@brunobracaioli/aibrain 0.4.0-beta.2 → 0.4.0-beta.4

package/dist/engineering-pack.mjs

@@ -1,13 +1,15 @@
 // @ts-check
 
 /**
- * AISAC Engineering pack for Claude Code (ADR-0047 wave E4b, spec FR4/FR8).
+ * AISAC Engineering pack for Claude Code (ADR-0047 wave E4b) and Codex (E4c),
+ * spec FR4/FR8.
  *
  * One request per launch fetches the account's pack; it doubles as the live
  * license check. The pack is trusted instruction for the user's agent, so it
  * is accepted only when it is signed by a pinned key, matches the requested
  * locale and passes the FR3 rules again here. It is written into the launch's
- * private directory and handed to Claude Code as a second `--plugin-dir`.
+ * private directory and handed to Claude Code as a second `--plugin-dir`, or
+ * to the Codex app-server this launch owns (see codex-engineering.mjs).
  * Any failure starts the session without the pack; nothing here can block a
  * launch or treat a failure as licensed.
  */
@@ -35,6 +37,13 @@ import {
   unavailableReasonFor,
 } from './engineering.mjs';
 import { atomicJson } from './state.mjs';
+import {
+  AGENT_NAME,
+  CODEX_AGENTS_DIRECTORY,
+  MAX_AGENT_DESCRIPTION_LENGTH,
+  tomlBasicString,
+  validateCodexEngineering,
+} from './codex-engineering.mjs';
 
 const PACK_PATH = '/engineering/v1/pack';
 export const PACK_TIMEOUT_MS = 10_000;
@@ -86,6 +95,10 @@ const PLUGIN_NAME = 'aisac-engineering';
 const PLUGIN_LICENSE = 'LicenseRef-AISAC-Engineering';
 const PACK_DIRECTORY = 'engineering';
 const OUTPUT_STYLES_PREFIX = 'output-styles/';
+const SKILLS_DIRECTORY = 'skills';
+const AGENT_FILE = /^agents\/([a-z][a-z0-9-]{0,63})\.md$/u;
+const WATERMARK_KEY = 'aisac_watermark';
+const WATERMARK_VALUE = /^[0-9a-f]{16}$/u;
 export const PUBLIC_KEY_FILE = 'engineering-pack-public-key.json';
 const LOCALE_FILE = 'engineering-locale.json';
 const LAST_LAUNCH_FILE = 'engineering-last-launch.json';
@@ -113,11 +126,12 @@ const SAFE_REASON = /^[a-z][a-z0-9_]{0,63}$/u;
  *   | { outcome: 'unavailable', reason: string }
  *   | { outcome: 'rejected', reason: string }} PackOutcome
  */
+/** @typedef {'claude' | 'codex'} PackClient */
 /**
  * @typedef {{
  *   schemaVersion: 1,
  *   at: string,
- *   client: 'claude',
+ *   client: PackClient,
  *   state: PackOutcome['outcome'],
  *   reason: string | null,
  *   packVersion: string | null,
@@ -198,7 +212,7 @@ export async function readLastLaunch(root) {
     value.schemaVersion !== 1 ||
     typeof value.at !== 'string' ||
     !ISO_INSTANT.test(value.at) ||
-    value.client !== 'claude' ||
+    (value.client !== 'claude' && value.client !== 'codex') ||
     !['loaded', 'inactive', 'not_offered', 'unavailable', 'rejected'].includes(
       /** @type {string} */ (value.state),
     ) ||
@@ -519,12 +533,13 @@ const PLUGIN_DESCRIPTION = {
 };
 
 /**
- * Write a verified pack as a Claude Code plugin inside the launch's private
- * directory and return the plugin root. The manifest is the client's own.
+ * Write the pack files into `engineering/` of the launch's private directory:
+ * `0700` directories, `0600` files, exclusive creation, contained paths.
  * @param {VerifiedPack} pack
  * @param {string} launchDirectory
+ * @returns {Promise<string>} the pack root
  */
-export async function materializePack(pack, launchDirectory) {
+async function writePackFiles(pack, launchDirectory) {
   const base = resolve(launchDirectory, PACK_DIRECTORY);
   await mkdir(base, { mode: 0o700 });
   for (const file of pack.files) {
@@ -534,6 +549,17 @@ export async function materializePack(pack, launchDirectory) {
     await mkdir(dirname(target), { recursive: true, mode: 0o700 });
     await writeFile(target, file.content, { mode: 0o600, flag: 'wx' });
   }
+  return base;
+}
+
+/**
+ * Write a verified pack as a Claude Code plugin inside the launch's private
+ * directory and return the plugin root. The manifest is the client's own.
+ * @param {VerifiedPack} pack
+ * @param {string} launchDirectory
+ */
+export async function materializePack(pack, launchDirectory) {
+  const base = await writePackFiles(pack, launchDirectory);
   const manifest = {
     name: PLUGIN_NAME,
     version: `0.0.0-${pack.packVersion}`,
@@ -553,6 +579,92 @@ export async function materializePack(pack, launchDirectory) {
   return base;
 }
 
+/**
+ * Front-matter values (one `key: value` per line, lower-cased keys, matching
+ * outer quotes removed) and the body after it; null without front matter.
+ * @param {string} content
+ * @returns {{ values: Map<string, string>, body: string } | null}
+ */
+export function splitFrontMatter(content) {
+  if (!content.startsWith(FRONT_MATTER_FENCE)) return null;
+  const end = content.indexOf(FRONT_MATTER_CLOSE, FRONT_MATTER_FENCE.length - 1);
+  if (end === -1) return null;
+  /** @type {Map<string, string>} */
+  const values = new Map();
+  for (const line of content.slice(FRONT_MATTER_FENCE.length, end + 1).split('\n')) {
+    const key = FRONT_MATTER_KEY.exec(line)?.[1];
+    if (key === undefined) continue;
+    let value = line.slice(line.indexOf(':') + 1).trim();
+    if (value.length >= 2 && (value[0] === '"' || value[0] === "'") && value.at(-1) === value[0])
+      value = value.slice(1, -1);
+    values.set(key.toLowerCase(), value);
+  }
+  return { values, body: content.slice(end + FRONT_MATTER_CLOSE.length).replace(/^\n+/u, '') };
+}
+
+/**
+ * A Codex agent role file from a pack agent (`agents/<name>.md`): the front
+ * matter's name and description, the body as developer instructions, and the
+ * origin mark kept as a comment. Null when the agent cannot be a role.
+ * @param {PackFile} file
+ * @returns {{ name: string, description: string, toml: string } | null}
+ */
+export function codexRoleOf(file) {
+  const fileName = AGENT_FILE.exec(file.path)?.[1];
+  const parsed = splitFrontMatter(file.content);
+  if (fileName === undefined || parsed === null) return null;
+  const name = parsed.values.get('name');
+  const description = parsed.values.get('description');
+  if (name !== fileName || !AGENT_NAME.test(name)) return null;
+  if (
+    description === undefined ||
+    description.length === 0 ||
+    description.length > MAX_AGENT_DESCRIPTION_LENGTH ||
+    description === '>' ||
+    description === '|' ||
+    parsed.body.trim().length === 0
+  )
+    return null;
+  const watermark = parsed.values.get(WATERMARK_KEY);
+  const lines = [
+    '# AISAC Engineering. Licensed to your account; do not redistribute.',
+    ...(watermark !== undefined && WATERMARK_VALUE.test(watermark)
+      ? [`# ${WATERMARK_KEY}: ${watermark}`]
+      : []),
+    `name = ${tomlBasicString(name)}`,
+    `description = ${tomlBasicString(description)}`,
+    `developer_instructions = ${tomlBasicString(parsed.body)}`,
+  ];
+  return { name, description, toml: `${lines.join('\n')}\n` };
+}
+
+/**
+ * Write a verified pack for the Codex app-server this launch owns: the files
+ * as for Claude (without the Claude manifest), one role file per agent in
+ * `codex-agents/`, and the description the monitor turns into session
+ * arguments. Output styles have no Codex equivalent and stay unused.
+ * @param {VerifiedPack} pack
+ * @param {string} launchDirectory
+ * @returns {Promise<import('./codex-engineering.mjs').CodexEngineering>}
+ */
+export async function materializeCodexPack(pack, launchDirectory) {
+  const base = await writePackFiles(pack, launchDirectory);
+  const skillsRoot = join(base, SKILLS_DIRECTORY);
+  await mkdir(skillsRoot, { recursive: true, mode: 0o700 });
+  const rolesDirectory = join(base, CODEX_AGENTS_DIRECTORY);
+  await mkdir(rolesDirectory, { mode: 0o700 });
+  /** @type {import('./codex-engineering.mjs').CodexAgentRole[]} */
+  const agents = [];
+  for (const file of pack.files) {
+    const role = codexRoleOf(file);
+    if (role === null) continue;
+    const configFile = join(rolesDirectory, `${role.name}.toml`);
+    await writeFile(configFile, role.toml, { mode: 0o600, flag: 'wx' });
+    agents.push({ name: role.name, description: role.description, configFile });
+  }
+  return validateCodexEngineering({ schemaVersion: 1, skillsRoot, agents });
+}
+
 /**
  * One line for the launch, in the pack locale; null when the capability is
  * not offered, so memory-only users see no change.
@@ -594,13 +706,14 @@ export function packNotice(outcome, locale) {
 /**
  * @param {PackOutcome} outcome
  * @param {PackLocale} locale
+ * @param {PackClient} client
  * @returns {LastLaunch}
  */
-function lastLaunchOf(outcome, locale) {
+function lastLaunchOf(outcome, locale, client) {
   return {
     schemaVersion: 1,
     at: new Date().toISOString(),
-    client: 'claude',
+    client,
     state: outcome.outcome,
     reason:
       outcome.outcome === 'unavailable' || outcome.outcome === 'rejected' ? outcome.reason : null,
@@ -610,13 +723,17 @@ function lastLaunchOf(outcome, locale) {
 }
 
 /**
- * Fetch, verify and write the pack for one Claude Code launch. Never throws.
+ * Fetch, verify and write the pack for one Claude Code or Codex launch. Never
+ * throws. `hostSupported: false` (a Codex release older than the verified
+ * mechanism) still checks the license but loads nothing.
  * @param {{ endpoint: string, token: string, root: string, directory: string,
- *   packageRoot: string, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch,
- *   timeoutMs?: number }} input
- * @returns {Promise<{ pluginRoot: string | null, line: string | null }>}
+ *   packageRoot: string, client?: PackClient, hostSupported?: boolean,
+ *   env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number }} input
+ * @returns {Promise<{ pluginRoot: string | null,
+ *   codex: import('./codex-engineering.mjs').CodexEngineering | null, line: string | null }>}
  */
 export async function prepareEngineeringPack(input) {
+  const client = input.client ?? 'claude';
   const locale = resolvePackLocale(await readStoredLocale(input.root), input.env);
   /** @type {PackOutcome} */
   let outcome;
@@ -632,21 +749,27 @@ export async function prepareEngineeringPack(input) {
   } catch {
     outcome = { outcome: 'unavailable', reason: 'client_error' };
   }
+  if (outcome.outcome === 'loaded' && input.hostSupported === false)
+    outcome = { outcome: 'unavailable', reason: `${client}_outdated` };
   let pluginRoot = null;
+  /** @type {import('./codex-engineering.mjs').CodexEngineering | null} */
+  let codex = null;
   if (outcome.outcome === 'loaded') {
     try {
-      pluginRoot = await materializePack(outcome.pack, input.directory);
+      if (client === 'codex') codex = await materializeCodexPack(outcome.pack, input.directory);
+      else pluginRoot = await materializePack(outcome.pack, input.directory);
     } catch {
+      codex = null;
       await rm(join(input.directory, PACK_DIRECTORY), { recursive: true, force: true }).catch(
         () => undefined,
       );
       outcome = { outcome: 'rejected', reason: 'materialize_failed' };
     }
   }
-  await atomicJson(join(input.root, LAST_LAUNCH_FILE), lastLaunchOf(outcome, locale)).catch(
+  await atomicJson(join(input.root, LAST_LAUNCH_FILE), lastLaunchOf(outcome, locale, client)).catch(
     () => undefined,
   );
-  return { pluginRoot, line: packNotice(outcome, locale) };
+  return { pluginRoot, codex, line: packNotice(outcome, locale) };
 }
 
 /**

package/dist/extensions-catalog.mjs

@@ -0,0 +1,140 @@
+// @ts-check
+/**
+ * The AISAC Engineering extension catalog (spec aisac-engineering-extensions,
+ * FR1, FR2). It ships with the client and is the only source of hooks: the
+ * server and the licensed pack can neither add nor change entries (ADR-0048).
+ * The MCP catalog arrives in E6c.
+ */
+
+/** @typedef {'pt-BR' | 'en'} CatalogLocale */
+/** @typedef {'PreToolUse' | 'PostToolUse' | 'UserPromptSubmit' | 'SessionStart' | 'PreCompact' | 'Stop'} HookEvent */
+/** @typedef {'block' | 'advise' | 'context'} HookMode */
+/**
+ * @typedef {object} HookBinding
+ * @property {HookEvent} event
+ * @property {string} [matcher] Tool names (PreToolUse, PostToolUse) or SessionStart sources.
+ */
+/**
+ * @typedef {object} HookEntry
+ * @property {string} id
+ * @property {HookMode} mode
+ * @property {boolean} defaultOn
+ * @property {readonly ('claude' | 'codex')[]} clients
+ * @property {readonly HookBinding[]} bindings
+ * @property {Readonly<Record<CatalogLocale, string>>} description
+ */
+
+export const CATALOG_ID = /^[a-z][a-z0-9-]{0,31}$/u;
+
+const EDIT_TOOLS = 'Edit|MultiEdit|Write';
+
+/** @type {readonly HookEntry[]} */
+export const HOOK_CATALOG = Object.freeze([
+  {
+    id: 'secrets-guard',
+    mode: 'block',
+    defaultOn: true,
+    clients: ['claude'],
+    bindings: [
+      { event: 'PreToolUse', matcher: 'Read|Edit|MultiEdit|Write|NotebookEdit|Grep|Bash' },
+    ],
+    description: {
+      en: 'Refuses reading or writing secret files (.env, keys, credentials); decides from names only.',
+      'pt-BR':
+        'Recusa ler ou gravar arquivos de segredo (.env, chaves, credenciais); decide só pelo nome.',
+    },
+  },
+  {
+    id: 'git-guard',
+    mode: 'block',
+    defaultOn: false,
+    clients: ['claude'],
+    bindings: [{ event: 'PreToolUse', matcher: 'Bash' }],
+    description: {
+      en: 'Refuses git push to main or master and force pushes (--force-with-lease passes).',
+      'pt-BR': 'Recusa git push na main ou master e push forçado (--force-with-lease passa).',
+    },
+  },
+  {
+    id: 'destructive-guard',
+    mode: 'block',
+    defaultOn: false,
+    clients: ['claude'],
+    bindings: [{ event: 'PreToolUse', matcher: 'Bash' }],
+    description: {
+      en: 'Refuses rm -rf on /, ~, . or .. and DROP DATABASE, DROP TABLE or TRUNCATE.',
+      'pt-BR': 'Recusa rm -rf em /, ~, . ou .. e DROP DATABASE, DROP TABLE ou TRUNCATE.',
+    },
+  },
+  {
+    id: 'format-on-edit',
+    mode: 'advise',
+    defaultOn: false,
+    clients: ['claude'],
+    bindings: [{ event: 'PostToolUse', matcher: EDIT_TOOLS }],
+    description: {
+      en: "Formats the edited file with the project's own formatter, when one is installed.",
+      'pt-BR': 'Formata o arquivo editado com o formatador do próprio projeto, quando houver.',
+    },
+  },
+  {
+    id: 'docs-reminder',
+    mode: 'advise',
+    defaultOn: true,
+    clients: ['claude'],
+    bindings: [{ event: 'PostToolUse', matcher: EDIT_TOOLS }, { event: 'UserPromptSubmit' }],
+    description: {
+      en: 'After a source file changes in a project with docs/, reminds once per turn to update the docs.',
+      'pt-BR':
+        'Quando um arquivo de código muda num projeto com docs/, lembra uma vez por turno de atualizar a documentação.',
+    },
+  },
+  {
+    id: 'session-context',
+    mode: 'context',
+    defaultOn: true,
+    clients: ['claude'],
+    bindings: [{ event: 'SessionStart', matcher: 'startup|resume|clear' }],
+    description: {
+      en: 'Starts the session with a short repository snapshot (branch, status, recent commits).',
+      'pt-BR': 'Abre a sessão com um resumo do repositório (branch, status, commits recentes).',
+    },
+  },
+  {
+    id: 'compact-continuity',
+    mode: 'context',
+    defaultOn: true,
+    clients: ['claude'],
+    bindings: [{ event: 'PreCompact' }, { event: 'SessionStart', matcher: 'compact' }],
+    description: {
+      en: 'Saves a repository snapshot before a compaction and restores it right after.',
+      'pt-BR': 'Salva um resumo do repositório antes do compact e o devolve logo depois.',
+    },
+  },
+  {
+    id: 'continuity-reminder',
+    mode: 'block',
+    defaultOn: true,
+    clients: ['claude'],
+    bindings: [
+      { event: 'PostToolUse', matcher: EDIT_TOOLS },
+      { event: 'UserPromptSubmit' },
+      { event: 'Stop' },
+    ],
+    description: {
+      en: 'In a project with NOTES.md, asks once per turn to update NOTES.md, the spec or the CHANGELOG after code changes.',
+      'pt-BR':
+        'Num projeto com NOTES.md, pede uma vez por turno para atualizar NOTES.md, a spec ou o CHANGELOG depois de mudanças no código.',
+    },
+  },
+]);
+
+/** @param {string} id @returns {HookEntry | undefined} */
+export function hookById(id) {
+  return HOOK_CATALOG.find((entry) => entry.id === id);
+}
+
+/** @returns {string[]} */
+export function hookIds() {
+  return HOOK_CATALOG.map((entry) => entry.id);
+}

package/dist/extensions-cli.mjs

@@ -0,0 +1,214 @@
+// @ts-check
+/**
+ * `aisac hooks` (spec aisac-engineering-extensions FR4): list, enable,
+ * disable and reset guardrail hooks, offline. On a TTY without arguments it
+ * opens a checklist. Choices apply to the next session; running sessions
+ * keep their set.
+ */
+import { emitKeypressEvents } from 'node:readline';
+import { HOOK_CATALOG, hookById, hookIds } from './extensions-catalog.mjs';
+import {
+  readPreferences,
+  resolveHooks,
+  unknownHookIds,
+  writePreferences,
+} from './extensions-preferences.mjs';
+import { readLastLaunch, readStoredLocale, resolvePackLocale } from './engineering-pack.mjs';
+import { stateRoot } from './state.mjs';
+
+const USAGE_EXIT_CODE = 2;
+const ID_WIDTH = Math.max(...HOOK_CATALOG.map((entry) => entry.id.length));
+const NEXT_SESSION =
+  'Applies to the next `aisac claude` session; running sessions keep their current set.';
+const LICENSE_NOTE = 'Hooks load only with an active AISAC Engineering license.';
+
+/**
+ * @typedef {object} ChecklistState
+ * @property {number} cursor
+ * @property {boolean[]} enabled
+ */
+
+/**
+ * One key press in the checklist (pure, tested without a TTY).
+ * @param {ChecklistState} state
+ * @param {{ name?: string, ctrl?: boolean, sequence?: string }} key
+ * @returns {{ state: ChecklistState, done: 'save' | 'cancel' | null }}
+ */
+export function checklistStep(state, key) {
+  const last = state.enabled.length - 1;
+  if ((key.ctrl === true && key.name === 'c') || key.name === 'escape' || key.name === 'q')
+    return { state, done: 'cancel' };
+  if (key.name === 'return' || key.name === 'enter') return { state, done: 'save' };
+  if (key.name === 'up' || key.name === 'k')
+    return { state: { ...state, cursor: Math.max(0, state.cursor - 1) }, done: null };
+  if (key.name === 'down' || key.name === 'j')
+    return { state: { ...state, cursor: Math.min(last, state.cursor + 1) }, done: null };
+  if (key.name === 'space' || key.sequence === ' ') {
+    const enabled = state.enabled.map((value, index) => (index === state.cursor ? !value : value));
+    return { state: { ...state, enabled }, done: null };
+  }
+  return { state, done: null };
+}
+
+/** @param {'pt-BR' | 'en'} locale @param {ReturnType<typeof resolveHooks>} hooks @param {ChecklistState} [state] */
+function renderLines(locale, hooks, state) {
+  return hooks.map((hook, index) => {
+    const enabled = state === undefined ? hook.enabled : state.enabled[index];
+    const pointer = state === undefined ? ' ' : index === state.cursor ? '>' : ' ';
+    const source = state === undefined ? ` ${hook.source.padEnd(7)}` : '';
+    return `${pointer} [${enabled ? 'x' : ' '}] ${hook.entry.id.padEnd(ID_WIDTH)}  ${hook.entry.mode.padEnd(8)}${source}  ${hook.entry.description[locale]}`;
+  });
+}
+
+/** @param {string} root */
+async function licensedLastLaunch(root) {
+  const last = await readLastLaunch(root);
+  return last?.state === 'loaded';
+}
+
+/**
+ * Store explicit choices, keeping MCP choices as they are.
+ * @param {Record<string, boolean>} hooks
+ */
+async function saveHooks(hooks) {
+  const current = await readPreferences(stateRoot());
+  await writePreferences({ hooks, mcp: current.status === 'valid' ? current.mcp : {} });
+  if (current.status === 'invalid')
+    console.log('The previous extensions file was invalid and was replaced.');
+}
+
+/** @param {string[]} ids */
+function unknownIds(ids) {
+  return ids.filter((id) => hookById(id) === undefined);
+}
+
+/** @param {boolean} licensed */
+function afterChange(licensed) {
+  console.log(NEXT_SESSION);
+  if (!licensed) console.log(LICENSE_NOTE);
+}
+
+/**
+ * Interactive checklist. Resolves to the new enabled flags, or null on cancel.
+ * @param {'pt-BR' | 'en'} locale @param {ReturnType<typeof resolveHooks>} hooks
+ * @returns {Promise<boolean[] | null>}
+ */
+function runChecklist(locale, hooks) {
+  return new Promise((resolve) => {
+    let state = { cursor: 0, enabled: hooks.map((hook) => hook.enabled) };
+    const header = 'AISAC Engineering hooks: space toggles, enter saves, q cancels.';
+    const draw = (/** @type {boolean} */ first) => {
+      if (!first) process.stdout.write(`\u001b[${hooks.length}A\u001b[J`);
+      process.stdout.write(`${renderLines(locale, hooks, state).join('\n')}\n`);
+    };
+    console.log(header);
+    draw(true);
+    emitKeypressEvents(process.stdin);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    /** @param {string} _text @param {{ name?: string, ctrl?: boolean, sequence?: string }} key */
+    const onKey = (_text, key) => {
+      const step = checklistStep(state, key ?? {});
+      state = step.state;
+      if (step.done === null) return draw(false);
+      process.stdin.off('keypress', onKey);
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      resolve(step.done === 'save' ? state.enabled : null);
+    };
+    process.stdin.on('keypress', onKey);
+  });
+}
+
+/**
+ * `aisac hooks [list|enable|disable|reset] [ids...] [--json]`.
+ * @param {string[]} args
+ */
+export async function hooksCommand(args) {
+  const json = args.includes('--json');
+  const words = args.filter((arg) => arg !== '--json');
+  const [action = 'list', ...ids] = words;
+  const root = stateRoot();
+  const locale = resolvePackLocale(await readStoredLocale(root));
+  const preferences = await readPreferences(root);
+  const hooks = resolveHooks(preferences);
+  const licensed = await licensedLastLaunch(root);
+
+  if (action === 'list' && ids.length === 0) {
+    if (json) {
+      console.log(
+        JSON.stringify({
+          preferences: preferences.status,
+          licensedLastLaunch: licensed,
+          hooks: hooks.map((hook) => ({
+            id: hook.entry.id,
+            enabled: hook.enabled,
+            source: hook.source,
+            mode: hook.entry.mode,
+            clients: hook.entry.clients,
+            description: hook.entry.description[locale],
+          })),
+          unknown: unknownHookIds(preferences),
+        }),
+      );
+      return;
+    }
+    if (args.length === 0 && process.stdin.isTTY && process.stdout.isTTY) {
+      const chosen = await runChecklist(locale, hooks);
+      if (chosen === null) return console.log('No change.');
+      /** @type {Record<string, boolean>} */
+      const choices = preferences.status === 'valid' ? { ...preferences.hooks } : {};
+      hooks.forEach((hook, index) => {
+        if (chosen[index] !== hook.enabled) choices[hook.entry.id] = chosen[index] === true;
+      });
+      await saveHooks(choices);
+      return afterChange(licensed);
+    }
+    console.log('AISAC Engineering hooks (Claude Code):');
+    console.log(renderLines(locale, hooks).join('\n'));
+    if (preferences.status === 'invalid')
+      console.log('The extensions file is invalid: the defaults apply. Run `aisac hooks reset`.');
+    console.log(
+      'Change with `aisac hooks enable <id>`, `aisac hooks disable <id>` or `aisac hooks reset`.',
+    );
+    if (!licensed) console.log(LICENSE_NOTE);
+    return;
+  }
+  if (action === 'reset' && ids.length === 0) {
+    await saveHooks({});
+    console.log('Hooks reset to the defaults.');
+    return afterChange(licensed);
+  }
+  if ((action === 'enable' || action === 'disable') && ids.length > 0) {
+    const unknown = unknownIds(ids);
+    if (unknown.length > 0) {
+      console.error(
+        `aisac: unknown hook id: ${unknown.join(', ')}. Valid: ${hookIds().join(', ')}.`,
+      );
+      process.exitCode = USAGE_EXIT_CODE;
+      return;
+    }
+    /** @type {Record<string, boolean>} */
+    const choices = preferences.status === 'valid' ? { ...preferences.hooks } : {};
+    for (const id of ids) choices[id] = action === 'enable';
+    await saveHooks(choices);
+    console.log(`${action === 'enable' ? 'Enabled' : 'Disabled'}: ${ids.join(', ')}.`);
+    return afterChange(licensed);
+  }
+  console.error(
+    'aisac: usage: aisac hooks [--json] | aisac hooks enable <id>... | aisac hooks disable <id>... | aisac hooks reset',
+  );
+  process.exitCode = USAGE_EXIT_CODE;
+}
+
+/** Offline extension summary for `status` and `doctor`. @param {string} root */
+export async function extensionsSummary(root) {
+  const preferences = await readPreferences(root);
+  return {
+    preferences: preferences.status,
+    hooks: resolveHooks(preferences)
+      .filter((hook) => hook.enabled)
+      .map((hook) => hook.entry.id),
+    unknown: unknownHookIds(preferences),
+  };
+}