@samirosamsam/aim 0.1.0 → 0.1.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aim",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Install deterministic Codex guardrails from natural-language block rules.",
   "author": {
     "name": "AIM"
@@ -13,9 +13,12 @@
     "displayName": "AIM",
     "shortDescription": "Block matching Codex tool calls with local guardrails.",
     "longDescription": "AIM helps Codex turn natural-language block requests into local PreToolUse guardrails for Bash, file edits, and MCP tool calls.",
-    "developerName": "AIM",
+    "developerName": "Rippletide",
     "category": "Productivity",
     "capabilities": ["Write"],
+    "brandColor": "#272757",
+    "composerIcon": "assets/rippletide-logo.png",
+    "logo": "assets/rippletide-logo.png",
     "defaultPrompt": [
       "Block this Codex action.",
       "Install deterministic guardrails for this repo."

package/README.md

@@ -26,7 +26,22 @@ codex plugin marketplace add tototozip/AIM --ref main
 codex plugin add aim@aim
 ```
 
-Then start a new Codex thread and invoke `@aim`.
+Then start a new Codex thread, run `/hooks`, trust the AIM hook if Codex asks,
+and invoke `@aim`.
+
+Example:
+
+```text
+@aim empêche git push
+```
+
+To test it, ask Codex to run:
+
+```bash
+git push origin main --dry-run
+```
+
+The call should be denied before Bash executes.
 
 ## Codex Guardrail
 
@@ -36,6 +51,9 @@ Install or refresh the local Codex hook:
 npx -y @samirosamsam/aim@latest setup
 ```
 
+This is only needed when using the CLI without the Codex plugin. The plugin
+already bundles `hooks/hooks.json`.
+
 If Codex says hooks need review, run `/hooks`, inspect the AIM hook, and trust it.
 
 Add a deterministic guardrail from natural language:
@@ -46,6 +64,19 @@ npx -y @samirosamsam/aim@latest rule add 'empêche de modifier package.json'
 npx -y @samirosamsam/aim@latest rule add 'empêche les calls GitHub qui ajoutent des collaborators'
 ```
 
+For SaaS data targets described by a title or label, use Codex/provider tools first to resolve the concrete resource, then write the rule with `capture`:
+
+```bash
+npx -y @samirosamsam/aim@latest capture \
+  --provider notion \
+  --tool fetch \
+  --args '{"url":"https://www.notion.so/..."}' \
+  --effect deny \
+  --agent codex \
+  --connection notion:codex \
+  --policy ~/.codex/aim/policy.json
+```
+
 Codex then calls the AIM hook before supported tool calls. A blocked Bash call returns the Codex `PreToolUse` deny shape:
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samirosamsam/aim",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "AIM CLI for installing deterministic Codex tool-call guardrails.",
   "private": false,
   "type": "module",
@@ -10,6 +10,7 @@
   "files": [
     ".agents/plugins/marketplace.json",
     ".codex-plugin/plugin.json",
+    "assets/",
     "bin/",
     "hooks/",
     "skills/",

package/skills/aim/SKILL.md

@@ -9,15 +9,24 @@ Use the public `aim` CLI as the source of truth for installing Codex hooks, addi
 
 ## Workflow
 
-1. Install or refresh the Codex `PreToolUse` hook before claiming enforcement is active:
+1. Use the bundled plugin hook when AIM is installed as a Codex plugin. Do not run `setup` just to duplicate it. If Codex reports hooks need review, tell the user to run `/hooks`, inspect the AIM hook, and trust it.
+
+For CLI-only use without the Codex plugin, install or refresh the Codex `PreToolUse` hook before claiming enforcement is active:
 
 ```bash
 npx -y @samirosamsam/aim@latest setup --json
 ```
 
-If Codex reports that hooks need review, tell the user to run `/hooks`, inspect the AIM hook, and trust it. Do not claim active enforcement until the hook is trusted and a proof call blocks.
+Do not claim active enforcement until the hook is trusted and a proof call blocks.
+
+2. Choose the smallest enforceable path:
+
+- For Bash commands and file edits, use `rule add`.
+- For external data or SaaS access, first discover the concrete resource with that provider's tools, then use `capture`.
+- If the user gives a human label such as a page title, folder name, channel name, repo label, database name, or "all subpages", do not reject it as "not a resource". Search/list/fetch with the provider plugin or MCP tools, pick the best exact match when confidence is high, and explain the choice. Ask only when several plausible matches remain or when a broad wildcard would be required.
+- For hierarchical requests such as subpages, folders, databases, repos, or projects, enumerate the concrete children when the provider tools expose them and add rules for each resolved resource. If the provider cannot enumerate future children, block the resolved current resources and state that new children need another rule.
 
-2. Add the user's requested block as a Codex guardrail rule:
+For local Codex rules:
 
 ```bash
 npx -y @samirosamsam/aim@latest rule add "<what the user wants to prevent>" --json
@@ -31,6 +40,21 @@ npx -y @samirosamsam/aim@latest rule add "empêche de modifier package.json" --j
 npx -y @samirosamsam/aim@latest rule add "empêche les calls GitHub qui ajoutent des collaborators" --json
 ```
 
+For resolved MCP resources:
+
+```bash
+npx -y @samirosamsam/aim@latest capture \
+  --provider "<provider>" \
+  --tool "<representative MCP tool>" \
+  --args '<representative MCP args JSON>' \
+  --resource "<stable provider resource id or path>" \
+  --effect deny \
+  --agent codex \
+  --connection "<provider>:codex" \
+  --policy ~/.codex/aim/policy.json \
+  --json
+```
+
 3. Prove the guardrail with a representative hook input before reporting success. Pick the proof that matches the rule:
 
 ```bash
@@ -58,7 +82,7 @@ npx -y @samirosamsam/aim@latest rule list --json
 
 ## Advanced Commands
 
-Use `capture`, `authorize`, `compile`, `add`, or `check` only for lower-level policy debugging. The normal public workflow is `setup`, `rule add`, proof, report.
+Use `compile`, `add`, or `check` only for lower-level policy debugging. The normal public workflow is `setup`, then `rule add` for local Codex resources or provider discovery plus `capture` for MCP resources, then proof, then report.
 
 ```bash
 npx -y @samirosamsam/aim@latest capture \
@@ -75,7 +99,7 @@ If a command returns `questions`, ask for the missing command, file path, provid
 
 ## Scope
 
-- For Codex enforcement, prefer `rule add` over `compile`/`add`; it writes rules intended for the `PreToolUse` hook.
+- For Codex enforcement, prefer `rule add` for Bash/files and `capture` for resolved MCP resources over `compile`/`add`; both write rules intended for the `PreToolUse` hook.
 - Prefer narrow resource patterns over `*`.
 - Codex hook guardrails are default-allow: no matching block means the tool call proceeds.
 - Treat `deny` as higher priority than `approval`, and `approval` as higher priority than `allow`.

package/src/engine.js

@@ -214,7 +214,12 @@ export function compileCodexRulePrompt(prompt, context = {}) {
   }
 
   if (drafts.length === 0) {
-    questions.push("Specify a Bash command, file path, or MCP provider/tool/resource to block.");
+    const providers = detectProviders(normalized).filter((provider) => provider !== "*");
+    if (providers.length > 0) {
+      questions.push(`Resolve the ${providers.join("/")} resource with that provider's search/list/fetch tools, then add an AIM capture rule with the stable resource id or path.`);
+    } else {
+      questions.push("Specify a Bash command, file path, or MCP provider/tool/resource to block.");
+    }
   }
 
   return { drafts: uniqueDrafts(drafts), questions };
@@ -531,7 +536,7 @@ function inferGithubCall(tool, args) {
 }
 
 function inferNotionCall(tool, args) {
-  const page = cleanPart(args.page_id ?? args.pageId ?? args.id);
+  const page = cleanPart(args.page_id ?? args.pageId ?? args.id ?? notionPageId(args.url ?? args.page_url ?? args.pageUrl));
   const database = cleanPart(args.database_id ?? args.databaseId);
   if (page) return { access: inferAccess(tool), resource: `notion/pages/${page}` };
   if (database) return { access: inferAccess(tool), resource: `notion/databases/${database}` };
@@ -570,6 +575,14 @@ function githubRepo(args, suffix = "") {
   return owner && repo ? `repo/${owner}/${repo}${suffix}` : "*";
 }
 
+function notionPageId(value) {
+  const text = String(value ?? "");
+  const dashed = text.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i);
+  if (dashed) return dashed[0];
+  const compact = text.match(/[0-9a-f]{32}/i);
+  return compact?.[0] ?? "";
+}
+
 function reasonFor(effect, access, resourcePattern) {
   if (effect === "deny") return `Block ${access} on ${resourcePattern}.`;
   if (effect === "approval") return `Require human approval for ${access} on ${resourcePattern}.`;