@shidesheng0218/agentguard 0.8.0 → 0.9.0

package/dist/cli.js

@@ -1,7 +1,55 @@
 #!/usr/bin/env node
+import {
+  HOOKS_STOP_BLOCK_REASON,
+  WIRE_VERIFY_CORRECTIVE,
+  analyzeCall,
+  blockKindStats,
+  buildStatus,
+  callsSince,
+  captureCheckpoint,
+  castVetoVote,
+  claudeDetected,
+  claudeHooksInstalled,
+  claudeSettingsPath,
+  codexDetected,
+  codexHooksPath,
+  collectVetoContext,
+  countBlocks,
+  countEvents,
+  detectKimiConfig,
+  findClaims,
+  fingerprint,
+  getMeta,
+  guardHome,
+  hasEvidence,
+  hasRecentEdits,
+  hashOutput,
+  installClaudeHooks,
+  knownSessions,
+  latestCheckpointFile,
+  latestSessionId,
+  listBlocks,
+  loadConfig,
+  normalizeCall,
+  oldestEventTs,
+  openDb,
+  outputSampleOf,
+  probeLogPath,
+  recordBlock,
+  recordCall,
+  recordEvent,
+  renderResumeBlock,
+  setBlockFeedback,
+  setMeta,
+  stateDbPath,
+  uninstallClaudeHooks,
+  userConfigPath,
+  vetoKeyConfigured,
+  writeConfigTemplate
+} from "./chunk-SACTXNYK.js";
 
 // src/cli.ts
-import fs10 from "fs";
+import fs6 from "fs";
 import { Command } from "commander";
 
 // src/version.ts
@@ -10,395 +58,9 @@ var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var version = pkg.version;
 
-// src/config.ts
-import fs2 from "fs";
-import { parse as parseToml } from "smol-toml";
-
-// src/paths.ts
+// src/installer.ts
 import fs from "fs";
-import os from "os";
 import path from "path";
-function guardHome() {
-  const env = process.env.AGENT_GUARD_HOME ?? process.env.KIMI_GUARD_HOME;
-  if (env && env.trim()) return path.resolve(env);
-  const fresh = path.join(os.homedir(), ".agent-guard");
-  const legacy = path.join(os.homedir(), ".kimi-guard");
-  if (!fs.existsSync(fresh) && fs.existsSync(legacy)) return legacy;
-  return fresh;
-}
-function claudeSettingsPath() {
-  const env = process.env.CLAUDE_SETTINGS_PATH;
-  if (env && env.trim()) return path.resolve(env);
-  return path.join(os.homedir(), ".claude", "settings.json");
-}
-function claudeDetected() {
-  return fs.existsSync(claudeSettingsPath()) || fs.existsSync(path.join(os.homedir(), ".claude"));
-}
-function stateDbPath() {
-  return path.join(guardHome(), "state.db");
-}
-function probeLogPath() {
-  return path.join(guardHome(), "probe.jsonl");
-}
-function userConfigPath() {
-  return path.join(guardHome(), "config.toml");
-}
-function detectKimiConfig() {
-  const env = process.env.KIMI_CONFIG_PATH;
-  if (env && env.trim()) {
-    const p = path.resolve(env);
-    return { path: p, exists: fs.existsSync(p) };
-  }
-  const candidates = [
-    path.join(os.homedir(), ".kimi-code", "config.toml"),
-    path.join(os.homedir(), ".kimi", "config.toml")
-  ];
-  for (const p of candidates) {
-    if (fs.existsSync(p)) return { path: p, exists: true };
-  }
-  return { path: candidates[0], exists: false };
-}
-
-// src/toolsets.ts
-var DEFAULT_EDIT_TOOLS = ["WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit", "NotebookEdit"];
-var DEFAULT_READ_TOOLS = ["ReadFile", "Read"];
-var DEFAULT_SEARCH_TOOLS = ["Grep", "Glob"];
-var DEFAULT_SHELL_TOOLS = ["Shell", "Bash"];
-var CLAUDE_EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-var CLAUDE_READ_TOOLS = ["Read"];
-var CLAUDE_SEARCH_TOOLS = ["Grep", "Glob"];
-var CLAUDE_SHELL_TOOLS = ["Bash"];
-function toolDefaultsFor(harness) {
-  return harness === "claude" ? { edit: [...CLAUDE_EDIT_TOOLS], read: [...CLAUDE_READ_TOOLS], search: [...CLAUDE_SEARCH_TOOLS], shell: [...CLAUDE_SHELL_TOOLS] } : { edit: [...DEFAULT_EDIT_TOOLS], read: [...DEFAULT_READ_TOOLS], search: [...DEFAULT_SEARCH_TOOLS], shell: [...DEFAULT_SHELL_TOOLS] };
-}
-function resolve(list, fallback) {
-  return new Set(list.length > 0 ? list : fallback);
-}
-function editTools(cfg) {
-  return resolve(cfg.tools.edit, DEFAULT_EDIT_TOOLS);
-}
-function readTools(cfg) {
-  return resolve(cfg.tools.read, DEFAULT_READ_TOOLS);
-}
-function searchTools(cfg) {
-  return resolve(cfg.tools.search, DEFAULT_SEARCH_TOOLS);
-}
-function shellTools(cfg) {
-  return resolve(cfg.tools.shell, DEFAULT_SHELL_TOOLS);
-}
-
-// src/config.ts
-var defaultConfig = {
-  harness: "kimi",
-  tools: toolDefaultsFor("kimi"),
-  repeat: {
-    enabled: true,
-    maxRepeats: 3,
-    warnAt: 2,
-    windowMinutes: 30,
-    watch: ["Grep", "Glob", "Shell", "Bash", "FetchURL", "SearchWeb", "ReadFile"],
-    thresholds: { ReadFile: 5 },
-    exemptPatterns: []
-  },
-  cycle: { enabled: true, windowMinutes: 30 },
-  noProgress: { enabled: true, windowMinutes: 30, warnAt: 15, blockAt: 25 },
-  nearRepeat: { enabled: true, windowMinutes: 30, warnAt: 6, blockAt: 10 },
-  explore: { enabled: true, windowMinutes: 30, warnAt: 10, blockAt: 15 },
-  verify: {
-    enabled: true,
-    blockOnNoEvidence: false,
-    evidenceWindowMinutes: 60,
-    claimPatterns: [],
-    evidencePatterns: [],
-    shellTools: ["Shell", "Bash"],
-    veto: {
-      enabled: false,
-      model: "kimi-k3",
-      baseUrl: "https://api.moonshot.cn/v1",
-      maxCallsPerSession: 3,
-      timeoutMs: 1e4
-    }
-  },
-  thinking: { enabled: true, minThinkChars: 2e4, maxTextRatio: 0.1 },
-  anchor: { enabled: true, everyNPrompts: 5, maxChars: 1e3 },
-  context: { enabled: true, warnPercent: 85 },
-  noGain: { enabled: true, windowMinutes: 30, warnAt: 3, blockAt: 4 },
-  churn: {
-    enabled: true,
-    windowMinutes: 30,
-    warnAt: 5,
-    blockAt: 10,
-    tools: ["WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit", "NotebookEdit"]
-  },
-  policy: { killSwitch: true, maxBlocksPerSession: 5, blockWindowMinutes: 60 },
-  budget: {
-    enabled: true,
-    plan: "tier1",
-    weekly: 0,
-    fiveHour: 0,
-    dispatchTools: ["Task", "Agent"],
-    reservePercent: 10,
-    subagentWeight: 5,
-    warnPercent: 80,
-    precise: false,
-    preciseUrl: "",
-    preciseCacheSeconds: 300
-  },
-  probe: false
-};
-var CONFIG_TEMPLATE = `# agent-guard configuration
-# Docs: https://github.com/shidesheng0218/kimi-guard
-
-[tools]                   # canonical tool-name taxonomy \u2014 if your CLI version renames tools, fix it HERE
-edit = ["WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit", "NotebookEdit"]
-read = ["ReadFile", "Read"]
-search = ["Grep", "Glob"]
-shell = ["Shell", "Bash"]
-
-[repeat]
-enabled = true
-maxRepeats = 3            # identical (tool, args) calls allowed per window
-warnAt = 2                # soft context warning before the hard block
-windowMinutes = 30
-watch = ["Grep", "Glob", "Shell", "Bash", "FetchURL", "SearchWeb", "ReadFile"]
-# exemptPatterns = ["git status"]  # regexes over JSON-serialized args; matching calls are never repeat-blocked (polling commands like git status, sleep)
-
-[repeat.thresholds]       # per-tool overrides
-ReadFile = 5
-
-[cycle]                   # A->B->A->B oscillation detection
-enabled = true
-windowMinutes = 30
-
-[noProgress]              # long stretch of calls with no successful edit
-enabled = true
-windowMinutes = 30
-warnAt = 15
-blockAt = 25
-
-[nearRepeat]              # fuzzy near-duplicates (punctuation/case/order differences)
-enabled = true
-windowMinutes = 30
-warnAt = 6
-blockAt = 10
-
-[explore]                 # pure-exploration streak: reads/searches with no action in between
-enabled = true
-windowMinutes = 30
-warnAt = 10
-blockAt = 15
-
-[verify]                  # completion-claim gate: "tests pass" must be backed by a real run
-enabled = true
-blockOnNoEvidence = false # hooks path: block Stop when edits landed but nothing was verified
-evidenceWindowMinutes = 60
-# deprecated: shell tool names now live in [tools] shell (this key still works)
-
-[verify.veto]             # optional LLM veto vote to suppress false positives (self-critic style)
-enabled = false           # requires KIMI_GUARD_VETO_API_KEY in the environment
-model = "kimi-k3"         # use a cheap fast model \u2014 the LLM only votes, never authors
-baseUrl = "https://api.moonshot.cn/v1"
-maxCallsPerSession = 3    # anti "vote-laundering" cap: the model cannot retry its way out
-timeoutMs = 10000
-
-[thinking]                # thinking-dominance (pure-reasoning turns), Wire mode only
-enabled = true
-minThinkChars = 20000
-maxTextRatio = 0.1
-
-[anchor]                  # goal anchoring: re-inject the original task periodically
-enabled = true
-everyNPrompts = 5         # re-inject the goal every N prompts / steps
-maxChars = 1000
-
-[context]                 # context-fill gate (Wire mode reads StatusUpdate.context_usage)
-enabled = true
-warnPercent = 85          # steer a wrap-up warning when context is this full
-
-[noGain]                  # different args, byte-identical output
-enabled = true
-windowMinutes = 30
-warnAt = 3
-blockAt = 4
-
-[churn]                   # same file edited over and over
-enabled = true
-windowMinutes = 30
-warnAt = 5
-blockAt = 10
-# deprecated: edit tool names now live in [tools] edit (this key still works)
-
-[policy]
-killSwitch = true         # after maxBlocksPerSession interventions, block ALL tools
-maxBlocksPerSession = 5
-blockWindowMinutes = 60
-
-[budget]                  # request accounting for Kimi Coding Plans
-enabled = true
-plan = "tier1"            # tier1: 1024/week | tier2: 2048 | tier3: 7168 (200 per 5h)
-weekly = 0                # override weekly requests (0 = use plan preset)
-fiveHour = 0              # override 5h requests (0 = use plan preset)
-dispatchTools = ["Task", "Agent"]
-reservePercent = 10       # keep this much headroom for you, not the agent
-subagentWeight = 5        # ~requests each dispatched subagent costs
-warnPercent = 80
-precise = false           # poll the official Kimi usage API for exact windows (needs KIMI_API_KEY, sk-kimi-...)
-preciseUrl = ""           # default https://api.kimi.com/coding/v1
-preciseCacheSeconds = 300 # the API is rate-limited; cache aggressively. Falls back to event-based on any error
-
-[probe]
-enabled = false
-`;
-function applyClaudeDefaults(cfg) {
-  cfg.tools = toolDefaultsFor("claude");
-  cfg.repeat.watch = ["Grep", "Glob", "Bash", "Read", "WebFetch", "WebSearch"];
-  cfg.repeat.thresholds = { Read: 5 };
-  cfg.budget.dispatchTools = ["Task"];
-}
-function num(v, fallback) {
-  return typeof v === "number" && Number.isFinite(v) ? v : fallback;
-}
-function bool(v, fallback) {
-  return typeof v === "boolean" ? v : fallback;
-}
-function strArr(v, fallback) {
-  return Array.isArray(v) && v.every((x) => typeof x === "string") && v.length > 0 ? v : fallback;
-}
-function strArrOrNull(v) {
-  return Array.isArray(v) && v.every((x) => typeof x === "string") && v.length > 0 ? v : null;
-}
-function loadConfig(configPath = userConfigPath(), harness = "kimi") {
-  const cfg = structuredClone(defaultConfig);
-  cfg.harness = harness;
-  if (harness === "claude") applyClaudeDefaults(cfg);
-  let raw;
-  try {
-    raw = fs2.readFileSync(configPath, "utf8");
-  } catch {
-    return cfg;
-  }
-  let data;
-  try {
-    data = parseToml(raw);
-  } catch (err) {
-    process.stderr.write(`[agent-guard] failed to parse ${configPath}: ${err.message}
-`);
-    return cfg;
-  }
-  const section = (name) => data[name] ?? {};
-  const tools = section("tools");
-  const toolsEdit = strArrOrNull(tools["edit"]);
-  const toolsRead = strArrOrNull(tools["read"]);
-  const toolsSearch = strArrOrNull(tools["search"]);
-  const toolsShell = strArrOrNull(tools["shell"]);
-  if (toolsEdit) cfg.tools.edit = toolsEdit;
-  if (toolsRead) cfg.tools.read = toolsRead;
-  if (toolsSearch) cfg.tools.search = toolsSearch;
-  if (toolsShell) cfg.tools.shell = toolsShell;
-  const repeat = section("repeat");
-  cfg.repeat.enabled = bool(repeat["enabled"], cfg.repeat.enabled);
-  cfg.repeat.maxRepeats = num(repeat["maxRepeats"], cfg.repeat.maxRepeats);
-  cfg.repeat.warnAt = num(repeat["warnAt"], cfg.repeat.warnAt);
-  cfg.repeat.windowMinutes = num(repeat["windowMinutes"], cfg.repeat.windowMinutes);
-  cfg.repeat.watch = strArr(repeat["watch"], cfg.repeat.watch);
-  const exempt = repeat["exemptPatterns"];
-  if (Array.isArray(exempt)) cfg.repeat.exemptPatterns = exempt.filter((p) => typeof p === "string");
-  const th = repeat["thresholds"];
-  if (th) {
-    for (const [k, v] of Object.entries(th)) if (typeof v === "number") cfg.repeat.thresholds[k] = v;
-  }
-  const cycle = section("cycle");
-  cfg.cycle.enabled = bool(cycle["enabled"], cfg.cycle.enabled);
-  cfg.cycle.windowMinutes = num(cycle["windowMinutes"], cfg.cycle.windowMinutes);
-  const noProgress = section("noProgress");
-  cfg.noProgress.enabled = bool(noProgress["enabled"], cfg.noProgress.enabled);
-  cfg.noProgress.windowMinutes = num(noProgress["windowMinutes"], cfg.noProgress.windowMinutes);
-  cfg.noProgress.warnAt = num(noProgress["warnAt"], cfg.noProgress.warnAt);
-  cfg.noProgress.blockAt = num(noProgress["blockAt"], cfg.noProgress.blockAt);
-  const nearRepeat = section("nearRepeat");
-  cfg.nearRepeat.enabled = bool(nearRepeat["enabled"], cfg.nearRepeat.enabled);
-  cfg.nearRepeat.windowMinutes = num(nearRepeat["windowMinutes"], cfg.nearRepeat.windowMinutes);
-  cfg.nearRepeat.warnAt = num(nearRepeat["warnAt"], cfg.nearRepeat.warnAt);
-  cfg.nearRepeat.blockAt = num(nearRepeat["blockAt"], cfg.nearRepeat.blockAt);
-  const explore = section("explore");
-  cfg.explore.enabled = bool(explore["enabled"], cfg.explore.enabled);
-  cfg.explore.windowMinutes = num(explore["windowMinutes"], cfg.explore.windowMinutes);
-  cfg.explore.warnAt = num(explore["warnAt"], cfg.explore.warnAt);
-  cfg.explore.blockAt = num(explore["blockAt"], cfg.explore.blockAt);
-  const verify = section("verify");
-  cfg.verify.enabled = bool(verify["enabled"], cfg.verify.enabled);
-  cfg.verify.blockOnNoEvidence = bool(verify["blockOnNoEvidence"], cfg.verify.blockOnNoEvidence);
-  cfg.verify.evidenceWindowMinutes = num(verify["evidenceWindowMinutes"], cfg.verify.evidenceWindowMinutes);
-  const claims = verify["claimPatterns"];
-  if (Array.isArray(claims)) cfg.verify.claimPatterns = claims.filter((c) => typeof c === "string");
-  const evidence = verify["evidencePatterns"];
-  if (Array.isArray(evidence)) cfg.verify.evidencePatterns = evidence.filter((c) => typeof c === "string");
-  cfg.verify.shellTools = strArr(verify["shellTools"], cfg.verify.shellTools);
-  const legacyShellTools = strArrOrNull(verify["shellTools"]);
-  if (legacyShellTools && !toolsShell) cfg.tools.shell = legacyShellTools;
-  const veto = verify["veto"];
-  if (veto) {
-    cfg.verify.veto.enabled = bool(veto["enabled"], cfg.verify.veto.enabled);
-    cfg.verify.veto.model = typeof veto["model"] === "string" ? veto["model"] : cfg.verify.veto.model;
-    cfg.verify.veto.baseUrl = typeof veto["baseUrl"] === "string" ? veto["baseUrl"] : cfg.verify.veto.baseUrl;
-    cfg.verify.veto.maxCallsPerSession = num(veto["maxCallsPerSession"], cfg.verify.veto.maxCallsPerSession);
-    cfg.verify.veto.timeoutMs = num(veto["timeoutMs"], cfg.verify.veto.timeoutMs);
-  }
-  const thinking = section("thinking");
-  cfg.thinking.enabled = bool(thinking["enabled"], cfg.thinking.enabled);
-  cfg.thinking.minThinkChars = num(thinking["minThinkChars"], cfg.thinking.minThinkChars);
-  cfg.thinking.maxTextRatio = num(thinking["maxTextRatio"], cfg.thinking.maxTextRatio);
-  const anchor = section("anchor");
-  cfg.anchor.enabled = bool(anchor["enabled"], cfg.anchor.enabled);
-  cfg.anchor.everyNPrompts = num(anchor["everyNPrompts"], cfg.anchor.everyNPrompts);
-  cfg.anchor.maxChars = num(anchor["maxChars"], cfg.anchor.maxChars);
-  const context = section("context");
-  cfg.context.enabled = bool(context["enabled"], cfg.context.enabled);
-  cfg.context.warnPercent = num(context["warnPercent"], cfg.context.warnPercent);
-  const noGain = section("noGain");
-  cfg.noGain.enabled = bool(noGain["enabled"], cfg.noGain.enabled);
-  cfg.noGain.windowMinutes = num(noGain["windowMinutes"], cfg.noGain.windowMinutes);
-  cfg.noGain.warnAt = num(noGain["warnAt"], cfg.noGain.warnAt);
-  cfg.noGain.blockAt = num(noGain["blockAt"], cfg.noGain.blockAt);
-  const churn = section("churn");
-  cfg.churn.enabled = bool(churn["enabled"], cfg.churn.enabled);
-  cfg.churn.windowMinutes = num(churn["windowMinutes"], cfg.churn.windowMinutes);
-  cfg.churn.warnAt = num(churn["warnAt"], cfg.churn.warnAt);
-  cfg.churn.blockAt = num(churn["blockAt"], cfg.churn.blockAt);
-  cfg.churn.tools = strArr(churn["tools"], cfg.churn.tools);
-  const legacyChurnTools = strArrOrNull(churn["tools"]);
-  if (legacyChurnTools && !toolsEdit) cfg.tools.edit = legacyChurnTools;
-  const policy = section("policy");
-  cfg.policy.killSwitch = bool(policy["killSwitch"], cfg.policy.killSwitch);
-  cfg.policy.maxBlocksPerSession = num(policy["maxBlocksPerSession"], cfg.policy.maxBlocksPerSession);
-  cfg.policy.blockWindowMinutes = num(policy["blockWindowMinutes"], cfg.policy.blockWindowMinutes);
-  const budget = section("budget");
-  cfg.budget.enabled = bool(budget["enabled"], cfg.budget.enabled);
-  cfg.budget.plan = typeof budget["plan"] === "string" ? budget["plan"] : cfg.budget.plan;
-  cfg.budget.weekly = num(budget["weekly"], cfg.budget.weekly);
-  cfg.budget.fiveHour = num(budget["fiveHour"], cfg.budget.fiveHour);
-  cfg.budget.dispatchTools = strArr(budget["dispatchTools"], cfg.budget.dispatchTools);
-  cfg.budget.reservePercent = num(budget["reservePercent"], cfg.budget.reservePercent);
-  cfg.budget.subagentWeight = num(budget["subagentWeight"], cfg.budget.subagentWeight);
-  cfg.budget.warnPercent = num(budget["warnPercent"], cfg.budget.warnPercent);
-  cfg.budget.precise = bool(budget["precise"], cfg.budget.precise);
-  cfg.budget.preciseUrl = typeof budget["preciseUrl"] === "string" ? budget["preciseUrl"] : cfg.budget.preciseUrl;
-  cfg.budget.preciseCacheSeconds = num(budget["preciseCacheSeconds"], cfg.budget.preciseCacheSeconds);
-  cfg.probe = bool(section("probe")["enabled"], cfg.probe);
-  cfg.verify.shellTools = cfg.tools.shell;
-  cfg.churn.tools = cfg.tools.edit;
-  return cfg;
-}
-function writeConfigTemplate(configPath = userConfigPath()) {
-  if (fs2.existsSync(configPath)) return false;
-  fs2.mkdirSync(configPath.replace(/[/\\][^/\\]+$/, ""), { recursive: true });
-  fs2.writeFileSync(configPath, CONFIG_TEMPLATE, "utf8");
-  return true;
-}
-
-// src/installer.ts
-import fs3 from "fs";
-import path2 from "path";
 var MANAGED_BEGIN = "# >>> kimi-guard managed >>> DO NOT EDIT";
 var MANAGED_END = "# <<< kimi-guard <<<";
 function hookRules(commandName = "kguard", compat = false) {
@@ -443,12 +105,12 @@ function findManagedBlock(text) {
 function installHooks(commandName = "kguard", compat = false) {
   const { path: configPath, exists } = detectKimiConfig();
   const created = !exists;
-  let text = exists ? fs3.readFileSync(configPath, "utf8") : "";
+  let text = exists ? fs.readFileSync(configPath, "utf8") : "";
   const block = findManagedBlock(text);
   const replaced = block !== void 0;
   if (exists && !replaced) {
     const backupPath = `${configPath}.kimi-guard.bak`;
-    fs3.writeFileSync(backupPath, text, "utf8");
+    fs.writeFileSync(backupPath, text, "utf8");
   }
   const newBlock = managedBlock(commandName, compat);
   if (block) {
@@ -457,8 +119,8 @@ function installHooks(commandName = "kguard", compat = false) {
     const prefix = text.length === 0 ? "" : text.endsWith("\n") ? "\n" : "\n\n";
     text = text + prefix + newBlock + "\n";
   }
-  fs3.mkdirSync(path2.dirname(configPath), { recursive: true });
-  fs3.writeFileSync(configPath, text, "utf8");
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, text, "utf8");
   return {
     configPath,
     created,
@@ -469,71 +131,71 @@ function installHooks(commandName = "kguard", compat = false) {
 function uninstallHooks() {
   const { path: configPath, exists } = detectKimiConfig();
   if (!exists) return { configPath, removed: false };
-  const text = fs3.readFileSync(configPath, "utf8");
+  const text = fs.readFileSync(configPath, "utf8");
   const block = findManagedBlock(text);
   if (!block) return { configPath, removed: false };
   let out = text.slice(0, block.start) + text.slice(block.end);
   out = out.replace(/^\n{2,}/, "\n");
-  fs3.writeFileSync(configPath, out, "utf8");
+  fs.writeFileSync(configPath, out, "utf8");
   return { configPath, removed: true };
 }
 function hooksInstalled(configPath) {
   const p = configPath ?? detectKimiConfig().path;
   try {
-    return fs3.readFileSync(p, "utf8").includes(MANAGED_BEGIN);
+    return fs.readFileSync(p, "utf8").includes(MANAGED_BEGIN);
   } catch {
     return false;
   }
 }
 
-// src/harness/claude.ts
-import fs4 from "fs";
-import path3 from "path";
-var CLAUDE_COMMAND_MARKER = "agentguard hook";
-var CLAUDE_EVENTS = [
+// src/harness/codex.ts
+import fs2 from "fs";
+import path2 from "path";
+var CODEX_COMMAND_MARKER = "agentguard hook";
+var CODEX_EVENTS = [
   "PreToolUse",
   "PostToolUse",
-  "PostToolUseFailure",
   "UserPromptSubmit",
   "Stop",
   "SubagentStart",
+  "SubagentStop",
   "SessionStart",
   "SessionEnd",
   "PreCompact",
   "PostCompact",
-  "StopFailure"
+  "Interrupt"
 ];
-var CLAUDE_EVENTS_COMPAT = ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
+var CODEX_EVENTS_COMPAT = ["PreToolUse", "PostToolUse"];
 function isOurs(group) {
-  return (group.hooks ?? []).some((h) => typeof h.command === "string" && h.command.includes(CLAUDE_COMMAND_MARKER));
+  return (group.hooks ?? []).some((h) => typeof h.command === "string" && h.command.includes(CODEX_COMMAND_MARKER));
 }
 function ourGroup(event, bin) {
   return {
     matcher: "",
-    hooks: [{ type: "command", command: `${bin} hook ${event} --harness claude`, timeout: 5 }]
+    hooks: [{ type: "command", command: `${bin} hook ${event} --harness codex`, timeout: 5 }]
   };
 }
-function installClaudeHooks(bin = "agentguard", compat = false) {
-  const configPath = claudeSettingsPath();
-  const created = !fs4.existsSync(configPath);
-  let settings = {};
+function installCodexHooks(bin = "agentguard", compat = false) {
+  const configPath = codexHooksPath();
+  const created = !fs2.existsSync(configPath);
+  let file = {};
   let backupPath;
   if (!created) {
-    const raw = fs4.readFileSync(configPath, "utf8");
+    const raw = fs2.readFileSync(configPath, "utf8");
     try {
-      settings = JSON.parse(raw);
+      file = JSON.parse(raw);
     } catch {
       backupPath = `${configPath}.agentguard.bak`;
-      fs4.copyFileSync(configPath, backupPath);
-      settings = {};
+      fs2.copyFileSync(configPath, backupPath);
+      file = {};
     }
     if (!backupPath) {
       backupPath = `${configPath}.agentguard.bak`;
-      fs4.writeFileSync(backupPath, raw, "utf8");
+      fs2.writeFileSync(backupPath, raw, "utf8");
     }
   }
-  const events = compat ? CLAUDE_EVENTS_COMPAT : CLAUDE_EVENTS;
-  const hooks = settings.hooks ??= {};
+  const events = compat ? CODEX_EVENTS_COMPAT : CODEX_EVENTS;
+  const hooks = file.hooks ??= {};
   let updated = false;
   for (const event of events) {
     const groups = (hooks[event] ?? []).filter((g) => !isOurs(g));
@@ -542,20 +204,20 @@ function installClaudeHooks(bin = "agentguard", compat = false) {
     hooks[event] = groups;
     if (JSON.stringify(groups) !== before) updated = true;
   }
-  fs4.mkdirSync(path3.dirname(configPath), { recursive: true });
-  fs4.writeFileSync(configPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  fs2.mkdirSync(path2.dirname(configPath), { recursive: true });
+  fs2.writeFileSync(configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   return { configPath, created, updated: updated || created, backupPath: created ? void 0 : backupPath };
 }
-function uninstallClaudeHooks() {
-  const configPath = claudeSettingsPath();
-  if (!fs4.existsSync(configPath)) return { configPath, removed: false };
-  let settings;
+function uninstallCodexHooks() {
+  const configPath = codexHooksPath();
+  if (!fs2.existsSync(configPath)) return { configPath, removed: false };
+  let file;
   try {
-    settings = JSON.parse(fs4.readFileSync(configPath, "utf8"));
+    file = JSON.parse(fs2.readFileSync(configPath, "utf8"));
   } catch {
     return { configPath, removed: false };
   }
-  const hooks = settings.hooks;
+  const hooks = file.hooks;
   if (!hooks) return { configPath, removed: false };
   let removed = false;
   for (const event of Object.keys(hooks)) {
@@ -564,565 +226,20 @@ function uninstallClaudeHooks() {
     if (kept.length === 0) delete hooks[event];
     else hooks[event] = kept;
   }
-  if (removed) fs4.writeFileSync(configPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  if (removed) fs2.writeFileSync(configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   return { configPath, removed };
 }
-function claudeHooksInstalled(configPath = claudeSettingsPath()) {
+function codexHooksInstalled(configPath = codexHooksPath()) {
   try {
-    const settings = JSON.parse(fs4.readFileSync(configPath, "utf8"));
-    return Object.values(settings.hooks ?? {}).some((groups) => groups.some(isOurs));
+    const file = JSON.parse(fs2.readFileSync(configPath, "utf8"));
+    return Object.values(file.hooks ?? {}).some((groups) => groups.some(isOurs));
   } catch {
     return false;
   }
 }
 
 // src/guard.ts
-import fs7 from "fs";
-
-// src/store.ts
-import fs5 from "fs";
-import path4 from "path";
-import { createRequire as createRequire2 } from "module";
-var nodeRequire = createRequire2(import.meta.url);
-function sqliteCtor() {
-  return nodeRequire("node:sqlite").DatabaseSync;
-}
-var SCHEMA_VERSION = 3;
-var SCHEMA = `
-CREATE TABLE IF NOT EXISTS calls (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  session_id TEXT NOT NULL,
-  tool_name TEXT NOT NULL,
-  args_hash TEXT NOT NULL,
-  args_json TEXT NOT NULL,
-  output_hash TEXT,
-  file_path TEXT,
-  status TEXT NOT NULL,
-  ts INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_calls_session ON calls(session_id, ts);
-CREATE INDEX IF NOT EXISTS idx_calls_sig ON calls(session_id, tool_name, args_hash, ts);
-CREATE INDEX IF NOT EXISTS idx_calls_out ON calls(session_id, tool_name, output_hash, ts);
-CREATE INDEX IF NOT EXISTS idx_calls_time ON calls(ts);
-CREATE TABLE IF NOT EXISTS events (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  session_id TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  meta_json TEXT NOT NULL,
-  ts INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_events_kind ON events(session_id, kind, ts);
-CREATE INDEX IF NOT EXISTS idx_events_time ON events(ts);
-CREATE TABLE IF NOT EXISTS blocks (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  session_id TEXT NOT NULL,
-  tool_name TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  ts INTEGER NOT NULL,
-  feedback TEXT
-);
-CREATE INDEX IF NOT EXISTS idx_blocks_session ON blocks(session_id, ts);
-CREATE TABLE IF NOT EXISTS meta (
-  k TEXT PRIMARY KEY,
-  v TEXT NOT NULL
-);
-`;
-var db = null;
-function openDb() {
-  if (db) return db;
-  const file = stateDbPath();
-  fs5.mkdirSync(path4.dirname(file), { recursive: true });
-  const d = new (sqliteCtor())(file);
-  d.exec("PRAGMA journal_mode = WAL;");
-  migrate(d);
-  db = d;
-  return db;
-}
-function migrate(d) {
-  d.exec("CREATE TABLE IF NOT EXISTS meta (k TEXT PRIMARY KEY, v TEXT NOT NULL);");
-  const row = d.prepare("SELECT v FROM meta WHERE k = 'schema_version'").get();
-  const version2 = row ? Number(row.v) : 0;
-  if (version2 === SCHEMA_VERSION) {
-    d.exec(SCHEMA);
-    return;
-  }
-  if (version2 === 2) {
-    d.exec(SCHEMA);
-    try {
-      d.exec("ALTER TABLE blocks ADD COLUMN feedback TEXT");
-    } catch {
-    }
-  } else {
-    d.exec("DROP TABLE IF EXISTS calls; DROP TABLE IF EXISTS events; DROP TABLE IF EXISTS blocks;");
-    d.exec(SCHEMA);
-  }
-  d.prepare(
-    "INSERT INTO meta (k, v) VALUES ('schema_version', ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v"
-  ).run(String(SCHEMA_VERSION));
-}
-function recordCall(call) {
-  openDb().prepare(
-    "INSERT INTO calls (session_id, tool_name, args_hash, args_json, output_hash, file_path, status, ts) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
-  ).run(
-    call.sessionId,
-    call.toolName,
-    call.argsHash,
-    call.argsJson,
-    call.outputHash,
-    call.filePath,
-    call.status,
-    call.ts ?? Date.now()
-  );
-}
-function callsSince(sessionId, sinceTs, limit = 500) {
-  return openDb().prepare(
-    "SELECT tool_name, args_hash, args_json, output_hash, file_path, status, ts FROM calls WHERE session_id = ? AND ts >= ? ORDER BY ts ASC LIMIT ?"
-  ).all(sessionId, sinceTs, limit);
-}
-function recordEvent(sessionId, kind, meta, ts = Date.now()) {
-  openDb().prepare("INSERT INTO events (session_id, kind, meta_json, ts) VALUES (?, ?, ?, ?)").run(sessionId, kind, JSON.stringify(meta), ts);
-}
-function countEvents(sessionId, kinds, sinceTs) {
-  const placeholders = kinds.map(() => "?").join(",");
-  const row = openDb().prepare(
-    `SELECT COUNT(*) AS n FROM events WHERE session_id = ? AND kind IN (${placeholders}) AND ts >= ?`
-  ).get(sessionId, ...kinds, sinceTs);
-  return Number(row?.n ?? 0);
-}
-function oldestEventTs(sessionId, kinds, sinceTs) {
-  const placeholders = kinds.map(() => "?").join(",");
-  const row = openDb().prepare(
-    `SELECT MIN(ts) AS m FROM events WHERE session_id = ? AND kind IN (${placeholders}) AND ts >= ?`
-  ).get(sessionId, ...kinds, sinceTs);
-  return row?.m ?? null;
-}
-function recordBlock(sessionId, toolName, kind, ts = Date.now()) {
-  const info = openDb().prepare("INSERT INTO blocks (session_id, tool_name, kind, ts) VALUES (?, ?, ?, ?)").run(sessionId, toolName, kind, ts);
-  return Number(info.lastInsertRowid);
-}
-function listBlocks(limit = 20) {
-  return openDb().prepare("SELECT id, session_id, tool_name, kind, ts, feedback FROM blocks ORDER BY id DESC LIMIT ?").all(limit);
-}
-function setBlockFeedback(id, verdict) {
-  const info = openDb().prepare("UPDATE blocks SET feedback = ? WHERE id = ?").run(verdict, id);
-  return Number(info.changes) > 0;
-}
-function blockKindStats() {
-  const rows = openDb().prepare(
-    `SELECT kind, COUNT(*) AS n,
-              SUM(CASE WHEN feedback = 'fp' THEN 1 ELSE 0 END) AS fp,
-              SUM(CASE WHEN feedback = 'tp' THEN 1 ELSE 0 END) AS tp
-       FROM blocks GROUP BY kind ORDER BY n DESC`
-  ).all();
-  return rows.map((r) => ({ kind: r.kind, n: Number(r.n), fp: Number(r.fp), tp: Number(r.tp) }));
-}
-function countBlocks(sessionId, sinceTs) {
-  const row = openDb().prepare("SELECT COUNT(*) AS n FROM blocks WHERE session_id = ? AND ts >= ?").get(sessionId, sinceTs);
-  return Number(row?.n ?? 0);
-}
-function getMeta(key) {
-  const row = openDb().prepare("SELECT v FROM meta WHERE k = ?").get(key);
-  return row?.v;
-}
-function setMeta(key, value) {
-  openDb().prepare("INSERT INTO meta (k, v) VALUES (?, ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v").run(key, value);
-}
-function knownSessions(limit = 5) {
-  return openDb().prepare(
-    `SELECT session_id, MAX(last_ts) AS last_ts, SUM(n) AS n FROM (
-         SELECT session_id, MAX(ts) AS last_ts, COUNT(*) AS n FROM calls GROUP BY session_id
-         UNION ALL
-         SELECT session_id, MAX(ts) AS last_ts, COUNT(*) AS n FROM events GROUP BY session_id
-       ) GROUP BY session_id ORDER BY last_ts DESC LIMIT ?`
-  ).all(limit);
-}
-function buildStatus() {
-  const d = openDb();
-  const now = Date.now();
-  const day = now - 864e5;
-  const calls24h = Number(d.prepare("SELECT COUNT(*) AS n FROM calls WHERE ts >= ?").get(day).n);
-  const blocks24h = d.prepare("SELECT kind, COUNT(*) AS n FROM blocks WHERE ts >= ? GROUP BY kind").all(day).map((r) => ({ kind: r.kind, n: Number(r.n) }));
-  const topRepeated = d.prepare(
-    "SELECT tool_name, args_hash, COUNT(*) AS n FROM calls WHERE ts >= ? GROUP BY session_id, tool_name, args_hash ORDER BY n DESC LIMIT 5"
-  ).all(day).map((r) => ({ tool_name: r.tool_name, args_hash: r.args_hash, n: Number(r.n) }));
-  const noGainPairs = d.prepare(
-    "SELECT tool_name, COUNT(DISTINCT session_id || ':' || output_hash) AS n FROM calls WHERE ts >= ? AND output_hash IS NOT NULL GROUP BY tool_name ORDER BY n DESC LIMIT 5"
-  ).all(day).map((r) => ({ tool_name: r.tool_name, n: Number(r.n) }));
-  const events24h = d.prepare("SELECT kind, COUNT(*) AS n FROM events WHERE ts >= ? GROUP BY kind").all(day).map((r) => ({ kind: r.kind, n: Number(r.n) }));
-  const lastActivity = d.prepare("SELECT MAX(m) AS m FROM (SELECT MAX(ts) AS m FROM calls UNION ALL SELECT MAX(ts) AS m FROM events)").get();
-  return {
-    calls24h,
-    blocks24h,
-    topRepeated,
-    noGainPairs,
-    events24h,
-    lastActivityTs: lastActivity?.m ?? null
-  };
-}
-
-// src/events.ts
-import { createHash } from "crypto";
-function pickString(payload, keys) {
-  for (const k of keys) {
-    const v = payload[k];
-    if (typeof v === "string" && v) return v;
-  }
-  return "";
-}
-function pickField(payload, keys) {
-  for (const k of keys) {
-    if (payload[k] !== void 0) return payload[k];
-  }
-  return void 0;
-}
-function collapseWs(s) {
-  return s.replace(/\s+/g, " ").trim();
-}
-function sortDeep(value, collapseStrings) {
-  if (Array.isArray(value)) return value.map((x) => sortDeep(x, collapseStrings));
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const k of Object.keys(value).sort()) {
-      out[k] = sortDeep(value[k], collapseStrings);
-    }
-    return out;
-  }
-  if (value === void 0) return null;
-  if (typeof value === "string") return collapseStrings ? collapseWs(value) : value;
-  return value;
-}
-var WHITESPACE_SENSITIVE = /* @__PURE__ */ new Set(["Shell", "Bash", "Grep", "Glob", "FetchURL", "SearchWeb", "ReadFile", "WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit"]);
-function fingerprint(tool, args) {
-  let v = args ?? {};
-  if (v === null || typeof v !== "object") v = { value: v ?? null };
-  const normalized = sortDeep(v, !WHITESPACE_SENSITIVE.has(tool));
-  return createHash("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 16);
-}
-function hashOutput(output) {
-  if (output === void 0 || output === null) return null;
-  let s;
-  if (typeof output === "string") s = output;
-  else {
-    try {
-      s = JSON.stringify(sortDeep(output, false));
-    } catch {
-      s = String(output);
-    }
-  }
-  s = collapseWs(s).slice(0, 4096);
-  if (!s) return null;
-  return createHash("sha256").update(s).digest("hex").slice(0, 16);
-}
-var FILE_KEYS = ["file_path", "filePath", "path", "file", "filename", "notebook_path", "target"];
-function extractFile(args) {
-  if (args === null || typeof args !== "object") return null;
-  const obj = args;
-  for (const k of FILE_KEYS) {
-    const v = obj[k];
-    if (typeof v === "string" && v) return v;
-  }
-  return null;
-}
-function normalizeCall(payload, event, ts = Date.now()) {
-  const sessionId = pickString(payload, ["session_id", "sessionId", "session", "sessionID"]) || "unknown";
-  const tool = pickString(payload, ["tool_name", "toolName", "tool"]);
-  if (!tool) return null;
-  const args = pickField(payload, ["tool_input", "toolInput", "input"]) ?? {};
-  const outputKeys = ["tool_output", "toolOutput", "tool_response", "output", "result"];
-  const output = event === "PostToolUse" ? pickField(payload, outputKeys) : event === "PostToolUseFailure" ? pickField(payload, ["error", "error_message", ...outputKeys]) : void 0;
-  const argsJson = JSON.stringify(args).slice(0, 2048);
-  return {
-    sessionId,
-    tool,
-    args,
-    argsHash: fingerprint(tool, args),
-    argsJson,
-    outputHash: output !== void 0 ? hashOutput(output) : null,
-    filePath: extractFile(args),
-    status: event === "PostToolUseFailure" ? "failure" : "ok",
-    ts
-  };
-}
-
-// src/analysis.ts
-var allow = [];
-function isRepeatExempt(proposed, cfg) {
-  if (cfg.repeat.exemptPatterns.length === 0) return false;
-  let text;
-  try {
-    text = JSON.stringify(proposed.args ?? {});
-  } catch {
-    text = String(proposed.args);
-  }
-  for (const p of cfg.repeat.exemptPatterns) {
-    try {
-      if (new RegExp(p).test(text)) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-function analyzeRepetition(history, proposed, cfg, now) {
-  if (!cfg.repeat.enabled) return allow;
-  const watched = cfg.repeat.watch.includes(proposed.tool) || proposed.tool in cfg.repeat.thresholds;
-  if (!watched) return allow;
-  if (isRepeatExempt(proposed, cfg)) return allow;
-  const threshold = cfg.repeat.thresholds[proposed.tool] ?? cfg.repeat.maxRepeats;
-  const since = now - cfg.repeat.windowMinutes * 6e4;
-  const n = history.filter(
-    (r) => r.tool_name === proposed.tool && r.args_hash === proposed.argsHash && r.ts >= since
-  ).length;
-  if (n >= threshold) {
-    return [
-      {
-        kind: "repeat",
-        severity: "block",
-        tool: proposed.tool,
-        message: `"${proposed.tool}" has already been called ${n} times with identical arguments in the last ${cfg.repeat.windowMinutes} minutes. The previous results are already in context \u2014 use them instead of re-running. If a retry is genuinely required, change the arguments or state why the previous result is insufficient.`,
-        evidence: `signature count=${n}, threshold=${threshold}`
-      }
-    ];
-  }
-  if (cfg.repeat.warnAt > 0 && n >= cfg.repeat.warnAt) {
-    return [
-      {
-        kind: "repeat",
-        severity: "warn",
-        tool: proposed.tool,
-        message: `"${proposed.tool}" has been called ${n} times with identical arguments \u2014 the result is already in context. Identical calls are blocked at ${threshold}; make sure any retry adds new information.`,
-        evidence: `signature count=${n}, warnAt=${cfg.repeat.warnAt}`
-      }
-    ];
-  }
-  return allow;
-}
-function analyzeCycles(history, cfg, now) {
-  if (!cfg.cycle.enabled) return allow;
-  const since = now - cfg.cycle.windowMinutes * 6e4;
-  const recent = history.filter((r) => r.ts >= since).slice(-16).map((r) => `${r.tool_name}:${r.args_hash}`);
-  if (recent.length < 8) return allow;
-  const findings = [];
-  for (let period = 1; period <= 3; period++) {
-    const minReps = period === 1 ? 5 : 3;
-    const needed = period * minReps;
-    const tail = recent.slice(-needed);
-    if (tail.length < needed) continue;
-    const base = tail.slice(0, period);
-    let isCycle = true;
-    for (let i = period; i < tail.length; i++) {
-      if (tail[i] !== base[i % period]) {
-        isCycle = false;
-        break;
-      }
-    }
-    if (isCycle) {
-      const desc = period === 1 ? `the same call (${base[0]})` : `a ${period}-step cycle (${base.map((s) => s.split(":")[0]).join(" \u2192 ")})`;
-      findings.push({
-        kind: "cycle",
-        severity: "block",
-        tool: base[0]?.split(":")[0],
-        message: `Loop detected: the agent has repeated ${desc} ${minReps}+ times in a row without progress. Stop re-running this sequence. Re-read the results already in context, reassess the approach, and either proceed differently or end the turn with a summary.`,
-        evidence: `period=${period}, reps>=${minReps}`
-      });
-      break;
-    }
-  }
-  return findings;
-}
-function analyzeNoGain(history, cfg, now) {
-  if (!cfg.noGain.enabled) return allow;
-  const since = now - cfg.noGain.windowMinutes * 6e4;
-  const byPair = /* @__PURE__ */ new Map();
-  for (const r of history) {
-    if (r.ts < since || !r.output_hash) continue;
-    const key = `${r.tool_name}:${r.output_hash}`;
-    byPair.set(key, (byPair.get(key) ?? 0) + 1);
-  }
-  const findings = [];
-  for (const [key, n] of byPair) {
-    if (n < cfg.noGain.warnAt) continue;
-    const tool = key.split(":")[0];
-    if (n >= cfg.noGain.blockAt) {
-      findings.push({
-        kind: "noGain",
-        severity: "block",
-        tool,
-        message: `No-progress loop: ${tool} returned the exact same output ${n} times despite different arguments. You are not gaining new information. Stop calling ${tool}, analyze the result you already have, change strategy, or report your findings.`,
-        evidence: `tool=${tool} identical_output_count=${n}`
-      });
-    } else {
-      findings.push({
-        kind: "noGain",
-        severity: "warn",
-        tool,
-        message: `${tool} has returned the same output ${n} times \u2014 verify you are not repeating work.`,
-        evidence: `tool=${tool} identical_output_count=${n}`
-      });
-    }
-  }
-  return findings.slice(0, 2);
-}
-function editToolSet(cfg) {
-  return editTools(cfg);
-}
-function analyzeNoProgress(history, proposed, cfg, now) {
-  if (!cfg.noProgress.enabled) return allow;
-  if (editToolSet(cfg).has(proposed.tool)) return allow;
-  const since = now - cfg.noProgress.windowMinutes * 6e4;
-  const tools = editToolSet(cfg);
-  let lastEditTs = -1;
-  for (const r of history) {
-    if (r.ts < since) continue;
-    if (tools.has(r.tool_name) && r.status === "ok") lastEditTs = Math.max(lastEditTs, r.ts);
-  }
-  const stretch = history.filter((r) => r.ts >= since && r.ts > lastEditTs).length;
-  if (stretch < cfg.noProgress.warnAt) return allow;
-  if (stretch >= cfg.noProgress.blockAt) {
-    return [
-      {
-        kind: "noProgress",
-        severity: "block",
-        tool: proposed.tool,
-        message: `No progress: ${stretch} tool calls in the last ${cfg.noProgress.windowMinutes} minutes with no successful file edit landing. You are circling, not converging. Stop, pick the single most valuable next change, make it deliberately, or report what is blocking you.`,
-        evidence: `stretch=${stretch} warnAt=${cfg.noProgress.warnAt} blockAt=${cfg.noProgress.blockAt}`
-      }
-    ];
-  }
-  return [
-    {
-      kind: "noProgress",
-      severity: "warn",
-      tool: proposed.tool,
-      message: `${stretch} calls without a landed edit recently \u2014 make sure the next step actually produces a change.`,
-      evidence: `stretch=${stretch}`
-    }
-  ];
-}
-function analyzeChurn(history, cfg, now) {
-  if (!cfg.churn.enabled) return allow;
-  const since = now - cfg.churn.windowMinutes * 6e4;
-  const tools = editTools(cfg);
-  const byFile = /* @__PURE__ */ new Map();
-  for (const r of history) {
-    if (r.ts < since || !r.file_path || !tools.has(r.tool_name)) continue;
-    byFile.set(r.file_path, (byFile.get(r.file_path) ?? 0) + 1);
-  }
-  const findings = [];
-  for (const [file, n] of byFile) {
-    if (n >= cfg.churn.blockAt) {
-      findings.push({
-        kind: "churn",
-        severity: "block",
-        tool: "edit",
-        message: `Edit churn: ${file} has been modified ${n} times in the last ${cfg.churn.windowMinutes} minutes without converging. Stop editing. Re-read the file and the error output, form an explicit hypothesis about why previous fixes failed, then make a single deliberate change \u2014 or ask the user for help.`,
-        evidence: `file=${file} edits=${n}`
-      });
-    } else if (n >= cfg.churn.warnAt) {
-      findings.push({
-        kind: "churn",
-        severity: "warn",
-        tool: "edit",
-        message: `${file} has been edited ${n} times recently \u2014 step back and verify your approach before editing again.`,
-        evidence: `file=${file} edits=${n}`
-      });
-    }
-  }
-  return findings.sort((a, b) => a.severity === b.severity ? 0 : a.severity === "block" ? -1 : 1).slice(0, 1);
-}
-function analyzeExplore(history, proposed, cfg, now) {
-  if (!cfg.explore.enabled) return allow;
-  const passive = /* @__PURE__ */ new Set([...readTools(cfg), ...searchTools(cfg)]);
-  if (!passive.has(proposed.tool)) return allow;
-  const since = now - cfg.explore.windowMinutes * 6e4;
-  let streak = 0;
-  for (let i = history.length - 1; i >= 0; i--) {
-    const r = history[i];
-    if (r.ts < since || !passive.has(r.tool_name)) break;
-    streak++;
-  }
-  if (streak < cfg.explore.warnAt) return allow;
-  if (streak >= cfg.explore.blockAt) {
-    return [
-      {
-        kind: "explore",
-        severity: "block",
-        tool: proposed.tool,
-        message: `Exploration without implementation: ${streak} consecutive read/search calls with no action in the last ${cfg.explore.windowMinutes} minutes. You have gathered enough \u2014 pick the most valuable thing you learned and act on it (edit, run, or write). If nothing is actionable, summarize what you found and say so.`,
-        evidence: `streak=${streak} blockAt=${cfg.explore.blockAt}`
-      }
-    ];
-  }
-  return [
-    {
-      kind: "explore",
-      severity: "warn",
-      tool: proposed.tool,
-      message: `${streak} consecutive read/search calls \u2014 make sure the next step acts on what you already learned.`,
-      evidence: `streak=${streak}`
-    }
-  ];
-}
-function fuzzyKey(tool, argsJson) {
-  let text = argsJson;
-  try {
-    const obj = JSON.parse(argsJson);
-    const parts = [];
-    for (const v of Object.values(obj)) {
-      if (typeof v === "string") parts.push(v);
-      else if (v !== null && v !== void 0) parts.push(JSON.stringify(v));
-    }
-    if (parts.length > 0) text = parts.join("|");
-  } catch {
-  }
-  return `${tool}:${text.toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]/g, "")}`;
-}
-function analyzeNearRepeat(history, cfg, now = Date.now()) {
-  if (!cfg.nearRepeat.enabled) return allow;
-  const since = now - cfg.nearRepeat.windowMinutes * 6e4;
-  const byKey = /* @__PURE__ */ new Map();
-  for (const r of history) {
-    if (r.ts < since) continue;
-    const key = fuzzyKey(r.tool_name, r.args_json);
-    const cur = byKey.get(key) ?? { n: 0, tool: r.tool_name };
-    cur.n++;
-    byKey.set(key, cur);
-  }
-  const findings = [];
-  for (const [, v] of byKey) {
-    if (v.n >= cfg.nearRepeat.blockAt) {
-      findings.push({
-        kind: "nearRepeat",
-        severity: "block",
-        tool: v.tool,
-        message: `Near-duplicate loop: ${v.tool} has been called ${v.n} times with arguments that differ only trivially (punctuation, case, spacing, order). You are not trying anything new. Use the results already in context or change the approach substantially.`,
-        evidence: `fuzzy_count=${v.n} blockAt=${cfg.nearRepeat.blockAt}`
-      });
-    } else if (v.n >= cfg.nearRepeat.warnAt) {
-      findings.push({
-        kind: "nearRepeat",
-        severity: "warn",
-        tool: v.tool,
-        message: `${v.tool} has ${v.n} near-identical calls recently \u2014 verify these calls differ meaningfully.`,
-        evidence: `fuzzy_count=${v.n}`
-      });
-    }
-  }
-  return findings.sort((a, b) => a.severity === b.severity ? 0 : a.severity === "block" ? -1 : 1).slice(0, 1);
-}
-function analyzeCall(history, proposed, cfg, now = Date.now()) {
-  const findings = [
-    ...analyzeRepetition(history, proposed, cfg, now),
-    ...analyzeCycles(history, cfg, now),
-    ...analyzeNoGain(history, cfg, now),
-    ...analyzeChurn(history, cfg, now),
-    ...analyzeNoProgress(history, proposed, cfg, now),
-    ...analyzeNearRepeat(history, cfg, now),
-    ...analyzeExplore(history, proposed, cfg, now)
-  ];
-  const rank = { block: 0, warn: 1 };
-  findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
-  return { findings: findings.slice(0, 2) };
-}
+import fs3 from "fs";
 
 // src/policy.ts
 var KILL_SWITCH_MESSAGE = "[agent-guard] CIRCUIT BREAK: this session has hit the intervention limit. Stop making tool calls immediately. Do not attempt to work around this guard. Summarize what you have learned so far, state what remains blocked and why, and end your turn so the user can review the situation.";
@@ -1244,9 +361,9 @@ async function refreshPreciseUsage(cfg, env = process.env) {
   if (fresh) return fresh;
   const base = (cfg.preciseUrl || DEFAULT_URL).replace(/\/+$/, "");
   const key = env.KIMI_API_KEY.trim();
-  for (const path7 of ["/usages", "/usage"]) {
+  for (const path4 of ["/usages", "/usage"]) {
     try {
-      const res = await fetch(base + path7, {
+      const res = await fetch(base + path4, {
         headers: { Authorization: `Bearer ${key}`, "User-Agent": "KimiCLI/1.6" },
         signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
       });
@@ -1383,204 +500,6 @@ function formatSnapshot(snap) {
   ].join("\n");
 }
 
-// src/checkpoint.ts
-import fs6 from "fs";
-import path5 from "path";
-function argSummary(argsJson, max = 100) {
-  try {
-    const obj = JSON.parse(argsJson);
-    const parts = [];
-    for (const [k, v] of Object.entries(obj)) {
-      const s = typeof v === "string" ? v : JSON.stringify(v);
-      parts.push(`${k}=${s.length > 60 ? s.slice(0, 57) + "..." : s}`);
-    }
-    const joined = parts.join(", ");
-    return joined.length > max ? joined.slice(0, max - 3) + "..." : joined || "{}";
-  } catch {
-    return argsJson.slice(0, max);
-  }
-}
-function buildBrief(sessionId, now = Date.now(), windowMs = 6 * 36e5, cfg = loadConfig()) {
-  const calls = callsSince(sessionId, now - windowMs, 1e3);
-  if (calls.length === 0) return "";
-  const shells = shellTools(cfg);
-  const edits = editTools(cfg);
-  const reads = readTools(cfg);
-  const searchesSet = searchTools(cfg);
-  const files = /* @__PURE__ */ new Map();
-  const commands = [];
-  const searches = [];
-  const failures = [];
-  for (const r of calls) {
-    const summary = argSummary(r.args_json, 90);
-    if (edits.has(r.tool_name) && r.file_path) {
-      const f = files.get(r.file_path) ?? { reads: 0, edits: 0 };
-      f.edits++;
-      files.set(r.file_path, f);
-    } else if (r.file_path && reads.has(r.tool_name)) {
-      const f = files.get(r.file_path) ?? { reads: 0, edits: 0 };
-      f.reads++;
-      files.set(r.file_path, f);
-    }
-    if (shells.has(r.tool_name)) commands.push(summary);
-    if (searchesSet.has(r.tool_name)) searches.push(summary);
-    if (r.status === "failure") failures.push(`${r.tool_name}: ${summary}`);
-  }
-  const lines = [];
-  lines.push("## Observed activity (auto-captured by agent-guard)");
-  lines.push("");
-  if (files.size > 0) {
-    lines.push("### Files touched");
-    for (const [f, c] of [...files.entries()].slice(0, 25)) {
-      lines.push(`- ${f} (read \xD7${c.reads}, edited \xD7${c.edits})`);
-    }
-    lines.push("");
-  }
-  if (commands.length > 0) {
-    lines.push("### Commands run (most recent last)");
-    for (const c of commands.slice(-10)) lines.push(`- ${c}`);
-    lines.push("");
-  }
-  if (searches.length > 0) {
-    lines.push("### Searches performed (results are already known \u2014 do not redo them)");
-    const seen = /* @__PURE__ */ new Set();
-    for (const s of searches.slice(-15)) {
-      if (seen.has(s)) continue;
-      seen.add(s);
-      lines.push(`- ${s}`);
-    }
-    lines.push("");
-  }
-  if (failures.length > 0) {
-    lines.push("### Failed calls (avoid repeating these)");
-    const seen = /* @__PURE__ */ new Set();
-    for (const f of failures.slice(-8)) {
-      if (seen.has(f)) continue;
-      seen.add(f);
-      lines.push(`- ${f}`);
-    }
-    lines.push("");
-  }
-  lines.push(`Total recorded tool calls in window: ${calls.length}`);
-  return lines.join("\n");
-}
-function captureCheckpoint(sessionId, reason, now = Date.now(), cfg = loadConfig()) {
-  const brief = buildBrief(sessionId, now, 6 * 36e5, cfg);
-  if (!brief) return null;
-  const dir = path5.join(guardHome(), "checkpoints", sessionId.replace(/[^\w.-]/g, "_"));
-  fs6.mkdirSync(dir, { recursive: true });
-  const file = path5.join(dir, `${now}-${reason.replace(/[^\w-]/g, "_")}.md`);
-  const header = [
-    `# agent-guard checkpoint`,
-    ``,
-    `- session: ${sessionId}`,
-    `- time: ${new Date(now).toISOString()}`,
-    `- reason: ${reason}`,
-    ``
-  ].join("\n");
-  fs6.writeFileSync(file, header + brief + "\n", "utf8");
-  recordEvent(sessionId, "checkpoint", { reason, file }, now);
-  return { sessionId, path: file, brief, reason, ts: now };
-}
-function latestSessionId() {
-  const sessions = knownSessions(1);
-  return sessions[0]?.session_id ?? null;
-}
-function latestCheckpointFile(sessionId) {
-  const base = path5.join(guardHome(), "checkpoints");
-  if (!fs6.existsSync(base)) return null;
-  let dir = sessionId ? path5.join(base, sessionId.replace(/[^\w.-]/g, "_")) : "";
-  if (!dir || !fs6.existsSync(dir)) {
-    const dirs = fs6.readdirSync(base).map((d) => ({ d, m: fs6.statSync(path5.join(base, d)).mtimeMs })).sort((a, b) => b.m - a.m);
-    if (dirs.length === 0) return null;
-    dir = path5.join(base, dirs[0].d);
-  }
-  const files = fs6.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().reverse();
-  return files[0] ? path5.join(dir, files[0]) : null;
-}
-function renderResumeBlock(brief, reason) {
-  return [
-    `<agent-guard-resume reason="${reason}">`,
-    "You are resuming a task that was interrupted. Use the observed state below as verified",
-    "prior knowledge. Do NOT re-explore files you have already read, do NOT redo searches",
-    "listed here, and do NOT repeat failed calls. Continue from the last known state.",
-    "",
-    brief,
-    "</agent-guard-resume>"
-  ].join("\n");
-}
-
-// src/verify.ts
-var DEFAULT_CLAIM_PATTERNS = [
-  /\btests?\b.{0,40}\b(pass(?:ed|ing)?|green)\b/i,
-  /\ball\b.{0,24}\btests?\b.{0,24}\bpass/i,
-  /\bbuild\b.{0,30}\b(succeed(?:ed)?|passed|ok)\b/i,
-  /\bcompil(?:es?|ed)\b.{0,20}\bsuccessfully\b/i,
-  /\blint\b.{0,30}\b(clean|passed|no issues)\b/i,
-  /\bfixed\b.{0,40}\b(all|every)\b/i,
-  /测试(全部|都)?通过/,
-  /全部(测试)?通过/,
-  /构建成功/,
-  /编译通过/,
-  /零(错误|警告)/,
-  /问题已全部解决/
-];
-var DEFAULT_EVIDENCE_PATTERNS = [
-  /\b(test|tests|vitest|jest|mocha|pytest|cargo test|go test|make test)\b/i,
-  /\b(npm|pnpm|yarn)\s+(run\s+)?(test|check)\b/i,
-  /\b(mvn|gradle|sbt|dotnet\s+test)\b/i,
-  /\b(tsc|pyright|mypy|eslint|biome|ruff|flake8|clippy)\b/i,
-  /\b(build|compile|lint|check|verify)\b/i,
-  /\bmake\b/i
-];
-function findClaims(text, cfg) {
-  if (!text) return [];
-  const patterns = cfg.verify.claimPatterns.length > 0 ? cfg.verify.claimPatterns.map((p) => new RegExp(p)) : DEFAULT_CLAIM_PATTERNS;
-  const claims = [];
-  for (const p of patterns) {
-    const m = p.exec(text);
-    if (m) {
-      claims.push({
-        pattern: String(p),
-        snippet: text.slice(Math.max(0, (m.index ?? 0) - 40), (m.index ?? 0) + m[0].length + 40).replace(/\s+/g, " ").trim()
-      });
-    }
-    if (claims.length >= 3) break;
-  }
-  return claims;
-}
-function hasEvidence(sessionId, cfg, now = Date.now()) {
-  const vouched = getMeta(`vouched:${sessionId}`) === "1";
-  if (vouched) return true;
-  const since = now - cfg.verify.evidenceWindowMinutes * 6e4;
-  const patterns = cfg.verify.evidencePatterns.length > 0 ? cfg.verify.evidencePatterns.map((p) => new RegExp(p)) : DEFAULT_EVIDENCE_PATTERNS;
-  const shells = shellTools(cfg);
-  const calls = callsSince(sessionId, since, 400);
-  for (const r of calls) {
-    if (r.status !== "ok") continue;
-    if (!shells.has(r.tool_name)) continue;
-    try {
-      const args = JSON.parse(r.args_json);
-      const cmd = args.command ?? "";
-      for (const p of patterns) {
-        if (p.test(cmd)) return true;
-      }
-    } catch {
-      continue;
-    }
-  }
-  return false;
-}
-function hasRecentEdits(sessionId, cfg, now = Date.now()) {
-  const since = now - cfg.verify.evidenceWindowMinutes * 6e4;
-  const edits = editTools(cfg);
-  return callsSince(sessionId, since, 400).some(
-    (r) => r.status === "ok" && edits.has(r.tool_name)
-  );
-}
-var HOOKS_STOP_BLOCK_REASON = "[agent-guard] Blocked (verify): this turn ended after successful file edits with no successful verification command (test/build/lint) in the session. Run your verification before claiming completion, or state explicitly why it cannot run here.";
-var WIRE_VERIFY_CORRECTIVE = "[agent-guard verification] Your final message claims tests/build pass, but no successful verification command was recorded in this session. Actually run the verification now and base your claims on real results, then restate the conclusion.";
-
 // src/guard.ts
 function probeEnabled() {
   if (process.env.KIMI_GUARD_PROBE === "1") return true;
@@ -1592,7 +511,7 @@ function probeEnabled() {
 }
 function appendProbe(event, payload) {
   const line = JSON.stringify({ ts: Date.now(), event, payload }) + "\n";
-  fs7.appendFileSync(probeLogPath(), line, "utf8");
+  fs3.appendFileSync(probeLogPath(), line, "utf8");
 }
 async function readStdinJson() {
   const chunks = [];
@@ -1626,7 +545,7 @@ function processHookEvent(event, cfg, payload, now = Date.now()) {
     case "PostToolUseFailure":
       return handlePostTool(event, cfg, payload, sessionId, now);
     case "Stop": {
-      if (cfg.harness === "claude") recordEvent(sessionId, "turn", { origin: "stop" }, now);
+      if (cfg.harness !== "kimi") recordEvent(sessionId, "turn", { origin: "stop" }, now);
       if (!cfg.verify.enabled || !cfg.verify.blockOnNoEvidence) return { code: 0 };
       if (!hasRecentEdits(sessionId, cfg, now)) return { code: 0 };
       if (hasEvidence(sessionId, cfg, now)) return { code: 0 };
@@ -1746,6 +665,7 @@ function handlePostTool(event, cfg, payload, sessionId, now) {
     argsHash: call.argsHash,
     argsJson: call.argsJson,
     outputHash: call.outputHash,
+    outputSample: call.outputSample,
     filePath: call.filePath,
     status: call.status,
     ts: now
@@ -1755,7 +675,7 @@ function handlePostTool(event, cfg, payload, sessionId, now) {
 
 // src/hook.ts
 function encodeHint(event, harness, text) {
-  if (harness === "claude") {
+  if (harness !== "kimi") {
     return JSON.stringify({ hookSpecificOutput: { hookEventName: event, additionalContext: text } });
   }
   return text;
@@ -1781,82 +701,9 @@ async function runHook(event, harness = "kimi") {
 }
 
 // src/status.ts
-import fs8 from "fs";
+import fs4 from "fs";
 import { spawnSync } from "child_process";
 import pc from "picocolors";
-
-// src/veto.ts
-function vetoKeyConfigured(env = process.env) {
-  return Boolean(env.KIMI_GUARD_VETO_API_KEY?.trim());
-}
-function vetoBaseUrls(cfg, env = process.env) {
-  return {
-    baseUrl: env.KIMI_GUARD_VETO_BASE_URL?.trim() || cfg.baseUrl,
-    model: env.KIMI_GUARD_VETO_MODEL?.trim() || cfg.model
-  };
-}
-function collectVetoContext(sessionId, cfg, now = Date.now()) {
-  const since = now - cfg.verify.evidenceWindowMinutes * 6e4;
-  const calls = callsSince(sessionId, since, 400);
-  const shells = shellTools(cfg);
-  const recentCommands = [];
-  const editedFiles = [];
-  for (const r of calls.slice(-40)) {
-    if (shells.has(r.tool_name)) {
-      try {
-        const args = JSON.parse(r.args_json);
-        if (args.command) recentCommands.push(args.command.slice(0, 120));
-      } catch {
-      }
-    }
-    if (r.file_path && editedFiles.length < 10) editedFiles.push(r.file_path);
-  }
-  return { sessionId, claims: [], goal: "", recentCommands: recentCommands.slice(-5), editedFiles };
-}
-var PROMPT_HEADER = "You are a false-positive detector for an AI-agent guardrail. An agent just finished its turn claiming completion, but the session's recorded command history contains NO successful verification command (test/build/lint). Decide whether blocking would be a FALSE POSITIVE \u2014 i.e. the agent has a legitimate reason why verification cannot run in this session.\nRules: base your vote ONLY on the facts below. A claim that verification is unnecessary or happens elsewhere is NOT by itself a reason to veto. Answer with EXACTLY one line:\nVETO: yes  (false positive \u2014 allow the completion)\nVETO: no   (block stands \u2014 the agent must actually run verification)\nDo not write anything else.\n\nFacts:\n";
-function buildVetoPrompt(ctx) {
-  const lines = [];
-  lines.push(`- user goal: ${ctx.goal.slice(0, 300) || "(unknown)"}`);
-  lines.push(`- claims made by the agent:`);
-  for (const c of ctx.claims.slice(0, 3)) lines.push(`  "${c.snippet}"`);
-  lines.push(`- recent commands the agent ran: ${ctx.recentCommands.length > 0 ? ctx.recentCommands.join(" ; ") : "(none)"}`);
-  lines.push(`- files the agent edited: ${ctx.editedFiles.length > 0 ? ctx.editedFiles.join(", ") : "(none)"}`);
-  lines.push("- recorded successful verification commands in session history: none");
-  return PROMPT_HEADER + lines.join("\n");
-}
-async function castVetoVote(ctx, cfg, env = process.env) {
-  if (!cfg.enabled || !vetoKeyConfigured(env)) return { vetoed: false, error: "veto disabled" };
-  const calls = Number(getMeta(`veto_calls:${ctx.sessionId}`) ?? "0");
-  if (calls >= cfg.maxCallsPerSession) return { vetoed: false, error: "session vote budget exhausted" };
-  setMeta(`veto_calls:${ctx.sessionId}`, String(calls + 1));
-  const { baseUrl, model } = vetoBaseUrls(cfg, env);
-  const key = env.KIMI_GUARD_VETO_API_KEY.trim();
-  try {
-    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/chat/completions`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${key}`
-      },
-      body: JSON.stringify({
-        model,
-        messages: [{ role: "user", content: buildVetoPrompt(ctx) }],
-        max_tokens: 8,
-        temperature: 0,
-        stream: false
-      }),
-      signal: AbortSignal.timeout(cfg.timeoutMs)
-    });
-    if (!res.ok) return { vetoed: false, error: `http ${res.status}` };
-    const data = await res.json();
-    const raw = (data.choices?.[0]?.message?.content ?? "").trim();
-    return { vetoed: /^VETO:\s*yes\b/i.test(raw), raw };
-  } catch (err) {
-    return { vetoed: false, error: err.message };
-  }
-}
-
-// src/status.ts
 function ok(msg) {
   console.log(`${pc.green("\u2713")} ${msg}`);
 }
@@ -1870,6 +717,7 @@ var CALIBRATION_KEYS = {
   repeat: "repeat.maxRepeats",
   nearRepeat: "nearRepeat.blockAt",
   noGain: "noGain.blockAt",
+  noGainFuzzy: "noGain.fuzzyBlockAt",
   churn: "churn.blockAt",
   noProgress: "noProgress.blockAt",
   explore: "explore.blockAt",
@@ -1924,7 +772,7 @@ function agentProcessRunning() {
     return r.stdout.split("\n").some((line) => {
       const l = line.trim();
       if (l.includes("agentguard") || l.includes("kimi-guard") || l.includes("kguard")) return false;
-      return /(?:^|[/\s])(kimi|claude)(?:\s|$)/.test(l);
+      return /(?:^|[/\s])(kimi|claude|codex)(?:\s|$)/.test(l);
     });
   } catch {
     return false;
@@ -1993,17 +841,18 @@ function cmdDoctor() {
     `node ${process.versions.node} is too old (need >=22.13 for node:sqlite)`
   );
   try {
-    fs8.mkdirSync(guardHome(), { recursive: true });
-    fs8.accessSync(guardHome(), fs8.constants.W_OK);
+    fs4.mkdirSync(guardHome(), { recursive: true });
+    fs4.accessSync(guardHome(), fs4.constants.W_OK);
     check(true, `state dir writable: ${guardHome()}`, "");
     openDb().prepare("SELECT 1").get();
-    check(true, `state db opens (schema v2): ${stateDbPath()}`, "");
+    check(true, `state db opens: ${stateDbPath()}`, "");
   } catch (err) {
     check(false, "", `state dir/db problem: ${err.message}`);
   }
   const kimi = detectKimiConfig();
   const hasClaude = claudeDetected();
-  if (kimi.exists || !hasClaude) {
+  const hasCodex = codexDetected();
+  if (kimi.exists || !hasClaude && !hasCodex) {
     check(
       kimi.exists,
       `kimi config found: ${kimi.path}`,
@@ -2024,7 +873,16 @@ function cmdDoctor() {
   } else {
     console.log(`  ${pc.dim("-")} claude code not detected (skipped)`);
   }
-  const kimiConfigText = fs8.existsSync(kimi.path) ? fs8.readFileSync(kimi.path, "utf8") : "";
+  if (codexDetected()) {
+    check(
+      codexHooksInstalled(),
+      `[codex] hooks present in ${codexHooksPath()}`,
+      `[codex] hooks not installed \u2014 run: agentguard install --harness codex`
+    );
+  } else {
+    console.log(`  ${pc.dim("-")} codex not detected (skipped)`);
+  }
+  const kimiConfigText = fs4.existsSync(kimi.path) ? fs4.readFileSync(kimi.path, "utf8") : "";
   const hasSecurityLayer = /kimi-boost managed|destructive|secret-guard|branch-guard|block-dangerous/i.test(kimiConfigText);
   if (hasSecurityLayer) {
     ok("security-layer hooks detected (authorization axis covered)");
@@ -2038,8 +896,8 @@ function cmdDoctor() {
     "agentguard is not on PATH \u2014 hook commands will fail-open. Install globally: npm i -g @shidesheng0218/agentguard"
   );
   const probeFile = probeLogPath();
-  if (fs8.existsSync(probeFile)) {
-    const lines = fs8.readFileSync(probeFile, "utf8").trim().split("\n").filter(Boolean);
+  if (fs4.existsSync(probeFile)) {
+    const lines = fs4.readFileSync(probeFile, "utf8").trim().split("\n").filter(Boolean);
     ok(`probe log has ${lines.length} samples (${probeFile})`);
     const keys = /* @__PURE__ */ new Map();
     for (const line of lines.slice(-50)) {
@@ -2055,7 +913,7 @@ function cmdDoctor() {
   } else {
     warn("no probe samples yet \u2014 run 'kguard probe on', use Kimi Code a bit, then 'kguard doctor'");
   }
-  if (fs8.existsSync(userConfigPath())) ok(`config present: ${userConfigPath()}`);
+  if (fs4.existsSync(userConfigPath())) ok(`config present: ${userConfigPath()}`);
   else warn("no user config (defaults in effect) \u2014 run 'kguard config init' to create one");
   try {
     const normalizeMisses = Number(getMeta("normalize_misses") ?? "0");
@@ -2098,8 +956,8 @@ ${failures} check(s) failed.`);
 }
 
 // src/wire/supervisor.ts
-import fs9 from "fs";
-import path6 from "path";
+import fs5 from "fs";
+import path3 from "path";
 
 // src/wire/client.ts
 import { spawn } from "child_process";
@@ -2201,12 +1059,12 @@ var WireClient = class {
   }
   async request(method, params, timeoutMs = this.opts.requestTimeoutMs ?? 6e5) {
     const id = this.id();
-    const promise = new Promise((resolve2, reject) => {
+    const promise = new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new Error(`wire request timeout: ${method}`));
       }, timeoutMs);
-      this.pending.set(id, { resolve: resolve2, reject, timer });
+      this.pending.set(id, { resolve, reject, timer });
     });
     this.write({ jsonrpc: "2.0", method, id, params });
     return promise;
@@ -2260,12 +1118,12 @@ function addUsage(acc, u) {
 async function runSupervised(opts) {
   const cfg = opts.config ?? loadConfig();
   const runId = `run-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${process.pid}`;
-  const logDir = path6.join(guardHome(), "runs", runId);
-  fs9.mkdirSync(logDir, { recursive: true });
-  const logPath = path6.join(logDir, "wire.jsonl");
+  const logDir = path3.join(guardHome(), "runs", runId);
+  fs5.mkdirSync(logDir, { recursive: true });
+  const logPath = path3.join(logDir, "wire.jsonl");
   const rawLog = (direction, line) => {
     try {
-      fs9.appendFileSync(logPath, JSON.stringify({ dir: direction, ts: Date.now(), line }) + "\n");
+      fs5.appendFileSync(logPath, JSON.stringify({ dir: direction, ts: Date.now(), line }) + "\n");
     } catch {
     }
   };
@@ -2290,7 +1148,7 @@ async function runSupervised(opts) {
     verifyRounds: 0,
     vetoes: 0,
     thinkingDominance: 0,
-    reportPath: path6.join(logDir, "report.json"),
+    reportPath: path3.join(logDir, "report.json"),
     logPath
   };
   let steersSent = 0;
@@ -2474,7 +1332,8 @@ async function runSupervised(opts) {
       argsHash: fingerprint(call.name, call.args),
       argsJson: JSON.stringify(call.args).slice(0, 2048),
       outputHash: hashOutput(output),
-      filePath: extractFile2(call.args),
+      outputSample: outputSampleOf(output),
+      filePath: extractFile(call.args),
       status: returnValue.is_error ? "failure" : "ok"
     });
   }
@@ -2631,12 +1490,12 @@ ${brief.brief}
   report.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
   recordEvent(sessionId(), "run_end", { endReason: report.endReason, blocks: report.blocks.length });
   try {
-    fs9.writeFileSync(report.reportPath, JSON.stringify(report, null, 2), "utf8");
+    fs5.writeFileSync(report.reportPath, JSON.stringify(report, null, 2), "utf8");
   } catch {
   }
   return report;
 }
-function extractFile2(args) {
+function extractFile(args) {
   if (args === null || typeof args !== "object") return null;
   const obj = args;
   for (const k of ["file_path", "filePath", "path", "file", "filename"]) {
@@ -2670,15 +1529,17 @@ function formatReport(r) {
 // src/cli.ts
 var program = new Command();
 program.name("agentguard").description("Runtime behavior guard for coding agents (Kimi Code CLI & Claude Code): loop detection, quota gates, checkpoints").version(version, "-V, --version", "print version");
-program.command("install").description("install hook rules into detected agent CLIs (Kimi Code config.toml and/or Claude Code settings.json)").option("--compat", "legacy-safe mode: only the 3 universally supported hook events (for older kimi-cli versions)").option("--harness <name>", "kimi | claude | all (default: auto-detect installed harnesses, fallback kimi)").action((opts) => {
+program.command("install").description("install hook rules into detected agent CLIs (Kimi Code config.toml and/or Claude Code settings.json)").option("--compat", "legacy-safe mode: only the 3 universally supported hook events (for older kimi-cli versions)").option("--harness <name>", "kimi | claude | codex | all (default: auto-detect installed harnesses, fallback kimi)").action((opts) => {
   const which = opts.harness ?? "auto";
-  const doKimi = which === "kimi" || which === "all" || which === "auto";
-  const doClaude = which === "claude" || which === "all" || which === "auto" && claudeDetected();
-  if (!doKimi && !doClaude) {
+  const known = ["kimi", "claude", "codex", "all", "auto"];
+  if (!known.includes(which)) {
     console.error(`unknown harness: ${which}`);
     process.exitCode = 1;
     return;
   }
+  const doKimi = which === "kimi" || which === "all" || which === "auto";
+  const doClaude = which === "claude" || which === "all" || which === "auto" && claudeDetected();
+  const doCodex = which === "codex" || which === "all" || which === "auto" && codexDetected();
   if (doKimi) {
     const r = installHooks("agentguard", Boolean(opts.compat));
     console.log(`\u2713 [kimi] config: ${r.configPath}${r.created ? " (created)" : ""}`);
@@ -2694,9 +1555,16 @@ program.command("install").description("install hook rules into detected agent C
     if (r.backupPath) console.log(`\u2713 [claude] backup: ${r.backupPath}`);
     console.log(`\u2713 [claude] hooks ${r.updated ? "installed" : "already up to date"}${opts.compat ? " (compat)" : ""}`);
   }
+  if (doCodex) {
+    const r = installCodexHooks("agentguard", Boolean(opts.compat));
+    console.log(`\u2713 [codex] config: ${r.configPath}${r.created ? " (created)" : ""}`);
+    if (r.backupPath) console.log(`\u2713 [codex] backup: ${r.backupPath}`);
+    console.log(`\u2713 [codex] hooks ${r.updated ? "installed" : "already up to date"}${opts.compat ? " (compat)" : ""}`);
+    console.log("  note: Codex hooks cover shell/apply_patch/local function tools; hosted tools (e.g. WebSearch) are not observable.");
+  }
   console.log("  restart the agent CLI (or /reload) to take effect.");
 });
-program.command("uninstall").description("remove the managed hook entries from Kimi Code config.toml and Claude Code settings.json").option("--harness <name>", "kimi | claude | all (default: all)").action((opts) => {
+program.command("uninstall").description("remove the managed hook entries from Kimi Code config.toml and Claude Code settings.json").option("--harness <name>", "kimi | claude | codex | all (default: all)").action((opts) => {
   const which = opts.harness ?? "all";
   if (which === "kimi" || which === "all") {
     const r = uninstallHooks();
@@ -2706,9 +1574,13 @@ program.command("uninstall").description("remove the managed hook entries from K
     const r = uninstallClaudeHooks();
     console.log(r.removed ? `\u2713 [claude] removed hooks from ${r.configPath}` : `[claude] no managed hooks found in ${r.configPath}`);
   }
+  if (which === "codex" || which === "all") {
+    const r = uninstallCodexHooks();
+    console.log(r.removed ? `\u2713 [codex] removed hooks from ${r.configPath}` : `[codex] no managed hooks found in ${r.configPath}`);
+  }
 });
-program.command("hook").argument("<event>", "hook event name, e.g. PreToolUse").description("hook entrypoint invoked by the agent CLI (reads JSON payload from stdin)").option("--harness <name>", "kimi | claude (default: kimi)", "kimi").action(async (event, opts) => {
-  const harness = opts.harness === "claude" ? "claude" : "kimi";
+program.command("hook").argument("<event>", "hook event name, e.g. PreToolUse").description("hook entrypoint invoked by the agent CLI (reads JSON payload from stdin)").option("--harness <name>", "kimi | claude | codex (default: kimi)", "kimi").action(async (event, opts) => {
+  const harness = opts.harness === "claude" ? "claude" : opts.harness === "codex" ? "codex" : "kimi";
   process.exitCode = await runHook(event, harness);
 });
 program.command("status").description("guard activity: calls, interventions, sessions, budget windows").action(() => cmdStatus());
@@ -2745,11 +1617,11 @@ program.command("checkpoint").description("capture a research-state checkpoint f
 });
 program.command("resume").description("print a paste-ready context block built from the latest checkpoint").option("-f, --file <path>", "use a specific checkpoint file (defaults to the latest)").action((opts) => {
   const file = opts.file ?? latestCheckpointFile();
-  if (!file || !fs10.existsSync(file)) {
+  if (!file || !fs6.existsSync(file)) {
     console.log("no checkpoints found \u2014 run 'kguard checkpoint' first");
     return;
   }
-  const content = fs10.readFileSync(file, "utf8");
+  const content = fs6.readFileSync(file, "utf8");
   const reason = /- reason: (.*)/.exec(content)?.[1] ?? "interrupted";
   const idx = content.indexOf("## Observed activity");
   const brief = idx >= 0 ? content.slice(idx) : content;
@@ -2806,11 +1678,11 @@ probe.command("off").action(() => {
   console.log("\u2713 probe off");
 });
 probe.command("show").option("-n, --last <n>", "how many samples to show", "10").action((opts) => {
-  if (!fs10.existsSync(probeLogPath())) {
+  if (!fs6.existsSync(probeLogPath())) {
     console.log("no probe samples yet \u2014 run 'kguard probe on' first");
     return;
   }
-  const lines = fs10.readFileSync(probeLogPath(), "utf8").trim().split("\n").filter(Boolean);
+  const lines = fs6.readFileSync(probeLogPath(), "utf8").trim().split("\n").filter(Boolean);
   for (const line of lines.slice(-Number(opts.last))) console.log(line);
 });
 var cfgCmd = program.command("config").description("manage the guard config.toml");
@@ -2828,12 +1700,29 @@ cfgCmd.command("get <key>").description("print one effective value, e.g. budget.
   const value = key.split(".").reduce((acc, k) => acc && typeof acc === "object" ? acc[k] : void 0, cfg);
   console.log(value === void 0 ? `<unset: ${key}>` : typeof value === "object" ? JSON.stringify(value) : String(value));
 });
-program.command("run").description("supervised headless run: spawns the agent in Wire mode, enforces loop guards, meters tokens, auto-checkpoints").argument("[prompt...]", "task prompt (or use --prompt)").option("-p, --prompt <text>", "task prompt").option("-e, --exec <command...>", "agent command to supervise (default: kimi --wire)").option("--max-steps <n>", "hard step cap (per turn)", "200").option("--max-minutes <n>", "hard wall-clock cap for the whole run", "30").option("--auto-resume <n>", "re-prompt with checkpoint brief after max_steps/kill-switch", "0").option("--max-verify-rounds <n>", "corrective rounds when the final message makes unbacked completion claims", "2").option("--no-steer", "disable soft mid-turn corrections").option("--max-steers <n>", "cap on steer injections", "5").option("--yolo", "auto-approve every approval request").option("--json", "print machine-readable report JSON").action(async (promptParts, opts) => {
+program.command("run").description("supervised headless run: loop guards, token metering, auto-checkpoints. Kimi: Wire protocol (in-process steer); Claude Code: claude -p stream-json supervision").argument("[prompt...]", "task prompt (or use --prompt)").option("-p, --prompt <text>", "task prompt").option("-e, --exec <command...>", "agent command to supervise (default: kimi --wire / claude)").option("--harness <name>", "kimi | claude (default: kimi; claude uses claude -p stream-json)").option("--max-steps <n>", "hard step cap (per turn)", "200").option("--max-minutes <n>", "hard wall-clock cap for the whole run", "30").option("--auto-resume <n>", "re-prompt with checkpoint brief after max_steps/kill-switch", "0").option("--max-verify-rounds <n>", "corrective rounds when the final message makes unbacked completion claims", "2").option("--no-steer", "disable soft mid-turn corrections").option("--max-steers <n>", "cap on steer injections", "5").option("--yolo", "auto-approve every approval request").option("--json", "print machine-readable report JSON").action(async (promptParts, opts) => {
   const prompt = opts.prompt ?? promptParts.join(" ");
   if (!prompt.trim()) {
     console.error("error: a prompt is required (argument or --prompt)");
     process.exit(1);
   }
+  if (opts.harness === "claude") {
+    const { runClaudeSupervised } = await import("./claude-ZFYJRREP.js");
+    const report2 = await runClaudeSupervised({
+      prompt,
+      command: opts.exec ?? ["claude"],
+      maxSteps: Number(opts.maxSteps),
+      maxMinutes: Number(opts.maxMinutes),
+      autoResume: Number(opts.autoResume),
+      maxVerifyRounds: Number(opts.maxVerifyRounds),
+      approval: opts.yolo ? "approve" : "reject",
+      json: Boolean(opts.json)
+    });
+    if (opts.json) console.log(JSON.stringify(report2, null, 2));
+    else console.log(formatReport(report2));
+    process.exitCode = report2.endReason === "finished" ? 0 : 2;
+    return;
+  }
   const report = await runSupervised({
     prompt,
     command: opts.exec ?? ["kimi", "--wire"],