@pushary/agent-hooks 0.95.8 → 0.98.0

package/dist/bin/pushary-codex-hook.js

@@ -1,33 +1,42 @@
 #!/usr/bin/env node
 import {
-  defersToNativeMode
-} from "../chunk-VDI645ZX.js";
+  takeHookHoldBudget
+} from "../chunk-SI7GYBQP.js";
+import {
+  blockedActionFingerprint,
+  codexCallKey,
+  consumeCodexCallDecision,
+  defersToNativeMode,
+  forgetBlockedActionHint,
+  hasBlockedActionHint,
+  recordBlockedActionHint,
+  recordCodexCallDecision,
+  userScope
+} from "../chunk-53QCTSWY.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-5GKNAQTG.js";
+} from "../chunk-XOOWC62T.js";
 import {
   readHookInput
-} from "../chunk-XEVOPOKT.js";
+} from "../chunk-M4TVEMLH.js";
 import {
   denyReasonFrom,
   isDeferAnswer
 } from "../chunk-YHG74UFF.js";
-import "../chunk-3YFJGKJQ.js";
-import "../chunk-EMGGUO2Q.js";
-import "../chunk-R3OZ5ISU.js";
-import "../chunk-XZWUOCJZ.js";
-import "../chunk-QJPYJVL3.js";
-import "../chunk-QD73WATQ.js";
-import "../chunk-I7LKI4WO.js";
-import "../chunk-QV266EGS.js";
-import "../chunk-GOPIMNVC.js";
-import "../chunk-3AJIK5AO.js";
-import "../chunk-SKPXQRKN.js";
+import "../chunk-5B5QV3KC.js";
+import "../chunk-OBYC6SN4.js";
+import "../chunk-W2MG2P46.js";
+import "../chunk-LBNAGGLV.js";
+import "../chunk-IRLTW6KF.js";
+import "../chunk-6LRGZJFB.js";
+import "../chunk-DOD3A6EU.js";
+import "../chunk-HFQ7WSHZ.js";
+import "../chunk-2GLOHBYB.js";
+import "../chunk-XPPXOKIG.js";
 import "../chunk-EQRS3SGM.js";
-import "../chunk-VERXHIQF.js";
+import "../chunk-NQGYPTJQ.js";
 import "../chunk-XHKBHWLX.js";
-import "../chunk-L4ZCFMWW.js";
 import {
   CODEX_AGENT,
   DEFAULT_SESSION,
@@ -52,100 +61,97 @@ import {
   toCodexWire,
   toPolicyLookup,
   toPolicyLookups
-} from "../chunk-HUGIKB5O.js";
+} from "../chunk-YJDRHQLG.js";
 import {
   UNNAMED_ACTION,
+  codexReviewerDenialsSince,
   deriveActionBody,
   deriveBlocker,
   deriveToolTarget,
   describeToolCall,
+  isCodexGuardianRolloutHead,
+  readCodexTurnContext,
+  scanCodexGuardianReviews,
   scopePathFor,
   sessionIdentityOf
-} from "../chunk-Z4JVEL7R.js";
-import "../chunk-XUTSZYYJ.js";
+} from "../chunk-A76GNRIK.js";
+import "../chunk-OPR2BPD4.js";
 import {
   DECISION_STOP_REASON,
   askUser,
+  cancelQuestion,
+  claimBlockedAction,
   isDecisionStopped,
   isLocalQuestionHandoff,
+  pollForAnswer,
+  requestGate,
   sendNotification,
   waitForQuestion
-} from "../chunk-XS33QBJA.js";
+} from "../chunk-LGXUGYUH.js";
 import {
   getMachineId
-} from "../chunk-E47WV7BJ.js";
+} from "../chunk-WU6LSXJ6.js";
 import {
   canonicalJson
-} from "../chunk-NOVA7KZ2.js";
+} from "../chunk-XL3RKJYQ.js";
 import "../chunk-GMXKITVA.js";
 import "../chunk-DINDL2CF.js";
-import "../chunk-VMQU7YEJ.js";
+import "../chunk-SJLGOVC6.js";
 import "../chunk-EYRGBYZG.js";
 import "../chunk-SAF6HGAA.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-L7NOG547.js";
+import {
+  writeFileAtomic
+} from "../chunk-VZD2GEKB.js";
 import {
   getApiKey
 } from "../chunk-2UMNXADU.js";
 import {
+  CODEX_RESCUE_TOOL_NAME,
   DECISION_LINE_MAX,
+  GATE_BLOCK_REASON_MAX_LENGTH,
+  GATE_WIRE,
   KILL_REASON,
+  codexStopRescueOutput,
   effectiveWaitSeconds,
+  hookHoldWindowMs,
   hookWaitClamped,
   hookWaitDeadline,
   resolveGate
-} from "../chunk-MC5WUOJJ.js";
+} from "../chunk-OUAE3GKO.js";
 
 // bin/pushary-codex-hook.ts
 import { basename } from "path";
 
-// src/codex-call-decision.ts
+// src/codex-reviewer.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/codex-rollout.ts
 import { createHash } from "crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
-import { tmpdir, userInfo } from "os";
-import { join } from "path";
-var CODEX_DECISION_TTL_MS = 60 * 1e3;
-var userScope = () => {
-  try {
-    const info = userInfo();
-    const id = typeof info.uid === "number" && info.uid >= 0 ? String(info.uid) : info.username;
-    return id.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128) || "default";
-  } catch {
-    return "default";
-  }
-};
-var decisionDir = () => join(tmpdir(), `pushary-codex-decisions-${userScope()}`);
-var decisionFile = (key) => join(decisionDir(), key);
-var PRESENTATION_ONLY_INPUT_KEYS = ["description"];
-var identifyingToolInput = (toolInput) => {
-  if (!toolInput) return {};
-  const identifying = {};
-  for (const [key, value] of Object.entries(toolInput)) {
-    if (PRESENTATION_ONLY_INPUT_KEYS.includes(key)) continue;
-    identifying[key] = value;
-  }
-  return identifying;
-};
-var codexCallKey = (identity) => {
-  if (!identity.sessionId || !identity.turnId || !identity.toolName) return null;
-  const material = canonicalJson([
-    identity.sessionId,
-    identity.turnId,
-    identity.toolName,
-    identifyingToolInput(identity.toolInput)
-  ]);
-  return createHash("sha256").update(material, "utf-8").digest("hex").slice(0, 32);
-};
-var parseDecision = (raw) => {
+import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, isAbsolute, join, relative } from "path";
+var CODEX_ROLLOUT_TAIL_MAX_BYTES = 8 * 1024 * 1024;
+var CODEX_ROLLOUT_HEAD_MAX_BYTES = 1024 * 1024;
+var CODEX_GUARDIAN_READ_MAX_BYTES = 8 * 1024 * 1024;
+var CODEX_GUARDIAN_SCAN_MAX_DAYS = 31;
+var CODEX_GUARDIAN_SCAN_MAX_FILES = 2e3;
+var CODEX_ROLLOUT_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var READ_CHUNK_BYTES = 64 * 1024;
+var TURN_CONTEXT_LINE_MAX_BYTES = 1024 * 1024;
+var MTIME_SLACK_MS = 2e3;
+var NEWLINE = 10;
+var TURN_CONTEXT_MARKER = '"turn_context"';
+var ROLLOUT_FILE = /^rollout-.*\.jsonl$/;
+var DATE_SEGMENTS = /^(\d{4})\/(\d{2})\/(\d{2})$/;
+var cacheKey = (...parts) => createHash("sha256").update(parts.join("\n"), "utf-8").digest("hex").slice(0, 32);
+var turnCacheDir = () => join(tmpdir(), `pushary-codex-turns-${userScope()}`);
+var guardianCursorDir = () => join(tmpdir(), `pushary-codex-guardian-${userScope()}`);
+var readJsonRecord = (path) => {
   try {
-    const parsed = JSON.parse(raw);
-    if (parsed.kind === "approved") return { kind: "approved" };
-    if (parsed.kind === "handled") return { kind: "handled" };
-    if (parsed.kind === "denied") {
-      return { kind: "denied", reason: typeof parsed.reason === "string" ? parsed.reason : "" };
-    }
-    return null;
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
@@ -155,7 +161,7 @@ var sweepExpired = (dir, nowMs) => {
     for (const name of readdirSync(dir)) {
       const path = join(dir, name);
       try {
-        if (nowMs - statSync(path).mtimeMs >= CODEX_DECISION_TTL_MS) rmSync(path, { force: true });
+        if (nowMs - statSync(path).mtimeMs >= CODEX_ROLLOUT_CACHE_TTL_MS) rmSync(path, { force: true });
       } catch {
         continue;
       }
@@ -164,27 +170,365 @@ var sweepExpired = (dir, nowMs) => {
     return;
   }
 };
-var recordCodexCallDecision = (key, decision) => {
-  if (!key) return;
+var writeJsonRecord = (dir, name, record) => {
   try {
-    const dir = decisionDir();
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
     else sweepExpired(dir, Date.now());
-    writeFileSync(decisionFile(key), JSON.stringify(decision), { encoding: "utf-8", mode: 384 });
+    writeFileAtomic(join(dir, name), JSON.stringify(record), 384);
+    return true;
   } catch {
-    return;
+    return false;
+  }
+};
+var readBytes = (path, offset, length) => {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const buffer = Buffer.alloc(length);
+    const read = readSync(fd, buffer, 0, length, offset);
+    return read === length ? buffer : null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+};
+var locate = (region, base, from, to, read, marker) => {
+  if (to <= from) return null;
+  const text = region.toString("utf-8", from, to);
+  if (!text.includes(marker)) return null;
+  const value = read(text);
+  return value ? { value, offset: base + from, length: to - from } : null;
+};
+var findLastRolloutLine = (path, maxBytes, read, marker) => {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const size = fstatSync(fd).size;
+    const floor = Math.max(0, size - maxBytes);
+    let carry = Buffer.alloc(0);
+    let position = size;
+    while (position > floor) {
+      const start = Math.max(floor, position - READ_CHUNK_BYTES);
+      const chunk = Buffer.alloc(position - start);
+      if (readSync(fd, chunk, 0, chunk.length, start) !== chunk.length) return null;
+      const region = carry.length > 0 ? Buffer.concat([chunk, carry]) : chunk;
+      let lineEnd = region.length;
+      let newline = region.lastIndexOf(NEWLINE, lineEnd - 1);
+      while (newline >= 0) {
+        const found = locate(region, start, newline + 1, lineEnd, read, marker);
+        if (found) return found;
+        lineEnd = newline;
+        newline = lineEnd > 0 ? region.lastIndexOf(NEWLINE, lineEnd - 1) : -1;
+      }
+      if (start === 0) return locate(region, 0, 0, lineEnd, read, marker);
+      carry = region.subarray(0, lineEnd);
+      position = start;
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+};
+var isWholeLineAt = (path, offset, length) => {
+  const before = offset > 0 ? 1 : 0;
+  const bytes = readBytes(path, offset - before, length + before + 1);
+  if (!bytes) return null;
+  if (before === 1 && bytes[0] !== NEWLINE) return null;
+  if (bytes[bytes.length - 1] !== NEWLINE) return null;
+  return bytes.toString("utf-8", before, before + length);
+};
+var cachedTurn = (file, transcriptPath, turnId) => {
+  const cached = readJsonRecord(file);
+  if (!cached || cached.transcriptPath !== transcriptPath || cached.turnId !== turnId) return null;
+  const { offset, length } = cached;
+  if (typeof offset !== "number" || typeof length !== "number") return null;
+  if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length <= 0) return null;
+  if (length > TURN_CONTEXT_LINE_MAX_BYTES) return null;
+  const line = isWholeLineAt(transcriptPath, offset, length);
+  const context = line === null ? null : readCodexTurnContext(line);
+  return context?.turnId === turnId ? context : null;
+};
+var readCodexTurn = (call, limits = {}) => {
+  const { transcriptPath, sessionId, turnId } = call;
+  if (!transcriptPath || !isAbsolute(transcriptPath) || !sessionId || !turnId) return null;
+  const name = cacheKey(sessionId, turnId);
+  const cached = cachedTurn(join(turnCacheDir(), name), transcriptPath, turnId);
+  if (cached) return cached;
+  const found = findLastRolloutLine(
+    transcriptPath,
+    limits.tailMaxBytes ?? CODEX_ROLLOUT_TAIL_MAX_BYTES,
+    readCodexTurnContext,
+    TURN_CONTEXT_MARKER
+  );
+  if (!found || found.value.turnId !== turnId) return null;
+  writeJsonRecord(turnCacheDir(), name, { transcriptPath, turnId, offset: found.offset, length: found.length });
+  return found.value;
+};
+var readFirstLine = (path, maxBytes) => {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    let collected = Buffer.alloc(0);
+    while (collected.length < maxBytes) {
+      const chunk = Buffer.alloc(Math.min(READ_CHUNK_BYTES, maxBytes - collected.length));
+      const read = readSync(fd, chunk, 0, chunk.length, collected.length);
+      if (read === 0) return null;
+      const newline = chunk.subarray(0, read).indexOf(NEWLINE);
+      if (newline >= 0) return Buffer.concat([collected, chunk.subarray(0, newline)]).toString("utf-8");
+      collected = Buffer.concat([collected, chunk.subarray(0, read)]);
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+};
+var sessionsLayoutOf = (transcriptPath) => {
+  const dayDir = dirname(transcriptPath);
+  const root = dirname(dirname(dirname(dayDir)));
+  const match = DATE_SEGMENTS.exec(relative(root, dayDir).split(/[\\/]/).join("/"));
+  if (!match) return null;
+  return { root, year: Number(match[1]), month: Number(match[2]), day: Number(match[3]) };
+};
+var isInside = (root, path) => {
+  const within = relative(root, path);
+  return within.length > 0 && !within.startsWith("..") && !isAbsolute(within);
+};
+var isGuardianRollout = (path, sessionId, headMaxBytes) => {
+  const head = readFirstLine(path, headMaxBytes);
+  return head !== null && isCodexGuardianRolloutHead(head, sessionId);
+};
+var pad = (value) => String(value).padStart(2, "0");
+var dayDirectories = (layout, now) => {
+  const today = new Date(now.getFullYear(), now.getMonth(), now.getDate()).getTime();
+  const directories = [];
+  for (let offset = 0; offset <= CODEX_GUARDIAN_SCAN_MAX_DAYS; offset++) {
+    const date = new Date(layout.year, layout.month - 1, layout.day + offset);
+    if (offset > 0 && date.getTime() > today) break;
+    directories.push(join(layout.root, String(date.getFullYear()), pad(date.getMonth() + 1), pad(date.getDate())));
+  }
+  return directories;
+};
+var createdAtMs = (transcriptPath, turnStartedAt) => {
+  try {
+    const birth = statSync(transcriptPath).birthtimeMs;
+    return birth > 0 ? birth : Date.parse(turnStartedAt);
+  } catch {
+    return Date.parse(turnStartedAt);
+  }
+};
+var discoverGuardianRollout = (call, layout, now, limits) => {
+  const sinceMs = createdAtMs(call.transcriptPath, call.turnStartedAt) - MTIME_SLACK_MS;
+  if (!Number.isFinite(sinceMs)) return null;
+  const headMaxBytes = limits.headMaxBytes ?? CODEX_ROLLOUT_HEAD_MAX_BYTES;
+  const maxFiles = limits.maxFiles ?? CODEX_GUARDIAN_SCAN_MAX_FILES;
+  let examined = 0;
+  let best = null;
+  for (const directory of dayDirectories(layout, now)) {
+    let names;
+    try {
+      names = readdirSync(directory).sort();
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      if (!ROLLOUT_FILE.test(name)) continue;
+      const path = join(directory, name);
+      if (path === call.transcriptPath) continue;
+      if (++examined > maxFiles) return best?.path ?? null;
+      let mtimeMs;
+      try {
+        const stat = statSync(path);
+        if (!stat.isFile()) continue;
+        mtimeMs = stat.mtimeMs;
+      } catch {
+        continue;
+      }
+      if (mtimeMs < sinceMs || best && mtimeMs <= best.mtimeMs) continue;
+      if (isGuardianRollout(path, call.sessionId, headMaxBytes)) best = { path, mtimeMs };
+    }
   }
+  return best?.path ?? null;
+};
+var readGuardianCursor = (file, sessionId) => {
+  const cursor = readJsonRecord(file);
+  if (!cursor || cursor.sessionId !== sessionId || typeof cursor.path !== "string") return null;
+  const offset = cursor.offset;
+  if (typeof offset !== "number" || !Number.isSafeInteger(offset) || offset < 0) return null;
+  return { path: cursor.path, offset };
 };
-var consumeCodexCallDecision = (key) => {
-  if (!key) return null;
-  const path = decisionFile(key);
+var readCompleteLines = (path, from, maxBytes) => {
+  let fd;
   try {
-    const fresh = Date.now() - statSync(path).mtimeMs < CODEX_DECISION_TTL_MS;
-    const raw = readFileSync(path, "utf-8");
-    rmSync(path, { force: true });
-    return fresh ? parseDecision(raw) : null;
+    fd = openSync(path, "r");
+    const size = fstatSync(fd).size;
+    let start = from > size ? 0 : from;
+    const skipsPartial = size - start > maxBytes;
+    if (skipsPartial) start = size - maxBytes;
+    const buffer = Buffer.alloc(size - start);
+    if (buffer.length > 0 && readSync(fd, buffer, 0, buffer.length, start) !== buffer.length) return null;
+    let lineStart = 0;
+    if (skipsPartial) {
+      const newline = buffer.indexOf(NEWLINE);
+      if (newline < 0) return { lines: [], end: from };
+      lineStart = newline + 1;
+    }
+    const lines = [];
+    for (let newline = buffer.indexOf(NEWLINE, lineStart); newline >= 0; newline = buffer.indexOf(NEWLINE, lineStart)) {
+      lines.push({ offset: start + lineStart, text: buffer.toString("utf-8", lineStart, newline) });
+      lineStart = newline + 1;
+    }
+    return { lines, end: start + lineStart };
   } catch {
     return null;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+};
+var takeCodexReviewerDenials = (call, options = {}) => {
+  const { transcriptPath, sessionId, turnStartedAt } = call;
+  if (!isAbsolute(transcriptPath) || !sessionId || !Number.isFinite(Date.parse(turnStartedAt))) return null;
+  const layout = sessionsLayoutOf(transcriptPath);
+  if (!layout) return null;
+  const headMaxBytes = options.headMaxBytes ?? CODEX_ROLLOUT_HEAD_MAX_BYTES;
+  const cursorName = cacheKey(sessionId);
+  const cursor = readGuardianCursor(join(guardianCursorDir(), cursorName), sessionId);
+  const remembered = cursor && isInside(layout.root, cursor.path) && cursor.path !== transcriptPath && isGuardianRollout(cursor.path, sessionId, headMaxBytes) ? cursor : null;
+  const guardianPath = remembered?.path ?? discoverGuardianRollout(call, layout, options.now ?? /* @__PURE__ */ new Date(), options);
+  if (!guardianPath) return null;
+  const from = remembered?.offset ?? 0;
+  const read = readCompleteLines(guardianPath, from, options.guardianMaxBytes ?? CODEX_GUARDIAN_READ_MAX_BYTES);
+  if (!read) return null;
+  const scan = scanCodexGuardianReviews(read.lines);
+  const next = scan.pendingOffset ?? read.end;
+  const denials = codexReviewerDenialsSince(scan.reviews, turnStartedAt);
+  if (!remembered || next !== from) {
+    const saved = writeJsonRecord(guardianCursorDir(), cursorName, { sessionId, path: guardianPath, offset: next });
+    if (!saved && denials.length > 0) return null;
+  }
+  return { guardianPath, denials };
+};
+
+// src/codex-reviewer.ts
+var START_MS = Date.now();
+var CLAIM_TIMEOUT_MS = 4e3;
+var GATE_TIMEOUT_MS = 15e3;
+var CANCEL_TIMEOUT_MS = 4e3;
+var CODEX_RESCUE_STOP_RESERVE_MS = 2e4;
+var codexRescueEndsAt = (startMs, holdBudgetSeconds) => startMs + hookHoldWindowMs("codex", holdBudgetSeconds) - CODEX_RESCUE_STOP_RESERVE_MS;
+var codexRescueDeadline = (startMs, deadlineSeconds, nowMs, holdBudgetSeconds) => Math.min(hookWaitDeadline(startMs, deadlineSeconds, "codex", nowMs), codexRescueEndsAt(startMs, holdBudgetSeconds));
+var codexApprovalsReviewer = (call) => readCodexTurn({ transcriptPath: call.transcript_path, sessionId: call.session_id, turnId: call.turn_id })?.approvalsReviewer;
+var claimCodexReviewerRetry = async (apiKey, call) => {
+  if (!call.tool_name || !call.tool_input) return false;
+  const fingerprint = blockedActionFingerprint({
+    source: "codex",
+    sessionId: call.session_id,
+    toolName: call.tool_name,
+    toolInput: call.tool_input,
+    cwd: call.cwd
+  });
+  if (!fingerprint || !hasBlockedActionHint(fingerprint)) return false;
+  const granted = await claimBlockedAction(apiKey, {
+    v: GATE_WIRE,
+    source: "codex",
+    event: "PermissionRequest",
+    toolName: call.tool_name,
+    toolInputs: [call.tool_input],
+    sessionId: call.session_id,
+    machineId: getMachineId(),
+    cwd: call.cwd,
+    repoKey: repoKeyFor(call.cwd),
+    permissionMode: call.permission_mode
+  }, CLAIM_TIMEOUT_MS);
+  if (granted !== null) forgetBlockedActionHint(fingerprint);
+  return granted === true;
+};
+var blockReasonOf = (rationale) => rationale?.trim().slice(0, GATE_BLOCK_REASON_MAX_LENGTH).trim() || void 0;
+var reviewToolUseId = (guardianPath, denial) => `codex-review-${createHash2("sha256").update(canonicalJson([guardianPath, denial.offset, denial.plannedAction]), "utf-8").digest("hex").slice(0, 40)}`;
+var isRescueApproval = (output) => {
+  if (!output) return false;
+  try {
+    const parsed = JSON.parse(output);
+    return parsed?.decision === "block" && typeof parsed.reason === "string" && parsed.reason.length > 0;
+  } catch {
+    return false;
+  }
+};
+var isAffirmativeAnswer = (answer) => answer.answered && !isDecisionStopped(answer) && answer.value === "yes";
+var approveOnce = (fingerprint, output) => recordBlockedActionHint(fingerprint) ? output : void 0;
+var rescueRequest = (call, sessionId, guardianPath, denial) => {
+  const cwd = denial.cwd ?? call.cwd;
+  const blockReason = blockReasonOf(denial.rationale);
+  return {
+    v: GATE_WIRE,
+    source: "codex",
+    event: "Stop",
+    toolName: CODEX_RESCUE_TOOL_NAME,
+    toolInputs: [{ command: denial.command }],
+    sessionId,
+    toolUseId: reviewToolUseId(guardianPath, denial),
+    machineId: getMachineId(),
+    cwd,
+    ...call.cwd ? { sessionCwd: call.cwd } : {},
+    repoKey: repoKeyFor(cwd),
+    permissionMode: call.permission_mode,
+    createDecision: true,
+    localSurfaceAvailable: false,
+    ...blockReason ? { blockReason } : {},
+    approvalsReviewer: "auto_review",
+    blockedBy: "auto_review"
+  };
+};
+var askAboutDenial = async (apiKey, call, sessionId, guardianPath, denial, holdBudgetSeconds) => {
+  const request = rescueRequest(call, sessionId, guardianPath, denial);
+  const fingerprint = blockedActionFingerprint({
+    source: "codex",
+    sessionId,
+    toolName: request.toolName,
+    toolInput: request.toolInputs[0],
+    cwd: request.cwd
+  });
+  if (!fingerprint) return void 0;
+  const reply = await requestGate(apiKey, request, GATE_TIMEOUT_MS);
+  if (!reply) return void 0;
+  if (reply.kind === "no_opinion") return isRescueApproval(reply.output) ? approveOnce(fingerprint, reply.output) : void 0;
+  if (reply.kind !== "ask" || !reply.correlationId || reply.deadlineSeconds === void 0) return void 0;
+  if (reply.noDevices) {
+    await cancelQuestion(apiKey, reply.correlationId, AbortSignal.timeout(CANCEL_TIMEOUT_MS)).catch(() => void 0);
+    return void 0;
+  }
+  const deadline = codexRescueDeadline(START_MS, reply.deadlineSeconds, Date.now(), holdBudgetSeconds);
+  const answer = await pollForAnswer(apiKey, reply.correlationId, deadline);
+  if (!isAffirmativeAnswer(answer)) return void 0;
+  const approve = reply.settlementOutputs?.approve;
+  return approveOnce(
+    fingerprint,
+    isRescueApproval(approve) ? approve : JSON.stringify(codexStopRescueOutput("allow", denial.command))
+  );
+};
+var rescueCodexReviewerDenial = async (call, holdBudgetSeconds) => {
+  let apiKey;
+  try {
+    apiKey = getApiKey();
+  } catch {
+    return void 0;
+  }
+  try {
+    const { session_id: sessionId, transcript_path: transcriptPath } = call;
+    if (!sessionId || !transcriptPath) return void 0;
+    if (holdBudgetSeconds === void 0 || codexRescueEndsAt(START_MS, holdBudgetSeconds) - Date.now() <= GATE_TIMEOUT_MS) return void 0;
+    const turn = readCodexTurn({ transcriptPath, sessionId, turnId: call.turn_id });
+    if (turn?.approvalsReviewer !== "auto_review" || !turn.startedAt) return void 0;
+    const taken = takeCodexReviewerDenials({ transcriptPath, sessionId, turnStartedAt: turn.startedAt });
+    const denial = taken?.denials.at(-1);
+    if (!taken || !denial) return void 0;
+    return await askAboutDenial(apiKey, call, sessionId, taken.guardianPath, denial, holdBudgetSeconds);
+  } catch {
+    return void 0;
   }
 };
 
@@ -195,7 +539,7 @@ var callKeyFor = (input) => codexCallKey({
   toolName: input.tool_name,
   toolInput: input.tool_input
 });
-var START_MS = Date.now();
+var START_MS2 = Date.now();
 var agentNameFor = (input) => `Codex - ${basename(input.cwd ?? process.cwd())}`;
 var describeFor = (input, lookup) => input.tool_name === "apply_patch" ? describeApplyPatch(input.tool_input?.command) ?? describeToolCall(lookup.tool, lookup.input, "hook") : describeToolCall(lookup.tool, lookup.input, "hook");
 var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode) => {
@@ -221,8 +565,8 @@ var pushQuestion = async (apiKey, input, lookup, waitSeconds, mode) => {
     toolUseId: input.tool_use_id
   }).catch(() => ({ correlationId: "", status: "unavailable" }));
   const now = Date.now();
-  const deadline = hookWaitDeadline(START_MS, waitSeconds, "codex", now);
-  const clampCut = hookWaitClamped(START_MS, waitSeconds, "codex", now);
+  const deadline = hookWaitDeadline(START_MS2, waitSeconds, "codex", now);
+  const clampCut = hookWaitClamped(START_MS2, waitSeconds, "codex", now);
   const answer = await waitForQuestion(apiKey, result, deadline);
   return { answer, localHandoff: !answer.answered && isLocalQuestionHandoff(result), clampCut };
 };
@@ -258,23 +602,21 @@ var codexGate = async (apiKey, input) => {
   });
   return { verdict, lookup };
 };
-var fromRecordedDecision = (decision) => {
-  if (decision.kind === "approved") return codexAllow();
-  if (decision.kind === "denied") return codexDeny(decision.reason);
-  return codexPass();
-};
 var PUSHARY_OWN_TOOL_PREFIX = "mcp__pushary__";
 var isPusharyOwnTool = (toolName) => typeof toolName === "string" && toolName.startsWith(PUSHARY_OWN_TOOL_PREFIX);
 var decidePermissionRequest = async (input) => {
   if (isPusharyOwnTool(input.tool_name)) return codexPass();
-  const recorded = consumeCodexCallDecision(callKeyFor(input));
-  if (recorded) return fromRecordedDecision(recorded);
   try {
     const apiKey = getApiKey();
     const { verdict, lookup } = await codexGate(apiKey, input);
     if (verdict.kind === "kill") return codexDeny(KILL_REASON);
-    if (verdict.kind === "allow") return codexAllow();
     if (verdict.kind === "deny") return codexDeny(verdict.reason);
+    const recorded = consumeCodexCallDecision(callKeyFor(input));
+    if (recorded?.kind === "denied") return codexDeny(recorded.reason);
+    if (recorded?.kind === "handled") return codexPass();
+    if (await claimCodexReviewerRetry(apiKey, input)) return codexAllow();
+    if (codexApprovalsReviewer(input) === "auto_review") return codexPass();
+    if (verdict.kind === "allow") return codexAllow();
     if (verdict.kind === "defer") return codexPass();
     const toolPolicy = verdict.policy;
     if (toolPolicy.mode === "terminal_only") return codexPass();
@@ -283,7 +625,8 @@ var decidePermissionRequest = async (input) => {
       return codexPass();
     }
     const waitSeconds = toolPolicy.mode === "push_first" ? toolPolicy.pushFirstSeconds : effectiveWaitSeconds(toolPolicy.timeoutAction, toolPolicy.timeoutSeconds, "codex");
-    const { answer, localHandoff, clampCut } = await pushQuestion(apiKey, input, lookup, waitSeconds, toolPolicy.mode);
+    const asked = recorded ? { ...input, tool_use_id: recorded.toolUseId } : input;
+    const { answer, localHandoff, clampCut } = await pushQuestion(apiKey, asked, lookup, waitSeconds, toolPolicy.mode);
     if (isDecisionStopped(answer)) return codexDeny(DECISION_STOP_REASON);
     if (localHandoff) return codexPass();
     if (answer.answered) {
@@ -305,6 +648,10 @@ var recordPreToolUse = (key, outcome) => {
   );
   return outcome;
 };
+var recordApproval = (key, input) => {
+  if (input.tool_use_id) recordCodexCallDecision(key, { kind: "approved", toolUseId: input.tool_use_id });
+  return codexPass();
+};
 var permissionRequestNeverFires = (permissionMode) => permissionMode === "bypassPermissions";
 var decidePushFirstBeforeTheTool = async (apiKey, input, lookup, pushFirstSeconds, callKey) => {
   let pushed;
@@ -320,10 +667,7 @@ var decidePushFirstBeforeTheTool = async (apiKey, input, lookup, pushFirstSecond
   }
   if (answer.answered) {
     if (isDeferAnswer(answer.value)) return recordPreToolUse(callKey, codexPass());
-    if (answer.value === "yes") {
-      recordCodexCallDecision(callKey, { kind: "approved" });
-      return codexPass();
-    }
+    if (answer.value === "yes") return recordApproval(callKey, input);
     return recordPreToolUse(callKey, codexDeny(denyReasonFrom(answer.value, answer.note)));
   }
   return recordPreToolUse(callKey, codexPass());
@@ -353,6 +697,7 @@ var decidePreToolUse = async (input) => {
     if (verdict.kind === "kill") return codexDeny(KILL_REASON);
     if (verdict.kind === "allow") return codexPass();
     if (verdict.kind === "deny") return codexDeny(verdict.reason);
+    if (codexApprovalsReviewer(input) === "auto_review") return codexPass();
     if (defersToNativeMode(input.permission_mode, input.tool_name ?? "")) return codexPass();
     if (verdict.kind === "defer") return codexPass();
     const toolPolicy = verdict.policy;
@@ -369,10 +714,7 @@ var decidePreToolUse = async (input) => {
       if (localHandoff) return recordPreToolUse(callKey, codexPass());
       if (answer.answered) {
         if (isDeferAnswer(answer.value)) return recordPreToolUse(callKey, codexPass());
-        if (answer.value === "yes") {
-          recordCodexCallDecision(callKey, { kind: "approved" });
-          return codexPass();
-        }
+        if (answer.value === "yes") return recordApproval(callKey, input);
         return recordPreToolUse(callKey, codexDeny(denyReasonFrom(answer.value, answer.note)));
       }
       if (clampCut) return recordPreToolUse(callKey, codexPass());
@@ -448,12 +790,18 @@ var main = async () => {
           session_id: input.session_id
         }, CODEX_AGENT));
         break;
-      case "Stop":
+      case "Stop": {
+        const rescued = await rescueCodexReviewerDenial(input, takeHookHoldBudget());
+        if (rescued) {
+          process.stdout.write(rescued);
+          break;
+        }
         await handleStop({
           cwd: input.cwd,
           session_id: input.session_id
         }, CODEX_AGENT);
         break;
+      }
       case "SessionStart":
         await reportSessionStart(input);
         break;