@staff0rd/assist 0.391.4 → 0.392.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.391.4",
+  version: "0.392.0",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -17,6 +17,7 @@ var package_default = {
   files: [
     "dist",
     "claude",
+    "codex",
     "allowed.cli-reads",
     "allowed.cli-writes"
   ],
@@ -140,10 +141,10 @@ import { stringify as stringifyYaml } from "yaml";
 // src/shared/loadRawYaml.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
-function loadRawYaml(path63) {
-  if (!existsSync(path63)) return {};
+function loadRawYaml(path64) {
+  if (!existsSync(path64)) return {};
   try {
-    const content = readFileSync(path63, "utf8");
+    const content = readFileSync(path64, "utf8");
     return parseYaml(content) || {};
   } catch {
     return {};
@@ -1360,8 +1361,8 @@ function findUnmergedPaths() {
   }
   const found = /* @__PURE__ */ new Set();
   for (const line of output.split("\n")) {
-    const path63 = line.split("	")[1];
-    if (path63) found.add(path63.trim());
+    const path64 = line.split("	")[1];
+    if (path64) found.add(path64.trim());
   }
   return [...found];
 }
@@ -1460,8 +1461,8 @@ function getPreferredRemoteRepo(cwd) {
 function gitRefUrl(kind, ref, cwd) {
   const repo = getPreferredRemoteRepo(cwd);
   if (!repo) return void 0;
-  const path63 = kind === "branch" ? "tree" : "commit";
-  return `https://github.com/${repo.org}/${repo.repo}/${path63}/${ref}`;
+  const path64 = kind === "branch" ? "tree" : "commit";
+  return `https://github.com/${repo.org}/${repo.repo}/${path64}/${ref}`;
 }
 
 // src/commands/commit/collectCommitRefs.ts
@@ -3232,9 +3233,9 @@ import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
 
 // src/commands/verify/forbiddenStrings/findForbiddenStrings.ts
 import { minimatch as minimatch2 } from "minimatch";
-function resolveStringsAtPath(data, path63) {
+function resolveStringsAtPath(data, path64) {
   let current = data;
-  for (const segment of path63.split(".")) {
+  for (const segment of path64.split(".")) {
     if (current === null || typeof current !== "object") return [];
     current = current[segment];
   }
@@ -3247,10 +3248,10 @@ function resolveStringsAtPath(data, path63) {
 }
 function findRuleViolations(data, rule) {
   const violations = [];
-  for (const path63 of rule.paths) {
-    for (const value of resolveStringsAtPath(data, path63)) {
+  for (const path64 of rule.paths) {
+    for (const value of resolveStringsAtPath(data, path64)) {
       if (minimatch2(value, rule.disallowed))
-        violations.push({ file: rule.file, path: path63, value });
+        violations.push({ file: rule.file, path: path64, value });
     }
   }
   return violations;
@@ -3289,8 +3290,8 @@ function forbiddenStrings() {
     process.exit(0);
   }
   console.log("Forbidden strings found:\n");
-  for (const { file, path: path63, value } of violations) {
-    console.log(`  ${file} ${path63}: ${value}`);
+  for (const { file, path: path64, value } of violations) {
+    console.log(`  ${file} ${path64}: ${value}`);
   }
   console.log(`
 Total: ${violations.length} forbidden string(s).`);
@@ -3582,15 +3583,15 @@ function readBaselineMigrations(repoRelativeDir, ref) {
   } catch {
     return baseline;
   }
-  const paths = listing.split("\n").map((line) => line.trim()).filter(Boolean).filter((path63) => MIGRATION_FILE3.test(basename(path63)));
-  for (const path63 of paths) {
+  const paths = listing.split("\n").map((line) => line.trim()).filter(Boolean).filter((path64) => MIGRATION_FILE3.test(basename(path64)));
+  for (const path64 of paths) {
     try {
-      const content = execSync12(`git show "${ref}:${path63}"`, {
+      const content = execSync12(`git show "${ref}:${path64}"`, {
         encoding: "utf8",
         maxBuffer: 16 * 1024 * 1024,
         stdio: ["pipe", "pipe", "pipe"]
       });
-      baseline.set(basename(path63), content);
+      baseline.set(basename(path64), content);
     } catch {
     }
   }
@@ -4955,10 +4956,10 @@ var hooksSettings = {
   }
 };
 function ensureHooksSettings() {
-  const path63 = daemonPaths.hooksSettings;
-  mkdirSync5(dirname12(path63), { recursive: true });
-  writeFileSync15(path63, JSON.stringify(hooksSettings, null, 2));
-  return path63;
+  const path64 = daemonPaths.hooksSettings;
+  mkdirSync5(dirname12(path64), { recursive: true });
+  writeFileSync15(path64, JSON.stringify(hooksSettings, null, 2));
+  return path64;
 }
 
 // src/shared/spawnInherit.ts
@@ -5222,9 +5223,9 @@ var LOCAL_FILES = ["backlog.jsonl", "backlog.db"];
 function backupLocalBacklogFiles(dir) {
   const moved = [];
   for (const name of LOCAL_FILES) {
-    const path63 = join15(dir, ".assist", name);
-    if (existsSync18(path63)) {
-      renameSync(path63, `${path63}.bak`);
+    const path64 = join15(dir, ".assist", name);
+    if (existsSync18(path64)) {
+      renameSync(path64, `${path64}.bak`);
       moved.push(`${name} \u2192 ${name}.bak`);
     }
   }
@@ -5663,8 +5664,8 @@ var backlogItemSchema = z3.strictObject({
 var backlogFileSchema = z3.array(backlogItemSchema);
 
 // src/commands/backlog/parseBacklogJsonl.ts
-function parseBacklogJsonl(path63) {
-  const content = readFileSync14(path63, "utf8").trim();
+function parseBacklogJsonl(path64) {
+  const content = readFileSync14(path64, "utf8").trim();
   if (content.length === 0) return [];
   return content.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => backlogItemSchema.parse(JSON.parse(line)));
 }
@@ -5746,8 +5747,8 @@ function findBacklogUp(startDir) {
 
 // src/commands/backlog/getCurrentOrigin.ts
 import { execFileSync } from "child_process";
-function stripLeadingSlashes(path63) {
-  return path63.replace(/^\/+/, "");
+function stripLeadingSlashes(path64) {
+  return path64.replace(/^\/+/, "");
 }
 function normalizeOrigin(raw) {
   const trimmed = raw.trim().replace(/\.git$/i, "").replace(/\/+$/, "");
@@ -6287,24 +6288,24 @@ function getOwnerPath(itemId2) {
 function recordSignalOwner(itemId2) {
   const sessionId = process.env.ASSIST_SESSION_ID;
   if (!sessionId) return;
-  const path63 = getOwnerPath(itemId2);
-  mkdirSync7(dirname14(path63), { recursive: true });
-  writeFileSync17(path63, JSON.stringify({ sessionId }));
+  const path64 = getOwnerPath(itemId2);
+  mkdirSync7(dirname14(path64), { recursive: true });
+  writeFileSync17(path64, JSON.stringify({ sessionId }));
 }
 function readSignalOwner(itemId2) {
-  const path63 = getOwnerPath(itemId2);
-  if (!existsSync21(path63)) return void 0;
+  const path64 = getOwnerPath(itemId2);
+  if (!existsSync21(path64)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync15(path63, "utf8"));
+    const parsed = JSON.parse(readFileSync15(path64, "utf8"));
     return parsed.sessionId;
   } catch {
     return void 0;
   }
 }
 function clearSignalOwner(itemId2) {
-  const path63 = getOwnerPath(itemId2);
+  const path64 = getOwnerPath(itemId2);
   try {
-    rmSync(path63);
+    rmSync(path64);
   } catch {
   }
 }
@@ -6341,19 +6342,19 @@ function resolveSignalTarget(event, data) {
 function writeSignal(event, data) {
   const target = resolveSignalTarget(event, data);
   if (!target) return;
-  const path63 = getSignalPath(target);
-  if (!path63) return;
+  const path64 = getSignalPath(target);
+  if (!path64) return;
   const signal = { event, sessionId: target, ...data };
-  mkdirSync8(dirname15(path63), { recursive: true });
-  writeFileSync18(path63, JSON.stringify(signal));
+  mkdirSync8(dirname15(path64), { recursive: true });
+  writeFileSync18(path64, JSON.stringify(signal));
 }
 
 // src/commands/backlog/readSignal.ts
 function readSignal() {
-  const path63 = getSignalPath();
-  if (!path63 || !existsSync22(path63)) return void 0;
+  const path64 = getSignalPath();
+  if (!path64 || !existsSync22(path64)) return void 0;
   try {
-    return JSON.parse(readFileSync16(path63, "utf8"));
+    return JSON.parse(readFileSync16(path64, "utf8"));
   } catch {
     return void 0;
   }
@@ -6448,13 +6449,13 @@ function activityPath(sessionId) {
 function emitActivity(activity2) {
   const sessionId = process.env.ASSIST_ACTIVITY_ID;
   if (!sessionId) return;
-  const path63 = activityPath(sessionId);
-  mkdirSync9(dirname16(path63), { recursive: true });
-  writeFileSync19(path63, JSON.stringify({ ...activity2, startedAt: Date.now() }));
+  const path64 = activityPath(sessionId);
+  mkdirSync9(dirname16(path64), { recursive: true });
+  writeFileSync19(path64, JSON.stringify({ ...activity2, startedAt: Date.now() }));
 }
-function readActivity(path63) {
+function readActivity(path64) {
   try {
-    return JSON.parse(readFileSync17(path63, "utf8"));
+    return JSON.parse(readFileSync17(path64, "utf8"));
   } catch {
     return void 0;
   }
@@ -6464,9 +6465,9 @@ function reconcileActivity(sessionId, activity2) {
     removeActivity(sessionId);
     return;
   }
-  const path63 = activityPath(sessionId);
-  mkdirSync9(dirname16(path63), { recursive: true });
-  writeFileSync19(path63, JSON.stringify(activity2));
+  const path64 = activityPath(sessionId);
+  mkdirSync9(dirname16(path64), { recursive: true });
+  writeFileSync19(path64, JSON.stringify(activity2));
 }
 function removeActivity(sessionId) {
   try {
@@ -7697,8 +7698,8 @@ async function getBacklogExists(req, res) {
 // src/commands/backlog/originDisplayName.ts
 function originDisplayName(origin) {
   if (origin.startsWith("local:")) {
-    const path63 = origin.slice("local:".length).replace(/\/+$/, "");
-    const segments = path63.split("/").filter(Boolean);
+    const path64 = origin.slice("local:".length).replace(/\/+$/, "");
+    const segments = path64.split("/").filter(Boolean);
     return segments[segments.length - 1] ?? origin;
   }
   const firstSlash = origin.indexOf("/");
@@ -8089,7 +8090,7 @@ function findSynthesisForBranch(repoReviewsDir, branch2) {
   const parent = dirname20(branchKeyPath);
   const branchPrefix = basename5(branchKeyPath);
   if (!existsSync25(parent)) return null;
-  const synthesisFiles = readdirSync2(parent).filter((name) => name.startsWith(branchPrefix)).map((name) => join23(parent, name, "synthesis.md")).filter((path63) => existsSync25(path63)).map((path63) => ({ path: path63, mtime: statSync2(path63).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const synthesisFiles = readdirSync2(parent).filter((name) => name.startsWith(branchPrefix)).map((name) => join23(parent, name, "synthesis.md")).filter((path64) => existsSync25(path64)).map((path64) => ({ path: path64, mtime: statSync2(path64).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   return synthesisFiles[0]?.path ?? null;
 }
 
@@ -8143,12 +8144,12 @@ async function getReviewSynthesis(req, res) {
   const cwd = getCwdParam(req, res);
   if (!cwd) return;
   try {
-    const path63 = await resolveSynthesisPath(cwd);
-    if (!path63) {
+    const path64 = await resolveSynthesisPath(cwd);
+    if (!path64) {
       respondJson(res, 404, { error: "No synthesis found" });
       return;
     }
-    respondJson(res, 200, { synthesis: readFileSync19(path63, "utf8") });
+    respondJson(res, 200, { synthesis: readFileSync19(path64, "utf8") });
   } catch {
     respondJson(res, 404, { error: "No synthesis found" });
   }
@@ -8283,10 +8284,10 @@ function getStorePath(filename) {
   return join26(getStoreDir(), filename);
 }
 function loadJson(filename) {
-  const path63 = getStorePath(filename);
-  if (existsSync26(path63)) {
+  const path64 = getStorePath(filename);
+  if (existsSync26(path64)) {
     try {
-      return JSON.parse(readFileSync20(path63, "utf8"));
+      return JSON.parse(readFileSync20(path64, "utf8"));
     } catch {
       return {};
     }
@@ -11440,52 +11441,6 @@ function findBuiltinDenyRaw(rawCommand) {
   return toDecision(matchBuiltinDeny(rawCommand));
 }
 
-// src/commands/cliHook/logDeniedToolCall.ts
-import { mkdirSync as mkdirSync12 } from "fs";
-import { homedir as homedir14 } from "os";
-import { join as join28 } from "path";
-import Database from "better-sqlite3";
-var _db;
-function getDbDir() {
-  return join28(homedir14(), ".assist");
-}
-function initSchema(db) {
-  db.exec(`
-		CREATE TABLE IF NOT EXISTS denied_tool_calls (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			tool TEXT NOT NULL,
-			command TEXT NOT NULL,
-			repo TEXT NOT NULL,
-			session_id TEXT,
-			deny_reason TEXT NOT NULL,
-			timestamp TEXT NOT NULL DEFAULT (datetime('now'))
-		);
-	`);
-}
-function openPromptsDb(dir) {
-  if (_db) return _db;
-  const dbDir = dir ?? getDbDir();
-  mkdirSync12(dbDir, { recursive: true });
-  const db = new Database(join28(dbDir, "assist.db"));
-  db.pragma("journal_mode = WAL");
-  initSchema(db);
-  _db = db;
-  return db;
-}
-function logDeniedToolCall(entry) {
-  const db = openPromptsDb();
-  db.prepare(
-    `INSERT INTO denied_tool_calls (tool, command, repo, session_id, deny_reason)
-		 VALUES (@tool, @command, @repo, @sessionId, @denyReason)`
-  ).run({
-    tool: entry.tool,
-    command: entry.command,
-    repo: entry.repo,
-    sessionId: entry.sessionId ?? null,
-    denyReason: entry.denyReason
-  });
-}
-
 // src/shared/isApprovedRead.ts
 import { resolve as resolve9, sep } from "path";
 
@@ -11576,9 +11531,9 @@ var __dirname4 = dirname21(__filename3);
 function packageRoot() {
   return __dirname4;
 }
-function readLines(path63) {
-  if (!existsSync27(path63)) return [];
-  return readFileSync23(path63, "utf8").split("\n").filter((line) => line.trim() !== "");
+function readLines(path64) {
+  if (!existsSync27(path64)) return [];
+  return readFileSync23(path64, "utf8").split("\n").filter((line) => line.trim() !== "");
 }
 var cachedReads;
 var cachedWrites;
@@ -11625,13 +11580,13 @@ function findCliWrite(command) {
 
 // src/shared/readSettingsPerms.ts
 import { existsSync as existsSync28, readFileSync as readFileSync24 } from "fs";
-import { homedir as homedir15 } from "os";
-import { join as join29 } from "path";
+import { homedir as homedir14 } from "os";
+import { join as join28 } from "path";
 function readSettingsPerms(key) {
   const paths = [
-    join29(homedir15(), ".claude", "settings.json"),
-    join29(process.cwd(), ".claude", "settings.json"),
-    join29(process.cwd(), ".claude", "settings.local.json")
+    join28(homedir14(), ".claude", "settings.json"),
+    join28(process.cwd(), ".claude", "settings.json"),
+    join28(process.cwd(), ".claude", "settings.local.json")
   ];
   const entries = [];
   for (const p of paths) {
@@ -11823,6 +11778,59 @@ function resolvePermission(toolName, parts) {
   };
 }
 
+// src/commands/cliHook/decideCommand.ts
+function decideCommand(toolName, rawCommand) {
+  const result = splitCompound(rawCommand);
+  if (result.ok) return resolvePermission(toolName, result.parts);
+  return findBuiltinDenyRaw(rawCommand) ?? findDeny(toolName, [rawCommand]);
+}
+
+// src/commands/cliHook/logDeniedToolCall.ts
+import { mkdirSync as mkdirSync12 } from "fs";
+import { homedir as homedir15 } from "os";
+import { join as join29 } from "path";
+import Database from "better-sqlite3";
+var _db;
+function getDbDir() {
+  return join29(homedir15(), ".assist");
+}
+function initSchema(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS denied_tool_calls (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			tool TEXT NOT NULL,
+			command TEXT NOT NULL,
+			repo TEXT NOT NULL,
+			session_id TEXT,
+			deny_reason TEXT NOT NULL,
+			timestamp TEXT NOT NULL DEFAULT (datetime('now'))
+		);
+	`);
+}
+function openPromptsDb(dir) {
+  if (_db) return _db;
+  const dbDir = dir ?? getDbDir();
+  mkdirSync12(dbDir, { recursive: true });
+  const db = new Database(join29(dbDir, "assist.db"));
+  db.pragma("journal_mode = WAL");
+  initSchema(db);
+  _db = db;
+  return db;
+}
+function logDeniedToolCall(entry) {
+  const db = openPromptsDb();
+  db.prepare(
+    `INSERT INTO denied_tool_calls (tool, command, repo, session_id, deny_reason)
+		 VALUES (@tool, @command, @repo, @sessionId, @denyReason)`
+  ).run({
+    tool: entry.tool,
+    command: entry.command,
+    repo: entry.repo,
+    sessionId: entry.sessionId ?? null,
+    denyReason: entry.denyReason
+  });
+}
+
 // src/commands/cliHook/index.ts
 var SUPPORTED_TOOLS = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
 function tryParseInput(raw) {
@@ -11838,15 +11846,10 @@ function tryParseInput(raw) {
     return void 0;
   }
 }
-function decide(toolName, rawCommand) {
-  const result = splitCompound(rawCommand);
-  if (result.ok) return resolvePermission(toolName, result.parts);
-  return findBuiltinDenyRaw(rawCommand) ?? findDeny(toolName, [rawCommand]);
-}
 async function cliHook() {
   const input = tryParseInput(await readStdin());
   if (!input) return;
-  const decision = decide(input.toolName, input.command);
+  const decision = decideCommand(input.toolName, input.command);
   if (!decision) return;
   console.log(
     JSON.stringify({
@@ -12022,14 +12025,14 @@ function showProgress(p, label2) {
   const pct = Math.round(p.done / p.total * 100);
   process.stderr.write(`\r\x1B[K[${pct}%] Scanning ${label2}...`);
 }
-async function resolveCommand(cli, path63, description, depth, p) {
-  showProgress(p, path63.join(" "));
-  const subHelp = await runHelp([cli, ...path63]);
+async function resolveCommand(cli, path64, description, depth, p) {
+  showProgress(p, path64.join(" "));
+  const subHelp = await runHelp([cli, ...path64]);
   if (!subHelp || !hasSubcommands(subHelp)) {
-    return [{ path: path63, description }];
+    return [{ path: path64, description }];
   }
-  const children = await discoverAt(cli, path63, depth + 1, p);
-  return children.length > 0 ? children : [{ path: path63, description }];
+  const children = await discoverAt(cli, path64, depth + 1, p);
+  return children.length > 0 ? children : [{ path: path64, description }];
 }
 async function discoverAt(cli, parentPath, depth, p) {
   if (depth > SAFETY_DEPTH) return [];
@@ -12177,9 +12180,9 @@ function logPath(cli) {
   return join30(homedir16(), ".assist", `cli-discover-${safeName}.log`);
 }
 function readCache(cli) {
-  const path63 = logPath(cli);
-  if (!existsSync29(path63)) return void 0;
-  return readFileSync25(path63, "utf8");
+  const path64 = logPath(cli);
+  if (!existsSync29(path64)) return void 0;
+  return readFileSync25(path64, "utf8");
 }
 function writeCache(cli, output) {
   const dir = join30(homedir16(), ".assist");
@@ -12351,9 +12354,9 @@ function sweepRestrictedDir(dir = getRestrictedDir()) {
   }
   const cutoff = Date.now() - STALE_AFTER_MS;
   for (const entry of entries) {
-    const path63 = join32(dir, entry);
+    const path64 = join32(dir, entry);
     try {
-      if (statSync3(path63).mtimeMs < cutoff) unlinkSync7(path63);
+      if (statSync3(path64).mtimeMs < cutoff) unlinkSync7(path64);
     } catch {
       continue;
     }
@@ -12363,10 +12366,10 @@ function sweepRestrictedDir(dir = getRestrictedDir()) {
 // src/commands/codeComment/readPinState.ts
 import { existsSync as existsSync30, readFileSync as readFileSync26 } from "fs";
 function readPinState(pin) {
-  const path63 = getPinStatePath(pin);
-  if (!existsSync30(path63)) return void 0;
+  const path64 = getPinStatePath(pin);
+  if (!existsSync30(path64)) return void 0;
   try {
-    const state = JSON.parse(readFileSync26(path63, "utf8"));
+    const state = JSON.parse(readFileSync26(path64, "utf8"));
     if (state.pin !== pin) return void 0;
     return state;
   } catch {
@@ -12515,6 +12518,65 @@ function registerCodeComment(parent) {
   codeComment.command("confirm").description("Confirm a pin to insert its comment and clear the pin state").argument("<pin>", "Pin issued by 'code-comment set'").action(codeCommentConfirm);
 }
 
+// src/commands/codexHook/index.ts
+var SUPPORTED_TOOLS2 = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
+function parseInput(raw) {
+  try {
+    const data = JSON.parse(raw);
+    const command = data.tool_input?.command;
+    if (typeof command !== "string" || !command.trim()) return void 0;
+    if (!data.tool_name || !SUPPORTED_TOOLS2.has(data.tool_name))
+      return void 0;
+    return {
+      event: data.hook_event_name ?? "PreToolUse",
+      toolName: data.tool_name,
+      command: command.trim()
+    };
+  } catch {
+    return void 0;
+  }
+}
+function preToolUseOutput(decision) {
+  if (decision.permissionDecision === "allow") {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        permissionDecisionReason: decision.permissionDecisionReason
+      }
+    };
+  }
+  return { decision: "block", reason: decision.permissionDecisionReason };
+}
+function permissionRequestOutput(decision) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      decision: {
+        behavior: decision.permissionDecision === "allow" ? "allow" : "deny",
+        message: decision.permissionDecisionReason
+      }
+    }
+  };
+}
+async function codexHook() {
+  const input = parseInput(await readStdin());
+  if (!input) return;
+  const decision = decideCommand(input.toolName, input.command);
+  if (!decision) return;
+  const output = input.event === "PermissionRequest" ? permissionRequestOutput(decision) : preToolUseOutput(decision);
+  console.log(JSON.stringify(output));
+}
+
+// src/commands/registerCodexHook.ts
+function registerCodexHook(program2) {
+  program2.command("codex-hook").description(
+    "Codex PreToolUse/PermissionRequest hook for auto-approving read-only CLI commands"
+  ).action(() => {
+    codexHook();
+  });
+}
+
 // src/commands/complexity/analyze.ts
 import chalk119 from "chalk";
 
@@ -13132,8 +13194,8 @@ function stepIntoNested(container, key, nextKey) {
   }
   return ensureObject(container, resolved);
 }
-function setNestedValue(obj, path63, value) {
-  const keys = path63.split(".");
+function setNestedValue(obj, path64, value) {
+  const keys = path64.split(".");
   const result = { ...obj };
   let current = result;
   for (let i = 0; i < keys.length - 1; i++) {
@@ -13213,9 +13275,9 @@ function isTraversable(value) {
 function stepInto(current, key) {
   return isTraversable(current) ? current[key] : void 0;
 }
-function getNestedValue(obj, path63) {
+function getNestedValue(obj, path64) {
   let current = obj;
-  for (const key of path63.split(".")) current = stepInto(current, key);
+  for (const key of path64.split(".")) current = stepInto(current, key);
   return current;
 }
 
@@ -15801,9 +15863,9 @@ function parseRscRows(flight) {
 }
 function makeRscResolver(rows) {
   return (ref) => {
-    const [id, ...path63] = ref.slice(1).replace(/^[L@]/, "").split(":");
+    const [id, ...path64] = ref.slice(1).replace(/^[L@]/, "").split(":");
     let v = rows[id];
-    for (const key of path63) {
+    for (const key of path64) {
       if (v == null || typeof v !== "object") return void 0;
       v = v[key];
     }
@@ -16450,15 +16512,15 @@ function postComment(vars) {
   const stdout = startLine === void 0 ? runGhGraphql(MUTATION_SINGLE, base) : runGhGraphql(MUTATION_MULTI, { ...base, startLine });
   assertThreadCreated(stdout);
 }
-function comment2(path63, line, body, startLine) {
+function comment2(path64, line, body, startLine) {
   validateBody(body);
   validateLine(line);
   if (startLine !== void 0) validateLine(startLine);
   try {
     const prId = getCurrentPrNodeId();
-    postComment({ prId, body, path: path63, line, startLine });
+    postComment({ prId, body, path: path64, line, startLine });
     const range = startLine !== void 0 ? `${startLine}-${line}` : `${line}`;
-    console.log(`Added review comment on ${path63}:${range}`);
+    console.log(`Added review comment on ${path64}:${range}`);
   } catch (error) {
     if (isGhNotInstalled(error)) {
       console.error("Error: GitHub CLI (gh) is not installed.");
@@ -17319,8 +17381,8 @@ function registerPrs(program2) {
   prsCommand.command("reply <comment-id> <body>").description("Reply to a comment thread without resolving it").action((commentId, body) => {
     reply(Number.parseInt(commentId, 10), body);
   });
-  prsCommand.command("comment <path> <line> <body>").description("Add a line comment to the pending review").action((path63, line, body) => {
-    comment2(path63, Number.parseInt(line, 10), body);
+  prsCommand.command("comment <path> <line> <body>").description("Add a line comment to the pending review").action((path64, line, body) => {
+    comment2(path64, Number.parseInt(line, 10), body);
   });
   configHelp(prsCommand, prsConfigHelp);
 }
@@ -17573,10 +17635,10 @@ function resolveOpSecret(reference) {
 }
 
 // src/commands/ravendb/ravenFetch.ts
-async function ravenFetch(connection, path63) {
+async function ravenFetch(connection, path64) {
   const apiKey = resolveOpSecret(connection.apiKeyRef);
   let accessToken = await getAccessToken(apiKey);
-  const url = `${connection.url}${path63}`;
+  const url = `${connection.url}${path64}`;
   const headers = {
     Authorization: `Bearer ${accessToken}`,
     "Content-Type": "application/json"
@@ -17680,16 +17742,16 @@ import chalk166 from "chalk";
 // src/commands/ravendb/buildQueryPath.ts
 function buildQueryPath(opts) {
   const db = encodeURIComponent(opts.db);
-  let path63;
+  let path64;
   if (opts.collection) {
-    path63 = `/databases/${db}/indexes/dynamic/${encodeURIComponent(opts.collection)}?start=${opts.start}&pageSize=${opts.pageSize}&sort=${encodeURIComponent(opts.sort)}`;
+    path64 = `/databases/${db}/indexes/dynamic/${encodeURIComponent(opts.collection)}?start=${opts.start}&pageSize=${opts.pageSize}&sort=${encodeURIComponent(opts.sort)}`;
   } else {
-    path63 = `/databases/${db}/queries?start=${opts.start}&pageSize=${opts.pageSize}`;
+    path64 = `/databases/${db}/queries?start=${opts.start}&pageSize=${opts.pageSize}`;
   }
   if (opts.query) {
-    path63 += `&query=${encodeURIComponent(opts.query)}`;
+    path64 += `&query=${encodeURIComponent(opts.query)}`;
   }
-  return path63;
+  return path64;
 }
 
 // src/commands/ravendb/fetchAllPages.ts
@@ -17698,7 +17760,7 @@ async function fetchAllPages(connection, opts) {
   let start3 = 0;
   while (true) {
     const effectivePageSize = opts.limit !== void 0 ? Math.min(opts.pageSize, opts.limit - allResults.length) : opts.pageSize;
-    const path63 = buildQueryPath({
+    const path64 = buildQueryPath({
       db: connection.database,
       collection: opts.collection,
       start: start3,
@@ -17706,7 +17768,7 @@ async function fetchAllPages(connection, opts) {
       sort: opts.sort,
       query: opts.query
     });
-    const data = await ravenFetch(connection, path63);
+    const data = await ravenFetch(connection, path64);
     const results = data.Results ?? [];
     const totalResults = data.TotalResults ?? 0;
     if (results.length === 0) break;
@@ -20094,8 +20156,8 @@ async function handlePostSynthesis(synthesisPath, options2) {
 // src/commands/review/prepareReviewDir.ts
 import { existsSync as existsSync41, mkdirSync as mkdirSync17, unlinkSync as unlinkSync14, writeFileSync as writeFileSync34 } from "fs";
 function clearReviewFiles(paths) {
-  for (const path63 of [paths.claudePath, paths.codexPath, paths.synthesisPath]) {
-    if (existsSync41(path63)) unlinkSync14(path63);
+  for (const path64 of [paths.claudePath, paths.codexPath, paths.synthesisPath]) {
+    if (existsSync41(path64)) unlinkSync14(path64);
   }
 }
 function prepareReviewDir(paths, requestBody, force) {
@@ -21243,8 +21305,8 @@ import chalk187 from "chalk";
 
 // src/commands/seq/fetchSeq.ts
 import chalk184 from "chalk";
-async function fetchSeq(conn, path63, params) {
-  const url = `${conn.url}${path63}?${params}`;
+async function fetchSeq(conn, path64, params) {
+  const url = `${conn.url}${path64}?${params}`;
   const response = await fetch(url, {
     headers: {
       Accept: "application/json",
@@ -22731,9 +22793,9 @@ function findPortFile(roamDir) {
     return void 0;
   }
   const candidates = entries.filter((name) => /^roam-local-api(-[^.]+)?\.port$/.test(name)).map((name) => {
-    const path63 = join60(roamDir, name);
+    const path64 = join60(roamDir, name);
     try {
-      return { path: path63, mtimeMs: statSync8(path63).mtimeMs };
+      return { path: path64, mtimeMs: statSync8(path64).mtimeMs };
     } catch {
       return void 0;
     }
@@ -23152,11 +23214,11 @@ function findLinkIndex() {
 function parseLinkArgs() {
   const idx = findLinkIndex();
   if (idx === -1) return null;
-  const path63 = process.argv[idx + 1];
+  const path64 = process.argv[idx + 1];
   const rest = process.argv.slice(idx + 2);
   const { value: prefix2 } = extractOption(rest, "--prefix");
   if (!prefix2) return null;
-  return { path: path63, prefix: prefix2 };
+  return { path: path64, prefix: prefix2 };
 }
 function hasDuplicateLink(runList, linkPath) {
   return runList.some(
@@ -24436,8 +24498,8 @@ async function seedRunningMsFromUsage(session, notify2) {
 var DEBOUNCE_MS = 50;
 function watchActivity(session, notify2) {
   if (session.commandType !== "assist" || !session.cwd) return;
-  const path63 = activityPath(session.id);
-  const dir = dirname29(path63);
+  const path64 = activityPath(session.id);
+  const dir = dirname29(path64);
   try {
     mkdirSync24(dir, { recursive: true });
   } catch {
@@ -24447,7 +24509,7 @@ function watchActivity(session, notify2) {
   let timer = null;
   const read = () => {
     timer = null;
-    const activity2 = readActivity(path63);
+    const activity2 = readActivity(path64);
     if (!activity2) return;
     session.activity = activity2;
     if (activity2.claudeSessionId)
@@ -24457,11 +24519,11 @@ function watchActivity(session, notify2) {
     notify2();
   };
   session.activityWatcher = watch(dir, (_event, filename) => {
-    if (filename && !path63.endsWith(filename)) return;
+    if (filename && !path64.endsWith(filename)) return;
     if (timer) clearTimeout(timer);
     timer = setTimeout(read, DEBOUNCE_MS);
   });
-  if (existsSync54(path63)) read();
+  if (existsSync54(path64)) read();
 }
 function refreshActivity(session) {
   if (session.commandType !== "assist" || !session.cwd) return;
@@ -26550,9 +26612,9 @@ async function statusLine() {
 }
 
 // src/commands/sync.ts
-import * as fs43 from "fs";
+import * as fs44 from "fs";
 import * as os3 from "os";
-import * as path61 from "path";
+import * as path62 from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 
 // src/commands/sync/syncClaudeMd.ts
@@ -26586,8 +26648,52 @@ async function syncClaudeMd(claudeDir, targetBase, options2) {
 }
 
 // src/commands/sync/syncCodex.ts
+import * as fs41 from "fs";
+import * as path59 from "path";
+
+// src/commands/sync/syncCodexHooks.ts
 import * as fs40 from "fs";
 import * as path58 from "path";
+var BEGIN = "# >>> assist codex hooks (managed) \u2014 do not edit >>>";
+var END = "# <<< assist codex hooks (managed) <<<";
+function upsertManagedBlock(existing, body) {
+  const block = `${BEGIN}
+${body.trim()}
+${END}`;
+  const begin = existing.indexOf(BEGIN);
+  if (begin === -1) {
+    const base = existing.replace(/\s*$/, "");
+    return base ? `${base}
+
+${block}
+` : `${block}
+`;
+  }
+  const endMarker = existing.indexOf(END, begin);
+  const after = endMarker === -1 ? existing.length : endMarker + END.length;
+  const before = existing.slice(0, begin).replace(/\s*$/, "");
+  const rest = existing.slice(after).replace(/^\s*/, "");
+  const head = before ? `${before}
+
+${block}` : block;
+  return rest ? `${head}
+
+${rest}
+` : `${head}
+`;
+}
+function syncCodexHooks(sourcePath) {
+  const body = fs40.readFileSync(sourcePath, "utf8");
+  const configPath = path58.join(harnesses.codex.homeDir, "config.toml");
+  const existing = fs40.existsSync(configPath) ? fs40.readFileSync(configPath, "utf8") : "";
+  fs40.mkdirSync(path58.dirname(configPath), { recursive: true });
+  fs40.writeFileSync(configPath, upsertManagedBlock(existing, body));
+  console.log(
+    "Registered assist codex-hook in ~/.codex/config.toml (PreToolUse, PermissionRequest)"
+  );
+}
+
+// src/commands/sync/syncCodex.ts
 function quoteYaml(value) {
   return `"${value.replace(/\\/g, String.raw`\\`).replace(/"/g, String.raw`\"`)}"`;
 }
@@ -26608,56 +26714,57 @@ description: ${quoteYaml(description)}
 function syncCodex(claudeDir) {
   if (!isHarnessAvailable("codex")) return;
   const codex = harnesses.codex;
-  const commandsSource = path58.join(claudeDir, "commands");
-  const files = fs40.readdirSync(commandsSource);
+  const commandsSource = path59.join(claudeDir, "commands");
+  const files = fs41.readdirSync(commandsSource);
   for (const file of files) {
     if (!file.endsWith(".md")) continue;
     const name = file.replace(/\.md$/, "");
-    const content = fs40.readFileSync(path58.join(commandsSource, file), "utf8");
-    const target = path58.join(codex.homeDir, codex.sync.commandDest(name));
-    fs40.mkdirSync(path58.dirname(target), { recursive: true });
-    fs40.writeFileSync(target, commandToSkill(name, content));
-  }
-  const agentsTarget = path58.join(codex.homeDir, codex.sync.agentsFile);
-  fs40.mkdirSync(path58.dirname(agentsTarget), { recursive: true });
-  fs40.copyFileSync(path58.join(claudeDir, "CLAUDE.md"), agentsTarget);
+    const content = fs41.readFileSync(path59.join(commandsSource, file), "utf8");
+    const target = path59.join(codex.homeDir, codex.sync.commandDest(name));
+    fs41.mkdirSync(path59.dirname(target), { recursive: true });
+    fs41.writeFileSync(target, commandToSkill(name, content));
+  }
+  const agentsTarget = path59.join(codex.homeDir, codex.sync.agentsFile);
+  fs41.mkdirSync(path59.dirname(agentsTarget), { recursive: true });
+  fs41.copyFileSync(path59.join(claudeDir, "CLAUDE.md"), agentsTarget);
+  syncCodexHooks(path59.join(claudeDir, "..", "codex", "config.toml"));
   console.log(
     `Synced ${files.length} skill(s) to ~/.codex/skills and CLAUDE.md to ~/.codex/AGENTS.md`
   );
 }
 
 // src/commands/sync/syncDesign.ts
-import * as fs41 from "fs";
-import * as path59 from "path";
+import * as fs42 from "fs";
+import * as path60 from "path";
 function syncDesign(claudeDir, targetBase) {
-  const systemPromptSource = path59.join(claudeDir, "system-prompt.md");
-  const systemPromptTarget = path59.join(targetBase, "system-prompt.md");
-  fs41.copyFileSync(systemPromptSource, systemPromptTarget);
+  const systemPromptSource = path60.join(claudeDir, "system-prompt.md");
+  const systemPromptTarget = path60.join(targetBase, "system-prompt.md");
+  fs42.copyFileSync(systemPromptSource, systemPromptTarget);
   console.log("Copied system-prompt.md to ~/.claude/system-prompt.md");
-  const skillsSource = path59.join(claudeDir, "skills");
-  const skillsTarget = path59.join(targetBase, "skills");
-  fs41.mkdirSync(skillsTarget, { recursive: true });
-  const files = fs41.readdirSync(skillsSource);
+  const skillsSource = path60.join(claudeDir, "skills");
+  const skillsTarget = path60.join(targetBase, "skills");
+  fs42.mkdirSync(skillsTarget, { recursive: true });
+  const files = fs42.readdirSync(skillsSource);
   for (const file of files) {
-    fs41.copyFileSync(
-      path59.join(skillsSource, file),
-      path59.join(skillsTarget, file)
+    fs42.copyFileSync(
+      path60.join(skillsSource, file),
+      path60.join(skillsTarget, file)
     );
   }
   console.log(`Synced ${files.length} design skill(s) to ~/.claude/skills`);
 }
 
 // src/commands/sync/syncSettings.ts
-import * as fs42 from "fs";
-import * as path60 from "path";
+import * as fs43 from "fs";
+import * as path61 from "path";
 import chalk200 from "chalk";
 async function syncSettings(claudeDir, targetBase, options2) {
-  const source = path60.join(claudeDir, "settings.json");
-  const target = path60.join(targetBase, "settings.json");
-  const sourceContent = fs42.readFileSync(source, "utf8");
+  const source = path61.join(claudeDir, "settings.json");
+  const target = path61.join(targetBase, "settings.json");
+  const sourceContent = fs43.readFileSync(source, "utf8");
   const sourceSettings = JSON.parse(sourceContent);
-  const targetExists = fs42.existsSync(target);
-  const targetContent = targetExists ? fs42.readFileSync(target, "utf8") : "";
+  const targetExists = fs43.existsSync(target);
+  const targetContent = targetExists ? fs43.readFileSync(target, "utf8") : "";
   const preservedUserSettings = targetExists ? JSON.parse(targetContent) : {};
   const mergedContent = JSON.stringify(
     { ...preservedUserSettings, ...sourceSettings },
@@ -26686,18 +26793,18 @@ async function syncSettings(claudeDir, targetBase, options2) {
       }
     }
   }
-  fs42.writeFileSync(target, mergedContent);
+  fs43.writeFileSync(target, mergedContent);
   console.log("Copied settings.json to ~/.claude/settings.json");
 }
 
 // src/commands/sync.ts
 var __filename5 = fileURLToPath9(import.meta.url);
-var __dirname7 = path61.dirname(__filename5);
+var __dirname7 = path62.dirname(__filename5);
 async function sync(options2) {
   const config = loadConfig();
   const yes = options2?.yes ?? config.sync.autoConfirm;
-  const claudeDir = path61.join(__dirname7, "..", "claude");
-  const targetBase = path61.join(os3.homedir(), ".claude");
+  const claudeDir = path62.join(__dirname7, "..", "claude");
+  const targetBase = path62.join(os3.homedir(), ".claude");
   syncCommands(claudeDir, targetBase);
   syncDesign(claudeDir, targetBase);
   await syncSettings(claudeDir, targetBase, { yes });
@@ -26705,12 +26812,12 @@ async function sync(options2) {
   syncCodex(claudeDir);
 }
 function syncCommands(claudeDir, targetBase) {
-  const sourceDir = path61.join(claudeDir, "commands");
-  const targetDir = path61.join(targetBase, "commands");
-  fs43.mkdirSync(targetDir, { recursive: true });
-  const files = fs43.readdirSync(sourceDir);
+  const sourceDir = path62.join(claudeDir, "commands");
+  const targetDir = path62.join(targetBase, "commands");
+  fs44.mkdirSync(targetDir, { recursive: true });
+  const files = fs44.readdirSync(sourceDir);
   for (const file of files) {
-    fs43.copyFileSync(path61.join(sourceDir, file), path61.join(targetDir, file));
+    fs44.copyFileSync(path62.join(sourceDir, file), path62.join(targetDir, file));
     console.log(`Copied ${file} to ${targetDir}`);
   }
   console.log(`Synced ${files.length} command(s) to ~/.claude/commands`);
@@ -26718,7 +26825,7 @@ function syncCommands(claudeDir, targetBase) {
 
 // src/commands/update.ts
 import { execSync as execSync57 } from "child_process";
-import * as path62 from "path";
+import * as path63 from "path";
 
 // src/commands/restartDaemonAfterUpdate.ts
 async function restartDaemonAfterUpdate() {
@@ -26737,12 +26844,12 @@ async function restartDaemonAfterUpdate() {
 // src/commands/update.ts
 function isGlobalNpmInstall(dir) {
   try {
-    const resolved = path62.resolve(dir);
-    if (resolved.split(path62.sep).includes("node_modules")) {
+    const resolved = path63.resolve(dir);
+    if (resolved.split(path63.sep).includes("node_modules")) {
       return true;
     }
     const globalPrefix = execSync57("npm prefix -g", { stdio: "pipe" }).toString().trim();
-    return resolved.toLowerCase().startsWith(path62.resolve(globalPrefix).toLowerCase());
+    return resolved.toLowerCase().startsWith(path63.resolve(globalPrefix).toLowerCase());
   } catch {
     return false;
   }
@@ -26788,7 +26895,7 @@ function reportCliError(error) {
 var program = new Command();
 program.name("assist").description("CLI application").version(package_default.version).option("--no-open", "Do not open a browser on startup").action((options2) => web({ port: "3100", open: options2.open }));
 var syncCommand = program.command("sync").description(
-  "Copy command files to ~/.claude/commands; when codex is detected, also install commands as ~/.codex/skills/<name>/SKILL.md and CLAUDE.md as ~/.codex/AGENTS.md"
+  "Copy command files to ~/.claude/commands; when codex is detected, also install commands as ~/.codex/skills/<name>/SKILL.md, CLAUDE.md as ~/.codex/AGENTS.md, and register the assist codex-hook auto-approval hook in ~/.codex/config.toml"
 ).option("-y, --yes", "Overwrite settings.json without prompting").action((options2) => sync(options2));
 configHelp(syncCommand, rootConfigHelp.sync);
 program.command("init").description("Initialize VS Code and verify configurations").action(init5);
@@ -26815,6 +26922,7 @@ registerBackup(program);
 registerDb(program);
 registerCliHook(program);
 registerCodeComment(program);
+registerCodexHook(program);
 registerEditHook(program);
 registerGithub(program);
 registerHandover(program);