@openrig/cli 0.4.2 → 0.4.4

package/daemon/assets/guidance/openrig-start.md

@@ -17,6 +17,12 @@ That skill covers the broader surface, including chatroom, discovery, adopt/bind
 Your per-session startup guidance may also name additional packaged skills for your role and pod.
 Load those too. This shared overlay is only the common bootstrap floor, not the full operating manual for your seat.
 
+## Working missions and slices (the SDLC)
+
+If your seat works missions or slices, load the packaged `mission-slice-sop` skill BEFORE authoring or building — it teaches the flow the Living Notes UI projects: intent → mini-requirements + proof contract (→ mockups for UI slices) → plan-lock (`rig scope slice approve --scope spec`) → build the locked set → QA visual compare → `rig proof add … --media` drops (the C1 drop verb — never hand-place proof files) → proof-lock (`--scope delivery`).
+
+The conventions themselves (section names, proof-contract format, the two locks, C1 proof headers) live in ONE shipped document: `docs/reference/sdlc-conventions.md` (in the CLI package). `rig scope slice create` scaffolds the convention sections for every template kind; `rig scope audit` is the advisory backstop — it records and advises, it never blocks your work.
+
 ## Identity
 
 Run this first after launch or compaction to recover your identity:

package/daemon/assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs

@@ -75,9 +75,48 @@ function buildOpenRigPayload(providerPayload, env = process.env, now = () => new
   };
 }
 
+// OPR.0.4.3.28 B1+B3 — resolve the ingest base URL + token without depending on
+// the operator seeding OPENRIG_URL/OPENRIG_ACTIVITY_HOOK_TOKEN into the shell:
+//   1. env OPENRIG_URL / token (unchanged fast path).
+//   2. B1: synthesize the base URL from OPENRIG_HOST + OPENRIG_PORT (both present
+//      in a launched seat's env) when the URL is absent.
+//   3. B3: file-discovery — read {baseUrl, token} from
+//      OPENRIG_HOME/activity-endpoint.json (default ~/.openrig) for reconcile /
+//      restored seats whose frozen process env lacks the activity vars. The
+//      daemon writes this file at startup. Identity (session/node/runtime) still
+//      comes from env, which previously-launched-then-reconciled seats inherit
+//      from the tmux session env.
+function resolveEndpoint(env = process.env) {
+  let baseUrl = firstString(env.OPENRIG_URL, env.RIGGED_URL);
+  let token = firstString(env.OPENRIG_ACTIVITY_HOOK_TOKEN, env.RIGGED_ACTIVITY_HOOK_TOKEN);
+
+  if (!baseUrl) {
+    const port = firstString(env.OPENRIG_PORT, env.RIGGED_PORT);
+    if (port) {
+      const host = firstString(env.OPENRIG_HOST, env.RIGGED_HOST) || "127.0.0.1";
+      baseUrl = `http://${host}:${port}`;
+    }
+  }
+
+  if (!baseUrl || !token) {
+    try {
+      const fs = require("node:fs");
+      const path = require("node:path");
+      const os = require("node:os");
+      const home = firstString(env.OPENRIG_HOME, env.RIGGED_HOME) || path.join(os.homedir(), ".openrig");
+      const parsed = JSON.parse(fs.readFileSync(path.join(home, "activity-endpoint.json"), "utf8"));
+      if (!baseUrl && typeof parsed.baseUrl === "string" && parsed.baseUrl.length > 0) baseUrl = parsed.baseUrl;
+      if (!token && typeof parsed.token === "string" && parsed.token.length > 0) token = parsed.token;
+    } catch {
+      // absent/malformed — the caller no-ops safely below.
+    }
+  }
+
+  return { baseUrl, token };
+}
+
 async function postHookPayload(payload, env = process.env) {
-  const baseUrl = firstString(env.OPENRIG_URL, env.RIGGED_URL);
-  const token = firstString(env.OPENRIG_ACTIVITY_HOOK_TOKEN, env.RIGGED_ACTIVITY_HOOK_TOKEN);
+  const { baseUrl, token } = resolveEndpoint(env);
   if (!baseUrl || !token || !payload || typeof fetch !== "function") return;
 
   const controller = new AbortController();
@@ -147,4 +186,5 @@ module.exports = {
   buildSessionIdentityPayload,
   parseJson,
   postHookPayload,
+  resolveEndpoint,
 };

package/daemon/assets/plugins/openrig-core/skills/mission-slice-sop/SKILL.md

@@ -0,0 +1,115 @@
+---
+name: mission-slice-sop
+description: Use when working a mission or slice — the full SDLC flow (intent → mini-requirements + proof contract → mockups → plan-lock → build → QA visual compare → `rig proof` drops → proof-lock) plus how to track, prove, hand off, and carry state across agents and compaction via the canonical files (PROGRESS.md / PROOF.md / MISSION_NOTES.md / MISSION_BRIEF.md / README.md / IMPLEMENTATION-PRD.md). Covers the convention sections the Living Notes UI projects, the two locks, the three role contracts, per-file WHO/WHEN/HOW rules, the four-legs lifecycle, hot-potato queue handoffs, the moment-of-truth checklist, the deterministic `rig scope audit` backstop, and the ghost-text capture gotcha.
+metadata:
+  openrig:
+    stage: shipped
+    last_verified: "2026-07-06"
+    distribution_scope: product-bound
+    source_evidence: |
+      Authored + embedded in release-0.4.3 slice 32 (mission-slice-sop);
+      moved into the canonical product skill source and updated in
+      release-0.4.4 slice 23 (operationalize the SDLC control plane) to
+      teach the full SDLC flow the Living Notes UI projects: the convention
+      sections, the proof-contract pairing, the two staged-approval locks,
+      C1 proof drops, and the three role contracts. Conventions SSOT:
+      docs/reference/sdlc-conventions.md (shipped with the CLI package).
+      The deterministic backstop is the `rig scope audit` classifier.
+    sibling_skills:
+      - queue-handoff
+      - seat-continuity-and-handover
+      - claude-compaction-restore
+---
+
+# Mission/Slice SOP — how you work a mission & slice
+
+Use this skill to actually **do** mission/slice work the way OpenRig expects: author the convention sections, track on the canonical files, prove on them, hand off through them, and survive compaction on them. **Do the work described here; do not merely explain the protocol.** The deterministic backstop is `rig scope audit` — the audit classifier is the source of truth for adherence. The conventions themselves live in ONE place: **`docs/reference/sdlc-conventions.md`** (shipped with the CLI package) — this skill teaches the flow; the SSOT defines the formats.
+
+## The SDLC flow (intent → proof)
+
+```
+intent → mini-requirements + proof contract → (UI slices: mockups)
+      → plan-lock (rig scope slice approve --scope spec)
+      → build the LOCKED set
+      → QA: mockup ↔ delivered VISUAL compare
+      → proof drops (rig proof add <slice> …)
+      → proof-lock (rig scope slice approve --scope delivery)
+```
+
+1. **Record intent** verbatim in the slice's `## Intent` section (`rig scope slice create` scaffolds it — every template kind).
+2. **Author the mini-requirements + proof contract**: `## Mini-requirements` is the concise one-glance tier (approval starts there); `## Proof contract` is a checkbox list of promised deliverables, each written as an observable outcome. UI deliverables name their planned mockup. The IMPLEMENTATION-PRD opens with the mini-requirements; everything between intent and proof is **elastic** — for a small slice the mini-requirements may BE the whole PRD.
+3. **Plan-lock**: `rig scope slice approve <slice> --scope spec` — "the PRD matches the intent; THIS artifact set is what gets built." One daemon-side write: frontmatter stamp + append-only audit row.
+4. **Build the locked set** — look at the mockups, not just the spec text.
+5. **QA visual compare**: for each deliverable, load the planned mockup, produce the real artifact in a test/demo environment, visually compare, and record the verdict.
+6. **Drop proof**: `rig proof add <slice> --artifact-type qa --verdict PASS --candidate-sha <tip> --money-evidence "…" --evidences "1,3" --media "walk.webm,panel.png" --self-check "…"` — the C1 header's closed sets validate at drop time; `--evidences` joins the drop to its proof-contract items and `--media` names the curated proof/-relative media the drop stands behind (that pairing + media set is what the UI's DELIVERED section renders).
+7. **Proof-lock**: `rig scope slice approve <slice> --scope delivery` — the terminal sign-off. Approval is freeze/sign-off, **never** proven-green: proven-green requires the recorded C1 verdicts.
+
+## The three role contracts
+
+- **Planning agent:** authors intent + mini-requirements + the proof contract; produces mockups for UI deliverables and attaches them to the locked set (a UI slice with no mockup is an incomplete plan; non-UI slices have none — not a gate); locks the plan.
+- **Build agent:** builds against the LOCKED set only; looks at the mockups.
+- **QA agent (owns the compare):** visually compares planned vs delivered per deliverable, records verdict + note via proof drops, and **curates** the canonical proof set (bounded, mapped to deliverables; the fix-loop pile stays in `proof/`, one drill-in down). On mismatch: fix-and-re-review or kick back with the reason — never escalate a raw mismatch to the human.
+
+## The canonical files (the operating surface)
+
+> The canonical files below are the **operating surface of the work** — you track on them, prove on them, hand off through them, and survive compaction on them. They are NOT side-artifacts to "maintain"; keeping them current *is* the work.
+
+- **README.md** (mission + slice) — the overview, OPENING with the convention sections (`## Intent` / `## Mini-requirements` / `## Proof contract`). The **mission README carries this SOP at its bottom.**
+- **IMPLEMENTATION-PRD.md** — the full PRD; opens with the mini-requirements; the `## Proof contract` here is what the UI's DELIVERED pairing joins proof against.
+- **PROGRESS.md** — the live delivery state. One line per outcome; links down for detail.
+- **MISSION_NOTES.md** — the accruing handoff + tribal-knowledge doc. Blank-slate onboarding + **compaction-restore** read it. `§1` top-of-mind + per-seat `§A–§X`.
+- **MISSION_BRIEF.md** — the steering doc (the UI "Steering" tab). The 7-section schema.
+- **PROOF.md** (+ `proof/`) — acceptance evidence. **A slice is not done until every proof-contract item has evidence.**
+
+## Per-file rules — WHO / WHEN / HOW
+
+### PROGRESS.md
+- **WHO:** the orchestrator owns `§1` (current state); every agent logs its own outcomes.
+- **WHEN:** after every slice-done **AND every commit**; on any material state change.
+- **HOW:** one line per outcome (checkbox), link down for detail (workstream-continuity format); keep frontmatter `stage`/`verified` honest.
+
+### PROOF.md + proof/
+- **WHO:** the impl/QA pair that worked the slice.
+- **WHEN:** a slice is **NOT "done"** until every proof-contract item has evidence.
+- **HOW:** proof maps **1:1 to the proof contract's deliverables** — put media under `proof/`, then ATTACH it with `rig proof add <slice> … --evidences <item> --media <files>` (the drop writes the C1 header the DELIVERED pairing joins on) + a line in PROOF.md stating what it proves. **Hand-placing files in `proof/` without a drop is the anti-pattern** — the deliverable stays unpaired and `unverified`. No proof → not done.
+
+### MISSION_NOTES.md
+- **WHO:** any agent updates `§1` (top-of-mind); each seat owns + appends to its own `§A–§X` section.
+- **WHEN:** on any material change; a compacting agent **files its state here BEFORE compaction and reads it on restore.**
+- **HOW:** accruing tribal knowledge — `§1` ≤ 5–15 lines (gates, open decisions, surprises); per-seat continuation entries (latest = truth; other seats read-only). Pointer-first; don't duplicate.
+
+### MISSION_BRIEF.md
+- **WHO:** product/design (steering owner).
+- **WHEN:** when steering changes.
+- **HOW:** the 7-section steering schema (the UI "Steering" tab reads it).
+
+### README.md
+- **WHO:** the author at creation; refreshed on rescope.
+- **WHEN:** at mission/slice creation + when scope/theme changes.
+- **HOW:** overview + honest frontmatter (`id`/`stage`/`verified`) + the convention sections up top; the mission README carries this SOP at its bottom.
+
+## The lifecycle (4 legs)
+
+**SCAFFOLD** (`rig scope` creates the files from templates — every slice kind emits the convention sections + `proof/` + the IMPLEMENTATION-PRD skeleton) → **POPULATE** (agents fill them as work happens, per the rules above) → **PROJECT** (the Living Notes UI reads them into INTENT → PLAN → DELIVERED) → **VERIFY** (`rig scope audit` checks adherence). "Loose freeform write + deterministic verify."
+
+## Hot-potato (handoffs)
+
+End every turn by passing the ball — a `rig queue` handoff to the next agent (close the qitem with a `closure_reason`). The **durable ball-pass is the queue close, not a chat message.** Never go idle without a handoff.
+
+## Verify (deterministic backstop)
+
+Run `rig scope audit` at slice-close. It flags: committed-without-touching-PROGRESS; slice-marked-done-without-PROOF; active-mission-without-MISSION_NOTES; MISSION_BRIEF off-schema; proof artifacts violating the C1 header; missing IMPLEMENTATION-PRD on a building slice; missing convention sections (`## Intent`, a well-formed `## Proof contract`, the UI-slice mockup ref). Every convention check is **advisory / fail-open** — it records and advises, never blocks a write. **Fix the flag, don't suppress it.**
+
+## Reading terminal captures — KNOWN GOTCHA: ghost-text autocomplete is NOT real
+
+When you `rig capture` a pane, **greyed / ghost autocomplete suggestions are NOT real content** — they are autocomplete *previews* (shell autosuggestion, the input-box ghost-text completion), not typed, staged, or committed input. **This is known, expected, and has been faking agents out a lot** — reading a ghost suggestion in a peer's input box as "staged text they're about to send," or as a real prompt, and then reasoning/acting on a string that was never actually there.
+
+**Rule:** ignore ghost/autosuggest text entirely. Only *committed/rendered* pane output is real. If a `❯` input line shows text, treat it as an autocomplete artifact unless you have independent evidence it was actually entered. Do not build decisions (or worry about "colliding with staged text") on ghost text. When it matters, verify at source (git, the queue, the actual event) — never off a capture's ghost line.
+
+## Moment-of-truth checklist
+
+- **Starting a slice?** → intent recorded verbatim? mini-requirements + proof contract authored? mockups attached (UI slices)? plan locked (`--scope spec`)?
+- **Finishing a slice?** → every proof-contract item has curated evidence via `rig proof add … --evidences --media` (C1 drops — never only hand-placed files)? PROGRESS updated? MISSION_NOTES `§1` refreshed? proof locked (`--scope delivery`)? Handed off via queue?
+- **Committing?** → PROGRESS updated?
+- **Compacting?** → filed your state in MISSION_NOTES?
+- **Starting on a mission?** → read the mission README (incl. this SOP) + MISSION_NOTES + `docs/reference/sdlc-conventions.md`?

package/daemon/assets/plugins/openrig-core/skills/openrig-user/SKILL.md

@@ -61,7 +61,7 @@ Default posture on this host now:
 
 Most work in OpenRig reduces to this loop:
 - recover identity: `rig whoami --json`
-- inspect inventory: `rig ps --nodes --json`
+- inspect inventory: `rig ps` (fleet map) / `rig ps --nodes -A --json` (fleet nodes)
 - read context: `rig transcript ...`, `rig ask ...`, `rig chatroom history ...`
 - act: `rig send`, `rig capture`, `rig broadcast`, lifecycle commands
 
@@ -90,13 +90,13 @@ If the daemon is unreachable but identity can still be inferred, `--json` may re
 ## Inventory and Monitoring
 
 ```bash
-rig ps
-rig ps --json
-rig ps --nodes
-rig ps --nodes --json
+rig ps                      # ALL active rigs, one compact row each (v0.4.4 default)
+rig ps --json               # bare array, all non-archived rigs
+rig ps --nodes              # current rig's nodes (session default, local only)
+rig ps --nodes -A --json    # fleet node inventory (explicit)
 ```
 
-Use `rig ps --nodes --json` for the current node inventory across rigs. It is the best machine-readable operator surface for:
+Use `rig ps --nodes -A --json` for the current node inventory across rigs (v0.4.4: `--nodes` needs an explicit scope outside a managed session). It is the best machine-readable operator surface for:
 - session name
 - runtime
 - session/startup status
@@ -386,7 +386,7 @@ rig whoami --json
 
 Notes:
 - for tmux-backed self-attach, `rig whoami --json` is the right verification
-- for raw/external self-attach, `rig ps --nodes --json` is currently the more reliable verification surface
+- for raw/external self-attach, `rig ps --nodes -A --json` is currently the more reliable verification surface
 - if the current shell is outside tmux, pass `--display-name <name>` when you want a stable human session label recorded
 
 ### Adopt a topology and bind live sessions
@@ -453,13 +453,13 @@ Verification loop:
 ```bash
 rig discover --json
 rig adopt <fragment.yaml> --bindings-file <bindings.yaml> --target-rig <rigId>
-rig ps --nodes --json
+rig ps --nodes -A --json
 rig export <rigId> -o rig.yaml
 ```
 
 Success looks like:
 - the new sessions stop appearing in `rig discover`
-- the new logical IDs appear in `rig ps --nodes --json`
+- the new logical IDs appear in `rig ps --nodes -A --json`
 - `rig export` includes the new pod
 
 ### Mixed-origin rigs are allowed
@@ -477,7 +477,7 @@ Current safety rule:
 The proven operator pattern is:
 - keep one OpenRig manager session outside the rig it manages
 - address the target by rig name, not cached rig ID
-- resolve the current owner from fresh `rig ps --nodes --json`
+- resolve the current owner from fresh `rig ps --nodes -A --json`
 - send the manager the spec path, bindings path, and verification steps with `rig send`
 
 This lets ordinary agents ask the manager for OpenRig help instead of every agent needing to be an OpenRig expert.
@@ -548,7 +548,7 @@ When the CLI behaves strangely, use the smallest truthful check first:
 ```bash
 rig whoami --json
 rig daemon status
-rig ps --nodes --json
+rig ps --nodes -A --json
 ```
 
 Specific operator rules:
@@ -584,7 +584,7 @@ Design assumptions that hold in the shipped CLI:
 
 1. `rig whoami --json`
 2. `rig transcript <your-session> --tail 100`
-3. `rig ps --nodes --json`
+3. `rig ps --nodes -A --json`
 4. `rig chatroom history <rig> --limit 50`
 
 ## Commands That Do Not Exist

package/daemon/dist/adapters/codex-runtime-adapter.d.ts

@@ -73,6 +73,17 @@ export declare class CodexRuntimeAdapter implements RuntimeAdapter {
      * launches seats.)
      */
     ensureCodexActivityHooks(): void;
+    /**
+     * OPR.0.4.3.33 — compute + splice Codex's `[hooks.state."<key>"] trusted_hash` for our 4
+     * authored activity hooks into `content`. `key_source` is the canonicalized config path
+     * (Codex keys trust by `std::fs::canonicalize(config.toml).display()`); we best-effort
+     * `realpathSync` the config path to match — on a miss (file not yet on real disk, or a mock
+     * fs in tests) we fall back to the plain absolute path, and any resulting key mismatch just
+     * degrades to the launch-time trust gate (Layer-2 floor), never a broken run. The command
+     * string is the value Codex deserializes from our TOML literal `'node "<relay>"'` — i.e.
+     * `node "<relay>"` WITHOUT the outer TOML quote delimiters. Timeout=5, matcher/status None.
+     */
+    private applyCodexActivityHookTrust;
     /**
      * OPR.0.4.1.10 B3 — durable disable. When runtime.codex.hooks_enabled is false, strip the
      * OpenRig-managed activity-hooks sentinel block from ~/.codex/config.toml so a seat that was
@@ -117,5 +128,40 @@ export declare class CodexRuntimeAdapter implements RuntimeAdapter {
     private findCodexDescendantPids;
     private readThreadIdFromLogs;
 }
+export interface CodexHookTrustInput {
+    /** Codex hook_key source identity: canonicalized `~/.codex/config.toml` path. */
+    keySource: string;
+    /** The command as Codex DESERIALIZES it — `node "<relay>"` (no outer TOML quote delimiters). */
+    command: string;
+    /** Our authored hook timeout (seconds). */
+    timeoutSec: number;
+    /** None for our hooks; folded into the hash when present (kept for faithful reproduction). */
+    matcher?: string | null;
+    /** None for our hooks; folded into the hash when present. */
+    statusMessage?: string | null;
+    /** Positional group index within the event's matcher-group list (our hooks: 0). */
+    groupIndex?: number;
+    /** Positional handler index within the group's handler list (our hooks: 0). */
+    handlerIndex?: number;
+}
+/**
+ * Reproduce Codex's persisted hook trust `{ key, trusted_hash }` for one authored activity
+ * hook. Pure + deterministic. See the block comment above for the full RTFM derivation and the
+ * PROVISIONAL-until-VM-read-back caveat.
+ */
+export declare function computeCodexHookTrust(event: (typeof OPENRIG_ACTIVITY_HOOK_EVENTS)[number], input: CodexHookTrustInput): {
+    key: string;
+    hash: string;
+};
+/**
+ * OPR.0.4.3.33 — idempotent, non-clobbering, section-scoped writer for a single
+ * `[hooks.state."<key>"] trusted_hash = "<hash>"` record. Mirrors upsertCodexProjectTrust:
+ * find/create the exact table header, splice ONLY its `trusted_hash` line, leave every other
+ * `[hooks.state]` / `[projects]` entry and the managed hook block byte-identical. Same key+hash
+ * ⇒ no-op. Only ever called for OUR 4 authored hook keys (never a blanket/wildcard trust).
+ */
+export declare function upsertCodexHookTrust(content: string, key: string, hash: string): string;
 export declare function isCodex013xOrLater(version: string): boolean;
+declare const OPENRIG_ACTIVITY_HOOK_EVENTS: readonly ["SessionStart", "UserPromptSubmit", "Stop", "PermissionRequest"];
+export {};
 //# sourceMappingURL=codex-runtime-adapter.d.ts.map

package/daemon/dist/adapters/codex-runtime-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-runtime-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/codex-runtime-adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAKtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,OAAO,WAAW;IAC3B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,aAAa,CAA8D;IACnF,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,mBAAmB,CAAsB;IAKjD,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,iBAAiB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5E,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QACxD,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUD;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAehF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,IAAI,IAAI;IAmBhC;;;;;;OAMG;IACH,wBAAwB,IAAI,IAAI;IAY1B,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IAkG/B,OAAO,CAAC,wBAAwB;IAW1B,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAqBlD,iCAAiC;YAiCjC,4BAA4B;IAuC1C,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI9D,OAAO,CAAC,YAAY;IA2CpB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAe5B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,uBAAuB;IAsB/B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;YAUZ,oBAAoB;YAsBpB,kBAAkB;IAsGhC,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,oBAAoB;CAO7B;AAwDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D"}
+{"version":3,"file":"codex-runtime-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/codex-runtime-adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAKtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,OAAO,WAAW;IAC3B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,aAAa,CAA8D;IACnF,OAAO,CAAC,iBAAiB,CAAsC;IAC/D,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,mBAAmB,CAAsB;IAKjD,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,iBAAiB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5E,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QACxD,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUD;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAehF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,IAAI,IAAI;IA+BhC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IAiBnC;;;;;;OAMG;IACH,wBAAwB,IAAI,IAAI;IAY1B,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IAkG/B,OAAO,CAAC,wBAAwB;IAW1B,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAqBlD,iCAAiC;YAiCjC,4BAA4B;IAuC1C,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI9D,OAAO,CAAC,YAAY;IA2CpB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAe5B;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,uBAAuB;IAsB/B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;YAUZ,oBAAoB;YAsBpB,kBAAkB;IAsGhC,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,oBAAoB;CAO7B;AAsGD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,EACpD,KAAK,EAAE,mBAAmB,GACzB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoB/B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CA8BvF;AAuBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D;AA4DD,QAAA,MAAM,4BAA4B,4EAA6E,CAAC"}

package/daemon/dist/adapters/codex-runtime-adapter.js

@@ -98,12 +98,51 @@ export class CodexRuntimeAdapter {
             return;
         const configPath = nodePath.join(homedir, ".codex", "config.toml");
         const existing = this.fs.exists(configPath) ? this.fs.readFile(configPath) : "";
-        const updated = upsertCodexActivityHooks(existing, relay);
-        if (updated !== existing) {
+        const withHooks = upsertCodexActivityHooks(existing, relay);
+        if (withHooks !== existing) {
             this.fs.mkdirp(nodePath.dirname(configPath));
-            this.fs.writeFile(configPath, updated);
+            this.fs.writeFile(configPath, withHooks);
+        }
+        // OPR.0.4.3.33 hook-trust-autoclear — pre-write Codex's OWN hook trust record
+        // ([hooks.state."<key>"] trusted_hash) for exactly our 4 authored hooks, on the SAME
+        // seam that provisions them, so the daemon's unmanaged inline hooks are trusted from
+        // clean config on EVERY path a fresh Codex process reads config (launch/adopt/reconcile)
+        // — not just the launch keystroke gate. Layer-2 floor (dismissCodexInteractiveGates)
+        // stays as the fail-safe if a Codex-version drift changes the identity/hash. Idempotent
+        // + non-clobbering; only touches our 4 keys. See applyCodexActivityHookTrust for the RTFM.
+        const trusted = this.applyCodexActivityHookTrust(withHooks, configPath, relay);
+        if (trusted !== withHooks) {
+            this.fs.mkdirp(nodePath.dirname(configPath));
+            this.fs.writeFile(configPath, trusted);
         }
     }
+    /**
+     * OPR.0.4.3.33 — compute + splice Codex's `[hooks.state."<key>"] trusted_hash` for our 4
+     * authored activity hooks into `content`. `key_source` is the canonicalized config path
+     * (Codex keys trust by `std::fs::canonicalize(config.toml).display()`); we best-effort
+     * `realpathSync` the config path to match — on a miss (file not yet on real disk, or a mock
+     * fs in tests) we fall back to the plain absolute path, and any resulting key mismatch just
+     * degrades to the launch-time trust gate (Layer-2 floor), never a broken run. The command
+     * string is the value Codex deserializes from our TOML literal `'node "<relay>"'` — i.e.
+     * `node "<relay>"` WITHOUT the outer TOML quote delimiters. Timeout=5, matcher/status None.
+     */
+    applyCodexActivityHookTrust(content, configPath, relay) {
+        let keySource = configPath;
+        try {
+            keySource = fs.realpathSync(configPath);
+        }
+        catch {
+            // config.toml not on the real filesystem (first write / unit-test mock fs) — the plain
+            // absolute path is the honest best guess; a canonicalization delta is fail-safe (gate reappears).
+        }
+        const command = `node "${relay}"`;
+        let next = content;
+        for (const event of OPENRIG_ACTIVITY_HOOK_EVENTS) {
+            const { key, hash } = computeCodexHookTrust(event, { keySource, command, timeoutSec: 5 });
+            next = upsertCodexHookTrust(next, key, hash);
+        }
+        return next;
+    }
     /**
      * OPR.0.4.1.10 B3 — durable disable. When runtime.codex.hooks_enabled is false, strip the
      * OpenRig-managed activity-hooks sentinel block from ~/.codex/config.toml so a seat that was
@@ -693,6 +732,131 @@ function upsertCodexProjectTrust(content, projectPath) {
     }
     return `${lines.join("\n").replace(/\n*$/, "\n")}`;
 }
+// ── OPR.0.4.3.33 hook-trust-autoclear ────────────────────────────────────────────────────
+// Pre-write Codex's OWN hook trust record so the daemon's provisioned (unmanaged) inline
+// activity hooks are trusted on every path (launch/adopt/reconcile) without a manual `/hooks`
+// "Trust all" keystroke. Codex is a private impl; the key+hash below are REPRODUCED from the
+// open source (RTFM, cited) and are PROVISIONAL until pinned by a byte-for-byte read-back of a
+// real Codex `[hooks.state]` after `/hooks`->"Trust all" (the QA VM proof — see the unit test
+// fixture marked PIN-TO-VM). A mismatch is fail-safe: Codex re-shows the gate and the launch-time
+// Layer-2 keystroke floor (dismissCodexInteractiveGates) clears it — never a false-trusted run.
+//
+// RTFM sources (cite):
+//   - https://developers.openai.com/codex/hooks
+//   - openai/codex PR #20321 "hook trust metadata and enforcement" (merge commit 0452dca;
+//     typed-identity commit ffcc9cc) — key file codex-rs/hooks/src/engine/discovery.rs.
+//   - openai/codex issue #21615 (the `[hooks.state]` pre-write workaround for exactly this
+//     local-wrapper-installer case) + #23259 (positional path-keying fragility).
+//
+// KEY — codex-rs/hooks/src/lib.rs `hook_key`:
+//   `{key_source}:{event_label}:{group_index}:{handler_index}`
+//   - key_source: `std::fs::canonicalize(~/.codex/config.toml).display()` (the config source
+//     layer identity; confirmed by codex-rs/app-server/tests/suite/v2/hooks_list.rs which keys
+//     `{canonicalize(config.toml).display()}:pre_tool_use:0:0`).
+//   - event_label: `hook_event_key_label()` — SessionStart→session_start,
+//     UserPromptSubmit→user_prompt_submit, Stop→stop, PermissionRequest→permission_request.
+//   - group_index/handler_index: positional. Our managed block writes exactly one
+//     `[[hooks.<Ev>]]` group (0) with one `[[hooks.<Ev>.hooks]]` handler (0) per event ⇒ 0:0.
+//     (Positional keying is a known upstream fragility (#23259); if a user pre-authored hooks
+//     for the same event in the same layer our index would shift → gate reappears → fail-safe.)
+//
+// HASH — codex-rs/hooks/src/engine/discovery.rs `command_hook_hash`
+//        → codex-rs/config/src/fingerprint.rs `version_for_toml`:
+//   hash = "sha256:" + hex( sha256( canonical_json( toml_value( NormalizedHookIdentity ) ) ) )
+//   NormalizedHookIdentity { event_name: <label>, #[serde(flatten)] group: MatcherGroup }
+//   MatcherGroup { matcher: Option<String>, hooks: Vec<HookHandlerConfig> }
+//   HookHandlerConfig::Command (codex-rs/config/src/hook_config.rs, `#[serde(tag="type")]`,
+//     rename "command"): { command: String, commandWindows: Option, timeout(=timeout_sec):
+//     Option<u64>, async: bool, statusMessage: Option }
+//   Load-bearing serialization facts:
+//     * `TomlValue::try_from` DROPS None fields (TOML has no null) → matcher / commandWindows /
+//       statusMessage are omitted for our hooks; `async` is a plain bool (not Option) so
+//       `async = false` IS present.
+//     * event_name uses the snake_case label (session_start …), NOT the CamelCase event.
+//     * `version_for_toml` converts the TomlValue → serde_json Value, `canonical_json` sorts
+//       every object's keys recursively, then sha256's the COMPACT JSON bytes. serde_json's
+//       compact output (no spaces, `/` unescaped, `"`/`\` JSON-escaped) matches JSON.stringify.
+//   CONFIDENCE: the HASH is fully deterministic from the open source (JSON+sha256) — HIGH.
+//   The KEY's exact key_source canonical form + the positional indices are what the VM
+//   read-back must confirm — PROVISIONAL until then.
+/** Recursively sort object keys (mirrors codex-rs fingerprint.rs `canonical_json`). */
+function canonicalizeJsonValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalizeJsonValue);
+    if (value !== null && typeof value === "object") {
+        const src = value;
+        const out = {};
+        for (const key of Object.keys(src).sort())
+            out[key] = canonicalizeJsonValue(src[key]);
+        return out;
+    }
+    return value;
+}
+const CODEX_HOOK_EVENT_KEY_LABEL = {
+    SessionStart: "session_start",
+    UserPromptSubmit: "user_prompt_submit",
+    Stop: "stop",
+    PermissionRequest: "permission_request",
+};
+/**
+ * Reproduce Codex's persisted hook trust `{ key, trusted_hash }` for one authored activity
+ * hook. Pure + deterministic. See the block comment above for the full RTFM derivation and the
+ * PROVISIONAL-until-VM-read-back caveat.
+ */
+export function computeCodexHookTrust(event, input) {
+    const label = CODEX_HOOK_EVENT_KEY_LABEL[event];
+    const groupIndex = input.groupIndex ?? 0;
+    const handlerIndex = input.handlerIndex ?? 0;
+    const key = `${input.keySource}:${label}:${groupIndex}:${handlerIndex}`;
+    // Build NormalizedHookIdentity exactly as `TomlValue::try_from` would: None fields dropped.
+    const handler = {
+        type: "command",
+        command: input.command,
+        timeout: input.timeoutSec,
+        async: false,
+    };
+    if (input.statusMessage != null)
+        handler.statusMessage = input.statusMessage;
+    const identity = { event_name: label, hooks: [handler] };
+    if (input.matcher != null)
+        identity.matcher = input.matcher;
+    const serialized = JSON.stringify(canonicalizeJsonValue(identity));
+    const hex = createHash("sha256").update(serialized, "utf8").digest("hex");
+    return { key, hash: `sha256:${hex}` };
+}
+/**
+ * OPR.0.4.3.33 — idempotent, non-clobbering, section-scoped writer for a single
+ * `[hooks.state."<key>"] trusted_hash = "<hash>"` record. Mirrors upsertCodexProjectTrust:
+ * find/create the exact table header, splice ONLY its `trusted_hash` line, leave every other
+ * `[hooks.state]` / `[projects]` entry and the managed hook block byte-identical. Same key+hash
+ * ⇒ no-op. Only ever called for OUR 4 authored hook keys (never a blanket/wildcard trust).
+ */
+export function upsertCodexHookTrust(content, key, hash) {
+    const header = `[hooks.state.${JSON.stringify(key)}]`;
+    const trustLine = `trusted_hash = ${JSON.stringify(hash)}`;
+    const lines = content.length > 0 ? content.split("\n") : [];
+    const headerIndex = lines.findIndex((line) => line.trim() === header);
+    if (headerIndex === -1) {
+        const trimmed = content.trimEnd();
+        const prefix = trimmed.length > 0 ? `${trimmed}\n\n` : "";
+        return `${prefix}${header}\n${trustLine}\n`;
+    }
+    let nextSectionIndex = lines.length;
+    for (let i = headerIndex + 1; i < lines.length; i++) {
+        if (lines[i].trim().startsWith("[")) {
+            nextSectionIndex = i;
+            break;
+        }
+    }
+    const hashIndex = lines.findIndex((line, index) => index > headerIndex && index < nextSectionIndex && line.trim().startsWith("trusted_hash"));
+    if (hashIndex >= 0) {
+        lines[hashIndex] = trustLine;
+    }
+    else {
+        lines.splice(headerIndex + 1, 0, trustLine);
+    }
+    return `${lines.join("\n").replace(/\n*$/, "\n")}`;
+}
 function parseCanonicalSessionName(sessionName) {
     const trimmed = sessionName.trim();
     const atIndex = trimmed.indexOf("@");