@nodii/dev 0.6.24 → 0.6.26

package/dist/managed-hooks.js

@@ -0,0 +1,166 @@
+import { spawn } from "node:child_process";
+import { access, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { homedir } from "node:os";
+import { basename, isAbsolute, join } from "node:path";
+import { CliError, VERSION } from "./core.js";
+
+export const CODEX_HOOK_EVENTS = [
+  "SessionStart", "UserPromptSubmit", "PreToolUse", "PermissionRequest", "PostToolUse",
+  "PreCompact", "PostCompact", "SubagentStart", "SubagentStop", "Stop", "Interrupt", "SessionEnd",
+];
+
+export const managedHooksDir = (home = homedir()) => join(home, ".config", "nodii-dev", "codex-managed-hooks");
+export const MANAGED_DISPATCH_MIN_VERSION = "0.6.26";
+
+/** Only a single nodii-dev invocation is allowed; shell composition is never accepted. */
+export function nodiiCommandArgs(command) {
+  const text = String(command ?? "").trim();
+  if (!text.startsWith("nodii-dev") || /[;&|<>`$\\\r\n]/.test(text))
+    throw new CliError("HARNESS_INVALID", `Managed hooks may run one nodii-dev command only: ${command}`, 1);
+  const words = text.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) ?? [];
+  if (words.shift() !== "nodii-dev") throw new CliError("HARNESS_INVALID", `Managed hooks may run nodii-dev commands only: ${command}`, 1);
+  return words.map((word) => /^(['"]).*\1$/.test(word) ? word.slice(1, -1) : word);
+}
+
+export function validateManagedHooks(hooks = {}) {
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!CODEX_HOOK_EVENTS.includes(event)) throw new CliError("HARNESS_INVALID", `Codex does not support managed hook event ${event}.`, 1);
+    for (const entry of entries)
+      for (const handler of entry.hooks ?? []) {
+        if (handler.type !== "command") throw new CliError("HARNESS_INVALID", `Managed ${event} hooks must be command handlers.`, 1);
+        nodiiCommandArgs(handler.command);
+      }
+  }
+}
+
+const tomlString = (value) => JSON.stringify(String(value));
+const shellString = (value) => `'${String(value).replaceAll("'", `'\\''`)}'`;
+const laneConfig = (env) => /^lane-[a-z0-9_-]+\.json$/i.test(basename(env.NODII_DEV_CONFIG_PATH ?? ""));
+const emptyResponse = (event) => ["Stop", "SubagentStop"].includes(event) ? "{}\n" : "";
+
+/** Stable managed policy: all later hook changes live in user-owned hooks.json. */
+export function managedRequirements(dir) {
+  const dispatcher = join(dir, "dispatch");
+  return [
+    "[features]",
+    "hooks = true",
+    "",
+    "[hooks]",
+    `managed_dir = ${tomlString(dir)}`,
+    "",
+    ...CODEX_HOOK_EVENTS.flatMap((event) => [
+      `[[hooks.${event}]]`,
+      'matcher = ".*"',
+      "",
+      `[[hooks.${event}.hooks]]`,
+      'type = "command"',
+      `command = ${tomlString(`${dispatcher} ${event}`)}`,
+      "timeout = 30",
+      'statusMessage = "Applying Nodii harness policy"',
+      "",
+    ]),
+  ].join("\n");
+}
+
+export function managedHookBundle(hooksText, { home, cliPath, cliVersion = VERSION } = {}) {
+  let parsed;
+  try { parsed = JSON.parse(String(hooksText ?? "")); }
+  catch { throw new CliError("HARNESS_SETTINGS_INVALID", ".codex/hooks.json is not valid JSON.", 2); }
+  validateManagedHooks(parsed.hooks ?? {});
+  if (!isAbsolute(String(cliPath ?? ""))) throw new CliError("HARNESS_INVALID", "The managed Codex dispatcher needs the absolute nodii-dev executable path.", 1);
+  const dir = managedHooksDir(home);
+  const command = shellString(cliPath);
+  const dispatch = `#!/bin/sh\nmanaged_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)\nmanaged_cli=${command}\nempty_response() {\n  case "$1" in Stop|SubagentStop) printf '{}\\n' ;; esac\n}\ncase "\${NODII_DEV_CONFIG_PATH##*/}" in lane-*.json) ;; *) empty_response "$1"; exit 0 ;; esac\nif [ ! -x "$managed_cli" ]; then empty_response "$1"; exit 0; fi\nexport NODII_DEV_MANAGED_HOOKS_DIR="$managed_dir"\nexport NODII_DEV_MANAGED_CLI_PATH="$managed_cli"\nmanaged_output=$("$managed_cli" hook managed-dispatch "$1" 2>/dev/null)\nmanaged_status=$?\nif [ "$managed_status" -ne 0 ]; then empty_response "$1"; exit 0; fi\nif [ -n "$managed_output" ]; then printf '%s\\n' "$managed_output"; else empty_response "$1"; fi\n`;
+  const metadata = `${JSON.stringify({ cliPath, cliVersion, minimumVersion: MANAGED_DISPATCH_MIN_VERSION }, null, 2)}\n`;
+  return { dir, hooksText: `${JSON.stringify({ hooks: parsed.hooks ?? {} }, null, 2)}\n`, dispatch, metadata, requirements: managedRequirements(dir) };
+}
+
+export async function writeManagedHookBundle(bundle) {
+  await mkdir(bundle.dir, { recursive: true, mode: 0o700 });
+  await writeFile(join(bundle.dir, "hooks.json"), bundle.hooksText, { mode: 0o600 });
+  await writeFile(join(bundle.dir, "dispatch"), bundle.dispatch, { mode: 0o700 });
+  await chmod(join(bundle.dir, "dispatch"), 0o700);
+  await writeFile(join(bundle.dir, "metadata.json"), bundle.metadata, { mode: 0o600 });
+  await writeFile(join(bundle.dir, "requirements.toml"), bundle.requirements, { mode: 0o600 });
+}
+
+function runHandler(args, input, { spawnImpl = spawn, env = process.env } = {}) {
+  return new Promise((resolve) => {
+    const child = spawnImpl(env.NODII_DEV_MANAGED_CLI_PATH ?? "nodii-dev", args, { env, stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.on("error", (error) => resolve({ status: 1, stdout, stderr: `${stderr}${error.message}` }));
+    child.on("exit", (status) => resolve({ status: status ?? 1, stdout, stderr }));
+    child.stdin.end(input);
+  });
+}
+
+const matchTarget = (event, payload) => {
+  if (["PreToolUse", "PermissionRequest", "PostToolUse"].includes(event)) return payload.tool_name ?? "";
+  if (event === "SessionStart") return payload.source ?? "";
+  return payload.agent_type ?? payload.source ?? "";
+};
+
+function responseOf(stdout) {
+  try { return JSON.parse(stdout.trim()); } catch { return null; }
+}
+
+/** Execute the current generated hook set behind the stable managed dispatcher. */
+export async function dispatchManagedHook(event, payloadText, deps = {}) {
+  if (!CODEX_HOOK_EVENTS.includes(event)) throw new CliError("USAGE", `Unknown managed Codex hook event: ${event}`, 2);
+  const env = deps.env ?? process.env;
+  if (!laneConfig(env)) return emptyResponse(event);
+  const dir = deps.dir ?? env.NODII_DEV_MANAGED_HOOKS_DIR ?? managedHooksDir();
+  let config;
+  try { config = JSON.parse(await (deps.read ?? readFile)(join(dir, "hooks.json"), "utf8")); }
+  catch (error) { throw new CliError("HARNESS_SETTINGS_INVALID", `Cannot read managed Codex hooks: ${error.message}`, 2); }
+  validateManagedHooks(config.hooks ?? {});
+  const payload = JSON.parse(payloadText);
+  const target = matchTarget(event, payload);
+  const handlers = (config.hooks?.[event] ?? []).filter((entry) => {
+    try { return new RegExp(entry.matcher || ".*").test(target); } catch { return false; }
+  }).flatMap((entry) => entry.hooks ?? []);
+  const results = await Promise.all(handlers.map((handler) => (deps.run ?? runHandler)(nodiiCommandArgs(handler.command), payloadText, deps)));
+  const messages = results.map((result) => responseOf(result.stdout)).filter(Boolean);
+  const errors = results.filter((result) => result.status !== 0).map((result) => result.stderr.trim() || result.stdout.trim()).filter(Boolean);
+  if (["PreToolUse", "PermissionRequest"].includes(event)) {
+    const denied = messages.find((message) => message.hookSpecificOutput?.permissionDecision === "deny");
+    if (denied) return `${JSON.stringify(denied)}\n`;
+    if (errors.length) return `${JSON.stringify({ hookSpecificOutput: { hookEventName: event, permissionDecision: "deny", permissionDecisionReason: errors.join("\n") } })}\n`;
+    const contexts = messages.map((message) => message.hookSpecificOutput?.additionalContext).filter(Boolean);
+    return contexts.length ? `${JSON.stringify({ hookSpecificOutput: { hookEventName: event, additionalContext: contexts.join("\n") } })}\n` : "";
+  }
+  const structured = messages.map((message) => message.hookSpecificOutput?.additionalContext).filter(Boolean);
+  const plain = results.map((result) => responseOf(result.stdout) ? "" : result.stdout.trim()).filter(Boolean);
+  if (["Stop", "SubagentStop"].includes(event)) return "{}\n";
+  return [...structured, ...plain, ...errors].join("\n") + ([...structured, ...plain, ...errors].length ? "\n" : "");
+}
+
+const versionParts = (value) => String(value ?? "").split(".").map((part) => Number.parseInt(part, 10));
+const atLeast = (actual, minimum) => {
+  const a = versionParts(actual);
+  const b = versionParts(minimum);
+  if (a.some(Number.isNaN) || b.some(Number.isNaN)) return false;
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);
+  }
+  return true;
+};
+
+/** The managed dispatcher deliberately fails open; doctor makes that visible. */
+export async function managedHookCliStatus({ home = homedir(), read = readFile, accessImpl = access } = {}) {
+  let metadata;
+  try { metadata = JSON.parse(await read(join(managedHooksDir(home), "metadata.json"), "utf8")); }
+  catch (error) {
+    return { ok: false, reason: "metadata_missing", message: `managed hook metadata is unavailable (${error.code ?? error.message})` };
+  }
+  if (!isAbsolute(String(metadata.cliPath ?? ""))) return { ...metadata, ok: false, reason: "path_invalid", message: "managed hook nodii-dev path is not absolute" };
+  try { await accessImpl(metadata.cliPath, constants.X_OK); }
+  catch { return { ...metadata, ok: false, reason: "cli_missing", message: `managed hook CLI is missing or not executable: ${metadata.cliPath}` }; }
+  const minimum = metadata.minimumVersion ?? MANAGED_DISPATCH_MIN_VERSION;
+  if (!atLeast(metadata.cliVersion, minimum)) return { ...metadata, ok: false, reason: "cli_too_old", message: `managed hook CLI ${metadata.cliVersion ?? "unknown"} is older than ${minimum}` };
+  return { ...metadata, ok: true };
+}

package/dist/safety.js

@@ -1,16 +1,18 @@
 import { execFile } from "node:child_process";
-import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { appendFile, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { CliError, configPath, devRequest, encode, readConfig } from "./core.js";
 
 const execFileAsync = promisify(execFile);
 const ACTIVE = new Set(["queued", "building", "built", "review", "on_main"]);
-const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+const SHELL_TOOLS = new Set(["Bash", "shell", "exec_command"]);
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit", "apply_patch"]);
 const GENERATED_MARK = /(?:do not edit|auto-?generated|generated (?:file|code)|@generated)/i;
 const REVIEW_RECEIPT = "nodii-review-receipt.json";
 const SAFETY_STATE = "nodii-safety-state.json";
 const SAFETY_AUDIT = "nodii-safety-audit.jsonl";
+export const HOOK_EVENTS = "nodii-hook-events.jsonl";
 
 async function optional(path) {
   try { return await readFile(path, "utf8"); }
@@ -25,6 +27,23 @@ async function gitPrivatePath(cwd, name) {
   return git(cwd, "rev-parse", "--path-format=absolute", "--git-path", name);
 }
 
+/** Minimal private receipt used by doctor to prove a runtime actually fired. */
+export async function recordHookFire(payload) {
+  const cwd = payload?.cwd ?? process.cwd();
+  const path = await gitPrivatePath(cwd, HOOK_EVENTS);
+  const event = {
+    at: new Date().toISOString(),
+    runtime: hookRuntime(payload),
+    event: payload?.hook_event_name ?? "unknown",
+    ...(payload?.source ? { source: payload.source } : {}),
+    ...(payload?.tool_name ? { tool: payload.tool_name } : {}),
+  };
+  if (event.runtime === "codex") event.profile = basename(process.env.CODEX_HOME ?? ".codex") === ".codex-work" ? "codex-work" : "codex-personal";
+  await mkdir(dirname(path), { recursive: true });
+  await appendFile(path, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+  return event;
+}
+
 const cleanPath = (path) => String(path).split(sep).join("/").replace(/^\.\//, "");
 const quotePattern = (value) => value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
 function globPattern(glob) {
@@ -121,12 +140,20 @@ function exactDeployGrant(context) {
   return context.deployGrants.some((x) => x === context.head);
 }
 
+const provenLane = (context) => context.provenLane === true || (context.provenLane === undefined && Boolean(context.lane));
+const nudgeViolation = (violation) => `nodii-dev safety: unproven lane context; ${violation.message.replace(/\bblocked\b/gi, "would be blocked")}`;
+
 /** Data-dependent checks nudge, rather than silently passing, when their source is not available yet. */
 export function commandNudges(command, context) {
   const tokens = words(command);
   const nudges = [];
   if (deployCommand(tokens, command) && !context.deployGrantKnown)
     nudges.push("nodii-dev safety: can't verify deploy authorization: no GO grant source is configured (follow-up AGENT-HARNESS-13).");
+  if (gitInvocations(tokens).some((x) => x.verb === "push")) {
+    if (!provenLane(context)) nudges.push("nodii-dev safety: can't verify review: this is not a proven current-lane context.");
+    else if (!context.reviewFlowKnown) nudges.push(`nodii-dev safety: can't verify review for ${context.lane?.key ?? context.branch}: Dev's lane review receipt flow is unavailable.`);
+  }
+  if (!provenLane(context)) nudges.push(...commandViolations(command, context).map(nudgeViolation));
   return nudges;
 }
 
@@ -135,10 +162,10 @@ export function commandViolations(command, context) {
   const tokens = words(command);
   const gitCommands = gitInvocations(tokens);
   const violations = [];
-  const lane = context.role !== "coordinator";
+  const lane = provenLane(context);
   const block = (code, message) => violations.push({ code, message });
 
-  if (gitCommands.some((x) => x.verb === "stash") && lane)
+  if (gitCommands.some((x) => x.verb === "stash"))
     block("SAFETY_GIT_STASH", "git stash is shared by every worktree; lanes and subagents use a work-in-progress commit.");
 
   for (const verb of ["checkout", "switch"]) {
@@ -168,7 +195,7 @@ export function commandViolations(command, context) {
     else if (!context.noVerifyReason) block("SAFETY_NO_VERIFY_REASON", "A coordinator may use --no-verify only with a recorded reason.");
   }
 
-  if (gitCommands.some((x) => x.verb === "push")) {
+  if (lane && context.reviewFlowKnown && gitCommands.some((x) => x.verb === "push")) {
     const receipt = context.reviewReceipt;
     if (!receipt) block("SAFETY_REVIEW_REQUIRED", `Push blocked: no review receipt for ${context.head}. Run nodii-dev lane review after the gates are green.`);
     else if (receipt.commit !== context.head)
@@ -177,7 +204,7 @@ export function commandViolations(command, context) {
       block("SAFETY_REVIEW_BASE", `Push blocked: review used base ${receipt.base}, but origin/main is ${context.base}. Re-review the current diff.`);
   }
 
-  if (lane && /(?:^|[\s/])(?:nodii-dev|@nodii\/dev(?:@[^\s]+)?)\s+(?:login|logout|agent\s+register)(?:\s|$)/.test(command))
+  if (/(?:^|[\s/])(?:nodii-dev|@nodii\/dev(?:@[^\s]+)?)\s+(?:login|logout|agent\s+register)(?:\s|$)/.test(command))
     block("SAFETY_IDENTITY", "A lane never runs nodii-dev login, logout or agent register; ask the coordinator.");
   if (/\bnodii\/prod(?:\/|\b)/i.test(command))
     block("SAFETY_PROD_SECRET", "nodii/prod secrets are outside lane authority.");
@@ -207,9 +234,11 @@ export function commandViolations(command, context) {
 /** Edit-tool ownership and generated-file blocks. */
 export async function editViolations(paths, context) {
   const violations = [];
+  const root = await realpath(context.root).catch(() => resolve(context.root));
   for (const path of paths) {
-    const absolute = isAbsolute(path) ? resolve(path) : resolve(context.cwd, path);
-    const rel = cleanPath(relative(context.root, absolute));
+    const unresolved = isAbsolute(path) ? resolve(path) : resolve(context.cwd, path);
+    const absolute = await realpath(unresolved).catch(async () => join(await realpath(dirname(unresolved)).catch(() => dirname(unresolved)), basename(unresolved)));
+    const rel = cleanPath(relative(root, absolute));
     if (rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
       violations.push({ code: "SAFETY_EDIT_OUTSIDE_REPO", message: `Edit blocked outside the lane repository: ${path}.` });
       continue;
@@ -224,8 +253,22 @@ export async function editViolations(paths, context) {
   return violations;
 }
 
+export function hookRuntime(payload) {
+  return payload?.model || payload?.turn_id || payload?.tool_name === "apply_patch" ? "codex" : "claude";
+}
+
+export function patchPaths(command) {
+  const paths = [];
+  for (const line of String(command ?? "").split(/\r?\n/)) {
+    const match = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(line) ?? /^\*\*\* Move to: (.+)$/.exec(line);
+    if (match?.[1]?.trim()) paths.push(match[1].trim());
+  }
+  return [...new Set(paths)];
+}
+
 function editPaths(payload) {
   const input = payload.tool_input ?? {};
+  if (payload.tool_name === "apply_patch") return patchPaths(input.command);
   return [input.file_path, input.path, input.notebook_path, ...(Array.isArray(input.paths) ? input.paths : [])].filter((x) => typeof x === "string" && x);
 }
 
@@ -253,9 +296,15 @@ const laneStack = (key) => String(key ?? "").toLowerCase().replace(/[^a-z0-9_-]/
 async function currentLane(cwd, request, config) {
   if (!config?.agentId) return null;
   const branch = await git(cwd, "branch", "--show-current");
-  const root = await git(cwd, "rev-parse", "--show-toplevel");
+  const rootText = await git(cwd, "rev-parse", "--show-toplevel");
+  const root = await realpath(rootText).catch(() => resolve(rootText));
   const lanes = (await request("GET", "/api/v1/lanes?limit=200")).data ?? [];
-  return lanes.find((x) => x.agentId === config.agentId && x.branch === branch && resolve(x.worktree ?? root) === resolve(root) && ACTIVE.has(x.status)) ?? null;
+  for (const lane of lanes) {
+    if (lane.agentId !== config.agentId || lane.branch !== branch || !ACTIVE.has(lane.status)) continue;
+    const worktree = await realpath(lane.worktree ?? root).catch(() => resolve(lane.worktree ?? root));
+    if (worktree === root) return lane;
+  }
+  return null;
 }
 
 function deployGrantsFrom(text) {
@@ -264,7 +313,7 @@ function deployGrantsFrom(text) {
 
 /** Resolve the facts a hook needs without creating a second lane record. */
 export async function safetyContext(cwd = process.cwd(), { request = devRequest, configReader = readConfig, env = process.env } = {}) {
-  const root = await git(cwd, "rev-parse", "--show-toplevel");
+  const root = await realpath(await git(cwd, "rev-parse", "--show-toplevel"));
   const branch = await git(cwd, "branch", "--show-current");
   const head = await git(cwd, "rev-parse", "HEAD");
   const base = await git(cwd, "rev-parse", "origin/main");
@@ -277,6 +326,15 @@ export async function safetyContext(cwd = process.cwd(), { request = devRequest,
   }
   let lane = null;
   try { lane = await currentLane(cwd, request, config); } catch {}
+  let reviewFlowKnown = false;
+  if (lane) {
+    if (Array.isArray(lane.reviews)) reviewFlowKnown = true;
+    else try {
+      const detailed = (await request("GET", `/api/v1/lanes/${encode(lane.key)}`)).data;
+      reviewFlowKnown = Array.isArray(detailed?.reviews);
+      if (detailed && !Array.isArray(detailed)) lane = { ...lane, ...detailed };
+    } catch {}
+  }
   const receiptPath = await gitPrivatePath(cwd, REVIEW_RECEIPT);
   const statePath = await gitPrivatePath(cwd, SAFETY_STATE);
   const receiptText = await optional(receiptPath);
@@ -287,7 +345,7 @@ export async function safetyContext(cwd = process.cwd(), { request = devRequest,
   const ownership = laneOwnership(lane, root);
   const laneProject = laneStack(lane?.key);
   return {
-    cwd: payloadCwd(cwd), root, branch, head, base, role, lane,
+    cwd: await realpath(cwd).catch(() => payloadCwd(cwd)), root, branch, head, base, role, lane, provenLane: Boolean(lane), reviewFlowKnown,
     ownedPaths: ownership.paths,
     ownershipKnown: role === "coordinator" || ownership.known,
     generatedPaths: [...await harnessGenerated(root), ...(state.generatedPaths ?? [])],
@@ -306,30 +364,37 @@ function blocked(violation) {
   throw new CliError(violation.code, violation.message, 2);
 }
 
-/** Claude PreToolUse entrypoint. Silent return means allowed. */
+/** Runtime-neutral PreToolUse entrypoint. Silent return means allowed. */
 export async function safetyPreHook(payload, contextOrResolver = safetyContext) {
   const tool = payload.tool_name ?? "";
-  if (tool !== "Bash" && !EDIT_TOOLS.has(tool)) return { allowed: true, ignored: true };
+  if (!SHELL_TOOLS.has(tool) && !EDIT_TOOLS.has(tool)) return { allowed: true, ignored: true };
   const cwd = payload.cwd ?? process.cwd();
   const context = typeof contextOrResolver === "function" ? await contextOrResolver(cwd) : contextOrResolver;
-  context.cwd = resolve(cwd);
-  if (tool === "Bash") {
+  context.cwd = await realpath(cwd).catch(() => resolve(cwd));
+  if (SHELL_TOOLS.has(tool)) {
     const command = String(payload.tool_input?.command ?? "");
     const violation = commandViolations(command, context)[0];
-    if (violation) blocked(violation);
+    if (violation && provenLane(context)) blocked(violation);
     if (usesNoVerify(command) && context.role === "coordinator" && context.noVerifyReason)
       await recordNoVerifyReason(cwd, context.noVerifyReason);
     return { allowed: true, nudges: commandNudges(command, context) };
   }
   const paths = editPaths(payload);
-  if (!paths.length) blocked({ code: "SAFETY_EDIT_PATH_MISSING", message: `Edit blocked: ${tool} supplied no file path.` });
+  if (!paths.length) {
+    const violation = { code: "SAFETY_EDIT_PATH_MISSING", message: `Edit blocked: ${tool} supplied no file path.` };
+    if (provenLane(context)) blocked(violation);
+    return { allowed: true, nudges: [nudgeViolation(violation)] };
+  }
   const violation = (await editViolations(paths, context))[0];
-  if (violation) blocked(violation);
+  if (violation && provenLane(context)) blocked(violation);
   return {
     allowed: true,
-    nudges: context.role !== "coordinator" && !context.ownershipKnown
-      ? ["nodii-dev safety: can't verify owned paths: the lane has no Dev ownedPaths field yet (follow-up AGENT-HARNESS-10)."]
-      : [],
+    nudges: [
+      ...(!provenLane(context) && violation ? [nudgeViolation(violation)] : []),
+      ...(context.role !== "coordinator" && !context.ownershipKnown
+        ? ["nodii-dev safety: can't verify owned paths: the lane has no Dev ownedPaths field yet (follow-up AGENT-HARNESS-10)."]
+        : []),
+    ],
   };
 }
 
@@ -351,7 +416,7 @@ function successful(payload) {
 
 /** Record only successful resource creation; says nothing when satisfied. */
 export async function safetyPostHook(payload) {
-  if (payload.tool_name !== "Bash" || !successful(payload)) return { recorded: false };
+  if (!SHELL_TOOLS.has(payload.tool_name) || !successful(payload)) return { recorded: false };
   const command = String(payload.tool_input?.command ?? "");
   const tokens = words(command);
   const cwd = payload.cwd ?? process.cwd();
@@ -370,12 +435,19 @@ export async function safetyPostHook(payload) {
   return { recorded: false };
 }
 
-/** Pin the exact commit and origin/main base Dev's review transition covers. */
+/** The exact commit and origin/main base a review and its local receipt cover. */
+export async function reviewCommitContext(cwd = process.cwd()) {
+  return {
+    commit: await git(cwd, "rev-parse", "HEAD"),
+    base: await git(cwd, "rev-parse", "origin/main"),
+  };
+}
+
+/** Pin the exact commit and origin/main base Dev accepted for review. */
 export async function recordReviewReceipt(cwd = process.cwd()) {
   const path = await gitPrivatePath(cwd, REVIEW_RECEIPT);
   const receipt = {
-    commit: await git(cwd, "rev-parse", "HEAD"),
-    base: await git(cwd, "rev-parse", "origin/main"),
+    ...(await reviewCommitContext(cwd)),
     recordedAt: new Date().toISOString(),
   };
   await mkdir(dirname(path), { recursive: true });
@@ -395,3 +467,16 @@ export const safetySettingsSnippet = () => ({
     PostToolUse: [{ matcher: "^Bash$", hooks: [{ type: "command", command: "nodii-dev hook safety-post" }] }],
   },
 });
+
+export const codexSafetyHooksSnippet = () => ({
+  hooks: {
+    PreToolUse: [{ matcher: "^(Bash|apply_patch)$", hooks: [{ type: "command", command: "nodii-dev hook safety-pre" }] }],
+    PostToolUse: [{ matcher: "^Bash$", hooks: [{ type: "command", command: "nodii-dev hook safety-post" }] }],
+  },
+});
+
+export const regroundingHooksSnippet = () => ({
+  hooks: {
+    SessionStart: [{ matcher: "^compact$", hooks: [{ type: "command", command: "nodii-dev hook session-start" }] }],
+  },
+});

package/dist/setup.js

@@ -1,7 +1,8 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { CliError, checkLogin } from "./core.js";
-import { safetySettingsSnippet } from "./safety.js";
+import { codexHooksFromClaude } from "./harness.js";
+import { regroundingHooksSnippet, safetySettingsSnippet } from "./safety.js";
 
 export const SKILL_PATH = ".claude/skills/nodii-build-workflow/SKILL.md";
 const START = "<!-- nodii-dev build workflow:start -->";
@@ -47,7 +48,10 @@ ${END}`;
 export const workflowHooks = () => {
   const safety = safetySettingsSnippet().hooks;
   return {
-    SessionStart: [{ hooks: [{ type: "command", command: "nodii-dev lane list --mine --json" }] }],
+    SessionStart: [
+      { hooks: [{ type: "command", command: "nodii-dev lane list --mine --json" }] },
+      ...regroundingHooksSnippet().hooks.SessionStart,
+    ],
     Stop: [{ hooks: [{ type: "command", command: "nodii-dev hook lane-heartbeat" }] }],
     PreToolUse: safety.PreToolUse,
     PostToolUse: [
@@ -70,6 +74,12 @@ export function mergeSettings(current = {}) {
   return { ...current, hooks };
 }
 
+export function mergeCodexHooks(current = {}) {
+  const hooks = { ...(current.hooks ?? {}) };
+  for (const [event, entries] of Object.entries(codexHooksFromClaude(workflowHooks()))) hooks[event] = mergeHookList(hooks[event], entries);
+  return { ...current, hooks };
+}
+
 export function updateMarkedDocument(text = "") {
   const block = new RegExp(`${START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
   if (block.test(text)) return `${text.replace(block, managedBlock).trimEnd()}\n`;
@@ -86,12 +96,18 @@ export async function setupPlan(root = process.cwd()) {
   let parsed = {};
   try { parsed = existingSettings ? JSON.parse(existingSettings) : {}; }
   catch { throw new CliError("INVALID_SETTINGS", `${settingsPath} is not valid JSON; fix it before setup.`, 2); }
+  const codexHooksPath = join(root, ".codex/hooks.json");
+  const existingCodexHooks = await optional(codexHooksPath);
+  let parsedCodexHooks = {};
+  try { parsedCodexHooks = existingCodexHooks ? JSON.parse(existingCodexHooks) : {}; }
+  catch { throw new CliError("INVALID_SETTINGS", `${codexHooksPath} is not valid JSON; fix it before setup.`, 2); }
   const claude = join(root, "CLAUDE.md");
   const agents = join(root, "AGENTS.md");
   const documentPath = (await optional(claude)) !== null ? claude : (await optional(agents)) !== null ? agents : claude;
   const desired = new Map([
     [join(root, SKILL_PATH), workflowSkill],
     [settingsPath, `${JSON.stringify(mergeSettings(parsed), null, 2)}\n`],
+    [codexHooksPath, `${JSON.stringify(mergeCodexHooks(parsedCodexHooks), null, 2)}\n`],
     [documentPath, updateMarkedDocument((await optional(documentPath)) ?? "")],
   ]);
   const changes = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.24",
+  "version": "0.6.26",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {