@praxis.guard/auditor-cli 0.0.44 → 0.0.45

package/README.md

@@ -21,6 +21,21 @@ Each `auditor setup` command auto-detects installed agents and configures all of
 |-------|-----|----------------|--------------|
 | **Cursor** (`--for=cursor`) | `~/.cursor/mcp.json` | `~/.cursor/hooks.json` (or `.cursor/hooks.json` per-project) | `.cursor/environment.json` |
 | **Claude Desktop** (`--for=claude-desktop`) | `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) / `%APPDATA%/Claude/claude_desktop_config.json` (Windows) | — | — |
+| **Claude Code** (`--for=claude-code`) | `~/.claude.json` | `PreToolUse` for Bash | — |
+
+## Codex app workflow
+
+Codex support is repo-local rather than an auto-detected host adapter:
+
+```bash
+auditor setup codex
+auditor setup codex doctor
+```
+
+Setup merges the Praxis MCP server into `.codex/config.toml` and installs `PreToolUse` and
+`PermissionRequest` hooks in `.codex/hooks.json`. Open the repository in Codex and review/trust
+the hook definitions before they can run. V1 governs Bash and MCP calls; Praxis's own `guard`
+and `guard_wait` tools are excluded so approval requests cannot block themselves.
 
 The MCP server tags itself with `PRAXIS_AGENT_HOST=<agent>` in its registration env so heartbeats report which host launched it. See [docs/auditor-cli-multi-agent-adapter-design.md](../../docs/auditor-cli-multi-agent-adapter-design.md) for the full design.
 

package/dist/cli/dispatch-hook.d.ts

@@ -0,0 +1,2 @@
+export declare function dispatchHookCommand(name: string | undefined): Promise<boolean>;
+//# sourceMappingURL=dispatch-hook.d.ts.map

package/dist/cli/dispatch-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-hook.d.ts","sourceRoot":"","sources":["../../src/cli/dispatch-hook.ts"],"names":[],"mappings":"AAIA,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBpF"}

package/dist/cli/dispatch-hook.js

@@ -0,0 +1,29 @@
+import { runBeforeMcpHookFromStdin } from "../hooks/run-before-mcp.js";
+import { runBeforeShellHookFromStdin } from "../hooks/run-before-shell.js";
+import { runClaudeCodePreToolUseHookFromStdin } from "../hooks/run-claude-code-pre-tool-use.js";
+export async function dispatchHookCommand(name) {
+    if (name === "before-shell") {
+        await runBeforeShellHookFromStdin();
+        return true;
+    }
+    if (name === "before-mcp") {
+        await runBeforeMcpHookFromStdin();
+        return true;
+    }
+    if (name === "claude-code") {
+        await runClaudeCodePreToolUseHookFromStdin();
+        return true;
+    }
+    if (name === "codex-pre-tool-use") {
+        const { runCodexPreToolUseHookFromStdin } = await import("../hooks/run-codex-hooks.js");
+        await runCodexPreToolUseHookFromStdin();
+        return true;
+    }
+    if (name === "codex-permission-request") {
+        const { runCodexPermissionRequestHookFromStdin } = await import("../hooks/run-codex-hooks.js");
+        await runCodexPermissionRequestHookFromStdin();
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=dispatch-hook.js.map

package/dist/cli/dispatch-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-hook.js","sourceRoot":"","sources":["../../src/cli/dispatch-hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AAEhG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,2BAA2B,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,yBAAyB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,oCAAoC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,EAAE,+BAA+B,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,+BAA+B,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,MAAM,EAAE,sCAAsC,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/F,MAAM,sCAAsC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/dispatch-setup.d.ts

@@ -0,0 +1,2 @@
+export declare function dispatchSetupCommand(sub: string | undefined, args: string[]): Promise<void>;
+//# sourceMappingURL=dispatch-setup.d.ts.map

package/dist/cli/dispatch-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-setup.d.ts","sourceRoot":"","sources":["../../src/cli/dispatch-setup.ts"],"names":[],"mappings":"AAAA,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCjG"}

package/dist/cli/dispatch-setup.js

@@ -0,0 +1,34 @@
+export async function dispatchSetupCommand(sub, args) {
+    if (sub === "all") {
+        const { runSetupAll } = await import("./setup-all.js");
+        await runSetupAll(args);
+        return;
+    }
+    if (sub === "hook") {
+        const { runSetupHook } = await import("./setup-hook.js");
+        await runSetupHook(args);
+        return;
+    }
+    if (sub === "mcp") {
+        const { runSetupMcp } = await import("./setup-mcp.js");
+        await runSetupMcp(args);
+        return;
+    }
+    if (sub === "cloud") {
+        const { runSetupCloud } = await import("./setup-cloud.js");
+        await runSetupCloud(args);
+        return;
+    }
+    if (sub === "doctor") {
+        const { runSetupDoctor } = await import("./setup-doctor.js");
+        await runSetupDoctor(args);
+        return;
+    }
+    if (sub === "codex") {
+        const { runSetupCodex } = await import("./setup-codex.js");
+        await runSetupCodex(args);
+        return;
+    }
+    throw new Error(`Unknown setup command: ${sub ?? "(missing)"}`);
+}
+//# sourceMappingURL=dispatch-setup.js.map

package/dist/cli/dispatch-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-setup.js","sourceRoot":"","sources":["../../src/cli/dispatch-setup.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAuB,EAAE,IAAc;IAChF,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/cli/help.d.ts

@@ -0,0 +1,2 @@
+export declare function printHelp(): void;
+//# sourceMappingURL=help.d.ts.map

package/dist/cli/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AA2DA,wBAAgB,SAAS,IAAI,IAAI,CAEhC"}

package/dist/cli/help.js

@@ -0,0 +1,61 @@
+import process from "node:process";
+const HELP_TEXT = `auditor — Praxis guard CLI
+
+Usage:
+  auditor setup all          Global hook + MCP; cloud environment.json in cwd (or --project)
+  auditor setup hook         Configure ~/.cursor/hooks.json (all workspaces; use --project for repo)
+  auditor setup mcp          Configure ~/.cursor/mcp.json praxis-guard server
+  auditor setup cloud        Configure .cursor/environment.json for Cloud Agents
+  auditor setup doctor       Validate global hook + MCP setup (reports project hooks too)
+  auditor setup codex        Configure repo-local .codex MCP + hooks (--project, --dry-run)
+  auditor setup codex doctor Validate repo-local Codex setup
+  auditor login              Authenticate this CLI with your Praxis account (device code flow)
+  auditor logout [--revoke]  Remove saved credentials (and optionally revoke token server-side)
+  auditor token create       Generate a new bearer token (for Cloud Agents, CI, etc.)
+  auditor whoami             Show signed-in uid, email, and token source (calls Cloud Function)
+  auditor mcp                MCP stdio server (tools: guard, guard_wait) — use in Cursor mcp.json
+  auditor approvals list     List pending approval requests
+  auditor approvals open <id>  Print approval URL for a request
+  auditor approvals approve <id>  Dev-only: approve request (GUARD_APPROVAL_DEV=1)
+  auditor approvals deny <id>   Deny an approval request (human auth or dev)
+  auditor approvals watch <id>  Poll until approved and write execution ticket
+  auditor hook before-shell  Cursor beforeShellExecution (stdin JSON → stdout JSON)
+  auditor hook before-mcp    Cursor beforeMCPExecution (stdin JSON → stdout JSON)
+  auditor hook claude-code   Claude Code PreToolUse/Bash (stdin JSON → stdout JSON)
+  auditor hook codex-pre-tool-use       Codex PreToolUse (Bash + MCP)
+  auditor hook codex-permission-request Codex PermissionRequest (Bash + MCP)
+  auditor doctor             Show policy path, sync revision, auth status
+  auditor policies sync      Fetch policies from Cloud Functions → local policies.v1.json + meta
+  auditor version            Package version and git short SHA when available
+  auditor help | --help      This message
+
+Auth:
+  Token is resolved in order: PRAXIS_GUARD_TOKEN env var → ~/.config/praxis/credentials.json.
+  Run \`auditor login\` to authenticate interactively.
+
+Defaults (production):
+  Project ID and region use built-in Praxis production values unless overridden below.
+  Function URLs are derived from project/region or explicit base-url env vars.
+
+Local development:
+  Set PRAXIS_FIREBASE_FUNCTIONS_EMULATOR_HOST to your Functions emulator host:port.
+
+Env (all optional):
+  PRAXIS_GUARD_TOKEN                       Override token (CI/CD). Skips credential file.
+  PRAXIS_FIREBASE_ID_TOKEN                 Alternative: Firebase Auth ID JWT for the functions project.
+  PRAXIS_FIREBASE_FUNCTIONS_EMULATOR_HOST  Functions emulator host:port (local dev).
+  PRAXIS_FIREBASE_PROJECT_ID               Override Firebase project id.
+  PRAXIS_FIREBASE_FUNCTIONS_REGION         Override Functions region.
+  PRAXIS_FIREBASE_CALLABLE_BASE_URL        Full override base URL (no trailing slash).
+  PRAXIS_GUARD_EVENT_URL                   Full override for guard event endpoint.
+  PRAXIS_APP_URL                           Web app origin for login and approval links.
+  PRAXIS_POLICIES_V1_PATH                  Override path for policies.v1.json (default: ~/.praxis/policies.v1.json).
+  PRAXIS_POLICIES_META_PATH                Override path for policies.v1.meta.json (default beside policy file).
+  PRAXIS_GUARD_STORAGE_ROOT                Workspace root for .praxis/guard tickets/pending (auto-detected from cwd).
+  PRAXIS_HOOK_INLINE_APPROVAL              Set to 0 to disable hook-inline approval request on MUTATE deny (default: on).
+  PRAXIS_HOOK_INLINE_APPROVAL_TIMEOUT_MS   Max ms for inline approval HTTP from hooks (default: 1200).
+`;
+export function printHelp() {
+    process.stdout.write(HELP_TEXT);
+}
+//# sourceMappingURL=help.js.map

package/dist/cli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDjB,CAAC;AAEF,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA+DA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyJ1D"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAQA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkH1D"}

package/dist/cli/main.js

@@ -1,63 +1,9 @@
 import process from "node:process";
 import { runDoctor } from "./doctor.js";
-import { runBeforeShellHookFromStdin } from "../hooks/run-before-shell.js";
-import { runBeforeMcpHookFromStdin } from "../hooks/run-before-mcp.js";
-import { runClaudeCodePreToolUseHookFromStdin } from "../hooks/run-claude-code-pre-tool-use.js";
+import { dispatchHookCommand } from "./dispatch-hook.js";
+import { dispatchSetupCommand } from "./dispatch-setup.js";
+import { printHelp } from "./help.js";
 import { runVersion } from "./version.js";
-function printHelp() {
-    process.stdout.write(`auditor — Praxis guard CLI
-
-Usage:
-  auditor setup all          Global hook + MCP; cloud environment.json in cwd (or --project)
-  auditor setup hook         Configure ~/.cursor/hooks.json (all workspaces; use --project for repo)
-  auditor setup mcp          Configure ~/.cursor/mcp.json praxis-guard server
-  auditor setup cloud        Configure .cursor/environment.json for Cloud Agents
-  auditor setup doctor       Validate global hook + MCP setup (reports project hooks too)
-  auditor login              Authenticate this CLI with your Praxis account (device code flow)
-  auditor logout [--revoke]  Remove saved credentials (and optionally revoke token server-side)
-  auditor token create       Generate a new bearer token (for Cloud Agents, CI, etc.)
-  auditor whoami             Show signed-in uid, email, and token source (calls Cloud Function)
-  auditor mcp                MCP stdio server (tools: guard, guard_wait) — use in Cursor mcp.json
-  auditor approvals list     List pending approval requests
-  auditor approvals open <id>  Print approval URL for a request
-  auditor approvals approve <id>  Dev-only: approve request (GUARD_APPROVAL_DEV=1)
-  auditor approvals deny <id>   Deny an approval request (human auth or dev)
-  auditor approvals watch <id>  Poll until approved and write execution ticket
-  auditor hook before-shell  Cursor beforeShellExecution (stdin JSON → stdout JSON)
-  auditor hook before-mcp    Cursor beforeMCPExecution (stdin JSON → stdout JSON)
-  auditor hook claude-code   Claude Code PreToolUse/Bash (stdin JSON → stdout JSON)
-  auditor doctor             Show policy path, sync revision, auth status
-  auditor policies sync      Fetch policies from Cloud Functions → local policies.v1.json + meta
-  auditor version            Package version and git short SHA when available
-  auditor help | --help      This message
-
-Auth:
-  Token is resolved in order: PRAXIS_GUARD_TOKEN env var → ~/.config/praxis/credentials.json.
-  Run \`auditor login\` to authenticate interactively.
-
-Defaults (production):
-  Project ID and region use built-in Praxis production values unless overridden below.
-  Function URLs are derived from project/region or explicit base-url env vars.
-
-Local development:
-  Set PRAXIS_FIREBASE_FUNCTIONS_EMULATOR_HOST to your Functions emulator host:port.
-
-Env (all optional):
-  PRAXIS_GUARD_TOKEN                       Override token (CI/CD). Skips credential file.
-  PRAXIS_FIREBASE_ID_TOKEN                 Alternative: Firebase Auth ID JWT for the functions project.
-  PRAXIS_FIREBASE_FUNCTIONS_EMULATOR_HOST  Functions emulator host:port (local dev).
-  PRAXIS_FIREBASE_PROJECT_ID               Override Firebase project id.
-  PRAXIS_FIREBASE_FUNCTIONS_REGION         Override Functions region.
-  PRAXIS_FIREBASE_CALLABLE_BASE_URL        Full override base URL (no trailing slash).
-  PRAXIS_GUARD_EVENT_URL                   Full override for guard event endpoint.
-  PRAXIS_APP_URL                           Web app origin for login and approval links.
-  PRAXIS_POLICIES_V1_PATH                  Override path for policies.v1.json (default: ~/.praxis/policies.v1.json).
-  PRAXIS_POLICIES_META_PATH                Override path for policies.v1.meta.json (default beside policy file).
-  PRAXIS_GUARD_STORAGE_ROOT                Workspace root for .praxis/guard tickets/pending (auto-detected from cwd).
-  PRAXIS_HOOK_INLINE_APPROVAL              Set to 0 to disable hook-inline approval request on MUTATE deny (default: on).
-  PRAXIS_HOOK_INLINE_APPROVAL_TIMEOUT_MS   Max ms for inline approval HTTP from hooks (default: 1200).
-`);
-}
 export async function runCli(argv) {
     const a0 = argv[0];
     const a1 = argv[1];
@@ -90,35 +36,9 @@ export async function runCli(argv) {
         return;
     }
     if (a0 === "setup") {
-        const sub = a1;
-        const rest = argv.slice(2);
         try {
-            if (sub === "all") {
-                const { runSetupAll } = await import("./setup-all.js");
-                await runSetupAll(rest);
-                return;
-            }
-            if (sub === "hook") {
-                const { runSetupHook } = await import("./setup-hook.js");
-                await runSetupHook(rest);
-                return;
-            }
-            if (sub === "mcp") {
-                const { runSetupMcp } = await import("./setup-mcp.js");
-                await runSetupMcp(rest);
-                return;
-            }
-            if (sub === "cloud") {
-                const { runSetupCloud } = await import("./setup-cloud.js");
-                await runSetupCloud(rest);
-                return;
-            }
-            if (sub === "doctor") {
-                const { runSetupDoctor } = await import("./setup-doctor.js");
-                await runSetupDoctor(rest);
-                return;
-            }
-            throw new Error(`Unknown setup command: ${sub ?? "(missing)"}`);
+            await dispatchSetupCommand(a1, argv.slice(2));
+            return;
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
@@ -176,18 +96,8 @@ export async function runCli(argv) {
         await runMcpStdioServer();
         return;
     }
-    if (a0 === "hook" && a1 === "before-shell") {
-        await runBeforeShellHookFromStdin();
-        return;
-    }
-    if (a0 === "hook" && a1 === "before-mcp") {
-        await runBeforeMcpHookFromStdin();
+    if (a0 === "hook" && (await dispatchHookCommand(a1)))
         return;
-    }
-    if (a0 === "hook" && a1 === "claude-code") {
-        await runClaudeCodePreToolUseHookFromStdin();
-        return;
-    }
     if (a0 === "approvals") {
         const { runApprovals } = await import("./approvals.js");
         try {

package/dist/cli/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDtB,CAAC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnB,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3D,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACvD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACzD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACvD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAC3D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBAC7D,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1D,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,SAAS,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,iBAAiB,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,2BAA2B,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QACzC,MAAM,yBAAyB,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,aAAa,EAAE,CAAC;QAC1C,MAAM,oCAAoC,EAAE,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QACvB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnB,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3D,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1D,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,SAAS,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,iBAAiB,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO;IAE7D,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QACvB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/cli/setup-codex.d.ts

@@ -0,0 +1,9 @@
+type CodexSetupOptions = {
+    projectDir: string;
+    dryRun: boolean;
+    doctor: boolean;
+};
+export declare function parseSetupCodexOptions(args: string[]): CodexSetupOptions;
+export declare function runSetupCodex(args: string[]): Promise<void>;
+export {};
+//# sourceMappingURL=setup-codex.d.ts.map

package/dist/cli/setup-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-codex.d.ts","sourceRoot":"","sources":["../../src/cli/setup-codex.ts"],"names":[],"mappings":"AAQA,KAAK,iBAAiB,GAAG;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CA0BxE;AAmBD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAejE"}

package/dist/cli/setup-codex.js

@@ -0,0 +1,61 @@
+import process from "node:process";
+import { readCodexSetupStatus, upsertCodexConfig, upsertCodexHooks, } from "../codex/config.js";
+export function parseSetupCodexOptions(args) {
+    let projectDir = process.cwd();
+    let dryRun = false;
+    let doctor = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "doctor") {
+            doctor = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--project") {
+            const value = args[i + 1];
+            if (!value)
+                throw new Error("Missing value for --project");
+            projectDir = value;
+            i++;
+            continue;
+        }
+        throw new Error(`Unknown setup codex option: ${arg}`);
+    }
+    return { projectDir, dryRun, doctor };
+}
+async function runCodexDoctor(projectDir) {
+    const status = await readCodexSetupStatus(projectDir);
+    const hookReady = status.preToolUseConfigured && status.permissionRequestConfigured;
+    const ready = status.mcpConfigured && hookReady;
+    const lines = [
+        `Codex setup doctor (${projectDir}):`,
+        `  MCP: ${status.mcpConfigured ? "configured" : "missing"} (${status.configPath})`,
+        `  PreToolUse: ${status.preToolUseConfigured ? "configured" : "missing"} (${status.hooksPath})`,
+        `  PermissionRequest: ${status.permissionRequestConfigured ? "configured" : "missing"} (${status.hooksPath})`,
+        `  AGENTS.md: ${status.agentsGuidancePresent ? "present" : "missing (recommended)"}`,
+        "  Hook trust: cannot be verified by auditor; review and trust the hooks in Codex.",
+        `  Ready: ${ready ? "yes" : "no"}`,
+    ];
+    process.stdout.write(`${lines.join("\n")}\n`);
+    if (!ready)
+        process.exitCode = 1;
+}
+export async function runSetupCodex(args) {
+    const opts = parseSetupCodexOptions(args);
+    if (opts.doctor) {
+        await runCodexDoctor(opts.projectDir);
+        return;
+    }
+    const [config, hooks] = await Promise.all([
+        upsertCodexConfig(opts.projectDir, opts.dryRun),
+        upsertCodexHooks(opts.projectDir, opts.dryRun),
+    ]);
+    process.stdout.write(`setup codex (${opts.projectDir}):\n`);
+    process.stdout.write(`  mcp:   ${config.message}\n    path: ${config.path}\n`);
+    process.stdout.write(`  hooks: ${hooks.message}\n    path: ${hooks.path}\n`);
+    process.stdout.write("  next: open the project in Codex and review/trust the Praxis hooks.\n");
+}
+//# sourceMappingURL=setup-codex.js.map

package/dist/cli/setup-codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-codex.js","sourceRoot":"","sources":["../../src/cli/setup-codex.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,IAAI,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC3D,UAAU,GAAG,KAAK,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,2BAA2B,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG;QACZ,uBAAuB,UAAU,IAAI;QACrC,UAAU,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,GAAG;QAClF,iBAAiB,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,GAAG;QAC/F,wBAAwB,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,GAAG;QAC7G,gBAAgB,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,EAAE;QACpF,mFAAmF;QACnF,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/C,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;KAC/C,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,UAAU,MAAM,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,OAAO,eAAe,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;AACjG,CAAC"}

package/dist/codex/config.d.ts

@@ -0,0 +1,23 @@
+type JsonMap = Record<string, unknown>;
+export type CodexSetupResult = {
+    path: string;
+    changed: boolean;
+    message: string;
+};
+export type CodexSetupStatus = {
+    configPath: string;
+    hooksPath: string;
+    mcpConfigured: boolean;
+    preToolUseConfigured: boolean;
+    permissionRequestConfigured: boolean;
+    agentsGuidancePresent: boolean;
+};
+export declare function codexConfigPath(projectDir: string): string;
+export declare function codexHooksPath(projectDir: string): string;
+export declare function mergeCodexConfigToml(source: string): string;
+export declare function mergeCodexHooks(existing: JsonMap | null): JsonMap;
+export declare function upsertCodexConfig(projectDir: string, dryRun?: boolean): Promise<CodexSetupResult>;
+export declare function upsertCodexHooks(projectDir: string, dryRun?: boolean): Promise<CodexSetupResult>;
+export declare function readCodexSetupStatus(projectDir: string): Promise<CodexSetupStatus>;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/codex/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAUA,KAAK,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEvC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,2BAA2B,EAAE,OAAO,CAAC;IACrC,qBAAqB,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAsDD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG3D;AAoCD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAqBjE;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWrG;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;AAgBD,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBxF"}

package/dist/codex/config.js

@@ -0,0 +1,177 @@
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+const CODEX_DIR = ".codex";
+const MCP_HEADER = '[mcp_servers."praxis-guard"]';
+const MCP_ENV_HEADER = '[mcp_servers."praxis-guard".env]';
+const PRE_TOOL_COMMAND = "auditor hook codex-pre-tool-use";
+const PERMISSION_COMMAND = "auditor hook codex-permission-request";
+export function codexConfigPath(projectDir) {
+    return path.join(projectDir, CODEX_DIR, "config.toml");
+}
+export function codexHooksPath(projectDir) {
+    return path.join(projectDir, CODEX_DIR, "hooks.json");
+}
+async function readText(pathname) {
+    try {
+        return await readFile(pathname, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "";
+        throw error;
+    }
+}
+async function writeAtomic(pathname, content) {
+    await mkdir(path.dirname(pathname), { recursive: true });
+    const temp = path.join(path.dirname(pathname), `.${path.basename(pathname)}.tmp.${process.pid}`);
+    await writeFile(temp, content, "utf8");
+    await rename(temp, pathname);
+}
+function isTableHeader(line) {
+    return /^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/.test(line);
+}
+function isPraxisMcpHeader(line) {
+    return /^\s*\[mcp_servers\.(?:"praxis-guard"|'praxis-guard'|praxis-guard)(?:\.env)?\]\s*(?:#.*)?$/.test(line);
+}
+function removePraxisMcpTables(source) {
+    const lines = source.split(/\r?\n/);
+    const kept = [];
+    let removing = false;
+    for (const line of lines) {
+        if (isTableHeader(line)) {
+            removing = isPraxisMcpHeader(line);
+        }
+        if (!removing)
+            kept.push(line);
+    }
+    return kept.join("\n").trimEnd();
+}
+function renderPraxisMcpConfig() {
+    return [
+        MCP_HEADER,
+        'command = "auditor"',
+        'args = ["mcp"]',
+        "",
+        MCP_ENV_HEADER,
+        'PRAXIS_AGENT_HOST = "codex-app"',
+    ].join("\n");
+}
+export function mergeCodexConfigToml(source) {
+    const base = removePraxisMcpTables(source);
+    return `${base ? `${base}\n\n` : ""}${renderPraxisMcpConfig()}\n`;
+}
+async function readJson(pathname) {
+    const raw = await readText(pathname);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("JSON root must be an object");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`Invalid JSON at ${pathname}: ${String(error)}. Refusing to overwrite existing file.`);
+    }
+}
+function commandHook(command, statusMessage) {
+    return { type: "command", command, timeout: 30, statusMessage };
+}
+function isPraxisHookGroup(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const hooks = value.hooks;
+    if (!Array.isArray(hooks))
+        return false;
+    return hooks.some((hook) => {
+        if (!hook || typeof hook !== "object" || Array.isArray(hook))
+            return false;
+        const command = hook.command;
+        return command === PRE_TOOL_COMMAND || command === PERMISSION_COMMAND;
+    });
+}
+function replacePraxisGroups(existing, additions) {
+    const groups = Array.isArray(existing) ? existing.filter((entry) => !isPraxisHookGroup(entry)) : [];
+    return [...groups, ...additions];
+}
+export function mergeCodexHooks(existing) {
+    const config = existing ? structuredClone(existing) : {};
+    const hooks = config.hooks && typeof config.hooks === "object" && !Array.isArray(config.hooks)
+        ? config.hooks
+        : {};
+    config.hooks = hooks;
+    hooks.PreToolUse = replacePraxisGroups(hooks.PreToolUse, [
+        {
+            matcher: "^Bash$|^mcp__.*",
+            hooks: [commandHook(PRE_TOOL_COMMAND, "Checking Praxis policy")],
+        },
+    ]);
+    hooks.PermissionRequest = replacePraxisGroups(hooks.PermissionRequest, [
+        {
+            matcher: "^Bash$|^mcp__.*",
+            hooks: [commandHook(PERMISSION_COMMAND, "Checking Praxis approval")],
+        },
+    ]);
+    return config;
+}
+export async function upsertCodexConfig(projectDir, dryRun = false) {
+    const pathname = codexConfigPath(projectDir);
+    const before = await readText(pathname);
+    const after = mergeCodexConfigToml(before);
+    const changed = before !== after;
+    if (changed && !dryRun)
+        await writeAtomic(pathname, after);
+    return {
+        path: pathname,
+        changed,
+        message: changed ? (dryRun ? "would update Codex MCP config" : "updated Codex MCP config") : "Codex MCP config already up to date",
+    };
+}
+export async function upsertCodexHooks(projectDir, dryRun = false) {
+    const pathname = codexHooksPath(projectDir);
+    const existing = await readJson(pathname);
+    const before = existing ? `${JSON.stringify(existing, null, 2)}\n` : "";
+    const after = `${JSON.stringify(mergeCodexHooks(existing), null, 2)}\n`;
+    const changed = before !== after;
+    if (changed && !dryRun)
+        await writeAtomic(pathname, after);
+    return {
+        path: pathname,
+        changed,
+        message: changed ? (dryRun ? "would update Codex hooks" : "updated Codex hooks") : "Codex hooks already up to date",
+    };
+}
+function hooksContainCommand(config, event, command) {
+    const hooks = config?.hooks;
+    if (!hooks || typeof hooks !== "object" || Array.isArray(hooks))
+        return false;
+    const groups = hooks[event];
+    if (!Array.isArray(groups))
+        return false;
+    return groups.some((group) => {
+        if (!group || typeof group !== "object" || Array.isArray(group))
+            return false;
+        const handlers = group.hooks;
+        return Array.isArray(handlers) && handlers.some((handler) => {
+            return !!handler && typeof handler === "object" && handler.command === command;
+        });
+    });
+}
+export async function readCodexSetupStatus(projectDir) {
+    const configPath = codexConfigPath(projectDir);
+    const hooksPath = codexHooksPath(projectDir);
+    const [config, hooks] = await Promise.all([readText(configPath), readJson(hooksPath).catch(() => null)]);
+    return {
+        configPath,
+        hooksPath,
+        mcpConfigured: config.includes(MCP_HEADER) &&
+            config.includes('command = "auditor"') &&
+            config.includes('PRAXIS_AGENT_HOST = "codex-app"'),
+        preToolUseConfigured: hooksContainCommand(hooks, "PreToolUse", PRE_TOOL_COMMAND),
+        permissionRequestConfigured: hooksContainCommand(hooks, "PermissionRequest", PERMISSION_COMMAND),
+        agentsGuidancePresent: existsSync(path.join(projectDir, "AGENTS.md")) || existsSync(path.join(projectDir, "AGENT.md")),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/codex/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,SAAS,GAAG,QAAQ,CAAC;AAC3B,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AAmBnE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjG,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,2FAA2F,CAAC,IAAI,CACrG,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;QACL,UAAU;QACV,qBAAqB;QACrB,gBAAgB;QAChB,EAAE;QACF,cAAc;QACd,iCAAiC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,IAAI,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAiB,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,aAAqB;IACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAI,KAAiB,CAAC,KAAK,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3E,MAAM,OAAO,GAAI,IAAgB,CAAC,OAAO,CAAC;QAC1C,OAAO,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,kBAAkB,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiB,EAAE,SAAoB;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAwB;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAE,eAAe,CAAC,QAAQ,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9E,CAAC,CAAE,MAAM,CAAC,KAAiB;QAC3B,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAErB,KAAK,CAAC,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE;QACvD;YACE,OAAO,EAAE,iBAAiB;YAC1B,KAAK,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;SACjE;KACF,CAAC,CAAC;IACH,KAAK,CAAC,iBAAiB,GAAG,mBAAmB,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACrE;YACE,OAAO,EAAE,iBAAiB;YAC1B,KAAK,EAAE,CAAC,WAAW,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;SACrE;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,qCAAqC;KACnI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,gCAAgC;KACpH,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB,EAAE,KAAa,EAAE,OAAe;IACjF,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAI,KAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,MAAM,QAAQ,GAAI,KAAiB,CAAC,KAAK,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1D,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAmB,CAAC,OAAO,KAAK,OAAO,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO;QACL,UAAU;QACV,SAAS;QACT,aAAa,EACX,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3B,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QACpD,oBAAoB,EAAE,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC;QAChF,2BAA2B,EAAE,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QAChG,qBAAqB,EACnB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;KAClG,CAAC;AACJ,CAAC"}

package/dist/codex/evaluate-tool.d.ts

@@ -0,0 +1,28 @@
+import { type Tier } from "../policy/index.js";
+export type CodexToolPayload = {
+    session_id?: string;
+    turn_id?: string;
+    cwd?: string;
+    hook_event_name?: string;
+    tool_name?: string;
+    tool_use_id?: string;
+    tool_input?: unknown;
+};
+export type CodexEvaluation = {
+    governed: boolean;
+    allowed: boolean;
+    tier: Tier;
+    argv: string[];
+    reason?: string;
+    storageRoot: string;
+    toolInputHash?: string | null;
+};
+type McpIdentity = {
+    server: string;
+    tool: string;
+};
+export declare function parseCodexMcpToolName(toolName: string): McpIdentity | null;
+export declare function isPraxisGuardTool(toolName: string): boolean;
+export declare function evaluateCodexTool(payload: CodexToolPayload): Promise<CodexEvaluation>;
+export {};
+//# sourceMappingURL=evaluate-tool.d.ts.map

package/dist/codex/evaluate-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-tool.d.ts","sourceRoot":"","sources":["../../src/codex/evaluate-tool.ts"],"names":[],"mappings":"AAMA,OAAO,EAA0C,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAQvF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,KAAK,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAK1E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3D;AAuKD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAW3F"}

package/dist/codex/evaluate-tool.js

@@ -0,0 +1,183 @@
+import { appendAuditJsonl } from "../audit/jsonl.js";
+import { toolInputSha256 } from "../approval/fingerprint.js";
+import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
+import { formatHookDenyMessages } from "../hooks/agent-message.js";
+import { resolveMutateHookPermission } from "../hooks/before-mcp-mutate.js";
+import { resolveShellMutateHookPermission } from "../hooks/before-shell-mutate.js";
+import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
+import { analyzeShellCommand } from "../shell/analyze-command.js";
+import { commandMayContainGovernedTool } from "../shell/governed-tools.js";
+import { evaluateMcpProposal } from "../shell/evaluate.js";
+import { sendGuardEvent } from "../telemetry/guard-events.js";
+import { recordCodexPermissionHandoff } from "./permission-handoff.js";
+export function parseCodexMcpToolName(toolName) {
+    if (!toolName.startsWith("mcp__"))
+        return null;
+    const parts = toolName.slice("mcp__".length).split("__");
+    if (parts.length < 2)
+        return null;
+    return { server: parts.slice(0, -1).join("__") || "stdio", tool: parts.at(-1) || "_" };
+}
+export function isPraxisGuardTool(toolName) {
+    const identity = parseCodexMcpToolName(toolName);
+    if (!identity || (identity.tool !== "guard" && identity.tool !== "guard_wait"))
+        return false;
+    return /^praxis(?:-|_)guard$/i.test(identity.server);
+}
+function codexReason(input) {
+    const formatted = formatHookDenyMessages({
+        hook: input.kind === "shell" ? "beforeShellExecution" : "beforeMCPExecution",
+        tier: input.tier,
+        argv: input.argv,
+        reasons: input.reasons,
+        toolName: input.toolName,
+        inlineApproval: input.inlineApproval,
+    });
+    return formatted.agent_message;
+}
+async function auditAndSend(input) {
+    const event = {
+        ts: new Date().toISOString(),
+        hook: "codexPreToolUse",
+        agent: "codex-app",
+        tool_name: input.payload.tool_name,
+        tool_input: input.payload.tool_input,
+        argv: input.argv,
+        tier: input.tier,
+        decision: input.allowed ? "allow" : "block",
+        governed: input.governed,
+        ticketConsumed: input.ticketConsumed,
+        reasons: input.reasons,
+        latency_ms: input.latencyMs,
+    };
+    await appendAuditJsonl(event, input.storageRoot).catch((error) => {
+        process.stderr.write(`[auditor] audit log append failed: ${String(error)}\n`);
+    });
+    await sendGuardEvent({
+        ...event,
+        status: input.allowed ? "passed" : "blocked",
+        tool: input.kind === "shell" ? "auditor-hook" : "auditor-hook-mcp",
+        command_path: input.argv[0] ?? null,
+        verb: input.argv[1] ?? null,
+        resource: input.argv.slice(2).join(" ") || null,
+        kind: input.kind,
+        ...(input.policyRevision !== null ? { policy_revision: input.policyRevision } : {}),
+    });
+}
+function shellReasons(analysis) {
+    const reasons = [];
+    if (!analysis.primary.evaluation.classification.matched)
+        reasons.push("unknown_command(default_deny)");
+    if (analysis.primary.evaluation.flags.metacharacters || analysis.raw_metacharacters)
+        reasons.push("metacharacters");
+    if (analysis.primary.evaluation.flags.dangerous_flags)
+        reasons.push("dangerous_flags");
+    if (analysis.fail_closed)
+        reasons.push("unparseable(fail_closed)");
+    if (analysis.invocations.length > 1)
+        reasons.push(`multiple_governed_invocations(${analysis.invocations.length})`);
+    return reasons;
+}
+async function evaluateBash(payload, started) {
+    const command = payload.tool_input && typeof payload.tool_input === "object"
+        ? payload.tool_input.command
+        : undefined;
+    const rawCommand = typeof command === "string" ? command : "";
+    const storageRoot = resolveGuardStorageRoot(payload.cwd);
+    if (!rawCommand || !commandMayContainGovernedTool(rawCommand)) {
+        return { governed: false, allowed: true, tier: "READ", argv: [], storageRoot };
+    }
+    const [policy, policyRevision] = await Promise.all([loadPoliciesV1(), readPoliciesV1Revision()]);
+    const analysis = analyzeShellCommand(rawCommand, policy);
+    if (analysis.skipped) {
+        return { governed: false, allowed: true, tier: "READ", argv: [], storageRoot };
+    }
+    const argv = analysis.primary.canonical_argv;
+    const tier = analysis.tier;
+    const reasons = shellReasons(analysis);
+    let allowed = tier === "READ";
+    let ticketConsumed = false;
+    let inlineApproval = null;
+    if (tier === "MUTATE") {
+        const mutate = await resolveShellMutateHookPermission({
+            tier,
+            argv,
+            analysis,
+            storageRoot,
+            rawDisplay: rawCommand,
+            policyRevision,
+            initialReasons: reasons,
+        });
+        allowed = mutate.permission === "allow";
+        ticketConsumed = mutate.ticketConsumed;
+        inlineApproval = mutate.inlineApproval;
+        reasons.splice(0, reasons.length, ...mutate.reasons);
+    }
+    if (ticketConsumed) {
+        await recordCodexPermissionHandoff({ storageRoot, argv, turnId: payload.turn_id });
+    }
+    const reason = allowed ? undefined : codexReason({ kind: "shell", tier, argv, reasons, inlineApproval });
+    await auditAndSend({ payload, kind: "shell", tier, argv, allowed, governed: true, ticketConsumed, reasons, policyRevision, storageRoot, latencyMs: performance.now() - started });
+    return { governed: true, allowed, tier, argv, reason, storageRoot };
+}
+async function evaluateMcp(payload, started) {
+    const toolName = payload.tool_name ?? "";
+    const identity = parseCodexMcpToolName(toolName);
+    const storageRoot = resolveGuardStorageRoot(payload.cwd);
+    if (!identity || isPraxisGuardTool(toolName)) {
+        return { governed: false, allowed: true, tier: "READ", argv: [], storageRoot };
+    }
+    const argv = ["mcp", identity.server, identity.tool];
+    const [policy, policyRevision] = await Promise.all([loadPoliciesV1(), readPoliciesV1Revision()]);
+    const { skipped, evaluation } = evaluateMcpProposal(policy, argv);
+    if (skipped)
+        return { governed: false, allowed: true, tier: "READ", argv, storageRoot };
+    const tier = evaluation.tier;
+    const reasons = evaluation.reasons.map((reason) => reason.message);
+    const toolInputHash = toolInputSha256(payload.tool_input);
+    let allowed = tier === "READ";
+    let ticketConsumed = false;
+    let inlineApproval = null;
+    if (tier === "MUTATE") {
+        const mutate = await resolveMutateHookPermission({
+            argv,
+            tier,
+            storageRoot,
+            toolInputHash,
+            rawToolName: toolName,
+            toolInputPreview: JSON.stringify(payload.tool_input ?? {}).slice(0, 200),
+            policyRevision,
+            initialReasons: reasons,
+        });
+        allowed = mutate.permission === "allow";
+        ticketConsumed = mutate.ticketConsumed;
+        inlineApproval = mutate.inlineApproval;
+        reasons.splice(0, reasons.length, ...mutate.reasons);
+    }
+    if (ticketConsumed) {
+        await recordCodexPermissionHandoff({
+            storageRoot,
+            argv,
+            toolInputHash,
+            turnId: payload.turn_id,
+        });
+    }
+    const reason = allowed ? undefined : codexReason({ kind: "mcp", tier, argv, reasons, toolName, inlineApproval });
+    await auditAndSend({ payload, kind: "mcp", tier, argv, allowed, governed: true, ticketConsumed, reasons, policyRevision, storageRoot, latencyMs: performance.now() - started });
+    return { governed: true, allowed, tier, argv, reason, storageRoot, toolInputHash };
+}
+export async function evaluateCodexTool(payload) {
+    const started = performance.now();
+    if (payload.tool_name === "Bash")
+        return evaluateBash(payload, started);
+    if (payload.tool_name?.startsWith("mcp__"))
+        return evaluateMcp(payload, started);
+    return {
+        governed: false,
+        allowed: true,
+        tier: "READ",
+        argv: [],
+        storageRoot: resolveGuardStorageRoot(payload.cwd),
+    };
+}
+//# sourceMappingURL=evaluate-tool.js.map

package/dist/codex/evaluate-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-tool.js","sourceRoot":"","sources":["../../src/codex/evaluate-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAwBvE,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAOpB;IACC,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB;QAC5E,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,aAAa,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAY3B;IACC,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,WAAW;QAClB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,CAAC;QACnB,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;QAClE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpH,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAyB,EAAE,OAAe;IACpE,MAAM,OAAO,GACX,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QAC1D,CAAC,CAAE,OAAO,CAAC,UAAoC,CAAC,OAAO;QACvD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,UAAU,EAAE,UAAU;YACtB,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;QACxC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,4BAA4B,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IACzG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAClL,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAyB,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAExF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;YAC/C,IAAI;YACJ,IAAI;YACJ,WAAW;YACX,aAAa;YACb,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACxE,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;QACxC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,4BAA4B,CAAC;YACjC,WAAW;YACX,IAAI;YACJ,aAAa;YACb,MAAM,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACjH,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAChL,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAyB;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/codex/permission-handoff.d.ts

@@ -0,0 +1,13 @@
+export declare function recordCodexPermissionHandoff(input: {
+    storageRoot: string;
+    argv: readonly string[];
+    toolInputHash?: string | null;
+    turnId?: string | null;
+}): Promise<void>;
+export declare function consumeCodexPermissionHandoff(input: {
+    storageRoot: string;
+    argv: readonly string[];
+    toolInputHash?: string | null;
+    turnId?: string | null;
+}): Promise<boolean>;
+//# sourceMappingURL=permission-handoff.d.ts.map

package/dist/codex/permission-handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-handoff.d.ts","sourceRoot":"","sources":["../../src/codex/permission-handoff.ts"],"names":[],"mappings":"AAgCA,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB"}

package/dist/codex/permission-handoff.js

@@ -0,0 +1,36 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { guardSubpath } from "../bridge/guard-storage-root.js";
+const HANDOFF_TTL_MS = 2 * 60 * 1000;
+function handoffKey(argv, toolInputHash, turnId) {
+    return createHash("sha256")
+        .update(JSON.stringify({ argv: [...argv], toolInputHash: toolInputHash ?? null, turnId: turnId ?? null }))
+        .digest("hex");
+}
+function handoffPath(storageRoot, argv, toolInputHash, turnId) {
+    return path.join(guardSubpath("codex-permission-handoffs", storageRoot), `${handoffKey(argv, toolInputHash, turnId)}.json`);
+}
+export async function recordCodexPermissionHandoff(input) {
+    const pathname = handoffPath(input.storageRoot, input.argv, input.toolInputHash, input.turnId);
+    await mkdir(path.dirname(pathname), { recursive: true });
+    await writeFile(pathname, `${JSON.stringify({ createdAt: Date.now() })}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+export async function consumeCodexPermissionHandoff(input) {
+    const pathname = handoffPath(input.storageRoot, input.argv, input.toolInputHash, input.turnId);
+    try {
+        const parsed = JSON.parse(await readFile(pathname, "utf8"));
+        await unlink(pathname).catch(() => undefined);
+        return typeof parsed.createdAt === "number" && Date.now() - parsed.createdAt <= HANDOFF_TTL_MS;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        await unlink(pathname).catch(() => undefined);
+        return false;
+    }
+}
+//# sourceMappingURL=permission-handoff.js.map

package/dist/codex/permission-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-handoff.js","sourceRoot":"","sources":["../../src/codex/permission-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,SAAS,UAAU,CACjB,IAAuB,EACvB,aAA6B,EAC7B,MAAsB;IAEtB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAClG;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,WAAmB,EACnB,IAAuB,EACvB,aAA6B,EAC7B,MAAsB;IAEtB,OAAO,IAAI,CAAC,IAAI,CACd,YAAY,CAAC,2BAA2B,EAAE,WAAW,CAAC,EACtD,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA4B,CAAC;QACvF,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/hooks/run-codex-hooks.d.ts

@@ -0,0 +1,3 @@
+export declare function runCodexPreToolUseHookFromStdin(): Promise<void>;
+export declare function runCodexPermissionRequestHookFromStdin(): Promise<void>;
+//# sourceMappingURL=run-codex-hooks.d.ts.map

package/dist/hooks/run-codex-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-codex-hooks.d.ts","sourceRoot":"","sources":["../../src/hooks/run-codex-hooks.ts"],"names":[],"mappings":"AA8BA,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,IAAI,CAAC,CAyBrE;AAED,wBAAsB,sCAAsC,IAAI,OAAO,CAAC,IAAI,CAAC,CAoC5E"}

package/dist/hooks/run-codex-hooks.js

@@ -0,0 +1,77 @@
+import { consumeCodexPermissionHandoff } from "../codex/permission-handoff.js";
+import { evaluateCodexTool } from "../codex/evaluate-tool.js";
+async function readStdinJson() {
+    let data = "";
+    for await (const chunk of process.stdin)
+        data += String(chunk);
+    return JSON.parse(data);
+}
+function writeJson(value) {
+    process.stdout.write(JSON.stringify(value));
+}
+export async function runCodexPreToolUseHookFromStdin() {
+    try {
+        const payload = await readStdinJson();
+        const result = await evaluateCodexTool(payload);
+        if (!result.governed) {
+            writeJson({});
+            return;
+        }
+        const response = {
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: result.allowed ? "allow" : "deny",
+                ...(result.reason ? { permissionDecisionReason: result.reason } : {}),
+            },
+        };
+        writeJson(response);
+    }
+    catch (error) {
+        writeJson({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: `Praxis guard hook failed closed: ${String(error)}`,
+            },
+        });
+    }
+}
+export async function runCodexPermissionRequestHookFromStdin() {
+    try {
+        const payload = await readStdinJson();
+        const result = await evaluateCodexTool(payload);
+        if (!result.governed || result.tier === "READ") {
+            writeJson({});
+            return;
+        }
+        const handedOff = await consumeCodexPermissionHandoff({
+            storageRoot: result.storageRoot,
+            argv: result.argv,
+            toolInputHash: result.toolInputHash,
+            turnId: payload.turn_id,
+        });
+        if (handedOff) {
+            writeJson({});
+            return;
+        }
+        const response = {
+            hookSpecificOutput: {
+                hookEventName: "PermissionRequest",
+                decision: {
+                    behavior: "deny",
+                    message: result.reason ?? "Use the Praxis guard approval flow for this action.",
+                },
+            },
+        };
+        writeJson(response);
+    }
+    catch (error) {
+        writeJson({
+            hookSpecificOutput: {
+                hookEventName: "PermissionRequest",
+                decision: { behavior: "deny", message: `Praxis guard hook failed closed: ${String(error)}` },
+            },
+        });
+    }
+}
+//# sourceMappingURL=run-codex-hooks.js.map

package/dist/hooks/run-codex-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-codex-hooks.js","sourceRoot":"","sources":["../../src/hooks/run-codex-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAyB,MAAM,2BAA2B,CAAC;AAmBrF,KAAK,UAAU,aAAa;IAC1B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAyB;YACrC,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBACrD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;SACF,CAAC;QACF,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC;YACR,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9E;SAC6B,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC;YACpD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,MAAM,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAA4B;YACxC,kBAAkB,EAAE;gBAClB,aAAa,EAAE,mBAAmB;gBAClC,QAAQ,EAAE;oBACR,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,qDAAqD;iBAChF;aACF;SACF,CAAC;QACF,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC;YACR,kBAAkB,EAAE;gBAClB,aAAa,EAAE,mBAAmB;gBAClC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;aAC7F;SACgC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/telemetry/agent-host.d.ts

@@ -6,6 +6,6 @@ import type { AgentId } from "../adapters/types.js";
  * Returns "unknown" when the env var is unset (legacy installs that pre-date
  * adapter tagging). See docs/auditor-cli-multi-agent-adapter-design.md § PR 3.
  */
-export type AgentHost = AgentId | "unknown";
+export type AgentHost = AgentId | "codex-app" | "unknown";
 export declare function resolveAgentHost(): AgentHost;
 //# sourceMappingURL=agent-host.d.ts.map

package/dist/telemetry/agent-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-host.d.ts","sourceRoot":"","sources":["../../src/telemetry/agent-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAI5C,wBAAgB,gBAAgB,IAAI,SAAS,CAI5C"}
+{"version":3,"file":"agent-host.d.ts","sourceRoot":"","sources":["../../src/telemetry/agent-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAU1D,wBAAgB,gBAAgB,IAAI,SAAS,CAI5C"}

package/dist/telemetry/agent-host.js

@@ -1,4 +1,10 @@
-const KNOWN_HOSTS = ["cursor", "claude-desktop", "claude-code", "unknown"];
+const KNOWN_HOSTS = [
+    "cursor",
+    "claude-desktop",
+    "claude-code",
+    "codex-app",
+    "unknown",
+];
 export function resolveAgentHost() {
     const raw = process.env.PRAXIS_AGENT_HOST?.trim();
     if (!raw)

package/dist/telemetry/agent-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-host.js","sourceRoot":"","sources":["../../src/telemetry/agent-host.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAyB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAEjG,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAQ,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"agent-host.js","sourceRoot":"","sources":["../../src/telemetry/agent-host.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,GAAyB;IACxC,QAAQ;IACR,gBAAgB;IAChB,aAAa;IACb,WAAW;IACX,SAAS;CACV,CAAC;AAEF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAQ,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxis.guard/auditor-cli",
-  "version": "0.0.44",
+  "version": "0.0.45",
   "private": false,
   "type": "module",
   "license": "MIT",