@ghl-ai/aw 0.1.39-beta.8 → 0.1.39

package/codex.mjs

@@ -0,0 +1,839 @@
+// codex.mjs — Project-local Codex defaults for AW/ECC startup.
+
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+import { getSupportedHarnessPhaseEntries } from './hook-manifest.mjs';
+
+const CODEX_HOOK_MATCHER = 'startup|resume';
+const CODEX_HOOK_COMMAND = 'bash "$(git rev-parse --show-toplevel)/hooks/aw-session-start"';
+const CODEX_PROMPT_COMMAND = 'bash "$(git rev-parse --show-toplevel)/scripts/hooks/session-start-rules-context.sh"';
+const CODEX_HOOK_STATUS = 'Loading AW router';
+const CURSOR_HOOK_COMMAND = 'bash "$(git rev-parse --show-toplevel)/hooks/aw-session-start"';
+const CLAUDE_HOOK_MATCHER = 'startup|resume|clear|compact';
+const CLAUDE_HOOK_COMMAND = '"$CLAUDE_PROJECT_DIR"/hooks/aw-session-start';
+const CLAUDE_PROMPT_COMMAND = 'bash "${CLAUDE_PROJECT_DIR}/scripts/hooks/session-start-rules-context.sh"';
+
+const CONFIG_FILE_MARKER = '# aw-managed-file: codex-ecc-baseline';
+const HOOK_LINE_MARKER = '# aw-managed: codex_hooks';
+const HOOK_LINE_REPLACED_MARKER = '# aw-managed: codex_hooks restored-from-false';
+const FEATURES_BLOCK_NAME = 'features';
+const AW_SESSION_START_MARKER = '# aw-managed: codex-aw-session-start';
+const SUPPORTED_CODEX_WORKSPACE_PHASES = new Set(
+  getSupportedHarnessPhaseEntries('codex', 'workspace').map(entry => entry.phase),
+);
+const SUPPORTED_CURSOR_WORKSPACE_PHASES = new Set(
+  getSupportedHarnessPhaseEntries('cursor', 'workspace').map(entry => entry.phase),
+);
+const SUPPORTED_CLAUDE_WORKSPACE_PHASES = new Set(
+  getSupportedHarnessPhaseEntries('claude', 'workspace').map(entry => entry.phase),
+);
+
+// Keep the AWCLI baseline lean and collision-free. Project-specific bridges such
+// as `ghl-ai` belong in the repo's own `.codex/config.toml`, not in the managed
+// defaults that AWCLI installs into every linked project.
+const CODEX_MANAGED_SERVERS = [
+  {
+    name: 'github',
+    lines: [
+      '[mcp_servers.github]',
+      'command = "npx"',
+      'args = ["-y", "@modelcontextprotocol/server-github"]',
+    ],
+  },
+  {
+    name: 'context7-mcp',
+    lines: [
+      '[mcp_servers.context7-mcp]',
+      'command = "npx"',
+      'args = ["-y", "@upstash/context7-mcp@latest"]',
+    ],
+  },
+  {
+    name: 'exa',
+    lines: [
+      '[mcp_servers.exa]',
+      'url = "https://mcp.exa.ai/mcp"',
+    ],
+  },
+  {
+    name: 'memory',
+    lines: [
+      '[mcp_servers.memory]',
+      'command = "npx"',
+      'args = ["-y", "@modelcontextprotocol/server-memory"]',
+    ],
+  },
+  {
+    name: 'playwright',
+    lines: [
+      '[mcp_servers.playwright]',
+      'command = "npx"',
+      'args = ["-y", "@playwright/mcp@latest", "--extension"]',
+    ],
+  },
+  {
+    name: 'sequential-thinking',
+    lines: [
+      '[mcp_servers.sequential-thinking]',
+      'command = "npx"',
+      'args = ["-y", "@modelcontextprotocol/server-sequential-thinking"]',
+    ],
+  },
+];
+
+const AW_SESSION_START_SCRIPT = `#!/usr/bin/env bash
+${AW_SESSION_START_MARKER}
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(cd "\${SCRIPT_DIR}/.." && pwd)"
+TARGET_SCRIPT="\$ROOT_DIR/.aw_registry/platform/core/skills/using-aw-skills/hooks/session-start.sh"
+
+if [[ ! -f "\$TARGET_SCRIPT" ]]; then
+  echo '{"hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": "WARNING: AW session-start hook not found at .aw_registry/platform/core/skills/using-aw-skills/hooks/session-start.sh. Run aw pull platform or aw init."}}'
+  exit 0
+fi
+
+exec bash "\$TARGET_SCRIPT"
+`;
+
+export function ensureCodexWorkspaceDefaults(cwd) {
+  const updatedFiles = [];
+
+  const codexConfigPath = join(cwd, '.codex', 'config.toml');
+  if (ensureCodexConfig(codexConfigPath)) {
+    updatedFiles.push(codexConfigPath);
+  }
+
+  const codexHooksPath = join(cwd, '.codex', 'hooks.json');
+  if (ensureCodexHooksJson(codexHooksPath)) {
+    updatedFiles.push(codexHooksPath);
+  }
+
+  const hookWrapperPath = join(cwd, 'hooks', 'aw-session-start');
+  if (ensureManagedScript(hookWrapperPath, AW_SESSION_START_SCRIPT, AW_SESSION_START_MARKER)) {
+    updatedFiles.push(hookWrapperPath);
+  }
+
+  return updatedFiles;
+}
+
+export function ensureWorkspaceHookDefaults(cwd) {
+  const updatedFiles = [...ensureCodexWorkspaceDefaults(cwd)];
+
+  const cursorHooksPath = join(cwd, '.cursor', 'hooks.json');
+  if (ensureCursorHooksJson(cursorHooksPath)) {
+    updatedFiles.push(cursorHooksPath);
+  }
+
+  const claudeSettingsPath = join(cwd, '.claude', 'settings.json');
+  if (ensureClaudeSettingsJson(claudeSettingsPath)) {
+    updatedFiles.push(claudeSettingsPath);
+  }
+
+  return updatedFiles;
+}
+
+export function removeCodexWorkspaceDefaults(cwd) {
+  const removedFiles = [];
+
+  const hookWrapperPath = join(cwd, 'hooks', 'aw-session-start');
+  if (removeManagedScript(hookWrapperPath, AW_SESSION_START_MARKER)) {
+    removedFiles.push(hookWrapperPath);
+  }
+
+  const codexHooksPath = join(cwd, '.codex', 'hooks.json');
+  if (removeManagedHooksJson(codexHooksPath)) {
+    removedFiles.push(codexHooksPath);
+  }
+
+  const codexConfigPath = join(cwd, '.codex', 'config.toml');
+  if (removeManagedCodexConfig(codexConfigPath)) {
+    removedFiles.push(codexConfigPath);
+  }
+
+  pruneEmptyDir(join(cwd, '.codex'));
+  pruneEmptyDir(join(cwd, 'hooks'));
+
+  return removedFiles;
+}
+
+export function removeWorkspaceHookDefaults(cwd) {
+  const removedFiles = [];
+
+  const cursorHooksPath = join(cwd, '.cursor', 'hooks.json');
+  if (removeManagedCursorHooksJson(cursorHooksPath)) {
+    removedFiles.push(cursorHooksPath);
+  }
+
+  const claudeSettingsPath = join(cwd, '.claude', 'settings.json');
+  if (removeManagedClaudeSettingsJson(claudeSettingsPath)) {
+    removedFiles.push(claudeSettingsPath);
+  }
+
+  removedFiles.push(...removeCodexWorkspaceDefaults(cwd));
+
+  pruneEmptyDir(join(cwd, '.cursor'));
+  pruneEmptyDir(join(cwd, '.claude'));
+
+  return removedFiles;
+}
+
+function ensureCodexConfig(filePath) {
+  if (!existsSync(filePath)) {
+    mkdirSync(dirname(filePath), { recursive: true });
+    writeFileSync(filePath, buildManagedConfigFile());
+    return true;
+  }
+
+  const existing = readFileSync(filePath, 'utf8');
+  if (isLegacyHookOnlyConfig(existing)) {
+    writeFileSync(filePath, buildManagedConfigFile());
+    return true;
+  }
+
+  let next = existing;
+  next = ensureCodexHookEnabled(next);
+  next = ensureManagedServerBlocks(next);
+
+  if (next === existing) {
+    return false;
+  }
+
+  writeFileSync(filePath, next);
+  return true;
+}
+
+function ensureCodexHooksJson(filePath) {
+  let config = {};
+
+  if (existsSync(filePath)) {
+    try {
+      config = JSON.parse(readFileSync(filePath, 'utf8'));
+    } catch {
+      config = {};
+    }
+  }
+
+  if (!config.hooks || typeof config.hooks !== 'object' || Array.isArray(config.hooks)) {
+    config.hooks = {};
+  }
+
+  const sessionStart = Array.isArray(config.hooks.SessionStart) ? config.hooks.SessionStart : [];
+  const existingEntry = sessionStart.find(entry =>
+    entry?.matcher === CODEX_HOOK_MATCHER &&
+    Array.isArray(entry.hooks) &&
+    entry.hooks.some(hook => hook?.type === 'command' && hook?.command === CODEX_HOOK_COMMAND)
+  );
+  const existingAwEntry = sessionStart.find(entry =>
+    Array.isArray(entry?.hooks) &&
+    entry.hooks.some(hook => hook?.type === 'command' && isAwSessionStartCommand(hook?.command))
+  );
+  const promptSubmit = Array.isArray(config.hooks.UserPromptSubmit) ? config.hooks.UserPromptSubmit : [];
+  const existingPromptEntry = promptSubmit.find(entry =>
+    Array.isArray(entry?.hooks) &&
+    entry.hooks.some(hook => hook?.type === 'command' && isAwPromptReminderCommand(hook?.command))
+  );
+
+  let changed = false;
+
+  if (SUPPORTED_CODEX_WORKSPACE_PHASES.has('SessionStart') && existingEntry) {
+    const desiredHook = existingEntry.hooks.find(hook => hook?.type === 'command' && hook?.command === CODEX_HOOK_COMMAND);
+    if (desiredHook && desiredHook.statusMessage !== CODEX_HOOK_STATUS) {
+      desiredHook.statusMessage = CODEX_HOOK_STATUS;
+      changed = true;
+    }
+  } else if (SUPPORTED_CODEX_WORKSPACE_PHASES.has('SessionStart') && !existingAwEntry) {
+    sessionStart.push({
+      matcher: CODEX_HOOK_MATCHER,
+      hooks: [
+        {
+          type: 'command',
+          command: CODEX_HOOK_COMMAND,
+          statusMessage: CODEX_HOOK_STATUS,
+        },
+      ],
+    });
+    config.hooks.SessionStart = sessionStart;
+    changed = true;
+  }
+
+  if (SUPPORTED_CODEX_WORKSPACE_PHASES.has('UserPromptSubmit') && !existingPromptEntry) {
+    promptSubmit.push({
+      hooks: [
+        {
+          type: 'command',
+          command: CODEX_PROMPT_COMMAND,
+        },
+      ],
+    });
+    config.hooks.UserPromptSubmit = promptSubmit;
+    changed = true;
+  }
+
+  if (!changed && existsSync(filePath)) {
+    return false;
+  }
+
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`);
+  return true;
+}
+
+function ensureCursorHooksJson(filePath) {
+  let config = {};
+
+  if (existsSync(filePath)) {
+    try {
+      config = JSON.parse(readFileSync(filePath, 'utf8'));
+    } catch {
+      config = {};
+    }
+  }
+
+  if (!config || typeof config !== 'object' || Array.isArray(config)) {
+    config = {};
+  }
+
+  let changed = false;
+
+  if (config.version === undefined) {
+    config.version = 1;
+    changed = true;
+  }
+
+  if (!config.hooks || typeof config.hooks !== 'object' || Array.isArray(config.hooks)) {
+    config.hooks = {};
+    changed = true;
+  }
+
+  const sessionStart = Array.isArray(config.hooks.sessionStart) ? config.hooks.sessionStart : [];
+  const existingAwEntry = sessionStart.find(entry => isAwSessionStartCommand(entry?.command));
+
+  if (SUPPORTED_CURSOR_WORKSPACE_PHASES.has('SessionStart') && !existingAwEntry) {
+    sessionStart.push({ command: CURSOR_HOOK_COMMAND });
+    config.hooks.sessionStart = sessionStart;
+    changed = true;
+  }
+
+  if (!changed && existsSync(filePath)) {
+    return false;
+  }
+
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`);
+  return true;
+}
+
+function removeManagedCursorHooksJson(filePath) {
+  if (!existsSync(filePath)) {
+    return false;
+  }
+
+  let config;
+  try {
+    config = JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return false;
+  }
+
+  if (!config || typeof config !== 'object' || Array.isArray(config) || !config.hooks || typeof config.hooks !== 'object' || Array.isArray(config.hooks)) {
+    return false;
+  }
+
+  let changed = false;
+
+  if (Array.isArray(config.hooks.sessionStart)) {
+    const nextSessionStart = config.hooks.sessionStart.filter(entry => entry?.command !== CURSOR_HOOK_COMMAND);
+    if (nextSessionStart.length !== config.hooks.sessionStart.length) {
+      changed = true;
+    }
+
+    if (nextSessionStart.length > 0) {
+      config.hooks.sessionStart = nextSessionStart;
+    } else if (config.hooks.sessionStart.length > 0) {
+      delete config.hooks.sessionStart;
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return false;
+  }
+
+  if (Object.keys(config.hooks).length === 0) {
+    delete config.hooks;
+  }
+
+  if (isManagedJsonShell(config, ['version']) || isManagedJsonShell(config, [])) {
+    rmSync(filePath, { force: true });
+    return true;
+  }
+
+  writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`);
+  return true;
+}
+
+function ensureClaudeSettingsJson(filePath) {
+  let config = {};
+
+  if (existsSync(filePath)) {
+    try {
+      config = JSON.parse(readFileSync(filePath, 'utf8'));
+    } catch {
+      config = {};
+    }
+  }
+
+  if (!config || typeof config !== 'object' || Array.isArray(config)) {
+    config = {};
+  }
+
+  if (!config.hooks || typeof config.hooks !== 'object' || Array.isArray(config.hooks)) {
+    config.hooks = {};
+  }
+
+  const sessionStart = Array.isArray(config.hooks.SessionStart) ? config.hooks.SessionStart : [];
+  const existingAwEntry = sessionStart.find(entry =>
+    Array.isArray(entry?.hooks) &&
+    entry.hooks.some(hook => hook?.type === 'command' && isAwSessionStartCommand(hook?.command))
+  );
+  const promptSubmit = Array.isArray(config.hooks.UserPromptSubmit) ? config.hooks.UserPromptSubmit : [];
+  const existingPromptEntry = promptSubmit.find(entry =>
+    Array.isArray(entry?.hooks) &&
+    entry.hooks.some(hook => hook?.type === 'command' && isAwPromptReminderCommand(hook?.command))
+  );
+
+  let changed = false;
+
+  if (SUPPORTED_CLAUDE_WORKSPACE_PHASES.has('SessionStart') && !existingAwEntry) {
+    sessionStart.push({
+      matcher: CLAUDE_HOOK_MATCHER,
+      hooks: [
+        {
+          type: 'command',
+          command: CLAUDE_HOOK_COMMAND,
+        },
+      ],
+    });
+    config.hooks.SessionStart = sessionStart;
+    changed = true;
+  }
+
+  if (SUPPORTED_CLAUDE_WORKSPACE_PHASES.has('UserPromptSubmit') && !existingPromptEntry) {
+    promptSubmit.push({
+      hooks: [
+        {
+          type: 'command',
+          command: CLAUDE_PROMPT_COMMAND,
+        },
+      ],
+    });
+    config.hooks.UserPromptSubmit = promptSubmit;
+    changed = true;
+  }
+
+  if (!changed && existsSync(filePath)) {
+    return false;
+  }
+
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`);
+  return true;
+}
+
+function removeManagedClaudeSettingsJson(filePath) {
+  if (!existsSync(filePath)) {
+    return false;
+  }
+
+  let config;
+  try {
+    config = JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return false;
+  }
+
+  if (!config || typeof config !== 'object' || Array.isArray(config) || !config.hooks || typeof config.hooks !== 'object' || Array.isArray(config.hooks)) {
+    return false;
+  }
+
+  let changed = false;
+
+  if (Array.isArray(config.hooks.SessionStart)) {
+    const nextSessionStart = config.hooks.SessionStart
+      .map(entry => {
+        if (!Array.isArray(entry?.hooks)) {
+          return entry;
+        }
+
+        const filteredHooks = entry.hooks.filter(hook =>
+          !(hook?.type === 'command' && hook?.command === CLAUDE_HOOK_COMMAND)
+        );
+
+        if (filteredHooks.length !== entry.hooks.length) {
+          changed = true;
+        }
+
+        if (filteredHooks.length === 0) {
+          return null;
+        }
+
+        return { ...entry, hooks: filteredHooks };
+      })
+      .filter(Boolean);
+
+    if (nextSessionStart.length > 0) {
+      config.hooks.SessionStart = nextSessionStart;
+    } else if (config.hooks.SessionStart.length > 0) {
+      delete config.hooks.SessionStart;
+      changed = true;
+    }
+  }
+
+  if (Array.isArray(config.hooks.UserPromptSubmit)) {
+    const nextPromptSubmit = config.hooks.UserPromptSubmit
+      .map(entry => {
+        if (!Array.isArray(entry?.hooks)) {
+          return entry;
+        }
+
+        const filteredHooks = entry.hooks.filter(hook =>
+          !(hook?.type === 'command' && hook?.command === CLAUDE_PROMPT_COMMAND)
+        );
+
+        if (filteredHooks.length !== entry.hooks.length) {
+          changed = true;
+        }
+
+        if (filteredHooks.length === 0) {
+          return null;
+        }
+
+        return { ...entry, hooks: filteredHooks };
+      })
+      .filter(Boolean);
+
+    if (nextPromptSubmit.length > 0) {
+      config.hooks.UserPromptSubmit = nextPromptSubmit;
+    } else if (config.hooks.UserPromptSubmit.length > 0) {
+      delete config.hooks.UserPromptSubmit;
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return false;
+  }
+
+  if (Object.keys(config.hooks).length === 0) {
+    delete config.hooks;
+  }
+
+  if (isManagedJsonShell(config, [])) {
+    rmSync(filePath, { force: true });
+    return true;
+  }
+
+  writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`);
+  return true;
+}
+
+function removeManagedHooksJson(filePath) {
+  if (!existsSync(filePath)) {
+    return false;
+  }
+
+  let config;
+  try {
+    config = JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return false;
+  }
+
+  if (!config.hooks || typeof config.hooks !== 'object' || Array.isArray(config.hooks)) {
+    return false;
+  }
+
+  let changed = false;
+
+  if (Array.isArray(config.hooks.SessionStart)) {
+    const nextSessionStart = config.hooks.SessionStart
+      .map(entry => {
+        if (!Array.isArray(entry?.hooks)) {
+          return entry;
+        }
+
+        const filteredHooks = entry.hooks.filter(hook =>
+          !(hook?.type === 'command' && hook?.command === CODEX_HOOK_COMMAND)
+        );
+
+        if (filteredHooks.length !== entry.hooks.length) {
+          changed = true;
+        }
+
+        if (filteredHooks.length === 0) {
+          return null;
+        }
+
+        return { ...entry, hooks: filteredHooks };
+      })
+      .filter(Boolean);
+
+    if (nextSessionStart.length > 0) {
+      config.hooks.SessionStart = nextSessionStart;
+    } else if (config.hooks.SessionStart.length > 0) {
+      delete config.hooks.SessionStart;
+      changed = true;
+    }
+  }
+
+  if (Array.isArray(config.hooks.UserPromptSubmit)) {
+    const nextPromptSubmit = config.hooks.UserPromptSubmit
+      .map(entry => {
+        if (!Array.isArray(entry?.hooks)) {
+          return entry;
+        }
+
+        const filteredHooks = entry.hooks.filter(hook =>
+          !(hook?.type === 'command' && hook?.command === CODEX_PROMPT_COMMAND)
+        );
+
+        if (filteredHooks.length !== entry.hooks.length) {
+          changed = true;
+        }
+
+        if (filteredHooks.length === 0) {
+          return null;
+        }
+
+        return { ...entry, hooks: filteredHooks };
+      })
+      .filter(Boolean);
+
+    if (nextPromptSubmit.length > 0) {
+      config.hooks.UserPromptSubmit = nextPromptSubmit;
+    } else if (config.hooks.UserPromptSubmit.length > 0) {
+      delete config.hooks.UserPromptSubmit;
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return false;
+  }
+
+  if (Object.keys(config.hooks).length === 0) {
+    rmSync(filePath, { force: true });
+    return true;
+  }
+
+  writeFileSync(filePath, `${JSON.stringify(config, null, 2)}\n`);
+  return true;
+}
+
+function removeManagedCodexConfig(filePath) {
+  if (!existsSync(filePath)) {
+    return false;
+  }
+
+  const existing = readFileSync(filePath, 'utf8');
+
+  if (existing.includes(CONFIG_FILE_MARKER) || isLegacyHookOnlyConfig(existing)) {
+    rmSync(filePath, { force: true });
+    return true;
+  }
+
+  let next = existing;
+
+  for (const server of CODEX_MANAGED_SERVERS) {
+    next = removeManagedBlock(next, serverBlockName(server.name));
+  }
+
+  next = removeManagedBlock(next, FEATURES_BLOCK_NAME);
+  next = next.replace(
+    new RegExp(`^\\s*codex_hooks\\s*=\\s*true\\s*${escapeRegExp(HOOK_LINE_MARKER)}\\s*$\\n?`, 'm'),
+    ''
+  );
+  next = next.replace(
+    new RegExp(`^\\s*codex_hooks\\s*=\\s*true\\s*${escapeRegExp(HOOK_LINE_REPLACED_MARKER)}\\s*$\\n?`, 'm'),
+    'codex_hooks = false\n'
+  );
+
+  next = tidyToml(next);
+
+  if (next === existing) {
+    return false;
+  }
+
+  if (next.trim() === '') {
+    rmSync(filePath, { force: true });
+    return true;
+  }
+
+  writeFileSync(filePath, next);
+  return true;
+}
+
+function ensureManagedServerBlocks(content) {
+  let next = content;
+
+  for (const server of CODEX_MANAGED_SERVERS) {
+    if (hasTomlSection(next, `mcp_servers.${server.name}`)) {
+      continue;
+    }
+
+    next = `${next.trimEnd()}\n\n${buildManagedBlock(serverBlockName(server.name), server.lines)}\n`;
+  }
+
+  return tidyToml(next);
+}
+
+function ensureCodexHookEnabled(content) {
+  if (/^\s*codex_hooks\s*=\s*true\b/m.test(content)) {
+    return content;
+  }
+
+  if (/^\s*codex_hooks\s*=\s*false\b/m.test(content)) {
+    return content.replace(
+      /^\s*codex_hooks\s*=\s*false\b.*$/m,
+      `codex_hooks = true ${HOOK_LINE_REPLACED_MARKER}`
+    );
+  }
+
+  const featuresHeaderMatch = content.match(/^\[features\]\s*$/m);
+  if (featuresHeaderMatch && featuresHeaderMatch.index !== undefined) {
+    const insertAt = featuresHeaderMatch.index + featuresHeaderMatch[0].length;
+    return `${content.slice(0, insertAt)}\ncodex_hooks = true ${HOOK_LINE_MARKER}${content.slice(insertAt)}`;
+  }
+
+  return tidyToml(`${content.trimEnd()}\n\n${buildManagedBlock(FEATURES_BLOCK_NAME, ['[features]', 'codex_hooks = true'])}\n`);
+}
+
+function buildManagedConfigFile() {
+  const lines = [
+    CONFIG_FILE_MARKER,
+    '#:schema https://developers.openai.com/codex/config-schema.json',
+    '',
+    'approval_policy = "on-request"',
+    'sandbox_mode = "workspace-write"',
+    'web_search = "live"',
+    'persistent_instructions = true',
+  ];
+
+  for (const server of CODEX_MANAGED_SERVERS) {
+    lines.push('', ...buildManagedBlockLines(serverBlockName(server.name), server.lines));
+  }
+
+  lines.push('', ...buildManagedBlockLines(FEATURES_BLOCK_NAME, ['[features]', 'codex_hooks = true']));
+  return `${lines.join('\n')}\n`;
+}
+
+function buildManagedBlock(name, lines) {
+  return `${buildManagedBlockLines(name, lines).join('\n')}`;
+}
+
+function buildManagedBlockLines(name, lines) {
+  return [`# aw-managed-start: ${name}`, ...lines, `# aw-managed-end: ${name}`];
+}
+
+function removeManagedBlock(content, name) {
+  const pattern = new RegExp(
+    `\\n?# aw-managed-start: ${escapeRegExp(name)}\\n[\\s\\S]*?\\n# aw-managed-end: ${escapeRegExp(name)}\\n?`,
+    'g'
+  );
+  return content.replace(pattern, '\n');
+}
+
+function ensureManagedScript(filePath, content, marker) {
+  if (existsSync(filePath)) {
+    const existing = readFileSync(filePath, 'utf8');
+    if (existing === content) {
+      return false;
+    }
+    if (!existing.includes(marker)) {
+      return false;
+    }
+  }
+
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, content);
+  return true;
+}
+
+function removeManagedScript(filePath, marker) {
+  if (!existsSync(filePath)) {
+    return false;
+  }
+
+  const existing = readFileSync(filePath, 'utf8');
+  if (!existing.includes(marker)) {
+    return false;
+  }
+
+  rmSync(filePath, { force: true });
+  return true;
+}
+
+function hasTomlSection(content, sectionName) {
+  const pattern = new RegExp(`^\\[${escapeRegExp(sectionName)}\\]\\s*$`, 'm');
+  return pattern.test(content);
+}
+
+function tidyToml(content) {
+  const normalized = content
+    .replace(/\r\n/g, '\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .replace(/[ \t]+\n/g, '\n')
+    .trim();
+  return normalized ? `${normalized}\n` : '';
+}
+
+function serverBlockName(name) {
+  return `mcp_servers.${name}`;
+}
+
+function pruneEmptyDir(dirPath) {
+  if (!existsSync(dirPath)) {
+    return;
+  }
+
+  try {
+    if (readFileSync(join(dirPath, '.keep'))) {
+      return;
+    }
+  } catch { /* no sentinel */ }
+
+  try {
+    if (dirname(dirPath) !== dirPath && existsSync(dirPath) && readdirSync(dirPath).length === 0) {
+      rmSync(dirPath, { recursive: true, force: true });
+    }
+  } catch { /* best effort */ }
+}
+
+function isLegacyHookOnlyConfig(content) {
+  const trimmed = content.trim();
+  return trimmed === '[features]\ncodex_hooks = true';
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function isAwSessionStartCommand(command) {
+  return typeof command === 'string' && (
+    command.includes('hooks/aw-session-start') ||
+    command.includes('hooks/session-start') ||
+    (/run-hook\.cmd/.test(command) && /session-start/.test(command))
+  );
+}
+
+function isAwPromptReminderCommand(command) {
+  return typeof command === 'string' && command.includes('scripts/hooks/session-start-rules-context.sh');
+}
+
+function isManagedJsonShell(config, allowedKeys) {
+  const keys = Object.keys(config);
+  return keys.every(key => allowedKeys.includes(key));
+}