@makaio/client-codex 1.0.0-dev-1789404058608 → 1.0.0-dev-1789642522820

package/dist/definition.d.ts

@@ -86,6 +86,7 @@ export declare const clientDefinition: {
             name: string;
             frameworkSubject?: string | undefined;
             responseCapabilities: readonly string[];
+            minimumVersion?: string | undefined;
         }[];
     };
     managedInstall?: {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as CodexConfigHooksAddResponseSchema, B as CodexScopeHookRecordSchema, D as CodexWiringSchemas, F as CodexConfigSchemas, I as CodexHookEntrySchema, L as CodexNativeCommandHookSchema, M as CodexConfigHooksListResponseSchema, N as CodexConfigHooksRemoveRequestSchema, O as AbsolutePathSchema, P as CodexConfigHooksRemoveResponseSchema, R as CodexNativeHookMatcherGroupSchema, U as clientDefinition, V as CodexScopeSchema, j as CodexConfigHooksListRequestSchema, k as CodexConfigHooksAddRequestSchema, o as CodexClientSubjects, t as CodexClientSessionService, z as CodexNativeHooksFileSchema } from "./codex-client-session-service-epcEX-w5.mjs";
-import { t as codexPackage } from "./src-BMTPLcPK.mjs";
+import { A as CodexConfigHooksAddResponseSchema, B as CodexScopeHookRecordSchema, D as CodexWiringSchemas, F as CodexConfigSchemas, I as CodexHookEntrySchema, L as CodexNativeCommandHookSchema, M as CodexConfigHooksListResponseSchema, N as CodexConfigHooksRemoveRequestSchema, O as AbsolutePathSchema, P as CodexConfigHooksRemoveResponseSchema, R as CodexNativeHookMatcherGroupSchema, U as clientDefinition, V as CodexScopeSchema, j as CodexConfigHooksListRequestSchema, k as CodexConfigHooksAddRequestSchema, o as CodexClientSubjects, t as CodexClientSessionService, z as CodexNativeHooksFileSchema } from "./codex-client-session-service-BrCcbB06.mjs";
+import { t as codexPackage } from "./src-D25LSa6Y.mjs";
 
 export { AbsolutePathSchema, CodexClientSessionService, CodexClientSubjects, CodexConfigHooksAddRequestSchema, CodexConfigHooksAddResponseSchema, CodexConfigHooksListRequestSchema, CodexConfigHooksListResponseSchema, CodexConfigHooksRemoveRequestSchema, CodexConfigHooksRemoveResponseSchema, CodexConfigSchemas, CodexHookEntrySchema, CodexNativeCommandHookSchema, CodexNativeHookMatcherGroupSchema, CodexNativeHooksFileSchema, CodexScopeHookRecordSchema, CodexScopeSchema, CodexWiringSchemas, clientDefinition, codexPackage };

package/dist/runtime/codex-client-session-service.d.ts

@@ -39,7 +39,7 @@
  * @packageDocumentation
  */
 import type { IMakaioBus } from '@makaio/framework/bus';
-import type { ClientHookProviderContractRegistry, ClientHookResponseRegistry } from '@makaio/framework/clients';
+import type { ClientHookProviderContractRegistry, ClientHookResponseRegistry, ClientSessionTokenSink } from '@makaio/framework/clients';
 import { BaseService } from '@makaio/framework/service-base';
 import { CodexClientSettings } from './client-settings.js';
 import { CodexSessionConfigHandler } from './session-config-handler.js';
@@ -108,6 +108,15 @@ export declare class CodexClientSessionService extends BaseService {
      */
     private readonly providerContractRegistry;
     private readonly hookResponseRegistry;
+    /**
+     * In-process sink for session correlation tokens.
+     *
+     * When non-undefined, the {@link onSessionToken} callback hands the token
+     * directly to this sink so no bus payload (and no `MAKAIO_DEBUG` bus logger)
+     * ever sees the token value. Codex declares no session-token capability, so
+     * this will typically remain `undefined`.
+     */
+    private readonly sessionTokens;
     /**
      * Creates a new Codex client session service.
      * @param bus - Bus instance used for subscribing and emitting events
@@ -122,8 +131,13 @@ export declare class CodexClientSessionService extends BaseService {
      *   from clients-core for registering the Codex hook response contract.
      *   Omit in tests that do not exercise the response pipeline.
      * @param hookResponseRegistry - Optional contributor registry used by the terminal composer.
+     * @param sessionTokens - In-process token sink from clients-core. When
+     *   supplied, the {@link onSessionToken} callback hands the token directly
+     *   to the sink — no bus payload (and no `MAKAIO_DEBUG` bus logger) ever
+     *   sees the token value. Codex declares no session-token capability, so
+     *   this will typically be `undefined`.
      */
-    constructor(bus?: IMakaioBus, settings?: CodexClientSettings, machineId?: string, sessionConfigHandler?: CodexSessionConfigHandler, providerContractRegistry?: ClientHookProviderContractRegistry, hookResponseRegistry?: ClientHookResponseRegistry);
+    constructor(bus?: IMakaioBus, settings?: CodexClientSettings, machineId?: string, sessionConfigHandler?: CodexSessionConfigHandler, providerContractRegistry?: ClientHookProviderContractRegistry, hookResponseRegistry?: ClientHookResponseRegistry, sessionTokens?: ClientSessionTokenSink);
     /**
      * Register the raw hook ingress handler, the `hook.handle` request handler,
      * config management request handlers, wiring management request handlers,
@@ -193,4 +207,15 @@ export declare class CodexClientSessionService extends BaseService {
      * @returns True when the native hook should remain raw-only
      */
     private isAdapterManagedSession;
+    /**
+     * Returns true when a normalized event should be suppressed by the
+     * adapter-managed gate — that is, when the session is adapter-managed AND the
+     * subject is one the adapter emits AND the event is not a compaction or clear
+     * restart start (which have no adapter counterpart and must always be forwarded).
+     * @param normalized - Normalized hook event to evaluate
+     * @param isManagedSession - Whether the originating session is adapter-managed
+     * @returns True when the event should be dropped from the native-hook path
+     */
+    private shouldSuppressForManagedSession;
+    private enrichForkLineage;
 }

package/dist/runtime/fork-sniff.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Fork lineage sniff for Codex rollout files.
+ *
+ * Codex records every thread as a JSONL *rollout* file. The first line is the
+ * thread's own `session_meta` record; when the thread was created by forking
+ * another thread, that record carries `forked_from_id` — the parent thread id.
+ * Codex then copies the parent's persisted rollout items verbatim into the
+ * child file, so the parent's own `session_meta` line appears *later* in the
+ * same file.
+ *
+ * ## Why a sniff is needed
+ *
+ * The `SessionStart` hook payload has no lineage field at all: it carries
+ * `session_id`, `transcript_path`, `cwd`, `hook_event_name`, `model`,
+ * `permission_mode` and `source` — nothing else. A fork also reports
+ * `source: 'startup'`, exactly like a brand-new thread, so the hook alone
+ * cannot distinguish the two. `transcript_path` points at the rollout file
+ * the CLI has just materialized for the starting thread, which makes the
+ * rollout head the only lineage source available at session-start time.
+ *
+ * ## Detection invariant
+ *
+ * The **first** `session_meta` record in the file is the file's own. Any later
+ * `session_meta` record was copied from an ancestor and must be ignored, so the
+ * scan stops at the first one it can parse:
+ *
+ * - `forked_from_id` present and different from the starting thread's own id
+ *   → fork child; that id is the direct parent.
+ * - `forked_from_id` absent (or equal to the own id, which would be a
+ *   self-reference and is never a usable parent) → no fork signal.
+ * - No parseable `session_meta` inside the window → inconclusive; return
+ *   `undefined`. Fork registration is fill-once on the ingestion side, so a
+ *   guessed parent would be permanently wrong while deferring is safe.
+ *
+ * Anchoring the window at the start of the file is what makes the rule sound
+ * under a byte cap: the decisive record is the first one, so no earlier record
+ * can exist outside the window.
+ *
+ * ## Design principles
+ *
+ * - **Pure detection core**: {@link sniffRolloutForkLineage} operates on raw
+ *   JSONL lines. No I/O, no bus, no dependencies beyond the language runtime.
+ * - **Bounded I/O wrapper**: {@link sniffRolloutFork} reads at most
+ *   {@link SNIFF_MAX_BYTES} from the rollout head, so the hook path never
+ *   blocks on a large rollout file.
+ * - **Fail-open**: any I/O or parse error yields `undefined` (no fork signal);
+ *   hook processing is never blocked by a sniff failure.
+ * @packageDocumentation
+ */
+/**
+ * Maximum number of bytes to read from the rollout head for fork detection.
+ *
+ * The decisive record is the first line, but that line embeds the thread's
+ * `base_instructions`, which can run to several kilobytes. 128 KiB leaves ample
+ * headroom for it while keeping the blocking window small. A `session_meta`
+ * line longer than the window yields a truncated, unparseable JSON fragment and
+ * therefore no signal — the fail-open outcome, not a wrong parent.
+ */
+export declare const SNIFF_MAX_BYTES: number;
+/**
+ * Result of the fork lineage sniff.
+ *
+ * Returned only when the rollout's own `session_meta` names a foreign parent
+ * thread; `undefined` means no fork signal was found.
+ */
+export interface CodexForkSniffResult {
+    /** Adapter session id of the parent thread. */
+    readonly parentAdapterSessionId: string;
+}
+/**
+ * Detect fork lineage from raw rollout JSONL lines.
+ *
+ * Scans the provided window **forward** from the first line. The window must be
+ * anchored at the start of the rollout file (see {@link sniffRolloutFork});
+ * under that anchoring, the first `session_meta` record found is the file's own
+ * and decides the outcome. Later `session_meta` records belong to ancestors
+ * copied into the fork and are never consulted.
+ * @param lines - Raw JSONL lines from the rollout head (may include empty
+ *   strings, partial lines, or non-JSON data)
+ * @param hookSessionId - Session id reported by the hook payload (the starting
+ *   thread's own id)
+ * @returns Fork sniff result when the own `session_meta` names a foreign
+ *   parent, or `undefined` for a plain start / no signal / inconclusive window
+ */
+export declare function sniffRolloutForkLineage(lines: readonly string[], hookSessionId: string): CodexForkSniffResult | undefined;
+/**
+ * Sniff the rollout file at session-start time to detect fork lineage.
+ *
+ * Combines the bounded head read with the pure forward-scanning detection core.
+ * Because the window is anchored at the start of the file, a byte cap can never
+ * produce a wrong parent: the decisive record — the file's own `session_meta` —
+ * is either inside the window or the sniff returns `undefined`. Returns
+ * `undefined` (no fork signal) on any error; hook processing must never be
+ * blocked by a sniff failure.
+ * @param rolloutPath - Absolute path to the rollout JSONL file, as reported by
+ *   the hook payload's `transcript_path`
+ * @param hookSessionId - Session id reported by the hook payload
+ * @returns Fork sniff result, or `undefined` when no fork is detected or the
+ *   sniff cannot be performed
+ */
+export declare function sniffRolloutFork(rolloutPath: string, hookSessionId: string): Promise<CodexForkSniffResult | undefined>;

package/dist/runtime/hook-normalizer.d.ts

@@ -5,50 +5,60 @@
  * `client:codex.hook.received` to their corresponding
  * `client.session.*` observed-semantics subjects.
  *
- * **Mapping table** (Codex event → global subject):
+ * **Mapping table** (Codex event → global subject(s)):
  *
- * | Codex event name         | Global subject                          |
- * |--------------------------|------------------------------------------|
- * | `SessionStart`           | `client.session.started`                |
- * | `UserPromptSubmit`       | `client.session.userPrompt.submitted`   |
- * | `Stop`                   | `client.session.turn.completed`         |
- * | `PreToolUse`             | `client.session.tool.pre`               |
- * | `PostToolUse`            | `client.session.tool.post`              |
+ * | Codex event name | Global subject(s)                                       |
+ * |------------------|----------------------------------------------------------|
+ * | `SessionStart`   | `client.session.started`                               |
+ * | `UserPromptSubmit` | `client.session.turn.started`, then `client.session.userPrompt.submitted` |
+ * | `Stop`           | `client.session.turn.completed`                        |
+ * | `PreToolUse`     | `client.session.tool.pre`                              |
+ * | `PostToolUse`    | `client.session.tool.post`                             |
+ * | `SubagentStart`  | `client.session.subagent.started`                      |
+ * | `SubagentStop`   | `client.session.subagent.completed`                    |
+ * | `PreCompact`     | `client.session.compaction.pre`                        |
+ * | `PostCompact`    | _(raw-only — no global subject)_                       |
  *
- * All other event names are returned as `null` — they are kept raw only and
+ * All other event names return an empty array — they are kept raw only and
  * are never emitted into the global `client.*` namespace.
  *
- * **Source notes:** The Codex CLI hook event names above reflect the OpenAI
- * Codex CLI hook system as documented at the time of authoring. If the binary
- * changes its hook names, update {@link CODEX_EVENT_MAP} accordingly.
+ * **Source notes:** Event names are verified against the pinned
+ * `rust-v0.144.1` Codex source (`codex-rs/hooks/src/lib.rs`). Update this
+ * normalizer when a new binary version changes or adds hook names.
+ *
+ * **Subagent hooks:** On both `SubagentStart` and `SubagentStop`, the raw
+ * `session_id` is the PARENT session id. `adapterSessionId` on the base carries
+ * it directly (no stripping). `agentId` identifies the subagent. `turnId` is
+ * populated from `turn_id` when the Codex CLI includes it.
  * @packageDocumentation
  */
 import { ClientSubjects } from '@makaio/framework/clients';
-import type { ClientSessionStarted, ClientSessionUserPromptSubmitted, ClientSessionTurnCompleted, ClientSessionToolPre, ClientSessionToolPost } from '@makaio/framework/contracts/client';
+import type { ClientSessionStarted, ClientSessionUserPromptSubmitted, ClientSessionTurnStarted, ClientSessionTurnCompleted, ClientSessionToolPre, ClientSessionToolPost, ClientSessionSubagentStarted, ClientSessionSubagentCompleted, ClientSessionCompactionPre } from '@makaio/framework/contracts/client';
 import type { RawClientHookPayload } from './schemas.js';
 /**
  * Union of all normalized subject definitions the Codex normalizer can emit.
  *
- * Used as the return type of {@link normalizeCodexHook} to keep downstream
- * consumers type-safe without wide `SubjectDefinition` casts.
+ * Used as the element type of the array returned by {@link normalizeCodexHook}
+ * to keep downstream consumers type-safe without wide `SubjectDefinition` casts.
  */
-export type CodexNormalizedSubject = typeof ClientSubjects.session.started | typeof ClientSubjects.session.userPrompt.submitted | typeof ClientSubjects.session.turn.completed | typeof ClientSubjects.session.tool.pre | typeof ClientSubjects.session.tool.post;
+export type CodexNormalizedSubject = typeof ClientSubjects.session.started | typeof ClientSubjects.session.userPrompt.submitted | typeof ClientSubjects.session.turn.started | typeof ClientSubjects.session.turn.completed | typeof ClientSubjects.session.tool.pre | typeof ClientSubjects.session.tool.post | typeof ClientSubjects.session.subagent.started | typeof ClientSubjects.session.subagent.completed | typeof ClientSubjects.session.compaction.pre;
 /**
  * Union of all normalized payload types the Codex normalizer can produce.
  *
  * Mirrors the `client.session.*` schema union so callers do not need to
  * import individual payload types from `@makaio/contracts`.
  */
-export type CodexNormalizedPayload = ClientSessionStarted | ClientSessionUserPromptSubmitted | ClientSessionTurnCompleted | ClientSessionToolPre | ClientSessionToolPost;
+export type CodexNormalizedPayload = ClientSessionStarted | ClientSessionUserPromptSubmitted | ClientSessionTurnStarted | ClientSessionTurnCompleted | ClientSessionToolPre | ClientSessionToolPost | ClientSessionSubagentStarted | ClientSessionSubagentCompleted | ClientSessionCompactionPre;
 /**
  * Discriminated union of normalized Codex hook event results.
  *
  * Each variant pairs a specific `client.session.*` subject with its
- * corresponding strongly-typed payload.  The caller switches on `subject`
+ * corresponding strongly-typed payload. The caller switches on `subject`
  * to obtain a narrowed payload type and call `bus.emit` without casts.
  *
- * When the event name is unknown, {@link normalizeCodexHook} returns `null`
- * to signal that the event must stay raw-only.
+ * {@link normalizeCodexHook} returns an array of these — empty when the event
+ * name is unknown (raw-only), and potentially more than one entry for hooks
+ * that map to multiple bus events (e.g. `UserPromptSubmit` yields two).
  */
 export type CodexNormalizedEvent = {
     readonly subject: typeof ClientSubjects.session.started;
@@ -56,6 +66,9 @@ export type CodexNormalizedEvent = {
 } | {
     readonly subject: typeof ClientSubjects.session.userPrompt.submitted;
     readonly payload: ClientSessionUserPromptSubmitted;
+} | {
+    readonly subject: typeof ClientSubjects.session.turn.started;
+    readonly payload: ClientSessionTurnStarted;
 } | {
     readonly subject: typeof ClientSubjects.session.turn.completed;
     readonly payload: ClientSessionTurnCompleted;
@@ -65,18 +78,34 @@ export type CodexNormalizedEvent = {
 } | {
     readonly subject: typeof ClientSubjects.session.tool.post;
     readonly payload: ClientSessionToolPost;
+} | {
+    readonly subject: typeof ClientSubjects.session.subagent.started;
+    readonly payload: ClientSessionSubagentStarted;
+} | {
+    readonly subject: typeof ClientSubjects.session.subagent.completed;
+    readonly payload: ClientSessionSubagentCompleted;
+} | {
+    readonly subject: typeof ClientSubjects.session.compaction.pre;
+    readonly payload: ClientSessionCompactionPre;
 };
 /**
- * Normalize a raw Codex hook payload into a `client.session.*` event.
+ * Normalize a raw Codex hook payload into `client.session.*` events.
+ *
+ * Returns an empty array for unknown or not-yet-modeled event names so the
+ * caller skips global emission and keeps the event raw-only in
+ * `client:codex.*`. A single hook may map to more than one normalized event:
+ * `UserPromptSubmit` yields `turn.started` followed by `userPrompt.submitted`.
+ * Emission order within the array is significant and must be preserved by the
+ * caller.
  *
- * Returns `null` for unknown or not-yet-modeled event names so the caller
- * skips global emission and keeps the event raw-only in `client:codex.*`.
+ * The `receivedAt` timestamp from the raw hook payload is used as `observedAt`
+ * to preserve the original wall-clock time of the observation.
  * @param raw - Raw hook payload delivered on `client:codex.hook.received`
  * @param machineId - Stable runtime identity of the observing machine,
  *   caller-supplied by the owning client runtime. Stamped onto
  *   `client.session.started` so downstream storage receives the owning
  *   machine's identity without deriving it from the writer process.
- * @returns Normalized event with subject and typed payload, or `null` when
- *   the event name is unknown
+ * @returns Normalized events with subject and typed payload, in emission
+ *   order; empty when the event name is unknown (raw-only)
  */
-export declare function normalizeCodexHook(raw: RawClientHookPayload, machineId?: string): CodexNormalizedEvent | null;
+export declare function normalizeCodexHook(raw: RawClientHookPayload, machineId?: string): CodexNormalizedEvent[];

package/dist/runtime/hook-response-composer.d.ts

@@ -5,6 +5,29 @@ export interface ComposeCodexHookResponseOptions {
     readonly deadline?: number;
     readonly signal?: AbortSignal;
     readonly onDiagnostics?: (diagnostics: readonly CollectionDiagnostic[]) => void;
+    /**
+     * Receives a `session.token` effect for the runtime to record; never
+     * rendered to the client binary's stdout. When several contributors deliver
+     * a token, the highest-priority contributor wins (first in the
+     * deterministically ordered effects array). Omit when token recording is not
+     * required.
+     *
+     * The sink is skipped (not called) when:
+     * - Both `session_id` and `thread_id` are absent from the payload.
+     * - The event is `SubagentStart` and `agent_id` is absent or empty —
+     *   forwarding without an agent id would overwrite the parent session entry.
+     *
+     * For `SessionStart` and all other events, `agent_id` is ignored even when
+     * present in the payload.
+     * @param token - Opaque correlation token value.
+     * @param scope - Client id, adapter session id, and optional agent id for
+     *   SubagentStart. The client id is always `'codex'` from this composer.
+     */
+    readonly onSessionToken?: (token: string, scope: {
+        clientId: string;
+        adapterSessionId: string;
+        agentId?: string;
+    }) => void | Promise<void>;
 }
 /**
  * Reduce ordered effects into one provider-valid Codex response.
@@ -22,7 +45,8 @@ export declare function renderCodexNativeResponse(eventName: string, effects: re
  * Compose one terminal Codex native hook response.
  * @param registry - Active response contributor registry.
  * @param payload - Normalized native hook payload.
- * @param options - Request deadline, cancellation, and diagnostics hooks.
+ * @param options - Request deadline, cancellation, diagnostics hooks, and
+ *   optional session-token sink.
  * @returns The composed native response envelope.
  */
 export declare function composeCodexHookResponse(registry: ClientHookResponseRegistry, payload: RawClientHookPayload, options?: ComposeCodexHookResponseOptions): Promise<ClientHookHandleResponse>;

package/dist/runtime/hook-response-contracts.d.ts

@@ -1,8 +1,28 @@
-/** Codex 0.144.1 synchronous hook-response contract. @packageDocumentation */
 import type { InteractionBlockability, ProviderContractCatalogEntry, ProviderContributionEnvelope } from '@makaio/framework/contracts/client';
 export declare const CODEX_CLIENT_ID = "codex";
 export declare const CODEX_CONTRACT_ID = "openai.codex-hook-response";
-export declare const CODEX_CONTRACT_VERSION = "1.1.0";
+/**
+ * Semantic version of the Codex hook-response contract.
+ *
+ * Pinned to the proven capabilities of Codex CLI 0.144.1. Bump this version
+ * when a future CLI release expands the native response surface.
+ *
+ * `1.2.0` adds `SubagentStart` as a request-capable, non-blockable interaction
+ * carrying canonical `context.append`. The appended context lands in the
+ * *subagent's* context window, not the parent's — proven live, see
+ * `runtime/__tests__/fixtures/hook-contracts/probe/subagent-start-context-append.json`.
+ * Subagent creation cannot be refused (`continue: false` is parsed for
+ * compatibility but does not stop the subagent), so the interaction is
+ * non-blockable. Purely additive: every `1.1.0` contributor remains valid.
+ *
+ * `1.3.0` adds the canonical `session.token` interaction to the catalog. The
+ * definition does not declare it on any Codex event yet (Codex hands its MCP
+ * subprocesses no session id). When declared, the composer collects the token
+ * and hands it to the in-process token sink of the client runtime; it is never
+ * rendered to the client binary's stdout. Purely additive: every `1.2.0`
+ * contributor remains valid.
+ */
+export declare const CODEX_CONTRACT_VERSION = "1.3.0";
 export type CodexBlockEffects = Readonly<{
     decision: 'block';
     reason: string;

package/dist/runtime/package.mjs

@@ -1,4 +1,4 @@
-import { C as createCodexStopBlockEffect, E as normalizeCodexHook, H as CODEX_HOOK_RESPONSE_CAPABILITIES, S as createCodexSessionStartContextEffect, T as createCodexUserPromptSubmitContextEffect, _ as createCodexPreToolUseBlockEffect, a as CODEX_CLIENT_NAMESPACE, b as createCodexPreToolUseUpdateEffect, c as CODEX_CLIENT_ID, d as CODEX_INTERACTION_BLOCKABILITY, f as CODEX_RESPONSE_CAPABILITIES, g as createCodexPostToolUseContextEffect, h as createCodexPostToolUseBlockEffect, i as withCodexNativeAuthSourceLock, l as CODEX_CONTRACT_ID, m as codexProviderContractCatalog, n as buildCodexNativeAuthSourceLockPath, o as CodexClientSubjects, p as CODEX_SUPPORTED_INTERACTIONS, r as executeCodexNativeAuthSourceLock, s as composeCodexHookResponse, t as CodexClientSessionService, u as CODEX_CONTRACT_VERSION, v as createCodexPreToolUseContextEffect, w as createCodexUserPromptSubmitBlockEffect, x as createCodexSessionStartBlockEffect, y as createCodexPreToolUseDenyEffect } from "../codex-client-session-service-epcEX-w5.mjs";
+import { C as createCodexStopBlockEffect, E as normalizeCodexHook, H as CODEX_HOOK_RESPONSE_CAPABILITIES, S as createCodexSessionStartContextEffect, T as createCodexUserPromptSubmitContextEffect, _ as createCodexPreToolUseBlockEffect, a as CODEX_CLIENT_NAMESPACE, b as createCodexPreToolUseUpdateEffect, c as CODEX_CLIENT_ID, d as CODEX_INTERACTION_BLOCKABILITY, f as CODEX_RESPONSE_CAPABILITIES, g as createCodexPostToolUseContextEffect, h as createCodexPostToolUseBlockEffect, i as withCodexNativeAuthSourceLock, l as CODEX_CONTRACT_ID, m as codexProviderContractCatalog, n as buildCodexNativeAuthSourceLockPath, o as CodexClientSubjects, p as CODEX_SUPPORTED_INTERACTIONS, r as executeCodexNativeAuthSourceLock, s as composeCodexHookResponse, t as CodexClientSessionService, u as CODEX_CONTRACT_VERSION, v as createCodexPreToolUseContextEffect, w as createCodexUserPromptSubmitBlockEffect, x as createCodexSessionStartBlockEffect, y as createCodexPreToolUseDenyEffect } from "../codex-client-session-service-BrCcbB06.mjs";
 import { dep } from "@makaio/framework/contracts";
 import { ClientsCoreToken } from "@makaio/framework/clients";
 
@@ -44,7 +44,7 @@ const codexClientRuntimePackage = {
 	create: (ctx) => {
 		const clientsCore = ctx.getService(ClientsCoreToken);
 		if (!clientsCore) throw new Error("codex.runtime requires makaio.clients-core");
-		return new CodexClientSessionService(ctx.bus, void 0, ctx.machineId, void 0, clientsCore.providerContractRegistry, clientsCore.hookResponseRegistry);
+		return new CodexClientSessionService(ctx.bus, void 0, ctx.machineId, void 0, clientsCore.providerContractRegistry, clientsCore.hookResponseRegistry, clientsCore.sessionTokens);
 	}
 };
 

package/dist/runtime/schemas.d.ts

@@ -7,7 +7,14 @@
  *
  * The hook name constants below are the canonical event names reported in the
  * `eventName` field of {@link RawClientHookPayload} by the Codex CLI.
- * @see https://github.com/openai/codex
+ *
+ * Event names are verified against the pinned `rust-v0.144.1` Codex source
+ * (`codex-rs/hooks/src/lib.rs` — `HOOK_EVENT_NAMES` and
+ * `engine/output_parser.rs`). The full set present in 0.144.1 is:
+ * `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `Stop`,
+ * `SubagentStart`, `SubagentStop`, `PreCompact`, `PostCompact`,
+ * `PermissionRequest`. `SessionEnd` and `Interrupt` are NOT present.
+ * @see https://github.com/openai/codex/tree/rust-v0.144.1/codex-rs/hooks
  * @packageDocumentation
  */
 export { RawClientHookPayloadSchema, type RawClientHookPayload } from '@makaio/framework/clients';
@@ -17,9 +24,22 @@ export { RawClientHookPayloadSchema, type RawClientHookPayload } from '@makaio/f
  * These are the events the normalizer translates into `client.session.*` bus
  * emissions. Any event NOT listed here is left as raw `client:codex`
  * namespace data only.
+ *
+ * Event names are verified against pinned source `rust-v0.144.1`
+ * (`codex-rs/hooks/src/lib.rs`).
  */
 export declare const CODEX_HOOK_SESSION_START = "SessionStart";
 export declare const CODEX_HOOK_USER_PROMPT_SUBMIT = "UserPromptSubmit";
 export declare const CODEX_HOOK_PRE_TOOL_USE = "PreToolUse";
 export declare const CODEX_HOOK_POST_TOOL_USE = "PostToolUse";
 export declare const CODEX_HOOK_STOP = "Stop";
+export declare const CODEX_HOOK_SUBAGENT_START = "SubagentStart";
+export declare const CODEX_HOOK_SUBAGENT_STOP = "SubagentStop";
+export declare const CODEX_HOOK_PRE_COMPACT = "PreCompact";
+export declare const CODEX_HOOK_POST_COMPACT = "PostCompact";
+/**
+ * Fires when Codex asks the user for tool permission. Raw ingress only —
+ * response surface not yet proven against the pinned CLI source, so no
+ * capability is declared for this event.
+ */
+export declare const CODEX_HOOK_PERMISSION_REQUEST = "PermissionRequest";

package/dist/runtime/wiring.d.ts

@@ -43,6 +43,17 @@ export interface CodexWiringSettings {
 export declare const CODEX_HOOK_COMMAND_SENTINEL = "hook received codex";
 /** Sentinel for synchronous Codex hook responses. */
 export declare const CODEX_HOOK_HANDLE_COMMAND_SENTINEL = "hook handle codex";
+/**
+ * Timeout for request-mode hooks on context-only (non-blockable) interactions.
+ *
+ * Request-mode hooks carry `--debounce-failure`, so a down server is detected
+ * quickly and cool-down suppression kicks in for subsequent invocations.
+ * Context-only hooks still fail fast (1 s) to bound the overhead on each prompt
+ * or subagent spawn when the bus is genuinely unreachable.
+ * Blockable interactions retain {@link DEFAULT_HOOK_HANDLE_TIMEOUT_MS} because
+ * those must complete before the native client can proceed.
+ */
+export declare const CONTEXT_ONLY_HOOK_HANDLE_TIMEOUT_MS = 1000;
 /**
  * Build the wiring entry list, annotated with installation status, by
  * comparing the expected entries against the currently installed Codex hooks.

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { t as codexPackage } from "./src-BMTPLcPK.mjs";
+import { t as codexPackage } from "./src-D25LSa6Y.mjs";
 import { codexClientRuntimePackage } from "./runtime/package.mjs";
 
 //#region src/server.ts

package/dist/{src-BMTPLcPK.mjs → src-D25LSa6Y.mjs}

@@ -1,4 +1,4 @@
-import { U as clientDefinition } from "./codex-client-session-service-epcEX-w5.mjs";
+import { U as clientDefinition } from "./codex-client-session-service-BrCcbB06.mjs";
 
 //#region src/package.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makaio/client-codex",
-  "version": "1.0.0-dev-1789404058608",
+  "version": "1.0.0-dev-1789642522820",
   "type": "module",
   "main": "dist/index.mjs",
   "exports": {