@scopebond/hook 0.4.0 → 0.5.0

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,mBAAmB;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1F,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,OAAO,0BAA0B,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,0BAA0B,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC;AAC1D,CAAC","sourcesContent":["// The installed package version, read from the package's own package.json at\n// runtime. Used to pin the `npx` command the hook installs into the agent config,\n// so the harness always runs the exact version the user set up rather than a\n// floating latest.\n\nimport { readFileSync } from \"node:fs\";\n\nexport function hookVersion(): string {\n  try {\n    // dist/version.js → ../package.json is the package root in both the source\n    // tree and the published tarball.\n    const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\"));\n    return typeof pkg.version === \"string\" ? pkg.version : \"latest\";\n  } catch {\n    return \"latest\";\n  }\n}\n\n/** The command the agent harness runs for each tool call: a version-pinned npx\n *  invocation so a missing global binary is fetched rather than silently skipped\n *  (which a harness can treat as \"no hook\" and fail open). */\nexport function hookCommand(harness: \"claude\" | \"cursor\"): string {\n  return `npx -y @scopebond/hook@${hookVersion()} ${harness}`;\n}\n\n/** The command a user runs by hand for a CLI subcommand (`log`, `verify`, `test`,\n *  `init`, `connect`). After `npx @scopebond/hook init` there is no `scopebond-hook`\n *  binary on PATH, so printed guidance must use the same version-pinned `npx` form,\n *  which also resolves to a global install when one exists. */\nexport function cliCommand(sub: string): string {\n  return `npx -y @scopebond/hook@${hookVersion()} ${sub}`;\n}\n"]}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,mBAAmB;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1F,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,WAAW,CAAC,OAAsC;IAChE,OAAO,0BAA0B,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,uBAAuB,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC;AAC1G,CAAC","sourcesContent":["// The installed package version, read from the package's own package.json at\n// runtime. Used to pin the `npx` command the hook installs into the agent config,\n// so the harness always runs the exact version the user set up rather than a\n// floating latest.\n\nimport { readFileSync } from \"node:fs\";\n\nexport function hookVersion(): string {\n  try {\n    // dist/version.js → ../package.json is the package root in both the source\n    // tree and the published tarball.\n    const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\"));\n    return typeof pkg.version === \"string\" ? pkg.version : \"latest\";\n  } catch {\n    return \"latest\";\n  }\n}\n\n/** The command the agent harness runs for each tool call: a version-pinned npx\n *  invocation so a missing global binary is fetched rather than silently skipped\n *  (which a harness can treat as \"no hook\" and fail open). */\nexport function hookCommand(harness: \"claude\" | \"cursor\" | \"codex\"): string {\n  return `npx -y @scopebond/hook@${hookVersion()} ${harness}`;\n}\n\n/** The command a user runs by hand for a CLI subcommand (`log`, `verify`, `test`,\n *  `init`, `connect`). After `npx @scopebond/hook init` there is no `scopebond-hook`\n *  binary on PATH, so printed guidance must use the same version-pinned `npx` form,\n *  which also resolves to a global install when one exists. */\nexport function cliCommand(sub: string): string {\n  return `${process.platform === \"win32\" ? \"npx.cmd\" : \"npx\"} -y @scopebond/hook@${hookVersion()} ${sub}`;\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@scopebond/hook",
-  "version": "0.4.0",
-  "description": "Scopebond hook for Claude Code and Cursor — checks each coding-agent tool call against policy before it runs (in-path, cooperative M0) and records a signed receipt, locally.",
+  "version": "0.5.0",
+  "description": "Scopebond hook for Claude Code, Cursor, and OpenAI Codex — checks coding-agent actions against policy before they run and records a signed receipt locally.",
   "license": "Apache-2.0",
   "author": "Avouro LLC",
   "homepage": "https://github.com/avouro-com/scopebond/tree/main/packages/hook#readme",
@@ -17,6 +17,7 @@
     "scopebond",
     "claude-code",
     "cursor",
+    "openai-codex",
     "hooks",
     "ai-agents",
     "policy"
@@ -41,9 +42,9 @@
     "dist"
   ],
   "dependencies": {
-    "@scopebond/policy-schema": "^0.3.0",
-    "@scopebond/sdk": "^0.1.1",
-    "@scopebond/gateway": "^0.6.0"
+    "@scopebond/sdk": "^0.1.2",
+    "@scopebond/gateway": "^0.6.1",
+    "@scopebond/policy-schema": "^0.4.0"
   },
   "publishConfig": {
     "access": "public"