@haposoft/cafekit 0.18.1 → 0.18.3

package/src/codex/hooks/lib/hook-context.cjs

@@ -18,6 +18,88 @@ const PROJECT_ROOT = (() => {
   }
 })();
 
+/**
+ * Plugin root when this hook runs from the Codex plugin tree, else null.
+ *
+ * Codex exports PLUGIN_ROOT (and CLAUDE_PLUGIN_ROOT) to plugin hooks. An npx-installed
+ * hook can inherit those variables from a parent process, so the plugin is recognized
+ * only when this file really lives under that root.
+ */
+function pluginRoot() {
+  const declared = process.env.PLUGIN_ROOT || process.env.CLAUDE_PLUGIN_ROOT;
+  if (!declared) return null;
+  try {
+    const root = fs.realpathSync(declared);
+    const self = fs.realpathSync(path.resolve(__dirname, '..', '..'));
+    return self === root ? root : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Where the plugin keeps state for every repository: PLUGIN_DATA, or a per-user temp
+ * directory. The temp directory must be a real 0700 directory this user owns; anything
+ * else throws, so privacy decisions fail closed instead of trusting a planted path.
+ */
+function pluginStateRoot() {
+  const data = process.env.PLUGIN_DATA || process.env.CLAUDE_PLUGIN_DATA;
+  if (data && path.isAbsolute(data)) {
+    fs.mkdirSync(data, { recursive: true, mode: 0o700 });
+    return fs.realpathSync(data);
+  }
+  const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
+  const dir = path.join(require('os').tmpdir(), `cafekit-codex-plugin-${uid}`);
+  try { fs.mkdirSync(dir, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+  const stat = fs.lstatSync(dir);
+  const owned = typeof process.getuid !== 'function' || stat.uid === process.getuid();
+  if (!stat.isDirectory() || stat.isSymbolicLink() || !owned || (stat.mode & 0o077) !== 0) {
+    throw new Error(`unsafe CafeKit plugin state directory: ${dir}`);
+  }
+  return dir;
+}
+
+/** Per-repository state directory under the plugin state root. */
+function pluginProjectDir(projectRoot, name) {
+  const key = crypto.createHash('sha256').update(String(projectRoot)).digest('hex').slice(0, 16);
+  return path.join(pluginStateRoot(), 'projects', key, name);
+}
+
+/**
+ * True when the repository runs CafeKit's own npx-installed Codex hooks: its
+ * .codex/hooks.json parses, and every CafeKit launcher in it names a hook script that
+ * exists inside this repository. A committed hooks.json from another machine, or a
+ * planted file with no real hooks behind it, must not switch the plugin's gates off.
+ */
+function hasProjectCafekitHooks(projectRoot) {
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(projectRoot, '.codex', 'hooks.json'), 'utf8'));
+    const hooksDir = fs.realpathSync(path.join(projectRoot, '.codex', 'hooks'));
+    const commands = Object.values(config?.hooks || {}).flat()
+      .flatMap((group) => (Array.isArray(group?.hooks) ? group.hooks : []))
+      .map((handler) => String(handler?.command || ''));
+    const scripts = commands
+      .map((command) => command.match(/'([^']*[/\\]\.codex[/\\]hooks[/\\][a-z0-9-]+\.cjs)'\s*$/)?.[1])
+      .filter(Boolean);
+    if (scripts.length === 0) return false;
+    // The npx launcher names its script by the exact path <realpath(root)>/.codex/hooks.
+    // Anything else (a relative path, `..`, a symlinked alias, /proc/self/cwd) can
+    // resolve against whatever cwd the hook runs in, so it never counts.
+    const expectedDir = path.join(fs.realpathSync(projectRoot), '.codex', 'hooks');
+    return scripts.every((script) => {
+      if (!path.isAbsolute(script) || path.dirname(script) !== expectedDir) return false;
+      try {
+        const real = fs.realpathSync(script);
+        return path.dirname(real) === hooksDir && fs.statSync(real).isFile();
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
+
 function readPayload() {
   const raw = fs.readFileSync(0, 'utf8').trim();
   if (!raw) throw new Error('hook payload is empty');
@@ -40,6 +122,33 @@ function resolveSessionCwd(payload) {
   }
 }
 
+function gitTopLevel(cwd) {
+  try {
+    const out = require('child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd, encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore']
+    }).trim();
+    return out ? fs.realpathSync(out) : cwd;
+  } catch {
+    return cwd;
+  }
+}
+
+/**
+ * The repository a hook acts on. An npx install sits inside it (PROJECT_ROOT); the plugin
+ * lives in a shared cache, so it takes the repository from the payload's cwd. Beside an
+ * active npx install the plugin stands down, so one set of gates and one privacy store
+ * decide; `onStandDown` lets SessionStart say so once.
+ */
+function resolveProjectRoot(payload, { onStandDown } = {}) {
+  if (!pluginRoot()) return PROJECT_ROOT;
+  const root = gitTopLevel(resolveSessionCwd(payload));
+  if (hasProjectCafekitHooks(root)) {
+    if (typeof onStandDown === 'function') onStandDown(root);
+    process.exit(0);
+  }
+  return root;
+}
+
 function readRuntime(projectRoot = PROJECT_ROOT) {
   try {
     const file = path.join(projectRoot, '.codex', 'runtime.json');
@@ -84,10 +193,11 @@ function assertConfiguredSpecsPath(projectRoot, runtime) {
 }
 
 function getHookContext(payload) {
-  const runtime = readRuntime(PROJECT_ROOT);
-  assertConfiguredSpecsPath(PROJECT_ROOT, runtime);
+  const projectRoot = resolveProjectRoot(payload);
+  const runtime = readRuntime(projectRoot);
+  assertConfiguredSpecsPath(projectRoot, runtime);
   return {
-    projectRoot: PROJECT_ROOT,
+    projectRoot,
     sessionCwd: resolveSessionCwd(payload),
     runtime
   };
@@ -123,6 +233,7 @@ function atomicWrite(file, content, mode = 0o600) {
  * `.codex` at any depth. Source-tree runs therefore write to a temp directory.
  */
 function hookStateDir(projectRoot) {
+  if (pluginRoot()) return projectRoot ? pluginProjectDir(projectRoot, 'logs') : path.join(pluginStateRoot(), 'logs');
   const root = projectRoot || PROJECT_ROOT;
   return String(root).includes(`${path.sep}packages${path.sep}spec${path.sep}src`)
     ? path.join(require('os').tmpdir(), 'cafekit-hook-logs', 'codex')
@@ -131,7 +242,7 @@ function hookStateDir(projectRoot) {
 
 function logCrash(hook, error) {
   try {
-    const dir = hookStateDir(PROJECT_ROOT);
+    const dir = pluginRoot() ? hookStateDir(null) : hookStateDir(PROJECT_ROOT);
     fs.mkdirSync(dir, { recursive: true });
     fs.appendFileSync(
       path.join(dir, 'hook-log.jsonl'),
@@ -149,6 +260,9 @@ function logCrash(hook, error) {
 
 module.exports = {
   PROJECT_ROOT,
+  pluginRoot,
+  pluginProjectDir,
+  resolveProjectRoot,
   atomicWrite,
   getHookContext,
   hookStateDir,

package/src/codex/hooks/lib/inspect-paths.cjs

@@ -1,199 +1 @@
-'use strict';
-
-const BLOCKED_DIRS = new Set([
-  'node_modules', 'dist', 'build', '.next', '.nuxt', '.output',
-  '__pycache__', '.venv', 'venv', 'vendor', 'target',
-  '.git', 'coverage', '.nyc_output'
-]);
-const BROAD_GLOBS = [/^\*\*\/\*$/, /^\*\*\.\w+$/, /^\*\*\/\*\.\w+$/];
-const PATH_KEYS = new RegExp(
-  '^(?:file_?paths?|paths?|search_?paths?|'
-  + '(?:source|target|destination)_?paths?|dirs?|director(?:y|ies)|'
-  + 'folders?|cwd|root|locations?|uris?)$',
-  'i'
-);
-const GLOB_KEYS = /(?:^|_)(?:glob|globs|pattern|patterns)$/i;
-function clean(value) {
-  return String(value || '').trim().replace(/^['"`]+|['"`,:]+$/g, '');
-}
-function blockedSegment(value) {
-  return clean(value)
-    .replace(/\\/g, '/')
-    .split('/')
-    .find((segment) => BLOCKED_DIRS.has(segment));
-}
-function isBroadGlob(value) {
-  const candidate = clean(value);
-  return BROAD_GLOBS.some((rule) => rule.test(candidate));
-}
-function collectStructured(value, key, paths, globs) {
-  if (typeof value === 'string') {
-    if (PATH_KEYS.test(key)) paths.push(value);
-    if (GLOB_KEYS.test(key)) globs.push(value);
-    return;
-  }
-  if (Array.isArray(value)) {
-    if (PATH_KEYS.test(key)) paths.push(...value.filter((item) => typeof item === 'string'));
-    if (GLOB_KEYS.test(key)) globs.push(...value.filter((item) => typeof item === 'string'));
-    for (const item of value) collectStructured(item, '', paths, globs);
-    return;
-  }
-  if (!value || typeof value !== 'object') return;
-  for (const [childKey, child] of Object.entries(value)) {
-    collectStructured(child, childKey, paths, globs);
-  }
-}
-function shellTokens(command) {
-  const tokens = [];
-  let token = '';
-  let quote = '';
-  for (let index = 0; index < command.length; index += 1) {
-    const char = command[index];
-    if (quote) {
-      if (char === quote) quote = '';
-      else if (char === '\\' && quote === '"' && index + 1 < command.length) {
-        token += command[index += 1];
-      } else token += char;
-      continue;
-    }
-    if (char === '"' || char === "'") {
-      quote = char;
-    } else if (char === '\n') {
-      if (token) tokens.push(token);
-      token = '';
-      tokens.push('|');
-    } else if (/\s/.test(char)) {
-      if (token) tokens.push(token);
-      token = '';
-    } else if (';&|'.includes(char)) {
-      if (token) tokens.push(token);
-      token = '';
-      const pair = command.slice(index, index + 2);
-      if (pair === '&&' || pair === '||') index += 1;
-      tokens.push('|');
-    } else {
-      token += char;
-    }
-  }
-  if (token) tokens.push(token);
-  return tokens;
-}
-function commandGroups(command) {
-  const groups = [[]];
-  for (const token of shellTokens(command)) {
-    if (token === '|') groups.push([]);
-    else groups[groups.length - 1].push(clean(token));
-  }
-  return groups.filter((group) => group.length);
-}
-
-function positional(tokens, optionsWithValue = new Set()) {
-  const out = [];
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (optionsWithValue.has(token)) index += 1;
-    else if (!token.startsWith('-') || token === '-') out.push(token);
-  }
-  return out;
-}
-
-function readerOptionPaths(name, tokens) {
-  if (!['rg', 'grep', 'sed'].includes(name)) return [];
-  const paths = [];
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token === '-f' || token === '--file') {
-      if (tokens[index + 1]) paths.push(tokens[index + 1]);
-      index += 1;
-    } else if (token.startsWith('--file=')) {
-      paths.push(token.slice('--file='.length));
-    }
-  }
-  return paths;
-}
-
-function findRoots(tokens) {
-  const roots = [];
-  let index = 1;
-  while (['-H', '-L', '-P'].includes(tokens[index]) || /^-O\d+$/.test(tokens[index] || '')) {
-    index += 1;
-  }
-  if (tokens[index] === '-D') index += 2;
-  if (tokens[index] === '--') index += 1;
-  for (; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token.startsWith('-') || ['!', '(', ')'].includes(token)) break;
-    roots.push(token);
-  }
-  return roots;
-}
-
-function commandPaths(group, globs) {
-  const commandIndex = group.findIndex((token) => (
-    token && !/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)
-  ));
-  if (commandIndex < 0) return [];
-  const tokens = group.slice(commandIndex);
-  while (['sudo', 'env', 'time', 'command'].includes(tokens[0])) tokens.shift();
-  if (!tokens.length) return [];
-  const name = tokens[0].replace(/\\/g, '/').split('/').pop();
-  const optionPaths = readerOptionPaths(name, tokens);
-
-  for (let index = 1; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (token === '-g' || token === '--glob' || token === '--iglob') {
-      if (tokens[index + 1]) globs.push(tokens[index + 1]);
-    } else if (/^--(?:i?glob)=/.test(token)) {
-      globs.push(token.slice(token.indexOf('=') + 1));
-    }
-  }
-
-  if (name === 'rg' || name === 'grep') {
-    const values = positional(tokens, new Set([
-      '-e', '--regexp', '-f', '--file', '-g', '--glob', '--iglob',
-      '-t', '--type', '-T', '--type-not'
-    ]));
-    const explicitPattern = tokens.some((token) => token === '-e' || token === '--regexp');
-    const fileMode = tokens.includes('--files');
-    return [...optionPaths, ...(explicitPattern || fileMode ? values : values.slice(1))];
-  }
-  if (name === 'sed') {
-    const values = positional(tokens, new Set(['-e', '--expression', '-f', '--file']));
-    const explicitScript = tokens.some((token) => (
-      ['-e', '--expression', '-f', '--file'].includes(token)
-    ));
-    return [...optionPaths, ...(explicitScript ? values : values.slice(1))];
-  }
-  if (name === 'find') return findRoots(tokens);
-  if (['cat', 'head', 'tail', 'ls', 'wc', 'du', 'tree', 'file', 'stat', 'cd', 'pushd', 'source', '.'].includes(name)) {
-    return positional(tokens, new Set(['-n', '--lines', '-c', '--bytes']));
-  }
-  return tokens.filter((token) => (
-    /^(?:\.{0,2}[\\/]|~[\\/])/.test(token)
-    || (token.includes('/') && blockedSegment(token))
-  ));
-}
-
-function inspectInput(input) {
-  const paths = [];
-  const globs = [];
-  collectStructured(input, '', paths, globs);
-  const command = typeof input?.command === 'string'
-    ? input.command
-    : typeof input?.cmd === 'string' ? input.cmd : '';
-  for (const group of commandGroups(command)) {
-    paths.push(...commandPaths(group, globs));
-  }
-  return {
-    broadGlob: globs.find(isBroadGlob),
-    blockedPath: paths.map((requested) => ({
-      requested,
-      blocked: blockedSegment(requested)
-    })).find((result) => result.blocked)
-  };
-}
-
-module.exports = {
-  BLOCKED_DIRS,
-  inspectInput
-};
+module.exports = require('../../../claude/hooks/lib/inspect-paths.cjs');

package/src/codex/hooks/lib/plugin-options.cjs

@@ -0,0 +1,2 @@
+'use strict';
+module.exports = require('../../../claude/hooks/lib/plugin-options.cjs');

package/src/codex/hooks/lib/privacy-paths.cjs

@@ -0,0 +1 @@
+module.exports = require('../../../claude/hooks/lib/privacy-paths.cjs');

package/src/codex/hooks/lib/privacy-state.cjs

@@ -4,6 +4,8 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const PATH_SAFETY = require('./runtime-path-safety.cjs');
+const { displayNames } = require('./privacy-paths.cjs');
+const { pluginRoot, pluginProjectDir } = require('./hook-context.cjs');
 
 // Codex cannot raise an interactive prompt from a hook -- PreToolUse honours no
 // "ask" decision -- so approval costs a full round trip: the agent has to relay
@@ -15,7 +17,18 @@ const APPROVAL_PREFIX = 'APPROVE CAFEKIT PRIVACY ';
 function stateDir(projectRoot) {
   return path.join(projectRoot, '.codex', 'hooks', '.privacy');
 }
+// Under the plugin, approvals live in the plugin state root, one directory per
+// repository; pluginProjectDir throws for an unsafe root so callers fail closed.
+function pluginStateDir(projectRoot, create) {
+  const dir = pluginProjectDir(PATH_SAFETY.canonicalDirectory(projectRoot, 'privacy project root'), 'privacy');
+  if (create) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  else if (!fs.existsSync(dir)) return null;
+  const stat = fs.lstatSync(dir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('privacy state must be a regular directory');
+  return dir;
+}
 function secureStateDir(projectRoot, create = false) {
+  if (pluginRoot()) return pluginStateDir(projectRoot, create);
   const root = PATH_SAFETY.canonicalDirectory(projectRoot, 'privacy project root');
   const hooks = path.join(root, '.codex', 'hooks');
   try { PATH_SAFETY.assertComponentPath(root, hooks); }
@@ -24,7 +37,12 @@ function secureStateDir(projectRoot, create = false) {
     throw error;
   }
   const dir = path.join(hooks, '.privacy');
-  if (create && !fs.existsSync(dir)) fs.mkdirSync(dir, { mode: 0o700 });
+  if (create && !fs.existsSync(dir)) {
+    // A parallel hook can create the directory between the check and the mkdir;
+    // the component and directory checks below still reject anything but a real directory.
+    try { fs.mkdirSync(dir, { mode: 0o700 }); }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+  }
   try { PATH_SAFETY.assertComponentPath(root, dir); }
   catch (error) {
     if (!create && error.code === 'ENOENT') return null;
@@ -61,13 +79,6 @@ function samePathKeys(left, right) {
     && left.every((value, index) => value === right[index]);
 }
 
-function displayNames(filePaths) {
-  const names = [...new Set(filePaths.map((filePath) => path.basename(filePath)))].sort();
-  return names.length <= 3
-    ? names.join(', ')
-    : `${names.slice(0, 3).join(', ')} (+${names.length - 3} more)`;
-}
-
 function atomicWrite(dir, file, payload) {
   PATH_SAFETY.assertComponentPath(dir, path.dirname(file));
   const temp = `${file}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
@@ -84,14 +95,81 @@ function readJson(dir, file) {
   }
 }
 
+function validPending(record, sessionId, requestId, now = Date.now()) {
+  return record?.requestId === requestId && record.sessionId === sessionId
+    && Number.isFinite(record.expiresAt) && record.expiresAt > now
+    && typeof record.displayName === 'string' && record.displayName.length > 0
+    && Array.isArray(record.pathKeys) && record.pathKeys.length > 0
+    && record.pathKeys.every(key => typeof key === 'string' && /^[a-f0-9]{64}$/.test(key));
+}
+
+function writeShortMarker(dir, record) {
+  const { requestId, sessionId, expiresAt } = record;
+  fs.writeFileSync(path.join(dir, `short-${hash(sessionId)}-${requestId}.json`),
+    `${JSON.stringify({ requestId, sessionId, expiresAt })}\n`,
+    { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+}
+
+/** Each prompt owns only markers it successfully renamed, never a shared mutable flag. */
+function claimShortMarkers(projectRoot, sessionId) {
+  const requestIds = [];
+  if (typeof sessionId !== 'string' || !sessionId.trim()) return { ok: true, requestIds };
+  const dir = secureStateDir(projectRoot);
+  if (!dir) return { ok: true, requestIds };
+  const prefix = `short-${hash(sessionId)}-`;
+  let ok = true;
+  for (const name of fs.readdirSync(dir)) {
+    if (!name.startsWith(prefix) || !name.endsWith('.json')) continue;
+    const file = path.join(dir, name);
+    const claimed = path.join(dir, `claim-${crypto.randomBytes(12).toString('hex')}.tmp`);
+    const requestId = name.slice(prefix.length, -'.json'.length);
+    let moved = false;
+    try {
+      PATH_SAFETY.assertComponentPath(dir, file);
+      fs.renameSync(file, claimed);
+      moved = true;
+      requestIds.push(requestId);
+      PATH_SAFETY.assertComponentPath(dir, claimed);
+      const marker = JSON.parse(fs.readFileSync(claimed, 'utf8'));
+      if (!/^[a-f0-9]{24}$/.test(requestId) || marker.requestId !== requestId
+        || marker.sessionId !== sessionId || !Number.isFinite(marker.expiresAt)
+        || marker.expiresAt <= Date.now()) throw new Error('Invalid short approval marker');
+    } catch {
+      ok = false;
+      if (!moved) {
+        // A failed claim cancels the shortcut; deletion never counts as ownership.
+        try { fs.unlinkSync(file); }
+        catch {
+          let descriptor;
+          try {
+            PATH_SAFETY.canonicalRegularFile(dir, file, 'short approval marker');
+            descriptor = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW);
+            fs.ftruncateSync(descriptor, 0);
+          } catch { /* no permission follows a failed invalidation */ }
+          finally {
+            if (descriptor !== undefined) {
+              try { fs.closeSync(descriptor); } catch { /* already rejected */ }
+            }
+          }
+        }
+      }
+    } finally {
+      if (moved) {
+        try { fs.unlinkSync(claimed); } catch { ok = false; }
+      }
+    }
+  }
+  return { ok, requestIds };
+}
+
 function cleanup(projectRoot, now = Date.now()) {
   const dir = secureStateDir(projectRoot);
   if (!dir) return;
   for (const name of fs.readdirSync(dir)) {
-    if (!/^(pending|token)-[a-f0-9]+\.json$/.test(name)) continue;
+    if (!/^(?:(?:pending|token)-[a-f0-9]+|short-[a-f0-9]{64}-[a-f0-9]{24})\.json$/.test(name)) continue;
     const file = path.join(dir, name);
     const record = readJson(dir, file);
-    if (!record || Number(record.expiresAt) <= now) {
+    if (!record || !Number.isFinite(record.expiresAt) || record.expiresAt <= now) {
       try {
         fs.unlinkSync(file);
       } catch {
@@ -101,13 +179,20 @@ function cleanup(projectRoot, now = Date.now()) {
   }
 }
 
-function clearState(projectRoot) {
+function clearState(projectRoot, sessionId) {
   try {
+    if (typeof sessionId !== 'string' || !sessionId.trim()) return;
     const dir = secureStateDir(projectRoot);
     if (!dir) return;
     for (const name of fs.readdirSync(dir)) {
+      if (name.startsWith(`short-${hash(sessionId)}-`) && name.endsWith('.json')) {
+        try { fs.unlinkSync(path.join(dir, name)); } catch { /* concurrently claimed */ }
+        continue;
+      }
       if (/^(pending|token)-[a-f0-9]+\.json$/.test(name)) {
-        try { fs.unlinkSync(path.join(dir, name)); } catch { /* concurrently consumed */ }
+        const file = path.join(dir, name);
+        if (readJson(dir, file)?.sessionId !== sessionId) continue;
+        try { fs.unlinkSync(file); } catch { /* concurrently consumed */ }
       }
     }
   } catch {
@@ -123,26 +208,38 @@ function createPending({
   filePath
 }) {
   cleanup(projectRoot);
-  if (!sessionId) throw new Error('A Codex session ID is required');
+  if (typeof sessionId !== 'string' || !sessionId.trim()) throw new Error('A Codex session ID is required');
   const paths = requestPaths(filePaths, filePath);
   if (paths.length === 0) throw new Error('At least one sensitive path is required');
+  const pathKeys = requestPathKeys(paths, sessionCwd);
+  const dir = secureStateDir(projectRoot, true);
+  for (const name of fs.readdirSync(dir)) {
+    const match = name.match(/^pending-([a-f0-9]{24})\.json$/);
+    if (!match) continue;
+    const pending = readJson(dir, path.join(dir, name));
+    if (validPending(pending, sessionId, match[1]) && samePathKeys(pending.pathKeys, pathKeys)) {
+      try { writeShortMarker(dir, pending); }
+      catch (error) { if (error.code !== 'EEXIST') throw error; }
+      return pending;
+    }
+  }
   const requestId = crypto.randomBytes(12).toString('hex');
   const record = {
     version: 2,
     requestId,
     sessionId: String(sessionId || ''),
-    pathKeys: requestPathKeys(paths, sessionCwd),
+    pathKeys,
     displayName: displayNames(paths),
     expiresAt: Date.now() + TTL_MS
   };
-  const dir = secureStateDir(projectRoot, true);
   atomicWrite(dir, path.join(dir, `pending-${requestId}.json`), record);
+  writeShortMarker(dir, record);
   return record;
 }
 
 function approvePending({ projectRoot, sessionId, requestId }) {
   cleanup(projectRoot);
-  if (!sessionId) return { ok: false, reason: 'session' };
+  if (typeof sessionId !== 'string' || !sessionId.trim()) return { ok: false, reason: 'session' };
   if (!/^[a-f0-9]{24}$/.test(requestId)) return { ok: false, reason: 'invalid' };
 
   const dir = secureStateDir(projectRoot);
@@ -152,6 +249,7 @@ function approvePending({ projectRoot, sessionId, requestId }) {
   if (!record) return { ok: false, reason: 'missing' };
   if (record.sessionId !== String(sessionId || '')) return { ok: false, reason: 'session' };
   if (Number(record.expiresAt) <= Date.now()) return { ok: false, reason: 'expired' };
+  if (!validPending(record, sessionId, requestId)) return { ok: false, reason: 'invalid' };
 
   try {
     fs.unlinkSync(pendingFile);
@@ -218,5 +316,6 @@ module.exports = {
   approvePending,
   hasGrant,
   cleanup,
-  clearState
+  clearState,
+  claimShortMarkers
 };

package/src/codex/hooks/lib/rules-reservation.cjs

@@ -0,0 +1,38 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { hookStateDir } = require('./hook-context.cjs');
+
+function reservationFile(projectRoot, sessionId) {
+  const key = crypto.createHash('sha256')
+    .update(String(sessionId || 'unknown'))
+    .digest('hex')
+    .slice(0, 16);
+  return path.join(hookStateDir(projectRoot), `rules-${key}.json`);
+}
+
+/** Reserve one injection slot per session. Returns null on reservation errors. */
+function reserveSession(projectRoot, sessionId) {
+  if (!sessionId) return null;
+  try {
+    const file = reservationFile(projectRoot, sessionId);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ sessionId: String(sessionId) }), {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600
+    });
+    return true;
+  } catch (error) {
+    return error.code === 'EEXIST' ? false : null;
+  }
+}
+
+function clearSessionReservation(projectRoot, sessionId) {
+  if (!sessionId) return;
+  try { fs.rmSync(reservationFile(projectRoot, sessionId), { force: true }); } catch { /* fail-open */ }
+}
+
+module.exports = { reserveSession, clearSessionReservation };

package/src/codex/hooks/lib/secret-keywords.cjs

@@ -0,0 +1 @@
+module.exports = require('../../../claude/hooks/lib/secret-keywords.cjs');