@scopebond/hook 0.4.0 → 0.6.0

package/README.md

@@ -1,28 +1,33 @@
 # @scopebond/hook
 
-The Scopebond connector for **Claude Code** and **Cursor**. It checks every tool
+The Scopebond connector for **Claude Code**, **Cursor**, and **OpenAI Codex**. It checks every tool
 call a coding agent makes against your policy *before it runs*, blocks the ones
 outside policy, and records a signed receipt — locally, on the machine, and
 optionally mirrored to your Scopebond Cloud workspace for monitoring.
 
-- **Label:** in-path · prevents (a Claude Code `PreToolUse` deny via exit code 2
-  blocks even in bypass-permissions mode).
-- **Ceiling:** it governs actions the harness routes through its tool system
+- **What it does:** checks supported agent actions before they run and blocks an
+  action when it breaks your policy.
+- **Where it works:** actions the coding agent routes through its tool system
   (shell, file, MCP, web). A process started outside the harness is not covered.
 
 ## Install once for your machine
 
 ```
 npm i -g @scopebond/hook
-scopebond install                   # detects Cursor; add --claude / --cursor to pick
+scopebond install                   # detects Cursor and Codex
+scopebond install --codex           # set up Codex only
 ```
 
 `install` sets Scopebond up **once per developer machine**, not per repository: it
 scaffolds a user-level home (`~/.scopebond`, override `SCOPEBOND_HOME`) with a
 signing key, a countersigning key and a starter policy, and registers the hook by
-absolute path in your user-level `~/.claude/settings.json` (and `~/.cursor/hooks.json`
-when Cursor is present). Every project you open is then governed, and a project-local
-`.scopebond/` still takes precedence when you want a per-repo policy.
+absolute path in your user-level `~/.claude/settings.json`, `~/.cursor/hooks.json`,
+or `~/.codex/hooks.json`. After Codex setup, open Codex, run `/hooks`, review
+Scopebond, and choose **Trust** once. Every project you open is then governed by your
+user-level policy. A project's own `.scopebond/policy.json` applies only after you trust it
+in that project (`scopebond trust`, or `init` there), pinned to its exact contents: a
+repository you clone, or an agent working in it, cannot swap in a weaker policy, and any
+later edit to that file stops it applying until you trust it again.
 
 ```
 scopebond status                    # home, which agents are configured, cloud, receipts
@@ -43,14 +48,17 @@ Scopebond is also a Claude Code plugin (this repo is a plugin marketplace):
 ### Per-repository enroll (alternative)
 
 ```
-npx @scopebond/hook init            # Claude Code (or: init --cursor)
+npx @scopebond/hook init            # Claude Code
+npx @scopebond/hook init --cursor   # Cursor
+npx @scopebond/hook init --codex    # Codex, then approve it once with /hooks
 ```
 
 `init` scaffolds `.scopebond/` in the current project (a machine signing key, a
 countersigning key, a starter policy — "protect main and production paths" — and a
-`.gitignore` so none of it is committed) and configures `.claude/settings.json` or
-`.cursor/hooks.json`. Then run one safe command in the agent and see the receipt in
-`.scopebond/receipts.db`.
+`.gitignore` so none of it is committed) and configures `.claude/settings.json`,
+`.cursor/hooks.json`, or `.codex/hooks.json`. Then run one safe command in the agent and see the receipt in
+`.scopebond/receipts.db`. `init`, `trust` and `uninstall` are meant for a person at a
+terminal: in a script or CI, pass `--yes`.
 
 ## Connect it to your workspace (optional)
 
@@ -62,11 +70,13 @@ as `scopebond-enrollment.json`, then:
 npx @scopebond/hook connect https://<your-workspace> scopebond-enrollment.json
 ```
 
+In Windows PowerShell, use `npx.cmd` instead of `npx` if script execution policy blocks `npx.ps1`; no execution-policy change is needed. Enrollment registers both the gateway attester and the hook's separate agent signing key with proof of possession, so Cloud can verify authenticated receipts.
+
 `connect` does the whole setup in one command: it scaffolds `.scopebond/` if needed,
 enrolls this machine's countersigning key, stores a scoped machine credential in
-`.scopebond/cloud.json` (a secret — never commit it), **and configures Claude Code
-for you** (it merges the hook into `.claude/settings.json`, preserving anything
-already there — pass `--no-install` to skip, or `--cursor` for Cursor). The
+`.scopebond/cloud.json` (a secret — never commit it), **and configures your coding
+agent for you** (it merges the hook into the agent's settings, preserving anything
+already there — pass `--no-install` to skip, `--cursor` for Cursor, or `--codex` for Codex). The
 enrollment argument can be a file, an inline blob, or JSON on stdin, so the portal
 can hand you a single copy-paste command with nothing to save.
 
@@ -81,27 +91,69 @@ anything still queued — run it on a session-end hook (and set
 Each tool call is mapped to a normalized [Action Taxonomy](https://github.com/avouro-com/scopebond)
 action (`shell.exec`, `git.push`, `file.write`, `mcp.tool.call`, …), signed by the
 machine key and decided against your policy by an in-process check-only gateway.
-An allowed action is a **cooperative allow** (recorded, never executed by the
-hook — the agent performs it); a denied action is blocked. Unknown tools are
+An allowed action is recorded and left to the coding agent's normal permission
+prompt; the hook never auto-approves it. A denied action is blocked. Unknown tools are
 recorded as *not evaluated* and grant nothing. Anything unexpected fails closed
 (deny) with a repair message.
 
 Commands are stored as a scrubbed head plus a digest; file contents are never
 stored; common secret shapes are removed before signing.
 
-**Strict mode.** By default a tool with no taxonomy mapping is recorded *not
-evaluated* (not blocked). Add `--strict` (or `SCOPEBOND_HOOK_STRICT=1`) to deny
-unmapped tools too — fail-closed coverage for anything the taxonomy does not map.
+**What a shell command is checked for.** A command line is split into every command it
+runs (`&&`, `;`, pipes, `$( )` and backticks — also inside double quotes — `bash -c`,
+`eval`, `trap`, `su -c`, `script -c`, `watch`, `parallel`, `cmd /c`, `pwsh -Command`
+and `-EncodedCommand`, `find -exec`, `env -S`), with shell keywords and grouping
+(`if … then`, `for … do`, `{ … }`, `!`, `case`) and wrappers (`sudo`, `env`, `time`,
+`nice`, `xargs`, `timeout`, `strace`, `busybox` …, each with its own option arity)
+stripped so the real program is seen; the wrappers are checked too. Each command is
+checked as a program, and the files it reads or writes are checked like the Read and
+Write tools: operands of programs that output or copy file content (`cat`, `grep`,
+`tar`, …), copies and moves (`cp`, `mv`, `rsync`, `scp`, `Copy-Item`), writers and
+editors (`tee`, `touch`, `sed -i`, `yq -i`, `ed`, `vim`, `Set-Content`), git's own writes
+(`checkout -- p`, `restore`, `mv`, `rm`, `config core.hooksPath`), secrets sent or staged
+(`curl -T`, `-d @file`, `gh gist create`, `git add`) and redirections, including
+`x>file` without spaces. Existence and metadata checks (`ls`, `test -f`, `[ -f ]`,
+`stat`) and a secret file's name in a string are not reads. Paths are compared
+case-insensitively; Windows `\` paths, 8.3 short names (`CLAUDE~1`), `::$DATA` streams
+and trailing dots are normalized; and a glob, variable or brace list that could name a
+protected file or directory (`.scope*/agent.key`, `.*/*`, `$HOME/.ssh/id_rsa`) is
+treated as that file. Every destination of a `git push` is checked in the common
+spellings (`refs/heads/main`, `HEAD:main`, a second refspec, `--repo`, `--all`,
+`--mirror`); a push whose destination is not on the command line (a git alias, a
+configured push refspec, `send-pack`) is denied, and a tags-only push is allowed. The
+agent running the hook's own `init`, `install`, `trust`, `uninstall` or `connect` is
+denied, and those commands also refuse a non-interactive terminal unless `--yes` is
+passed.
+
+**Limits.** The hook sees the command text, not what a program does at run time. It
+does not follow a variable whose value it cannot see (`cat $FILE`), a path assembled
+inside a script or interpreter (`python script.py`), aliases and functions defined in
+an earlier call, git aliases from a config file, recursive reads of a parent of a
+protected directory (`grep -r . `, `cp -r ~ /tmp`), or deletion expressed as arguments
+(`find -delete`, `git clean`). Commands whose written files are named only inside their
+input — `patch`, `git apply`, `git am`, `tar x`, `unzip`, `7z x`, `cpio -i` — are
+recorded with an unevaluated write: allowed in normal mode, denied in strict mode.
+Reading any `*.pem` file is denied, including a public certificate, because a PEM file
+is often a private key. For stronger guarantees, run the agent behind the Scopebond
+gateway or in a sandbox; the hook is a guardrail for a cooperating agent, not a jail.
+
+**Strict mode.** A shell command that cannot be parsed (an unbalanced quote) or whose
+program is only known at run time (`$cmd`, `$(…) args`) is checked with an empty
+program name, which the starter policy denies in every mode — edit the `safe-shell`
+clause to change that. By default a tool with no taxonomy mapping, or a write whose
+target the command text does not name, is recorded *not evaluated* (not blocked). Add
+`--strict` (or `SCOPEBOND_HOOK_STRICT=1`) to deny those too — fail-closed coverage for
+anything the taxonomy does not map.
 
 ## Library
 
 The mapper and runtime are exported for testing and embedding:
 
 ```js
-import { mapClaudeToolUse, createHookRuntime } from "@scopebond/hook";
+import { mapClaudeToolUse, mapCodexToolUse, createHookRuntime } from "@scopebond/hook";
 ```
 
-`mapClaudeToolUse` / `mapCursorEvent` are pure functions (native payload →
+`mapClaudeToolUse`, `mapCursorEvent`, and `mapCodexToolUse` are pure functions (native payload →
 normalized action). `createHookRuntime` builds the check-only gateway from a
 policy, a machine key and a local receipt log; pass `cloud: { connection }` (from
 `connectCloud`) to mirror receipts to a workspace.

package/dist/cli.js

@@ -4,13 +4,15 @@
 //
 //   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)
 //   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)
-//   scopebond-hook init [--cursor] [--no-install]  scaffold keys + starter policy and configure the agent
-//   scopebond-hook connect <url> <bundle.json> [--cursor]
+//   scopebond-hook codex                      evaluate a Codex PreToolUse call (stdin JSON)
+//   scopebond-hook init [--cursor|--codex] [--no-install] [--yes]
+//   scopebond-hook connect <url> <bundle.json> [--cursor|--codex]
 //                                             enroll with a Cloud workspace and start exporting
 //   scopebond-hook log [-n N]                 show the most recent local receipts
 //   scopebond-hook verify                     verify every local receipt offline against the attester key
 //   scopebond-hook test "<shell command>"     show the decision for a command without recording it
 //   scopebond-hook flush                      deliver any queued receipts to Cloud now
+//   scopebond-hook trust [--yes]              let this project's .scopebond policy govern here (pinned)
 //
 // Config dir: $SCOPEBOND_HOOK_DIR, else ./.scopebond
 // Fail-closed: any error denies the action with a repair message.
@@ -20,10 +22,10 @@ import { tmpdir } from "node:os";
 import { execFileSync } from "node:child_process";
 import { verifyReceipt } from "@scopebond/gateway";
 import { openReceiptStore, loadOrCreateAttester } from "@scopebond/gateway/node";
-import { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
+import { mapClaudeToolUse, mapCodexToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
 import { createHookRuntime } from "./runtime.js";
 import { scaffold, harnessSnippet, installHarness } from "./init.js";
-import { userHome, userHarnessFile, resolveConfigDir, writeHarnessConfig, removeHarnessConfig, cursorDetected, absoluteHookCommand, isHarnessConfigured, purgeHome, } from "./install.js";
+import { userHome, userHarnessFile, resolveConfigDir, writeHarnessConfig, removeHarnessConfig, cursorDetected, codexDetected, absoluteHookCommand, isHarnessConfigured, purgeHome, trustProjectPolicy, untrustedProjectPolicy, } from "./install.js";
 import { connectCloud, loadConnection } from "./cloud.js";
 import { cliCommand, hookVersion } from "./version.js";
 import { fileURLToPath } from "node:url";
@@ -93,30 +95,48 @@ function denyClaude(reason) {
     process.stderr.write(`Scopebond: ${reason}\n`);
     process.exit(2);
 }
-async function runClaude() {
+/** Codex accepts the structured deny response on a successful hook exit. Keeping
+ *  exit 0 lets its UI show a completed policy check instead of a failed hook while
+ *  still preventing the tool call. */
+function denyCodex(reason) {
+    process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason },
+    }) + "\n");
+    process.exit(0);
+}
+const harnessName = (harness) => harness === "claude" ? "Claude Code" : harness === "cursor" ? "Cursor" : "Codex";
+const harnessFileName = (harness) => harness === "claude" ? ".claude/settings.json" : harness === "cursor" ? ".cursor/hooks.json" : ".codex/hooks.json";
+const selectedHarness = (args) => args.includes("--codex") ? "codex" : args.includes("--cursor") ? "cursor" : "claude";
+const codexTrustStep = "Open Codex, run `/hooks`, review Scopebond, and choose Trust. Then start a new task.";
+async function runPreToolUse(mapper, deny = denyClaude) {
     let input;
     try {
         input = JSON.parse(readStdin());
     }
     catch {
-        denyClaude("hook received invalid JSON on stdin");
+        deny("hook received invalid JSON on stdin");
     }
     try {
         const cwd = input?.cwd ? String(input.cwd) : process.cwd();
         const runtime = createHookRuntime(runtimePaths(resolveConfigDir(cwd)));
-        const decision = await runtime.evaluate(fillPushBranch(mapClaudeToolUse(input), currentBranch(cwd)));
+        const decision = await runtime.evaluate(fillPushBranch(mapper(input), currentBranch(cwd)));
         await runtime.flush();
         if (decision.decision === "deny")
-            denyClaude(decision.reason);
-        // allow and not_evaluated both DEFER to Claude Code's own permission flow: the
-        // hook records the receipt but never returns permissionDecision:"allow", which
-        // would suppress the user's normal review. Scopebond blocks; it does not approve.
+            deny(decision.reason);
+        // Stay silent on allow/not_evaluated so the coding agent's normal permission
+        // flow remains in charge. Scopebond blocks; it never silently approves.
         process.exit(0);
     }
     catch (error) {
-        denyClaude(`Scopebond hook failed closed: ${error.message}. Repair: run \`${cliCommand("init")}\`.`);
+        deny(`Scopebond hook failed closed: ${error.message}. Repair: run \`${cliCommand("init")}\`.`);
     }
 }
+async function runClaude() {
+    await runPreToolUse(mapClaudeToolUse);
+}
+async function runCodex() {
+    await runPreToolUse(mapCodexToolUse, denyCodex);
+}
 async function runCursor() {
     let input = {};
     try {
@@ -143,22 +163,49 @@ async function runCursor() {
     process.stdout.write(JSON.stringify({ permission, agentMessage: message }) + "\n");
     process.exit(0);
 }
+/** `init`, `trust` and `uninstall` change what governs the agent, so they are for a
+ *  person at a terminal. A coding agent's shell is not interactive: without a TTY on
+ *  stdin they refuse unless `--yes` is passed (for scripts and CI). The starter policy
+ *  also denies the agent running them. */
+function requireInteractive(command, args) {
+    if (process.stdin.isTTY || args.includes("--yes"))
+        return;
+    console.error(`scopebond ${command} changes what governs your coding agent, so it must be run from an interactive terminal.`);
+    console.error(`In a script or CI, pass --yes: ${cliCommand(`${command} --yes`)}`);
+    process.exit(1);
+}
 function runInit(args) {
-    const harness = args.includes("--cursor") ? "cursor" : "claude";
+    requireInteractive("init", args);
+    const harness = selectedHarness(args);
     const dir = configDir();
     const { agentKid, policyPath } = scaffold(dir, { force: args.includes("--force") });
     console.log(`Scopebond hook enrolled in ${dir}`);
     console.log(`  machine key    ${agentKid}`);
     console.log(`  policy         ${policyPath} (starter — edit the limits)`);
+    // With a user-level install present, a project policy governs only once trusted.
+    // Running init here is that decision, so pin this policy now.
+    if (!process.env.SCOPEBOND_HOOK_DIR && existsSync(join(userHome(), "policy.json"))) {
+        trustProjectPolicy(dir);
+        console.log(`  trusted        overrides ${userHome()} here; after editing it, run \`${cliCommand("trust")}\``);
+    }
     console.log("");
     // Configure the agent automatically by default (idempotent), so there is no
     // hand-editing step; --no-install prints the snippet instead.
     if (!args.includes("--no-install")) {
-        const file = installHarness(harness);
-        console.log(`✓ ${harness === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+        let file;
+        try {
+            file = installHarness(harness);
+        }
+        catch (error) {
+            console.error(error.message);
+            process.exit(1);
+        }
+        console.log(`✓ ${harnessName(harness)} configured in ${file}`);
+        if (harness === "codex")
+            console.log(`\nOne last step: ${codexTrustStep}`);
     }
     else {
-        console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+        console.log(`Add this to your ${harnessFileName(harness)}:`);
         console.log(harnessSnippet(harness));
     }
     console.log("");
@@ -277,9 +324,9 @@ async function runConnect(args) {
     const positional = args.filter((a) => !a.startsWith("--"));
     const url = positional[0];
     const bundleArg = positional[1];
-    const harness = args.includes("--cursor") ? "cursor" : "claude";
+    const harness = selectedHarness(args);
     if (!url) {
-        console.error("usage: scopebond-hook connect <workspace-url> <enrollment> [--cursor] [--no-install]");
+        console.error("usage: scopebond-hook connect <workspace-url> <enrollment> [--claude|--cursor|--codex] [--no-install]");
         process.exit(1);
     }
     const dir = configDir();
@@ -303,10 +350,12 @@ async function runConnect(args) {
         // caller opts out. This removes the "paste this snippet" step.
         if (!args.includes("--no-install")) {
             const file = installHarness(harness);
-            console.log(`✓ ${harness === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+            console.log(`✓ ${harnessName(harness)} configured in ${file}`);
+            if (harness === "codex")
+                console.log(`\nOne last step: ${codexTrustStep}`);
         }
         else {
-            console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+            console.log(`Add this to your ${harnessFileName(harness)}:`);
             console.log(harnessSnippet(harness));
         }
         console.log("");
@@ -326,8 +375,10 @@ async function runFlush() {
     const runtime = createHookRuntime(runtimePaths(dir));
     await runtime.exporter?.flush();
     const status = runtime.exporter?.status();
+    runtime.exporter?.stop();
     console.log(`flushed; ${status?.pending ?? 0} receipt(s) still pending${status?.lastError ? ` (last error: ${status.lastError})` : ""}`);
-    process.exit(status && status.pending > 0 ? 1 : 0);
+    // Let pending HTTP handles close normally (forced exit can abort on Windows).
+    process.exitCode = status && status.pending > 0 ? 1 : 0;
 }
 /** The absolute path to this CLI file, for registering the hook by absolute path. */
 function cliPath() {
@@ -343,21 +394,30 @@ function runInstall(args) {
     console.log(`  machine key    ${agentKid}`);
     console.log(`  policy         ${policyPath} (starter — edit the limits)`);
     console.log("");
-    const harnesses = args.includes("--cursor")
-        ? ["cursor"]
-        : args.includes("--claude") ? ["claude"] : (cursorDetected() ? ["claude", "cursor"] : ["claude"]);
+    const harnesses = args.includes("--codex") ? ["codex"]
+        : args.includes("--cursor") ? ["cursor"]
+            : args.includes("--claude") ? ["claude"]
+                : ["claude", ...(cursorDetected() ? ["cursor"] : []), ...(codexDetected() ? ["codex"] : [])];
     if (!args.includes("--no-install")) {
         for (const h of harnesses) {
-            const file = writeHarnessConfig(userHarnessFile(h), h, absoluteHookCommand(cliPath(), h));
-            console.log(`✓ ${h === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+            try {
+                const file = writeHarnessConfig(userHarnessFile(h), h, absoluteHookCommand(cliPath(), h));
+                console.log(`✓ ${harnessName(h)} configured in ${file}`);
+            }
+            catch (error) {
+                console.error(`✗ ${harnessName(h)}: ${error.message}`);
+                process.exitCode = 1;
+            }
         }
     }
     else {
         console.log("Add this to your user-level agent config:");
         console.log(harnessSnippet(harnesses[0]));
     }
+    if (harnesses.includes("codex"))
+        console.log(`\nOne last step for Codex: ${codexTrustStep}`);
     console.log("");
-    console.log("A project-local .scopebond still takes precedence when present.");
+    console.log(`A project's own .scopebond policy applies only after you trust it there (${cliCommand("trust")}).`);
     console.log(`Check it: ${cliCommand("doctor")} · see decisions: ${cliCommand("log")}`);
     console.log(`To send receipts to a workspace: ${cliCommand("connect <workspace-url> <enrollment>")}`);
 }
@@ -366,13 +426,18 @@ function runStatus() {
     const installed = existsSync(join(home, "policy.json"));
     const claude = isHarnessConfigured(userHarnessFile("claude"));
     const cursor = isHarnessConfigured(userHarnessFile("cursor"));
+    const codex = isHarnessConfigured(userHarnessFile("codex"));
     const connected = !!loadConnection(resolveConfigDir(process.cwd()));
     const dbPath = join(resolveConfigDir(process.cwd()), "receipts.db");
     console.log(`Scopebond hook ${hookVersion()}`);
     console.log(`  user home        ${home} ${installed ? "(installed)" : "(not installed — run `scopebond install`)"}`);
     console.log(`  active config    ${resolveConfigDir(process.cwd())}`);
-    console.log(`  Claude Code      ${claude ? "configured" : "not configured"}`);
+    const ignored = untrustedProjectPolicy(process.cwd());
+    if (ignored)
+        console.log(`  project policy   ${ignored} ignored — not trusted (run \`${cliCommand("trust")}\` to use it)`);
+    console.log(`  Claude Code     ${claude ? "configured" : "not configured"}`);
     console.log(`  Cursor           ${cursor ? "configured" : cursorDetected() ? "detected, not configured" : "not detected"}`);
+    console.log(`  Codex            ${codex ? "configured (approve once with /hooks)" : codexDetected() ? "detected, not configured" : "not detected"}`);
     console.log(`  cloud workspace  ${connected ? "connected" : "not connected (local only)"}`);
     console.log(`  local receipts   ${existsSync(dbPath) ? dbPath : "none yet"}`);
 }
@@ -391,6 +456,13 @@ async function runDoctor() {
     console.log(`  active config    ${active} ${hasPolicy ? "ok" : "no policy (run `scopebond install` or `init`)"}`);
     if (!hasPolicy)
         problems.push("no policy found in the active config dir");
+    const ignored = untrustedProjectPolicy(process.cwd());
+    if (ignored)
+        console.log(`  project policy   ${ignored} IGNORED — not trusted (never trusted, or edited since). Review it, then \`${cliCommand("trust")}\``);
+    const codex = isHarnessConfigured(userHarnessFile("codex"));
+    console.log(`  Codex hook       ${codex ? "configured" : codexDetected() ? "not configured — run `scopebond install --codex`" : "not detected"}`);
+    if (codex)
+        console.log(`  Codex approval   run /hooks in Codex and approve Scopebond once`);
     const connection = loadConnection(active);
     if (!connection) {
         console.log(`  cloud            not connected (local only) — receipts stay on this machine`);
@@ -407,11 +479,12 @@ async function runDoctor() {
         console.log(`  cloud            ${connection.url} — ${reachable}`);
     }
     console.log(problems.length ? `\n${problems.length} problem(s): ${problems.join("; ")}` : `\nAll good.`);
-    process.exit(problems.length ? 1 : 0);
+    process.exitCode = problems.length ? 1 : 0;
 }
 function runUninstall(args) {
+    requireInteractive("uninstall", args);
     let removed = 0;
-    for (const h of ["claude", "cursor"]) {
+    for (const h of ["claude", "cursor", "codex"]) {
         if (removeHarnessConfig(userHarnessFile(h))) {
             console.log(`✓ removed the Scopebond hook from ${userHarnessFile(h)}`);
             removed++;
@@ -426,6 +499,20 @@ function runUninstall(args) {
     else
         console.log(`Kept ${userHome()} (keys, policy, receipts). Use --purge to remove it too.`);
 }
+/** `trust` — let this project's .scopebond policy govern here instead of the user
+ *  home, pinned to its current contents. Run by the user, not the agent: the file it
+ *  writes lives in the user home, which the starter policy write-protects. */
+function runTrust(args) {
+    requireInteractive("trust", args);
+    const dir = join(process.cwd(), ".scopebond");
+    if (!existsSync(join(dir, "policy.json"))) {
+        console.error(`no project policy at ${join(dir, "policy.json")}`);
+        process.exit(1);
+    }
+    const digest = trustProjectPolicy(dir);
+    console.log(`✓ trusted ${join(dir, "policy.json")} (sha256 ${digest.slice(0, 12)}…)`);
+    console.log("It governs agents in this project until it changes; after any edit, review it and run trust again.");
+}
 function runLogin() {
     console.log("Device-code login is not available yet.");
     console.log(`For now, connect with a one-time enrollment from your workspace:`);
@@ -439,6 +526,9 @@ if (cmd === "claude") {
 else if (cmd === "cursor") {
     await runCursor();
 }
+else if (cmd === "codex") {
+    await runCodex();
+}
 else if (cmd === "init") {
     runInit(rest);
 }
@@ -472,8 +562,11 @@ else if (cmd === "uninstall") {
 else if (cmd === "login") {
     runLogin();
 }
+else if (cmd === "trust") {
+    runTrust(rest);
+}
 else {
-    console.error("usage: scopebond <claude|cursor|init|install|connect|log|verify|test|flush|status|doctor|uninstall|login> [--cursor] [--claude] [--force] [--strict] [--no-install] [--purge]");
+    console.error("usage: scopebond <claude|cursor|codex|init|install|connect|log|verify|test|flush|status|doctor|uninstall|login|trust> [--cursor] [--claude] [--codex] [--force] [--strict] [--no-install] [--purge] [--yes]");
     process.exit(1);
 }
 //# sourceMappingURL=cli.js.map