@webpieces/ai-hook-rules 0.4.703 → 0.4.705

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/ai-hook-rules",
-  "version": "0.4.703",
+  "version": "0.4.705",
   "description": "Pluggable write-time validation framework for AI coding agents (@webpieces/ai-hook-rules). Claude Code PreToolUse + openclaw before_tool_call adapters share one rule engine.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -25,7 +25,9 @@
     "directory": "packages/tooling/ai-hook-rules"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.703"
+    "@webpieces/rules-config": "0.4.705",
+    "inversify": "7.10.4",
+    "reflect-metadata": "0.2.2"
   },
   "publishConfig": {
     "access": "public"

package/src/adapters/agent-adapters.d.ts

@@ -0,0 +1,13 @@
+import { AgentPayload } from './agent-payload';
+import { AgentHookEvent } from '../core/agent-event';
+/**
+ * The ONE place a payload is routed to its harness's adapter. Every other module takes an
+ * `AgentHookEvent` and never asks which agent produced it — except the two codex-only surfaces
+ * (read parity, the shared-tree subagent guard), which check `aiType` explicitly and say so.
+ */
+export declare class AgentAdapters {
+    private readonly claude;
+    private readonly codex;
+    envelope(payload: AgentPayload): AgentHookEvent;
+    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent;
+}

package/src/adapters/agent-adapters.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentAdapters = void 0;
+const detect_ai_1 = require("./detect-ai");
+const claude_code_adapter_1 = require("./claude-code-adapter");
+const codex_adapter_1 = require("./codex-adapter");
+/**
+ * The ONE place a payload is routed to its harness's adapter. Every other module takes an
+ * `AgentHookEvent` and never asks which agent produced it — except the two codex-only surfaces
+ * (read parity, the shared-tree subagent guard), which check `aiType` explicitly and say so.
+ */
+class AgentAdapters {
+    claude = new claude_code_adapter_1.ClaudeCodeAdapter();
+    codex = new codex_adapter_1.CodexAdapter();
+    envelope(payload) {
+        return (0, detect_ai_1.detectAiType)(payload) === 'codex' ? this.codex.envelope(payload) : this.claude.envelope(payload);
+    }
+    toEvent(payload, cwd) {
+        return (0, detect_ai_1.detectAiType)(payload) === 'codex' ? this.codex.toEvent(payload, cwd) : this.claude.toEvent(payload, cwd);
+    }
+}
+exports.AgentAdapters = AgentAdapters;
+//# sourceMappingURL=agent-adapters.js.map

package/src/adapters/agent-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-adapters.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/agent-adapters.ts"],"names":[],"mappings":";;;AAEA,2CAA2C;AAC3C,+DAA0D;AAC1D,mDAA+C;AAE/C;;;;GAIG;AACH,MAAa,aAAa;IACL,MAAM,GAAG,IAAI,uCAAiB,EAAE,CAAC;IACjC,KAAK,GAAG,IAAI,4BAAY,EAAE,CAAC;IAE5C,QAAQ,CAAC,OAAqB;QAC1B,OAAO,IAAA,wBAAY,EAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,CAAC,OAAqB,EAAE,GAAW;QACtC,OAAO,IAAA,wBAAY,EAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpH,CAAC;CACJ;AAXD,sCAWC","sourcesContent":["import { AgentPayload } from './agent-payload';\nimport { AgentHookEvent } from '../core/agent-event';\nimport { detectAiType } from './detect-ai';\nimport { ClaudeCodeAdapter } from './claude-code-adapter';\nimport { CodexAdapter } from './codex-adapter';\n\n/**\n * The ONE place a payload is routed to its harness's adapter. Every other module takes an\n * `AgentHookEvent` and never asks which agent produced it — except the two codex-only surfaces\n * (read parity, the shared-tree subagent guard), which check `aiType` explicitly and say so.\n */\nexport class AgentAdapters {\n    private readonly claude = new ClaudeCodeAdapter();\n    private readonly codex = new CodexAdapter();\n\n    envelope(payload: AgentPayload): AgentHookEvent {\n        return detectAiType(payload) === 'codex' ? this.codex.envelope(payload) : this.claude.envelope(payload);\n    }\n\n    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent {\n        return detectAiType(payload) === 'codex' ? this.codex.toEvent(payload, cwd) : this.claude.toEvent(payload, cwd);\n    }\n}\n"]}

package/src/adapters/agent-payload.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The RAW PreToolUse wire envelope, as it arrives on stdin.
+ *
+ * ONE shape for both harnesses, because that is what was measured: Codex uses the SAME key names as
+ * Claude Code (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`,
+ * `agent_id`, `agent_type`) and merely ADDS `model`, `turn_id` and `tool_use_id`. A second payload
+ * type for the second harness would be two spellings of one thing.
+ *
+ * Interfaces, not classes, and deliberately so: nothing in this codebase ever CONSTRUCTS one of these.
+ * They describe bytes somebody else wrote, which `JSON.parse` hands back as a plain object — the same
+ * reason the shape this replaces was an interface.
+ */
+export interface AgentPayload {
+    tool_name: string;
+    tool_input: AgentToolInput;
+    /** The session's current working directory. Used to scope guards to the tree the agent is in. */
+    cwd?: string;
+    session_id?: string;
+    /** Empty/absent ⇒ the coordinator, populated ⇒ a subagent. MEASURED identical in both harnesses. */
+    agent_id?: string;
+    agent_type?: string;
+    /** Codex-only, and REQUIRED there. The one discriminator — see ./detect-ai.ts. */
+    turn_id?: string;
+}
+export interface AgentToolInput {
+    file_path?: string;
+    content?: string;
+    old_string?: string;
+    new_string?: string;
+    edits?: AgentEditEntry[];
+    command?: string;
+}
+export interface AgentEditEntry {
+    old_string?: string;
+    new_string?: string;
+}
+export declare class AgentPayloadParser {
+    /**
+     * Returns null for empty stdin (nothing to judge); throws InformAiError on unparseable bytes.
+     *
+     * The message still names Claude Code even though this path is shared, and that is DELIBERATE and
+     * temporary: the overriding constraint on this change is that no Claude Code behaviour moves, and a
+     * user-visible string is behaviour. Renaming it is a one-line follow-up once the Codex path is
+     * actually armed (it cannot mislead anyone before then — no Codex session reaches this code until
+     * the installer lands).
+     */
+    parse(raw: string): AgentPayload | null;
+}

package/src/adapters/agent-payload.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentPayloadParser = void 0;
+const types_1 = require("../core/types");
+const to_error_1 = require("../core/to-error");
+class AgentPayloadParser {
+    /**
+     * Returns null for empty stdin (nothing to judge); throws InformAiError on unparseable bytes.
+     *
+     * The message still names Claude Code even though this path is shared, and that is DELIBERATE and
+     * temporary: the overriding constraint on this change is that no Claude Code behaviour moves, and a
+     * user-visible string is behaviour. Renaming it is a one-line follow-up once the Codex path is
+     * actually armed (it cannot mislead anyone before then — no Codex session reaches this code until
+     * the installer lands).
+     */
+    parse(raw) {
+        if (!raw || raw.trim() === '')
+            return null;
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            throw new types_1.InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });
+        }
+    }
+}
+exports.AgentPayloadParser = AgentPayloadParser;
+//# sourceMappingURL=agent-payload.js.map

package/src/adapters/agent-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-payload.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/agent-payload.ts"],"names":[],"mappings":";;;AAAA,yCAA8C;AAC9C,+CAA2C;AAyC3C,MAAa,kBAAkB;IAC3B;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAW;QACb,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3C,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,qBAAa,CAAC,gDAAgD,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;CACJ;AApBD,gDAoBC","sourcesContent":["import { InformAiError } from '../core/types';\nimport { toError } from '../core/to-error';\n\n/**\n * The RAW PreToolUse wire envelope, as it arrives on stdin.\n *\n * ONE shape for both harnesses, because that is what was measured: Codex uses the SAME key names as\n * Claude Code (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`,\n * `agent_id`, `agent_type`) and merely ADDS `model`, `turn_id` and `tool_use_id`. A second payload\n * type for the second harness would be two spellings of one thing.\n *\n * Interfaces, not classes, and deliberately so: nothing in this codebase ever CONSTRUCTS one of these.\n * They describe bytes somebody else wrote, which `JSON.parse` hands back as a plain object — the same\n * reason the shape this replaces was an interface.\n */\nexport interface AgentPayload {\n    tool_name: string;\n    tool_input: AgentToolInput;\n    /** The session's current working directory. Used to scope guards to the tree the agent is in. */\n    cwd?: string;\n    session_id?: string;\n    /** Empty/absent ⇒ the coordinator, populated ⇒ a subagent. MEASURED identical in both harnesses. */\n    agent_id?: string;\n    agent_type?: string;\n    /** Codex-only, and REQUIRED there. The one discriminator — see ./detect-ai.ts. */\n    turn_id?: string;\n}\n\nexport interface AgentToolInput {\n    file_path?: string;\n    content?: string;\n    old_string?: string;\n    new_string?: string;\n    edits?: AgentEditEntry[];\n    command?: string;\n}\n\nexport interface AgentEditEntry {\n    old_string?: string;\n    new_string?: string;\n}\n\nexport class AgentPayloadParser {\n    /**\n     * Returns null for empty stdin (nothing to judge); throws InformAiError on unparseable bytes.\n     *\n     * The message still names Claude Code even though this path is shared, and that is DELIBERATE and\n     * temporary: the overriding constraint on this change is that no Claude Code behaviour moves, and a\n     * user-visible string is behaviour. Renaming it is a one-line follow-up once the Codex path is\n     * actually armed (it cannot mislead anyone before then — no Codex session reaches this code until\n     * the installer lands).\n     */\n    parse(raw: string): AgentPayload | null {\n        if (!raw || raw.trim() === '') return null;\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            return JSON.parse(raw) as AgentPayload;\n        } catch (err: unknown) {\n            const error = toError(err);\n            throw new InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });\n        }\n    }\n}\n"]}

package/src/adapters/agent-response.d.ts

@@ -0,0 +1,6 @@
+import { AgentHookEvent } from '../core/agent-event';
+import { HookOutcome } from './hook-outcome';
+export declare function denyJson(event: AgentHookEvent | null, reason: string): string;
+export declare function denyOutcome(event: AgentHookEvent | null, reason: string, rule?: string, fault?: string): HookOutcome;
+export declare function emitDeny(event: AgentHookEvent | null, reason: string, rule?: string, fault?: string): never;
+export declare function emitAllow(): never;

package/src/adapters/{claude-code-response.js → agent-response.js}

@@ -1,6 +1,6 @@
 "use strict";
-// The single place that knows Claude Code's PreToolUse decision protocol, so every deny in the
-// Claude Code adapter is emitted identically — and identically to the checked-in shim
+// The single place that knows the PreToolUse decision protocol, so every deny is emitted identically
+// — and identically to the checked-in shim
 // (.claude/webpieces/ai-hook.sh, rendered by renderShim() in ../bin/shim.ts), which emits the same JSON.
 //
 // A block is signalled by `permissionDecision: "deny"` JSON on STDOUT with exit 0 — NOT exit 2.
@@ -28,10 +28,12 @@
 // Refs: Claude Code GitHub issues #31592, #40380, #17356 (asymmetry "closed / not planned").
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.denyJson = denyJson;
+exports.denyOutcome = denyOutcome;
 exports.emitDeny = emitDeny;
 exports.emitAllow = emitAllow;
 const decision_log_1 = require("../core/decision-log");
 const l0_fault_codes_1 = require("../core/l0-fault-codes");
+const hook_outcome_1 = require("./hook-outcome");
 // ANSI escape (0x1b) built at runtime so no raw ESC byte sits in source. ANSI red is a *bonus* — the
 // 🛑 prefix + reason stay meaningful if a future/CI renderer strips the color. One place = one escape.
 const ESC = String.fromCharCode(0x1b);
@@ -47,52 +49,84 @@ const ESC = String.fromCharCode(0x1b);
  * The reset (`[0m`) still closes the sequence on the same line it opened, so nothing leaks into the
  * body or into whatever the terminal prints next.
  */
+// webpieces-disable no-function-outside-class -- private helper of the PreToolUse protocol boundary below; this module must stay callable from a tree too broken to build a DI container
 function redSystemMessage(reason) {
     const nl = reason.indexOf('\n');
     if (nl < 0)
         return `${ESC}[31;1m🛑 ${reason}${ESC}[0m`;
     return `${ESC}[31;1m🛑 ${reason.slice(0, nl)}${ESC}[0m${reason.slice(nl)}`;
 }
-function denyJson(reason, toolName) {
+// Takes the EVENT rather than a tool-name string, because the one thing this decision needs is the
+// event's routing kind, and the harnesses spell their tool names differently (`Bash` vs `apply_patch`)
+// while agreeing on the kind. The emitted bytes are identical for both harnesses — Codex accepts the
+// same `permissionDecision: "deny"` + `permissionDecisionReason` + `systemMessage` fields, and rejects
+// nothing we emit. It does hard-reject an EMPTY `permissionDecisionReason` where Claude tolerates one,
+// which is why emitDeny below refuses to send one.
+// webpieces-disable no-function-outside-class -- the PreToolUse wire shape itself, module-scope beside emitDeny/emitAllow by design, and it must stay callable from a tree too broken to build a DI container
+function denyJson(event, reason) {
+    // NEVER an empty reason, and the check lives HERE because this function owns the wire shape. Codex
+    // hard-rejects a deny whose permissionDecisionReason is empty (Claude tolerates it and shows the
+    // human nothing), so an empty one is not a cosmetic defect — it is a block that silently fails to
+    // block. Every call site passes prose; this is the backstop that keeps a future one from turning a
+    // deny into a protocol error.
+    const safe = reason.trim() === '' ? '[ai-hooks] blocked, but the guard produced no reason — failing closed.' : reason;
     const hookSpecificOutput = {
         hookEventName: 'PreToolUse',
         permissionDecision: 'deny',
-        permissionDecisionReason: reason,
+        permissionDecisionReason: safe,
     };
     // Bash only: permissionDecisionReason is NOT user-visible, so add the red systemMessage.
-    if (toolName === 'Bash') {
-        return JSON.stringify({ systemMessage: redSystemMessage(reason), hookSpecificOutput });
+    if (event !== null && event.kind === 'Bash') {
+        return JSON.stringify({ systemMessage: redSystemMessage(safe), hookSpecificOutput });
     }
     // Write/Edit/MultiEdit (and anything else): reason renders red natively; no systemMessage.
     return JSON.stringify({ hookSpecificOutput });
 }
-// Block the tool call and surface `reason` to both the user (terminal UI) and the model. `toolName`
-// selects whether the red `systemMessage` is added (Bash) or omitted (file tools) — see denyJson.
-// emitDeny/emitAllow are the hook's designated terminal boundary — the exit code IS the Claude Code
-// PreToolUse protocol (exit 0 + JSON = the contract), so the process.exit stays and is allowlisted.
+// THE DENY, AS A VALUE. `reason` is surfaced to both the user (terminal UI) and the model; the event's
+// kind selects whether the red `systemMessage` is added (Bash) or omitted (file tools) — see denyJson.
 //
-// Being the ONE boundary every path exits through is also why the per-invocation audit line is
-// flushed HERE: the `calls/` stream carries the outcome of its own call, and the outcome is not
+// This is the ONE boundary every blocking path passes through, which is why the per-invocation audit
+// line is flushed HERE: the `calls/` stream carries the outcome of its own call, and the outcome is not
 // known until this point. `rule` names what blocked (or '-'), for the line's `rule=` field.
 //
 // `fault` is the L0 fault code when the block IS an L0 fault (S/C/Y — the three decided here in JS,
 // where the sh shim's own `fault=` stamp can never reach), else '-'. Stamping it at this ONE boundary is
 // what makes `grep 'fault=S'` span the whole audit trail rather than only its sh half.
-// webpieces-disable no-function-outside-class -- the Claude Code PreToolUse protocol boundary; module-scope beside denyJson/emitAllow by design, and it must stay callable from a tree too broken to build a DI container.
-function emitDeny(reason, toolName, rule = '-', fault = l0_fault_codes_1.L0_FAULT_NONE) {
+//
+// It RETURNS the outcome instead of writing it. The write and the exit belong to HookApp, which owns
+// the injected stdout/exit ports — that separation is what lets a golden test read the exact bytes a
+// composed run produces. `denyForCrash` (hook-core) needs the value rather than the throw, because it
+// is already INSIDE the catch that would swallow one.
+// webpieces-disable no-function-outside-class -- the Claude Code PreToolUse protocol boundary; module-scope beside denyJson/allowOutcome by design, and it must stay callable from a tree too broken to build a DI container.
+function denyOutcome(event, reason, rule = '-', fault = l0_fault_codes_1.L0_FAULT_NONE) {
     // BLOCK_AI_CURE: every deny that reaches this boundary prints a cure the agent can act on — the
     // L0 faults name a command on the allowlist, and the L1/L2 guards print theirs. A deny needing a
     // HUMAN would have to say so at its own site; none does today, and inventing one here would be
     // guessing at the boundary rather than at the decision.
     decision_log_1.invocationLog.finish('BLOCK_AI_CURE', rule, fault);
-    process.stdout.write(denyJson(reason, toolName) + '\n');
-    // webpieces-disable no-process-exit-outside-main -- hook exit-code IS the Claude Code PreToolUse protocol (exit 0 + JSON = the contract); designated terminal boundary.
-    process.exit(0);
+    return new hook_outcome_1.HookOutcome(denyJson(event, reason) + '\n', 0);
 }
-// Allow the tool call. No JSON needed — a silent exit 0 is "allow" in the PreToolUse protocol.
-function emitAllow() {
+// The ALLOW, as a value. No JSON — a silent exit 0 is "allow" in the PreToolUse protocol.
+//
+// NOT exported, deliberately, where denyOutcome is: `denyForCrash` genuinely needs the deny in value
+// form because it is already inside the catch a throw would land in, and nothing needs the allow that
+// way. An exported one would be a second, externally-pickable spelling of "allow" sitting three lines
+// from `emitAllow` — precisely the shape an agent picks by accident.
+// webpieces-disable no-function-outside-class -- the PreToolUse protocol boundary, module-scope beside denyJson/denyOutcome by design, and it must stay callable from a tree too broken to build a DI container
+function allowOutcome() {
     decision_log_1.invocationLog.finish('ALLOW', '-');
-    // webpieces-disable no-process-exit-outside-main -- hook exit-code IS the Claude Code PreToolUse protocol (silent exit 0 = "allow"); designated terminal boundary.
-    process.exit(0);
+    return new hook_outcome_1.HookOutcome('', 0);
+}
+// Block the tool call and END the invocation from wherever in the pipeline we are — see HookTerminated
+// for why the terminal control flow is a throw now rather than a `process.exit` at the call site. Still
+// typed `never`: nothing after a call to this runs.
+// webpieces-disable no-function-outside-class -- the Claude Code PreToolUse protocol boundary; module-scope beside denyJson/emitAllow by design, and it must stay callable from a tree too broken to build a DI container.
+function emitDeny(event, reason, rule = '-', fault = l0_fault_codes_1.L0_FAULT_NONE) {
+    throw new hook_outcome_1.HookTerminated(denyOutcome(event, reason, rule, fault));
+}
+// Allow the tool call and END the invocation. See emitDeny.
+// webpieces-disable no-function-outside-class -- the PreToolUse protocol boundary, module-scope beside denyJson/emitDeny by design, and it must stay callable from a tree too broken to build a DI container
+function emitAllow() {
+    throw new hook_outcome_1.HookTerminated(allowOutcome());
 }
-//# sourceMappingURL=claude-code-response.js.map
+//# sourceMappingURL=agent-response.js.map

package/src/adapters/agent-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-response.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/agent-response.ts"],"names":[],"mappings":";AAAA,qGAAqG;AACrG,2CAA2C;AAC3C,yGAAyG;AACzG,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,uGAAuG;AACvG,oDAAoD;AACpD,EAAE;AACF,oGAAoG;AACpG,oDAAoD;AACpD,EAAE;AACF,8GAA8G;AAC9G,8GAA8G;AAC9G,8GAA8G;AAC9G,8GAA8G;AAC9G,8GAA8G;AAC9G,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,qGAAqG;AACrG,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,yCAAyC;AACzC,6FAA6F;;AAqC7F,4BAkBC;AAkBD,kCAOC;AAkBD,4BAEC;AAID,8BAEC;AAxGD,uDAAqD;AACrD,2DAAuD;AAEvD,iDAA6D;AAE7D,qGAAqG;AACrG,uGAAuG;AACvG,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,yLAAyL;AACzL,SAAS,gBAAgB,CAAC,MAAc;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,GAAG,GAAG,YAAY,MAAM,GAAG,GAAG,KAAK,CAAC;IACvD,OAAO,GAAG,GAAG,YAAY,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,mGAAmG;AACnG,uGAAuG;AACvG,qGAAqG;AACrG,uGAAuG;AACvG,uGAAuG;AACvG,mDAAmD;AACnD,8MAA8M;AAC9M,SAAgB,QAAQ,CAAC,KAA4B,EAAE,MAAc;IACjE,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC,CAAC,MAAM,CAAC;IACtH,MAAM,kBAAkB,GAAG;QACvB,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,MAAM;QAC1B,wBAAwB,EAAE,IAAI;KACjC,CAAC;IACF,yFAAyF;IACzF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,2FAA2F;IAC3F,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,uGAAuG;AACvG,uGAAuG;AACvG,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,4FAA4F;AAC5F,EAAE;AACF,oGAAoG;AACpG,yGAAyG;AACzG,uFAAuF;AACvF,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,sDAAsD;AACtD,8NAA8N;AAC9N,SAAgB,WAAW,CAAC,KAA4B,EAAE,MAAc,EAAE,OAAe,GAAG,EAAE,QAAgB,8BAAa;IACvH,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,wDAAwD;IACxD,4BAAa,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,IAAI,0BAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,0FAA0F;AAC1F,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,sGAAsG;AACtG,qEAAqE;AACrE,gNAAgN;AAChN,SAAS,YAAY;IACjB,4BAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,0BAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,uGAAuG;AACvG,wGAAwG;AACxG,oDAAoD;AACpD,2NAA2N;AAC3N,SAAgB,QAAQ,CAAC,KAA4B,EAAE,MAAc,EAAE,OAAe,GAAG,EAAE,QAAgB,8BAAa;IACpH,MAAM,IAAI,6BAAc,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,4DAA4D;AAC5D,6MAA6M;AAC7M,SAAgB,SAAS;IACrB,MAAM,IAAI,6BAAc,CAAC,YAAY,EAAE,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["// The single place that knows the PreToolUse decision protocol, so every deny is emitted identically\n// — and identically to the checked-in shim\n// (.claude/webpieces/ai-hook.sh, rendered by renderShim() in ../bin/shim.ts), which emits the same JSON.\n//\n// A block is signalled by `permissionDecision: \"deny\"` JSON on STDOUT with exit 0 — NOT exit 2.\n// Claude Code only parses the JSON on exit 0; exit 2 would ignore stdout and the reason would not\n// surface in the terminal UI. \"deny\" still blocks the tool, so this remains fail-closed: it is not the\n// silent-allow a bare exit 0 with no JSON would be.\n//\n// WHY the tool-conditional `systemMessage` (verified by live tests against Claude Code v2.1.x — the\n// docs are wrong here; do NOT re-derive from them):\n//\n//   | deny field                        | Bash tool                         | Write/Edit/MultiEdit tool     |\n//   |-----------------------------------|-----------------------------------|-------------------------------|\n//   | permissionDecisionReason (plain)  | model sees it; USER SEES NOTHING  | model + RED \"Error:\" block ok |\n//   | systemMessage                     | ONLY user-visible field; grey     | grey extra line (redundant)   |\n//   | systemMessage wrapped in ANSI red | RED + visible to the user (fix)   | redundant 2nd red line        |\n//\n// So: on a **Bash** deny we ALSO emit a top-level `systemMessage` wrapped in ANSI red (ESC[31;1m …\n// ESC[0m) — it is the only field a Bash deny shows the human, and it honors ANSI. On\n// Write/Edit/MultiEdit we add NO `systemMessage` (the reason already renders red natively — a second\n// line is just noise). `permissionDecisionReason` is always plain text (never ANSI): it's what the\n// model reads and what Write/Edit renders red. JSON.stringify serializes the ESC char as the valid\n// \\u escape, so the payload stays valid JSON — we build the ESC via String.fromCharCode(0x1b) so no\n// raw ESC (0x1b) byte ever lives in this source file. Do NOT use exit 2 (stdout JSON ignored;\n// stderr invisible to the user on Bash).\n// Refs: Claude Code GitHub issues #31592, #40380, #17356 (asymmetry \"closed / not planned\").\n\nimport { invocationLog } from '../core/decision-log';\nimport { L0_FAULT_NONE } from '../core/l0-fault-codes';\nimport { AgentHookEvent } from '../core/agent-event';\nimport { HookOutcome, HookTerminated } from './hook-outcome';\n\n// ANSI escape (0x1b) built at runtime so no raw ESC byte sits in source. ANSI red is a *bonus* — the\n// 🛑 prefix + reason stay meaningful if a future/CI renderer strips the color. One place = one escape.\nconst ESC = String.fromCharCode(0x1b);\n\n/**\n * ONLY THE HEADLINE IS RED. The body is left plain, and that is a legibility decision, not an oversight.\n *\n * Every deny that reaches here is MULTI-LINE — formatReport()'s `[rule] (N violations)` / `→ why` /\n * `Fix Option N:` skeleton for L1 and L2, and now the same skeleton for L0. A whole page rendered in\n * bold red is harder to read than the paragraph it replaced: the indentation that carries the structure\n * stops registering when every line shouts. Red the first line so the block is unmissable in a scroll of\n * terminal output, then let the structure do the rest of the work.\n *\n * The reset (`[0m`) still closes the sequence on the same line it opened, so nothing leaks into the\n * body or into whatever the terminal prints next.\n */\n// webpieces-disable no-function-outside-class -- private helper of the PreToolUse protocol boundary below; this module must stay callable from a tree too broken to build a DI container\nfunction redSystemMessage(reason: string): string {\n    const nl = reason.indexOf('\\n');\n    if (nl < 0) return `${ESC}[31;1m🛑 ${reason}${ESC}[0m`;\n    return `${ESC}[31;1m🛑 ${reason.slice(0, nl)}${ESC}[0m${reason.slice(nl)}`;\n}\n\n// Takes the EVENT rather than a tool-name string, because the one thing this decision needs is the\n// event's routing kind, and the harnesses spell their tool names differently (`Bash` vs `apply_patch`)\n// while agreeing on the kind. The emitted bytes are identical for both harnesses — Codex accepts the\n// same `permissionDecision: \"deny\"` + `permissionDecisionReason` + `systemMessage` fields, and rejects\n// nothing we emit. It does hard-reject an EMPTY `permissionDecisionReason` where Claude tolerates one,\n// which is why emitDeny below refuses to send one.\n// webpieces-disable no-function-outside-class -- the PreToolUse wire shape itself, module-scope beside emitDeny/emitAllow by design, and it must stay callable from a tree too broken to build a DI container\nexport function denyJson(event: AgentHookEvent | null, reason: string): string {\n    // NEVER an empty reason, and the check lives HERE because this function owns the wire shape. Codex\n    // hard-rejects a deny whose permissionDecisionReason is empty (Claude tolerates it and shows the\n    // human nothing), so an empty one is not a cosmetic defect — it is a block that silently fails to\n    // block. Every call site passes prose; this is the backstop that keeps a future one from turning a\n    // deny into a protocol error.\n    const safe = reason.trim() === '' ? '[ai-hooks] blocked, but the guard produced no reason — failing closed.' : reason;\n    const hookSpecificOutput = {\n        hookEventName: 'PreToolUse',\n        permissionDecision: 'deny',\n        permissionDecisionReason: safe,\n    };\n    // Bash only: permissionDecisionReason is NOT user-visible, so add the red systemMessage.\n    if (event !== null && event.kind === 'Bash') {\n        return JSON.stringify({ systemMessage: redSystemMessage(safe), hookSpecificOutput });\n    }\n    // Write/Edit/MultiEdit (and anything else): reason renders red natively; no systemMessage.\n    return JSON.stringify({ hookSpecificOutput });\n}\n\n// THE DENY, AS A VALUE. `reason` is surfaced to both the user (terminal UI) and the model; the event's\n// kind selects whether the red `systemMessage` is added (Bash) or omitted (file tools) — see denyJson.\n//\n// This is the ONE boundary every blocking path passes through, which is why the per-invocation audit\n// line is flushed HERE: the `calls/` stream carries the outcome of its own call, and the outcome is not\n// known until this point. `rule` names what blocked (or '-'), for the line's `rule=` field.\n//\n// `fault` is the L0 fault code when the block IS an L0 fault (S/C/Y — the three decided here in JS,\n// where the sh shim's own `fault=` stamp can never reach), else '-'. Stamping it at this ONE boundary is\n// what makes `grep 'fault=S'` span the whole audit trail rather than only its sh half.\n//\n// It RETURNS the outcome instead of writing it. The write and the exit belong to HookApp, which owns\n// the injected stdout/exit ports — that separation is what lets a golden test read the exact bytes a\n// composed run produces. `denyForCrash` (hook-core) needs the value rather than the throw, because it\n// is already INSIDE the catch that would swallow one.\n// webpieces-disable no-function-outside-class -- the Claude Code PreToolUse protocol boundary; module-scope beside denyJson/allowOutcome by design, and it must stay callable from a tree too broken to build a DI container.\nexport function denyOutcome(event: AgentHookEvent | null, reason: string, rule: string = '-', fault: string = L0_FAULT_NONE): HookOutcome {\n    // BLOCK_AI_CURE: every deny that reaches this boundary prints a cure the agent can act on — the\n    // L0 faults name a command on the allowlist, and the L1/L2 guards print theirs. A deny needing a\n    // HUMAN would have to say so at its own site; none does today, and inventing one here would be\n    // guessing at the boundary rather than at the decision.\n    invocationLog.finish('BLOCK_AI_CURE', rule, fault);\n    return new HookOutcome(denyJson(event, reason) + '\\n', 0);\n}\n\n// The ALLOW, as a value. No JSON — a silent exit 0 is \"allow\" in the PreToolUse protocol.\n//\n// NOT exported, deliberately, where denyOutcome is: `denyForCrash` genuinely needs the deny in value\n// form because it is already inside the catch a throw would land in, and nothing needs the allow that\n// way. An exported one would be a second, externally-pickable spelling of \"allow\" sitting three lines\n// from `emitAllow` — precisely the shape an agent picks by accident.\n// webpieces-disable no-function-outside-class -- the PreToolUse protocol boundary, module-scope beside denyJson/denyOutcome by design, and it must stay callable from a tree too broken to build a DI container\nfunction allowOutcome(): HookOutcome {\n    invocationLog.finish('ALLOW', '-');\n    return new HookOutcome('', 0);\n}\n\n// Block the tool call and END the invocation from wherever in the pipeline we are — see HookTerminated\n// for why the terminal control flow is a throw now rather than a `process.exit` at the call site. Still\n// typed `never`: nothing after a call to this runs.\n// webpieces-disable no-function-outside-class -- the Claude Code PreToolUse protocol boundary; module-scope beside denyJson/emitAllow by design, and it must stay callable from a tree too broken to build a DI container.\nexport function emitDeny(event: AgentHookEvent | null, reason: string, rule: string = '-', fault: string = L0_FAULT_NONE): never {\n    throw new HookTerminated(denyOutcome(event, reason, rule, fault));\n}\n\n// Allow the tool call and END the invocation. See emitDeny.\n// webpieces-disable no-function-outside-class -- the PreToolUse protocol boundary, module-scope beside denyJson/emitDeny by design, and it must stay callable from a tree too broken to build a DI container\nexport function emitAllow(): never {\n    throw new HookTerminated(allowOutcome());\n}\n"]}

package/src/adapters/claude-code-adapter.d.ts

@@ -0,0 +1,26 @@
+import { AgentPayload } from './agent-payload';
+import { AgentHookEvent } from '../core/agent-event';
+/**
+ * Morphs a Claude Code PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * This is the SAME `normalizeToolKind` / `normalizeToolInput` logic that used to live inline in
+ * hook-core.ts, moved out unchanged so hook-core is written once for every harness. Claude Code is the
+ * harness every developer uses today, so nothing about the mapping is allowed to move: `Write` still
+ * becomes one edit of `content` against '', `Edit` one edit of `old_string`→`new_string`, `MultiEdit`
+ * one per entry, and a file tool with no `file_path` still ends up allowed (kind `Ignored`).
+ */
+export declare class ClaudeCodeAdapter {
+    /**
+     * What is known from the ENVELOPE ALONE, touching nothing but `tool_name` and the identity fields.
+     *
+     * Not a second spelling of `toEvent` — a different question, asked at a moment when the answer to
+     * the other one may not exist. `toEvent` reads `tool_input`, and a payload whose `tool_input` is
+     * missing makes it throw; the crash then still has to be DENIED, and the deny still has to know
+     * whether it is decorating a Bash block (which needs the red `systemMessage`) or a file block
+     * (which does not). This is the shape that answers that, and it cannot fail.
+     */
+    envelope(payload: AgentPayload): AgentHookEvent;
+    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent;
+    private kindOf;
+    private fileOperations;
+}

package/src/adapters/claude-code-adapter.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaudeCodeAdapter = void 0;
+const agent_event_1 = require("../core/agent-event");
+const types_1 = require("../core/types");
+/**
+ * The Claude Code tools that enter the file/edit rule pipeline. `Read` is deliberately NOT here — it
+ * has its own fast path and only one guard may see it.
+ */
+const HANDLED_FILE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);
+/**
+ * Morphs a Claude Code PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * This is the SAME `normalizeToolKind` / `normalizeToolInput` logic that used to live inline in
+ * hook-core.ts, moved out unchanged so hook-core is written once for every harness. Claude Code is the
+ * harness every developer uses today, so nothing about the mapping is allowed to move: `Write` still
+ * becomes one edit of `content` against '', `Edit` one edit of `old_string`→`new_string`, `MultiEdit`
+ * one per entry, and a file tool with no `file_path` still ends up allowed (kind `Ignored`).
+ */
+class ClaudeCodeAdapter {
+    /**
+     * What is known from the ENVELOPE ALONE, touching nothing but `tool_name` and the identity fields.
+     *
+     * Not a second spelling of `toEvent` — a different question, asked at a moment when the answer to
+     * the other one may not exist. `toEvent` reads `tool_input`, and a payload whose `tool_input` is
+     * missing makes it throw; the crash then still has to be DENIED, and the deny still has to know
+     * whether it is decorating a Bash block (which needs the red `systemMessage`) or a file block
+     * (which does not). This is the shape that answers that, and it cannot fail.
+     */
+    envelope(payload) {
+        return new agent_event_1.AgentHookEvent('claude-code', this.kindOf(payload.tool_name), payload.tool_name, payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', [], null, []);
+    }
+    toEvent(payload, cwd) {
+        const kind = this.kindOf(payload.tool_name);
+        const toolInput = payload.tool_input;
+        const bash = kind === 'Bash' ? new types_1.NormalizedBashInput(toolInput.command ?? '') : null;
+        const reads = kind === 'Read' ? [toolInput.file_path ?? ''] : [];
+        const files = kind === 'File' ? this.fileOperations(payload.tool_name, toolInput) : [];
+        // A file tool that named no file has nothing to judge; fall back to Ignored so the hook allows
+        // it, exactly as the old `if (!input) emitAllow()` did.
+        const effective = kind === 'File' && files.length === 0 ? 'Ignored' : kind;
+        return new agent_event_1.AgentHookEvent('claude-code', effective, payload.tool_name, cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', files, bash, reads);
+    }
+    kindOf(toolName) {
+        if (toolName === 'Bash')
+            return 'Bash';
+        if (toolName === 'Read')
+            return 'Read';
+        if (HANDLED_FILE_TOOLS.has(toolName))
+            return 'File';
+        return 'Ignored';
+    }
+    fileOperations(toolKind, toolInput) {
+        const filePath = toolInput.file_path;
+        if (!filePath)
+            return [];
+        if (toolKind === 'Write') {
+            return [new agent_event_1.FileOperation(toolKind, new types_1.NormalizedToolInput(filePath, [new types_1.NormalizedEdit('', toolInput.content || '')]))];
+        }
+        if (toolKind === 'Edit') {
+            return [new agent_event_1.FileOperation(toolKind, new types_1.NormalizedToolInput(filePath, [new types_1.NormalizedEdit(toolInput.old_string || '', toolInput.new_string || '')]))];
+        }
+        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];
+        const edits = raw.map((e) => new types_1.NormalizedEdit(e.old_string || '', e.new_string || ''));
+        return [new agent_event_1.FileOperation(toolKind, new types_1.NormalizedToolInput(filePath, edits))];
+    }
+}
+exports.ClaudeCodeAdapter = ClaudeCodeAdapter;
+//# sourceMappingURL=claude-code-adapter.js.map

package/src/adapters/claude-code-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-adapter.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/claude-code-adapter.ts"],"names":[],"mappings":";;;AACA,qDAAoF;AACpF,yCAAmG;AAEnG;;;GAGG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,MAAa,iBAAiB;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAqB;QAC1B,OAAO,IAAI,4BAAc,CACrB,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,EAChE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC7F,EAAE,EAAE,IAAI,EAAE,EAAE,CACf,CAAC;IACN,CAAC;IAED,OAAO,CAAC,OAAqB,EAAE,GAAW;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,2BAAmB,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,+FAA+F;QAC/F,wDAAwD;QACxD,MAAM,SAAS,GAAmB,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,OAAO,IAAI,4BAAc,CACrB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAC3C,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC/E,KAAK,EAAE,IAAI,EAAE,KAAK,CACrB,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC3B,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QACpD,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,cAAc,CAAC,QAAkB,EAAE,SAAyB;QAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,2BAAa,CAAC,QAAQ,EAAE,IAAI,2BAAmB,CAAC,QAAQ,EAAE,CAAC,IAAI,sBAAc,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,2BAAa,CAAC,QAAQ,EAAE,IAAI,2BAAmB,CAAC,QAAQ,EAAE,CAAC,IAAI,sBAAc,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1J,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAkB,EAAE,CAAC,IAAI,sBAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QACzH,OAAO,CAAC,IAAI,2BAAa,CAAC,QAAQ,EAAE,IAAI,2BAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;CACJ;AAtDD,8CAsDC","sourcesContent":["import { AgentPayload, AgentToolInput, AgentEditEntry } from './agent-payload';\nimport { AgentHookEvent, AgentEventKind, FileOperation } from '../core/agent-event';\nimport { NormalizedBashInput, NormalizedEdit, NormalizedToolInput, ToolKind } from '../core/types';\n\n/**\n * The Claude Code tools that enter the file/edit rule pipeline. `Read` is deliberately NOT here — it\n * has its own fast path and only one guard may see it.\n */\nconst HANDLED_FILE_TOOLS: ReadonlySet<string> = new Set(['Write', 'Edit', 'MultiEdit']);\n\n/**\n * Morphs a Claude Code PreToolUse payload into the one normalized `AgentHookEvent`.\n *\n * This is the SAME `normalizeToolKind` / `normalizeToolInput` logic that used to live inline in\n * hook-core.ts, moved out unchanged so hook-core is written once for every harness. Claude Code is the\n * harness every developer uses today, so nothing about the mapping is allowed to move: `Write` still\n * becomes one edit of `content` against '', `Edit` one edit of `old_string`→`new_string`, `MultiEdit`\n * one per entry, and a file tool with no `file_path` still ends up allowed (kind `Ignored`).\n */\nexport class ClaudeCodeAdapter {\n    /**\n     * What is known from the ENVELOPE ALONE, touching nothing but `tool_name` and the identity fields.\n     *\n     * Not a second spelling of `toEvent` — a different question, asked at a moment when the answer to\n     * the other one may not exist. `toEvent` reads `tool_input`, and a payload whose `tool_input` is\n     * missing makes it throw; the crash then still has to be DENIED, and the deny still has to know\n     * whether it is decorating a Bash block (which needs the red `systemMessage`) or a file block\n     * (which does not). This is the shape that answers that, and it cannot fail.\n     */\n    envelope(payload: AgentPayload): AgentHookEvent {\n        return new AgentHookEvent(\n            'claude-code', this.kindOf(payload.tool_name), payload.tool_name,\n            payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            [], null, [],\n        );\n    }\n\n    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent {\n        const kind = this.kindOf(payload.tool_name);\n        const toolInput = payload.tool_input;\n        const bash = kind === 'Bash' ? new NormalizedBashInput(toolInput.command ?? '') : null;\n        const reads = kind === 'Read' ? [toolInput.file_path ?? ''] : [];\n        const files = kind === 'File' ? this.fileOperations(payload.tool_name as ToolKind, toolInput) : [];\n        // A file tool that named no file has nothing to judge; fall back to Ignored so the hook allows\n        // it, exactly as the old `if (!input) emitAllow()` did.\n        const effective: AgentEventKind = kind === 'File' && files.length === 0 ? 'Ignored' : kind;\n        return new AgentHookEvent(\n            'claude-code', effective, payload.tool_name,\n            cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            files, bash, reads,\n        );\n    }\n\n    private kindOf(toolName: string): AgentEventKind {\n        if (toolName === 'Bash') return 'Bash';\n        if (toolName === 'Read') return 'Read';\n        if (HANDLED_FILE_TOOLS.has(toolName)) return 'File';\n        return 'Ignored';\n    }\n\n    private fileOperations(toolKind: ToolKind, toolInput: AgentToolInput): readonly FileOperation[] {\n        const filePath = toolInput.file_path;\n        if (!filePath) return [];\n        if (toolKind === 'Write') {\n            return [new FileOperation(toolKind, new NormalizedToolInput(filePath, [new NormalizedEdit('', toolInput.content || '')]))];\n        }\n        if (toolKind === 'Edit') {\n            return [new FileOperation(toolKind, new NormalizedToolInput(filePath, [new NormalizedEdit(toolInput.old_string || '', toolInput.new_string || '')]))];\n        }\n        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];\n        const edits = raw.map((e: AgentEditEntry): NormalizedEdit => new NormalizedEdit(e.old_string || '', e.new_string || ''));\n        return [new FileOperation(toolKind, new NormalizedToolInput(filePath, edits))];\n    }\n}\n"]}

package/src/adapters/codex-adapter.d.ts

@@ -0,0 +1,19 @@
+import { AgentPayload } from './agent-payload';
+import { AgentHookEvent } from '../core/agent-event';
+/**
+ * Morphs a Codex PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * Codex exposes exactly two tools this hook has anything to say about. Everything else measured in a
+ * live session — `webrun`, `collaborationspawn_agent`, `collaborationwait_agent`, `view_image`,
+ * `update_plan` — and every tool not yet seen maps to `Ignored` and is allowed immediately. That
+ * default is chosen on purpose: an unknown tool is one we cannot judge, and inventing a mapping for it
+ * would apply file rules to bytes that are not a file edit.
+ */
+export declare class CodexAdapter {
+    private readonly patchParser;
+    private readonly readParity;
+    /** See ClaudeCodeAdapter.envelope — the pre-normalization shape the crash deny needs. */
+    envelope(payload: AgentPayload): AgentHookEvent;
+    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent;
+    private kindOf;
+}

package/src/adapters/codex-adapter.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexAdapter = void 0;
+const rules_config_1 = require("@webpieces/rules-config");
+const agent_event_1 = require("../core/agent-event");
+const types_1 = require("../core/types");
+const apply_patch_parse_1 = require("../core/apply-patch-parse");
+const shell_read_parity_1 = require("../core/shell-read-parity");
+/** Codex's shell tool. MEASURED: it reuses Claude's name — it is `Bash`, NOT `shell`. */
+const CODEX_BASH = 'Bash';
+/** Codex's ONLY file-editing tool. One envelope, many files, mixed operations. */
+const CODEX_APPLY_PATCH = 'apply_patch';
+/**
+ * Morphs a Codex PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * Codex exposes exactly two tools this hook has anything to say about. Everything else measured in a
+ * live session — `webrun`, `collaborationspawn_agent`, `collaborationwait_agent`, `view_image`,
+ * `update_plan` — and every tool not yet seen maps to `Ignored` and is allowed immediately. That
+ * default is chosen on purpose: an unknown tool is one we cannot judge, and inventing a mapping for it
+ * would apply file rules to bytes that are not a file edit.
+ */
+class CodexAdapter {
+    patchParser = new apply_patch_parse_1.ApplyPatchParser();
+    readParity = new shell_read_parity_1.ShellReadParity();
+    /** See ClaudeCodeAdapter.envelope — the pre-normalization shape the crash deny needs. */
+    envelope(payload) {
+        return new agent_event_1.AgentHookEvent('codex', this.kindOf(payload.tool_name), payload.tool_name, payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', [], null, []);
+    }
+    toEvent(payload, cwd) {
+        const kind = this.kindOf(payload.tool_name);
+        const command = payload.tool_input.command ?? '';
+        const bash = kind === 'Bash' ? new types_1.NormalizedBashInput(command) : null;
+        // Read parity: Codex has no Read tool, so a read arrives as `Bash` running a pager. Synthesized
+        // reads run the read guard IN ADDITION to the bash guards — see ../core/shell-read-parity.ts.
+        const reads = kind === 'Bash' ? this.readParity.readTargets(command, cwd, new rules_config_1.RepoRootFinder().resolveRepoRoot(cwd)) : [];
+        const files = kind === 'File' ? this.patchParser.parse(command, cwd) : [];
+        return new agent_event_1.AgentHookEvent('codex', kind, payload.tool_name, cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', files, bash, reads);
+    }
+    kindOf(toolName) {
+        if (toolName === CODEX_BASH)
+            return 'Bash';
+        if (toolName === CODEX_APPLY_PATCH)
+            return 'File';
+        return 'Ignored';
+    }
+}
+exports.CodexAdapter = CodexAdapter;
+//# sourceMappingURL=codex-adapter.js.map

package/src/adapters/codex-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-adapter.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/codex-adapter.ts"],"names":[],"mappings":";;;AAAA,0DAAyD;AAGzD,qDAAqE;AACrE,yCAAoD;AACpD,iEAA6D;AAC7D,iEAA4D;AAE5D,yFAAyF;AACzF,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAa,YAAY;IACJ,WAAW,GAAG,IAAI,oCAAgB,EAAE,CAAC;IACrC,UAAU,GAAG,IAAI,mCAAe,EAAE,CAAC;IAEpD,yFAAyF;IACzF,QAAQ,CAAC,OAAqB;QAC1B,OAAO,IAAI,4BAAc,CACrB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,EAC1D,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC7F,EAAE,EAAE,IAAI,EAAE,EAAE,CACf,CAAC;IACN,CAAC;IAED,OAAO,CAAC,OAAqB,EAAE,GAAW;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,2BAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,6BAAc,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,4BAAc,CACrB,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC/E,KAAK,EAAE,IAAI,EAAE,KAAK,CACrB,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC3B,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC;QAC3C,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC;QAClD,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ;AAjCD,oCAiCC","sourcesContent":["import { RepoRootFinder } from '@webpieces/rules-config';\n\nimport { AgentPayload } from './agent-payload';\nimport { AgentHookEvent, AgentEventKind } from '../core/agent-event';\nimport { NormalizedBashInput } from '../core/types';\nimport { ApplyPatchParser } from '../core/apply-patch-parse';\nimport { ShellReadParity } from '../core/shell-read-parity';\n\n/** Codex's shell tool. MEASURED: it reuses Claude's name — it is `Bash`, NOT `shell`. */\nconst CODEX_BASH = 'Bash';\n/** Codex's ONLY file-editing tool. One envelope, many files, mixed operations. */\nconst CODEX_APPLY_PATCH = 'apply_patch';\n\n/**\n * Morphs a Codex PreToolUse payload into the one normalized `AgentHookEvent`.\n *\n * Codex exposes exactly two tools this hook has anything to say about. Everything else measured in a\n * live session — `webrun`, `collaborationspawn_agent`, `collaborationwait_agent`, `view_image`,\n * `update_plan` — and every tool not yet seen maps to `Ignored` and is allowed immediately. That\n * default is chosen on purpose: an unknown tool is one we cannot judge, and inventing a mapping for it\n * would apply file rules to bytes that are not a file edit.\n */\nexport class CodexAdapter {\n    private readonly patchParser = new ApplyPatchParser();\n    private readonly readParity = new ShellReadParity();\n\n    /** See ClaudeCodeAdapter.envelope — the pre-normalization shape the crash deny needs. */\n    envelope(payload: AgentPayload): AgentHookEvent {\n        return new AgentHookEvent(\n            'codex', this.kindOf(payload.tool_name), payload.tool_name,\n            payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            [], null, [],\n        );\n    }\n\n    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent {\n        const kind = this.kindOf(payload.tool_name);\n        const command = payload.tool_input.command ?? '';\n        const bash = kind === 'Bash' ? new NormalizedBashInput(command) : null;\n        // Read parity: Codex has no Read tool, so a read arrives as `Bash` running a pager. Synthesized\n        // reads run the read guard IN ADDITION to the bash guards — see ../core/shell-read-parity.ts.\n        const reads = kind === 'Bash' ? this.readParity.readTargets(command, cwd, new RepoRootFinder().resolveRepoRoot(cwd)) : [];\n        const files = kind === 'File' ? this.patchParser.parse(command, cwd) : [];\n        return new AgentHookEvent(\n            'codex', kind, payload.tool_name,\n            cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            files, bash, reads,\n        );\n    }\n\n    private kindOf(toolName: string): AgentEventKind {\n        if (toolName === CODEX_BASH) return 'Bash';\n        if (toolName === CODEX_APPLY_PATCH) return 'File';\n        return 'Ignored';\n    }\n}\n"]}

package/src/adapters/codex-subagent-guard.d.ts

@@ -0,0 +1,30 @@
+import { AgentHookEvent } from '../core/agent-event';
+import { BlockedResult } from '../core/types';
+export declare const CODEX_SUBAGENT_RULE = "codex-subagent-no-write-in-shared-tree";
+/**
+ * A Codex SUBAGENT may not write into the tree it shares with its coordinator.
+ *
+ * This exists because of a MEASURED structural gap, not a style preference. Claude Code can hand a
+ * subagent its own git worktree (`isolation: "worktree"`), so two agents editing at once are editing
+ * two different checkouts. Codex cannot: `spawn_agent`'s schema is
+ * `{fork_turns?, message, model?, reasoning_effort?, task_name}` — there is no cwd, workdir or
+ * worktree parameter — and cwd resets to the repo root before every command, so a subagent cannot even
+ * put itself somewhere else. Every Codex subagent therefore writes into the coordinator's checkout,
+ * and concurrent subagents write into each other's.
+ *
+ * Reviewers are unaffected: they only read, and a read arrives as `Bash`.
+ *
+ * NOT a configurable rule yet, and that is deliberate. A rule registered with the engine must have an
+ * entry in webpieces.config.json, and the validator that would accept a new key is a RELEASE behind
+ * the source that defines it — adding both at once rejects the key as unknown and blocks every tool
+ * call in the repo. So the guard ships here, gated on `aiType === 'codex'`, and becomes a config-keyed
+ * rule in the follow-up PR that lands after the publish.
+ */
+export declare class CodexSubagentSharedTreeGuard {
+    /**
+     * Returns a block when a Codex SUBAGENT's patch targets a file inside `root`, else null.
+     * Claude Code events return null unconditionally — the harness has real isolation.
+     */
+    check(event: AgentHookEvent, root: string): BlockedResult | null;
+    private isInside;
+}

package/src/adapters/codex-subagent-guard.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexSubagentSharedTreeGuard = exports.CODEX_SUBAGENT_RULE = void 0;
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const rules_config_1 = require("@webpieces/rules-config");
+const types_1 = require("../core/types");
+exports.CODEX_SUBAGENT_RULE = 'codex-subagent-no-write-in-shared-tree';
+/**
+ * A Codex SUBAGENT may not write into the tree it shares with its coordinator.
+ *
+ * This exists because of a MEASURED structural gap, not a style preference. Claude Code can hand a
+ * subagent its own git worktree (`isolation: "worktree"`), so two agents editing at once are editing
+ * two different checkouts. Codex cannot: `spawn_agent`'s schema is
+ * `{fork_turns?, message, model?, reasoning_effort?, task_name}` — there is no cwd, workdir or
+ * worktree parameter — and cwd resets to the repo root before every command, so a subagent cannot even
+ * put itself somewhere else. Every Codex subagent therefore writes into the coordinator's checkout,
+ * and concurrent subagents write into each other's.
+ *
+ * Reviewers are unaffected: they only read, and a read arrives as `Bash`.
+ *
+ * NOT a configurable rule yet, and that is deliberate. A rule registered with the engine must have an
+ * entry in webpieces.config.json, and the validator that would accept a new key is a RELEASE behind
+ * the source that defines it — adding both at once rejects the key as unknown and blocks every tool
+ * call in the repo. So the guard ships here, gated on `aiType === 'codex'`, and becomes a config-keyed
+ * rule in the follow-up PR that lands after the publish.
+ */
+class CodexSubagentSharedTreeGuard {
+    /**
+     * Returns a block when a Codex SUBAGENT's patch targets a file inside `root`, else null.
+     * Claude Code events return null unconditionally — the harness has real isolation.
+     */
+    check(event, root) {
+        if (event.aiType !== 'codex')
+            return null;
+        if (event.agentId === '')
+            return null;
+        const inside = event.files.filter((f) => this.isInside(f.input.filePath, root));
+        if (inside.length === 0)
+            return null;
+        const targets = inside.map((f) => path.relative(root, f.input.filePath)).join(', ');
+        const worktree = path.join(path.dirname(root), 'wt-<task-name>');
+        const error = new rules_config_1.RuleFailError(exports.CODEX_SUBAGENT_RULE, `A Codex subagent is writing into the tree it shares with its coordinator: ${targets}\n\n` +
+            `Codex cannot spawn a subagent into its own checkout — spawn_agent takes no cwd or worktree, ` +
+            `and cwd resets to the repo root before every command — so this edit lands in the same files ` +
+            `the coordinator and every sibling subagent are editing.`, undefined, undefined, [
+            new rules_config_1.Option(`Give this agent its own checkout and address every file by ABSOLUTE path inside it: git worktree add ${worktree} -b <branch>`, true),
+            new rules_config_1.Option('Hand the edit back to the coordinator and have this agent report what to change instead of changing it'),
+        ]);
+        return new types_1.BlockedResult((0, rules_config_1.renderRuleFailForAi)(error));
+    }
+    isInside(filePath, root) {
+        const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+        return path.resolve(filePath).startsWith(rootWithSep);
+    }
+}
+exports.CodexSubagentSharedTreeGuard = CodexSubagentSharedTreeGuard;
+//# sourceMappingURL=codex-subagent-guard.js.map