@lyupro/codex-bridge 0.5.4 → 0.5.5

package/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.5] - 2026-08-28
+
+### Fixed
+
+- The write guard now reads quoting, so a redirect character inside a quoted argument is text rather
+  than an operator. While a delegated run held the repository, `sed -E 's#(A ).*#
<redacted>#'` was
+  refused as a write to a file named `#'`: the scan ran over raw text, so the `>` looked like a
+  redirect and the token after it looked like its destination. The file already carried a defence
+  against this class, added after a `node -e` expression was misread the same way, but that defence
+  filtered candidates holding characters no file name may contain and the one refused here held
+  none. The guard still fails closed: when quotes cannot be balanced the scan behaves exactly as
+  before, because answering "no write here" to a line it cannot parse would be worse than the false
+  refusal being removed.
+- The installation summary no longer reads as a bug. Four `PreToolUse` guards printed as
+  `PreToolUse and PreToolUse and PreToolUse and PreToolUse` because the sentence joined every hook's
+  event; it now groups by event and counts.
+- The installed-file count agrees with `doctor`. The summary counted the Codex rules file among the
+  files while `doctor` reports it on its own line, so `68` sat next to `67` and read as a lost file.
+- `Granted 0 permission rule(s)` no longer reports the good outcome as if it were a failure. When
+  the set is complete the summary says so; on a host whose settings were edited by hand it says how
+  many rules are missing and how to restore them, instead of claiming all are in place while the
+  operator gets permission windows. The already-installed branch reports the set by reading it —
+  granting there would have restored a deleted rule under the heading "nothing to do".
+- A contract probe that refuses to judge now carries the host's own words. `The host exited with
+  status 1.` was the entire account of a failure on a live host; the last non-empty line the host
+  printed is now part of the reason. What counts as honoured, ignored or inconclusive is unchanged.
+
 ## [0.5.4] - 2026-08-28
 
 ### Added

package/README.md

@@ -60,7 +60,7 @@ If a global install and a clone coexist, you have two package copies. `codex-bri
 - **Every run leaves an audit folder.** The verbatim task, scope, before/after git state, events, report, verdict, and reason remain together.
 - **Zero runtime dependencies and zero build steps.** The package is plain `.mjs` on the Node.js standard library.
 
-The current suite contains **809 automated tests: 808 passing and 1 skipped**.
+The current suite contains **817 automated tests: 816 passing and 1 skipped**.
 
 ## Verify
 

package/cli/install.mjs

@@ -25,7 +25,7 @@ import {
   withSettingsRun,
 } from './settings-merge.mjs';
 import { addRulesOwner, readRulesRegistry } from './rules-owners.mjs';
-import { addPermissionRules } from './permissions.mjs';
+import { addPermissionRules, inspectPermissions } from './permissions.mjs';
 import { contractStatus, detectHostVersion, readHostContract } from './host-contract.mjs';
 import { readRunConfig, retentionNotice } from '../src/home/lib/run-config.mjs';
 
@@ -61,6 +61,36 @@ function contractOutput(status, output) {
   return status.state === 'verified' ? output : `${output}\n${status.message}`;
 }
 
+function naturalList(items) {
+  if (items.length < 2) return items.join('');
+  return items.length === 2
+    ? items.join(' and ')
+    : `${items.slice(0, -1).join(', ')} and ${items.at(-1)}`;
+}
+
+function hookSummary(targets) {
+  const counts = new Map();
+  for (const { definition } of targets) {
+    counts.set(definition.event, (counts.get(definition.event) || 0) + 1);
+  }
+  const events = [...counts].map(([event, count]) => `${count} ${event}`);
+  return `${targets.length} hooks: ${naturalList(events)}`;
+}
+
+function permissionOutput(result, settingsPath) {
+  if (result.dryRun) return `Would evaluate permission rules in ${settingsPath}; settings unchanged.`;
+  if (result.added > 0) {
+    return `Granted ${result.added} of ${result.total} permission rule(s) in ${settingsPath} so the host runs the package command without asking.`;
+  }
+  // Zero granted is the good outcome only when the whole set is there. Saying "all are in place"
+  // off the count of what was added would state the opposite of the truth on a host someone had
+  // edited by hand, and permission windows are exactly what the operator would then not understand.
+  if (result.present < result.total) {
+    return `${result.present} of ${result.total} permission rules are in place in ${settingsPath}; run codex-bridge install --force to restore the rest.`;
+  }
+  return `All ${result.total} permission rules are already in place in ${settingsPath}, so the host runs the package command without asking.`;
+}
+
 async function migrateLegacySeed(host, seed) {
   if (await targetExists(seed.target)) return;
   const legacyName = path.basename(seed.target) === 'config.json' ? 'run-config.json' : path.basename(seed.target);
@@ -140,7 +170,22 @@ async function installInRun({
     { path: rule.target, fingerprint: ruleState.fingerprint });
   if (!changedFiles.length && !changedRule && inspectedHooks.every((state) => state.present)
     && recordHasHooks(record, targets) && sameRecord) {
-    if (!dryRun) await addRulesOwner(host);
+    if (!dryRun) {
+      await addRulesOwner(host);
+      // Read, never write: this branch's whole claim is that there is nothing to do, and a
+      // sentence about permission rules must not be paid for by quietly restoring one.
+      const permissionResult = await inspectPermissions(host.settingsPath);
+      return {
+        exitCode: 0,
+        output: contractOutput(
+          hostContract,
+          retentionOutput(
+            configuredRetentionLine,
+            `codex-bridge is already installed; nothing to do.\n${permissionOutput(permissionResult, host.settingsPath)}`,
+          ),
+        ),
+      };
+    }
     return {
       exitCode: 0,
       output: contractOutput(hostContract, retentionOutput(configuredRetentionLine, 'codex-bridge is already installed; nothing to do.')),
@@ -185,7 +230,9 @@ async function installInRun({
   // it goes looking for a way around, down to the absolute path to run-codex.mjs that Plan_41
   // removed. The rule follows the scope of the install, because host.settingsPath already is the
   // scope — a --scope project install must not reach into the operator's global config.
-  const permissionResult = dryRun ? { added: 0 } : await addPermissionRules(host.settingsPath);
+  const permissionResult = dryRun
+    ? { dryRun: true, added: 0, present: 0, total: 0 }
+    : await addPermissionRules(host.settingsPath);
   const fingerprints = {};
   for (const item of plan) {
     fingerprints[item.root] ??= {};
@@ -220,8 +267,8 @@ async function installInRun({
       hostContract,
       retentionOutput(
         configuredRetentionLine,
-        `Installed ${plan.length + 1} files and registered the ${targets.map(({ definition }) => definition.event).join(' and ')} hooks.`
-          + `\nGranted ${permissionResult.added} permission rule(s) in ${host.settingsPath} so the host runs the package command without asking.`,
+        `Installed ${plan.length} files and the Codex rules file, and registered ${hookSummary(targets)}.`
+          + `\n${permissionOutput(permissionResult, host.settingsPath)}`,
       ),
     ),
   };

package/cli/permissions.mjs

@@ -108,7 +108,13 @@ export async function addPermissionRules(settingsPath) {
         added += 1;
       }
     }
-    return { changed: added > 0, added };
+    const status = permissionStatus(settings);
+    return {
+      changed: added > 0,
+      added,
+      present: status.present,
+      total: status.total,
+    };
   });
 }
 

package/cli/probe-contract.mjs

@@ -23,6 +23,10 @@ const exists = async (target) => {
   }
 };
 
+function lastNonEmptyLine(output) {
+  return String(output ?? '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean).at(-1);
+}
+
 export function judgeProbe({ markerExists, hookFired, hostResult }) {
   if (markerExists) {
     return { result: 'ignored', reason: 'The marker command ran despite the hook refusal.' };
@@ -41,7 +45,9 @@ export function judgeProbe({ markerExists, hookFired, hostResult }) {
     return { result: null, reason: `The host was terminated by signal ${hostResult.signal}.` };
   }
   if (hostResult.status !== 0) {
-    return { result: null, reason: `The host exited with status ${String(hostResult.status)}.` };
+    const output = lastNonEmptyLine(hostResult.stderr) || lastNonEmptyLine(hostResult.stdout);
+    const detail = output ? `: ${output.slice(0, 200)}` : '';
+    return { result: null, reason: `The host exited with status ${String(hostResult.status)}${detail}.` };
   }
   if (!hookFired) {
     return { result: null, reason: 'The probe hook never received the marker command.' };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.5.4",
-  "description": "Claude Code-to-Codex delegation with 6 guards, 809 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.5.5",
+  "description": "Claude Code-to-Codex delegation with 6 guards, 817 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",

package/src/home/hooks/shell-write-intent.mjs

@@ -32,13 +32,40 @@ function addPath(paths, value) {
     && !paths.includes(candidate)) paths.push(candidate);
 }
 
-function tokens(segment) {
-  return segment.match(/"(?:\\.|[^"])*"|'[^']*'|[^\s]+/g) ?? [];
-}
-
-function positional(args) {
-  return args.filter((arg) => !arg.startsWith('-'));
-}
+function tokens(segment) {
+  return segment.match(/"(?:\\.|[^"])*"|'[^']*'|[^\s]+/g) ?? [];
+}
+
+// A `>` inside a quoted argument is text, not a redirect. The 2026-08-28 worktree-lock refusal
+// named `#'` from `sed -E 's#(A ).*#\1<redacted>#'` because this scan previously read raw text.
+function quotedCharacters(command) {
+  const quoted = new Uint8Array(command.length);
+  let quote = null;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (quote === "'") {
+      if (character === "'") quote = null;
+      else quoted[index] = 1;
+    } else if (quote === '"') {
+      if (character === '\\' && index + 1 < command.length) {
+        quoted[index] = 1;
+        quoted[index + 1] = 1;
+        index += 1;
+      } else if (character === '"') quote = null;
+      else quoted[index] = 1;
+    } else if (character === '\\' && index + 1 < command.length) {
+      index += 1;
+    } else if (character === "'" || character === '"') {
+      quote = character;
+      quoted[index] = 1;
+    }
+  }
+  return quote ? null : quoted;
+}
+
+function positional(args) {
+  return args.filter((arg) => !arg.startsWith('-'));
+}
 
 /**
  * Strip the directory and the Windows executable suffix before matching the command name.
@@ -83,14 +110,16 @@ function heredoc(command) {
 export function shellWriteIntent(command) {
   if (typeof command !== 'string' || !command.trim()) return { writes: false, paths: [] };
   const paths = [];
-  const document = heredoc(command);
-  const shell = document?.header ?? command;
-  let writes = document?.writes ?? false;
-
-  for (const match of shell.matchAll(/(?<![<>=])(?:\d*)>>?(?![=>&])\s*("(?:\\.|[^"])*"|'[^']*'|[^\s;|&]+)/g)) {
-    writes = true;
-    addPath(paths, match[1]);
-  }
+  const document = heredoc(command);
+  const shell = document?.header ?? command;
+  let writes = document?.writes ?? false;
+  const quoted = quotedCharacters(shell);
+
+  for (const match of shell.matchAll(/(?<![<>=])(?:\d*)>>?(?![=>&])\s*("(?:\\.|[^"])*"|'[^']*'|[^\s;|&]+)/g)) {
+    if (quoted && quoted[match.index]) continue;
+    writes = true;
+    addPath(paths, match[1]);
+  }
 
   // A real output redirect identifies the writer's destination. Body text is only evidence when
   // the interpreter itself is the writer, as in the 2026-08-16 python heredoc incident.