@makaio/client-codex 1.0.0-dev-1789642522820 → 1.0.0-dev-1790599449321

package/README.md

@@ -11,7 +11,7 @@ Static client definition and schema library for the OpenAI Codex CLI. This packa
 | `version` | `0.1.0` |
 | `description` | OpenAI Codex CLI — an agentic coding assistant |
 | `binary.name` | `codex` |
-| `binary.supportedVersions` | `0.144.1` |
+| `binary.supportedVersions` | `0.158.0` |
 | `defaultApprovalPolicy` | `full-access` |
 | `defaultAuth` | `openai-codex` via client method `native` |
 | `configIsolation.envVar` | `CODEX_HOME` |

package/descriptor.json

@@ -14,7 +14,7 @@
         "id": "codex",
         "name": "Codex",
         "description": "OpenAI Codex CLI \u2014 an agentic coding assistant",
-        "binary": { "name": "codex", "managed": true, "version": "0.144.1" }
+        "binary": { "name": "codex", "managed": true, "version": "0.158.0" }
       }
     ]
   }

package/dist/{codex-client-session-service-BrCcbB06.mjs → codex-client-session-service-SDzI8cot.mjs}

@@ -1,6 +1,6 @@
 import { codexCapabilityMap, createClientDefinition } from "@makaio/framework/contracts";
 import { z } from "zod";
-import { AbsolutePathSchema, BinaryNotFoundError, ClientSubjects, ClientWiringApplyResponseSchema, ClientWiringListResponseSchema, ClientWiringRemoveResponseSchema, DEFAULT_HOOK_HANDLE_TIMEOUT_MS, NOOP_HOOK_HANDLE_RESPONSE, assertAbsoluteProjectDir, atomicModifyFile, buildClientCommand, buildHookCommand, collectContributions, createClientNamespace, deriveSessionEventDescriptors, pickNonEmptyString } from "@makaio/framework/clients";
+import { AbsolutePathSchema, BinaryNotFoundError, ClientSubjects, ClientWiringApplyResponseSchema, ClientWiringListResponseSchema, ClientWiringRemoveResponseSchema, DEFAULT_HOOK_HANDLE_TIMEOUT_MS, NOOP_HOOK_HANDLE_RESPONSE, assertAbsoluteProjectDir, atomicModifyFile, buildClientCommand, buildHookCommand, collectContributions, createClientNamespace, deriveSessionEventDescriptors, pickNonEmptyString, pickNonEmptyStringValue } from "@makaio/framework/clients";
 import { MakaioBus, RequestError } from "@makaio/framework/bus";
 import { BaseService } from "@makaio/framework/service-base";
 import * as fs$1 from "node:fs/promises";
@@ -45,12 +45,12 @@ const clientDefinition = createClientDefinition({
 	description: "OpenAI Codex CLI — an agentic coding assistant",
 	binary: {
 		name: "codex",
-		supportedVersions: "0.144.1"
+		supportedVersions: "0.158.0"
 	},
 	managedInstall: {
 		type: "npm",
 		package: "@openai/codex",
-		version: "0.144.1"
+		version: "0.158.0"
 	},
 	versionCommand: {
 		executable: {
@@ -973,11 +973,13 @@ async function handleCodexConfigPrime(payload) {
 *
 * The `SessionStart` hook payload has no lineage field at all: it carries
 * `session_id`, `transcript_path`, `cwd`, `hook_event_name`, `model`,
-* `permission_mode` and `source` — nothing else. A fork also reports
-* `source: 'startup'`, exactly like a brand-new thread, so the hook alone
-* cannot distinguish the two. `transcript_path` points at the rollout file
-* the CLI has just materialized for the starting thread, which makes the
-* rollout head the only lineage source available at session-start time.
+* `permission_mode` and `source` — nothing else. Since Codex `0.158.0` a fork
+* reports `source: 'fork'`, so the hook tells *that* a thread is a fork but not
+* *whose* fork it is. `transcript_path` points at the rollout file the CLI has
+* just materialized for the starting thread; the sniff confirms the parent from
+* that rollout's first `session_meta` line, which makes the rollout head the
+* only lineage source available at session-start time. An ephemeral fork has no
+* rollout file (`transcript_path: null`), so its parent cannot be recovered.
 *
 * ## Detection invariant
 *
@@ -990,8 +992,10 @@ async function handleCodexConfigPrime(payload) {
 * - `forked_from_id` absent (or equal to the own id, which would be a
 *   self-reference and is never a usable parent) → no fork signal.
 * - No parseable `session_meta` inside the window → inconclusive; return
-*   `undefined`. Fork registration is fill-once on the ingestion side, so a
-*   guessed parent would be permanently wrong while deferring is safe.
+*   `undefined`. The caller then reports the start as `'fresh'` without a
+*   parent instead of guessing one: fork lineage is existing-wins at
+*   ingestion, so a guessed parent would stick, while an unset parent can
+*   still be filled by a later import.
 *
 * Anchoring the window at the start of the file is what makes the rule sound
 * under a byte cap: the decisive record is the first one, so no earlier record
@@ -1130,7 +1134,7 @@ async function sniffRolloutFork(rolloutPath, hookSessionId) {
 * emissions. Any event NOT listed here is left as raw `client:codex`
 * namespace data only.
 *
-* Event names are verified against pinned source `rust-v0.144.1`
+* Event names are verified against pinned source `rust-v0.158.0`
 * (`codex-rs/hooks/src/lib.rs`).
 */
 const CODEX_HOOK_SESSION_START = "SessionStart";
@@ -1169,7 +1173,7 @@ const CODEX_HOOK_PRE_COMPACT = "PreCompact";
 * are never emitted into the global `client.*` namespace.
 *
 * **Source notes:** Event names are verified against the pinned
-* `rust-v0.144.1` Codex source (`codex-rs/hooks/src/lib.rs`). Update this
+* `rust-v0.158.0` Codex source (`codex-rs/hooks/src/lib.rs`). Update this
 * normalizer when a new binary version changes or adds hook names.
 *
 * **Subagent hooks:** On both `SubagentStart` and `SubagentStop`, the raw
@@ -1193,21 +1197,20 @@ const COMPACTION_TRIGGERS = new Set(CLIENT_SESSION_COMPACTION_TRIGGERS);
 * Map from the Codex CLI `SessionStart.source` union to the
 * framework-level {@link ClientSessionStartMode}.
 *
-* - `'startup'` → `'fresh'` (brand-new thread — **and a fork child**, see
-*   below; the owning service upgrades the fork case to `'fork'`)
+* - `'startup'` → `'fresh'` (brand-new thread; never a fork)
 * - `'resume'`  → `'resume'` (thread continued from its own rollout file)
 * - `'clear'`   → `'clear'` (conversation cleared, new thread id)
 * - `'compact'` → `'compact'` (context compacted, same thread id)
+* - `'fork'`    → `'fork'` (fork child with a new thread id)
 *
-* The vendor union has exactly these four values in the pinned `rust-v0.144.1`
-* source (`codex-rs/hooks/src/events/session_start.rs`, `SessionStartSource`);
-* there is no `'fork'` value. In `codex-rs/core/src/session/session.rs` a fork
-* is classified next to a brand-new thread — the match arm that maps
-* `InitialHistory::New` to `SessionStartSource::Startup` also covers
-* `InitialHistory::Forked` — which is why `'startup'`, not `'resume'`, is the
-* mode that may still turn out to be a fork.
-* Lineage is recovered from the rollout file instead; see the fork sniff in
-* `fork-sniff.ts` and its caller in `codex-client-session-service.ts`.
+* The vendor union has these five values in the pinned `rust-v0.158.0`
+* source (`codex-rs/hooks/src/events/session_start.rs`, `SessionStartSource`).
+* Forks are reported explicitly as `'fork'`; `'startup'` covers only
+* `InitialHistory::New`, so a `'startup'` session is never a fork.
+* The hook payload still carries no parent id: the owning service recovers it
+* from the rollout file and falls back to `'fresh'` when it cannot. See the
+* fork sniff in `fork-sniff.ts` and its caller in
+* `codex-client-session-service.ts`.
 *
 * Vendor values not in this map yield `undefined`, leaving `startMode`
 * absent from the normalized payload — safe for forward compatibility when
@@ -1217,7 +1220,8 @@ const VENDOR_SOURCE_TO_START_MODE = {
 	startup: "fresh",
 	resume: "resume",
 	clear: "clear",
-	compact: "compact"
+	compact: "compact",
+	fork: "fork"
 };
 /**
 * Extract the `source` field from a `SessionStart` hook payload and map it
@@ -1490,13 +1494,13 @@ function normalizeCodexHook(raw, machineId) {
 
 //#endregion
 //#region src/runtime/hook-response-contracts.ts
-/** Codex 0.144.1 synchronous hook-response contract. @packageDocumentation */
+/** Codex 0.158.0 synchronous hook-response contract. @packageDocumentation */
 const CODEX_CLIENT_ID = "codex";
 const CODEX_CONTRACT_ID = "openai.codex-hook-response";
 /**
 * Semantic version of the Codex hook-response contract.
 *
-* Pinned to the proven capabilities of Codex CLI 0.144.1. Bump this version
+* Pinned to the proven capabilities of Codex CLI 0.158.0. Bump this version
 * when a future CLI release expands the native response surface.
 *
 * `1.2.0` adds `SubagentStart` as a request-capable, non-blockable interaction
@@ -1742,7 +1746,7 @@ const codexProviderContractCatalog = Object.freeze({
 
 //#endregion
 //#region src/runtime/hook-response-composer.ts
-/** Deterministic Codex 0.144.1 hook-response composition. @packageDocumentation */
+/** Deterministic Codex 0.158.0 hook-response composition. @packageDocumentation */
 /**
 * Resolve the declared response capabilities for one Codex event.
 * @param eventName - Native Codex hook event name.
@@ -3408,8 +3412,9 @@ var CodexClientSessionService = class extends BaseService {
 	*
 	* The handler receives request-mode hook payloads and returns a
 	* {@link ClientHookHandleResponse} composed by
-	* {@link composeCodexHookResponse}. The pinned Codex `0.144.1` source
-	* parses synchronous responses for all five declared events.
+	* {@link composeCodexHookResponse}. The pinned Codex `0.158.0` source
+	* parses synchronous responses for every event the definition declares
+	* with response capabilities.
 	*
 	* Extracted from {@link onInit} to keep the init method concise.
 	*/
@@ -3485,7 +3490,7 @@ var CodexClientSessionService = class extends BaseService {
 	* Called for every `client.runtime.started` event.  Only events whose
 	* `clientId` equals `'codex'`, whose `source.layer` is `'adapter'`, and
 	* that carry a non-empty `adapterSessionId` update the managed-sessions gate.
-	* Events from other clients (e.g. `'claude-code'`, `'gemini'`) are ignored
+	* Events from other clients (e.g. `'claude-code'`, `'qwen'`) are ignored
 	* unconditionally — their adapter sessions must not suppress Codex hook
 	* emissions.  Non-adapter sources (e.g. `'supervisor'`, `'statusline'`) are
 	* also ignored to prevent accidental suppression of native hook paths.
@@ -3519,6 +3524,7 @@ var CodexClientSessionService = class extends BaseService {
 	*/
 	async handleHookReceived(raw) {
 		const events = normalizeCodexHook(raw, this.machineId);
+		await this.observeRootRuntime(raw, events);
 		if (events.length === 0 && (raw.eventName === "SubagentStart" || raw.eventName === "SubagentStop")) console.warn(`[CodexClientSessionService] ${raw.eventName} hook produced no normalized events — agent_id is likely absent. The hook remains raw-only on client:codex.*.`);
 		const sharedAdapterSessionId = events[0]?.payload.adapterSessionId;
 		const isManagedSession = this.isAdapterManagedSession(sharedAdapterSessionId);
@@ -3570,6 +3576,38 @@ var CodexClientSessionService = class extends BaseService {
 		if (firstError !== void 0) throw firstError;
 	}
 	/**
+	* Enrich a supervisor-owned Codex runtime with the native session ID observed
+	* on its root `SessionStart` hook.
+	*
+	* Subagent hooks never produce `client.session.started`, so they cannot bind
+	* a root runtime. The supervisor correlation key joins observations; it does
+	* not grant ownership of an arbitrary native session.
+	* @param raw - Raw hook payload delivered on `client:codex.hook.received`.
+	* @param events - Normalized events derived from the raw hook.
+	*/
+	async observeRootRuntime(raw, events) {
+		if (raw.eventName !== "SessionStart") return;
+		const supervisorSessionId = pickNonEmptyStringValue(raw.metadata?.supervisorSessionId);
+		const rootStart = events.find((event) => event.subject === ClientSubjects.session.started);
+		const adapterSessionId = rootStart?.payload.adapterSessionId;
+		if (supervisorSessionId === void 0 || rootStart === void 0 || adapterSessionId === void 0) return;
+		try {
+			if (!(await this.bus.requestOptional(ClientSubjects.runtime.observe, {
+				clientId: CLIENT_ID,
+				source: {
+					layer: "client-hook",
+					producer: "codex-client-session-service"
+				},
+				observedAt: raw.receivedAt,
+				supervisorSessionId,
+				adapterSessionId,
+				...rootStart.payload.startMode === "clear" && { adapterSessionTransition: "root-clear" }
+			})).handled) console.warn("[CodexClientSessionService] Runtime identity join is unavailable.");
+		} catch {
+			console.warn("[CodexClientSessionService] Runtime identity join is unavailable.");
+		}
+	}
+	/**
 	* Determine whether a normalized native hook belongs to an adapter-managed
 	* session whose global observed-semantics events are already emitted by the
 	* adapter layer.
@@ -3595,37 +3633,45 @@ var CodexClientSessionService = class extends BaseService {
 		return startMode !== "compact" && startMode !== "clear";
 	}
 	/**
-	* Enrich a `client.session.started` payload with fork lineage when the
-	* normalizer reported `startMode: 'fresh'` and a rollout path is available.
+	* Resolve fork lineage for a `client.session.started` payload the normalizer
+	* reported with `startMode: 'fork'`.
+	*
+	* Codex `0.158.0` reports a fork child explicitly as `SessionStart` with
+	* `source: 'fork'`, but the payload carries no parent id. The child's rollout
+	* file opens with its own `session_meta` record, and that record names
+	* `forked_from_id` — the parent thread id. This method performs a bounded
+	* read of the rollout head to recover it and populates
+	* `parentAdapterSessionId`.
 	*
-	* Codex classifies a fork child next to a brand-new thread: both fire
-	* `SessionStart` with `source: 'startup'`, and the payload carries no
-	* lineage field. The child's rollout file, however, opens with its own
-	* `session_meta` record, and that record names `forked_from_id` — the parent
-	* thread id. This method performs a bounded read of the rollout head to
-	* recover it, upgrading `startMode` from `'fresh'` to `'fork'` and
-	* populating `parentAdapterSessionId`.
+	* When the parent cannot be recovered — no rollout path (an ephemeral fork
+	* reports `transcript_path: null`), an unreadable file, or no
+	* `forked_from_id` — the payload is downgraded to `startMode: 'fresh'`, so a
+	* `'fork'` event never goes out without its parent.
 	*
-	* Only `'fresh'` is sniffed. A resume appends to the *existing* rollout file,
-	* so a resumed fork child would still show its original `forked_from_id`;
+	* Only `'fork'` is sniffed. `'startup'` (mapped to `'fresh'`) is only ever a
+	* brand-new thread, and a resume appends to the *existing* rollout file, so a
+	* resumed fork child would still show its original `forked_from_id`;
 	* upgrading it to `'fork'` would re-register an already known session instead
 	* of letting ingestion rebind it by adapter session id.
 	*
 	* Runs **after** the managed-session suppression gate (so adapter-managed
 	* sessions are already filtered out) and **before** bus emission.
 	*
-	* On any sniff error the payload is returned unchanged — hook processing must
-	* never be blocked by a sniff failure.
+	* Sniff errors never throw — hook processing must never be blocked by a
+	* sniff failure; they count as "parent not recovered".
 	* @param payload - Normalized `client.session.started` payload
-	* @returns The payload, potentially enriched with fork lineage fields
+	* @returns The payload with fork lineage, the payload downgraded to
+	*   `'fresh'`, or the unchanged payload for any other start mode
 	*/
 	async enrichForkLineage(payload) {
-		if (payload.startMode !== "fresh" || payload.transcriptPath === void 0 || payload.adapterSessionId === void 0) return payload;
-		const sniffResult = await sniffRolloutFork(payload.transcriptPath, payload.adapterSessionId);
-		if (sniffResult === void 0) return payload;
+		if (payload.startMode !== "fork") return payload;
+		const sniffResult = payload.transcriptPath === void 0 || payload.adapterSessionId === void 0 ? void 0 : await sniffRolloutFork(payload.transcriptPath, payload.adapterSessionId);
+		if (sniffResult === void 0) return {
+			...payload,
+			startMode: "fresh"
+		};
 		return {
 			...payload,
-			startMode: "fork",
 			parentAdapterSessionId: sniffResult.parentAdapterSessionId
 		};
 	}

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as CodexConfigHooksAddResponseSchema, B as CodexScopeHookRecordSchema, D as CodexWiringSchemas, F as CodexConfigSchemas, I as CodexHookEntrySchema, L as CodexNativeCommandHookSchema, M as CodexConfigHooksListResponseSchema, N as CodexConfigHooksRemoveRequestSchema, O as AbsolutePathSchema, P as CodexConfigHooksRemoveResponseSchema, R as CodexNativeHookMatcherGroupSchema, U as clientDefinition, V as CodexScopeSchema, j as CodexConfigHooksListRequestSchema, k as CodexConfigHooksAddRequestSchema, o as CodexClientSubjects, t as CodexClientSessionService, z as CodexNativeHooksFileSchema } from "./codex-client-session-service-BrCcbB06.mjs";
-import { t as codexPackage } from "./src-D25LSa6Y.mjs";
+import { A as CodexConfigHooksAddResponseSchema, B as CodexScopeHookRecordSchema, D as CodexWiringSchemas, F as CodexConfigSchemas, I as CodexHookEntrySchema, L as CodexNativeCommandHookSchema, M as CodexConfigHooksListResponseSchema, N as CodexConfigHooksRemoveRequestSchema, O as AbsolutePathSchema, P as CodexConfigHooksRemoveResponseSchema, R as CodexNativeHookMatcherGroupSchema, U as clientDefinition, V as CodexScopeSchema, j as CodexConfigHooksListRequestSchema, k as CodexConfigHooksAddRequestSchema, o as CodexClientSubjects, t as CodexClientSessionService, z as CodexNativeHooksFileSchema } from "./codex-client-session-service-SDzI8cot.mjs";
+import { t as codexPackage } from "./src-D8eg77KO.mjs";
 
 export { AbsolutePathSchema, CodexClientSessionService, CodexClientSubjects, CodexConfigHooksAddRequestSchema, CodexConfigHooksAddResponseSchema, CodexConfigHooksListRequestSchema, CodexConfigHooksListResponseSchema, CodexConfigHooksRemoveRequestSchema, CodexConfigHooksRemoveResponseSchema, CodexConfigSchemas, CodexHookEntrySchema, CodexNativeCommandHookSchema, CodexNativeHookMatcherGroupSchema, CodexNativeHooksFileSchema, CodexScopeHookRecordSchema, CodexScopeSchema, CodexWiringSchemas, clientDefinition, codexPackage };

package/dist/runtime/codex-client-session-service.d.ts

@@ -29,7 +29,7 @@
  * silently dropped — the adapter path already owns the canonical emission.
  * Sessions whose `adapterSessionId` is absent or not yet registered emit as
  * before (fail-open).  Events from other clients (e.g. `'claude-code'`,
- * `'gemini'`) are ignored unconditionally — their adapter sessions must not
+ * `'qwen'`) are ignored unconditionally — their adapter sessions must not
  * suppress Codex hook emissions.
  *
  * The managed-session set is bounded at {@link MANAGED_SESSION_CAP} entries to
@@ -165,8 +165,9 @@ export declare class CodexClientSessionService extends BaseService {
      *
      * The handler receives request-mode hook payloads and returns a
      * {@link ClientHookHandleResponse} composed by
-     * {@link composeCodexHookResponse}. The pinned Codex `0.144.1` source
-     * parses synchronous responses for all five declared events.
+     * {@link composeCodexHookResponse}. The pinned Codex `0.158.0` source
+     * parses synchronous responses for every event the definition declares
+     * with response capabilities.
      *
      * Extracted from {@link onInit} to keep the init method concise.
      */
@@ -188,7 +189,7 @@ export declare class CodexClientSessionService extends BaseService {
      * Called for every `client.runtime.started` event.  Only events whose
      * `clientId` equals `'codex'`, whose `source.layer` is `'adapter'`, and
      * that carry a non-empty `adapterSessionId` update the managed-sessions gate.
-     * Events from other clients (e.g. `'claude-code'`, `'gemini'`) are ignored
+     * Events from other clients (e.g. `'claude-code'`, `'qwen'`) are ignored
      * unconditionally — their adapter sessions must not suppress Codex hook
      * emissions.  Non-adapter sources (e.g. `'supervisor'`, `'statusline'`) are
      * also ignored to prevent accidental suppression of native hook paths.
@@ -199,6 +200,7 @@ export declare class CodexClientSessionService extends BaseService {
      */
     private handleRuntimeStarted;
     private handleHookReceived;
+    private observeRootRuntime;
     /**
      * Determine whether a normalized native hook belongs to an adapter-managed
      * session whose global observed-semantics events are already emitted by the

package/dist/runtime/fork-sniff.d.ts

@@ -12,11 +12,13 @@
  *
  * The `SessionStart` hook payload has no lineage field at all: it carries
  * `session_id`, `transcript_path`, `cwd`, `hook_event_name`, `model`,
- * `permission_mode` and `source` — nothing else. A fork also reports
- * `source: 'startup'`, exactly like a brand-new thread, so the hook alone
- * cannot distinguish the two. `transcript_path` points at the rollout file
- * the CLI has just materialized for the starting thread, which makes the
- * rollout head the only lineage source available at session-start time.
+ * `permission_mode` and `source` — nothing else. Since Codex `0.158.0` a fork
+ * reports `source: 'fork'`, so the hook tells *that* a thread is a fork but not
+ * *whose* fork it is. `transcript_path` points at the rollout file the CLI has
+ * just materialized for the starting thread; the sniff confirms the parent from
+ * that rollout's first `session_meta` line, which makes the rollout head the
+ * only lineage source available at session-start time. An ephemeral fork has no
+ * rollout file (`transcript_path: null`), so its parent cannot be recovered.
  *
  * ## Detection invariant
  *
@@ -29,8 +31,10 @@
  * - `forked_from_id` absent (or equal to the own id, which would be a
  *   self-reference and is never a usable parent) → no fork signal.
  * - No parseable `session_meta` inside the window → inconclusive; return
- *   `undefined`. Fork registration is fill-once on the ingestion side, so a
- *   guessed parent would be permanently wrong while deferring is safe.
+ *   `undefined`. The caller then reports the start as `'fresh'` without a
+ *   parent instead of guessing one: fork lineage is existing-wins at
+ *   ingestion, so a guessed parent would stick, while an unset parent can
+ *   still be filled by a later import.
  *
  * Anchoring the window at the start of the file is what makes the rule sound
  * under a byte cap: the decisive record is the first one, so no earlier record

package/dist/runtime/hook-normalizer.d.ts

@@ -23,7 +23,7 @@
  * are never emitted into the global `client.*` namespace.
  *
  * **Source notes:** Event names are verified against the pinned
- * `rust-v0.144.1` Codex source (`codex-rs/hooks/src/lib.rs`). Update this
+ * `rust-v0.158.0` Codex source (`codex-rs/hooks/src/lib.rs`). Update this
  * normalizer when a new binary version changes or adds hook names.
  *
  * **Subagent hooks:** On both `SubagentStart` and `SubagentStop`, the raw

package/dist/runtime/hook-response-contracts.d.ts

@@ -4,7 +4,7 @@ export declare const CODEX_CONTRACT_ID = "openai.codex-hook-response";
 /**
  * Semantic version of the Codex hook-response contract.
  *
- * Pinned to the proven capabilities of Codex CLI 0.144.1. Bump this version
+ * Pinned to the proven capabilities of Codex CLI 0.158.0. Bump this version
  * when a future CLI release expands the native response surface.
  *
  * `1.2.0` adds `SubagentStart` as a request-capable, non-blockable interaction

package/dist/runtime/package.mjs

@@ -1,4 +1,4 @@
-import { C as createCodexStopBlockEffect, E as normalizeCodexHook, H as CODEX_HOOK_RESPONSE_CAPABILITIES, S as createCodexSessionStartContextEffect, T as createCodexUserPromptSubmitContextEffect, _ as createCodexPreToolUseBlockEffect, a as CODEX_CLIENT_NAMESPACE, b as createCodexPreToolUseUpdateEffect, c as CODEX_CLIENT_ID, d as CODEX_INTERACTION_BLOCKABILITY, f as CODEX_RESPONSE_CAPABILITIES, g as createCodexPostToolUseContextEffect, h as createCodexPostToolUseBlockEffect, i as withCodexNativeAuthSourceLock, l as CODEX_CONTRACT_ID, m as codexProviderContractCatalog, n as buildCodexNativeAuthSourceLockPath, o as CodexClientSubjects, p as CODEX_SUPPORTED_INTERACTIONS, r as executeCodexNativeAuthSourceLock, s as composeCodexHookResponse, t as CodexClientSessionService, u as CODEX_CONTRACT_VERSION, v as createCodexPreToolUseContextEffect, w as createCodexUserPromptSubmitBlockEffect, x as createCodexSessionStartBlockEffect, y as createCodexPreToolUseDenyEffect } from "../codex-client-session-service-BrCcbB06.mjs";
+import { C as createCodexStopBlockEffect, E as normalizeCodexHook, H as CODEX_HOOK_RESPONSE_CAPABILITIES, S as createCodexSessionStartContextEffect, T as createCodexUserPromptSubmitContextEffect, _ as createCodexPreToolUseBlockEffect, a as CODEX_CLIENT_NAMESPACE, b as createCodexPreToolUseUpdateEffect, c as CODEX_CLIENT_ID, d as CODEX_INTERACTION_BLOCKABILITY, f as CODEX_RESPONSE_CAPABILITIES, g as createCodexPostToolUseContextEffect, h as createCodexPostToolUseBlockEffect, i as withCodexNativeAuthSourceLock, l as CODEX_CONTRACT_ID, m as codexProviderContractCatalog, n as buildCodexNativeAuthSourceLockPath, o as CodexClientSubjects, p as CODEX_SUPPORTED_INTERACTIONS, r as executeCodexNativeAuthSourceLock, s as composeCodexHookResponse, t as CodexClientSessionService, u as CODEX_CONTRACT_VERSION, v as createCodexPreToolUseContextEffect, w as createCodexUserPromptSubmitBlockEffect, x as createCodexSessionStartBlockEffect, y as createCodexPreToolUseDenyEffect } from "../codex-client-session-service-SDzI8cot.mjs";
 import { dep } from "@makaio/framework/contracts";
 import { ClientsCoreToken } from "@makaio/framework/clients";
 

package/dist/runtime/schemas.d.ts

@@ -8,13 +8,18 @@
  * The hook name constants below are the canonical event names reported in the
  * `eventName` field of {@link RawClientHookPayload} by the Codex CLI.
  *
- * Event names are verified against the pinned `rust-v0.144.1` Codex source
+ * Event names are verified against the pinned `rust-v0.158.0` Codex source
  * (`codex-rs/hooks/src/lib.rs` — `HOOK_EVENT_NAMES` and
- * `engine/output_parser.rs`). The full set present in 0.144.1 is:
+ * `engine/output_parser.rs`). The full set present in 0.158.0 is:
  * `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `Stop`,
  * `SubagentStart`, `SubagentStop`, `PreCompact`, `PostCompact`,
- * `PermissionRequest`. `SessionEnd` and `Interrupt` are NOT present.
- * @see https://github.com/openai/codex/tree/rust-v0.144.1/codex-rs/hooks
+ * `PermissionRequest`, `SessionEnd`, `Interrupt`.
+ *
+ * `SessionEnd` and `Interrupt` (new since 0.156) are deliberately NOT declared
+ * or modelled here (maintainer decision, FACT-88): they have no consumer and
+ * no bus subject, and declaring them would spawn a hook process on every
+ * interrupt and every session end.
+ * @see https://github.com/openai/codex/tree/rust-v0.158.0/codex-rs/hooks
  * @packageDocumentation
  */
 export { RawClientHookPayloadSchema, type RawClientHookPayload } from '@makaio/framework/clients';
@@ -25,7 +30,7 @@ export { RawClientHookPayloadSchema, type RawClientHookPayload } from '@makaio/f
  * emissions. Any event NOT listed here is left as raw `client:codex`
  * namespace data only.
  *
- * Event names are verified against pinned source `rust-v0.144.1`
+ * Event names are verified against pinned source `rust-v0.158.0`
  * (`codex-rs/hooks/src/lib.rs`).
  */
 export declare const CODEX_HOOK_SESSION_START = "SessionStart";

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { t as codexPackage } from "./src-D25LSa6Y.mjs";
+import { t as codexPackage } from "./src-D8eg77KO.mjs";
 import { codexClientRuntimePackage } from "./runtime/package.mjs";
 
 //#region src/server.ts

package/dist/{src-D25LSa6Y.mjs → src-D8eg77KO.mjs}

@@ -1,4 +1,4 @@
-import { U as clientDefinition } from "./codex-client-session-service-BrCcbB06.mjs";
+import { U as clientDefinition } from "./codex-client-session-service-SDzI8cot.mjs";
 
 //#region src/package.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makaio/client-codex",
-  "version": "1.0.0-dev-1789642522820",
+  "version": "1.0.0-dev-1790599449321",
   "type": "module",
   "main": "dist/index.mjs",
   "exports": {