@hasna/skills 0.9.2 → 0.9.4

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.2",
+    version: "0.9.4",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36877,6 +36877,7 @@ var init_package = __esm(() => {
       "skills-serve": "bin/server.js",
       "skills-server": "bin/server.js",
       "skills-worker": "bin/worker.js",
+      "skills-maintenance": "bin/maintenance.js",
       "skills-migrate": "bin/migrate.js"
     },
     exports: {
@@ -36917,7 +36918,7 @@ var init_package = __esm(() => {
     types: "./dist/index.d.ts",
     scripts: {
       clean: "rm -rf bin/ dist/",
-      build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+      build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
       "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
       test: "bun test --timeout 30000",
       dev: "bun run ./src/cli/index.tsx",
@@ -55451,10 +55452,12 @@ function projectAncestorDirectories(projects) {
 }
 function inventoryNativeSkills(home = homedir4(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
-  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join29(home, path), aliases)]);
+  const selectedAgents = options.agents ? new Set(options.agents) : undefined;
+  const rootDefinitions = selectedAgents ? ROOTS.filter(([agent, path]) => selectedAgents.has(agent) || selectedAgents.has("hermes") && agent === "codex" && path === ".agents/skills") : ROOTS;
+  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join29(home, path), aliases)]);
   const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join29(home, adapter.root, CLI_BRIDGE_NAME), aliases));
   for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
-    for (const [agent, path] of ROOTS)
+    for (const [agent, path] of rootDefinitions)
       roots.push([agent, canonicalAgentPath(join29(project, path), aliases)]);
   }
   const entries = [], seen = new Set;
@@ -55710,7 +55713,7 @@ function planAgentIntegration(options) {
     return [agent, { command, profileId: profileId2 }];
   }));
   const discoveries = [...new Set(options.agents)].map((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }));
-  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases });
+  const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases });
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
     if (!INTEGRATION_AGENTS.includes(agent))
@@ -56110,7 +56113,7 @@ function assertManagedAgentBridge(agent, options = {}) {
   } catch (error) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
-  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
+  const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", agents: [agent], projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
   const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledBuiltin(entry));
   if (unexpected.length) {
     const paths = unexpected.slice(0, 3).map((entry) => {
@@ -108021,7 +108024,7 @@ async function connectCodexHookRpc(options) {
 }
 var SUPPORTED_CODEX_HOOK_VERSIONS;
 var init_codex_hook_rpc = __esm(() => {
-  SUPPORTED_CODEX_HOOK_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0"];
+  SUPPORTED_CODEX_HOOK_VERSIONS = ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1"];
 });
 
 // src/lib/codex-hook-trust-layout.ts
@@ -108098,7 +108101,7 @@ function codexTrustTextWitness(text3, keys3) {
   let result2 = text3;
   for (const span of replacements2.reverse())
     result2 = result2.slice(0, span.start) + span.comments + result2.slice(span.end);
-  return result2.split(/\r?\n/).filter((line) => line.trim()).join(`
+  return canonicalizeTableOrder(result2).split(/\r?\n/).filter((line) => line.trim()).join(`
 `);
 }
 var fail4 = () => new Error('CODEX_HOOK_TRUST_UNSUPPORTED_LAYOUT: preserve and convert hook trust to ordinary [hooks.state."<key>"] tables before enrollment'), prune = (value) => {
@@ -108107,6 +108110,25 @@ var fail4 = () => new Error('CODEX_HOOK_TRUST_UNSUPPORTED_LAYOUT: preserve and c
   if (value.hooks && !Object.keys(value.hooks).length)
     delete value.hooks;
   return value;
+}, canonicalizeTableOrder = (text3) => {
+  const headers = [...text3.matchAll(/^[ \t]*(\[\[?[^\r\n]+\]\]?)[ \t]*(#[^\r\n]*)?(?:\r?\n|$)/gm)];
+  if (!headers.length)
+    return text3;
+  const keys3 = headers.map((header) => header[1].trim());
+  if (keys3.some((key) => key.startsWith("[[") || keys3.filter((other) => other === key).length > 1))
+    return text3;
+  const plain = keys3.map((key) => key.slice(1, -1).trim());
+  if (plain.some((key, index) => plain.some((other, otherIndex) => index !== otherIndex && (other.startsWith(`${key}.`) || key.startsWith(`${other}.`)))))
+    return text3;
+  const first = headers[0].index;
+  const prefix = text3.slice(0, first);
+  const blocks = headers.map((header, index) => ({
+    key: header[1],
+    order: index,
+    text: text3.slice(header.index, headers[index + 1]?.index ?? text3.length)
+  }));
+  blocks.sort((a, b) => a.key.localeCompare(b.key) || a.order - b.order);
+  return prefix + blocks.map((block) => block.text).join("");
 };
 var init_codex_hook_trust_layout = () => {};
 
@@ -108206,6 +108228,101 @@ import { createHash as createHash26, randomUUID as randomUUID10 } from "crypto";
 import { join as join56, resolve as resolve22 } from "path";
 import { homedir as homedir11 } from "os";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
+async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc) {
+  let rpc;
+  try {
+    const home = resolve22(options.home ?? homedir11()), dataDir3 = resolve22(options.dataDir ?? getDataDirReadOnly());
+    const parent = resolve22(join56(dataDir3, "native-hook-trust")), journal = resolve22(options.journal);
+    need4(journal.startsWith(parent + "/") && /^[a-f0-9-]{36}$/.test(journal.slice(parent.length + 1)), "RECONCILE_JOURNAL_PATH");
+    const dir = lstatSync28(journal, { throwIfNoEntry: false });
+    need4(!!dir && dir.isDirectory() && !dir.isSymbolicLink() && dir.uid === process.getuid() && (dir.mode & 511) === 448, "UNSAFE_JOURNAL");
+    need4(!lstatSync28(join56(journal, "receipt.json"), { throwIfNoEntry: false }), "RECONCILE_ALREADY_COMPLETE");
+    need4(lstatSync28(join56(journal, "stopped.json"), { throwIfNoEntry: false })?.isFile(), "RECONCILE_JOURNAL_INCOMPLETE");
+    const stoppedFile = snapshot(join56(journal, "stopped.json"), true);
+    const intentFile = snapshot(join56(journal, "intent.json"), true), intent = JSON.parse(intentFile.text);
+    const configBefore = snapshot(join56(journal, "config.before.toml"), true), hooksBefore = snapshot(join56(journal, "hooks.before.json"), true), policyBefore = snapshot(join56(journal, "policy.before.json"), true);
+    const legacyIntent = intent.home === undefined && intent.configSha256 === undefined && intent.configVersion === undefined && intent.declarations === undefined && intent.admitted === undefined && intent.nativeHooks === undefined;
+    need4(intent.version === 1 && /^[a-f0-9]{64}$/.test(intent.planDigest) && typeof intent.configPath === "string" && /^[a-f0-9]{64}$/.test(intent.policySha256) && /^[a-f0-9]{64}$/.test(intent.hooksSha256) && Array.isArray(intent.hooks) && intent.hooks.length > 0 && intent.hooks.length <= 100 && (legacyIntent || typeof intent.home === "string" && intent.home === home && /^[a-f0-9]{64}$/.test(intent.configSha256) && typeof intent.configVersion === "string" && Array.isArray(intent.declarations) && Array.isArray(intent.admitted) && Array.isArray(intent.nativeHooks)), "RECONCILE_INTENT_INVALID");
+    const declarations = intent.declarations ?? intent.hooks.map((hook) => ({ event: hook.event, key: `${join56(home, ".codex/hooks.json")}${hook.key.slice(hook.key.indexOf(".codex/hooks.json") + ".codex/hooks.json".length)}`, command: hook.command }));
+    const admitted = intent.admitted ?? intent.hooks;
+    const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
+    const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
+    need4(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
+    need4(isDeepStrictEqual6(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
+    need4(configBefore.sha256 === intent.beforeSha256 && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
+    const currentConfig = snapshot(intent.configPath, true);
+    need4(codexTrustTextWitness(configBefore.text, intent.hooks.map((h) => h.key)) === codexTrustTextWitness(currentConfig.text, intent.hooks.map((h) => h.key)), "RECONCILE_UNRELATED_CONFIG_CHANGED");
+    const before2 = structure(configBefore.text), current = structure(currentConfig.text), expectedConfig = structuredClone(before2);
+    expectedConfig.hooks ??= {};
+    expectedConfig.hooks.state ??= {};
+    for (const hook of intent.hooks)
+      expectedConfig.hooks.state[hook.key] = { ...expectedConfig.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
+    need4(isDeepStrictEqual6(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+    const policyCurrent = snapshot(join56(dataDir3, "agent-policy.json"), true);
+    need4(policyCurrent.sha256 === policyBefore.sha256, "RECONCILE_POLICY_CHANGED");
+    const policy = parseManagedSkillPolicy(policyBefore.text), binding = policy.bridge;
+    assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home });
+    const skillsCli = bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
+    need4(isDeepStrictEqual6(skillsCli.receipt, intent.skillsCli), "RECONCILE_SKILLS_BINDING_CHANGED");
+    const alias = binding.rootAliases?.find((item) => item.agent === "codex"), codexHome = alias?.target ?? join56(home, ".codex"), hooksPath = join56(codexHome, "hooks.json");
+    need4(resolve22(intent.configPath) === resolve22(join56(codexHome, "config.toml")), "RECONCILE_CONFIG_PATH_CHANGED");
+    const hooksCurrent = snapshot(hooksPath);
+    need4(hooksCurrent.sha256 === intent.hooksSha256 || hooksCurrent.sha256 === hooksBefore.sha256, "RECONCILE_HOOKS_CHANGED");
+    rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
+    need4(rpc.version === intent.nativeVersion, "RECONCILE_NATIVE_VERSION_CHANGED");
+    const discovered = await rpc.request("hooks/list", { cwds: [home] });
+    need4(Array.isArray(discovered?.data) && discovered.data.length === 1 && discovered.data[0].cwd === home && !discovered.data[0].errors?.length && !discovered.data[0].warnings?.length, "RECONCILE_NATIVE_DISCOVERY_REFUSED");
+    const nativeHooks = discovered.data[0].hooks;
+    const recordedNativeHooks = intent.nativeHooks;
+    if (recordedNativeHooks)
+      need4(nativeHooks.length === recordedNativeHooks.length, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
+    const plannedKeys = new Set(intent.hooks.map((hook) => hook.key));
+    for (const expected of recordedNativeHooks ?? []) {
+      const matches2 = nativeHooks.filter((hook) => hook.key === expected.key);
+      need4(matches2.length === 1, "RECONCILE_NATIVE_HOOK_LIST_CHANGED");
+      const actual = safeNativeHook(matches2[0]);
+      const stable = (hook) => {
+        const { enabled, trustStatus, ...identity4 } = hook;
+        return identity4;
+      };
+      need4(isDeepStrictEqual6(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      if (!plannedKeys.has(expected.key))
+        need4(isDeepStrictEqual6(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
+    }
+    for (const wanted of intent.hooks) {
+      const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join56(home, ".codex/hooks.json"), hooksPath));
+      need4(matches2.length === 1, "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      const h = matches2[0];
+      need4(h.enabled === true && h.trustStatus === "trusted" && h.currentHash === wanted.currentHash, "RECONCILE_NATIVE_STATE_INCOMPLETE");
+    }
+    const config2 = await rpc.request("config/read", { includeLayers: true, cwd: home });
+    const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
+    need4(layers?.length === 1 && !layers[0].disabledReason && isDeepStrictEqual6(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
+    const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
+    need4(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual6(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
+    const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
+    const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === intent.configPath && !layer.name.profile);
+    need4(finalLayers?.length === 1 && isDeepStrictEqual6(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
+    unchanged2(stoppedFile);
+    unchanged2(intentFile);
+    unchanged2(configBefore);
+    unchanged2(hooksBefore);
+    unchanged2(policyBefore);
+    unchanged2(policyCurrent);
+    unchanged2(hooksCurrent);
+    unchanged2(currentConfig);
+    skillsCli.recheck();
+    assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home });
+    const receipt = { version: 1, status: "reconciled", reconciled: true, automaticRollback: false, journal, planDigest: intent.planDigest, nativeVersion: rpc.version, nativeStateVerified: true, nativeExecutionVerified: false, configSha256: currentConfig.sha256, hooksSha256: hooksCurrent.sha256, policySha256: policyBefore.sha256, skillsCli: skillsCli.receipt, nativeInventoryScope: recordedNativeHooks ? "complete" : "declared-managed-hooks-only", unrelatedNativeHooksPreserved: !!recordedNativeHooks, unrelatedSettingsAndCommentsPreserved: true };
+    save2(join56(journal, "receipt.json"), json2(receipt));
+    return receipt;
+  } catch (error61) {
+    const message = error61 instanceof Error && error61.message.startsWith("CODEX_HOOK_TRUST_") ? error61.message : "CODEX_HOOK_TRUST_RECONCILE_REFUSED";
+    throw new Error(message);
+  } finally {
+    await rpc?.close();
+  }
+}
 async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRpc) {
   let rpc, journal;
   try {
@@ -108259,7 +108376,8 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
       unchanged2(configFile);
     };
     checkInputs();
-    const planDigest = createHash26("sha256").update(json2({ version: 1, home, configPath, configSha256: configFile.sha256, configVersion: layers[0].version, policySha256: policyFile.sha256, hooksSha256: hooksFile.sha256, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, declarations: expected, admitted })).digest("hex");
+    const digestInput = { version: 1, home, configPath, configSha256: configFile.sha256, configVersion: layers[0].version, policySha256: policyFile.sha256, hooksSha256: hooksFile.sha256, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, declarations: expected, admitted };
+    const planDigest = makePlanDigest(digestInput);
     const baseReceipt = { planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, ownedNativeProcessId: rpc.processId, agent: "codex", applied: false, planned, nativeEligible: planned.length === 0, transport: "owned-stdio-process", existingSessionsReloaded: false, nativeExecutionVerified: false };
     if (options.apply)
       need4(options.reviewedPlanDigest === planDigest, "PLAN_CHANGED: run the dry-run again and pass its reviewed --plan-digest with --apply");
@@ -108283,7 +108401,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     save2(join56(journal, "config.before.toml"), configFile.bytes);
     save2(join56(journal, "hooks.before.json"), hooksFile.bytes);
     save2(join56(journal, "policy.before.json"), policyFile.bytes);
-    save2(join56(journal, "intent.json"), json2({ version: 1, planDigest, skillsCli: skillsCli.receipt, nativeVersion: rpc.version, configPath, beforeSha256: configFile.sha256, hooksSha256: hooksFile.sha256, policySha256: policyFile.sha256, expectedVersion: layers[0].version, hooks: planned }));
+    save2(join56(journal, "intent.json"), json2({ ...digestInput, planDigest, hooks: planned, nativeHooks: discovered.map(safeNativeHook) }));
     need4(isDeepStrictEqual6(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
     checkInputs();
     let result2;
@@ -108325,7 +108443,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
   }
 }
 var json2 = (value) => JSON.stringify(value, null, 2) + `
-`, structure = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), eventNames;
+`, structure = (text3) => JSON.parse(JSON.stringify(Bun.TOML.parse(text3))), eventNames, makePlanDigest = (value) => createHash26("sha256").update(json2(value)).digest("hex"), safeNativeHook = (hook) => ({ key: hook.key, eventName: hook.eventName, handlerType: hook.handlerType, command: hook.command, matcher: hook.matcher, timeoutSec: hook.timeoutSec, async: hook.async, statusMessage: hook.statusMessage, additionalContextLimit: hook.additionalContextLimit, sourcePath: hook.sourcePath, source: hook.source, pluginId: hook.pluginId, isManaged: hook.isManaged, currentHash: hook.currentHash, enabled: hook.enabled, trustStatus: hook.trustStatus });
 var init_agent_codex_trust = __esm(() => {
   init_config();
   init_managed_policy();
@@ -108503,7 +108621,7 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
-  hook.command("trust").requiredOption("--agent <agent>", "Native trust adapter (codex)").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--apply", "Enable and trust only the exact managed Skills hook identities", false).option("--plan-digest <sha256>", "Exact reviewed dry-run digest required with --apply").option("--json", "Output the native trust plan or receipt", false).description("Plan or enroll exact Skills hooks through Codex native trust controls").action(async (options) => {
+  const trust = hook.command("trust").requiredOption("--agent <agent>", "Native trust adapter (codex)").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--apply", "Enable and trust only the exact managed Skills hook identities", false).option("--plan-digest <sha256>", "Exact reviewed dry-run digest required with --apply").option("--json", "Output the native trust plan or receipt", false).description("Plan or enroll exact Skills hooks through Codex native trust controls").action(async (options) => {
     try {
       if (options.agent !== "codex")
         throw new Error("Native trust enrollment currently supports --agent codex only");
@@ -108517,6 +108635,20 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
+  trust.command("reconcile").requiredOption("--agent <agent>", "Native trust adapter (codex)").requiredOption("--journal <path>", "Private incomplete native trust journal to inspect").option("--codex-command <path>", "Installed Codex executable used for its native configuration API", "codex").option("--json", "Output the reconciliation receipt", false).description("Verify an interrupted Codex native trust write and resolve its private journal").action(async (options) => {
+    try {
+      if (options.agent !== "codex")
+        throw new Error("Native trust reconciliation currently supports --agent codex only");
+      const result2 = await reconcileCodexNativeHooks({ journal: options.journal, codexCommand: options.codexCommand });
+      if (options.json)
+        await writeCliOutput(JSON.stringify(result2));
+      else
+        await writeCliOutput(`Reconciled native Codex trust journal ${result2.journal}. No native configuration was written.`);
+    } catch (error61) {
+      console.error(error61.message);
+      process.exitCode = 1;
+    }
+  });
   hook.command("user-prompt").requiredOption("--agent <agent>", `Native payload/output adapter: ${INTEGRATION_AGENTS.join(", ")}`).option("--event <event>", "Native lifecycle event supplied by the installed adapter").option("--selection-profile <id>", "Selection profile to load").description("Read native lifecycle JSON on stdin and return selected context").action(async (options) => {
     const deadline = Date.now() + 12000;
     let event = options.agent === "hermes" && options.event === "pre_tool_call" ? "pre_tool_call" : "UserPromptSubmit";