@hasna/hooks 0.9.1 → 0.9.3

package/dist/index.js

@@ -4974,21 +4974,21 @@ __export(exports_profiles, {
   deleteProfile: () => deleteProfile,
   createProfile: () => createProfile
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
 import { join as join8 } from "path";
 function getProfilesDir() {
   const newDir = join8(getEffectiveDataRoot(), "profiles");
   const oldDir = join8(getHomeDir(), ".hooks", "profiles");
-  if (!existsSync8(newDir) && existsSync8(oldDir)) {
-    mkdirSync5(newDir, { recursive: true });
+  if (!existsSync9(newDir) && existsSync9(oldDir)) {
+    mkdirSync6(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
   return newDir;
 }
 function ensureProfilesDir() {
   const dir = getProfilesDir();
-  if (!existsSync8(dir)) {
-    mkdirSync5(dir, { recursive: true });
+  if (!existsSync9(dir)) {
+    mkdirSync6(dir, { recursive: true });
   }
 }
 function profilePath(id) {
@@ -5011,30 +5011,30 @@ function createProfile(input) {
   if (input.name) {
     profile.name = input.name;
   }
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
 `);
   return profile;
 }
 function getProfile(id) {
   const path = profilePath(id);
   try {
-    if (!existsSync8(path))
+    if (!existsSync9(path))
       return null;
-    return JSON.parse(readFileSync5(path, "utf-8"));
+    return JSON.parse(readFileSync6(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function listProfiles() {
   const dir = getProfilesDir();
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   try {
     const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync5(join8(dir, file), "utf-8");
+        const content = readFileSync6(join8(dir, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -5051,13 +5051,13 @@ function updateProfile(id, data) {
     profile.name = data.name;
   if (data.preferences !== undefined)
     profile.preferences = data.preferences;
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
 `);
   return profile;
 }
 function deleteProfile(id) {
   const path = profilePath(id);
-  if (!existsSync8(path))
+  if (!existsSync9(path))
     return false;
   try {
     rmSync(path);
@@ -5071,7 +5071,7 @@ function touchProfile(id) {
   if (!profile)
     return;
   profile.last_seen_at = new Date().toISOString();
-  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
+  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
 `);
 }
 function exportProfiles() {
@@ -5087,11 +5087,11 @@ function importProfiles(profiles) {
       continue;
     }
     const path = profilePath(profile.agent_id);
-    if (existsSync8(path)) {
+    if (existsSync9(path)) {
       skipped++;
       continue;
     }
-    writeFileSync4(path, JSON.stringify(profile, null, 2) + `
+    writeFileSync5(path, JSON.stringify(profile, null, 2) + `
 `);
     imported++;
   }
@@ -5104,7 +5104,7 @@ var init_profiles = __esm(() => {
 // ../../node_modules/.bun/@hasna+contracts@1.0.2+e0db24ae03127387/node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
-import { closeSync, fstatSync, openSync, readFileSync as readFileSync6 } from "fs";
+import { closeSync as closeSync2, fstatSync, openSync as openSync2, readFileSync as readFileSync7 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
 import { createRequire } from "module";
 import { hostname as osHostname } from "os";
@@ -5208,7 +5208,7 @@ function readAppConfigFile(path) {
   };
   let fd = -1;
   try {
-    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+    fd = openSync2(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -5229,7 +5229,7 @@ function readAppConfigFile(path) {
       unsafe("the file is not owned by the current user");
     if (before.size > MAX_CREDENTIAL_FILE_BYTES)
       unsafe("the file exceeds the size limit");
-    const bytes = readFileSync6(fd);
+    const bytes = readFileSync7(fd);
     const after = fstatSync(fd);
     if (!configFileReadsCoherent(before, after)) {
       unsafe("the file changed while being read");
@@ -5237,7 +5237,7 @@ function readAppConfigFile(path) {
     return parseEnvFile(bytes.toString("utf8"));
   } finally {
     if (fd !== -1)
-      closeSync(fd);
+      closeSync2(fd);
   }
 }
 function readCredentialFile(path, apiKeyKeys) {
@@ -6013,8 +6013,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname5, isAbsolute as isAbsolute3 } from "path";
-import { existsSync as existsSync10, realpathSync as realpathSync2, statSync } from "fs";
+import { dirname as dirname6, isAbsolute as isAbsolute3 } from "path";
+import { existsSync as existsSync11, realpathSync as realpathSync2, statSync } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
@@ -6062,9 +6062,9 @@ function isUnsafePathEntry(entry, home) {
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync10("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync11("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname5(process.execPath);
+  const bunDir = dirname6(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -6188,8 +6188,8 @@ __export(exports_run, {
   HookTimeoutError: () => HookTimeoutError
 });
 import { randomBytes as randomBytes2 } from "crypto";
-import { rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute4, join as join12 } from "path";
+import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute4, join as join12 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6258,7 +6258,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname6(options.scriptPath);
+  const scriptDir = dirname7(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
   const tempPath = join12(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
@@ -6268,7 +6268,7 @@ async function executeVerifiedScript(options) {
     killGroup(proc, { leaderAlive: proc !== null && proc.exitCode === null });
   }, options.timeout) : null;
   try {
-    writeFileSync5(tempPath, options.content, { flag: "wx", mode: 384 });
+    writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
     proc = Bun.spawn([...interpreter.command, isAbsolute4(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
@@ -7016,6 +7016,17 @@ var HOOKS = [
     matcher: "",
     tags: ["knowledge", "context", "codewith", "deterministic", "session-start", "prompt", "subagent"]
   },
+  {
+    name: "mementos-context",
+    displayName: "Mementos Prompt Context",
+    description: "Retrieves scoped memories for a user prompt, with optional relevance judgments",
+    version: "0.1.0",
+    category: "Context Management",
+    event: "UserPromptSubmit",
+    matcher: "",
+    timeoutSeconds: 12,
+    tags: ["mementos", "memory", "prompt", "codex", "claude", "codewith", "opt-in"]
+  },
   {
     name: "autoformat",
     displayName: "Auto Format",
@@ -7341,8 +7352,8 @@ function getHook(name) {
   return HOOKS.find((h) => h.name === name);
 }
 // src/lib/installer.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, rmdirSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7, dirname as dirname3 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, rmdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7, dirname as dirname4 } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -7434,15 +7445,157 @@ function resolveHook(name) {
 // src/lib/installer.ts
 init_manifest();
 
+// src/lib/mementos-options.ts
+function validateMementosRegistration(name, value) {
+  if (value === undefined)
+    return;
+  if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)) || !Object.hasOwn(value, "enabled") || Object.keys(value).some((key) => key !== "enabled" && key !== "secretRef") || name.replace(/^hook-/, "") !== "mementos-context" || typeof value.enabled !== "boolean") {
+    throw new Error("Mementos options require the mementos-context hook and an explicit enable/disable choice.");
+  }
+  if (value.secretRef !== undefined && (!value.enabled || typeof value.secretRef !== "string" || value.secretRef.length > 256 || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*(?:\/[a-zA-Z0-9][a-zA-Z0-9_.-]*){1,12}$/.test(value.secretRef))) {
+    throw new Error("OpenRouter requires an enabled Mementos hook and a valid Secrets reference, never a key value.");
+  }
+}
+function mementosRegistrationFromFlags(name, flags) {
+  if (!flags.enableMementos && !flags.disableMementos && flags.openrouterSecretRef === undefined)
+    return;
+  if (Boolean(flags.enableMementos) === Boolean(flags.disableMementos)) {
+    throw new Error("Choose exactly one of --enable-mementos or --disable-mementos.");
+  }
+  const value = { enabled: flags.enableMementos === true, ...flags.openrouterSecretRef !== undefined ? { secretRef: flags.openrouterSecretRef } : {} };
+  validateMementosRegistration(name, value);
+  return value;
+}
+function mementosCommandSuffix(value) {
+  validateMementosRegistration("mementos-context", value);
+  if (!value)
+    return "";
+  return value.enabled ? ` --enable-mementos${value.secretRef ? ` --openrouter-secret-ref ${value.secretRef}` : ""}` : " --disable-mementos";
+}
+function retainedMementosRegistration(commands) {
+  const values = commands.filter((command) => /^hooks run mementos-context(?:\s|$)/.test(command)).map((command) => {
+    const args = command.trim().split(/\s+/).slice(3);
+    const flags = {};
+    const seen = new Set;
+    while (args.length) {
+      const key = args.shift();
+      if (seen.has(key))
+        throw new Error("Ambiguous Mementos registration; specify its enablement explicitly.");
+      seen.add(key);
+      if (key === "--profile" && /^[\w-]+$/.test(args[0] ?? ""))
+        args.shift();
+      else if (key === "--enable-mementos")
+        flags.enableMementos = true;
+      else if (key === "--disable-mementos")
+        flags.disableMementos = true;
+      else if (key === "--openrouter-secret-ref" && args.length)
+        flags.openrouterSecretRef = args.shift();
+      else
+        throw new Error("Unrecognized Mementos registration options; specify its enablement explicitly.");
+    }
+    return mementosRegistrationFromFlags("mementos-context", flags);
+  });
+  if (new Set(values.map((value) => JSON.stringify(value))).size > 1) {
+    throw new Error("Conflicting Mementos registrations; specify its enablement explicitly.");
+  }
+  return values[0];
+}
+
 // src/lib/registration.ts
+var REGISTRATION_COMMAND_RE = /^(?:hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?|hook-([\w-]+))$/;
+function registrationName(command) {
+  if (typeof command !== "string")
+    return;
+  if (/^hooks run mementos-context(?:\s|$)/.test(command.trim())) {
+    try {
+      retainedMementosRegistration([command.trim()]);
+      return "mementos-context";
+    } catch {
+      return;
+    }
+  }
+  const match = command.trim().match(REGISTRATION_COMMAND_RE);
+  return match ? match[1] ?? match[2] : undefined;
+}
 function matchersOverlap(a, b) {
   return a === b || a.includes(b) || b.includes(a);
 }
 
 // src/lib/installer.ts
 init_store();
-var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-var HOOKS_DIR = existsSync7(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
+
+// src/lib/codex-settings.ts
+import { closeSync, existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3 } from "path";
+import { randomUUID } from "crypto";
+var snapshots = new WeakMap;
+function current(path) {
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1048576)
+      throw new Error("invalid_file");
+    return readFileSync4(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new Error("Cannot safely read Codex hooks.json; no settings were changed.");
+  }
+}
+function readCodexSettings(path) {
+  const raw = current(path);
+  let settings;
+  try {
+    settings = raw === null ? {} : JSON.parse(raw);
+    if (!settings || typeof settings !== "object" || Array.isArray(settings))
+      throw new Error;
+    if (settings.hooks !== undefined) {
+      if (!settings.hooks || typeof settings.hooks !== "object" || Array.isArray(settings.hooks))
+        throw new Error;
+      for (const entries of Object.values(settings.hooks)) {
+        if (!Array.isArray(entries) || entries.some((entry) => !entry || !Array.isArray(entry.hooks) || entry.hooks.some((hook) => !hook || typeof hook !== "object")))
+          throw new Error;
+      }
+    }
+  } catch {
+    throw new Error("Invalid Codex hooks.json; repair it before installing or removing hooks.");
+  }
+  snapshots.set(settings, { path, raw });
+  return settings;
+}
+function writeCodexSettings(path, settings) {
+  const snapshot = snapshots.get(settings);
+  if (!snapshot || snapshot.path !== path)
+    throw new Error("Codex settings require a complete current read before writing.");
+  mkdirSync4(dirname3(path), { recursive: true });
+  const lock = `${path}.hooks-write.lock`;
+  let fd;
+  try {
+    fd = openSync(lock, "wx", 384);
+  } catch {
+    throw new Error("Codex settings are being edited; retry after the active writer finishes.");
+  }
+  const temp = `${path}.${randomUUID()}.tmp`;
+  try {
+    if (current(path) !== snapshot.raw)
+      throw new Error("Codex settings changed since reading; re-read before retrying.");
+    const next = JSON.stringify(settings, null, 2) + `
+`;
+    writeFileSync3(temp, next, { flag: "wx", mode: 384 });
+    if (current(path) !== snapshot.raw)
+      throw new Error("Codex settings changed since reading; re-read before retrying.");
+    renameSync2(temp, path);
+    snapshots.set(settings, { path, raw: next });
+  } finally {
+    if (existsSync7(temp))
+      unlinkSync(temp);
+    closeSync(fd);
+    unlinkSync(lock);
+  }
+}
+
+// src/lib/installer.ts
+var __dirname2 = dirname4(fileURLToPath2(import.meta.url));
+var HOOKS_DIR = existsSync8(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -7450,10 +7603,15 @@ function shortHookName(name) {
   return name.startsWith("hook-") ? name.slice("hook-".length) : name;
 }
 function removeHookEntriesByName(entries, hookName) {
-  return entries.filter((entry) => !entry.hooks?.some((h) => {
-    const match = h.command?.match(/^hooks run ([\w-]+)/);
-    return match && match[1] === hookName;
-  }));
+  return entries.flatMap((entry) => {
+    if (!Array.isArray(entry.hooks))
+      return [entry];
+    const kept = entry.hooks.filter((h) => {
+      const match = h.command?.match(/^hooks run ([\w-]+)/);
+      return !(match && match[1] === hookName);
+    });
+    return kept.length === entry.hooks.length ? [entry] : kept.length ? [{ ...entry, hooks: kept }] : [];
+  });
 }
 var EVENT_MAP = {
   claude: {
@@ -7463,7 +7621,7 @@ var EVENT_MAP = {
     Notification: "Notification",
     SessionStart: "SessionStart",
     SessionEnd: "SessionEnd",
-    UserPromptSubmit: null,
+    UserPromptSubmit: "UserPromptSubmit",
     SubagentStart: null
   },
   gemini: {
@@ -7485,9 +7643,21 @@ var EVENT_MAP = {
     SessionEnd: null,
     UserPromptSubmit: "UserPromptSubmit",
     SubagentStart: "SubagentStart"
+  },
+  codex: {
+    PreToolUse: "PreToolUse",
+    PostToolUse: "PostToolUse",
+    Stop: "Stop",
+    Notification: null,
+    SessionStart: "SessionStart",
+    SessionEnd: "SessionEnd",
+    UserPromptSubmit: "UserPromptSubmit",
+    SubagentStart: "SubagentStart"
   }
 };
 function getTargetSettingsDir(target) {
+  if (target === "codex")
+    return ".codex";
   if (target === "codewith")
     return ".codewith";
   if (target === "gemini")
@@ -7495,6 +7665,8 @@ function getTargetSettingsDir(target) {
   return ".claude";
 }
 function getGlobalSettingsPathOverride(target) {
+  if (target === "codex")
+    return process.env.HASNA_HOOKS_CODEX_SETTINGS_PATH;
   if (target === "claude")
     return process.env.HASNA_HOOKS_CLAUDE_SETTINGS_PATH;
   if (target === "gemini")
@@ -7511,6 +7683,8 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
   if (globalOverride)
     return globalOverride;
   const dir = getTargetSettingsDir(target);
+  if (target === "codex")
+    return join7(scope === "project" ? process.cwd() : homedir3(), dir, "hooks.json");
   if (scope === "project") {
     return target === "codewith" ? join7(process.cwd(), dir, "config.toml") : join7(process.cwd(), dir, "settings.json");
   }
@@ -7524,13 +7698,15 @@ function getHookPath(name) {
   return join7(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync7(getHookPath(name));
+  return existsSync8(getHookPath(name));
 }
 function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
+  if (target === "codex")
+    return readCodexSettings(path);
   try {
-    if (existsSync7(path)) {
-      return JSON.parse(readFileSync4(path, "utf-8"));
+    if (existsSync8(path)) {
+      return JSON.parse(readFileSync5(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -7539,11 +7715,13 @@ function readSettings(scope = "global", target = "claude") {
 }
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
-  const dir = dirname3(path);
-  if (!existsSync7(dir)) {
-    mkdirSync4(dir, { recursive: true });
+  if (target === "codex")
+    return writeCodexSettings(path, settings);
+  const dir = dirname4(path);
+  if (!existsSync8(dir)) {
+    mkdirSync5(dir, { recursive: true });
   }
-  writeFileSync3(path, JSON.stringify(settings, null, 2) + `
+  writeFileSync4(path, JSON.stringify(settings, null, 2) + `
 `);
 }
 function getTargetEventName(internalEvent, target) {
@@ -7566,6 +7744,8 @@ function codewithMatcher(matcher) {
 }
 function codewithTimeout(name) {
   switch (name) {
+    case "mementos-context":
+      return 12;
     case "knowledge-context":
       return 6;
     case "session-start":
@@ -7602,12 +7782,13 @@ function codewithStatusMessage(name) {
       return `Running ${name}`;
   }
 }
-function buildCodewithTomlFragment(name, profile) {
+function buildCodewithTomlFragment(name, profile, mementos) {
   const shortName = shortHookName(name);
   const meta = resolveHookMeta(shortName);
   if (!meta)
     throw new Error(`Hook '${shortName}' not found`);
-  const command = profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`;
+  validateMementosRegistration(shortName, mementos);
+  const command = (profile ? `hooks run ${shortName} --profile ${profile}` : `hooks run ${shortName}`) + mementosCommandSuffix(mementos);
   const matcher = codewithMatcher(meta.matcher);
   const fragments = [];
   for (const event of getHookEvents(meta)) {
@@ -7632,21 +7813,21 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync7(path) ? readFileSync4(path, "utf-8") : "";
+    return existsSync8(path) ? readFileSync5(path, "utf-8") : "";
   } catch {
     return "";
   }
 }
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
-  const dir = dirname3(path);
-  if (!existsSync7(dir))
-    mkdirSync4(dir, { recursive: true });
-  const existing = existsSync7(path) ? readFileSync4(path, "utf-8") : "";
+  const dir = dirname4(path);
+  if (!existsSync8(dir))
+    mkdirSync5(dir, { recursive: true });
+  const existing = existsSync8(path) ? readFileSync5(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
-  writeFileSync3(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
+  writeFileSync4(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
   return path;
 }
 function detectConflict(name, scope, target) {
@@ -7689,14 +7870,14 @@ function detectRewriteConflict(name, scope, target, lookup = getHook) {
   }
   return;
 }
-function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath) {
+function installForTarget(name, scope, overwrite, target, profile, codewithMode = "fragment", codewithConfigPath, mementos) {
   const shortName = shortHookName(name);
   if (!hookExists(shortName)) {
     return { hook: shortName, success: false, error: `Hook '${shortName}' not found`, target };
   }
   if (target === "codewith") {
     try {
-      const fragment = buildCodewithTomlFragment(shortName, profile);
+      const fragment = buildCodewithTomlFragment(shortName, profile, mementos);
       if (codewithMode !== "write") {
         return {
           hook: shortName,
@@ -7743,18 +7924,25 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
       };
     }
   }
-  const registered = getRegisteredHooksForTarget(scope, target);
-  if (registered.includes(shortName) && !overwrite) {
-    return { hook: shortName, success: false, error: "Already installed. Use --overwrite to replace.", scope, target };
-  }
-  const conflict = detectConflict(shortName, scope, target);
-  const rewriteConflict = detectRewriteConflict(shortName, scope, target);
-  if (rewriteConflict) {
-    return { hook: shortName, success: false, error: `Refused: ${rewriteConflict}`, scope, target };
-  }
   try {
-    registerHook(shortName, scope, target, profile);
-    return { hook: shortName, success: true, scope, target, ...conflict ? { conflict } : {} };
+    const registered = getRegisteredHooksForTarget(scope, target);
+    if (registered.includes(shortName) && !overwrite) {
+      return { hook: shortName, success: false, error: "Already installed. Use --overwrite to replace.", scope, target };
+    }
+    const conflict = detectConflict(shortName, scope, target);
+    const rewriteConflict = detectRewriteConflict(shortName, scope, target);
+    if (rewriteConflict) {
+      return { hook: shortName, success: false, error: `Refused: ${rewriteConflict}`, scope, target };
+    }
+    registerHook(shortName, scope, target, profile, mementos);
+    return {
+      hook: shortName,
+      success: true,
+      scope,
+      target,
+      ...conflict ? { conflict } : {},
+      ...target === "codex" ? { applied: true, configPath: getSettingsPath(scope, target), note: "Registered in Codex hooks.json. Review and trust the exact definition in Codex /hooks; project hooks also require a trusted project. Registration alone does not prove execution." } : {}
+    };
   } catch (error) {
     return {
       hook: shortName,
@@ -7765,7 +7953,15 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
   }
 }
 function installHook(name, options = {}) {
-  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath } = options;
+  const { scope = "global", overwrite = false, target = "claude", profile, codewithMode = "fragment", codewithConfigPath, mementos } = options;
+  try {
+    validateMementosRegistration(name, mementos);
+  } catch (error) {
+    return { hook: name, success: false, target, error: error instanceof Error ? error.message : "Invalid Mementos options" };
+  }
+  if (!/^[\w-]+$/.test(name) || profile !== undefined && !/^[\w-]+$/.test(profile)) {
+    return { hook: name, success: false, error: "Hook and profile names must contain only letters, digits, underscores or hyphens.", target };
+  }
   if (target === "all") {
     const shortName = shortHookName(name);
     const meta = resolveHookMeta(shortName);
@@ -7780,7 +7976,7 @@ function installHook(name, options = {}) {
         };
       }
     }
-    const claudeResult = installForTarget(name, scope, overwrite, "claude", profile);
+    const claudeResult = installForTarget(name, scope, overwrite, "claude", profile, "fragment", undefined, mementos);
     if (!claudeResult.success) {
       return {
         ...claudeResult,
@@ -7788,7 +7984,7 @@ function installHook(name, options = {}) {
         target: "all"
       };
     }
-    const codewithResult = installForTarget(name, scope, overwrite, "codewith", profile, codewithMode, codewithConfigPath);
+    const codewithResult = installForTarget(name, scope, overwrite, "codewith", profile, codewithMode, codewithConfigPath, mementos);
     if (!codewithResult.success) {
       return {
         ...codewithResult,
@@ -7798,9 +7994,9 @@ function installHook(name, options = {}) {
     }
     return { ...claudeResult, target: "all" };
   }
-  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath);
+  return installForTarget(name, scope, overwrite, target, profile, codewithMode, codewithConfigPath, mementos);
 }
-function registerHook(name, scope = "global", target = "claude", profile) {
+function registerHook(name, scope = "global", target = "claude", profile, mementos) {
   const meta = resolveHookMeta(name);
   if (!meta)
     return;
@@ -7818,8 +8014,9 @@ function registerHook(name, scope = "global", target = "claude", profile) {
   const settings = readSettings(scope, target);
   if (!settings.hooks)
     settings.hooks = {};
+  const retained = name === "mementos-context" && mementos === undefined ? retainedMementosRegistration(Object.values(settings.hooks).flatMap((groups) => Array.isArray(groups) ? groups.flatMap((group) => Array.isArray(group.hooks) ? group.hooks.map((hook) => hook.command).filter((command) => typeof command === "string") : []) : [])) : undefined;
   removeHookFromAllEvents(settings, name);
-  const hookCommand = profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`;
+  const hookCommand = (profile ? `hooks run ${name} --profile ${profile}` : `hooks run ${name}`) + mementosCommandSuffix(mementos ?? retained);
   for (const eventKey of uniqueEventKeys) {
     if (!settings.hooks[eventKey])
       settings.hooks[eventKey] = [];
@@ -7864,10 +8061,12 @@ function getRegisteredHooksForTarget(scope = "global", target = "claude") {
   if (target === "codewith") {
     const config = readCodewithConfig(scope);
     const registered2 = [];
-    const re = /command\s*=\s*["']hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?["']/g;
+    const re = /^\s*command\s*=\s*["']([^"'\n]+)["']\s*$/gm;
     let match;
     while (match = re.exec(config)) {
-      registered2.push(match[1]);
+      const name = registrationName(match[1]);
+      if (name)
+        registered2.push(name);
     }
     return [...new Set(registered2)];
   }
@@ -7878,12 +8077,9 @@ function getRegisteredHooksForTarget(scope = "global", target = "claude") {
   for (const eventKey of Object.keys(settings.hooks)) {
     for (const entry of settings.hooks[eventKey]) {
       for (const hook of entry.hooks || []) {
-        const newMatch = hook.command?.match(/^hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?$/);
-        const oldMatch = hook.command?.match(/^hook-([\w-]+)$/);
-        const match = newMatch || oldMatch;
-        if (match) {
-          registered.push(match[1]);
-        }
+        const name = registrationName(hook.command);
+        if (name)
+          registered.push(name);
       }
     }
   }
@@ -7898,7 +8094,8 @@ function removeHook(name, scope = "global", target = "claude") {
   if (target === "all") {
     const claudeRemoved = removeHookForTarget(shortName, scope, "claude");
     const geminiRemoved = removeHookForTarget(shortName, scope, "gemini");
-    return claudeRemoved || geminiRemoved;
+    const codexRemoved = removeHookForTarget(shortName, scope, "codex");
+    return claudeRemoved || geminiRemoved || codexRemoved;
   }
   if (target === "codewith") {
     return false;
@@ -7913,9 +8110,10 @@ function removeHookForTarget(name, scope, target) {
   unregisterHook(name, scope, target);
   return true;
 }
+var JSON_SETTINGS_TARGETS = ["claude", "gemini", "codex"];
 function removeCodewithHookEntry(configText, name) {
   const sections = configText.split(/\n\s*\n/);
-  const nameRe = new RegExp(`^command\\s*=\\s*"hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?"$`);
+  const commandRe = /^command\s*=\s*"([^"\n]+)"$/;
   const entryHeaderRe = /^\[\[hooks\.([\w]+)\.hooks\]\]$/;
   const eventHeaderRe = /^\[\[hooks\.([\w]+)\]\]$/;
   const eventsWithEntries = new Set;
@@ -7928,7 +8126,7 @@ function removeCodewithHookEntry(configText, name) {
     if (entryMatch) {
       const event = entryMatch[1];
       eventsWithEntries.add(event);
-      if (lines.some((line) => nameRe.test(line.trim()))) {
+      if (lines.some((line) => registrationName(commandRe.exec(line.trim())?.[1]) === name)) {
         removed = true;
         continue;
       }
@@ -7969,10 +8167,10 @@ function codewithHasHookEntryInText(configText, name) {
 }
 function codewithHasHookEntry(name, scope = "global") {
   const path = getSettingsPath(scope, "codewith");
-  if (!existsSync7(path))
+  if (!existsSync8(path))
     return false;
   try {
-    return codewithHasHookEntryInText(readFileSync4(path, "utf-8"), name);
+    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
   } catch {
     return false;
   }
@@ -7986,7 +8184,7 @@ function removeStoreDirFailClosed(dir) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) {
-      unlinkSync(join7(dir, entry.name));
+      unlinkSync2(join7(dir, entry.name));
     }
   }
   rmdirSync(dir);
@@ -7996,14 +8194,14 @@ function uninstallHook(name, scope = "global", target = "claude") {
   const custom2 = readCustomManifest(shortName);
   const bundledMeta = custom2 ? undefined : getHook(shortName);
   const existsInTarget = (t) => getRegisteredHooksForTarget("global", t).includes(shortName) || getRegisteredHooksForTarget("project", t).includes(shortName);
-  const registeredClaudeOrGemini = target === "all" ? existsInTarget("claude") || existsInTarget("gemini") : false;
+  const registeredClaudeOrGemini = target === "all" ? JSON_SETTINGS_TARGETS.some(existsInTarget) : false;
   const registeredGlobal = registeredClaudeOrGemini || getRegisteredHooksForTarget("global", target === "all" ? "claude" : target).includes(shortName);
   const registeredProject = registeredClaudeOrGemini || getRegisteredHooksForTarget("project", target === "all" ? "claude" : target).includes(shortName);
   const codewithOnly = (target === "codewith" || target === "all") && codewithHasHookEntry(shortName, scope);
   if (!custom2 && !bundledMeta && !registeredGlobal && !registeredProject && !codewithOnly) {
     return { name: shortName, removed: false, source: null, settingsScopes: [], storeDirRemoved: false, pinRemoved: false, dbRecordRemoved: false, registrationsRemaining: [], error: `Hook '${shortName}' not found` };
   }
-  const writableTargets = target === "all" ? ["claude", "gemini"] : target === "codewith" ? [] : [target];
+  const writableTargets = target === "all" ? JSON_SETTINGS_TARGETS : target === "codewith" ? [] : [target];
   const scopes = [];
   for (const s of ["global", "project"]) {
     for (const t of writableTargets) {
@@ -8017,11 +8215,11 @@ function uninstallHook(name, scope = "global", target = "claude") {
   const registrationsRemaining = [];
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
-    if (existsSync7(codewithPath)) {
-      const before = readFileSync4(codewithPath, "utf-8");
+    if (existsSync8(codewithPath)) {
+      const before = readFileSync5(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
-        writeFileSync3(codewithPath, after.text, "utf-8");
+        writeFileSync4(codewithPath, after.text, "utf-8");
       }
       if (codewithHasHookEntryInText(after.removed ? after.text : before, shortName)) {
         registrationsRemaining.push("codewith");
@@ -8060,7 +8258,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
 // src/index.ts
 init_profiles();
 init_config();
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
 
 // src/lib/transport.ts
 init_transport();
@@ -8147,15 +8345,15 @@ init_manifest();
 // src/lib/custom-install.ts
 init_config();
 init_manifest();
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync2 } from "fs";
 import { join as join10 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
   const path = join10(dir, "manifest.json");
-  if (!existsSync9(path))
+  if (!existsSync10(path))
     return;
   try {
-    return parseManifest(readFileSync7(path, "utf-8"));
+    return parseManifest(readFileSync8(path, "utf-8"));
   } catch {
     return;
   }
@@ -8198,7 +8396,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync9(value);
+  return existsSync10(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -8212,11 +8410,11 @@ async function installCustomSource(source) {
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync9(source)) {
+  if (!existsSync10(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync7(source, "utf-8"));
+    const manifest = parseManifest(readFileSync8(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -8247,7 +8445,7 @@ async function installManifestUrl(url) {
 }
 // src/lib/sync.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 init_db();
 init_store();
 init_manifest();
@@ -8255,7 +8453,7 @@ function sha256OfText(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -8549,8 +8747,8 @@ async function installPinnedFromBundled(name, version) {
 // src/serve.ts
 init_manifest();
 init_store();
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname4, join as join11 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname5, join as join11 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/lib/secure-compare.ts
@@ -8724,8 +8922,8 @@ var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
 function packageVersion() {
   try {
-    const pkgPath = join11(dirname4(fileURLToPath3(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync9(pkgPath, "utf-8")).version || "0.0.0";
+    const pkgPath = join11(dirname5(fileURLToPath3(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -8991,11 +9189,11 @@ async function runHook(name, input, options = {}) {
     throw new Error(`Hook '${name}' not found`);
   const hookScript = getHookPath(name) + "/src/hook.ts";
   const resolvedScript = custom2?.scriptPath;
-  const script = resolvedScript ?? (existsSync11(hookScript) ? hookScript : undefined);
+  const script = resolvedScript ?? (existsSync12(hookScript) ? hookScript : undefined);
   if (!script)
     throw new Error(`Hook script not found: ${name}`);
   const { sha256Of: sha256Of2, checkScriptHash: checkScriptHash2 } = await Promise.resolve().then(() => (init_store(), exports_store));
-  const content = readFileSync10(script);
+  const content = readFileSync11(script);
   const check = checkScriptHash2(name, sha256Of2(content));
   if (!check.ok) {
     throw new Error(`Hook '${name}' script changed since it was trusted (sha256 ${check.expected} != ${check.actual}). Run 'hooks trust ${name}' to trust the new content.`);