}
+ */
+export async function prepareCodexGuardrails(input, dependencies = {}) {
+  const read = await readCodexGuardrails(input, dependencies);
+  if (read === null) return null;
+  const locale = resolvePackLocale(await readStoredLocale(input.root));
+  return {
+    value: codexHooksValue(read.enabled, locale),
+    line: codexHooksLine(read.enabled.length, read.summary),
+  };
+}

package/dist/launch.mjs

@@ -18,7 +18,8 @@ import {
   sweepStaleLaunches,
   writeLaunchMarker,
 } from './engineering-pack.mjs';
-import { prepareGuardrails } from './guardrails-plugin.mjs';
+import { prepareCodexGuardrails, prepareGuardrails } from './guardrails-plugin.mjs';
+import { CODEX_HOOKS_ENV, GUARDRAILS_SESSION_ENV, supportsCodexHooks } from './codex-hooks.mjs';
 import {
   CODEX_MCP_ENV,
   claudeDenyRules,
@@ -149,6 +150,8 @@ function childEnvironment(root) {
   delete environment[CODEX_ENGINEERING_ENV];
   delete environment[CODEX_ENGINEERING_SKILLS_ROOT_ENV];
   delete environment[CODEX_MCP_ENV];
+  delete environment[CODEX_HOOKS_ENV];
+  delete environment[GUARDRAILS_SESSION_ENV];
   environment.AIBRAIN_STATE_DIR = resolve(root);
   return environment;
 }
@@ -451,6 +454,7 @@ export async function readSessionServers(root, client, environment) {
  * @property {typeof prepareEngineeringPack} [preparePack] AISAC Engineering pack loader (E4b)
  * @property {typeof prepareGuardrails} [prepareGuardrails] Guardrail hooks plugin writer (E6a)
  * @property {typeof readSessionServers} [readSessionServers] MCP catalog servers to load (E6c)
+ * @property {typeof prepareCodexGuardrails} [prepareCodexGuardrails] Codex guardrail hooks (E6b)
  */
 
 /**
@@ -675,6 +679,7 @@ export async function launchClaude(config, root, args, dependencies = {}) {
 export async function launchCodex(config, root, args, dependencies = {}) {
   const preparePack = dependencies.preparePack ?? prepareEngineeringPack;
   const readServers = dependencies.readSessionServers ?? readSessionServers;
+  const writeCodexGuardrails = dependencies.prepareCodexGuardrails ?? prepareCodexGuardrails;
   const validated = assertConfig(config);
   assertCodexArgs(args);
   const captureLockPlatform = captureLockPlatformCheck();
@@ -744,6 +749,22 @@ export async function launchCodex(config, root, args, dependencies = {}) {
       process.stderr.write(`${line}\n`);
     if (servers !== null && servers.ready.length > 0)
       environment[CODEX_MCP_ENV] = JSON.stringify(servers.ready.map((entry) => entry.id));
+    // Guardrail hooks need the same license and a Codex measured with them
+    // (0.166.0+); like the pack they never block the launch (spec extensions FR6).
+    const guardrails = supportsCodexHooks(compatibility.version)
+      ? await writeCodexGuardrails({
+          root,
+          packageRoot,
+          executable,
+          cwd: launchPlan.effectiveCwd,
+          profile: launchPlan.profile,
+          environment,
+        }).catch(() => null)
+      : null;
+    if (guardrails !== null) {
+      environment[CODEX_HOOKS_ENV] = guardrails.value;
+      process.stderr.write(`${guardrails.line}\n`);
+    }
   }
   environment.AI_BRAIN_MCP_SERVER = MCP_ALIAS;
   environment.CODEX_BIN = executable;

package/dist/monitor.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // @ts-check
 
-import { access } from 'node:fs/promises';
+import { access, realpath } from 'node:fs/promises';
 import { constants } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
@@ -19,6 +19,13 @@ import {
   parseCodexEngineering,
 } from './codex-engineering.mjs';
 import { CODEX_MCP_ENV, codexMcpConfigArgs, parseCodexMcp } from './mcp-servers.mjs';
+import {
+  CODEX_HOOKS_ENV,
+  GUARDRAILS_SESSION_ENV,
+  codexHookConfigArgs,
+  guardrailsSessionValue,
+  parseCodexHooks,
+} from './codex-hooks.mjs';
 
 const root = dirname(fileURLToPath(import.meta.url));
 const endpoint = process.env.AIBRAIN_MCP_URL?.trim();
@@ -59,6 +66,35 @@ try {
 } catch {
   catalogServers = [];
 }
+// Guardrail hooks (E6b) follow the pack as well, and need the state root the pack
+// was checked against: their session value points at this launch's folder. The
+// flags are the whole catalog with byte-stable commands (codex-hooks.mjs). A
+// malformed value, or a package without the dispatcher, starts the session without
+// them.
+/** @type {{ args: string[], session: string } | null} */
+let guardrails = null;
+try {
+  const stateRoot = process.env.AIBRAIN_STATE_DIR;
+  const hooks =
+    engineering === null || stateRoot === undefined
+      ? null
+      : parseCodexHooks(process.env[CODEX_HOOKS_ENV]);
+  if (hooks !== null && engineering !== null && stateRoot !== undefined) {
+    // The real path, as the launcher's hooks/list probe uses (prepareCodexGuardrails).
+    const dispatcher = await realpath(join(root, 'guardrails', 'run.mjs'));
+    await access(dispatcher, constants.R_OK);
+    guardrails = {
+      args: codexHookConfigArgs({ node: process.execPath, dispatcher }),
+      session: guardrailsSessionValue(hooks, {
+        // The pack sits in <launch>/engineering/skills, inside <state>/runtime.
+        launchDirectory: dirname(dirname(engineering.skillsRoot)),
+        stateRoot,
+      }),
+    };
+  }
+} catch {
+  guardrails = null;
+}
 const policyText = process.env.CODEX_CONTEXT_POLICY_JSON;
 let policy;
 if (policyText === undefined) {
@@ -119,6 +155,11 @@ delete env[CODEX_APP_SERVER_PROFILE];
 delete env[CODEX_ENGINEERING_ENV];
 delete env[CODEX_ENGINEERING_SKILLS_ROOT_ENV];
 delete env[CODEX_MCP_ENV];
+delete env[CODEX_HOOKS_ENV];
+// Only this monitor sets the value the hook processes read; one inherited from an
+// outer session never reaches the app-server.
+delete env[GUARDRAILS_SESSION_ENV];
+if (guardrails !== null) env[GUARDRAILS_SESSION_ENV] = guardrails.session;
 if (engineering !== null) env[CODEX_ENGINEERING_SKILLS_ROOT_ENV] = engineering.skillsRoot;
 if (launchEnvelope?.profile !== undefined) env[CODEX_APP_SERVER_PROFILE] = launchEnvelope.profile;
 if (policy !== null) env.CODEX_CONTEXT_POLICY_JSON = JSON.stringify(policy);
@@ -142,6 +183,7 @@ const child = spawn(
     ...(launchEnvelope === null ? [] : ownedAppServerConfigArgs(launchEnvelope)),
     ...(engineering === null ? [] : codexEngineeringConfigArgs(engineering)),
     ...codexMcpConfigArgs(catalogServers),
+    ...(guardrails === null ? [] : guardrails.args),
   ],
   { cwd: process.cwd(), env, stdio: 'inherit' },
 );

package/dist/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.11",
+  "version": "0.4.0-beta.13",
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.11",
+  "version": "0.4.0-beta.13",
   "private": false,
   "description": "AISAC client for Claude Code and Codex: AI Brain memory, context management and AISAC Engineering",
   "license": "UNLICENSED",