@lyupro/codex-bridge 0.6.8 → 0.6.10

package/cli/settings-merge.mjs

@@ -1,11 +1,11 @@
 /** Merges and removes named codex-bridge hooks without disturbing host settings. */
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { spawnSync } from 'node:child_process';
-import { existsSync, statSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { readJsonFileWithRaw } from '../src/home/lib/json-file.mjs';
+import { envValue, resolveCommandOnPath } from '../src/home/lib/command-path.mjs';
 
 const LEGACY_SPEC = { event: 'SubagentStop', matcher: '*' };
 const settingsRuns = new AsyncLocalStorage();
@@ -18,34 +18,8 @@ export function shortCommandFor(name) {
   return `codex-bridge hook ${name}`;
 }
 
-function envValue(env, name) {
-  const key = Object.keys(env).find((entry) => entry.toLowerCase() === name);
-  return key ? env[key] : '';
-}
-
-function pathValue(env) {
-  return envValue(env, 'path');
-}
-
-function resolveCommand(name, env) {
-  const extensions = process.platform === 'win32'
-    ? (env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';')
-    : [''];
-  for (const directory of pathValue(env).split(path.delimiter).filter(Boolean)) {
-    for (const extension of extensions) {
-      const candidate = path.join(path.resolve(directory), `${name}${extension}`);
-      try {
-        if (existsSync(candidate) && statSync(candidate).isFile()) return candidate;
-      } catch {
-        continue;
-      }
-    }
-  }
-  return null;
-}
-
 export function commandReachable(name = 'codex-bridge', env = process.env) {
-  return Boolean(resolveCommand(name, env));
+  return Boolean(resolveCommandOnPath(name, env));
 }
 
 /**
@@ -63,7 +37,7 @@ export function reachableCommandVersion(name = 'codex-bridge', env = process.env
 }
 
 export function runReachableCommand(name, args, env = process.env) {
-  const shimPath = resolveCommand(name, env);
+  const shimPath = resolveCommandOnPath(name, env);
   if (!shimPath) return null;
   // Node 24 warned with DEP0190 during update (2026-09-07): invoke cmd explicitly for npm shims.
   // Live probes covered plain, bin with space, Program Files (x86), weird & name, and caret^dir.

package/cli/terminal-question.mjs

@@ -0,0 +1,41 @@
+/**
+ * The one terminal yes/no question. Plan_65 D9 needs three outcomes kept apart, because each leads
+ * to a different action: 'yes', 'no' (a no, a bare Enter, or input that ended — EOF is no answer,
+ * never consent) and 'cancel' (Ctrl+C: the caller exits 130 and changes nothing). prune's private
+ * copy folded all of them into "no"; a second copy in install would have drifted from it.
+ */
+import readline from 'node:readline/promises';
+
+// One spelling only. A guard that answers to several option names is a guard with several ways
+// to be switched off by accident.
+export function isInteractive(options) {
+  if (options.isTTY !== undefined) return Boolean(options.isTTY);
+  return Boolean((options.stdin || process.stdin).isTTY);
+}
+
+function outcome(answer) {
+  if (answer === 'cancel') return 'cancel';
+  return answer === true || (typeof answer === 'string' && /^(y|yes)$/i.test(answer.trim()))
+    ? 'yes'
+    : 'no';
+}
+
+/** `options.prompt` is the test seam: it may answer a boolean, a string, or the string 'cancel'. */
+export async function askYesNo(question, options) {
+  if (options.prompt !== undefined) return outcome(await options.prompt(question));
+
+  const input = options.stdin || process.stdin;
+  const output = options.promptOutput || process.stderr;
+  const interfaceHandle = readline.createInterface({ input, output });
+  const ended = new Promise((resolve) => {
+    interfaceHandle.once('SIGINT', () => resolve('cancel'));
+    interfaceHandle.once('close', () => resolve('no'));
+  });
+  // A closed interface rejects the pending question; the close itself already decided the answer.
+  const answered = interfaceHandle.question(`${question} [y/N] `).then(outcome, () => ended);
+  try {
+    return await Promise.race([answered, ended]);
+  } finally {
+    interfaceHandle.close();
+  }
+}

package/cli/uninstall-purge.mjs

@@ -0,0 +1,139 @@
+/**
+ * Uninstalls one host and purges the package home behind one preflight.
+ * Plan_65 D12 items 5-7 and D14 item 1 require both consents and authorization before any
+ * host mutation; D10 item 4 forbids removing the home until this host's hooks are gone.
+ */
+import fs from 'node:fs';
+import { uninstall, removePermissions, stillAttachedLine } from './uninstall.mjs';
+import { legacyInstallRecordPath, readInstallRecord } from './manifest.mjs';
+import { normalizeRepoPath } from '../src/home/lib/runner/project-dir.mjs';
+import { inspectHost } from './host-inspection.mjs';
+import { removeHostSide } from './host-removal.mjs';
+import { withSettingsRun } from './settings-merge.mjs';
+import { withLifecycle } from './lifecycle-transaction.mjs';
+import { readRulesRegistry } from './rules-owners.mjs';
+import { rulesDryRunLines, removeRulesForHost } from './uninstall-rules.mjs';
+import { removeEmpty, removeEmptyLayout } from './remove-layout.mjs';
+import { recordHomeWriter, removeOutside } from './record-removal.mjs';
+import { runPurgePreflight, diagnosePurge } from './purge-preflight.mjs';
+import { executeHomePlan } from './home-plan-execute.mjs';
+import { inspectHome } from './home-inspection.mjs';
+import {
+  purgeDryRunLines, purgeDryRunExitCode, outcomeLines, outcomeExitCode,
+} from './removal-outcomes.mjs';
+
+const ACCOUNTED = new Set(['kept', 'blocked', 'failed']);
+
+/**
+ * Plan_65 D12 item 7: a run started during purge (D14 item 3) or any other writer can recreate a registry
+ * file after its removal, and "Purged" would then be a false report. One more pass names every registry
+ * file present that the outcomes did not already name as kept. It does not defend against a deliberate
+ * swap of a folder between check and removal (D4 item 6); that limit is documented, not compensated.
+ */
+export function appearedLines(host, plan, outcomes) {
+  const inspection = inspectHome(host.brandRoot, { imageMembers: plan.imageMembers });
+  if (inspection.root === 'missing') return [];
+  if (inspection.root === 'error') {
+    return [`Could not re-check ${host.brandRoot} after purge (${inspection.rootCode}).`];
+  }
+  const named = new Set(outcomes.filter((entry) => entry.kind !== 'directory' && ACCOUNTED.has(entry.result))
+    .map((entry) => entry.relative));
+  return inspection.files.filter((file) => !named.has(file.relative)).map((file) =>
+    `Appeared during purge: brand/${file.relative}; run uninstall --purge again once nothing writes to the home.`);
+}
+
+async function purgeInRun(options, ticket) {
+  const { host } = options;
+  let registry = null;
+  let registryError = null;
+  try {
+    registry = await readRulesRegistry(host);
+  } catch (err) {
+    registryError = err;
+  }
+  const preflight = await runPurgePreflight({
+    host, ticket, packageRoot: options.packageRoot,
+    ...(options.liveRunCheck !== undefined ? { liveRunCheck: options.liveRunCheck } : {}),
+    options: { ...options, candidates: options.candidates ?? registry?.owners ?? [] },
+  });
+  if (preflight.verdict === 'refused') {
+    return { exitCode: 1, output: ['Purge refused; nothing was changed.', ...preflight.lines].join('\n') };
+  }
+  if (preflight.verdict === 'cancelled') {
+    return { exitCode: 130, output: 'Cancelled; nothing was changed.' };
+  }
+  const { plan, authorization } = preflight;
+  const owner = plan.format2?.owners[normalizeRepoPath(host.root)] ?? null;
+  const inspection = await inspectHost(host, { owner });
+  const record = await readInstallRecord(host);
+  const writer = record ? recordHomeWriter(host, record.files) : null;
+  const permissionLine = await removePermissions(host, inspection, false);
+  const hostSide = await removeHostSide(host, inspection, { owner });
+  if (!hostSide.detached) {
+    return {
+      exitCode: 1,
+      output: [stillAttachedLine(host), permissionLine, ...hostSide.lines,
+        `Left ${host.brandRoot} untouched: purge removes the home only after this host's hooks are gone.`]
+        .join('\n'),
+    };
+  }
+  const rules = await removeRulesForHost({ host, record, registry, registryError, detached: true, writer });
+  const { outcomes } = await executeHomePlan(host, plan, {
+    detached: true, imageMembers: plan.imageMembers, authorization,
+  });
+  await removeEmpty(host.commandsDir);
+  if (record) await removeOutside(writer, legacyInstallRecordPath(host));
+  await removeEmpty(host.agentsDir);
+  await removeEmptyLayout(host.legacyAgentsDir);
+  await removeEmptyLayout(host.legacyCommandsDir);
+  const appeared = appearedLines(host, plan, outcomes);
+  return {
+    exitCode: appeared.length ? 1 : outcomeExitCode(outcomes),
+    output: ['Purged codex-bridge.', permissionLine, ...hostSide.lines, ...rules.lines,
+      ...outcomeLines(outcomes, { host }), ...appeared].join('\n'),
+  };
+}
+
+async function purgeDryRun(options) {
+  const { host } = options;
+  let registry = null;
+  let registryError = null;
+  try {
+    registry = await readRulesRegistry(host);
+  } catch (err) {
+    registryError = err;
+  }
+  const diagnosis = await diagnosePurge({
+    host, packageRoot: options.packageRoot,
+    ...(options.liveRunCheck !== undefined ? { liveRunCheck: options.liveRunCheck } : {}),
+  });
+  // D12: a corrupt inventory is a diagnosis, never a throwing host-record read.
+  const corrupt = diagnosis.plan.recordState === 'corrupt';
+  const owner = corrupt ? null : diagnosis.plan.format2?.owners[normalizeRepoPath(host.root)] ?? null;
+  const inspection = await inspectHost(host, { owner });
+  const record = corrupt ? null : await readInstallRecord(host);
+  const permissionLine = await removePermissions(host, inspection, true);
+  const hostSide = await removeHostSide(host, inspection, { owner, dryRun: true });
+  const lines = [permissionLine, ...hostSide.lines];
+  if (!hostSide.detached) {
+    lines.push(`Would leave ${host.brandRoot} untouched: this host's hooks could not be removed.`);
+  }
+  lines.push(...await rulesDryRunLines({ host, record, registry, registryError, detached: hostSide.detached }));
+  lines.push(...purgeDryRunLines(diagnosis, { host }));
+  return { exitCode: hostSide.detached ? purgeDryRunExitCode(diagnosis) : 1, output: lines.join('\n') };
+}
+
+async function missingHome(options) {
+  const result = await uninstall(options);
+  return { ...result, output: `${result.output}\nNothing to purge: ${options.host.brandRoot} does not exist.` };
+}
+
+export async function purge(options) {
+  const { host } = options;
+  if (options.dryRun) return withSettingsRun(host.settingsPath, () => purgeDryRun(options));
+  if (!fs.existsSync(host.brandRoot)) return missingHome(options);
+  return withLifecycle(host, 'purge', (ticket) => {
+    if (ticket === undefined) return missingHome(options);
+    return withSettingsRun(host.settingsPath, () => purgeInRun(options, ticket));
+  }, { waitMs: options.lifecycleWaitMs });
+}

package/cli/uninstall-rules.mjs

@@ -0,0 +1,72 @@
+/**
+ * Decides and performs what happens to the Codex rules file when a host leaves the package.
+ * Plan_65 B20a: uninstall and purge detach hosts alike, so sharing rules ownership and fingerprint
+ * decisions prevents their behavior and output from drifting apart.
+ */
+import { fileFingerprint } from './manifest.mjs';
+import { removeRulesOwner, remainingRulesOwners } from './rules-owners.mjs';
+import { removeOutside } from './record-removal.mjs';
+
+export function remainingOwnersText(count) {
+  return `${count} other owner${count === 1 ? '' : 's'} ${count === 1 ? 'remains' : 'remain'}`;
+}
+
+export async function rulesDryRunLines({ host, record, registry, registryError, detached }) {
+  const lines = [];
+  if (!record?.rules || !detached) return lines;
+  if (registryError) {
+    lines.push(`Would leave ${record.rules.path} because the rules ownership registry is invalid; \
+ownership is unknown.`);
+  } else {
+    const remainingOwners = remainingRulesOwners(registry, host);
+    const currentFingerprint = await fileFingerprint(record.rules.path);
+    if (remainingOwners?.length) {
+      lines.push(`Would leave ${record.rules.path} because ${remainingOwnersText(remainingOwners.length)}.`);
+    } else if (currentFingerprint === record.rules.fingerprint) {
+      lines.push(`Would remove ${record.rules.path}; no other owners remain and its fingerprint is unchanged.`);
+    } else if (currentFingerprint !== null) {
+      lines.push(`Would leave ${record.rules.path} because its contents changed after installation.`);
+    } else {
+      lines.push(`Would leave ${record.rules.path} because it is already absent.`);
+    }
+    if (!registry) {
+      lines.push(`Warning: the rules ownership registry was missing; \
+other installations may use ${record.rules.path}.`);
+    }
+  }
+  return lines;
+}
+
+export async function removeRulesForHost({ host, record, registry, registryError, detached, writer }) {
+  const detachedRecord = record && detached ? record : null;
+  let ownership = null;
+  if (detachedRecord && !registryError) {
+    try {
+      ownership = await removeRulesOwner(host);
+    } catch (err) {
+      registryError = err;
+    }
+  }
+  const lines = [];
+  if (detachedRecord?.rules) {
+    if (registryError) {
+      lines.push(`Left ${record.rules.path} because the rules ownership registry is invalid; ownership is unknown.`);
+    } else {
+      if (ownership?.owners.length) {
+        lines.push(`Left ${record.rules.path} because ${remainingOwnersText(ownership.owners.length)}.`);
+      } else {
+        const currentFingerprint = await fileFingerprint(record.rules.path);
+        if (currentFingerprint === record.rules.fingerprint) {
+          await removeOutside(writer, record.rules.path);
+        } else if (currentFingerprint !== null) {
+          lines.push(`Left ${record.rules.path} because its contents changed after installation.`);
+        }
+      }
+      if (!registry) {
+        lines.push(`Warning: the rules ownership registry was missing; \
+other installations may use ${record.rules.path}.`);
+      }
+    }
+  }
+  return { lines, registryError };
+}