@samirosamsam/aim 0.1.0 → 0.1.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aim",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Install deterministic Codex guardrails from natural-language block rules.",
   "author": {
     "name": "AIM"

package/README.md

@@ -46,6 +46,19 @@ npx -y @samirosamsam/aim@latest rule add 'empêche de modifier package.json'
 npx -y @samirosamsam/aim@latest rule add 'empêche les calls GitHub qui ajoutent des collaborators'
 ```
 
+For SaaS data targets described by a title or label, use Codex/provider tools first to resolve the concrete resource, then write the rule with `capture`:
+
+```bash
+npx -y @samirosamsam/aim@latest capture \
+  --provider notion \
+  --tool fetch \
+  --args '{"url":"https://www.notion.so/..."}' \
+  --effect deny \
+  --agent codex \
+  --connection notion:codex \
+  --policy ~/.codex/aim/policy.json
+```
+
 Codex then calls the AIM hook before supported tool calls. A blocked Bash call returns the Codex `PreToolUse` deny shape:
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samirosamsam/aim",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "AIM CLI for installing deterministic Codex tool-call guardrails.",
   "private": false,
   "type": "module",

package/skills/aim/SKILL.md

@@ -17,7 +17,14 @@ npx -y @samirosamsam/aim@latest setup --json
 
 If Codex reports that hooks need review, tell the user to run `/hooks`, inspect the AIM hook, and trust it. Do not claim active enforcement until the hook is trusted and a proof call blocks.
 
-2. Add the user's requested block as a Codex guardrail rule:
+2. Choose the smallest enforceable path:
+
+- For Bash commands and file edits, use `rule add`.
+- For external data or SaaS access, first discover the concrete resource with that provider's tools, then use `capture`.
+- If the user gives a human label such as a page title, folder name, channel name, repo label, database name, or "all subpages", do not reject it as "not a resource". Search/list/fetch with the provider plugin or MCP tools, pick the best exact match when confidence is high, and explain the choice. Ask only when several plausible matches remain or when a broad wildcard would be required.
+- For hierarchical requests such as subpages, folders, databases, repos, or projects, enumerate the concrete children when the provider tools expose them and add rules for each resolved resource. If the provider cannot enumerate future children, block the resolved current resources and state that new children need another rule.
+
+For local Codex rules:
 
 ```bash
 npx -y @samirosamsam/aim@latest rule add "<what the user wants to prevent>" --json
@@ -31,6 +38,21 @@ npx -y @samirosamsam/aim@latest rule add "empêche de modifier package.json" --j
 npx -y @samirosamsam/aim@latest rule add "empêche les calls GitHub qui ajoutent des collaborators" --json
 ```
 
+For resolved MCP resources:
+
+```bash
+npx -y @samirosamsam/aim@latest capture \
+  --provider "<provider>" \
+  --tool "<representative MCP tool>" \
+  --args '<representative MCP args JSON>' \
+  --resource "<stable provider resource id or path>" \
+  --effect deny \
+  --agent codex \
+  --connection "<provider>:codex" \
+  --policy ~/.codex/aim/policy.json \
+  --json
+```
+
 3. Prove the guardrail with a representative hook input before reporting success. Pick the proof that matches the rule:
 
 ```bash
@@ -58,7 +80,7 @@ npx -y @samirosamsam/aim@latest rule list --json
 
 ## Advanced Commands
 
-Use `capture`, `authorize`, `compile`, `add`, or `check` only for lower-level policy debugging. The normal public workflow is `setup`, `rule add`, proof, report.
+Use `compile`, `add`, or `check` only for lower-level policy debugging. The normal public workflow is `setup`, then `rule add` for local Codex resources or provider discovery plus `capture` for MCP resources, then proof, then report.
 
 ```bash
 npx -y @samirosamsam/aim@latest capture \
@@ -75,7 +97,7 @@ If a command returns `questions`, ask for the missing command, file path, provid
 
 ## Scope
 
-- For Codex enforcement, prefer `rule add` over `compile`/`add`; it writes rules intended for the `PreToolUse` hook.
+- For Codex enforcement, prefer `rule add` for Bash/files and `capture` for resolved MCP resources over `compile`/`add`; both write rules intended for the `PreToolUse` hook.
 - Prefer narrow resource patterns over `*`.
 - Codex hook guardrails are default-allow: no matching block means the tool call proceeds.
 - Treat `deny` as higher priority than `approval`, and `approval` as higher priority than `allow`.

package/src/engine.js

@@ -214,7 +214,12 @@ export function compileCodexRulePrompt(prompt, context = {}) {
   }
 
   if (drafts.length === 0) {
-    questions.push("Specify a Bash command, file path, or MCP provider/tool/resource to block.");
+    const providers = detectProviders(normalized).filter((provider) => provider !== "*");
+    if (providers.length > 0) {
+      questions.push(`Resolve the ${providers.join("/")} resource with that provider's search/list/fetch tools, then add an AIM capture rule with the stable resource id or path.`);
+    } else {
+      questions.push("Specify a Bash command, file path, or MCP provider/tool/resource to block.");
+    }
   }
 
   return { drafts: uniqueDrafts(drafts), questions };
@@ -531,7 +536,7 @@ function inferGithubCall(tool, args) {
 }
 
 function inferNotionCall(tool, args) {
-  const page = cleanPart(args.page_id ?? args.pageId ?? args.id);
+  const page = cleanPart(args.page_id ?? args.pageId ?? args.id ?? notionPageId(args.url ?? args.page_url ?? args.pageUrl));
   const database = cleanPart(args.database_id ?? args.databaseId);
   if (page) return { access: inferAccess(tool), resource: `notion/pages/${page}` };
   if (database) return { access: inferAccess(tool), resource: `notion/databases/${database}` };
@@ -570,6 +575,14 @@ function githubRepo(args, suffix = "") {
   return owner && repo ? `repo/${owner}/${repo}${suffix}` : "*";
 }
 
+function notionPageId(value) {
+  const text = String(value ?? "");
+  const dashed = text.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i);
+  if (dashed) return dashed[0];
+  const compact = text.match(/[0-9a-f]{32}/i);
+  return compact?.[0] ?? "";
+}
+
 function reasonFor(effect, access, resourcePattern) {
   if (effect === "deny") return `Block ${access} on ${resourcePattern}.`;
   if (effect === "approval") return `Require human approval for ${access} on ${resourcePattern}.`;