@ironbee-ai/cli 0.15.0 → 0.17.0

package/dist/clients/codex/hooks/require-verification.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Codex — PreToolUse hook adapter (matcher: `mcp__.*-devtools__.*`)
+ *
+ * Blocks devtools tool usage when no verification cycle is active.
+ * When allowed, injects `_metadata` into tool_input via Codex's
+ * `updatedInput` + **`permissionDecision: "allow"`** (the latter is
+ * REQUIRED — without it Codex silently drops the rewrite).
+ *
+ * Returns `permissionDecision: "deny"` (exit 2-equivalent) when blocked.
+ *
+ * **Soft mode** (`opts.soft`, assist mode — `verification.auto: false`):
+ * never denies. The no-cycle + recording-required blocks are skipped; the hook
+ * only injects `_metadata` (still with `permissionDecision: "allow"`, required
+ * for Codex to honor the rewrite). `verificationId` / `traceId` ride along only
+ * when a cycle is active (manual `$ironbee-verify`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const crypto_1 = require("crypto");
+const activity_1 = require("../../../hooks/core/activity");
+const session_state_1 = require("../../../hooks/core/session-state");
+const actions_1 = require("../../../hooks/core/actions");
+const verification_lifecycle_1 = require("../../../hooks/core/verification-lifecycle");
+const config_1 = require("../../../lib/config");
+const logger_1 = require("../../../lib/logger");
+const stdin_1 = require("../../../lib/stdin");
+const util_1 = require("../util");
+async function run(projectDir, opts) {
+    const soft = opts?.soft === true;
+    const input = (0, util_1.parseCodexHookStdin)((0, stdin_1.readStdin)());
+    const sessionId = input.session_id ?? "default";
+    const sessionDir = `${projectDir}/.ironbee/sessions/${sessionId}`;
+    const actionsFile = `${sessionDir}/actions.jsonl`;
+    (0, logger_1.setLogFile)(`${sessionDir}/session.log`);
+    const verificationId = (0, session_state_1.getActiveVerificationId)(sessionDir);
+    // Soft mode (assist) never denies — it only injects metadata.
+    if (!verificationId && !soft) {
+        const reason = `BLOCKED: You must start a verification cycle before using devtools tools.
+
+Start verification first:
+  echo '{"session_id":"${sessionId}"}' | ironbee hook verification-start
+
+Then use the verification tools for the active cycle(s) — mcp__browser-devtools__bdt_* for browser, mcp__node-devtools__ndt_* for node, mcp__backend-devtools__bedt_* for backend.`;
+        process.stdout.write(JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: reason,
+            },
+        }));
+        process.exit(0);
+        return;
+    }
+    // Recording enforcement is browser-only.
+    const toolName = input.tool_name ?? "";
+    const mcpServer = (0, util_1.extractCodexMcpServer)(toolName);
+    const isBrowserDevToolsCall = mcpServer === "browser-devtools";
+    // Codex flattens `-` → `_` on hook dispatch — the raw tool_name is
+    // `mcp__browser_devtools__bdt_content_start_recording`. Canonicalize
+    // the bare tool segment before comparing against the documented
+    // hyphenated form. Without this, the recording-start tool blocks
+    // itself and the agent can never start recording (infinite loop:
+    // gate denies → agent retries → gate denies → …).
+    const bareToolName = isBrowserDevToolsCall
+        ? (0, util_1.canonicalizeCodexToolName)(toolName.split("__").pop() ?? "")
+        : "";
+    const isRecordingStartTool = bareToolName === "bdt_content_start-recording";
+    if (!soft &&
+        isBrowserDevToolsCall &&
+        (0, session_state_1.isRecordingRequired)(sessionDir) &&
+        !(0, session_state_1.isRecordingActive)(sessionDir) &&
+        !isRecordingStartTool) {
+        const reason = `BLOCKED: Recording is required but not started.
+
+1. Start recording NOW:
+     Use mcp__browser-devtools__bdt_content_start-recording
+
+2. Run the verification (navigate, screenshot, aria, console, etc.)
+
+3. **Stop recording BEFORE submitting verdict:**
+     Use mcp__browser-devtools__bdt_content_stop-recording
+   submit-verdict will reject with "recording is still active" if you skip this.`;
+        process.stdout.write(JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: reason,
+            },
+        }));
+        process.exit(0);
+        return;
+    }
+    // ensure activity is open before reading its ID for metadata propagation
+    await (0, activity_1.startActivity)({ sessionDir, actionsFile, source: "pre_tool_use" });
+    // Assist auto-open: in soft mode open a verification cycle when none is
+    // active (instead of denying). See the Claude adapter for the rationale.
+    let effectiveVerificationId = verificationId;
+    if (soft && !effectiveVerificationId) {
+        const opened = await (0, verification_lifecycle_1.startVerification)({ sessionId, sessionDir, actionsFile, recordingEnabled: false });
+        effectiveVerificationId = opened.verificationId;
+    }
+    const traceId = (0, session_state_1.getActiveTraceId)(sessionDir);
+    const activityId = (0, session_state_1.getActiveActivityId)(sessionDir);
+    const projectName = (0, actions_1.resolveProjectName)(projectDir);
+    const traceStateParts = [`prj:${projectName}`, `sid:${sessionId}`];
+    if (activityId) {
+        traceStateParts.push(`aid:${activityId}`);
+    }
+    // Tag vid when a cycle is active (always, after the assist auto-open above).
+    if (effectiveVerificationId) {
+        traceStateParts.push(`vid:${effectiveVerificationId}`);
+    }
+    const traceState = `ironbee=${traceStateParts.join(";")}`;
+    const config = (0, config_1.loadConfig)(projectDir);
+    // tool_input is Record<string,unknown> | string | undefined; for MCP devtools
+    // matcher-routed tools it's always a Record (no custom_tool_call MCPs).
+    const baseInput = (input.tool_input && typeof input.tool_input === "object")
+        ? input.tool_input
+        : {};
+    const updatedInput = { ...baseInput };
+    const metadata = {
+        projectName,
+        sessionId,
+        activityId,
+        verificationId: effectiveVerificationId,
+        traceId,
+        traceState,
+        toolCallId: (0, crypto_1.randomUUID)(),
+    };
+    if (input.tool_use_id) {
+        metadata.toolUseId = input.tool_use_id;
+    }
+    metadata.mcpServer = mcpServer ?? "browser-devtools";
+    const userEmail = (0, session_state_1.getUserEmail)(sessionDir);
+    if (userEmail) {
+        metadata.userEmail = userEmail;
+    }
+    if (config.collector?.url) {
+        metadata.collectorUrl = config.collector.url;
+    }
+    if (config.collector?.apiKey) {
+        metadata.collectorApiKey = config.collector.apiKey;
+    }
+    updatedInput._metadata = metadata;
+    process.stdout.write(JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "allow",
+            updatedInput,
+        },
+    }));
+    logger_1.logger.debug(`require-verification: allowed ${toolName} with _metadata`);
+    process.exit(0);
+}
+//# sourceMappingURL=require-verification.js.map

package/dist/clients/codex/hooks/require-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-verification.js","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/require-verification.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAmBH,kBAwIC;AAzJD,mCAAoC;AACpC,2DAA6D;AAC7D,qEAO2C;AAC3C,yDAAiE;AACjE,uFAAwG;AACxG,gDAAiD;AACjD,gDAAyD;AACzD,8CAA+C;AAC/C,kCAAgG;AAEzF,KAAK,UAAU,GAAG,CAAC,UAAkB,EAAE,IAAyB;IACnE,MAAM,IAAI,GAAY,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAC1C,MAAM,KAAK,GAA2C,IAAA,0BAAmB,EAAC,IAAA,iBAAS,GAAE,CAAC,CAAC;IACvF,MAAM,SAAS,GAAW,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC;IACxD,MAAM,UAAU,GAAW,GAAG,UAAU,sBAAsB,SAAS,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAW,GAAG,UAAU,gBAAgB,CAAC;IAC1D,IAAA,mBAAU,EAAC,GAAG,UAAU,cAAc,CAAC,CAAC;IAExC,MAAM,cAAc,GAAuB,IAAA,uCAAuB,EAAC,UAAU,CAAC,CAAC;IAC/E,8DAA8D;IAC9D,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAW;;;yBAGN,SAAS;;mLAEiJ,CAAC;QAC5K,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,kBAAkB,EAAE;gBAChB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACnC;SACJ,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACX,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAW,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAkB,IAAA,4BAAqB,EAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,qBAAqB,GAAY,SAAS,KAAK,kBAAkB,CAAC;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,kDAAkD;IAClD,MAAM,YAAY,GAAW,qBAAqB;QAC9C,CAAC,CAAC,IAAA,gCAAyB,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,oBAAoB,GAAY,YAAY,KAAK,6BAA6B,CAAC;IACrF,IACI,CAAC,IAAI;QACL,qBAAqB;QACrB,IAAA,mCAAmB,EAAC,UAAU,CAAC;QAC/B,CAAC,IAAA,iCAAiB,EAAC,UAAU,CAAC;QAC9B,CAAC,oBAAoB,EACvB,CAAC;QACC,MAAM,MAAM,GAAW;;;;;;;;;iFASkD,CAAC;QAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,kBAAkB,EAAE;gBAChB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACnC;SACJ,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACX,CAAC;IAED,yEAAyE;IACzE,MAAM,IAAA,wBAAa,EAAC,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,uBAAuB,GAAuB,cAAc,CAAC;IACjE,IAAI,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnC,MAAM,MAAM,GAA4B,MAAM,IAAA,0CAAiB,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QACjI,uBAAuB,GAAG,MAAM,CAAC,cAAc,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAuB,IAAA,gCAAgB,EAAC,UAAU,CAAC,CAAC;IACjE,MAAM,UAAU,GAAuB,IAAA,mCAAmB,EAAC,UAAU,CAAC,CAAC;IAEvE,MAAM,WAAW,GAAW,IAAA,4BAAkB,EAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAa,CAAC,OAAO,WAAW,EAAE,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC;QACb,eAAe,CAAC,IAAI,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,6EAA6E;IAC7E,IAAI,uBAAuB,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,OAAO,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAW,WAAW,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAkC,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC;IAErE,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,SAAS,GAA4B,CAAC,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;QACjG,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,YAAY,GAA4B,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAA4B;QACtC,WAAW;QACX,SAAS;QACT,UAAU;QACV,cAAc,EAAE,uBAAuB;QACvC,OAAO;QACP,UAAU;QACV,UAAU,EAAE,IAAA,mBAAU,GAAE;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACpB,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,QAAQ,CAAC,SAAS,GAAG,SAAS,IAAI,kBAAkB,CAAC;IACrD,MAAM,SAAS,GAAuB,IAAA,4BAAY,EAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,SAAS,EAAE,CAAC;QACZ,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;QACxB,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACvD,CAAC;IACD,YAAY,CAAC,SAAS,GAAG,QAAQ,CAAC;IAElC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,kBAAkB,EAAE;YAChB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,OAAO;YAC3B,YAAY;SACf;KACJ,CAAC,CAAC,CAAC;IACJ,eAAM,CAAC,KAAK,CAAC,iCAAiC,QAAQ,iBAAiB,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/clients/codex/hooks/session-start.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Codex — SessionStart hook adapter
+ *
+ * Appends a `session_start` entry to actions.jsonl, populates session-state
+ * with auth info from `~/.codex/auth.json` (cleaner than Claude — explicit
+ * `auth_mode` enum vs JWT decode), then runs the standard reconcile pass to
+ * close any abandoned cycles from a prior session.
+ */
+export declare function run(projectDir: string): Promise<void>;
+//# sourceMappingURL=session-start.d.ts.map

package/dist/clients/codex/hooks/session-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start.d.ts","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/session-start.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+E3D"}

package/dist/clients/codex/hooks/session-start.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * Codex — SessionStart hook adapter
+ *
+ * Appends a `session_start` entry to actions.jsonl, populates session-state
+ * with auth info from `~/.codex/auth.json` (cleaner than Claude — explicit
+ * `auth_mode` enum vs JWT decode), then runs the standard reconcile pass to
+ * close any abandoned cycles from a prior session.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const actions_1 = require("../../../hooks/core/actions");
+const ids_1 = require("../../../import/ids");
+const session_state_1 = require("../../../hooks/core/session-state");
+const config_1 = require("../../../lib/config");
+const logger_1 = require("../../../lib/logger");
+const output_1 = require("../../../lib/output");
+const stdin_1 = require("../../../lib/stdin");
+const telemetry_1 = require("../../../lib/telemetry");
+const util_1 = require("../util");
+async function run(projectDir) {
+    const input = (0, util_1.parseCodexHookStdin)((0, stdin_1.readStdin)());
+    const sessionId = input.session_id ?? "default";
+    const sessionDir = `${projectDir}/.ironbee/sessions/${sessionId}`;
+    const actionsFile = `${sessionDir}/actions.jsonl`;
+    (0, logger_1.setLogFile)(`${sessionDir}/session.log`);
+    const usage = (0, util_1.resolveCodexUsage)();
+    if (usage.userEmail) {
+        (0, session_state_1.setUserEmail)(sessionDir, usage.userEmail);
+    }
+    (0, session_state_1.setUsage)(sessionDir, {
+        usage_type: usage.usageType ?? null,
+        usage_plan: usage.usagePlan ?? null,
+    });
+    const entry = {
+        ...(0, actions_1.baseFields)(actionsFile),
+        // Deterministic event.id — matches import's `deriveSessionStartEventId`.
+        // Without this override, live's random UUID + import's deterministic
+        // id never collide on `(session_id, id)` → re-import after live
+        // produces duplicate session_start rows.
+        id: (0, ids_1.deriveSessionStartEventId)(sessionId),
+        type: "session_start",
+        timestamp: Date.now(),
+        session_id: sessionId,
+        client: "codex",
+        source: input.source ?? "startup",
+    };
+    await (0, actions_1.appendAction)(actionsFile, entry);
+    await (0, session_state_1.reconcileSessionState)(sessionDir, actionsFile, actions_1.appendAction);
+    const verificationEnabled = (0, config_1.getVerificationEnabled)((0, config_1.loadConfig)(projectDir));
+    await (0, telemetry_1.trackSessionStart)("codex", sessionId, verificationEnabled, projectDir);
+    logger_1.logger.debug(`session-start: ${sessionId}`);
+    // Codex SessionStart accepts `additionalContext` in hookSpecificOutput
+    // for injecting into agent context. In monitoring mode we ship nothing.
+    if (!verificationEnabled) {
+        (0, output_1.writeAndExit)(JSON.stringify({}), 0);
+        return;
+    }
+    const verdictPass = JSON.stringify({
+        session_id: sessionId,
+        status: "pass",
+        checks: ["form submits successfully", "new item appears in list"],
+    });
+    const verdictFail = JSON.stringify({
+        session_id: sessionId,
+        status: "fail",
+        checks: ["form renders", "submit button unresponsive"],
+        issues: ["button click handler not firing", "TypeError in console"],
+    });
+    const context = `IRONBEE VERIFICATION — SESSION ACTIVE
+Session ID: ${sessionId}
+
+You MUST verify all code changes in the browser before completing any task.
+After EVERY verification attempt, you MUST submit a verdict BEFORE doing anything else.
+- If pass → submit pass verdict
+- If fail → submit fail verdict FIRST, then fix. Do NOT skip to fixing code without submitting.
+
+Submit via shell:
+  echo '${verdictPass}' | ironbee hook submit-verdict
+
+On fail (issues is required):
+  echo '${verdictFail}' | ironbee hook submit-verdict
+
+Required fields: session_id, status, checks
+On fail, include: issues (array of strings describing what failed)
+On pass after a previous fail, include: fixes (array of strings describing what was fixed)`;
+    (0, output_1.writeAndExit)(JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: "SessionStart",
+            additionalContext: context,
+        },
+    }), 0);
+}
+//# sourceMappingURL=session-start.js.map

package/dist/clients/codex/hooks/session-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start.js","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/session-start.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAYH,kBA+EC;AAzFD,yDAA2F;AAC3F,6CAAgE;AAChE,qEAAkG;AAClG,gDAAyE;AACzE,gDAAyD;AACzD,gDAAmD;AACnD,8CAA+C;AAC/C,sDAA2D;AAC3D,kCAA6E;AAEtE,KAAK,UAAU,GAAG,CAAC,UAAkB;IACxC,MAAM,KAAK,GAA2C,IAAA,0BAAmB,EAAC,IAAA,iBAAS,GAAE,CAAC,CAAC;IACvF,MAAM,SAAS,GAAW,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC;IACxD,MAAM,UAAU,GAAW,GAAG,UAAU,sBAAsB,SAAS,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAW,GAAG,UAAU,gBAAgB,CAAC;IAC1D,IAAA,mBAAU,EAAC,GAAG,UAAU,cAAc,CAAC,CAAC;IAExC,MAAM,KAAK,GAAe,IAAA,wBAAiB,GAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClB,IAAA,4BAAY,EAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IACD,IAAA,wBAAQ,EAAC,UAAU,EAAE;QACjB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAuB;QAC9B,GAAG,IAAA,oBAAU,EAAC,WAAW,CAAC;QAC1B,yEAAyE;QACzE,qEAAqE;QACrE,gEAAgE;QAChE,yCAAyC;QACzC,EAAE,EAAE,IAAA,+BAAyB,EAAC,SAAS,CAAC;QACxC,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;KACpC,CAAC;IAEF,MAAM,IAAA,sBAAY,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAA,qCAAqB,EAAC,UAAU,EAAE,WAAW,EAAE,sBAAY,CAAC,CAAC;IACnE,MAAM,mBAAmB,GAAY,IAAA,+BAAsB,EAAC,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC,CAAC;IACpF,MAAM,IAAA,6BAAiB,EAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC7E,eAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;IAE5C,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACvB,IAAA,qBAAY,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC;QACvC,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,CAAC,2BAA2B,EAAE,0BAA0B,CAAC;KACpE,CAAC,CAAC;IACH,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC;QACvC,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,CAAC,cAAc,EAAE,4BAA4B,CAAC;QACtD,MAAM,EAAE,CAAC,iCAAiC,EAAE,sBAAsB,CAAC;KACtE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAW;cACd,SAAS;;;;;;;;UAQb,WAAW;;;UAGX,WAAW;;;;2FAIsE,CAAC;IAExF,IAAA,qBAAY,EAAC,IAAI,CAAC,SAAS,CAAC;QACxB,kBAAkB,EAAE;YAChB,aAAa,EAAE,cAAc;YAC7B,iBAAiB,EAAE,OAAO;SAC7B;KACJ,CAAC,EAAE,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/clients/codex/hooks/track-action-monitor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Codex — PostToolUse hook adapter (monitoring-only mode, matcher: `.*`)
+ *
+ * Lean variant of track-action.ts for `verification.enable: false`. Submits
+ * a send_event job for every tool (no devtools-only path, no recording
+ * state, no actions.jsonl write for devtools). Also acts as activity-start
+ * fallback if no activity was opened yet.
+ */
+export declare function run(projectDir: string): Promise<void>;
+//# sourceMappingURL=track-action-monitor.d.ts.map

package/dist/clients/codex/hooks/track-action-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-action-monitor.d.ts","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/track-action-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyEH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8F3D"}

package/dist/clients/codex/hooks/track-action-monitor.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * Codex — PostToolUse hook adapter (monitoring-only mode, matcher: `.*`)
+ *
+ * Lean variant of track-action.ts for `verification.enable: false`. Submits
+ * a send_event job for every tool (no devtools-only path, no recording
+ * state, no actions.jsonl write for devtools). Also acts as activity-start
+ * fallback if no activity was opened yet.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const actions_1 = require("../../../hooks/core/actions");
+const ids_1 = require("../../../import/ids");
+const activity_1 = require("../../../hooks/core/activity");
+const session_state_1 = require("../../../hooks/core/session-state");
+const tool_use_stash_1 = require("../../../hooks/core/tool-use-stash");
+const config_1 = require("../../../lib/config");
+const logger_1 = require("../../../lib/logger");
+const output_1 = require("../../../lib/output");
+const stdin_1 = require("../../../lib/stdin");
+const queue_1 = require("../../../queue");
+const util_1 = require("../util");
+/** Same failure detection set as enabled-mode track-action.ts. Keep in sync. */
+function detectFailureMonitor(toolResponse) {
+    if (toolResponse === undefined || toolResponse === null) {
+        return { isError: false };
+    }
+    if (typeof toolResponse === "object" && toolResponse !== null) {
+        const rec = toolResponse;
+        if (rec.isError === true || rec.is_error === true) {
+            const msg = rec.error ?? rec.message ?? rec.errorMessage;
+            return { isError: true, errorText: typeof msg === "string" ? msg : JSON.stringify(rec).slice(0, 500) };
+        }
+    }
+    if (typeof toolResponse === "string") {
+        const t = toolResponse;
+        if (/(?:^|\n)Process exited with code [1-9]/.test(t)
+            || /^Exit code:\s*[1-9]/m.test(t)
+            || /apply_patch verification failed/i.test(t)
+            || /failed to find expected lines/i.test(t)
+            || /^\s*Error\b/.test(t)
+            || /(?:^|\n)\[Request interrupted by user\]/.test(t)
+            // Cross-pipeline parity with enabled-mode track-action.ts +
+            // projection.ts classifier — see comment there.
+            || /modified since (?:last )?read|stale read/i.test(t)
+            || /file (?:is )?too large|exceeds/i.test(t)
+            || /file not found|No such file or directory|does not exist/i.test(t)) {
+            return { isError: true, errorText: t.slice(0, 500) };
+        }
+    }
+    return { isError: false };
+}
+function safeStringifyBytes(value) {
+    if (value === undefined || value === null) {
+        return 0;
+    }
+    // Raw byte count for string values (apply_patch + exec_command output
+    // shape) — match enabled-mode track-action.ts + import runner.ts. Without
+    // this branch, monitoring mode emits 5-15% inflated tool_response_size
+    // vs import — same root as round-18 bug-5.
+    if (typeof value === "string") {
+        try {
+            return Buffer.byteLength(value, "utf8");
+        }
+        catch {
+            return 0;
+        }
+    }
+    try {
+        return Buffer.byteLength(JSON.stringify(value), "utf8");
+    }
+    catch {
+        return 0;
+    }
+}
+async function run(projectDir) {
+    const input = (0, util_1.parseCodexHookStdin)((0, stdin_1.readStdin)());
+    const sessionId = input.session_id ?? "default";
+    const sessionDir = `${projectDir}/.ironbee/sessions/${sessionId}`;
+    const actionsFile = `${sessionDir}/actions.jsonl`;
+    (0, logger_1.setLogFile)(`${sessionDir}/session.log`);
+    // activity-start fallback (in case UPS didn't fire)
+    await (0, activity_1.startActivity)({ sessionDir, actionsFile, source: "pre_tool_use" });
+    if (!(0, config_1.isJobQueueEnabled)(projectDir)) {
+        (0, output_1.writeAndExit)(JSON.stringify({}), 0);
+        return;
+    }
+    const rawToolName = input.tool_name ?? "";
+    const toolUseId = input.tool_use_id ?? "";
+    // tool_input is Record | string | undefined (apply_patch passes raw string)
+    const toolInput = input.tool_input;
+    const toolResponse = input.tool_response;
+    const classified = (0, util_1.classifyCodexTool)(rawToolName);
+    const activityId = (0, session_state_1.getActiveActivityId)(sessionDir);
+    const projectedInput = (0, util_1.extractCodexToolInput)(rawToolName, toolInput);
+    const stashed = (0, tool_use_stash_1.consumeToolUseData)(sessionId, toolUseId);
+    let durationMs = null;
+    if (stashed?.start_ns) {
+        try {
+            durationMs = Number((process.hrtime.bigint() - BigInt(stashed.start_ns)) / 1000000n);
+        }
+        catch (e) {
+            logger_1.logger.debug(`derive duration failed: ${e}`);
+        }
+    }
+    // Parallel-pipeline parity with enabled-mode track-action.ts: omit
+    // `activity_id` when no activity is open (Claude/Cursor live use
+    // `activityId!` → JSON.stringify drops; Codex was outlier shipping "").
+    // Collector schema rejects empty activity_id like it rejects empty fix_id.
+    // Cross-client parity: zero `tool_response_size` on failure to match
+    // Claude+Cursor (see enabled-mode track-action.ts for full rationale).
+    const failureMonitor = detectFailureMonitor(toolResponse);
+    const event = {
+        ...(0, actions_1.baseFields)(actionsFile),
+        type: "tool_call",
+        timestamp: Date.now(),
+        tool_type: classified.tool_type,
+        tool_name: classified.tool_name || (0, util_1.normalizeCodexToolName)(rawToolName),
+        mcp_server: classified.mcp_server,
+        tool_input: projectedInput,
+        tool_input_size: safeStringifyBytes(toolInput),
+        tool_response_size: failureMonitor.isError ? 0 : safeStringifyBytes(toolResponse),
+        duration: durationMs,
+    };
+    if (activityId) {
+        event.activity_id = activityId;
+    }
+    // Parallel-pipeline parity: enabled-mode track-action.ts (round 15)
+    // sets tool_use_id on both devtools + non-devtools branches.
+    // Monitoring mode (this file) was left behind. Without this, every
+    // tool_call emitted in monitoring mode ships without a join key →
+    // collector cannot correlate Codex tool_call events with MCP-side
+    // function_call_output events. Cross-mode parity break.
+    if (toolUseId) {
+        event.tool_use_id = toolUseId;
+    }
+    // Deterministic event.id parity with import (round 19 fix in
+    // enabled-mode track-action.ts). Monitoring mode previously emitted
+    // random UUID id → every tool_call duplicated on re-import.
+    if (toolUseId.length > 0) {
+        event.id = (0, ids_1.deriveToolCallEventIdFromToolUseId)(sessionId, toolUseId);
+    }
+    // Failure detection — enabled mode has `detectFailure`; monitoring
+    // mode previously emitted `error: undefined` for every failed tool
+    // → cross-mode parity break. Reuse the same `failureMonitor` computed
+    // for `tool_response_size` above.
+    if (failureMonitor.isError) {
+        event.error = failureMonitor.errorText;
+    }
+    try {
+        (0, queue_1.submit)(projectDir, sessionId, queue_1.SEND_EVENT_TYPE, event);
+    }
+    catch (e) {
+        if (e instanceof queue_1.JobTooLargeError) {
+            // Same rationale as enabled-mode track-action.ts: `tool_response`
+            // is never on the event in the first place, so an
+            // `tool_response_omitted: true` retry strips nothing and
+            // re-fails identically. Drop cleanly — matches Claude/Cursor
+            // monitor paths.
+            logger_1.logger.debug(`track-action-monitor: wire event too large for tool_call ${rawToolName}; dropping`);
+        }
+        else {
+            logger_1.logger.debug(`queue submit failed for tool_call ${rawToolName}: ${e}`);
+        }
+    }
+    (0, output_1.writeAndExit)(JSON.stringify({}), 0);
+}
+//# sourceMappingURL=track-action-monitor.js.map

package/dist/clients/codex/hooks/track-action-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-action-monitor.js","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/track-action-monitor.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAyEH,kBA8FC;AArKD,yDAAuF;AACvF,6CAAyE;AACzE,2DAA6D;AAC7D,qEAAwE;AACxE,uEAAwE;AACxE,gDAAwD;AACxD,gDAAyD;AACzD,gDAAmD;AACnD,8CAA+C;AAC/C,0CAA2E;AAC3E,kCAKiB;AAGjB,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,YAAqB;IAC/C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,GAAG,GAA4B,YAAuC,CAAC;QAC7E,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,GAAG,GAAY,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3G,CAAC;IACL,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAW,YAAY,CAAC;QAC/B,IAAI,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC;eAC7C,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;eAC9B,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;eAC1C,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;eACxC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;eACrB,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,4DAA4D;YAC5D,gDAAgD;eAC7C,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC;eACnD,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC;eACzC,0DAA0D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACzD,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,CAAC,CAAC;IACb,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,GAAG,CAAC,UAAkB;IACxC,MAAM,KAAK,GAA2C,IAAA,0BAAmB,EAAC,IAAA,iBAAS,GAAE,CAAC,CAAC;IACvF,MAAM,SAAS,GAAW,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC;IACxD,MAAM,UAAU,GAAW,GAAG,UAAU,sBAAsB,SAAS,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAW,GAAG,UAAU,gBAAgB,CAAC;IAC1D,IAAA,mBAAU,EAAC,GAAG,UAAU,cAAc,CAAC,CAAC;IAExC,oDAAoD;IACpD,MAAM,IAAA,wBAAa,EAAC,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAEzE,IAAI,CAAC,IAAA,0BAAiB,EAAC,UAAU,CAAC,EAAE,CAAC;QACjC,IAAA,qBAAY,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAW,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAW,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAClD,4EAA4E;IAC5E,MAAM,SAAS,GAAiD,KAAK,CAAC,UAAU,CAAC;IACjF,MAAM,YAAY,GAAY,KAAK,CAAC,aAAa,CAAC;IAClD,MAAM,UAAU,GAAyC,IAAA,wBAAiB,EAAC,WAAW,CAAC,CAAC;IACxF,MAAM,UAAU,GAAuB,IAAA,mCAAmB,EAAC,UAAU,CAAC,CAAC;IACvE,MAAM,cAAc,GAAwC,IAAA,4BAAqB,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAE1G,MAAM,OAAO,GAA4B,IAAA,mCAAkB,EAAmB,SAAS,EAAE,SAAS,CAAC,CAAC;IACpG,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAU,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IACjE,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,cAAc,GAA6C,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpG,MAAM,KAAK,GAAmB;QAC1B,GAAG,IAAA,oBAAU,EAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,IAAA,6BAAsB,EAAC,WAAW,CAAC;QACtE,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,UAAU,EAAE,cAAc;QAC1B,eAAe,EAAE,kBAAkB,CAAC,SAAS,CAAC;QAC9C,kBAAkB,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC;QACjF,QAAQ,EAAE,UAAU;KACL,CAAC;IACpB,IAAI,UAAU,EAAE,CAAC;QACb,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC;IACnC,CAAC;IACD,oEAAoE;IACpE,6DAA6D;IAC7D,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,wDAAwD;IACxD,IAAI,SAAS,EAAE,CAAC;QACZ,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC;IAClC,CAAC;IACD,6DAA6D;IAC7D,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,EAAE,GAAG,IAAA,wCAAkC,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACxE,CAAC;IACD,mEAAmE;IACnE,mEAAmE;IACnE,sEAAsE;IACtE,kCAAkC;IAClC,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;QACzB,KAAK,CAAC,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC;QACD,IAAA,cAAM,EAAC,UAAU,EAAE,SAAS,EAAE,uBAAe,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,wBAAgB,EAAE,CAAC;YAChC,kEAAkE;YAClE,kDAAkD;YAClD,yDAAyD;YACzD,6DAA6D;YAC7D,iBAAiB;YACjB,eAAM,CAAC,KAAK,CAAC,4DAA4D,WAAW,YAAY,CAAC,CAAC;QACtG,CAAC;aAAM,CAAC;YACJ,eAAM,CAAC,KAAK,CAAC,qCAAqC,WAAW,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IACD,IAAA,qBAAY,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/clients/codex/hooks/track-action-pre.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Codex — PreToolUse hook adapter (matcher: `.*`)
+ *
+ * Codex's PostToolUse stdin does NOT carry `duration_ms` like Claude/Cursor
+ * do. To populate `tool_call.duration` on the wire, we stash a monotonic
+ * `process.hrtime.bigint()` timestamp at PreToolUse keyed by `tool_use_id`,
+ * then derive the delta in the matching `track-action` PostToolUse handler.
+ *
+ * Hook overhead: ~30-60ms per side (cold node start). For tool calls < 100ms
+ * the duration field is dominated by overhead and not useful; for ≥1s calls
+ * accuracy is ~95-99%. Orphaned stash entries (interrupted tools whose
+ * PostToolUse never fires) are reaped by OS /tmp cleanup.
+ */
+export interface CodexTimingState {
+    start_ns: string;
+}
+export declare function run(projectDir: string): Promise<void>;
+//# sourceMappingURL=track-action-pre.d.ts.map

package/dist/clients/codex/hooks/track-action-pre.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-action-pre.d.ts","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/track-action-pre.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3D"}

package/dist/clients/codex/hooks/track-action-pre.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Codex — PreToolUse hook adapter (matcher: `.*`)
+ *
+ * Codex's PostToolUse stdin does NOT carry `duration_ms` like Claude/Cursor
+ * do. To populate `tool_call.duration` on the wire, we stash a monotonic
+ * `process.hrtime.bigint()` timestamp at PreToolUse keyed by `tool_use_id`,
+ * then derive the delta in the matching `track-action` PostToolUse handler.
+ *
+ * Hook overhead: ~30-60ms per side (cold node start). For tool calls < 100ms
+ * the duration field is dominated by overhead and not useful; for ≥1s calls
+ * accuracy is ~95-99%. Orphaned stash entries (interrupted tools whose
+ * PostToolUse never fires) are reaped by OS /tmp cleanup.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const logger_1 = require("../../../lib/logger");
+const stdin_1 = require("../../../lib/stdin");
+const tool_use_stash_1 = require("../../../hooks/core/tool-use-stash");
+const util_1 = require("../util");
+async function run(projectDir) {
+    const input = (0, util_1.parseCodexHookStdin)((0, stdin_1.readStdin)());
+    const sessionId = input.session_id ?? "";
+    const toolUseId = input.tool_use_id ?? "";
+    if (!sessionId || !toolUseId) {
+        process.exit(0);
+        return;
+    }
+    (0, logger_1.setLogFile)(`${projectDir}/.ironbee/sessions/${sessionId}/session.log`);
+    const state = { start_ns: process.hrtime.bigint().toString() };
+    (0, tool_use_stash_1.stashToolUseData)(sessionId, toolUseId, state);
+    logger_1.logger.debug(`track-action-pre: stashed start_ns for ${toolUseId}`);
+    process.exit(0);
+}
+//# sourceMappingURL=track-action-pre.js.map

package/dist/clients/codex/hooks/track-action-pre.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-action-pre.js","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/track-action-pre.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAWH,kBAaC;AAtBD,gDAAyD;AACzD,8CAA+C;AAC/C,uEAAsE;AACtE,kCAA8C;AAMvC,KAAK,UAAU,GAAG,CAAC,UAAkB;IACxC,MAAM,KAAK,GAA2C,IAAA,0BAAmB,EAAC,IAAA,iBAAS,GAAE,CAAC,CAAC;IACvF,MAAM,SAAS,GAAW,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAW,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACX,CAAC;IACD,IAAA,mBAAU,EAAC,GAAG,UAAU,sBAAsB,SAAS,cAAc,CAAC,CAAC;IACvE,MAAM,KAAK,GAAqB,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjF,IAAA,iCAAgB,EAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9C,eAAM,CAAC,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/clients/codex/hooks/track-action.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Codex — PostToolUse hook adapter (matcher: `.*`)
+ *
+ * Two routes per tool:
+ *   - **devtools MCP tools** (mcp__{browser,node,backend}-devtools__*): record
+ *     a `tool_call` entry in actions.jsonl (verify-gate dep), update recording
+ *     state for browser-devtools. NOT queue-submitted — devtools MCP server
+ *     self-ships its own tool_call events to the collector.
+ *   - **All other tools**: submit a `send_event` job to the queue with a
+ *     whitelisted `tool_input` projection.
+ *
+ * Codex-specific: derive `duration` from the timing stash written by
+ * `track-action-pre.ts` (Codex hook stdin does not carry duration_ms).
+ *
+ * Codex has NO PostToolUseFailure event — failures fold into PostToolUse
+ * with the error embedded in `tool_response`. We detect failure
+ * heuristically (looking for `isError: true` on MCP responses); the
+ * `failure_type` / `is_interrupt` fields stay null (Codex provides no
+ * structured failure schema).
+ */
+export declare function run(projectDir: string): Promise<void>;
+//# sourceMappingURL=track-action.d.ts.map

package/dist/clients/codex/hooks/track-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-action.d.ts","sourceRoot":"","sources":["../../../../src/clients/codex/hooks/track-action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAuIH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqN3D"}