@deksden-com/dd-flow-cli 0.1.0

package/dist/services/hooks.js

@@ -0,0 +1,929 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { parse, stringify } from "smol-toml";
+import { AppError } from "../shared/errors.js";
+import { parseJsonObject } from "../shared/json.js";
+import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
+import { appendAudit } from "./audit.js";
+import { requireProjectByRoot } from "./projects.js";
+import { activeFlowSessionsForProject, confirmPendingFlowSessionBinding, flowSessionById, flowSessionPayloadFromRegisterCommand, recordPendingFlowSessionBinding, updateFlowSessionContinuation } from "./sessions.js";
+const defaultProfileName = "default";
+const maxSanitizedSummaryLength = 1600;
+const stopLoopLimit = 3;
+const sharedEntries = [
+    "auth.json",
+    "auth.bk",
+    "sessions",
+    "archived_sessions",
+    "session_index.jsonl",
+    "history.jsonl",
+    "plugins",
+    "skills",
+    "cache",
+    "models_cache.json",
+    "prompts",
+    "rules",
+    "vendor_imports",
+    "AGENTS.md",
+    "installation_id",
+    "keybindings.json",
+    "browser",
+    "computer-use",
+    "generated_images",
+    "shell_snapshots",
+    "memories"
+];
+export function planCodexHome(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const profile = resolveProfileName(input.profile);
+    const paths = resolveHomePaths(context, project, profile, input);
+    return {
+        ok: true,
+        project_root: project.root,
+        profile,
+        profile_id: profileId(project.root, profile),
+        source_home: paths.sourceHome,
+        target_home: paths.targetHome,
+        config_path: paths.configPath,
+        hooks_path: paths.hooksPath,
+        owned_files: ["config.toml", "hooks.json", ".dd-flow-home.json", "log/", ".tmp/", "tmp/"],
+        shared_entries: sharedEntries,
+        exists: fs.existsSync(paths.targetHome),
+        codex_env: { CODEX_HOME: paths.targetHome }
+    };
+}
+export function initCodexHome(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const profile = resolveProfileName(input.profile);
+    const paths = resolveHomePaths(context, project, profile, input);
+    const now = context.now();
+    ensureDir(paths.targetHome);
+    ensureDir(path.join(paths.targetHome, "log"));
+    ensureDir(path.join(paths.targetHome, ".tmp"));
+    ensureDir(path.join(paths.targetHome, "tmp"));
+    const linked = createSharedLinks(paths.sourceHome, paths.targetHome);
+    const config = readTomlIfExists(path.join(paths.sourceHome, "config.toml"));
+    fs.writeFileSync(paths.configPath, stringify(withManagedConfig(config, paths.sourceHome, paths.targetHome)));
+    writeJsonFile(paths.hooksPath, expectedHooksConfig(project.root));
+    writeJsonFile(path.join(paths.targetHome, ".dd-flow-home.json"), {
+        managed_by: "dd-flow-cli",
+        schema_version: "0.1.0",
+        project_id: project.id,
+        project_root: project.root,
+        profile,
+        source_home: paths.sourceHome,
+        target_home: paths.targetHome,
+        created_at: now
+    });
+    upsertHomeProfile(context, project, profile, paths, "ready", "none");
+    appendAudit(context, {
+        projectId: project.id,
+        eventType: "codex_home.initialized",
+        payload: {
+            project_id: project.id,
+            profile,
+            source_home: paths.sourceHome,
+            target_home: paths.targetHome,
+            linked_entries: linked.linked,
+            skipped_entries: linked.skipped
+        }
+    });
+    return {
+        ok: true,
+        profile: homeProfile(context, project.id, profile),
+        linked_entries: linked.linked,
+        skipped_entries: linked.skipped,
+        codex_env: { CODEX_HOME: paths.targetHome }
+    };
+}
+export function getCodexHomeStatus(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const profile = resolveProfileName(input.profile);
+    const record = homeProfile(context, project.id, profile);
+    if (!record) {
+        return { ok: true, installed: false, profile, status: "not_initialized" };
+    }
+    const configStatus = managedConfigStatus(record);
+    const hooksStatus = hookFileStatus(record.hooks_path, project.root);
+    const drift = configStatus.drift_status === "none" && hooksStatus.drift_status === "none" ? "none" : "drifted";
+    const now = context.now();
+    context.db.run(`UPDATE codex_home_profiles
+     SET last_checked_at = ?, last_drift_status = ?, updated_at = ?
+     WHERE project_id = ? AND profile = ?`, [now, drift, now, project.id, profile]);
+    return {
+        ok: true,
+        installed: fs.existsSync(record.target_home),
+        profile,
+        home: homeProfile(context, project.id, profile),
+        config: configStatus,
+        hooks: hooksStatus,
+        shared_entries: sharedEntryStatus(record.source_home, record.target_home)
+    };
+}
+export function printCodexHomeEnv(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const profile = resolveProfileName(input.profile);
+    const record = requireHomeProfile(context, project.id, profile);
+    if (!fs.existsSync(record.target_home) || !fs.statSync(record.target_home).isDirectory()) {
+        throw new AppError("codex_home_unavailable", "Managed Codex home target does not exist", 1, {
+            target_home: record.target_home,
+            next_action: "Run dd-flow codex home init first."
+        });
+    }
+    return {
+        ok: true,
+        profile,
+        env: { CODEX_HOME: record.target_home },
+        command_prefix: `CODEX_HOME=${JSON.stringify(record.target_home)}`
+    };
+}
+export function removeCodexHome(context, input) {
+    if (!["keep-shared", "remove-owned"].includes(input.mode)) {
+        throw new AppError("validation", "--mode must be keep-shared or remove-owned", 2);
+    }
+    const mode = input.mode;
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const profile = resolveProfileName(input.profile);
+    const record = homeProfile(context, project.id, profile);
+    if (!record) {
+        return { ok: true, removed: false, profile, status: "not_initialized" };
+    }
+    const removedEntries = [];
+    for (const relative of ["config.toml", "hooks.json", ".dd-flow-home.json", "log", ".tmp", "tmp"]) {
+        const target = path.join(record.target_home, relative);
+        if (fs.existsSync(target)) {
+            fs.rmSync(target, { recursive: true, force: true });
+            removedEntries.push(relative);
+        }
+    }
+    if (mode === "remove-owned") {
+        removeSharedSymlinks(record.target_home);
+        removeDirIfEmpty(record.target_home);
+    }
+    context.db.run(`UPDATE codex_home_profiles SET status = 'removed', updated_at = ? WHERE project_id = ? AND profile = ?`, [context.now(), project.id, profile]);
+    appendAudit(context, {
+        projectId: project.id,
+        eventType: "codex_home.removed",
+        payload: { project_id: project.id, profile, mode, removed: removedEntries }
+    });
+    return { ok: true, removed: true, profile, mode, removed_entries: removedEntries };
+}
+export function printCodexHooks(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const target = resolveHookTarget(input.target);
+    const profile = resolveProfileName(input.profile);
+    return {
+        ok: true,
+        project_root: project.root,
+        target,
+        profile: target === "isolated" ? profile : null,
+        hooks_json: expectedHooksConfig(project.root)
+    };
+}
+export function getCodexHooksStatus(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const target = resolveHookTarget(input.target);
+    const location = resolveHookLocation(context, project, target, resolveProfileName(input.profile));
+    if (!location.available) {
+        return {
+            ok: true,
+            installed: false,
+            target,
+            profile: location.profile,
+            drift_status: "unavailable",
+            unavailable: location.unavailable
+        };
+    }
+    const status = hookFileStatus(location.hooksPath, project.root);
+    const recorded = hookInstallation(context, project.id, installationScope(target, location.profile));
+    const driftStatus = status.installed ? "none" : recorded?.installed === 1 ? "drifted" : status.drift_status;
+    return {
+        ok: true,
+        target,
+        profile: location.profile,
+        hooks_path: location.hooksPath,
+        installed: status.installed,
+        drift_status: driftStatus,
+        expected_hash: hashObject(expectedHooksConfig(project.root)),
+        recorded
+    };
+}
+export function installCodexHooks(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const target = resolveHookTarget(input.target);
+    const location = requireHookLocation(context, project, target, resolveProfileName(input.profile));
+    if (target === "default" && !input.yes) {
+        throw new AppError("confirmation_required", "Direct default Codex home mutation requires --yes", 1, {
+            target,
+            hooks_path: location.hooksPath
+        });
+    }
+    const existing = readJsonIfExists(location.hooksPath) ?? {};
+    const backup = target === "default" && fs.existsSync(location.hooksPath) ? backupFile(location.hooksPath, context.now()) : null;
+    const nextConfig = mergeHooksConfig(existing, project.root);
+    ensureDir(path.dirname(location.hooksPath));
+    writeJsonFile(location.hooksPath, nextConfig);
+    recordHookInstallation(context, project.id, installationScope(target, location.profile), location.hooksPath, true, "none");
+    appendAudit(context, {
+        projectId: project.id,
+        eventType: "codex_hooks.installed",
+        payload: { project_id: project.id, target, profile: location.profile, hooks_path: location.hooksPath, backup }
+    });
+    return {
+        ok: true,
+        installed: true,
+        target,
+        profile: location.profile,
+        hooks_path: location.hooksPath,
+        backup,
+        expected_hash: hashObject(expectedHooksConfig(project.root))
+    };
+}
+export function removeCodexHooks(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const target = resolveHookTarget(input.target);
+    const location = requireHookLocation(context, project, target, resolveProfileName(input.profile));
+    if (target === "default" && !input.yes) {
+        throw new AppError("confirmation_required", "Direct default Codex home mutation requires --yes", 1, {
+            target,
+            hooks_path: location.hooksPath
+        });
+    }
+    const existing = readJsonIfExists(location.hooksPath) ?? {};
+    const hadManaged = hasManagedHooks(existing, project.root);
+    const backup = target === "default" && fs.existsSync(location.hooksPath) ? backupFile(location.hooksPath, context.now()) : null;
+    const nextConfig = removeManagedHooks(existing, project.root);
+    ensureDir(path.dirname(location.hooksPath));
+    writeJsonFile(location.hooksPath, nextConfig);
+    recordHookInstallation(context, project.id, installationScope(target, location.profile), location.hooksPath, false, "not_installed");
+    appendAudit(context, {
+        projectId: project.id,
+        eventType: "codex_hooks.removed",
+        payload: { project_id: project.id, target, profile: location.profile, hooks_path: location.hooksPath, backup, had_managed: hadManaged }
+    });
+    return { ok: true, installed: false, target, profile: location.profile, hooks_path: location.hooksPath, backup, had_managed: hadManaged };
+}
+export function handleCodexHook(context, input) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const payload = parseJsonObject(input.stdin || "{}", "codex hook stdin");
+    const eventName = input.event || stringValue(payload.hook_event_name) || "Unknown";
+    const sessionId = stringValue(payload.session_id);
+    const turnId = stringValue(payload.turn_id);
+    const toolName = stringValue(payload.tool_name) ?? toolNameFromPayload(payload);
+    const command = commandFromPayload(payload);
+    const binding = sessionId ? upsertSessionBindingFromPayload(context, project, sessionId, payload) : undefined;
+    const preToolUseDecision = eventName === "PreToolUse" && command
+        ? preToolUseGuard(context, project, sessionId ?? null, payload, command)
+        : undefined;
+    if (eventName === "PreToolUse" && sessionId && command) {
+        recordPendingFlowSessionBinding(context, project, {
+            sessionId,
+            command,
+            cwd: stringValue(payload.cwd),
+            transcriptPath: stringValue(payload.transcript_path),
+            turnId: turnId ?? undefined
+        });
+    }
+    const confirmedFlowSession = eventName === "PostToolUse" && sessionId && toolSucceeded(payload)
+        ? confirmPendingFlowSessionBinding(context, project, { sessionId })
+        : undefined;
+    const existingFlowSession = sessionId ? flowSessionById(context, project.id, sessionId) : undefined;
+    const boundProtocol = eventName === "PostToolUse" && sessionId ? bindProtocolFromToolEvent(context, project, sessionId, payload) : binding;
+    const protocolId = confirmedFlowSession?.protocol_id ?? existingFlowSession?.protocol_id ?? boundProtocol?.protocol_id ?? binding?.protocol_id ?? null;
+    recordHookEvent(context, {
+        projectId: project.id,
+        protocolId,
+        sessionId: sessionId ?? null,
+        turnId: turnId ?? null,
+        eventName,
+        toolName: toolName ?? null,
+        status: "observed",
+        payload
+    });
+    if (eventName === "Stop") {
+        return stopDecision(context, project, sessionId ?? null);
+    }
+    if (preToolUseDecision) {
+        return preToolUseDecision;
+    }
+    return hookContinue(eventName, protocolId);
+}
+export function hookStatusForProject(context, projectId) {
+    return context.db.all(`SELECT scope, config_path, content_hash, installed, drift_status, updated_at
+     FROM hook_installations WHERE project_id = ? ORDER BY updated_at DESC`, [projectId]);
+}
+export function codexHomeProfilesForProject(context, projectId) {
+    return context.db.all(`SELECT id, profile, source_home, target_home, status, last_checked_at, last_drift_status, updated_at
+     FROM codex_home_profiles WHERE project_id = ? ORDER BY updated_at DESC`, [projectId]);
+}
+export function activeCodexSessionBindingsForProject(context, projectId) {
+    return context.db.all(`SELECT session_id, protocol_id, handshake_id, cwd, transcript_path, status, continuation_count, updated_at
+     FROM codex_session_bindings WHERE project_id = ? AND status = 'active' ORDER BY updated_at DESC`, [projectId]);
+}
+export function activeFlowSessionBindingsForProject(context, projectId) {
+    return activeFlowSessionsForProject(context, projectId).map((session) => ({
+        session_id: session.session_id,
+        flow_kind: session.flow_kind,
+        status: session.status,
+        protocol_id: session.protocol_id,
+        worker_id: session.worker_id,
+        workspace_path: session.workspace_path,
+        continuation_policy: session.continuation_policy,
+        current_stage: session.current_stage,
+        next_action: session.next_action,
+        continuation_count: session.continuation_count,
+        updated_at: session.updated_at
+    }));
+}
+export function codexHookEventsForProject(context, projectId) {
+    return context.db.all(`SELECT protocol_id, session_id, turn_id, event_name, tool_name, status, sanitized_summary, created_at
+     FROM codex_hook_events WHERE project_id = ? ORDER BY created_at DESC, id DESC LIMIT 20`, [projectId]);
+}
+function resolveProfileName(profile) {
+    return sanitizeProfile(profile ?? defaultProfileName);
+}
+function sanitizeProfile(value) {
+    const normalized = value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+    return normalized || defaultProfileName;
+}
+function profileId(projectRoot, profile) {
+    const projectName = sanitizeProfile(path.basename(projectRoot));
+    return `${projectName}-${profile}-${hashString(projectRoot).slice(0, 10)}`;
+}
+function resolveHomePaths(context, project, profile, input) {
+    const sourceHome = path.resolve(input.sourceHome ?? context.env.CODEX_HOME ?? path.join(os.homedir(), ".codex"));
+    const targetHome = path.resolve(input.targetHome ?? path.join(context.ddFlowHome, "codex-homes", profileId(project.root, profile)));
+    return {
+        sourceHome,
+        targetHome,
+        configPath: path.join(targetHome, "config.toml"),
+        hooksPath: path.join(targetHome, "hooks.json")
+    };
+}
+function defaultCodexHome(context) {
+    return path.resolve(context.env.CODEX_HOME ?? path.join(os.homedir(), ".codex"));
+}
+function readTomlIfExists(file) {
+    if (!fs.existsSync(file)) {
+        return {};
+    }
+    try {
+        return parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        throw new AppError("validation", `Invalid TOML in ${file}: ${String(error)}`, 2);
+    }
+}
+function withManagedConfig(config, sourceHome, targetHome) {
+    const next = { ...config };
+    const features = objectTable(next.features);
+    features.hooks = true;
+    next.features = features;
+    next.sqlite_home = sourceHome;
+    next.log_dir = path.join(targetHome, "log");
+    delete next.hooks;
+    return next;
+}
+function objectTable(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+}
+function createSharedLinks(sourceHome, targetHome) {
+    const linked = [];
+    const skipped = [];
+    for (const entry of sharedEntries) {
+        const source = path.join(sourceHome, entry);
+        const target = path.join(targetHome, entry);
+        if (!fs.existsSync(source)) {
+            skipped.push({ entry, reason: "source_missing" });
+            continue;
+        }
+        if (fs.existsSync(target)) {
+            if (fs.lstatSync(target).isSymbolicLink() && fs.readlinkSync(target) === source) {
+                linked.push(entry);
+            }
+            else {
+                skipped.push({ entry, reason: "target_exists" });
+            }
+            continue;
+        }
+        ensureDir(path.dirname(target));
+        fs.symlinkSync(source, target);
+        linked.push(entry);
+    }
+    return { linked, skipped };
+}
+function removeSharedSymlinks(targetHome) {
+    for (const entry of sharedEntries) {
+        const target = path.join(targetHome, entry);
+        if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) {
+            fs.rmSync(target);
+        }
+    }
+}
+function removeDirIfEmpty(dir) {
+    if (fs.existsSync(dir) && fs.statSync(dir).isDirectory() && fs.readdirSync(dir).length === 0) {
+        fs.rmdirSync(dir);
+    }
+}
+function sharedEntryStatus(sourceHome, targetHome) {
+    return sharedEntries.map((entry) => {
+        const source = path.join(sourceHome, entry);
+        const target = path.join(targetHome, entry);
+        return {
+            entry,
+            source_exists: fs.existsSync(source),
+            linked: fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()
+        };
+    });
+}
+function expectedHooksConfig(projectRoot) {
+    return {
+        hooks: {
+            SessionStart: [hookEntry("startup|resume", hookCommand("SessionStart", projectRoot), "dd-flow session binding")],
+            PreToolUse: [hookEntry("Bash", hookCommand("PreToolUse", projectRoot), "dd-flow command guard")],
+            PostToolUse: [hookEntry("Bash", hookCommand("PostToolUse", projectRoot), "dd-flow command observer")],
+            Stop: [{ hooks: [commandHook(hookCommand("Stop", projectRoot), "dd-flow continuation guard")] }]
+        }
+    };
+}
+function hookEntry(matcher, command, statusMessage) {
+    return { matcher, hooks: [commandHook(command, statusMessage)] };
+}
+function commandHook(command, statusMessage) {
+    return { type: "command", command, timeout: 5, statusMessage };
+}
+function hookCommand(event, projectRoot) {
+    return `dd-flow codex hook handle --event ${event} --project-root ${JSON.stringify(projectRoot)} --json`;
+}
+function resolveHookTarget(target) {
+    if (!target || target === "isolated") {
+        return "isolated";
+    }
+    if (target === "default") {
+        return "default";
+    }
+    throw new AppError("validation", "--target must be isolated or default", 2);
+}
+function resolveHookLocation(context, project, target, profile) {
+    if (target === "default") {
+        return { available: true, target, profile, hooksPath: path.join(defaultCodexHome(context), "hooks.json") };
+    }
+    const record = homeProfile(context, project.id, profile);
+    if (!record || !fs.existsSync(record.target_home)) {
+        return {
+            available: false,
+            target,
+            profile,
+            unavailable: {
+                code: "codex_home_unavailable",
+                next_action: "Run dd-flow codex home init before isolated hook installation."
+            }
+        };
+    }
+    return { available: true, target, profile, hooksPath: record.hooks_path };
+}
+function requireHookLocation(context, project, target, profile) {
+    const location = resolveHookLocation(context, project, target, profile);
+    if (!location.available) {
+        throw new AppError(String(location.unavailable.code), "Codex hook target is unavailable", 1, location.unavailable);
+    }
+    return location;
+}
+function hookFileStatus(hooksPath, projectRoot) {
+    const existing = readJsonIfExists(hooksPath);
+    const installed = existing ? hasExpectedHooks(existing, projectRoot) : false;
+    const managed = existing ? hasManagedHooks(existing, projectRoot) : false;
+    return {
+        installed,
+        drift_status: installed ? "none" : managed ? "drifted" : "not_installed",
+        hooks_path: hooksPath
+    };
+}
+function managedConfigStatus(record) {
+    if (!fs.existsSync(record.config_path)) {
+        return { parseable: false, hooks_enabled: false, sqlite_home: false, drift_status: "missing" };
+    }
+    const config = readTomlIfExists(record.config_path);
+    const features = objectTable(config.features);
+    const hooksEnabled = features.hooks === true;
+    const sqliteHome = config.sqlite_home === record.source_home;
+    const hasHooksSection = Boolean(config.hooks);
+    return {
+        parseable: true,
+        hooks_enabled: hooksEnabled,
+        sqlite_home: sqliteHome,
+        drift_status: hooksEnabled && sqliteHome && !hasHooksSection ? "none" : "drifted"
+    };
+}
+function mergeHooksConfig(existing, projectRoot) {
+    const withoutManaged = removeManagedHooks(existing, projectRoot);
+    const hooks = objectRecord(withoutManaged.hooks);
+    const expectedHooks = objectRecord(expectedHooksConfig(projectRoot).hooks);
+    for (const [event, entries] of Object.entries(expectedHooks)) {
+        hooks[event] = [...arrayValue(hooks[event]), ...arrayValue(entries)];
+    }
+    return { ...withoutManaged, hooks };
+}
+function removeManagedHooks(existing, projectRoot) {
+    const hooks = objectRecord(existing.hooks);
+    const nextHooks = {};
+    for (const [event, entries] of Object.entries(hooks)) {
+        const filtered = arrayValue(entries).filter((entry) => !entryHasManagedCommand(entry, projectRoot));
+        if (filtered.length > 0) {
+            nextHooks[event] = filtered;
+        }
+    }
+    return { ...existing, hooks: nextHooks };
+}
+function hasExpectedHooks(existing, projectRoot) {
+    const commands = collectHookCommands(existing);
+    return expectedCommands(projectRoot).every((command) => commands.includes(command));
+}
+function hasManagedHooks(existing, projectRoot) {
+    return collectHookCommands(existing).some((command) => command.includes("dd-flow codex hook handle") &&
+        (command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
+}
+function expectedCommands(projectRoot) {
+    return ["SessionStart", "PreToolUse", "PostToolUse", "Stop"].map((event) => hookCommand(event, projectRoot));
+}
+function entryHasManagedCommand(entry, projectRoot) {
+    return collectHookCommands(entry).some((command) => command.includes("dd-flow codex hook handle") &&
+        (command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
+}
+function collectHookCommands(value) {
+    if (Array.isArray(value)) {
+        return value.flatMap(collectHookCommands);
+    }
+    if (value && typeof value === "object") {
+        return Object.entries(value).flatMap(([key, child]) => {
+            if (key === "command" && typeof child === "string") {
+                return [child];
+            }
+            return collectHookCommands(child);
+        });
+    }
+    return [];
+}
+function objectRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+}
+function arrayValue(value) {
+    return Array.isArray(value) ? value : [];
+}
+function upsertHomeProfile(context, project, profile, paths, status, driftStatus) {
+    const now = context.now();
+    context.db.run(`INSERT INTO codex_home_profiles
+      (id, project_id, profile, source_home, target_home, config_path, hooks_path, status, created_at, updated_at, last_checked_at, last_drift_status)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?)
+     ON CONFLICT(project_id, profile) DO UPDATE SET
+       source_home = excluded.source_home,
+       target_home = excluded.target_home,
+       config_path = excluded.config_path,
+       hooks_path = excluded.hooks_path,
+       status = excluded.status,
+       updated_at = excluded.updated_at,
+       last_drift_status = excluded.last_drift_status`, [
+        profileId(project.root, profile),
+        project.id,
+        profile,
+        paths.sourceHome,
+        paths.targetHome,
+        paths.configPath,
+        paths.hooksPath,
+        status,
+        now,
+        now,
+        driftStatus
+    ]);
+}
+function homeProfile(context, projectId, profile) {
+    return context.db.get("SELECT * FROM codex_home_profiles WHERE project_id = ? AND profile = ?", [projectId, profile]);
+}
+function requireHomeProfile(context, projectId, profile) {
+    const record = homeProfile(context, projectId, profile);
+    if (!record) {
+        throw new AppError("codex_home_unavailable", "Managed Codex home profile is not initialized", 1, {
+            profile,
+            next_action: "Run dd-flow codex home init first."
+        });
+    }
+    return record;
+}
+function hookInstallation(context, projectId, scope) {
+    return context.db.get(`SELECT scope, config_path, content_hash, installed, drift_status, updated_at
+     FROM hook_installations WHERE project_id = ? AND scope = ?`, [projectId, scope]);
+}
+function recordHookInstallation(context, projectId, scope, configPath, installed, driftStatus) {
+    const now = context.now();
+    context.db.run(`INSERT INTO hook_installations
+      (project_id, scope, config_path, content_hash, installed, drift_status, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(project_id, scope) DO UPDATE SET
+       config_path = excluded.config_path,
+       content_hash = excluded.content_hash,
+       installed = excluded.installed,
+       drift_status = excluded.drift_status,
+       updated_at = excluded.updated_at`, [projectId, scope, configPath, hashObject(readJsonIfExists(configPath) ?? {}), installed ? 1 : 0, driftStatus, now, now]);
+}
+function installationScope(target, profile) {
+    return target === "isolated" ? `isolated:${profile}` : "default";
+}
+function upsertSessionBindingFromPayload(context, project, sessionId, payload) {
+    const existing = sessionBinding(context, project.id, sessionId);
+    const now = context.now();
+    const cwd = stringValue(payload.cwd) ?? existing?.cwd ?? null;
+    const transcriptPath = stringValue(payload.transcript_path) ?? existing?.transcript_path ?? null;
+    context.db.run(`INSERT INTO codex_session_bindings
+      (session_id, project_id, protocol_id, handshake_id, cwd, transcript_path, status, created_at, updated_at)
+     VALUES (?, ?, NULL, NULL, ?, ?, 'active', ?, ?)
+     ON CONFLICT(session_id, project_id) DO UPDATE SET
+       cwd = COALESCE(excluded.cwd, cwd),
+       transcript_path = COALESCE(excluded.transcript_path, transcript_path),
+       status = 'active',
+       updated_at = excluded.updated_at`, [sessionId, project.id, cwd, transcriptPath, now, now]);
+    return sessionBinding(context, project.id, sessionId);
+}
+function bindProtocolFromToolEvent(context, project, sessionId, payload) {
+    if (!toolSucceeded(payload)) {
+        return sessionBinding(context, project.id, sessionId);
+    }
+    const command = commandFromPayload(payload);
+    const handshakeId = command ? handshakeFromCommand(command) : null;
+    if (!handshakeId) {
+        return sessionBinding(context, project.id, sessionId);
+    }
+    const protocol = context.db.get("SELECT id, handshake_id FROM protocols WHERE project_id = ? AND (handshake_id = ? OR id = ?) ORDER BY updated_at DESC LIMIT 1", [project.id, handshakeId, handshakeId.startsWith("PRT-") ? handshakeId : `PRT-${handshakeId}`]);
+    if (!protocol) {
+        return sessionBinding(context, project.id, sessionId);
+    }
+    context.db.run(`UPDATE codex_session_bindings
+     SET protocol_id = ?, handshake_id = ?, status = 'active', updated_at = ?
+     WHERE project_id = ? AND session_id = ?`, [protocol.id, protocol.handshake_id, context.now(), project.id, sessionId]);
+    appendAudit(context, {
+        protocolId: protocol.id,
+        projectId: project.id,
+        eventType: "codex_session.bound",
+        payload: { project_id: project.id, protocol_id: protocol.id, handshake_id: protocol.handshake_id, session_id: sessionId }
+    });
+    return sessionBinding(context, project.id, sessionId);
+}
+function sessionBinding(context, projectId, sessionId) {
+    return context.db.get("SELECT * FROM codex_session_bindings WHERE project_id = ? AND session_id = ?", [projectId, sessionId]);
+}
+function recordHookEvent(context, input) {
+    context.db.run(`INSERT INTO codex_hook_events
+      (project_id, protocol_id, session_id, turn_id, event_name, tool_name, status, sanitized_summary, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+        input.projectId,
+        input.protocolId,
+        input.sessionId,
+        input.turnId,
+        input.eventName,
+        input.toolName,
+        input.status,
+        sanitizedSummary(input.payload),
+        context.now()
+    ]);
+}
+function stopDecision(context, project, sessionId) {
+    if (!sessionId) {
+        return {};
+    }
+    const session = flowSessionById(context, project.id, sessionId);
+    if (!session || ["waiting_user", "blocked", "stopping", "stopped", "closed"].includes(session.status)) {
+        return {};
+    }
+    if (session.protocol_id && protocolAllowsStop(context, session.protocol_id)) {
+        return {};
+    }
+    if (session.flow_kind === "merge_worker" && session.continuation_policy === "merge_queue") {
+        return stopContinuationDecision(context, project.id, sessionId, `merge-worker:${session.worker_id ?? session.session_id}:${session.next_action ?? "wait-next"}`, `Continue dd-flow merge worker ${session.worker_id ?? session.session_id}: run .memory-bank/dd-flow/merge-start.md and continue dd-flow merge-queue wait-next from the registered merge workspace. Use dd-flow session stop-worker to stop this worker.`, { limit: null });
+    }
+    if (session.flow_kind === "merge_job" && session.continuation_policy === "merge_job") {
+        return stopContinuationDecision(context, project.id, sessionId, `merge-job:${session.protocol_id ?? session.session_id}:${session.next_action ?? "none"}`, `Continue dd-flow merge job ${session.protocol_id ?? ""}: complete merge work, close the protocol, and report terminal state.`);
+    }
+    const nextAction = session.next_action ?? nextActionFromProtocol(context, session.protocol_id);
+    if (!nextAction || nextAction === "none" || session.continuation_policy === "none") {
+        return {};
+    }
+    return stopContinuationDecision(context, project.id, sessionId, `${session.flow_kind}:${session.protocol_id ?? session.session_id}:${nextAction}`, `Continue dd-flow ${session.flow_kind}${session.protocol_id ? ` ${session.protocol_id}` : ""}: ${nextAction}`);
+}
+function nextActionFromProtocol(context, protocolId) {
+    if (!protocolId) {
+        return null;
+    }
+    const protocol = context.db.get("SELECT id, status, stage, next_action FROM protocols WHERE id = ?", [protocolId]);
+    if (!protocol) {
+        return null;
+    }
+    if (["waiting_for_user", "blocked", "closed", "cancelled"].includes(protocol.stage) || ["waiting_for_user", "blocked", "closed", "cancelled"].includes(protocol.status)) {
+        return null;
+    }
+    return protocol.next_action;
+}
+function protocolAllowsStop(context, protocolId) {
+    const protocol = context.db.get("SELECT status, stage FROM protocols WHERE id = ?", [protocolId]);
+    return Boolean(protocol && (["closed", "cancelled"].includes(protocol.status) || ["closed", "cancelled"].includes(protocol.stage)));
+}
+function stopContinuationDecision(context, projectId, sessionId, actionKey, reason, options = {}) {
+    const nextCount = updateFlowSessionContinuation(context, projectId, sessionId, actionKey);
+    const limit = options.limit === undefined ? stopLoopLimit : options.limit;
+    if (limit !== null && nextCount > limit) {
+        return {};
+    }
+    return { decision: "block", reason };
+}
+function preToolUseGuard(context, project, sessionId, payload, command) {
+    const cwd = stringValue(payload.cwd);
+    const blockedTarget = cwd ? selfWorktreeRemovalTarget(command, cwd) : null;
+    if (!blockedTarget) {
+        const roleDecision = mergeRoleGuard(context, project, sessionId, command);
+        if (roleDecision) {
+            return roleDecision;
+        }
+        return undefined;
+    }
+    return {
+        decision: "block",
+        reason: `Refusing to remove the current Codex session worktree (${blockedTarget}). Restart or run cleanup from the stable project root or a separate cleanup session.`
+    };
+}
+function mergeRoleGuard(context, project, sessionId, command) {
+    const session = sessionId ? flowSessionById(context, project.id, sessionId) : undefined;
+    const mergeSessionKinds = ["merge_worker", "merge_job"];
+    const isMergeRole = session ? mergeSessionKinds.includes(session.flow_kind) : false;
+    const registerPayload = safeFlowSessionPayloadFromCommand(command);
+    if (registerPayload && mergeSessionKinds.includes(registerPayload.flow_kind)) {
+        if (session && !mergeSessionKinds.includes(session.flow_kind)) {
+            return blockMergeRole("A non-merge Codex session cannot re-register itself as a merge worker/job.");
+        }
+        if (registerPayload.flow_kind === "merge_job" && !claimedMergeJobMatches(context, project.id, registerPayload.protocol_id, registerPayload.worker_id)) {
+            return blockMergeRole("A merge_job session requires an already claimed merge queue job for the same protocol and worker_id.");
+        }
+    }
+    const mergeQueueAction = mergeQueueMutation(command);
+    if (mergeQueueAction) {
+        if (mergeQueueAction === "next" || mergeQueueAction === "wait-next") {
+            return session?.flow_kind === "merge_worker" ? undefined : blockMergeRole("Only a registered merge_worker session may claim or wait for merge queue jobs.");
+        }
+        return session?.flow_kind === "merge_job" ? undefined : blockMergeRole("Only a registered merge_job session may complete or fail a claimed merge queue job.");
+    }
+    if (mergeLaneLockMutation(command)) {
+        return isMergeRole ? undefined : blockMergeRole("Only registered merge sessions may mutate the merge lane lock.");
+    }
+    if (/\bgit\s+merge\b/.test(command)) {
+        return session?.flow_kind === "merge_job" ? undefined : blockMergeRole("Only a registered merge_job session may run git merge.");
+    }
+    return undefined;
+}
+function blockMergeRole(reason) {
+    return { decision: "block", reason };
+}
+function safeFlowSessionPayloadFromCommand(command) {
+    try {
+        return flowSessionPayloadFromRegisterCommand(command);
+    }
+    catch {
+        return undefined;
+    }
+}
+function claimedMergeJobMatches(context, projectId, protocolId, workerId) {
+    if (!protocolId || !workerId) {
+        return false;
+    }
+    const job = context.db.get("SELECT status, claimed_by_session_id FROM merge_queue WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
+    return job?.status === "claimed" && job.claimed_by_session_id === workerId;
+}
+function mergeQueueMutation(command) {
+    const match = command.match(/\bdd-flow\s+merge-queue\s+(next|wait-next|complete|fail)\b/);
+    return match?.[1] ?? null;
+}
+function mergeLaneLockMutation(command) {
+    return /\bdd-flow\s+lane\s+lock\s+(acquire|heartbeat|release|wait)\b/.test(command) && /(?:--lane(?:\s+|=)(?:"merge"|'merge'|merge)\b)/.test(command);
+}
+function selfWorktreeRemovalTarget(command, cwd) {
+    if (!/\bgit\s+worktree\s+remove\b/.test(command)) {
+        return null;
+    }
+    const cwdPath = normalizePathForGuard(cwd, cwd);
+    for (const target of gitWorktreeRemoveTargets(command)) {
+        const targetPath = normalizePathForGuard(target, cwd);
+        if (cwdPath === targetPath || cwdPath.startsWith(`${targetPath}${path.sep}`)) {
+            return targetPath;
+        }
+    }
+    return null;
+}
+function gitWorktreeRemoveTargets(command) {
+    const targets = [];
+    const pattern = /\bgit\s+worktree\s+remove\b([^;&|]*)/g;
+    for (const match of command.matchAll(pattern)) {
+        const args = shellishTokens(match[1] ?? "");
+        for (const arg of args) {
+            if (arg.startsWith("-")) {
+                continue;
+            }
+            targets.push(arg);
+            break;
+        }
+    }
+    return targets;
+}
+function shellishTokens(input) {
+    const tokens = [];
+    const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    for (const match of input.matchAll(pattern)) {
+        tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
+    }
+    return tokens.filter((token) => token.length > 0);
+}
+function normalizePathForGuard(value, cwd) {
+    const absolute = path.isAbsolute(value) ? value : path.resolve(cwd, value);
+    try {
+        return fs.realpathSync(absolute);
+    }
+    catch {
+        return path.resolve(absolute);
+    }
+}
+function hookContinue(eventName, protocolId) {
+    void eventName;
+    void protocolId;
+    return {};
+}
+function commandFromPayload(payload) {
+    const direct = stringValue(payload.command);
+    if (direct) {
+        return direct;
+    }
+    const toolInput = objectRecord(payload.tool_input);
+    return stringValue(toolInput.command) ?? stringValue(toolInput.cmd);
+}
+function toolNameFromPayload(payload) {
+    const toolInput = objectRecord(payload.tool_input);
+    return stringValue(toolInput.name);
+}
+function toolSucceeded(payload) {
+    const response = objectRecord(payload.tool_response);
+    const status = stringValue(payload.status) ?? stringValue(response.status);
+    if (!status) {
+        return true;
+    }
+    return ["success", "succeeded", "ok", "0"].includes(status.toLowerCase());
+}
+function handshakeFromCommand(command) {
+    const match = command.match(/\bdd-flow\s+protocol\s+register\s+([^\s]+)/);
+    return match?.[1] ?? null;
+}
+function sanitizedSummary(payload) {
+    const summary = JSON.stringify(sanitizeValue(payload));
+    return summary.length > maxSanitizedSummaryLength ? `${summary.slice(0, maxSanitizedSummaryLength)}...` : summary;
+}
+function sanitizeValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(sanitizeValue);
+    }
+    if (value && typeof value === "object") {
+        const next = {};
+        for (const [key, child] of Object.entries(value)) {
+            next[key] = secretKey(key) ? "<redacted>" : sanitizeValue(child);
+        }
+        return next;
+    }
+    if (typeof value === "string") {
+        return value
+            .replace(/(token|secret|password|api[_-]?key)=\S+/gi, "$1=<redacted>")
+            .replace(/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer <redacted>");
+    }
+    return value;
+}
+function secretKey(key) {
+    return /(token|secret|password|api[_-]?key|authorization|auth)/i.test(key);
+}
+function stringValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function readJsonIfExists(file) {
+    if (!fs.existsSync(file)) {
+        return undefined;
+    }
+    return parseJsonObject(fs.readFileSync(file, "utf8"), file);
+}
+function writeJsonFile(file, value) {
+    ensureDir(path.dirname(file));
+    fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+function backupFile(file, now) {
+    const suffix = now.replace(/[:.]/g, "-");
+    const backup = `${file}.${suffix}.bak`;
+    fs.copyFileSync(file, backup);
+    return backup;
+}
+function hashObject(value) {
+    return hashString(JSON.stringify(value));
+}
+function hashString(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}