@cybedefend/vibedefend 1.4.2 → 1.4.4

package/dist/hooks/runtime/emit.js

@@ -1,3 +1,15 @@
+/**
+ * Which clients need the `hookSpecificOutput.additionalContext` envelope for
+ * a given event. Everything not listed here keeps its plain-markdown (or
+ * Cursor's own) shape, which is the contract that already works for it.
+ *
+ * SessionStart deliberately does NOT list claude-code: its plain stdout is
+ * delivered by contract today and works — leave it alone (BACK-173 §2).
+ */
+const ENVELOPE_CLIENTS = {
+    SessionStart: new Set(['codex']),
+    PreToolUse: new Set(['claude-code', 'codex']),
+};
 export function emit(body, client) {
     if (!body)
         return;
@@ -15,29 +27,30 @@ export function emit(body, client) {
         process.stdout.write('\n');
 }
 /**
- * SessionStart-context emission.
+ * Model-context emission for a given hook event.
  *
- * For Codex: wraps in the documented JSON envelope so the body lands in
- * `additionalContext` and Codex injects it as developer context for the
- * upcoming conversation. (The "plain text on stdout" fallback Codex's
- * docs mention does not appear to be reliably honored in practice.)
+ * For the clients listed in `ENVELOPE_CLIENTS[hookEventName]`: writes ONE
+ * JSON object `{ hookSpecificOutput: { hookEventName, additionalContext } }`
+ * so the body lands in the model's context. Callers MUST call this once per
+ * hook run — two JSON objects concatenated on stdout are not valid JSON and
+ * the agent drops both (see fetch-rules, which accumulates the business and
+ * security blocks before emitting).
  *
  * For every other client: delegates to `emit`, which preserves Cursor's
- * permission-allow envelope and Claude Code / VS Code / Windsurf's
- * plain-markdown shape — all of which already work for their respective
- * SessionStart equivalents.
+ * permission-allow envelope and the plain-markdown shape that already works
+ * for the remaining client/event pairs.
  */
-export function emitContext(body, client) {
+export function emitContext(body, client, hookEventName) {
     if (!body)
         return;
-    if (client === 'codex') {
+    if (ENVELOPE_CLIENTS[hookEventName].has(client)) {
         const payload = JSON.stringify({
             hookSpecificOutput: {
-                hookEventName: 'SessionStart',
+                hookEventName,
                 additionalContext: body,
             },
         });
-        process.stdout.write(payload);
+        process.stdout.write(payload + '\n');
         return;
     }
     emit(body, client);

package/dist/hooks/runtime/emit.js.map

@@ -1 +1 @@
-{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../../src/hooks/runtime/emit.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,MAAgB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAgB;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,kBAAkB,EAAE;gBAClB,aAAa,EAAE,cAAc;gBAC7B,iBAAiB,EAAE,IAAI;aACxB;SACF,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,MAAgB,EAChB,MAAe;IAEf,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../../src/hooks/runtime/emit.ts"],"names":[],"mappings":"AA0CA;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAoD;IACxE,YAAY,EAAE,IAAI,GAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,EAAE,IAAI,GAAG,CAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,MAAgB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,MAAgB,EAChB,aAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,kBAAkB,EAAE;gBAClB,aAAa;gBACb,iBAAiB,EAAE,IAAI;aACxB;SACF,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,MAAgB,EAChB,MAAe;IAEf,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrB,CAAC"}

package/dist/hooks/runtime/fetch-rules.js

@@ -1,22 +1,38 @@
 /**
- * PreToolUse hook — fetch business rules before an Edit/Write.
+ * PreToolUse hook — fetch business rules before a file is written.
  *
  * Triggered by every agent on every tool call (Cursor and Claude Code
- * honour matchers and only fire for Edit/Write/MultiEdit; VS Code
- * ignores matchers, so we self-filter; Windsurf has its own
- * pre_write_code event; Codex uses apply_patch). We early-exit unless
- * the tool name is in our interested set.
+ * honour matchers; VS Code ignores matchers, so we self-filter; Windsurf
+ * has its own pre_write_code event; Codex uses apply_patch). We early-exit
+ * unless the tool name is in our interested set.
+ *
+ * `Bash` is in that set (BACK-173 follow-up): a shell command that writes
+ * files — `cat > f <<EOF`, `sed -i`, `tee`, `cp`… — fetches the rules for
+ * every file it targets, exactly like the edit tools. Without it an agent
+ * writing through the shell bypassed rules injection entirely, which is the
+ * common path in practice. A read-only shell command has no targets and
+ * exits silently (see `sniff` + `shell-writes`).
  */
 import { sniff } from './sniff.js';
 import { resolveProjectIdWithApi, resolveToken, } from './resolve.js';
 import { fetchBusinessRules, fetchSecurityRules } from './api.js';
-import { emit } from './emit.js';
+import { emitContext } from './emit.js';
 import { loadRuntimeConfig, readStdinJson } from './config.js';
+/**
+ * Production emitter: the rules body must reach the MODEL, and on Claude
+ * Code / Codex a PreToolUse hook's plain stdout never does (BACK-173) — it
+ * has to travel in a `hookSpecificOutput.additionalContext` envelope whose
+ * `hookEventName` names THIS hook.
+ */
+function emitPreToolUseContext(body, client) {
+    emitContext(body, client, 'PreToolUse');
+}
 const INTERESTED_TOOLS = new Set([
     'Edit',
     'Write',
     'MultiEdit',
     'apply_patch',
+    'Bash',
 ]);
 export async function fetchRulesHook(deps = {}) {
     const readStdin = deps.readStdin ?? readStdinJson;
@@ -25,7 +41,7 @@ export async function fetchRulesHook(deps = {}) {
     const resolveTok = deps.resolveTokenFn ?? resolveToken;
     const fetchRules = deps.fetchRulesFn ?? fetchBusinessRules;
     const fetchSecRules = deps.fetchSecurityRulesFn ?? fetchSecurityRules;
-    const emitFn = deps.emitFn ?? emit;
+    const emitFn = deps.emitFn ?? emitPreToolUseContext;
     const stdin = await readStdin();
     const event = sniff(stdin);
     // Self-filter: ignore tool calls we don't care about. Crucial for
@@ -44,15 +60,21 @@ export async function fetchRulesHook(deps = {}) {
     if (!projectId)
         return;
     const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
-    const token = resolveTok(config.region.mcpName);
+    const token = resolveTok(config.region.mcpName, {
+        mcpUrl: config.region.mcpUrl,
+    });
     if (!token)
         return;
     const intent = buildIntent(event);
+    // Edit tools write one file; a shell command may write several — fetch
+    // for all of them and label the callout with the whole list.
+    const files = event.filePaths.length > 0 ? event.filePaths : [event.filePath];
+    const fileLabel = files.join(', ');
     const fetchOpts = {
         apiBase,
         projectId,
         token,
-        files: [event.filePath],
+        files,
         intent,
         topK: 5,
     };
@@ -62,17 +84,23 @@ export async function fetchRulesHook(deps = {}) {
         fetchRules(fetchOpts),
         fetchSecRules(fetchOpts),
     ]);
+    // Accumulate, then emit ONCE. On Claude Code / Codex the emitter writes a
+    // JSON envelope; two envelopes concatenated on stdout are not JSON and the
+    // agent drops both — so both blocks ride in a single body (BACK-173 §1).
+    const blocks = [];
     if (businessResult) {
-        const body = composeBody(businessResult.markdown, businessResult.total, event.filePath);
+        const body = composeBody(businessResult.markdown, businessResult.total, fileLabel);
         if (body)
-            emitFn(body, event.client);
+            blocks.push(body);
     }
     if (securityResult &&
         securityResult.total > 0 &&
         securityResult.markdown &&
         securityResult.markdown.length > 0) {
-        emitFn(composeSecurityBody(securityResult.markdown, securityResult.total, event.filePath), event.client);
+        blocks.push(composeSecurityBody(securityResult.markdown, securityResult.total, fileLabel));
     }
+    if (blocks.length > 0)
+        emitFn(blocks.join('\n'), event.client);
 }
 /** Build the retrieval `intent` string from the event content. */
 function buildIntent(event) {
@@ -104,7 +132,7 @@ function visibleCalloutTemplate(kind, total, filePath) {
     return [
         '---',
         '',
-        `**🛡️ REQUIRED USER-VISIBLE MARKER** — you MUST include this exact block as the FIRST paragraph of your next assistant reply, BEFORE the Edit/Write tool call. Do not paraphrase, do not skip — without it, the user cannot see CybeDefend is influencing the change.`,
+        `**🛡️ REQUIRED USER-VISIBLE MARKER** — you MUST include this exact block as the FIRST paragraph of your next assistant reply, BEFORE the tool call that writes the file. Do not paraphrase, do not skip — without it, the user cannot see CybeDefend is influencing the change.`,
         '',
         `> 🛡️ **CybeDefend ${kind} Rules** — ${total} rule${total === 1 ? '' : 's'} for \`${filePath}\``,
         `> - **<rule-title>** [<severity> · <category>] — applies because <one-sentence reason>`,

package/dist/hooks/runtime/fetch-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-rules.js","sourceRoot":"","sources":["../../../src/hooks/runtime/fetch-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AAoBH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,kBAAkB,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,kEAAkE;IAClE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,SAAS;QACT,KAAK;QACL,KAAK,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvB,MAAM;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,UAAU,CAAC,SAAS,CAAC;QACrB,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,WAAW,CACtB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,IACE,cAAc;QACd,cAAc,CAAC,KAAK,GAAG,CAAC;QACxB,cAAc,CAAC,QAAQ;QACvB,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;QACD,MAAM,CACJ,mBAAmB,CACjB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,KAAK,CAAC,QAAQ,CACf,EACD,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,OAAO,cAAc,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,MAAM,0BAA0B,OAAO,EAAE,CAAC;AACzH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,KAAa,EACb,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACjE,OAAO;QACL,KAAK;QACL,EAAE;QACF,uQAAuQ;QACvQ,EAAE;QACF,sBAAsB,IAAI,cAAc,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,IAAI;QACjG,wFAAwF;QACxF,oFAAoF;QACpF,EAAE;QACF,uCAAuC,OAAO,2KAA2K;QACzN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,SAAS,WAAW,CAClB,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;YACnE,QAAQ;YACR,EAAE;YACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;SACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,iEAAiE;QACjE,+DAA+D;QAC/D,sBAAsB;QACtB,OAAO;YACL,iDAAiD,QAAQ,GAAG;YAC5D,EAAE;YACF,8CAA8C;YAC9C,EAAE;YACF,KAAK;YACL,EAAE;YACF,sJAAsJ;YACtJ,EAAE;YACF,2DAA2D,QAAQ,iBAAiB;YACpF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,OAAO;QACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;QACnE,QAAQ;QACR,EAAE;QACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"fetch-rules.js","sourceRoot":"","sources":["../../../src/hooks/runtime/fetch-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG/D;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY,EAAE,MAAgB;IAC3D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,MAAM;CACP,CAAC,CAAC;AAqBH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,kBAAkB,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,kEAAkE;IAClE,iEAAiE;IACjE,mBAAmB;IACnB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG;QAChB,OAAO;QACP,SAAS;QACT,KAAK;QACL,KAAK;QACL,MAAM;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,UAAU,CAAC,SAAS,CAAC;QACrB,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,WAAW,CACtB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,SAAS,CACV,CAAC;QACF,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IACE,cAAc;QACd,cAAc,CAAC,KAAK,GAAG,CAAC;QACxB,cAAc,CAAC,QAAQ;QACvB,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,mBAAmB,CACjB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,SAAS,CACV,CACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,OAAO,cAAc,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,MAAM,0BAA0B,OAAO,EAAE,CAAC;AACzH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAC7B,IAA6B,EAC7B,KAAa,EACb,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACjE,OAAO;QACL,KAAK;QACL,EAAE;QACF,iRAAiR;QACjR,EAAE;QACF,sBAAsB,IAAI,cAAc,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,IAAI;QACjG,wFAAwF;QACxF,oFAAoF;QACpF,EAAE;QACF,uCAAuC,OAAO,2KAA2K;QACzN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,SAAS,WAAW,CAClB,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;YACnE,QAAQ;YACR,EAAE;YACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;SACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,iEAAiE;QACjE,+DAA+D;QAC/D,sBAAsB;QACtB,OAAO;YACL,iDAAiD,QAAQ,GAAG;YAC5D,EAAE;YACF,8CAA8C;YAC9C,EAAE;YACF,KAAK;YACL,EAAE;YACF,sJAAsJ;YACtJ,EAAE;YACF,2DAA2D,QAAQ,iBAAiB;YACpF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,KAAa,EACb,QAAgB;IAEhB,OAAO;QACL,iCAAiC,KAAK,kBAAkB,QAAQ,GAAG;QACnE,QAAQ;QACR,EAAE;QACF,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/hooks/runtime/hook-refresh-trigger.js

@@ -0,0 +1,76 @@
+/**
+ * SessionStart: notice that the agents' hook entries were rendered by another
+ * version than the running runner, and re-wire them in the background.
+ *
+ * `installedVersion` is stamped by whatever last rendered the hooks (the
+ * installer, `update`, or `update --refresh-hooks`). The background
+ * auto-update, `update --self` and a manual `npm i -g` only replace the
+ * package, so after them the stamp names the previous version while the shim
+ * already runs the new runner. When a release changes the wiring itself
+ * (1.4.3 put fetch-rules on `Bash`, BACK-173), those installs kept the old
+ * wiring for good.
+ *
+ * On drift we spawn `vibedefend update --refresh-hooks` from the same global
+ * package, detached, once per runner version (a refresh that keeps failing
+ * must not respawn on every session). The new entries take effect in the
+ * agent's next session. Never throws, never blocks the bootstrap.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { ensureDirFor } from '../../utils.js';
+/** Returns whether a background refresh was spawned. */
+export function maybeRefreshStaleWiring(deps) {
+    try {
+        const { config, runnerVersion } = deps;
+        // Non-global installs have no package to call back into (and no
+        // background auto-update): their wiring is rendered by their own flow.
+        if (!config.runnerSource || config.installedVersion === runnerVersion) {
+            return false;
+        }
+        // <pkg>/dist/hook-runner.js → <pkg>/bin/vibedefend.js
+        const cliEntry = join(dirname(dirname(config.runnerSource)), 'bin', 'vibedefend.js');
+        if (!(deps.exists ?? existsSync)(cliEntry))
+            return false;
+        const markerPath = deps.markerPath ??
+            join(process.env.CYBEDEFEND_HOME ?? homedir(), '.cybedefend', 'hook-refresh.json');
+        if (readMarkerVersion(markerPath) === runnerVersion)
+            return false;
+        (deps.spawnRefresh ?? defaultSpawnRefresh)(cliEntry);
+        writeMarker(markerPath, runnerVersion);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function readMarkerVersion(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        const data = JSON.parse(readFileSync(path, 'utf8'));
+        return typeof data.version === 'string' ? data.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeMarker(path, version) {
+    try {
+        ensureDirFor(path);
+        writeFileSync(path, JSON.stringify({ version, spawnedAt: Date.now() }) + '\n');
+    }
+    catch {
+        /* best-effort */
+    }
+}
+function defaultSpawnRefresh(cliEntry) {
+    const child = spawn(process.execPath, [cliEntry, 'update', '--refresh-hooks'], {
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+    });
+    child.unref();
+}
+//# sourceMappingURL=hook-refresh-trigger.js.map

package/dist/hooks/runtime/hook-refresh-trigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-refresh-trigger.js","sourceRoot":"","sources":["../../../src/hooks/runtime/hook-refresh-trigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAc9C,wDAAwD;AACxD,MAAM,UAAU,uBAAuB,CAAC,IAAqB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACvC,gEAAgE;QAChE,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,KAAK,aAAa,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAEzD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACrF,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QAElE,CAAC,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC;QAC7E,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,EAAE;QAC7E,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/hooks/runtime/resolve.js

@@ -15,8 +15,10 @@
  * (Claude Code on Windows doesn't write to a system keychain yet anyway.)
  */
 import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { getValidAccessToken, LoginRequiredError } from '../../auth/auth.js';
+import { loadAuth } from '../../auth/auth-store.js';
 import { getOriginRemote, parseRemoteUrl } from '../../git.js';
 import { resolveProjectByRepository, } from '../../api/projects.js';
 import { getCachedRepoLink, writeCachedRepoLink, } from './repo-link-cache.js';
@@ -62,47 +64,81 @@ export function resolveProjectId(cwd = process.cwd(), deps = {}) {
     return { projectId: null, apiBase: null };
 }
 /**
- * Resolve the bearer token. Returns null if not found.
+ * Resolve the bearer token for the configured region. Returns null if not
+ * found. Only ever returns a credential that belongs to that region.
  *
- * macOS: Claude Code stores MCP OAuth tokens in the Keychain under the
- * service name "Claude Code-credentials". We shell out to `security`
- * (ships with macOS, no install) to extract the JSON blob, then parse
- * for the entry whose `serverName` matches our MCP name.
+ * Order:
+ *  1. `$CYBEDEFEND_TOKEN`.
+ *  2. VibeDefend's own `vibedefend login` bundle for the region, while it is
+ *     still valid. Read-only: refreshing belongs to `guard-check`
+ *     ({@link resolveTokenWithRefresh}). Logto rotates the refresh token on
+ *     every use, so two hook processes refreshing at once (guard-check and
+ *     fetch-rules fire on the same tool call) would trip its reuse detection.
+ *  3. macOS, Claude Code: the "Claude Code-credentials" Keychain blob, entry
+ *     whose `serverName` matches our MCP name.
+ *  4. macOS, Codex: the "Codex MCP Credentials" Keychain service, under the
+ *     region's exact account (see {@link codexCredentialAccount}).
+ *     Never the service's first entry: that is whichever server the user
+ *     logged into first (Linear, in the field), and its token went to our
+ *     gateway (BACK-173).
+ *  5. Linux: `secret-tool lookup service Claude-Code account <mcpName>`
+ *     (requires libsecret-tools; ships with most desktop distros).
  *
- * macOS (Codex): Codex stores MCP OAuth tokens in the Keychain under
- * the service name "Codex MCP Credentials". The account is
- * "<mcpName>|<hash>" and the password is a JSON blob with an
- * `access_token` field. We try this keychain after the Claude Code one.
- *
- * Linux: `secret-tool lookup service Claude-Code account <mcpName>`
- * (requires libsecret-tools; ships with most desktop distros).
- *
- * Windows: env var only for V1. Future improvement: `cmdkey /list` →
- * parse, or via a small PowerShell snippet.
+ * Windows: env var or login bundle only. Future improvement: `cmdkey /list`
+ * → parse, or via a small PowerShell snippet.
  */
-export function resolveToken(mcpName) {
+export function resolveToken(mcpName, opts = {}) {
     const envToken = process.env.CYBEDEFEND_TOKEN;
     if (envToken && envToken.length > 0)
         return envToken;
-    if (process.platform === 'darwin') {
-        return resolveTokenMacOS(mcpName) ?? resolveTokenCodexMacOS(mcpName);
+    const stored = (opts.loadStoredAuth ?? loadAuth)(mcpName);
+    if (stored && (opts.now ?? Date.now)() < stored.expiresAt) {
+        return stored.accessToken;
     }
-    if (process.platform === 'linux')
+    const platform = opts.platform ?? process.platform;
+    const readKeychain = opts.readKeychain ?? readMacOSKeychain;
+    if (platform === 'darwin') {
+        return (resolveTokenMacOS(mcpName, readKeychain) ??
+            resolveTokenCodexMacOS(mcpName, opts.mcpUrl, readKeychain));
+    }
+    if (platform === 'linux')
         return resolveTokenLinux(mcpName);
     return null;
 }
-function resolveTokenMacOS(mcpName) {
-    let blob;
+/**
+ * Keychain account under which Codex stores an MCP server's OAuth credential:
+ * `<name>|<first 16 hex chars of sha256('{"type":"http","url":<url>,"headers":{}}')>`.
+ * Matches every account of a real Codex 0.142 keychain.
+ */
+export function codexCredentialAccount(mcpName, mcpUrl) {
+    const digest = createHash('sha256')
+        .update(JSON.stringify({ type: 'http', url: mcpUrl, headers: {} }))
+        .digest('hex');
+    return `${mcpName}|${digest.slice(0, 16)}`;
+}
+function readMacOSKeychain(service, account) {
     try {
-        blob = execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], {
+        const blob = execFileSync('security', [
+            'find-generic-password',
+            '-s',
+            service,
+            ...(account === undefined ? [] : ['-a', account]),
+            '-w',
+        ], {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
             timeout: 2000,
         }).trim();
+        return blob.length > 0 ? blob : null;
     }
     catch {
         return null;
     }
+}
+function resolveTokenMacOS(mcpName, readKeychain) {
+    const blob = readKeychain('Claude Code-credentials');
+    if (!blob)
+        return null;
     try {
         const data = JSON.parse(blob);
         const oauth = data.mcpOAuth ?? {};
@@ -121,50 +157,37 @@ function resolveTokenMacOS(mcpName) {
 }
 /**
  * Codex stores MCP OAuth tokens in the macOS Keychain under service
- * "Codex MCP Credentials". The account is "<mcpName>|<hash>" — we use
- * a prefix match on the service and iterate all matching entries via
- * `security find-generic-password -s "Codex MCP Credentials"`.
+ * "Codex MCP Credentials", account `<mcpName>|<hash>`
+ * ({@link codexCredentialAccount}). Codex 0.142 writes
+ * `{ token_response: { access_token } }`; flat `access_token` /
+ * `accessToken` / raw-string blobs are still accepted.
  *
- * The password blob is a JSON object with an `access_token` field (the
- * same structure Codex writes when `codex mcp login <name>` completes).
- * Fall back to returning the raw blob as a token if JSON parsing fails
- * (some Codex versions write the raw token string directly).
+ * Only the region's own accounts are read. The service-wide lookup
+ * (`-s` without `-a`) returns whichever entry comes first, i.e. possibly
+ * another server's token.
  */
-function resolveTokenCodexMacOS(mcpName) {
-    // `security find-generic-password` with `-s` returns the FIRST matching
-    // entry. We use `-a <account-prefix>` to narrow to our MCP name, but the
-    // account has a `|<hash>` suffix we don't know. Instead we enumerate all
-    // entries for the Codex service and filter by mcpName prefix.
-    let blob;
-    try {
-        blob = execFileSync('security', ['find-generic-password', '-s', 'Codex MCP Credentials', '-a', mcpName, '-w'], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            timeout: 2000,
-        }).trim();
-    }
-    catch {
-        // Exact account match failed (account has a hash suffix). Try without
-        // the -a filter and scan all entries for this service by iterating.
-        // `security find-generic-password` without `-a` returns the first entry;
-        // to iterate all we'd need `security dump-keychain` (requires trust), so
-        // we try the service-only lookup and accept the first entry returned.
-        try {
-            blob = execFileSync('security', ['find-generic-password', '-s', 'Codex MCP Credentials', '-w'], {
-                encoding: 'utf8',
-                stdio: ['ignore', 'pipe', 'ignore'],
-                timeout: 2000,
-            }).trim();
-        }
-        catch {
-            return null;
-        }
+function resolveTokenCodexMacOS(mcpName, mcpUrl, readKeychain) {
+    const accounts = mcpUrl
+        ? [codexCredentialAccount(mcpName, mcpUrl), mcpName]
+        : [mcpName];
+    for (const account of accounts) {
+        const blob = readKeychain('Codex MCP Credentials', account);
+        if (!blob)
+            continue;
+        const token = parseCodexCredential(blob);
+        if (token)
+            return token;
     }
-    if (!blob)
-        return null;
+    return null;
+}
+function parseCodexCredential(blob) {
     try {
         const data = JSON.parse(blob);
-        return data.access_token ?? data.accessToken ?? data.token ?? null;
+        return (data.token_response?.access_token ??
+            data.access_token ??
+            data.accessToken ??
+            data.token ??
+            null);
     }
     catch {
         // Raw token string stored directly.
@@ -205,7 +228,9 @@ function resolveTokenLinux(mcpName) {
  * Never throws — all errors are converted to null so hook callers remain
  * fail-open.
  */
-export async function resolveTokenWithRefresh(mcpName, deps = {}) {
+export async function resolveTokenWithRefresh(mcpName, deps = {}, 
+/** The region's MCP URL, handed to the legacy lookup (Codex account). */
+opts = {}) {
     const getValidAccessTokenFn = deps.getValidAccessToken ?? getValidAccessToken;
     const resolveTokenFn = deps.resolveTokenFn ?? resolveToken;
     // 1. Env var takes highest precedence (CI / scripted use).
@@ -230,13 +255,13 @@ export async function resolveTokenWithRefresh(mcpName, deps = {}) {
             // agent's MCP OAuth (the common case) — that is the .env-not-blocked bug.
             // Only when the legacy lookup is ALSO empty do we return null, and the
             // caller then surfaces the loud UNVERIFIED banner.
-            return resolveTokenFn(mcpName);
+            return resolveTokenFn(mcpName, opts);
         }
         // Transient error (network/DNS) — fall through to the legacy path below
         // so a stale-but-unexpired legacy token can still be used.
     }
     // 3. Fall back to the synchronous legacy keychain lookup (pre-PKCE tokens).
-    return resolveTokenFn(mcpName);
+    return resolveTokenFn(mcpName, opts);
 }
 const RESOLVE_API_TIMEOUT_MS = 4_000;
 /**

package/dist/hooks/runtime/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAe/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;aACtD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAChE;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7E;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAC9D;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CACF,CAAC,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI3B,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,OAAyB,EAAE;IAE3B,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC9E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IAE3D,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,mDAAmD;YACnD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AA+BD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAgC,EAAE;IAElC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,uEAAuE;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAE/D,uEAAuE;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,+BAA+B;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,0BAA0B,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,KAAK,EACL,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACnE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,EAAE,CACxD,CAAC;QACF,4EAA4E;QAC5E,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAElC,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,mBAAmB,CACjB,GAAG,EACH,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAClE,IAAI,CAAC,SAAS,CACf,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;QAED,gEAAgE;QAChE,mBAAmB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAmB,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAe/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;aACtD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAC5D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CACL,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC;YACxC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,OAAgB;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CACvB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,YAA4B;IAE5B,MAAM,IAAI,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAC7B,OAAe,EACf,MAA0B,EAC1B,YAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QACpD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK3B,CAAC;QACF,OAAO,CACL,IAAI,CAAC,cAAc,EAAE,YAAY;YACjC,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,KAAK;YACV,IAAI,CACL,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,OAAyB,EAAE;AAC3B,yEAAyE;AACzE,OAA4B,EAAE;IAE9B,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC9E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IAE3D,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,mDAAmD;YACnD,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AA+BD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAgC,EAAE;IAElC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,uEAAuE;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAE/D,uEAAuE;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,+BAA+B;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,0BAA0B,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,KAAK,EACL,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACnE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,EAAE,CACxD,CAAC;QACF,4EAA4E;QAC5E,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAElC,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,mBAAmB,CACjB,GAAG,EACH,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAClE,IAAI,CAAC,SAAS,CACf,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;QAED,gEAAgE;QAChE,mBAAmB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/hooks/runtime/session-start.js

@@ -14,7 +14,12 @@ import { fetchProposalsCount } from './api.js';
 import { emitContext } from './emit.js';
 import { loadRuntimeConfig, readStdinJson } from './config.js';
 import { selfUpdateCheck } from './self-update-check.js';
+import { maybeRefreshStaleWiring } from './hook-refresh-trigger.js';
 import { pkg } from '../../version.js';
+/** Production emitter — the envelope's `hookEventName` must name THIS hook. */
+function emitSessionStartContext(body, client) {
+    emitContext(body, client, 'SessionStart');
+}
 export async function sessionStartHook(deps = {}) {
     const readStdin = deps.readStdin ?? readStdinJson;
     const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
@@ -25,12 +30,17 @@ export async function sessionStartHook(deps = {}) {
     // SessionStart context goes through `emitContext`, not `emit`, so the
     // body lands inside Codex's `additionalContext` JSON envelope (and as
     // plain markdown for everyone else). See emit.ts for the rationale.
-    const emitFn = deps.emitFn ?? emitContext;
+    const emitFn = deps.emitFn ?? emitSessionStartContext;
     const stdin = await readStdin();
     const event = sniff(stdin);
     const config = loadConfig();
     if (!config)
         return;
+    // The wiring is machine-wide: check it before the per-repo early exits.
+    (deps.refreshStaleWiringFn ?? maybeRefreshStaleWiring)({
+        config,
+        runnerVersion: pkg.version,
+    });
     // Async: falls back to git-origin auto-discovery (cache + bounded 4s
     // gateway call) when no env var / config.json projectId exists.
     const { projectId, apiBase: configApiBase } = await resolveProject();
@@ -44,12 +54,12 @@ export async function sessionStartHook(deps = {}) {
     }
     // Token + proposal-count are best-effort. The projectId block MUST surface
     // even when neither is available — that is the most important piece of
-    // session context for the agent (especially under Codex, whose MCP
-    // credentials live in a different Keychain service that `resolveToken`
-    // doesn't read yet, and so token lookup returns null on every Codex
-    // session). The proposal-count line is omitted on failure rather than
-    // showing a misleading "0" or blocking the whole bootstrap.
-    const token = resolveTok(config.region.mcpName);
+    // session context for the agent (e.g. an expired login bundle that no
+    // hook has refreshed yet). The proposal-count line is omitted on failure
+    // rather than showing a misleading "0" or blocking the whole bootstrap.
+    const token = resolveTok(config.region.mcpName, {
+        mcpUrl: config.region.mcpUrl,
+    });
     let total = null;
     if (token) {
         const result = await fetchProposals({ apiBase, projectId, token });

package/dist/hooks/runtime/session-start.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-start.js","sourceRoot":"","sources":["../../../src/hooks/runtime/session-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAoBvC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACpE,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAE1C,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,MAAM,CACJ,oDAAoD,KAAK,CAAC,MAAM,iBAAiB,SAAS,IAAI,EAC9F,KAAK,CAAC,MAAM,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,iCAAiC;QACjC,gBAAgB,SAAS,eAAe,KAAK,CAAC,MAAM,GAAG;KACxD,CAAC;IACF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,mFAAmF,CACpF,CAAC;IAEF,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,gFAAgF,EAChF,mEAAmE,CACpE,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,sFAAsF,CACvF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,mCAAmC,KAAK,+BAA+B,EACvE,2EAA2E,EAC3E,gFAAgF,EAChF,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CACR,wEAAwE,EACxE,uEAAuE,EACvE,wEAAwE,EACxE,wEAAwE,EACxE,gEAAgE,CACjE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,sEAAsE,EACtE,2DAA2D,EAC3D,yEAAyE,EACzE,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,gBAAgB,EAAE,GAAG,CAAC,OAAO;YAC7B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACnC,wEAAwE;YACxE,kEAAkE;YAClE,wDAAwD;YACxD,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"session-start.js","sourceRoot":"","sources":["../../../src/hooks/runtime/session-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAsBvC,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,IAAY,EAAE,MAAgB;IAC7D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACpE,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,wEAAwE;IACxE,CAAC,IAAI,CAAC,oBAAoB,IAAI,uBAAuB,CAAC,CAAC;QACrD,MAAM;QACN,aAAa,EAAE,GAAG,CAAC,OAAO;KAC3B,CAAC,CAAC;IAEH,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,MAAM,CACJ,oDAAoD,KAAK,CAAC,MAAM,iBAAiB,SAAS,IAAI,EAC9F,KAAK,CAAC,MAAM,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC7B,CAAC,CAAC;IACH,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,iCAAiC;QACjC,gBAAgB,SAAS,eAAe,KAAK,CAAC,MAAM,GAAG;KACxD,CAAC;IACF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,mFAAmF,CACpF,CAAC;IAEF,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,gFAAgF,EAChF,mEAAmE,CACpE,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,sFAAsF,CACvF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,mCAAmC,KAAK,+BAA+B,EACvE,2EAA2E,EAC3E,gFAAgF,EAChF,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CACR,wEAAwE,EACxE,uEAAuE,EACvE,wEAAwE,EACxE,wEAAwE,EACxE,gEAAgE,CACjE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,sEAAsE,EACtE,2DAA2D,EAC3D,yEAAyE,EACzE,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,gBAAgB,EAAE,GAAG,CAAC,OAAO;YAC7B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACnC,wEAAwE;YACxE,kEAAkE;YAClE,wDAAwD;YACxD,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}