@openrig/cli 0.4.0 → 0.4.2

package/daemon/assets/plugins/openrig-core/hooks/claude.json

@@ -41,6 +41,17 @@
         ]
       }
     ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/skills/claude-compaction-restore/scripts/precompact-hook.mjs\"",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
     "PostCompact": [
       {
         "hooks": [

package/daemon/assets/plugins/openrig-core/hooks/codex.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CODEX_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
             "timeout": 5
           }
         ]
@@ -16,7 +16,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CODEX_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
             "timeout": 5
           }
         ]
@@ -27,7 +27,18 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CODEX_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
             "timeout": 5
           }
         ]

package/daemon/assets/plugins/openrig-core/hooks/scripts/compaction-restore-bridge.cjs

@@ -1,12 +1,16 @@
 #!/usr/bin/env node
 "use strict";
 
-// OpenRig Claude compaction restore bridge.
+// OpenRig Claude compaction restore bridge (reader/deliverer).
 //
-// PreCompact writes a pending marker under OPENRIG_HOME. SessionStart
-// (matcher=compact) and UserPromptSubmit can then inject one restore
-// directive into Claude context via hookSpecificOutput.additionalContext.
-// PostCompact uses the same script as a cheap marker timestamp hook.
+// The per-seat pending marker is WRITTEN on PreCompact by the product-plugin
+// writer skills/claude-compaction-restore/scripts/precompact-hook.mjs (which
+// generates the restore packet and persists the real outputDir + operator
+// message). This bridge READS that marker on SessionStart (matcher=compact)
+// and UserPromptSubmit and injects ONE restore directive into Claude context
+// via hookSpecificOutput.additionalContext. PostCompact is a cheap marker
+// timestamp hook. OPR.0.4.1.09: resolve ONLY this seat's marker (never deliver
+// another seat's restore state) and surface the per-seat restore-map pointer.
 
 const fs = require("node:fs");
 const os = require("node:os");
@@ -76,26 +80,21 @@ function readMarker(filePath) {
 }
 
 function findMarker(payload, env = process.env) {
-  const dir = markerDir(env);
+  // OPR.0.4.1.09 (never deliver wrong-seat state): resolve ONLY this seat's keyed marker.
+  // The previous fallback-to-newest handed a seat with NO marker the NEWEST marker on
+  // disk - which can be ANOTHER seat's (the reader-side parallel of the part-1 extra bug).
+  // No seat identity -> no marker; absence -> the loud JSONL fallback the restore prompt
+  // already describes, NEVER a wrong-seat guess.
   const key = sessionKey(payload, env);
-  if (key) {
-    const direct = readMarker(path.join(dir, `${key}.json`));
-    if (direct) return direct;
-  }
-  try {
-    const candidates = fs.readdirSync(dir)
-      .filter((name) => name.endsWith(".json"))
-      .map((name) => path.join(dir, name))
-      .map((filePath) => ({ filePath, stat: fs.statSync(filePath) }))
-      .sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
-    for (const candidate of candidates) {
-      const marker = readMarker(candidate.filePath);
-      if (marker) return marker;
-    }
-  } catch {
-    return null;
-  }
-  return null;
+  if (!key) return null;
+  const marker = readMarker(path.join(markerDir(env), `${key}.json`));
+  if (!marker) return null;
+  // Defense-in-depth: refuse a keyed marker that DECLARES a different seat.
+  const declaredName = marker.data && typeof marker.data.sessionName === "string"
+    ? marker.data.sessionName.trim()
+    : "";
+  if (declaredName && sanitizeKey(declaredName) !== key) return null;
+  return marker;
 }
 
 function writeMarker(marker) {
@@ -106,6 +105,7 @@ function buildRestoreContext(marker) {
   const outputDir = firstString(marker.data.outputDir) || "/tmp/claude-compaction-restore";
   const ack = firstString(marker.data.expectedAck) || "restored from packet at <path>; resumed at step <X>";
   const postInstruction = firstString(marker.data.postCompactInstruction);
+  const restoreMapPath = firstString(marker.data.restoreMapPath);
   const pieces = [
     "OpenRig compaction restore packet is available for this Claude session.",
     "This hook output is informational context, not the action request.",
@@ -113,6 +113,10 @@ function buildRestoreContext(marker) {
     "OpenRig may send a later normal user message asking you to restore from this packet. Treat that later normal user message as the operator-authorized action request.",
     `After restoration, reply with: ${ack}`,
   ];
+  if (restoreMapPath) {
+    // OPR.0.4.1.09: the per-seat restore-map pointer the marker carries.
+    pieces.push(`Per-seat restore map: ${restoreMapPath} — read it during restore.`);
+  }
   if (postInstruction) {
     pieces.push(`Operator post-compaction context: ${postInstruction}`);
   }

package/daemon/assets/plugins/openrig-core/skills/claude-compaction-restore/scripts/precompact-hook.mjs

@@ -41,6 +41,10 @@ function readInstructionFile(filePath) {
   return fs.readFileSync(expanded, "utf8");
 }
 
+function sanitizeKey(value) {
+  return value.replace(/[^a-zA-Z0-9_.@-]/g, "_");
+}
+
 function sessionKey(input) {
   const raw = [
     process.env.OPENRIG_SESSION_NAME,
@@ -51,13 +55,65 @@ function sessionKey(input) {
     input.sessionName,
     input.transcript_path ? path.basename(input.transcript_path, ".jsonl") : "",
   ].find((value) => typeof value === "string" && value.trim().length > 0) || "unknown-session";
-  return raw.replace(/[^a-zA-Z0-9_.@-]/g, "_");
+  return sanitizeKey(raw);
+}
+
+// OPR.0.4.1.09 (rev1-r2 hook-path leak fix): MUST match claude-compaction-enforcer.ts
+// declaredSeatOf EXACTLY — a seat is authoritative ONLY inside a WELL-FORMED leading
+// frontmatter fence (opened AND closed `---`); the body is NEVER scanned; malformed/absent
+// frontmatter -> null (generic). Duplicated (not imported) because this hook is a standalone
+// portable plugin asset that cannot import the compiled daemon TS; semantics are kept
+// identical so the enforcer and hook paths refuse wrong-seat extras the same way.
+function declaredSeatOf(content) {
+  const fm = /^\s*---\s*\n([\s\S]*?)\n---/.exec(content);
+  if (!fm) return null;
+  const m = /^[ \t]*(?:target[_-]?seat|seat|session(?:[_-]?name)?)[ \t]*:[ \t]*["']?([^"'\n#]+?)["']?[ \t]*$/im.exec(fm[1]);
+  return m ? m[1].trim() : null;
+}
+
+// OPR.0.4.1.09 (rev1-r2): resolve the seat-safe EXTRA-FILE CONTENT for
+// postCompactInstruction, mirroring the enforcer resolvePostCompactExtra: (1) prefer the
+// PER-SEAT extra post-compact-extra/<seat>.md; (2) else the GLOBAL messageFilePath. In
+// EITHER case a file whose WELL-FORMED frontmatter declares a DIFFERENT seat is REFUSED
+// (returns "") so a foreign-seat extra never leaks into the marker via the hook path
+// (the enforcer path already refused it). Generic/this-seat/malformed -> inject.
+function readSeatSafeExtraFile(input, globalFilePath) {
+  const seatKey = sessionKey(input);
+  const refusedIfForeign = (content) => {
+    const declared = declaredSeatOf(content);
+    return declared && sanitizeKey(declared) !== seatKey ? "" : content;
+  };
+  // 1. Per-seat extra preferred (seat-keyed path; still defensively seat-checked to match
+  //    the enforcer, which refuses a per-seat file declaring a different seat).
+  const perSeatPath = path.join(getOpenRigHome(), "compaction", "post-compact-extra", `${seatKey}.md`);
+  if (fs.existsSync(perSeatPath)) {
+    return refusedIfForeign(fs.readFileSync(perSeatPath, "utf8"));
+  }
+  // 2. Global messageFilePath fallback, seat-checked.
+  if (!globalFilePath) return "";
+  const content = readInstructionFile(globalFilePath);
+  if (!content) return "";
+  return refusedIfForeign(content);
 }
 
 function pendingMarkerPath(input) {
   return path.join(getOpenRigHome(), "compaction", "restore-pending", `${sessionKey(input)}.json`);
 }
 
+// OPR.0.4.1.09: pointer to this seat's per-seat post-compaction extra
+// (compaction/post-compact-extra/<seat>.md), surfaced by the bridge reader.
+// Returned ONLY when it EXISTS, so the marker never points at an unresolvable
+// restoreMapPath; null otherwise.
+function perSeatRestoreMapPath(input) {
+  const p = path.join(getOpenRigHome(), "compaction", "post-compact-extra", `${sessionKey(input)}.md`);
+  try {
+    fs.accessSync(p);
+    return p;
+  } catch {
+    return null;
+  }
+}
+
 function writePendingRestoreMarker(input, parsed, restoreInstruction, customMessage) {
   const markerPath = pendingMarkerPath(input);
   fs.mkdirSync(path.dirname(markerPath), { recursive: true });
@@ -74,6 +130,8 @@ function writePendingRestoreMarker(input, parsed, restoreInstruction, customMess
     expectedAck: "restored from packet at <path>; resumed at step <X>",
     deliveredAt: null,
     deliveryCount: 0,
+    // OPR.0.4.1.09: per-seat restore-map pointer (post-compact-extra/<seat>.md) or null.
+    restoreMapPath: perSeatRestoreMapPath(input),
   };
   fs.writeFileSync(markerPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
   return markerPath;
@@ -86,7 +144,7 @@ function writePendingRestoreMarker(input, parsed, restoreInstruction, customMess
 // enabled but restore text has not been written yet, use OpenRig's default
 // instruction to load the canonical restore skill. Inline instructions and
 // file-path content are both included when both are configured.
-function readClaudeCompactionMessage() {
+function readClaudeCompactionMessage(input) {
   const configPath = path.join(getOpenRigHome(), "config.json");
   let inline = "";
   let filePath = "";
@@ -115,17 +173,20 @@ function readClaudeCompactionMessage() {
 
   const parts = [];
   if (inline && inline.length > 0) {
+    // Inline has no file/seat to declare; keep as-is.
     parts.push(`Inline restore instruction:\n${inline}`);
   }
-  if (filePath && filePath.length > 0) {
-    try {
-      const fileText = readInstructionFile(filePath);
-      if (fileText) {
-        parts.push(`Additional restore instruction file (${filePath}):\n${fileText}`);
-      }
-    } catch {
-      // Keep any inline instruction; unreadable extra files degrade quietly.
+  // OPR.0.4.1.09 (rev1-r2): the FILE portion is SEAT-SAFE — per-seat extra preferred, a
+  // foreign-seat global refused (mirrors the enforcer). Checked even when messageFilePath
+  // is unset, because the per-seat extra is an independent mechanism (the enforcer also
+  // checks the per-seat path regardless of the global config).
+  try {
+    const fileText = readSeatSafeExtraFile(input, filePath);
+    if (fileText) {
+      parts.push(`Additional restore instruction file:\n${fileText}`);
     }
+  } catch {
+    // Keep any inline instruction; unreadable extra files degrade quietly.
   }
   if (parts.length > 0) return parts.join("\n\n");
   if (policyEnabled && !inlineConfigured && !filePathConfigured) {
@@ -147,7 +208,7 @@ try {
     args.push(input.transcript_path);
   }
 
-  const customMessage = readClaudeCompactionMessage();
+  const customMessage = readClaudeCompactionMessage(input);
 
   const result = spawnSync("node", args, { encoding: "utf8" });
   if (result.status !== 0) {

package/daemon/assets/plugins/openrig-core/skills/queue-handoff/SKILL.md

@@ -1,24 +1,19 @@
 ---
 name: queue-handoff
-description: Use when ending a turn, finishing a slice, blocked on another agent's work, or escalating to a human — durable work handoff via queue items so the system keeps moving across compactions, missed messages, and interruptions. Covers the hot-potato terminal-turn-rule (active work ends by passing the ball, not by going idle), default-nudge semantics, and when --no-nudge or --notify is required.
+description: Use when ending a turn, finishing a slice, blocked on another agent's work, or escalating to a human — durable work handoff via queue items so the system keeps moving across compactions, missed messages, and interruptions. Covers the hot-potato terminal-turn-rule (active work ends by passing the ball, not by going idle), default-nudge semantics, and when `--no-nudge` is appropriate for intentional cold park or human gate.
 metadata:
   openrig:
     stage: factory-approved
-    last_verified: "2026-05-04"
+    last_verified: "2026-06-24"
     distribution_scope: product-bound
     source_evidence: |
-      Daemon-backed `rig queue` shipped in v0.2.0 (PL-004 Phase A) with handed-off-to / handed-off-from / state field shape. `rig queue` is canonical for new work; `rigx queue` is recovery-only fallback. The daemon enforces hot-potato strict-rejection at the API.
+      Daemon-backed `rig queue` shipped in v0.2.0 (PL-004 Phase A) with handed-off-to / handed-off-from / state field shape. `rig queue` is canonical for new work; `rigx queue` is recovery-only fallback. The daemon enforces hot-potato strict-rejection at the API. Body resynced from canonical 2026-06-24 (demo-blocker fix: corrected the default-nudge guidance — the default already nudges; the previously-described extra notify flag does not exist on the shipped CLI).
     sibling_skills: []
     transfer_test: pending
 ---
 
 # Queue Handoff
 
-> **CANONICAL SURFACE NOTE (2026-05-11)** — `rig queue` (daemon-backed SQLite) is the
-> canonical surface for all substantive work routing. `rigx queue` (filesystem v0
-> prototype) is **recovery-only fallback**; qitems written via `rigx queue` are
-> invisible to daemon-backed reads and break fleet-wide routing discipline.
-
 Durable work handoff via queue items. Lets the system keep moving
 through compactions, missed messages, and interruptions by passing the
 ball forward instead of leaving work suspended in chat or in-flight
@@ -71,27 +66,64 @@ every surface (CLI, MCP, future UI) inherits the same guarantee.
 |---|---|---|
 | `rig queue create` | yes | New qitem created from scratch |
 | `rig queue handoff` | yes | Transactional close-as-handed-off + create-new |
-| `rig queue handoff-and-complete` | **no — requires `--notify`** | Inside a self-driving loop where motion matters |
-| `rigx queue handoff` (filesystem v0 prototype; **recovery-only fallback since 2026-05-11**) | yes | Legacy artifact; qitems invisible to daemon-backed reads. Use `rig queue handoff` for all new substantive work. |
-
-**Footgun**: `handoff-and-complete` is cold unless `--notify` is passed.
-In a self-driving loop, an agent that closes with
-`handoff-and-complete` (no `--notify`) writes a durable qitem but does
-NOT wake the next owner — the rig stalls silently while the qitem sits
-in inbox.
-
-**Rule**: in a live loop, use `handoff-and-complete --notify` OR send
-a separate verified manual nudge. `--no-nudge` exists but should be
-used intentionally (e.g., explicit park or human-gate signal), not as
-an accidental stall.
-
-## Failure modes (5; verbatim)
+| `rig queue handoff-and-complete` | yes | Atomic close + create-new; default nudge wakes the new owner |
+| `rigx queue handoff` (filesystem v0 prototype; **recovery-only fallback since 2026-05-11**) | yes | Legacy artifact; qitems invisible to daemon-backed reads; deprecated with removal queued. Use `rig queue handoff` (daemon-backed) for all new substantive work. |
+
+**Footgun**: `--no-nudge` accidentally added to a live-loop handoff.
+The shipped 0.3.1 CLI nudges by default on every queue write surface
+(`rig queue create`, `rig queue handoff`, AND `rig queue handoff-and-complete`).
+The only suppression flag is `--no-nudge` — appropriate for intentional
+cold park, human-gate signal, or a deliberate poll-driven workflow, but
+NOT for live-loop handoffs where motion matters.
+
+**Rule**: in a live loop, omit `--no-nudge` and trust the default.
+`--no-nudge` is the opt-out, not the opt-in. If you find yourself
+reaching for `--notify`, stop — that flag does not exist on the
+shipped 0.3.1 CLI; you may be following a stale instruction that
+inverted the default-nudge polarity.
+
+## Queue-body hygiene (token + parse safety)
+
+The qitem body is durable DATA the daemon stores and replays on every
+`rig queue show <id>` / `--json` read. Keep it small and parse-safe — a
+bloated or malformed body costs every future reader, not just the
+recipient.
+
+- **No large command output in bodies.** Do NOT paste `rig ps`/`--nodes`
+  dumps, big JSON blobs, full proof output, diffs, or transcript chunks
+  into a qitem body. **Link the artifact PATH** (e.g.
+  `missions/<m>/<slice>/proof.md`) or **summarize in prose**, then point
+  at the file for the detail. A pasted dump makes `rig queue show <id>
+  --json` huge — a second-order token bloat: bloated DATA living in the
+  queue, distinct from the command-default output bombs the token-burn
+  emergency pack covers. (Sensor: dev1-guard token-burn-flag 8ea201e4,
+  2026-06; founder-directed cure.)
+- **Substantive bodies go through `--body-file`, not inline `--body`.**
+  For anything beyond a short line, write the body to a file and pass
+  `--body-file <path>` (or `-` for stdin). Inline `--body` with shell
+  metacharacters is fragile.
+- **No raw backticks in bodies.** Backticks in an inline body are shell
+  command-substitution and corrupt the payload (or execute). If you need
+  code/command spans, use `--body-file`, or drop the backticks and write
+  the command in plain text.
+
+Heuristic: if the thing you want to include is more than a few lines or
+contains shell metacharacters (backticks, `$`, quotes, newlines-with-pipes),
+it belongs in a file you LINK, not in the body you paste.
+
+Product backstop (defense-in-depth, NOT a substitute for this discipline):
+`rig queue show` oversized-body truncation/preview is tracked separately
+as slice OPR.0.4.1.3. The behavioral rule here is the primary, durable
+cure; the product truncation is the safety net.
+
+## Failure modes (6; verbatim)
 
 1. Agent ends a turn without a handoff, so the rig appears idle.
-2. Agent creates a queue item but suppresses or forgets the nudge when immediate motion was intended. This includes `handoff-and-complete` without `--notify` inside a live loop.
+2. Agent creates a queue item with `--no-nudge` inside a live loop, intending suppression of attention but breaking immediate motion. `--no-nudge` is for intentional cold park / human gate, not for routine live-loop handoffs. The opposite footgun — adding a `--notify` flag that does not exist on the shipped 0.3.1 CLI — comes from following stale instructions; the default already nudges.
 3. Queue item is too small and turns work into bureaucracy.
 4. Queue item is too broad and loses ownership, proof, or closure criteria.
 5. Human escalation happens in chat but not as a durable attention item.
+6. Agent pastes a large command dump (ps/nodes, big JSON, proof blob) into the qitem body, bloating the stored DATA so every future `rig queue show --json` read is huge. Link the proof PATH or summarize in prose; substantive bodies go through `--body-file`; no raw backticks inline.
 
 ## Durable handoff field shape
 
@@ -102,16 +134,16 @@ Every qitem carries:
 - `state` — one of: `pending | in-progress | done | blocked | failed | denied | canceled | handed-off`
 - `closure_reason` + `closure_target` — set on terminal closure per hot-potato rule
 
-The same field shape exists in legacy `rigx queue` artifacts and the daemon-shipped
-`rig queue` surface, but new queue reads and writes should use `rig queue`. Watchdog
-policies and workflow runtime project new owners off these fields.
+The fields are auditable across both `rigx queue` (config-layer) and
+`rig queue` (daemon-shipped) surfaces. Watchdog policies and workflow
+runtime project new owners off these fields.
 
 ## Two surfaces (same shape)
 
 | Surface | Status | When to use |
 |---|---|---|
 | `rig queue ...` (daemon-shipped, v0.2.0) | Active host coordination surface | Daemon-backed PL-004 work; SQLite-canonical |
-| `rigx queue ...` (filesystem v0 prototype) | Recovery-only fallback | Legacy recovery for artifacts that have not migrated; not for new substantive work because daemon-backed reads cannot see those qitems |
+| `rigx queue ...` (config-layer dogfood) | Coexists with daemon | Workflows still operating on the temporary substrate coordination layer; legacy artifacts |
 
 Default posture: prefer daemon `rig queue` for new work. If a
 daemon-backed coordination command fails, debug the command/runtime/schema
@@ -119,4 +151,5 @@ edge directly — don't fall back to stale pre-upgrade assumptions.
 
 ## See also
 
-- `rig queue --help` — full CLI surface for queue items, handoffs, and closure-reason discipline
+- `looping-workflows` skill — operating discipline for self-driving rig-shaped loops; queue-handoff is its current handoff substrate
+- `intake-routing` skill — how raw signals enter the system and become routed work that flows through the queue

package/daemon/dist/adapters/codex-runtime-adapter.d.ts

@@ -22,6 +22,7 @@ export declare class CodexRuntimeAdapter implements RuntimeAdapter {
     private readThreadIdByPid;
     private sleep;
     private resolveHomeDirByPid;
+    private activityRelayPath?;
     constructor(deps: {
         tmux: TmuxAdapter;
         fsOps: CodexAdapterFsOps;
@@ -33,6 +34,7 @@ export declare class CodexRuntimeAdapter implements RuntimeAdapter {
         readThreadIdByPid?: (pid: number) => string | undefined;
         resolveHomeDirByPid?: ResolveHomeDirByPid;
         sleep?: (ms: number) => Promise<void>;
+        activityRelayPath?: string;
     });
     /**
      * plugin-primitive Phase 3a slice 3.5 — ensure Codex feature flag.
@@ -49,6 +51,36 @@ export declare class CodexRuntimeAdapter implements RuntimeAdapter {
     ensureCodexFeatureFlag(enabled: boolean, opts?: {
         codexVersion?: string;
     }): void;
+    /**
+     * OPR.0.4.1.10 FR-A — write the OpenRig activity hooks into Codex's config layer
+     * (`~/.codex/config.toml` inline `[hooks]`) so an OpenRig-launched Codex seat is
+     * hook-PRIMARY from clean shipped config. Idempotent managed-block upsert for the
+     * four events SessionStart / UserPromptSubmit / Stop / PermissionRequest; each
+     * command is `node "<activityRelayPath>"` (the daemon's OWN shipped relay, FR-B —
+     * cwd-independent, version-matched, NOT `${PLUGIN_ROOT}` nor a per-cwd copy). Also
+     * pins `[features].hooks = true` (canonical key; the deprecated `codex_hooks` alias
+     * is intentionally NOT used here). Trust is granted at launch by the hook_trust_gate
+     * auto-clear (dismissCodexInteractiveGates → "2" Trust all and continue, verified on
+     * Codex 0.139). The relay inherits the seat's OPENRIG_* env from the tmux session.
+     *
+     * Fail-safe: skips + warns when the relay asset is missing — never writes a hook that
+     * points at a nonexistent script. Verified-firsthand (Codex 0.139, dev1-qa AC-2 proof):
+     * on the OpenRig-managed launch path — managed inline hooks + trusted + the relay env
+     * delivered into the seat (OPENRIG_URL + OPENRIG_ACTIVITY_HOOK_TOKEN + session/node/runtime)
+     * — all four events, SessionStart included, deliver as runtime_hook activity. Without the
+     * relay env the hooks are still trusted/visible but no activity rows land. (A bare/manual
+     * codex TUI launch lacks that context and may not deliver SessionStart — not how OpenRig
+     * launches seats.)
+     */
+    ensureCodexActivityHooks(): void;
+    /**
+     * OPR.0.4.1.10 B3 — durable disable. When runtime.codex.hooks_enabled is false, strip the
+     * OpenRig-managed activity-hooks sentinel block from ~/.codex/config.toml so a seat that was
+     * previously provisioned with hooks does not keep firing them after the operator disables.
+     * Removes ONLY the managed block — preserves any user-owned hooks and leaves [features].hooks
+     * (the Codex 0.139 default) intact. Idempotent; no-op when the config or the block is absent.
+     */
+    removeCodexActivityHooks(): void;
     listInstalled(binding: NodeBinding): Promise<InstalledResource[]>;
     project(plan: ProjectionPlan, binding: NodeBinding): Promise<ProjectionResult>;
     deliverStartup(files: ResolvedStartupFile[], binding: NodeBinding): Promise<StartupDeliveryResult>;

package/daemon/dist/adapters/codex-runtime-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-runtime-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/codex-runtime-adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAKtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,OAAO,WAAW;IAC3B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,aAAa,CAA8D;IACnF,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,mBAAmB,CAAsB;gBAErC,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,iBAAiB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5E,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QACxD,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACvC;IASD;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAe1E,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IAkG/B,OAAO,CAAC,wBAAwB;IAW1B,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAqBlD,iCAAiC;YAiCjC,4BAA4B;IAuC1C,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI9D,OAAO,CAAC,YAAY;IA2CpB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAe5B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,uBAAuB;IAsB/B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;YAUZ,oBAAoB;YAsBpB,kBAAkB;IAsGhC,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,oBAAoB;CAO7B;AAwDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D"}
+{"version":3,"file":"codex-runtime-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/codex-runtime-adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAKtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,OAAO,WAAW;IAC3B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,aAAa,CAA8D;IACnF,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,mBAAmB,CAAsB;IAKjD,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,iBAAiB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5E,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QACxD,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUD;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAehF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,IAAI,IAAI;IAmBhC;;;;;;OAMG;IACH,wBAAwB,IAAI,IAAI;IAY1B,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IAkG/B,OAAO,CAAC,wBAAwB;IAW1B,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAqBlD,iCAAiC;YAiCjC,4BAA4B;IAuC1C,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI9D,OAAO,CAAC,YAAY;IA2CpB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAe5B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,uBAAuB;IAsB/B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;YAUZ,oBAAoB;YAsBpB,kBAAkB;IAsGhC,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,oBAAoB;CAO7B;AAwDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D"}