@hasna/hooks 0.10.5 → 0.10.6

package/README.md

@@ -92,6 +92,36 @@ Repair unsafe installation permissions with a verified package installer, then
 check again. This check alone does not prove hosted authentication, native hook
 trust or a running agent's interception.
 
+## Codex safety readiness
+
+```bash
+hooks safety verify --target codex --cwd /path/to/project --codex-command /absolute/path/to/native/codex
+```
+
+This bounded, read-only check starts its own fresh Codex app-server and asks the
+native consumer for the selected project's hook definitions and feature state.
+It requires exactly one enabled, trusted, synchronous bundled Trash guard, checks
+its installed supervisor by classifying data, and verifies that the native
+definition stayed unchanged. It returns compact JSON and a nonzero exit on
+missing, disabled, untrusted, changed or unsafe state. No deletion is executed.
+
+The command accepts a native Linux ELF or macOS Mach-O executable for the host
+architecture (arm64 or x64); script launchers are refused before execution. When
+Codex is installed through npm, pass the platform package's native binary rather
+than its JavaScript launcher. Executable ownership, permissions, ancestry and
+bytes are checked. Supported protocol versions are 0.153.0, 0.154.0, 0.155.0,
+0.155.1 and 0.156.1; other versions refuse pending compatibility validation.
+The version probe has a five-second forced timeout and native discovery a
+fifteen-second lifetime budget. Neither step restarts an existing agent.
+
+Success reports `nativeDiscoveryVerified: true`, `guardVerified: true` and
+`nativeAdoptionVerified: false`. It does not enroll trust, change configuration,
+authenticate Trash, verify MCP or Instructions, or prove interception by an
+already-running session. Complete those separate setup checks and a fresh native
+interception proof before declaring station support. Use this small readiness
+check after installation, meaningful upgrades and during fresh-agent startup;
+never substitute repeated deletion smoke tests for a startup check.
+
 ## Optional Mementos prompt context
 
 `hooks install mementos-context --target codex` registers a native prompt hook.

package/bin/index.js

@@ -37388,7 +37388,7 @@ var init_redact = __esm(() => {
 });
 
 // src/lib/profiles.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync10, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
 import { join as join19 } from "path";
 function getProfilesDir() {
   const newDir = join19(getEffectiveDataRoot(), "profiles");
@@ -37434,7 +37434,7 @@ function getProfile(id) {
   try {
     if (!existsSync15(path))
       return null;
-    return JSON.parse(readFileSync14(path, "utf-8"));
+    return JSON.parse(readFileSync15(path, "utf-8"));
   } catch {
     return null;
   }
@@ -37448,7 +37448,7 @@ function listProfiles() {
     const profiles = [];
     for (const file2 of files) {
       try {
-        const content = readFileSync14(join19(dir, file2), "utf-8");
+        const content = readFileSync15(join19(dir, file2), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -37498,12 +37498,12 @@ import { spawnSync as spawnSync2 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute17, join as join22 } from "path";
+import { isAbsolute as isAbsolute18, join as join22 } from "path";
 import { createRequire as createRequire3 } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
-import { closeSync as closeSync6, fstatSync as fstatSync5, lstatSync as lstatSync10, openSync as openSync6, readFileSync as readFileSync15, realpathSync as realpathSync9, statSync as statSync2 } from "fs";
+import { closeSync as closeSync7, fstatSync as fstatSync6, lstatSync as lstatSync15, openSync as openSync7, readFileSync as readFileSync17, realpathSync as realpathSync10, statSync as statSync2 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename5, dirname as dirname19, join as join20, relative, sep as sep3 } from "path";
+import { basename as basename5, dirname as dirname20, join as join20, relative, sep as sep3 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -37577,16 +37577,16 @@ function o(e2, r2, t2) {
   }
 }
 function entryPoint(directory2) {
-  const root = realpathSync9(directory2);
-  const fd = openSync6(join20(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const root = realpathSync10(directory2);
+  const fd = openSync7(join20(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
-    const stat2 = fstatSync5(fd);
+    const stat2 = fstatSync6(fd);
     if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES3)
       throw new Error("Invalid Secrets package metadata");
-    pkg = JSON.parse(readFileSync15(fd, "utf8"));
+    pkg = JSON.parse(readFileSync17(fd, "utf8"));
   } finally {
-    closeSync6(fd);
+    closeSync7(fd);
   }
   if (!pkg || typeof pkg !== "object" || !("name" in pkg) || pkg.name !== PACKAGE) {
     throw new Error("Invalid Secrets package identity");
@@ -37598,7 +37598,7 @@ function entryPoint(directory2) {
   if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
     throw new Error("Invalid Secrets import export");
   }
-  const file2 = realpathSync9(join20(root, ...parts));
+  const file2 = realpathSync10(join20(root, ...parts));
   const within = relative(root, file2);
   if (!within || within === ".." || within.startsWith(`..${sep3}`) || !statSync2(file2).isFile()) {
     throw new Error("Secrets import export escapes its package or is not a file");
@@ -37606,13 +37606,13 @@ function entryPoint(directory2) {
   return pathToFileURL(file2).href;
 }
 function resolveInstalledSecrets(parentUrl) {
-  let directory2 = dirname19(fileURLToPath3(parentUrl));
+  let directory2 = dirname20(fileURLToPath3(parentUrl));
   for (;; ) {
     if (basename5(directory2) !== "node_modules") {
       const candidate = join20(directory2, "node_modules", PACKAGE);
       let absent = false;
       try {
-        lstatSync10(candidate);
+        lstatSync15(candidate);
       } catch (error61) {
         if (error61.code !== "ENOENT")
           throw error61;
@@ -37621,7 +37621,7 @@ function resolveInstalledSecrets(parentUrl) {
       if (!absent)
         return entryPoint(candidate);
     }
-    const parent = dirname19(directory2);
+    const parent = dirname20(directory2);
     if (parent === directory2)
       throw new Error("Secrets SDK is not installed for this consumer");
     directory2 = parent;
@@ -37633,7 +37633,7 @@ function homeDir(env) {
 }
 function absoluteOverride(env, key) {
   const value = env[key]?.trim();
-  return value && isAbsolute17(value) ? value : null;
+  return value && isAbsolute18(value) ? value : null;
 }
 function hasnaHomeDir(env) {
   const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
@@ -38740,8 +38740,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname20, isAbsolute as isAbsolute18 } from "path";
-import { existsSync as existsSync16, realpathSync as realpathSync10, statSync as statSync4 } from "fs";
+import { dirname as dirname21, isAbsolute as isAbsolute19 } from "path";
+import { existsSync as existsSync16, realpathSync as realpathSync11, statSync as statSync4 } from "fs";
 import { tmpdir } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
@@ -38760,7 +38760,7 @@ function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute18(entry))
+  if (entry === "" || !isAbsolute19(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -38770,7 +38770,7 @@ function isUnsafePathEntry(entry, home) {
     return true;
   const canonical4 = (path) => {
     try {
-      return realpathSync10(path);
+      return realpathSync11(path);
     } catch {
       return path;
     }
@@ -38791,7 +38791,7 @@ function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
   if (process.platform === "darwin" && existsSync16("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname20(process.execPath);
+  const bunDir = dirname21(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -38916,7 +38916,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync11 } from "fs";
-import { basename as basename9, dirname as dirname21, isAbsolute as isAbsolute19, join as join24 } from "path";
+import { basename as basename9, dirname as dirname22, isAbsolute as isAbsolute20, join as join24 } from "path";
 function extensionOf(scriptPath) {
   const base = basename9(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -38985,7 +38985,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname21(options.scriptPath);
+  const scriptDir = dirname22(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
   const tempPath = join24(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
@@ -38996,7 +38996,7 @@ async function executeVerifiedScript(options) {
   }, options.timeout) : null;
   try {
     writeFileSync11(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute19(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    proc = Bun.spawn([...interpreter.command, isAbsolute20(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -39078,7 +39078,7 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync17, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync19, rmSync as rmSync4 } from "fs";
 import { join as join27 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function manifestAt(dir) {
@@ -39086,7 +39086,7 @@ function manifestAt(dir) {
   if (!existsSync17(path))
     return;
   try {
-    return parseManifest(readFileSync17(path, "utf-8"));
+    return parseManifest(readFileSync19(path, "utf-8"));
   } catch {
     return;
   }
@@ -39147,7 +39147,7 @@ async function installCustomSource(source) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync17(source, "utf-8"));
+    const manifest = parseManifest(readFileSync19(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -39196,13 +39196,13 @@ __export(exports_sync, {
   fetchPinnedHook: () => fetchPinnedHook,
   commitSyncArtifacts: () => commitSyncArtifacts
 });
-import { createHash as createHash12 } from "crypto";
-import { readFileSync as readFileSync19 } from "fs";
+import { createHash as createHash17 } from "crypto";
+import { readFileSync as readFileSync20 } from "fs";
 function sha256OfText(text3) {
-  return createHash12("sha256").update(text3).digest("hex");
+  return createHash17("sha256").update(text3).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash12("sha256").update(readFileSync19(path)).digest("hex");
+  return createHash17("sha256").update(readFileSync20(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -40357,13 +40357,13 @@ __export(exports_serve, {
   SERVE_HOST: () => SERVE_HOST,
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
-import { readFileSync as readFileSync20 } from "fs";
-import { dirname as dirname22, join as join29 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname23, join as join29 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join29(dirname22(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync20(pkgPath, "utf-8")).version || "0.0.0";
+    const pkgPath = join29(dirname23(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync21(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -40663,8 +40663,8 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z3 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync18, readFileSync as readFileSync21 } from "fs";
-import { join as join30, dirname as dirname23 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync23 } from "fs";
+import { join as join30, dirname as dirname24 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
@@ -40673,7 +40673,7 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
   if (!resolved || !hookScript || !existsSync18(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
-  const content = readFileSync21(hookScript);
+  const content = readFileSync23(hookScript);
   const sha4 = sha256Of(content);
   const check2 = checkScriptHash(name, sha4);
   if (!check2.ok) {
@@ -40905,7 +40905,7 @@ function createHooksServer() {
       }
       if (meta3 && settingsExist) {
         try {
-          const settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
           if (!hookRegisteredInSettings(settings, name, meta3.event, meta3.matcher)) {
             const eventName = meta3.event.split(":")[0];
             issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -40945,7 +40945,7 @@ function createHooksServer() {
       const readmePath = join30(hookPath, "README.md");
       let readme = "";
       if (existsSync18(readmePath)) {
-        readme = readFileSync21(readmePath, "utf-8");
+        readme = readFileSync23(readmePath, "utf-8");
       }
       if (verbose) {
         return { content: [{ type: "text", text: JSON.stringify({ ...meta3, readme }) }] };
@@ -41275,7 +41275,7 @@ function createHooksServer() {
     let settings = {};
     try {
       if (existsSync18(settingsPath))
-        settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
       settings.hooks = {};
@@ -41298,7 +41298,7 @@ function createHooksServer() {
     let settings = {};
     try {
       if (existsSync18(settingsPath))
-        settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
       settings.hooks.__disabled = settings.hooks.__disabled.filter((n2) => n2 !== name);
@@ -41668,13 +41668,13 @@ var init_server = __esm(() => {
   init_redact();
   init_authority();
   init_storage();
-  __dirname3 = dirname23(fileURLToPath5(import.meta.url));
+  __dirname3 = dirname24(fileURLToPath5(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
       const p = join30(__dirname3, rel);
       if (existsSync18(p)) {
-        pkg = JSON.parse(readFileSync21(p, "utf-8"));
+        pkg = JSON.parse(readFileSync23(p, "utf-8"));
         break;
       }
     }
@@ -43416,8 +43416,8 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync19, readFileSync as readFileSync23, rmSync as rmSync6 } from "fs";
-import { join as join31, dirname as dirname24 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync25, rmSync as rmSync6 } from "fs";
+import { join as join31, dirname as dirname25 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
@@ -45023,6 +45023,268 @@ function inspectTrashBinary(env = process.env) {
   return { ok: false, code: failure };
 }
 
+// src/lib/codex-safety-check.ts
+init_native_safety();
+import { spawn as spawn2, execFile as execFile2 } from "child_process";
+import { createHash as createHash12 } from "crypto";
+import { constants as constants12, openSync as openSync6, closeSync as closeSync6, fstatSync as fstatSync5, lstatSync as lstatSync10, readFileSync as readFileSync14, realpathSync as realpathSync9 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname19, isAbsolute as isAbsolute17 } from "path";
+import { promisify } from "util";
+var versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"]);
+var matcher = "^(Bash|apply_patch|ApplyPatch|functions\\.apply_patch)$";
+
+class CodexSafetyError extends Error {
+  code;
+  constructor(code2) {
+    super(`Codex deletion safety check failed (${code2}).`);
+    this.code = code2;
+    this.name = "CodexSafetyError";
+  }
+}
+function need5(condition, code2) {
+  if (!condition)
+    throw new CodexSafetyError(code2);
+}
+var digest3 = (bytes) => createHash12("sha256").update(bytes).digest("hex");
+function nativeHeader(bytes) {
+  if (bytes.length < 64 || !["arm64", "x64"].includes(process.arch))
+    return false;
+  if (process.platform === "darwin") {
+    const cpu = process.arch === "arm64" ? 16777228 : 16777223;
+    return bytes.readUInt32LE(0) === 4277009103 && bytes.readUInt32LE(4) === cpu && bytes.readUInt32LE(12) === 2 && bytes.readUInt32LE(16) > 0 && bytes.readUInt32LE(16) <= 4096 && bytes.readUInt32LE(20) > 0 && bytes.readUInt32LE(20) <= bytes.length - 32;
+  }
+  if (process.platform === "linux") {
+    const offset = bytes.readBigUInt64LE(32), count = bytes.readUInt16LE(56);
+    return bytes.subarray(0, 7).equals(Buffer.from([127, 69, 76, 70, 2, 1, 1])) && [2, 3].includes(bytes.readUInt16LE(16)) && bytes.readUInt16LE(18) === (process.arch === "arm64" ? 183 : 62) && bytes.readUInt32LE(20) === 1 && bytes.readUInt16LE(52) === 64 && bytes.readUInt16LE(54) === 56 && count > 0 && count <= 1024 && offset >= 64n && offset + BigInt(count * 56) <= BigInt(bytes.length);
+  }
+  return false;
+}
+function executable(command) {
+  const found = isAbsolute17(command) ? command : Bun.which(command);
+  need5(found, "native_unavailable");
+  try {
+    const path = realpathSync9(found);
+    for (let parent = dirname19(path);; parent = dirname19(parent)) {
+      const stat2 = lstatSync10(parent);
+      need5(stat2.isDirectory() && [0, process.getuid?.()].includes(stat2.uid) && !(stat2.mode & 18), "native_unsafe_executable");
+      if (parent === dirname19(parent))
+        break;
+    }
+    const fd = openSync6(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
+    try {
+      const stat2 = fstatSync5(fd);
+      need5(stat2.isFile() && [0, process.getuid?.()].includes(stat2.uid) && !(stat2.mode & 18) && !!(stat2.mode & 64) && stat2.size <= 256000000, "native_unsafe_executable");
+      const bytes = readFileSync14(fd);
+      need5(bytes.length <= 256000000, "native_unavailable");
+      need5(nativeHeader(bytes), "native_executable_required");
+      return { path, sha256: digest3(bytes) };
+    } finally {
+      closeSync6(fd);
+    }
+  } catch (error61) {
+    if (error61 instanceof CodexSafetyError)
+      throw error61;
+    throw new CodexSafetyError("native_unavailable");
+  }
+}
+async function connectCodexSafety(options) {
+  const command = options.command ?? "codex", before = executable(command);
+  const env = { ...process.env, HOME: options.home, NO_COLOR: "1" };
+  for (const key of ["NODE_OPTIONS", "NODE_PATH", "BUN_OPTIONS", "BASH_ENV", "ENV", "DYLD_INSERT_LIBRARIES", "LD_PRELOAD"])
+    delete env[key];
+  if (options.codexHome === undefined)
+    delete env.CODEX_HOME;
+  else
+    env.CODEX_HOME = options.codexHome;
+  let version2;
+  try {
+    version2 = (await promisify(execFile2)(before.path, ["--version"], { env, cwd: options.home, timeout: 5000, killSignal: "SIGKILL", maxBuffer: 4096 })).stdout.trim();
+  } catch {
+    throw new CodexSafetyError("native_unavailable");
+  }
+  need5(versions.has(version2), "native_unsupported");
+  need5(JSON.stringify(executable(command)) === JSON.stringify(before), "guard_changed");
+  const child = spawn2(before.path, ["app-server", "--strict-config", "--stdio"], { env, cwd: options.home, stdio: ["pipe", "pipe", "pipe"] });
+  let stopped = false, buffer = Buffer.alloc(0), total = 0, nextId = 1;
+  const pending = new Map;
+  const fail2 = () => {
+    stopped = true;
+    for (const waiter of pending.values())
+      waiter.reject(new CodexSafetyError("native_failed"));
+    pending.clear();
+  };
+  const deadline = setTimeout(() => {
+    fail2();
+    child.kill("SIGKILL");
+  }, 15000);
+  const exited = new Promise((done) => {
+    child.once("exit", () => {
+      fail2();
+      clearTimeout(deadline);
+      done();
+    });
+    child.once("error", () => {
+      fail2();
+      clearTimeout(deadline);
+      done();
+    });
+  });
+  child.stdin.on("error", fail2);
+  const account = (length) => {
+    total += length;
+    if (total > 8388608) {
+      fail2();
+      child.kill("SIGKILL");
+      return false;
+    }
+    return true;
+  };
+  child.stderr.on("data", (bytes) => {
+    account(bytes.length);
+  });
+  child.stdout.on("data", (bytes) => {
+    if (stopped || !account(bytes.length))
+      return;
+    buffer = Buffer.concat([buffer, bytes]);
+    for (;; ) {
+      const end = buffer.indexOf(10);
+      if (end < 0)
+        return;
+      const line = buffer.subarray(0, end);
+      buffer = buffer.subarray(end + 1);
+      try {
+        const value = JSON.parse(line.toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+          throw Error();
+        if (!Object.hasOwn(value, "id"))
+          continue;
+        const waiter = pending.get(value.id);
+        if (!waiter)
+          throw Error();
+        pending.delete(value.id);
+        if (value.error || !Object.hasOwn(value, "result"))
+          waiter.reject(new CodexSafetyError("native_failed"));
+        else
+          waiter.resolve(value.result);
+      } catch {
+        fail2();
+        child.kill("SIGKILL");
+        return;
+      }
+    }
+  });
+  const request = (method, params) => new Promise((accept, reject) => {
+    if (stopped) {
+      reject(new CodexSafetyError("native_failed"));
+      return;
+    }
+    const id = nextId++;
+    pending.set(id, { resolve: accept, reject });
+    child.stdin.write(JSON.stringify({ id, method, params }) + `
+`);
+  });
+  const rpc = {
+    version: version2,
+    request,
+    async close() {
+      fail2();
+      child.stdin.end();
+      const force = setTimeout(() => child.kill("SIGKILL"), 1000);
+      await exited;
+      clearTimeout(force);
+      clearTimeout(deadline);
+      need5(JSON.stringify(executable(command)) === JSON.stringify(before), "guard_changed");
+    }
+  };
+  try {
+    await request("initialize", { clientInfo: { name: "hooks-safety-check", version: "1" }, capabilities: { experimentalApi: true } });
+    child.stdin.write(`{"method":"initialized"}
+`);
+    return rpc;
+  } catch {
+    await rpc.close();
+    throw new CodexSafetyError("native_failed");
+  }
+}
+function selectCodexSafety(discovery, configuration, home, cwd, featureEnabled) {
+  const data = discovery?.data;
+  need5(Array.isArray(data) && data.length === 1 && data[0]?.cwd === cwd && Array.isArray(data[0]?.hooks) && data[0].hooks.length <= 1e4 && Array.isArray(data[0].errors) && data[0].errors.length === 0 && Array.isArray(data[0].warnings) && data[0].warnings.length === 0, "native_discovery_failed");
+  const config2 = configuration?.config;
+  need5(config2 && typeof config2 === "object" && !Array.isArray(config2), "native_discovery_failed");
+  need5((config2.features?.hooks ?? featureEnabled) === true, "hooks_disabled");
+  for (const hook2 of data[0].hooks)
+    if (typeof hook2?.command === "string") {
+      if (/\bhasna-native-safety-v\d+\b/.test(hook2.command))
+        need5(nativeSafetyCommandBinding(hook2.command), "guard_definition_invalid");
+      need5(!/^(?:hooks run trash-guard|hook-trash-guard)(?:\s|$)/.test(hook2.command.trim()), "guard_definition_invalid");
+    }
+  const selected = data[0].hooks.filter((hook2) => typeof hook2?.command === "string" && nativeSafetyCommandBinding(hook2.command)?.name === "trash-guard");
+  need5(selected.length !== 0, "guard_missing");
+  need5(selected.length === 1, "guard_ambiguous");
+  const hook = selected[0], binding = nativeSafetyCommandBinding(hook.command);
+  need5(binding.home === home && hook.eventName === "preToolUse" && hook.handlerType === "command" && hook.matcher === matcher && hook.timeoutSec === 10 && hook.async === false && hook.statusMessage === null && hook.additionalContextLimit === null && typeof hook.key === "string" && hook.key.length <= 4096 && typeof hook.sourcePath === "string" && isAbsolute17(hook.sourcePath) && hook.pluginId === null && hook.isManaged === false && ["user", "project"].includes(hook.source) && typeof hook.currentHash === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash), "guard_definition_invalid");
+  need5(hook.enabled === true, "guard_disabled");
+  need5(hook.trustStatus === "trusted", "guard_untrusted");
+  return { key: hook.key, command: hook.command, currentHash: hook.currentHash, sourcePath: hook.sourcePath, enabled: true, trustStatus: "trusted" };
+}
+async function verifyCodexNativeSafety(options = {}, dependencies = {}) {
+  const home = realpathSync9(options.home ?? homedir8()), cwd = realpathSync9(options.cwd ?? process.cwd());
+  need5(isAbsolute17(home) && isAbsolute17(cwd), "native_unavailable");
+  const rpc = await (dependencies.connect ?? connectCodexSafety)({ ...options, home });
+  try {
+    need5(versions.has(rpc.version), "native_unsupported");
+    const inspect = async () => {
+      const hooks = await rpc.request("hooks/list", { cwds: [cwd] });
+      const configuration = await rpc.request("config/read", { cwd, includeLayers: false });
+      let enabled;
+      if (configuration?.config?.features?.hooks === undefined) {
+        let cursor = null, count = 0;
+        const seen = new Set;
+        do {
+          const page3 = await rpc.request("experimentalFeature/list", { cursor, limit: 100 });
+          need5(Array.isArray(page3?.data) && page3.data.length <= 100 && (page3.nextCursor === null || typeof page3.nextCursor === "string"), "native_discovery_failed");
+          count += page3.data.length;
+          need5(count <= 1000, "native_discovery_failed");
+          for (const feature of page3.data)
+            if (feature?.name === "hooks") {
+              need5(enabled === undefined && typeof feature.enabled === "boolean", "native_discovery_failed");
+              enabled = feature.enabled;
+            }
+          cursor = page3.nextCursor;
+          if (cursor !== null) {
+            need5(cursor.length > 0 && cursor.length <= 4096 && !seen.has(cursor) && page3.data.length > 0, "native_discovery_failed");
+            seen.add(cursor);
+          }
+        } while (cursor !== null);
+      }
+      return selectCodexSafety(hooks, configuration, home, cwd, enabled);
+    };
+    const before = await inspect();
+    try {
+      await (dependencies.verify ?? verifyNativeSafetyCommand)(before.command, home);
+    } catch {
+      throw new CodexSafetyError("guard_failed");
+    }
+    need5(JSON.stringify(await inspect()) === JSON.stringify(before), "guard_changed");
+    return {
+      ok: true,
+      target: "codex",
+      nativeVersion: rpc.version,
+      cwd,
+      key: before.key,
+      currentHash: before.currentHash,
+      enabled: true,
+      trusted: true,
+      guardVerified: true,
+      nativeDiscoveryVerified: true,
+      nativeAdoptionVerified: false
+    };
+  } finally {
+    await rpc.close();
+  }
+}
+
 // src/cli/index.tsx
 init_registry();
 init_installer();
@@ -45039,9 +45301,9 @@ init_local_opt_in();
 init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname24(fileURLToPath6(import.meta.url));
+var __dirname4 = dirname25(fileURLToPath6(import.meta.url));
 var pkgPath = existsSync19(join31(__dirname4, "..", "package.json")) ? join31(__dirname4, "..", "package.json") : join31(__dirname4, "..", "..", "package.json");
-var pkg2 = JSON.parse(readFileSync23(pkgPath, "utf-8"));
+var pkg2 = JSON.parse(readFileSync25(pkgPath, "utf-8"));
 var program3 = new Command;
 function resolveScope(options) {
   if (options.project)
@@ -45121,7 +45383,7 @@ async function openLocalStoreOrExit(json3) {
 function readToken(tokenFile) {
   if (tokenFile) {
     try {
-      return readFileSync23(tokenFile, "utf-8").trim();
+      return readFileSync25(tokenFile, "utf-8").trim();
     } catch {
       return;
     }
@@ -45135,9 +45397,9 @@ function readmePreview(readme, max = 280) {
   return preview2 ? truncateText2(preview2, max) : undefined;
 }
 function hookSummaryLine(hook, options = {}) {
-  const matcher = hook.matcher ? ` ${hook.matcher}` : "";
+  const matcher2 = hook.matcher ? ` ${hook.matcher}` : "";
   const description = options.verbose ? ` - ${truncateText2(hook.description, 110)}` : "";
-  return `  ${chalk2.cyan(hook.name.padEnd(17))} ${chalk2.dim(`[${hook.event}${matcher}]`)} ${chalk2.dim(hook.category)}${description}`;
+  return `  ${chalk2.cyan(hook.name.padEnd(17))} ${chalk2.dim(`[${hook.event}${matcher2}]`)} ${chalk2.dim(hook.category)}${description}`;
 }
 function listStoreHooks() {
   const out = [];
@@ -45287,7 +45549,7 @@ program3.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
-  const content = readFileSync23(hookScript);
+  const content = readFileSync25(hookScript);
   const sha4 = sha256Of2(content);
   const check2 = checkScriptHash2(hook, sha4);
   if (!check2.ok) {
@@ -45889,7 +46151,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
   let wiringCount = 0;
   if (settingsExist) {
     try {
-      const settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync25(settingsPath, "utf-8"));
       wiringCount = countSettingsWiring(settings);
     } catch {}
   }
@@ -45919,7 +46181,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
     }
     if (meta3 && settingsExist) {
       try {
-        const settings = JSON.parse(readFileSync23(settingsPath, "utf-8"));
+        const settings = JSON.parse(readFileSync25(settingsPath, "utf-8"));
         if (!hookRegisteredInSettings(settings, name, meta3.event, meta3.matcher)) {
           const eventName = meta3.event.split(":")[0];
           issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -46125,7 +46387,7 @@ program3.command("docs").argument("[hook]", "Hook name (shows general docs if om
     const readmePath = join31(hookPath, "README.md");
     let readme = "";
     if (existsSync19(readmePath)) {
-      readme = readFileSync23(readmePath, "utf-8");
+      readme = readFileSync25(readmePath, "utf-8");
     }
     if (options.json) {
       console.log(JSON.stringify({ ...meta3, readme }));
@@ -46795,8 +47057,21 @@ safety.command("install <guard>").option("--target <target>", "codex, claude or
   if (!result.success)
     process.exitCode = 1;
 });
-safety.command("verify").requiredOption("--target <target>", "sumi").option("--execution", "Also require the pinned native execution capability; no file operation is run").description("Verify a required native binding and its supervisor without running a file operation").action(async (options) => {
+safety.command("verify").requiredOption("--target <target>", "sumi or codex").option("--cwd <path>", "Codex project context to inspect (defaults to the current directory)").option("--codex-command <path>", "Installed Codex executable").option("--execution", "Also require the pinned native execution capability; no file operation is run").description("Verify a required native binding and its supervisor without running a file operation").action(async (options) => {
+  if (options.target === "codex") {
+    try {
+      if (options.execution)
+        throw new CodexSafetyError("native_unsupported");
+      console.log(JSON.stringify(await verifyCodexNativeSafety({ command: options.codexCommand, cwd: options.cwd, codexHome: process.env.CODEX_HOME })));
+    } catch (error61) {
+      console.log(JSON.stringify({ ok: false, target: "codex", code: error61 instanceof CodexSafetyError ? error61.code : "native_failed" }));
+      process.exitCode = 1;
+    }
+    return;
+  }
   try {
+    if (options.cwd || options.codexCommand)
+      throw new NativeSafetyError("input_invalid");
     if (options.target !== "sumi")
       throw new NativeSafetyError("input_invalid");
     const current2 = await (options.execution ? verifyNativeSafetyExecutionRegistration() : verifyNativeSafetyRegistration());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/hooks",
-  "version": "0.10.5",
+  "version": "0.10.6",
   "description": "Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command",
   "type": "module",
   "bin": {