@dsh-cc/plugin-cc-codex-bridge 0.8.1

package/.claude-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "cc-codex-bridge",
+  "description": "Official dsh-cc plugin: an approval-free Codex rescue lane — one canonical, locked-down bash invocation auto-allowed via a PreToolUse hook, with Codex's internal sandbox off while the dsh outer sandbox remains the single write boundary.",
+  "version": "0.8.1"
+}

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm check:readme --write
+README.md: 6f1df73f6bf0a89788b1cebd8c3947a404cf129e
+README.zh.md: 3bac75d8fd2f05ba660fed173c324de5dc86f860

package/README.md

@@ -0,0 +1,91 @@
+# cc-codex-bridge
+
+Official dsh-cc plugin: an **approval-free Codex rescue lane**. Installing it lets a
+dsh-cc session run exactly one canonical, locked-down Codex rescue invocation —
+`node <launcher> [--last] <prompt>` — with no human permission checkpoint, by
+auto-allowing that single command form through a PreToolUse hook.
+
+The core trade is **state relocation, not sandbox widening**: Codex runs with its
+internal sandbox off (nested sandboxes cannot stack), while the dsh outer sandbox
+remains the single write boundary — workspace plus temp areas only.
+
+## How it works
+
+- One canonical invocation form, pinned byte-for-byte: the interpreter and launcher
+  paths must be expansion-free literal tokens equal to the plugin's canonical
+  anchors — no PATH lookup, no symlink trampoline, no `~`/glob/`$VAR` expansion,
+  no compound commands, no command substitution outside single quotes.
+- A PreToolUse hook downgrades the permission verdict for exactly that form; every
+  other shape fails closed into the unchanged, approval-requiring flow.
+- Codex credentials are synced into a `0700` temp-dir home per run; the Codex CLI
+  itself resolves to a validated absolute path at spawn.
+
+## Usage
+
+1. **Status at session start.** A SessionStart hook fires on every session
+   (startup and resume alike) and injects a `cc-codex-bridge:` block stating
+   whether the lane is **ARMED** — including the exact canonical invocation to
+   type — or **NOT armed** with the machine reason in plain words.
+2. **Invoke the rescue** with the plugin command:
+
+   ```sh
+   /cc-codex-bridge:rescue review the failing spec
+   ```
+
+   The bare `rescue` name may collide with the Codex plugin's command, in
+   which case the bare registration is skipped — the scoped name above and the
+   always-present SessionStart canonical block keep the lane usable regardless.
+3. **Multi-line prompts** go through `--prompt-file`: write the prompt text to
+   a file inside the workspace (or the canonical tmpdir) and use the
+   `--prompt-file <path>` form from the SessionStart block.
+4. **`--last` only on explicit continue**: the resume flag is used only when
+   the user explicitly asks to continue the previous rescue.
+5. **Fail closed.** If the SessionStart block is absent or reports NOT armed,
+   the model must not guess or construct the canonical invocation — the rescue
+   falls back to the normal, approval-requiring path (stock `/codex:rescue`).
+
+## Dev-session degradation
+
+In dsh-cc's own repo dev sessions the launcher anchor sits inside the session
+workspace, so arming is refused (`anchor-under-writable-root`) and the lane
+degrades to the normal approval path. Expected and documented.
+
+## Security model (capability tunnel, stated plainly)
+
+Enabling the bridge means explicitly dropping the human checkpoint for this one
+command form. Unattended Codex may run any subprocess the outer sandbox permits —
+including actions the permission classifier would otherwise escalate (git push,
+ssh, cloud CLIs) and unlimited networking. **Only the filesystem write boundary
+holds** (workspace + temp areas); nothing else is claimed. The bridge is opt-in by
+installation; **uninstalling or disabling the plugin is the kill switch**.
+
+## Current status
+
+PR-1 shipped the skeleton, PR-2 activated the gate (the PreToolUse hook that
+auto-allows exactly the canonical rescue invocation), and PR-3 completes the
+entry surface: the SessionStart status/canonical-block hook and the final
+`/cc-codex-bridge:rescue` command — the lane is fully usable once the plugin
+is installed.
+
+## Install / uninstall
+
+Install from the dsh-cc marketplace, plugin name `cc-codex-bridge`:
+
+```sh
+claude plugin install cc-codex-bridge@dsh-cc
+```
+
+Uninstalling (or disabling) the plugin removes the lane entirely:
+
+```sh
+claude plugin uninstall cc-codex-bridge@dsh-cc
+```
+
+## Known limits
+
+- In dsh-cc's own repo dev sessions the launcher anchor sits inside the workspace,
+  so the bridge refuses to arm and degrades to the manual flow (expected,
+  documented).
+- A non-empty ambient `BASH_ENV` or `ENV` disarms the lane (shell-function
+  takeover defense).
+- Resume support in v1 is `--last` only.

package/README.zh.md

@@ -0,0 +1,76 @@
+# cc-codex-bridge
+
+dsh-cc 官方插件：一条**免审批的 Codex 救援通道**。安装后，dsh-cc 会话可以运行唯一一种
+规范、锁死的 Codex 救援调用 —— `node <launcher> [--last] <prompt>` —— 无需人工审批：
+PreToolUse 钩子只对这一种命令形态自动放行。
+
+核心思路是**状态搬迁，而非放宽沙箱**：Codex 以关闭内部沙箱的方式运行（嵌套沙箱无法
+叠加），同时 dsh 外层沙箱仍是唯一的写入边界 —— 仅限工作区与临时目录。
+
+## 工作原理
+
+- 唯一的规范调用形态，逐字节锁定：解释器与启动器路径必须是不含展开的字面量，与插件的
+  规范锚点逐字节相等 —— 不走 PATH 查找、不允许符号链接跳板、禁止 `~`/glob/`$VAR` 展开、
+  禁止复合命令、单引号之外禁止命令替换。
+- PreToolUse 钩子只对这一形态降级权限判定；其他一切形态一律失败关闭（fail-closed），
+  回落到原有需审批的流程。
+- 每次运行前，Codex 凭据会被同步到一个位于临时目录、权限为 `0700` 的专属 home；Codex
+  CLI 本身在启动时解析为经过校验的绝对路径。
+
+## 使用方法
+
+1. **会话开始时的状态块。** SessionStart 钩子在每次会话启动时触发（startup 与 resume
+   均包括），注入一个以 `cc-codex-bridge:` 开头的块：说明通道是否 **已启用（ARMED）** ——
+   并给出可照抄的规范调用 —— 或 **未启用（NOT armed）** 及其白话原因。
+2. **发起救援**，使用插件命令：
+
+   ```sh
+   /cc-codex-bridge:rescue review the failing spec
+   ```
+
+   裸名 `rescue` 可能与 Codex 插件的同名命令冲突；冲突时裸名注册会被跳过 —— 上面的
+   带作用域名称加上始终存在的 SessionStart 规范块，保证通道在任何情况下都可用。
+3. **多行提示词** 走 `--prompt-file`：先用文件工具把提示词写入工作区内（或规范临时
+   目录）的文件，再使用 SessionStart 块中的 `--prompt-file <path>` 形态。
+4. **`--last` 仅在明确要求续聊时使用**：只有当用户明确要求继续上一次救援时才加该标志。
+5. **失败即关闭。** 若 SessionStart 块缺失或显示未启用，模型不得猜测或自行拼造规范调用
+   —— 救援回落到正常的需审批路径（原生 `/codex:rescue`）。
+
+## 开发会话降级
+
+在 dsh-cc 自身的仓库开发会话中，启动器锚点位于会话工作区内，启用会被拒绝
+（`anchor-under-writable-root`），通道降级为正常审批路径。预期行为，已有文档。
+
+## 安全模型（能力隧道，直言不讳）
+
+启用本桥接意味着明确放弃这一种命令形态的人工检查点。无人值守的 Codex 可以运行外层
+沙箱允许的任何子进程 —— 包括权限分类器本会升级处理的操作（git push、ssh、云 CLI）以及
+不受限的网络访问。**只有文件系统写入边界仍然成立**（工作区 + 临时目录），除此之外不作
+任何承诺。安装本插件即是选择加入；**卸载或禁用插件即是一键关闭**。
+
+## 当前状态
+
+PR-1 交付骨架，PR-2 激活闸门（对且仅对规范救援调用自动放行的 PreToolUse 钩子），
+PR-3 补齐入口表面：SessionStart 状态/规范块钩子与最终的 `/cc-codex-bridge:rescue`
+命令 —— 插件一旦安装，通道即完整可用。
+
+## 安装 / 卸载
+
+从 dsh-cc marketplace 安装，插件名 `cc-codex-bridge`：
+
+```sh
+claude plugin install cc-codex-bridge@dsh-cc
+```
+
+卸载（或禁用）插件即彻底移除该通道：
+
+```sh
+claude plugin uninstall cc-codex-bridge@dsh-cc
+```
+
+## 已知限制
+
+- 在 dsh-cc 自身的仓库开发会话中，启动器锚点位于工作区内，桥接会拒绝启用并降级为手动
+  流程（预期行为，已有文档）。
+- 环境变量 `BASH_ENV` 或 `ENV` 非空时通道自动失效（防御 shell 函数劫持）。
+- v1 的续聊支持仅有 `--last`。

package/commands/rescue.md

@@ -0,0 +1,30 @@
+---
+description: Run a Codex rescue review through the cc-codex-bridge lane
+argument-hint: "[rescue request]"
+---
+
+You are dispatching a Codex rescue for this request from the user:
+
+$ARGUMENTS
+
+The **cc-codex-bridge** plugin's SessionStart hook injected a block at session
+start beginning with `cc-codex-bridge:` that states whether the rescue lane is
+ARMED and, if so, gives THE exact canonical invocation to type.
+
+Rules — follow them exactly:
+
+1. **Use the SessionStart-provided canonical block.** If it reports ARMED, run
+   the canonical invocation exactly as given there, passing this request as the
+   prompt. If the request text is multi-line (or contains characters that are
+   awkward as one shell word), write the text to a file inside the current
+   workspace (or the canonical tmpdir) with your file-write tool, then use the
+   `--prompt-file <path>` form from the block. Never edit, abbreviate, or
+   re-derive the anchor paths.
+2. **`--last` ONLY when the user explicitly asked to continue the previous
+   rescue** (e.g. "continue the last rescue"). Otherwise omit it.
+3. **Fail closed when the block is absent or reports NOT armed.** If the
+   SessionStart block is missing (e.g. the session resumed without it) or says
+   the lane is not armed, you MUST NOT guess or construct the canonical
+   invocation — fall back to the normal, approval-requiring Codex rescue path
+   (the stock `/codex:rescue` flow, expecting the usual permission checkpoint)
+   and tell the user that is what you did.

package/hooks/codex-rescue-allow.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+/**
+ * codex-rescue-allow.mjs — the §3.2 pre-execute allow listener as a plugin
+ * PreToolUse command hook (plan §9 S2/S3).
+ *
+ * Contract: on a byte-exact canonical rescue invocation emit exactly one
+ * `hookSpecificOutput` allow verdict (the codec drops a top-level
+ * `decision: "allow"` — only `permissionDecision` reaches the waterfall);
+ * on EVERYTHING else — parse failure, non-Bash tool, non-match, disarmed
+ * state, refusal, containment violation — emit NOTHING and exit 0, so the
+ * command falls through to the unchanged existing permission flow. This
+ * hook never denies (§3.2-f fail-closed-into-silence; the SessionStart
+ * hook surfaces armed/refused state).
+ *
+ * Canonical anchors are derived per-match inside THIS process via the
+ * shared canonical.mjs module (§5 one-source rule): a command hook runs
+ * through a PATH-resolved interpreter, so the byte-pinned pair is the
+ * realpath of this process's own interpreter executable and the realpath
+ * of the plugin's own launcher script (see canonical.mjs for the
+ * derivation). Both must sit outside the writable-root refusal set and
+ * ambient BASH_ENV/ENV must be empty, or the bridge is disarmed for this
+ * call.
+ */
+import { tmpdir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { arming, inside, safeReal } from '../scripts/lib/canonical.mjs'
+import { matchInvocation } from '../scripts/lib/argv.mjs'
+
+const REASON = 'cc-codex-bridge: canonical rescue invocation (byte-pinned anchors, expansion-free)'
+
+/** Silent pass: no stdout at all, exit 0 — the unchanged existing flow decides. */
+const silent = () => process.exit(0)
+
+let input = ''
+process.stdin.setEncoding('utf8')
+for await (const chunk of process.stdin) input += chunk
+
+let payload
+try {
+  payload = JSON.parse(input)
+} catch {
+  silent()
+}
+if (payload?.tool_name !== 'Bash') silent()
+const command = payload?.tool_input?.command
+if (typeof command !== 'string' || command === '') silent()
+
+try {
+  const arm = arming(typeof payload.cwd === 'string' ? payload.cwd : process.cwd(), { hookUrl: import.meta.url })
+  if (!arm.armed) silent()
+  const { node: NODE, launcher: LAUNCHER, cwd } = arm
+
+  const match = matchInvocation(command, { node: NODE, launcher: LAUNCHER })
+  if (!match.ok) silent()
+
+  if (match.value.prompt.kind === 'prompt-file') {
+    const raw = match.value.prompt.path
+    const abs = isAbsolute(raw) ? raw : join(cwd ?? payload.cwd, raw)
+    // §3.2-d matcher-side containment: realpath must land inside the session
+    // workspace or the canonical tmpdir (a symlink escaping via realpath is
+    // refused here; the launcher re-checks on the fd it opens).
+    if (!inside(safeReal(abs), [cwd, safeReal(tmpdir())].filter((p) => p !== null))) silent()
+  }
+
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'allow',
+        permissionDecisionReason: REASON,
+      },
+    }) + '\n',
+  )
+} catch {
+  silent()
+}

package/hooks/codex-rescue-context.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/**
+ * codex-rescue-context.mjs — the SessionStart context hook (plan §9 S4).
+ *
+ * Contract: read the stdin JSON payload; on ANY failure (parse error, bad
+ * shape, derivation throw) stay silent and exit 0. On success emit exactly
+ * one line `{"hookSpecificOutput":{"hookEventName":"SessionStart",
+ * "additionalContext": <text>}}` where the text is the armed block (the
+ * exact canonical invocation to type) or the refused block (machine reason
+ * in plain words). Arming comes from the shared canonical.mjs — the same
+ * derivation the PreToolUse allow hook applies per call.
+ */
+import { armedText, arming, refusedText } from '../scripts/lib/canonical.mjs'
+
+let input = ''
+process.stdin.setEncoding('utf8')
+for await (const chunk of process.stdin) input += chunk
+
+let payload
+try {
+  payload = JSON.parse(input)
+} catch {
+  process.exit(0)
+}
+const cwd = typeof payload?.cwd === 'string' && payload.cwd !== '' ? payload.cwd : process.cwd()
+
+let text
+try {
+  const arm = arming(cwd, { hookUrl: import.meta.url })
+  text = arm.armed ? armedText(arm) : refusedText(arm.reason)
+} catch {
+  process.exit(0)
+}
+
+process.stdout.write(
+  JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: text } }) + '\n',
+)
+process.exit(0)

package/hooks/hooks.json

@@ -0,0 +1,27 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/codex-rescue-allow.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/codex-rescue-context.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-cc/plugin-cc-codex-bridge",
+  "version": "0.8.1",
+  "description": "Official dsh-cc plugin: an approval-free Codex rescue lane — one canonical, locked-down bash invocation auto-allowed via a PreToolUse hook, with Codex's internal sandbox off while the dsh outer sandbox remains the single write boundary.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "files": [
+    ".claude-plugin/plugin.json",
+    "commands",
+    "hooks",
+    "scripts",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dsh-cc/dsh-cc.git",
+    "directory": "packages/plugin/cc-codex-bridge"
+  }
+}