@kylecheng3146/agent-ops 0.1.5 → 0.1.7

package/dist/packages/cli/src/context.js

@@ -79,6 +79,66 @@ export async function loadEffectiveConfig(root, scope) {
     }
     return mergeConfigLayers(layers);
 }
+/**
+ * Classifies only configuration that can participate in a project hook. The
+ * regular command loader intentionally keeps its throwing contract so CLI
+ * commands continue to surface configuration errors to the human.
+ */
+export async function loadProjectHookConfig(root) {
+    const home = process.env.AGENT_OPS_HOME ?? homedir();
+    const userPath = join(home, ".agent-ops", "config.json");
+    const projectPath = join(root, ".agent-ops", "config.json");
+    const layers = [defaultConfigLayer()];
+    let project;
+    try {
+        project = await loadOptionalConfig(projectPath);
+    }
+    catch {
+        return { kind: "invalid", path: projectPath };
+    }
+    if (project === null && projectPath === userPath) {
+        return { kind: "absent", config: DEFAULT_CONFIG };
+    }
+    if (projectPath !== userPath) {
+        try {
+            const user = await loadOptionalConfig(userPath);
+            if (user !== null) {
+                layers.push({
+                    source: "user",
+                    sourcePath: user.sourcePath,
+                    config: user.config
+                });
+            }
+        }
+        catch {
+            // A user-level error cannot make a project with no own config deny a
+            // tool call, but it remains a classified failure for an installed
+            // project that does own a config.
+            return project === null
+                ? { kind: "absent", config: DEFAULT_CONFIG }
+                : { kind: "invalid", path: userPath };
+        }
+    }
+    if (project === null) {
+        try {
+            return { kind: "absent", config: mergeConfigLayers(layers).config };
+        }
+        catch {
+            return { kind: "absent", config: DEFAULT_CONFIG };
+        }
+    }
+    layers.push({
+        source: "project",
+        sourcePath: project.sourcePath,
+        config: project.config
+    });
+    try {
+        return { kind: "loaded", config: mergeConfigLayers(layers).config };
+    }
+    catch {
+        return { kind: "invalid", path: projectPath };
+    }
+}
 export function repositoryRemoteUrl(root) {
     try {
         return execFileSync("git", ["config", "--get", "remote.origin.url"], {

package/dist/packages/cli/src/hook-process.js

@@ -1,14 +1,21 @@
 import { execFile as execFileCallback } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { join } from "node:path";
 import { promisify } from "node:util";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
+import { parseInstallManifest, PROJECT_MANIFEST_PATH } from "../../../runtime/src/fs/manifest.js";
+import { resolveContainedPath } from "../../../runtime/src/fs/paths.js";
+import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { claudeStopRecursionMarker } from "../../../runtime/src/adapters/claude/input.js";
 import { HARNESS_IDS, harnessDescriptor } from "../../../runtime/src/install/harness.js";
 import { STOP_VERIFICATION_ENV, StopVerificationService } from "../../../runtime/src/hooks/stop-service.js";
 import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
-import { runHookCommand, HOOK_EVENTS } from "./commands/hook.js";
-import { loadEffectiveConfig, repositoryTrust } from "./context.js";
+import { normalizeHookInput, runHookCommand, HOOK_EVENTS } from "./commands/hook.js";
+import { loadProjectHookConfig, repositoryTrust } from "./context.js";
 const HARNESSES = new Set(HARNESS_IDS);
 const MAX_HOOK_INPUT_BYTES = 1024 * 1024;
+const MAX_HOOK_MANIFEST_BYTES = 1024 * 1024;
 const execFile = promisify(execFileCallback);
 async function readStdin(stream) {
     const chunks = [];
@@ -33,6 +40,99 @@ function parseInput(source) {
         return null;
     }
 }
+function writeHookOutput(io, output) {
+    if (output.stdout.length > 0) {
+        io.writeStdout(output.stdout);
+    }
+    if (output.stderr.length > 0) {
+        io.writeStderr(output.stderr);
+    }
+}
+function failOpenOutput(harness, event) {
+    return harnessDescriptor(harness).runtime.formatOutput(event, {
+        action: "continue",
+        status: "PASS",
+        code: "HOOK_FAIL_OPEN"
+    });
+}
+async function readInstalledManifestForHarness(root, harness) {
+    try {
+        const path = await resolveContainedPath(root, PROJECT_MANIFEST_PATH);
+        const before = await lstat(path, { bigint: true });
+        if (!before.isFile() ||
+            before.size > BigInt(MAX_HOOK_MANIFEST_BYTES)) {
+            return false;
+        }
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const opened = await handle.stat({ bigint: true });
+            const resolvedAgain = await resolveContainedPath(root, PROJECT_MANIFEST_PATH);
+            const after = await lstat(resolvedAgain, { bigint: true });
+            if (!opened.isFile() ||
+                opened.size > BigInt(MAX_HOOK_MANIFEST_BYTES) ||
+                after.dev !== before.dev ||
+                after.ino !== before.ino) {
+                return false;
+            }
+            const chunks = [];
+            let totalBytes = 0;
+            while (totalBytes <= MAX_HOOK_MANIFEST_BYTES) {
+                const chunk = Buffer.alloc(Math.min(64 * 1024, MAX_HOOK_MANIFEST_BYTES + 1 - totalBytes));
+                const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+                if (bytesRead === 0) {
+                    return parseInstallManifest(Buffer.concat(chunks, totalBytes).toString("utf8")).harness.includes(harness);
+                }
+                chunks.push(chunk.subarray(0, bytesRead));
+                totalBytes += bytesRead;
+            }
+            return false;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return false;
+    }
+}
+async function hookConfigOutcome(root, loadConfig) {
+    if (loadConfig === undefined) {
+        return await loadProjectHookConfig(root);
+    }
+    try {
+        return { kind: "loaded", config: await loadConfig(root) };
+    }
+    catch {
+        return {
+            kind: "invalid",
+            path: join(root, ".agent-ops", "config.json")
+        };
+    }
+}
+async function invalidConfigOutput(options) {
+    const descriptor = harnessDescriptor(options.harness);
+    const normalized = normalizeHookInput(options.harness, options.input);
+    if (normalized === null) {
+        return failOpenOutput(options.harness, options.event);
+    }
+    if (options.event !== "PreToolUse" ||
+        normalized.event !== "command" ||
+        !(await readInstalledManifestForHarness(options.root, options.harness))) {
+        return failOpenOutput(options.harness, options.event);
+    }
+    const registration = descriptor.control.registrations.find(({ nativeEvent, normalizedEvent }) => nativeEvent === options.event && normalizedEvent === normalized.event);
+    if (registration === undefined || registration.runtimeFailure === "fail-open") {
+        return failOpenOutput(options.harness, options.event);
+    }
+    if (options.harness === "opencode" &&
+        registration.runtimeFailure === "fail-closed") {
+        // The generated OpenCode plugin already turns an unavailable runtime into
+        // its documented blocking error. Keep that contract in the shim.
+        return undefined;
+    }
+    const remedy = `Fix ${redactSecrets(options.configPath)}, or set AGENT_OPS_DISABLE=1 in your shell to temporarily disable agent-ops.`;
+    return descriptor.runtime.formatRuntimeFailure(options.event, registration.capability, remedy);
+}
 function defaultGitRunner(root) {
     return {
         run: async (args) => {
@@ -109,18 +209,36 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
     }
     try {
         const root = dependencies.root ?? process.cwd();
-        const config = dependencies.loadConfig === undefined
-            ? (await loadEffectiveConfig(root, "project")).config
-            : await dependencies.loadConfig(root);
+        const harnessId = harness;
+        const hookEvent = event;
+        if (process.env.AGENT_OPS_DISABLE === "1") {
+            writeHookOutput(io, failOpenOutput(harnessId, hookEvent));
+            return 0;
+        }
+        const rawInput = await readStdin(io.stdin);
+        const parsedInput = parseInput(rawInput);
+        const configOutcome = await hookConfigOutcome(root, dependencies.loadConfig);
+        if (configOutcome.kind === "invalid") {
+            const output = await invalidConfigOutput({
+                root,
+                harness: harnessId,
+                event: hookEvent,
+                input: parsedInput,
+                configPath: configOutcome.path
+            });
+            if (output !== undefined) {
+                writeHookOutput(io, output);
+            }
+            return 0;
+        }
+        const config = configOutcome.config;
         const trustStatus = dependencies.trust === undefined
             ? await repositoryTrust(root, config, cliVersion)
             : await dependencies.trust(root, config, cliVersion);
-        const rawInput = await readStdin(io.stdin);
-        const parsedInput = parseInput(rawInput);
         const trusted = trustStatus === "TRUSTED";
         const gitRunner = dependencies.gitRunner ?? defaultGitRunner(root);
         const processRunner = dependencies.processRunner ?? new NodeVerificationProcessRunner();
-        const stopVerification = shouldBuildStopVerification(harness, event, config, parsedInput)
+        const stopVerification = shouldBuildStopVerification(harnessId, event, config, parsedInput)
             ? stopVerificationOptions({
                 harness: harness,
                 rawInput: parsedInput,
@@ -133,7 +251,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             : undefined;
         const output = await runHookCommand({
             harness: harness,
-            event: event,
+            event: hookEvent,
             stdin: rawInput,
             config,
             trusted,
@@ -142,12 +260,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                 : { advisory: dependencies.advisory }),
             ...(stopVerification === undefined ? {} : { stopVerification })
         });
-        if (output.stdout.length > 0) {
-            io.writeStdout(output.stdout);
-        }
-        if (output.stderr.length > 0) {
-            io.writeStderr(output.stderr);
-        }
+        writeHookOutput(io, output);
     }
     catch {
         // ponytail: fail-open by design; hook failures stay invisible to the harness.

package/dist/packages/cli/src/loop-entry.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// Entry point used only by the generated project-local loop launchers.
+import { runLoopProcess } from "./codex-loop-process.js";
+process.exitCode = await runLoopProcess(process.argv.slice(2), {
+    stdin: process.stdin,
+    writeStdout: (value) => process.stdout.write(value),
+    writeStderr: (value) => process.stderr.write(value)
+});

package/dist/packages/cli/src/version.js

@@ -1,3 +1,3 @@
 // Single source of the published CLI version. Release preparation updates
 // this constant; bin.ts and the hook entry both read it from here.
-export const CLI_VERSION = "0.1.5";
+export const CLI_VERSION = "0.1.7";

package/dist/packages/cli/src/wizard.js

@@ -1,9 +1,49 @@
 import { CliArgumentError } from "./args.js";
+import { DEFAULT_REVIEW_TARGETS } from "../../../runtime/src/review/roles.js";
 import { HARNESS_IDS, resolveHarnessSelection } from "../../../runtime/src/install/harness.js";
 import { selectOption, selectOptions } from "./ui.js";
 const SCOPES = new Set(["project", "user"]);
-const PROFILES = new Set(["advisory", "core", "guardrails"]);
+const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
 const DEFAULT_HARNESS = [];
+const REVIEW_TARGET_SET = new Set(DEFAULT_REVIEW_TARGETS);
+const REVIEW_TARGET_CHOICES = DEFAULT_REVIEW_TARGETS.map((id) => ({
+    label: id,
+    value: id,
+    description: id === "codex"
+        ? "Runs with -s read-only; stdout is the bare final message."
+        : id === "agy"
+            ? "Antigravity CLI; runs with --sandbox --mode plan."
+            : "Runs with --permission-mode plan; tried last when it is the host."
+}));
+function selectReviewTargets(raw) {
+    const values = raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    for (const value of values) {
+        if (!REVIEW_TARGET_SET.has(value)) {
+            throw new CliArgumentError("CLI_INVALID_VALUE", `Invalid review target: ${value}`, "--review-target");
+        }
+    }
+    // Declared order wins: the chain order is the option list, not click order.
+    return DEFAULT_REVIEW_TARGETS.filter((target) => values.includes(target));
+}
+function affirmative(raw) {
+    return /^(y|yes)$/i.test(raw.trim());
+}
+async function probeReviewTargets(targets, setup) {
+    const probe = setup.probeReviewTarget;
+    if (probe === undefined) {
+        return;
+    }
+    for (const target of targets) {
+        if (!(await probe(target))) {
+            setup.warn?.(`${target} is not usable yet (missing or unauthenticated). ` +
+                `Install it or run: ${target} login, ` +
+                "then: agent-ops doctor --check-auth");
+        }
+    }
+}
 const SCOPE_CHOICES = [
     { label: "project", value: "project" },
     { label: "user", value: "user" }
@@ -24,6 +64,11 @@ const PROFILE_CHOICES = [
         label: "guardrails",
         value: "guardrails",
         description: "Blocks high-confidence unsafe commands; Stop verification is a separate opt-in feature."
+    },
+    {
+        label: "loop",
+        value: "loop",
+        description: "Installs the shared Codex and Claude Code local loop with secret and destructive-command interception."
     }
 ];
 const WIZARD_SUBTITLE = "Safe setup for Codex, Claude Code, and opencode with profile-driven rules, verification, and hooks.";
@@ -74,11 +119,11 @@ function selectProfiles(raw) {
     if (values.length === 0 ||
         values.some((value) => !PROFILES.has(value)) ||
         new Set(values).size !== values.length) {
-        throw new CliArgumentError("CLI_INVALID_VALUE", "Profiles must be a unique comma-separated list of core, advisory, or guardrails.");
+        throw new CliArgumentError("CLI_INVALID_VALUE", "Profiles must be a unique comma-separated list of core, advisory, guardrails, or loop.");
     }
     return values;
 }
-export async function completeInitChoices(args, io) {
+export async function completeInitChoices(args, io, setup = {}) {
     if (args.command !== "init" ||
         (args.scope !== undefined &&
             args.harness !== undefined &&
@@ -110,13 +155,27 @@ export async function completeInitChoices(args, io) {
             : await selectOptions("Profiles (multi-select: ↑↓ move, Space toggle, Enter confirm)", PROFILE_CHOICES, selectorIo, [], {
                 selectAll: true,
                 selectAllLabel: "Select all",
-                selectAllDescription: "Enable core, advisory, and guardrails together."
+                selectAllDescription: "Enable core, advisory, guardrails, and loop together."
             });
+        const enabled = args.reviewTargets !== undefined ||
+            (await selectOption("External review: call another agent CLI to review your work?", [
+                { label: "no", value: false, description: "Default. Nothing is spawned." },
+                {
+                    label: "yes",
+                    value: true,
+                    description: "Pick target CLIs; each is probed for authentication."
+                }
+            ], selectorIo));
+        const reviewTargets = args.reviewTargets ?? (enabled
+            ? await selectOptions("Review targets (multi-select: tried in listed order)", REVIEW_TARGET_CHOICES, selectorIo, [])
+            : []);
+        await probeReviewTargets(reviewTargets, setup);
         return {
             ...args,
             scope,
             harness,
-            profiles
+            profiles,
+            ...(reviewTargets.length === 0 ? {} : { reviewTargets })
         };
     }
     const session = await createPromptSession(io);
@@ -127,12 +186,17 @@ export async function completeInitChoices(args, io) {
             selectHarness(await session.question(`Harness (${HARNESS_IDS.join(",")}): `));
         const profiles = args.profiles.length > 0
             ? args.profiles
-            : selectProfiles(await session.question("Profiles (core,advisory,guardrails) [core]: "));
+            : selectProfiles(await session.question("Profiles (core,advisory,guardrails,loop) [core]: "));
+        const reviewTargets = args.reviewTargets ?? (affirmative(await session.question("Enable external review by another agent CLI? [y/N]: "))
+            ? selectReviewTargets(await session.question(`Review targets (${DEFAULT_REVIEW_TARGETS.join(",")}): `))
+            : []);
+        await probeReviewTargets(reviewTargets, setup);
         return {
             ...args,
             scope,
             harness,
-            profiles
+            profiles,
+            ...(reviewTargets.length === 0 ? {} : { reviewTargets })
         };
     }
     finally {

package/dist/runtime/src/adapters/claude/config.js

@@ -1,4 +1,17 @@
 import { AgentOpsError } from "../../fs/paths.js";
+const CLAUDE_LOOP_EVENTS = [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PreCompact",
+    "PostCompact",
+    "SubagentStart",
+    "SubagentStop"
+];
+const CLAUDE_HOOK_MARKER = "--managed-by=agent-ops";
+const CLAUDE_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.sh";
 export function claudeSettingsTarget(scope) {
     return scope === "project"
         ? {
@@ -18,7 +31,7 @@ function commandHook(event, runtimePath) {
             runtimePath,
             "claude",
             event,
-            "--managed-by=agent-ops"
+            CLAUDE_HOOK_MARKER
         ],
         timeout: 30
     };
@@ -29,6 +42,25 @@ function matcherGroup(event, runtimePath) {
         hooks: [commandHook(event, runtimePath)]
     };
 }
+function loopMatcherGroup(event) {
+    return {
+        ...(event === "PreToolUse" || event === "PermissionRequest"
+            ? { matcher: "Bash" }
+            : {}),
+        hooks: [
+            {
+                type: "command",
+                command: "bash",
+                args: [
+                    CLAUDE_LOOP_LAUNCHER,
+                    event,
+                    CLAUDE_HOOK_MARKER
+                ],
+                timeout: 30
+            }
+        ]
+    };
+}
 export function buildClaudeHookSettings(capabilities, runtimePath) {
     if (runtimePath.length === 0 ||
         runtimePath.length > 4096 ||
@@ -36,11 +68,18 @@ export function buildClaudeHookSettings(capabilities, runtimePath) {
         throw new AgentOpsError("CLAUDE_HOOK_PATH_INVALID", "Claude hook runtime path is invalid.");
     }
     const hooks = {};
-    if (capabilities.includes("lifecycle-summary")) {
-        hooks.SessionStart = [matcherGroup("SessionStart", runtimePath)];
+    if (capabilities.includes("project-loop")) {
+        for (const event of CLAUDE_LOOP_EVENTS) {
+            hooks[event] = [loopMatcherGroup(event)];
+        }
     }
-    if (capabilities.includes("command-policy")) {
-        hooks.PreToolUse = [matcherGroup("PreToolUse", runtimePath)];
+    else {
+        if (capabilities.includes("lifecycle-summary")) {
+            hooks.SessionStart = [matcherGroup("SessionStart", runtimePath)];
+        }
+        if (capabilities.includes("command-policy")) {
+            hooks.PreToolUse = [matcherGroup("PreToolUse", runtimePath)];
+        }
     }
     if (capabilities.includes("optional-stop-verify")) {
         hooks.Stop = [matcherGroup("Stop", runtimePath)];
@@ -50,19 +89,26 @@ export function buildClaudeHookSettings(capabilities, runtimePath) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isOwnedHandler(handler) {
-    if (!isRecord(handler) ||
-        handler.command !== "node" ||
-        !Array.isArray(handler.args)) {
+/**
+ * Matches only the two command shapes agent-ops actually generates. This is
+ * reused by installation inspection so a foreign hook cannot masquerade as
+ * ours merely by carrying the marker string.
+ */
+export function isClaudeManagedHandler(handler) {
+    if (!isRecord(handler) || !Array.isArray(handler.args)) {
         return false;
     }
-    return handler.args[3] === "--managed-by=agent-ops";
+    return ((handler.command === "node" &&
+        handler.args[3] === CLAUDE_HOOK_MARKER) ||
+        (handler.command === "bash" &&
+            handler.args[0] === CLAUDE_LOOP_LAUNCHER &&
+            handler.args[2] === CLAUDE_HOOK_MARKER));
 }
 function withoutOwnedHandlers(value) {
     if (!isRecord(value) || !Array.isArray(value.hooks)) {
         return value;
     }
-    const hooks = value.hooks.filter((handler) => !isOwnedHandler(handler));
+    const hooks = value.hooks.filter((handler) => !isClaudeManagedHandler(handler));
     return hooks.length === 0 ? null : { ...value, hooks };
 }
 function hookRecord(settings) {

package/dist/runtime/src/adapters/claude/events.js

@@ -1,6 +1,13 @@
 export const CLAUDE_SUPPORTED_EVENTS = [
     "SessionStart",
+    "UserPromptSubmit",
     "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PreCompact",
+    "PostCompact",
+    "SubagentStart",
+    "SubagentStop",
     "Stop"
 ];
 export function claudeNonInteractiveTrust(printMode) {

package/dist/runtime/src/adapters/claude/output.js

@@ -6,6 +6,7 @@ function json(value) {
     };
 }
 export function claudeHookOutput(event, result) {
+    const denialReason = result.remedy === undefined ? result.code : `${result.code}: ${result.remedy}`;
     if (event === "Stop" && result.evidence !== undefined) {
         return json({
             systemMessage: `agent-ops: ${result.code}`,
@@ -20,7 +21,7 @@ export function claudeHookOutput(event, result) {
             hookSpecificOutput: {
                 hookEventName: "PreToolUse",
                 permissionDecision: "deny",
-                permissionDecisionReason: result.code
+                permissionDecisionReason: denialReason
             }
         });
     }

package/dist/runtime/src/adapters/codex/config.js

@@ -1,5 +1,16 @@
 import { AgentOpsError } from "../../fs/paths.js";
 export const CODEX_MANAGED_MARKER = "--managed-by=agent-ops";
+const CODEX_LOOP_EVENTS = [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PreCompact",
+    "PostCompact",
+    "SubagentStart",
+    "SubagentStop"
+];
 /**
  * Releases up to 0.1.4 registered a bare `agent-ops` command resolved through
  * PATH. Detection still recognizes it so an update replaces it instead of
@@ -35,6 +46,23 @@ function matcherGroup(event, runtimePath) {
         hooks: [commandHook(event, runtimePath)]
     };
 }
+function loopMatcherGroup(event) {
+    const command = `bash "$(git rev-parse --show-toplevel)/.codex/hooks/agent-ops-loop.sh" ${event} ${CODEX_MANAGED_MARKER}`;
+    return {
+        ...(event === "PreToolUse" || event === "PermissionRequest"
+            ? { matcher: "^Bash$" }
+            : {}),
+        hooks: [
+            {
+                type: "command",
+                command,
+                commandWindows: command,
+                timeout: 30,
+                statusMessage: `Running agent-ops ${event}`
+            }
+        ]
+    };
+}
 export function codexHookTarget(scope) {
     return {
         path: ".codex/hooks.json",
@@ -45,11 +73,18 @@ export function codexHookTarget(scope) {
 export function buildCodexHookConfig(capabilities, runtimePath) {
     assertRuntimePath(runtimePath);
     const hooks = {};
-    if (capabilities.includes("lifecycle-summary")) {
-        hooks.SessionStart = [matcherGroup("SessionStart", runtimePath)];
+    if (capabilities.includes("project-loop")) {
+        for (const event of CODEX_LOOP_EVENTS) {
+            hooks[event] = [loopMatcherGroup(event)];
+        }
     }
-    if (capabilities.includes("command-policy")) {
-        hooks.PreToolUse = [matcherGroup("PreToolUse", runtimePath)];
+    else {
+        if (capabilities.includes("lifecycle-summary")) {
+            hooks.SessionStart = [matcherGroup("SessionStart", runtimePath)];
+        }
+        if (capabilities.includes("command-policy")) {
+            hooks.PreToolUse = [matcherGroup("PreToolUse", runtimePath)];
+        }
     }
     if (capabilities.includes("optional-stop-verify")) {
         hooks.Stop = [matcherGroup("Stop", runtimePath)];

package/dist/runtime/src/adapters/codex/events.js

@@ -1,6 +1,13 @@
 export const CODEX_SUPPORTED_EVENTS = [
     "SessionStart",
+    "UserPromptSubmit",
     "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PreCompact",
+    "PostCompact",
+    "SubagentStart",
+    "SubagentStop",
     "Stop"
 ];
 export function codexMatcherSupport(event) {

package/dist/runtime/src/config/merge.js

@@ -107,6 +107,7 @@ export function mergeConfigLayers(inputLayers) {
     const commands = new Map();
     const mappings = new Map();
     const exceptions = new Map();
+    const reviewRoles = new Map();
     let schemaVersion;
     let features;
     for (const layer of layers) {
@@ -128,6 +129,12 @@ export function mergeConfigLayers(inputLayers) {
             }
             mappings.set(key, effective(mapping, layer));
         }
+        // Keyed by role so a project can override one role without inheriting the
+        // rest. Review targets are a capability choice, not a guardrail, so no
+        // monotonic restriction applies.
+        for (const reviewRole of layer.config.reviewRoles ?? []) {
+            reviewRoles.set(reviewRole.role, effective(reviewRole, layer));
+        }
         for (const securityException of layer.config.securityExceptions) {
             const key = exceptionKey(securityException);
             const existing = exceptions.get(key);
@@ -150,7 +157,8 @@ export function mergeConfigLayers(inputLayers) {
         profiles: [...profiles.values()],
         verificationCommands: [...commands.values()],
         pathMappings: [...mappings.values()],
-        securityExceptions: [...exceptions.values()]
+        securityExceptions: [...exceptions.values()],
+        reviewRoles: [...reviewRoles.values()]
     };
     const config = {
         schemaVersion: schemaVersion.value,
@@ -160,7 +168,14 @@ export function mergeConfigLayers(inputLayers) {
         },
         features: provenance.features.value,
         pathMappings: provenance.pathMappings.map(({ value }) => value),
-        securityExceptions: provenance.securityExceptions.map(({ value }) => value)
+        securityExceptions: provenance.securityExceptions.map(({ value }) => value),
+        // Absent, not empty: an empty array would read as "configured with no
+        // targets" rather than "external review disabled".
+        ...(provenance.reviewRoles.length === 0
+            ? {}
+            : {
+                reviewRoles: provenance.reviewRoles.map(({ value }) => value)
+            })
     };
     const validation = validateConfig(config);
     if (!validation.ok) {