@stroq/cli 0.4.0 → 0.5.1

package/dist/index.js

@@ -1029,8 +1029,8 @@ function firstArgAfter(segment2) {
 }
 
 // ../core/src/actions/self-config.ts
-var SELF_CONFIG_FILE = /(\.claude\/settings(\.local)?\.json|\.cursor\/hooks\.json|\.stroq(\/|\b))/;
-var PROTECTED_DIRS = /\.(claude|cursor|stroq)(\/|$|\s)/;
+var SELF_CONFIG_FILE = /(\.claude\/settings(\.local)?\.json|\.cursor\/hooks\.json|\.codex\/(hooks\.json|config\.toml)|\.stroq(\/|\b))/;
+var PROTECTED_DIRS = /\.(claude|cursor|codex|stroq)(\/|$|\s)/;
 var SELF_CONFIG_READ_COMMANDS = /* @__PURE__ */ new Set([
   "cat",
   "less",
@@ -3617,7 +3617,7 @@ Paste this line into a .env file (or any config the agent can read). Stroq store
 
 // src/commands/doctor.ts
 import { existsSync as existsSync3 } from "fs";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 
 // src/commands/cursor-hooks.ts
 import { homedir as homedir5 } from "os";
@@ -3645,6 +3645,21 @@ function mcpToolName(rawServer, rawTool) {
   return `mcp__${server}__${tool || "call"}`;
 }
 
+// src/adapters/tool-input.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function toolInputRecord(value) {
+  if (value === void 0 || value === null) return {};
+  if (typeof value === "object" && !Array.isArray(value)) return value;
+  if (typeof value !== "string") return { raw: JSON.stringify(value) };
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+      return parsed;
+  } catch {
+  }
+  return { raw: value };
+}
+
 // src/adapters/cursor.ts
 var CURSOR_EVENTS = [
   "beforeShellExecution",
@@ -3706,18 +3721,6 @@ function cursorToolName(input) {
       return "Write";
   }
 }
-function mcpToolInput(value) {
-  if (value === void 0 || value === null) return {};
-  if (typeof value === "object" && !Array.isArray(value)) return value;
-  if (typeof value !== "string") return { raw: JSON.stringify(value) };
-  try {
-    const parsed = JSON.parse(value);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
-      return parsed;
-  } catch {
-  }
-  return { raw: value };
-}
 function cursorToolInput(input) {
   switch (input.hook_event_name) {
     case "beforeShellExecution":
@@ -3725,7 +3728,7 @@ function cursorToolInput(input) {
       return { command: input.command ?? "" };
     case "beforeMCPExecution":
     case "afterMCPExecution":
-      return mcpToolInput(input.tool_input);
+      return toolInputRecord(input.tool_input);
     case "beforeReadFile":
     case "afterFileEdit":
       return { file_path: input.file_path ?? "" };
@@ -3862,6 +3865,12 @@ function writeJsonObject(file, value) {
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `);
 }
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function withoutStroqGroups(groups, isOurs) {
+  return groups.filter(isPlainObject).map(
+    (group) => Array.isArray(group["hooks"]) ? { ...group, hooks: group["hooks"].filter((handler) => !isOurs(handler)) } : group
+  ).filter((group) => !Array.isArray(group["hooks"]) || group["hooks"].length > 0);
+}
 
 // src/commands/cursor-hooks.ts
 var CURSOR_HOOKS_VERSION = 1;
@@ -3896,13 +3905,98 @@ function installCursorHooks(file, command) {
   return merged;
 }
 
-// src/commands/init.ts
+// src/commands/codex-hooks.ts
 import { homedir as homedir6 } from "os";
-import { join as join9, resolve as resolve2 } from "path";
+import { join as join9 } from "path";
+var CODEX_PRE_MATCHER = "Bash|exec_command|shell|local_shell|apply_patch|ApplyPatch|mcp__.*";
+var CODEX_POST_MATCHER = "Bash|exec_command|shell|local_shell|mcp__.*";
+var CODEX_EVENT_NAMES = [
+  "SessionStart",
+  "SessionEnd",
+  "SubagentStart",
+  "SubagentStop",
+  "PreToolUse",
+  "PostToolUse",
+  "PermissionRequest",
+  "PreCompact",
+  "PostCompact",
+  "UserPromptSubmit",
+  "Stop",
+  "Interrupt"
+];
+var codexHandler = (command) => ({
+  type: "command",
+  command,
+  timeout: HOOK_TIMEOUT_SECONDS,
+  statusMessage: "Stroq"
+});
+var isStroqCodexHook = (handler) => typeof handler?.command === "string" && / hook codex$/.test(handler.command);
+var groupsOf = (events, event) => {
+  const groups = events[event];
+  return Array.isArray(groups) ? groups : [];
+};
+function nestedEvents(settings) {
+  return isPlainObject(settings.hooks) ? settings.hooks : {};
+}
+function liftableGroups(value) {
+  if (Array.isArray(value)) return value;
+  if (isPlainObject(value)) return [value];
+  return null;
+}
+function eventMapOf(settings) {
+  const merged = { ...nestedEvents(settings) };
+  const lifted = /* @__PURE__ */ new Set();
+  for (const name of CODEX_EVENT_NAMES) {
+    const groups = liftableGroups(settings[name]);
+    if (groups === null) continue;
+    merged[name] = [...groupsOf(merged, name), ...groups];
+    lifted.add(name);
+  }
+  return { events: merged, lifted };
+}
+var otherKeys = (settings, lifted) => Object.fromEntries(
+  Object.entries(settings).filter(([key]) => key !== "hooks" && !lifted.has(key))
+);
+var mergeGroups = (groups, matcher, command) => [
+  ...withoutStroqGroups(
+    groups,
+    (handler) => isStroqCodexHook(handler)
+  ),
+  { matcher, hooks: [codexHandler(command)] }
+];
+function mergeCodexHooks(settings, command) {
+  const { events, lifted } = eventMapOf(settings);
+  return {
+    ...otherKeys(settings, lifted),
+    hooks: {
+      ...events,
+      PreToolUse: mergeGroups(groupsOf(events, "PreToolUse"), CODEX_PRE_MATCHER, command),
+      PostToolUse: mergeGroups(groupsOf(events, "PostToolUse"), CODEX_POST_MATCHER, command)
+    }
+  };
+}
+function hasStroqCodexHook(settings) {
+  return Object.values(nestedEvents(settings)).flatMap((groups) => Array.isArray(groups) ? groups : []).some(
+    (group) => isPlainObject(group) && Array.isArray(group["hooks"]) && group["hooks"].some((handler) => isStroqCodexHook(handler))
+  );
+}
+function codexHooksPath(scope, cwd = process.cwd()) {
+  return scope === "user" ? join9(homedir6(), ".codex", "hooks.json") : join9(cwd, ".codex", "hooks.json");
+}
+var readCodexHooks = (file) => readJsonObject(file);
+function installCodexHooks(file, command) {
+  const merged = mergeCodexHooks(readCodexHooks(file), command);
+  writeJsonObject(file, merged);
+  return merged;
+}
+
+// src/commands/init.ts
+import { homedir as homedir7 } from "os";
+import { join as join10, resolve as resolve2 } from "path";
 import { parseArgs as parseArgs3 } from "util";
 var PRE_MATCHER = "Bash|Write|Edit|MultiEdit|NotebookEdit|Read|WebFetch|mcp__.*";
 var POST_MATCHER = "Read|WebFetch|WebSearch|Bash|Grep|mcp__.*";
-var HOOK_AGENTS = ["claude-code", "cursor"];
+var HOOK_AGENTS = ["claude-code", "cursor", "codex"];
 function hookCommand(node, entry, agent = "claude-code") {
   const loader = entry.endsWith(".ts") ? " --import tsx" : "";
   return `"${node}"${loader} "${entry}" hook ${agent}`;
@@ -3913,11 +4007,7 @@ var stroqHandler = (command) => ({
   timeout: HOOK_TIMEOUT_SECONDS
 });
 var isStroqHandler = (handler) => / hook claude-code$/.test(handler.command);
-function withoutStroq(groups) {
-  return groups.map(
-    (g) => Array.isArray(g.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isStroqHandler(h)) } : g
-  ).filter((g) => !Array.isArray(g.hooks) || g.hooks.length > 0);
-}
+var withoutStroq = (groups) => withoutStroqGroups(groups, (handler) => isStroqHandler(handler));
 function mergeHooks(settings, command) {
   const hooks = settings.hooks ?? {};
   return {
@@ -3936,7 +4026,7 @@ function mergeHooks(settings, command) {
   };
 }
 function settingsPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? join9(homedir6(), ".claude", "settings.json") : join9(cwd, ".claude", "settings.json");
+  return scope === "user" ? join10(homedir7(), ".claude", "settings.json") : join10(cwd, ".claude", "settings.json");
 }
 var readSettings = (file) => readJsonObject(file);
 function installHooks(file, command) {
@@ -3979,6 +4069,30 @@ Restart Cursor, then run "stroq doctor" to verify.
   );
   return 0;
 }
+var CODEX_NOTE = `On older Codex releases hooks are opt-in: set [features] hooks = true in ~/.codex/config.toml.
+Project hooks load only once you trust this project's .codex/ layer (Codex asks the first time);
+"stroq init --agent codex --user" writes ~/.codex/hooks.json instead and skips that prompt.
+Events an existing file kept at its root are migrated under the official "hooks" wrapper; nothing is dropped.
+`;
+function initCodex(scope, command, dryRun) {
+  const file = codexHooksPath(scope);
+  if (dryRun) {
+    process.stdout.write(
+      `${JSON.stringify(mergeCodexHooks(readCodexHooks(file), command), null, 2)}
+`
+    );
+    return 0;
+  }
+  installCodexHooks(file, command);
+  process.stdout.write(
+    `Stroq hooks installed in ${file}
+  PreToolUse  \u2192 ${CODEX_PRE_MATCHER}
+  PostToolUse \u2192 ${CODEX_POST_MATCHER}
+${CODEX_NOTE}Run "stroq doctor" to verify.
+`
+  );
+  return 0;
+}
 async function runInit(args) {
   const { values } = parseArgs3({
     args: [...args],
@@ -3997,7 +4111,12 @@ async function runInit(args) {
   const scope = values.user ? "user" : "project";
   const dryRun = values["dry-run"] === true;
   const command = hookCommand(process.execPath, resolve2(process.argv[1] ?? ""), agent);
-  return agent === "cursor" ? initCursor(scope, command, dryRun) : initClaudeCode(scope, command, dryRun);
+  const install = {
+    "claude-code": initClaudeCode,
+    cursor: initCursor,
+    codex: initCodex
+  };
+  return install[agent](scope, command, dryRun);
 }
 
 // src/commands/doctor.ts
@@ -4019,20 +4138,28 @@ function checkCursorHooks(file) {
     return { installed: false, error: err.message };
   }
 }
+function checkCodexHooks(file) {
+  try {
+    return { installed: hasStroqCodexHook(readCodexHooks(file)), error: null };
+  } catch (err) {
+    return { installed: false, error: err.message };
+  }
+}
 function agentScopes(cwd, pathFor, check) {
   return ["project", "user"].map((scope) => {
     const file = pathFor(scope, cwd);
     return { scope, file, ...check(file) };
   });
 }
-function hooksCheck(name, scopes, other) {
+function hooksCheck(name, scopes, others) {
   const broken = scopes.some((s) => s.error !== null);
   const installed = scopes.some((s) => s.installed);
+  const carrying = others.filter((o) => o.installed).map((o) => o.name);
   const perScope = scopes.map((s) => s.error ?? `${s.scope}: ${s.installed ? "installed" : "missing"} (${s.file})`).join("; ");
   return {
     name,
-    ok: !broken && (installed || other.installed),
-    detail: !broken && !installed && other.installed ? `not installed (ok: ${other.name} are)` : perScope
+    ok: !broken && (installed || carrying.length > 0),
+    detail: !broken && !installed && carrying.length > 0 ? `not installed (ok: ${carrying.join(", ")} are)` : perScope
   };
 }
 function secretsDetail(stats) {
@@ -4047,7 +4174,7 @@ function secretsDetail(stats) {
 }
 async function checkSecrets() {
   try {
-    const stats = await new FileSecretIndex(secretsFile(), homedir7()).stats();
+    const stats = await new FileSecretIndex(secretsFile(), homedir8()).stats();
     const ok = !stats.corrupt && stats.unreadable === 0 && !stats.truncated;
     return { name: "secrets", ok, detail: secretsDetail(stats) };
   } catch (err) {
@@ -4058,10 +4185,22 @@ async function doctorReport(cwd = process.cwd()) {
   const major = Number(process.versions.node.split(".")[0]);
   const rules = loadBundledRules();
   const detected = scanContent(rules, SAMPLE).verdict === "suspect";
-  const claude = agentScopes(cwd, settingsPath, checkClaudeHooks);
-  const cursor = agentScopes(cwd, cursorHooksPath, checkCursorHooks);
-  const claudeAgent = { name: "hooks", installed: claude.some((s) => s.installed) };
-  const cursorAgent = { name: "cursor hooks", installed: cursor.some((s) => s.installed) };
+  const agents = [
+    { name: "hooks", scopes: agentScopes(cwd, settingsPath, checkClaudeHooks) },
+    { name: "cursor hooks", scopes: agentScopes(cwd, cursorHooksPath, checkCursorHooks) },
+    { name: "codex hooks", scopes: agentScopes(cwd, codexHooksPath, checkCodexHooks) }
+  ];
+  const statuses = agents.map((a) => ({
+    name: a.name,
+    installed: a.scopes.some((s) => s.installed)
+  }));
+  const hookChecks = agents.map(
+    (agent, i) => hooksCheck(
+      agent.name,
+      agent.scopes,
+      statuses.filter((_, j) => j !== i)
+    )
+  );
   const home = stroqHome();
   const secrets = await checkSecrets();
   return {
@@ -4073,8 +4212,7 @@ async function doctorReport(cwd = process.cwd()) {
         ok: detected,
         detail: detected ? "injection sample detected" : "injection sample NOT detected"
       },
-      hooksCheck("hooks", claude, cursorAgent),
-      hooksCheck("cursor hooks", cursor, claudeAgent),
+      ...hookChecks,
       {
         name: "home",
         ok: true,
@@ -4092,6 +4230,252 @@ async function runDoctor() {
   return report.checks.every((c) => c.ok) ? 0 : 1;
 }
 
+// src/adapters/codex.ts
+import { z as z5 } from "zod";
+
+// src/adapters/codex-input.ts
+var BASH_TOOLS = /* @__PURE__ */ new Set(["Bash", "exec_command", "shell", "local_shell"]);
+var PATCH_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "ApplyPatch"]);
+var isBashTool = (name) => BASH_TOOLS.has(name);
+var isPatchTool = (name) => PATCH_TOOLS.has(name);
+var CODEX_HIGH_IMPACT_TOOL = /^(Bash|exec_command|shell|local_shell|apply_patch|ApplyPatch|mcp__)/;
+function codexToolName(rawTool) {
+  if (isPatchTool(rawTool)) return "Write";
+  if (isBashTool(rawTool)) return "Bash";
+  if (rawTool.startsWith("mcp__")) return mcpToolName("", rawTool);
+  return rawTool;
+}
+var ARGV_SHELL = /^(?:\/\w+\/)*(?:bash|sh|zsh|dash)$/;
+var ARGV_SHELL_FLAG = /^-[eilx]{0,3}c[eilx]{0,2}$/;
+var NEEDS_QUOTING = /[\s'"$`\\|&;<>()*?[\]#~]/;
+var quoteArg = (arg) => NEEDS_QUOTING.test(arg) ? `'${arg.replace(/'/g, "'\\''")}'` : arg;
+function joinArgv(values) {
+  const argv = values.filter((v) => typeof v === "string");
+  const [shell, flag, ...rest] = argv;
+  const isShellCall = shell !== void 0 && flag !== void 0 && rest.length > 0 && ARGV_SHELL.test(shell) && ARGV_SHELL_FLAG.test(flag);
+  return isShellCall ? rest.join(" ") : argv.map(quoteArg).join(" ");
+}
+var COMMAND_FIELDS = ["command", "cmd", "input", "script", "raw"];
+var NESTED_TEXT_FIELDS = ["text", "command", "cmd"];
+function nestedText(value) {
+  if (!isRecord(value)) return "";
+  for (const key of NESTED_TEXT_FIELDS) {
+    const inner = value[key];
+    if (typeof inner === "string" && inner !== "") return inner;
+  }
+  return "";
+}
+var fieldCommand = (value) => {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return joinArgv(value);
+  return nestedText(value);
+};
+function commandCandidates(toolInput) {
+  if (Array.isArray(toolInput)) {
+    const joined = joinArgv(toolInput);
+    return joined === "" ? [] : [joined];
+  }
+  const record = toolInputRecord(toolInput);
+  const found = /* @__PURE__ */ new Set();
+  for (const key of COMMAND_FIELDS) {
+    const text = fieldCommand(record[key]);
+    if (text !== "") found.add(text);
+  }
+  return [...found];
+}
+var commandOf = (toolInput) => commandCandidates(toolInput)[0] ?? "";
+var PATCH_FIELDS = ["command", "input", "patch", "raw", "cmd", "script", "arguments"];
+var stripBom = (text) => text.startsWith("\uFEFF") ? text.slice(1) : text;
+var joinLines = (values) => values.filter((v) => typeof v === "string").map(stripBom).join("\n");
+function patchFieldTexts(value, depth) {
+  if (typeof value === "string") return value === "" ? [] : [stripBom(value)];
+  if (Array.isArray(value)) {
+    const joined = joinLines(value);
+    return joined === "" ? [] : [joined];
+  }
+  if (depth > 0 && isRecord(value))
+    return PATCH_FIELDS.flatMap((key) => patchFieldTexts(value[key], depth - 1));
+  return [];
+}
+function patchTextOf(toolInput) {
+  if (Array.isArray(toolInput)) return joinLines(toolInput);
+  const record = toolInputRecord(toolInput);
+  return PATCH_FIELDS.flatMap((key) => patchFieldTexts(record[key], 1)).join("\n");
+}
+var PATCH_HEADER = /^\*\*\* (?:Add File|Update File|Delete File|Move to):[ \t]*([^\r\n]*?)[ \t\r]*$/;
+function applyPatchPaths(patchText) {
+  const paths = /* @__PURE__ */ new Set();
+  for (const line of patchText.split("\n")) {
+    const path = PATCH_HEADER.exec(line)?.[1] ?? "";
+    if (path !== "") paths.add(path);
+  }
+  return [...paths];
+}
+function codexToolInput(input) {
+  if (isBashTool(input.tool_name)) return { command: commandOf(input.tool_input) };
+  if (isPatchTool(input.tool_name)) {
+    const paths = applyPatchPaths(patchTextOf(input.tool_input));
+    return { file_path: paths[0] ?? "", file_paths: [...paths] };
+  }
+  return toolInputRecord(input.tool_input);
+}
+function isEmptyToolInput(value) {
+  if (value === void 0 || value === null || value === "") return true;
+  if (Array.isArray(value)) return value.length === 0;
+  return isRecord(value) && Object.keys(value).length === 0;
+}
+function describeToolInput(value) {
+  if (Array.isArray(value)) return "array";
+  if (isRecord(value)) return Object.keys(value).sort().join(", ");
+  return value === null ? "null" : typeof value;
+}
+
+// src/adapters/codex.ts
+var CODEX_EVENTS = ["PreToolUse", "PostToolUse"];
+var CodexHookInputSchema = z5.looseObject({
+  session_id: z5.string().min(1),
+  hook_event_name: z5.enum(CODEX_EVENTS),
+  tool_name: z5.string(),
+  tool_input: z5.unknown().optional(),
+  tool_response: z5.unknown().optional(),
+  cwd: z5.string().default(""),
+  // Never read; see the note above.
+  model: z5.unknown().optional(),
+  permission_mode: z5.unknown().optional(),
+  transcript_path: z5.unknown().optional(),
+  turn_id: z5.unknown().optional(),
+  tool_use_id: z5.unknown().optional()
+});
+function codexResultText(response) {
+  if (response && typeof response === "object" && !Array.isArray(response)) {
+    const record = response;
+    const output = record["output"];
+    if (typeof output === "string" && output !== "") return toolResultToText(output);
+    const streams = [record["stdout"], record["stderr"]].filter(
+      (part) => typeof part === "string" && part.length > 0
+    );
+    if (streams.length > 0) return toolResultToText(streams.join("\n"));
+  }
+  return toolResultToText(response);
+}
+var envelope = (event, fields) => ({
+  stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: event, ...fields } }),
+  exitCode: 0
+});
+var codexDenyOutput = (reason) => envelope("PreToolUse", { permissionDecision: "deny", permissionDecisionReason: reason });
+var codexContextOutput = (context) => envelope("PostToolUse", { additionalContext: context });
+var codexBlockOutput = (reason) => ({
+  stdout: "",
+  stderr: reason,
+  exitCode: 2
+});
+var askAsDeny = (decision) => `Stroq would ask before this action (${decision.ruleId}): ${decision.reason}. Codex hooks cannot prompt, so it is denied; run it yourself or relax the rule in ~/.stroq/policy.yaml.`;
+function renderDecision2(decision, provenance, secrets, now = /* @__PURE__ */ new Date()) {
+  if (decision.effect === "allow") return NO_OUTPUT;
+  const headline = decision.effect === "deny" ? `Stroq blocked this action (${decision.ruleId}): ${decision.reason}` : askAsDeny(decision);
+  return codexDenyOutput(withEvidence(headline, provenance, now, secrets));
+}
+var MAX_PATCH_PATHS = 64;
+var CODEX_PATCH_TOO_LARGE = {
+  effect: "deny",
+  ruleId: "codex-patch-too-large",
+  reason: `the patch declares more than ${MAX_PATCH_PATHS} files, more than Stroq can classify inside Codex's hook timeout`
+};
+var codexUnreadableInput = (shape) => ({
+  effect: "deny",
+  ruleId: "codex-unreadable-input",
+  reason: `Stroq could not read the command or patch from Codex's tool_input (keys: ${shape}); denied fail-closed. Report the payload shape at https://github.com/AGGIB/Stroq/issues`
+});
+var asPaths = (value) => Array.isArray(value) ? value.filter((p) => typeof p === "string") : [];
+function unreadableInput(input, guards) {
+  const bash = isBashTool(input.tool_name);
+  const patch = isPatchTool(input.tool_name);
+  if (!bash && !patch) return null;
+  if (isEmptyToolInput(input.tool_input)) return null;
+  const readable = bash ? guards.commands.length > 0 : guards.patchPaths.length > 0;
+  return readable ? null : codexUnreadableInput(describeToolInput(input.tool_input));
+}
+function preInputs(toolInput, guards) {
+  if (guards.commands.length > 1)
+    return guards.commands.map((command) => ({ ...toolInput, command }));
+  if (guards.patchPaths.length > 1)
+    return guards.patchPaths.map((file_path) => ({ ...toolInput, file_path }));
+  return [{ ...toolInput }];
+}
+var SEVERITY = { allow: 0, ask: 1, deny: 2 };
+async function decidePre(engine, event, inputs) {
+  const [first, ...rest] = inputs;
+  if (!first) throw new Error("decidePre: inputs must be non-empty");
+  let worst = await engine.pre({ ...event, toolInput: first });
+  for (const toolInput of rest) {
+    const next = await engine.pre({ ...event, toolInput });
+    if (SEVERITY[next.decision.effect] > SEVERITY[worst.decision.effect]) worst = next;
+  }
+  return worst;
+}
+async function denyDirectly(event, decision, summary) {
+  await new AuditLog(auditFile()).append({
+    sessionId: event.sessionId,
+    phase: "pre",
+    tool: event.toolName,
+    summary,
+    classes: [],
+    decision
+  });
+  return renderDecision2(decision, [], []);
+}
+function preGuards(input, toolInput) {
+  const found = {
+    commands: isBashTool(input.tool_name) ? commandCandidates(input.tool_input) : [],
+    patchPaths: isPatchTool(input.tool_name) ? asPaths(toolInput["file_paths"]) : []
+  };
+  return { ...found, unreadable: unreadableInput(input, found) };
+}
+async function handlePre(engine, event, guards) {
+  if (guards.unreadable)
+    return denyDirectly(event, guards.unreadable, "codex: unreadable tool_input");
+  if (guards.patchPaths.length > MAX_PATCH_PATHS)
+    return denyDirectly(
+      event,
+      CODEX_PATCH_TOO_LARGE,
+      `apply_patch: ${guards.patchPaths.length} files`
+    );
+  const { decision, provenance, secrets } = await decidePre(
+    engine,
+    event,
+    preInputs(event.toolInput, guards)
+  );
+  return renderDecision2(decision, provenance, secrets);
+}
+async function handlePost(engine, event, response) {
+  const result = await engine.post({ ...event, toolResultText: codexResultText(response) });
+  if (result.provenanceError) logError("provenance", result.provenanceError);
+  if (!result.scanned || result.scan.verdict !== "suspect") return NO_OUTPUT;
+  return codexContextOutput(warningFor(result.scan, event.toolName));
+}
+async function handleCodexHook(engine, raw) {
+  const input = CodexHookInputSchema.parse(raw);
+  const toolInput = codexToolInput(input);
+  const event = {
+    sessionId: input.session_id,
+    toolName: codexToolName(input.tool_name),
+    toolInput,
+    cwd: input.cwd || process.cwd()
+  };
+  if (input.hook_event_name === "PostToolUse")
+    return handlePost(engine, event, input.tool_response);
+  return handlePre(engine, event, preGuards(input, toolInput));
+}
+function codexFailClosedOutput(raw, err) {
+  const record = raw && typeof raw === "object" ? raw : {};
+  const event = record["hook_event_name"];
+  const tool = record["tool_name"];
+  if (typeof event === "string" && event !== "PreToolUse") return NO_OUTPUT;
+  if (typeof tool === "string" && !CODEX_HIGH_IMPACT_TOOL.test(tool)) return NO_OUTPUT;
+  const message = err instanceof Error ? err.message : String(err);
+  return codexBlockOutput(`Stroq internal error (fail-closed): ${message}`);
+}
+
 // src/commands/hook.ts
 async function readStdin(stream = process.stdin) {
   let data = "";
@@ -4105,6 +4489,14 @@ var ADAPTERS = {
     handle: handleCursorHook,
     failClosed: cursorFailClosedOutput,
     badJson: cursorDenyOutput
+  },
+  // Codex answers a block with exit code 2 and the reason on stderr, not with JSON:
+  // stdin that was not JSON at all is exactly the case where a JSON deny would be
+  // dropped as an unsupported/unparseable payload, i.e. fail open.
+  codex: {
+    handle: handleCodexHook,
+    failClosed: codexFailClosedOutput,
+    badJson: codexBlockOutput
   }
 };
 var SUPPORTED_AGENTS = Object.keys(ADAPTERS);
@@ -4132,6 +4524,16 @@ async function runHook(agent, rawJson) {
     return adapter.failClosed(raw, err);
   }
 }
+async function runHookCommand(agent, read = readStdin) {
+  try {
+    return await runHook(agent, await read());
+  } catch (err) {
+    if (agent !== "codex") throw err;
+    logError(`hook ${agent}`, err);
+    const message = err instanceof Error ? err.message : String(err);
+    return codexBlockOutput(`Stroq internal error (fail-closed): ${message}`);
+  }
+}
 
 // src/commands/log.ts
 import { parseArgs as parseArgs4 } from "util";
@@ -4160,13 +4562,13 @@ async function runLog(args) {
 // src/commands/untaint.ts
 import { existsSync as existsSync4, readdirSync as readdirSync4 } from "fs";
 import { rm as rm5 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { parseArgs as parseArgs5 } from "util";
 var USAGE = "usage: stroq untaint --session <id> | --all\n";
 async function clearAll() {
   const dir = sessionsDir();
   if (!existsSync4(dir)) return;
-  await Promise.all(readdirSync4(dir).map((f) => rm5(join10(dir, f), { force: true })));
+  await Promise.all(readdirSync4(dir).map((f) => rm5(join11(dir, f), { force: true })));
 }
 async function runUntaint(args) {
   const { values } = parseArgs5({
@@ -4255,8 +4657,8 @@ var USAGE2 = `stroq <command>
 
 Commands:
   init [--agent <name>] [--user] [--dry-run]
-                                     install hooks (--agent claude-code | cursor; project config by default)
-  hook <claude-code|cursor>          hook entrypoint: reads the event JSON on stdin, prints a decision
+                                     install hooks (--agent claude-code | cursor | codex; project config by default)
+  hook <claude-code|cursor|codex>    hook entrypoint: reads the event JSON on stdin, prints a decision
   doctor                             check the installation
   log [--count 20]                   show recent audit entries
   verify                             verify the audit hash chain
@@ -4269,8 +4671,9 @@ async function main(argv) {
   const [command, ...rest] = argv;
   switch (command) {
     case "hook": {
-      const out = await runHook(rest[0] ?? "", await readStdin());
+      const out = await runHookCommand(rest[0] ?? "");
       if (out.stdout) process.stdout.write(out.stdout);
+      if (out.stderr) process.stderr.write(out.stderr);
       return out.exitCode;
     }
     case "init":