@webpieces/ai-hook-rules 0.4.710 → 0.4.712

package/src/bin/codex-trust.d.ts

@@ -0,0 +1,99 @@
+/**
+ * CODEX HOOK TRUST — read it, report it, NEVER write it.
+ *
+ * ─── What Codex actually does ─────────────────────────────────────────────────────────────────────
+ * Codex trusts a hook entry TOFU. On first sight of a new or changed entry it PROMPTS
+ * (`Hooks need review / 1 hook is new or changed`) and, if the human accepts, records a hash in
+ * `~/.codex/config.toml`:
+ *
+ *     [hooks.state."<abs path to .codex/hooks.json>:pre_tool_use:<group>:<index>"]
+ *     trusted_hash = "sha256:…"
+ *
+ * ─── Why this only ever REPORTS ───────────────────────────────────────────────────────────────────
+ * The hash is NOT reproducible from outside Codex. Sixteen encodings were tried against a hooks.json we
+ * wrote ourselves and none of them produced the recorded value. So an installer that tried to write one
+ * would be guessing at a security decision on a human's behalf, and would either be ignored or — worse —
+ * appear to succeed. Forging it is not on the table even if the encoding were known: the prompt IS the
+ * mechanism, and the whole point of TOFU is that a person saw the command once.
+ *
+ * The consequence the installer must therefore SAY OUT LOUD: the prompt's third option is
+ * `Continue without trusting (hooks won't run)`. That is one keystroke to a fully unguarded session,
+ * with no later warning of any kind. Install-time verification cannot see that choice — it happens
+ * afterwards, in another process — which is exactly why guard-presence attestation exists as a separate
+ * mechanism (see ./codex-guard-presence.ts) rather than being folded into this check.
+ */
+/** What one repo's Codex trust looks like right now. Data-only → a class, per CLAUDE.md. */
+export declare class CodexTrustStatus {
+    /** `~/.codex/config.toml`, named even when it does not exist so the report can point at it. */
+    readonly configPath: string;
+    readonly configExists: boolean;
+    /** `[projects."<root>"] trust_level = "trusted"`. */
+    readonly projectTrusted: boolean;
+    /** The repo's `.codex/hooks.json`, absolute — the key every `hooks.state` entry is prefixed by. */
+    readonly hooksPath: string;
+    /** How many webpieces-managed PreToolUse entries that file registers. 0 ⇒ Codex is not armed. */
+    readonly registeredEntries: number;
+    /** How many of them `~/.codex/config.toml` records a `trusted_hash` for. */
+    readonly trustedEntries: number;
+    constructor(
+    /** `~/.codex/config.toml`, named even when it does not exist so the report can point at it. */
+    configPath: string, configExists: boolean, 
+    /** `[projects."<root>"] trust_level = "trusted"`. */
+    projectTrusted: boolean, 
+    /** The repo's `.codex/hooks.json`, absolute — the key every `hooks.state` entry is prefixed by. */
+    hooksPath: string, 
+    /** How many webpieces-managed PreToolUse entries that file registers. 0 ⇒ Codex is not armed. */
+    registeredEntries: number, 
+    /** How many of them `~/.codex/config.toml` records a `trusted_hash` for. */
+    trustedEntries: number);
+    /** True when Codex is armed here AND every entry it would run is trusted. */
+    fullyTrusted(): boolean;
+    /** True when there is nothing to say — this repo has not armed Codex at all. */
+    notArmed(): boolean;
+    /**
+     * The report, as lines. It states what IS, then the one action that changes it — and the action is
+     * always the human's, because nothing here can be repaired by a tool.
+     */
+    lines(): readonly string[];
+}
+/**
+ * Reads Codex's trust state. Never writes, never throws — an unreadable or absent config reports as
+ * "not trusted", which is the true and safe answer.
+ */
+export declare class CodexTrustProbe {
+    /** `~/.codex/config.toml`. `homeDir` is injectable so a unit test never reads the real one. */
+    configPath(homeDir?: string): string;
+    read(projectRoot: string, homeDir?: string): CodexTrustStatus;
+    /**
+     * How many webpieces-managed PreToolUse commands `.codex/hooks.json` registers.
+     *
+     * It counts what WE own, not every hook in the file: a consumer's own unrelated hook is none of this
+     * check's business, and counting it would make the report say "1 of 3 trusted" about hooks webpieces
+     * neither wrote nor can advise on.
+     */
+    private registeredEntryCount;
+    private readOrEmpty;
+    /**
+     * `[projects."<root>"]` carrying `trust_level = "trusted"`.
+     *
+     * A LINE SCAN, not a TOML parser, and deliberately: this package must load on a tree too broken to
+     * build a DI container, so it takes no dependency it does not need, and the two shapes it reads are
+     * both written by Codex itself in one fixed form. It over-reports "not trusted" for anything it
+     * cannot recognise, which is the safe direction — the consequence is one advisory line too many,
+     * never a session reported as guarded when it is not.
+     */
+    private projectTrusted;
+    /**
+     * How many `hooks.state."<hooksPath>:pre_tool_use:<group>:<index>"` sections carry a `trusted_hash`.
+     *
+     * The count is compared against the number of entries the file registers rather than matched
+     * one-for-one to a specific group/index: the group and index are Codex's own numbering of a file it
+     * re-reads on every launch, and an installer that assumed a numbering would report a false alarm the
+     * first time Codex renumbered.
+     */
+    private trustedEntryCount;
+    /** The body lines of one TOML section, or [] when the file carries no such header. */
+    private sectionBody;
+    /** The `<name>` of a `[<name>]` header line, or null for anything else. */
+    private headerOf;
+}

package/src/bin/codex-trust.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexTrustProbe = exports.CodexTrustStatus = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const os_1 = require("os");
+const to_error_1 = require("../core/to-error");
+const hook_registration_1 = require("./hook-registration");
+/**
+ * CODEX HOOK TRUST — read it, report it, NEVER write it.
+ *
+ * ─── What Codex actually does ─────────────────────────────────────────────────────────────────────
+ * Codex trusts a hook entry TOFU. On first sight of a new or changed entry it PROMPTS
+ * (`Hooks need review / 1 hook is new or changed`) and, if the human accepts, records a hash in
+ * `~/.codex/config.toml`:
+ *
+ *     [hooks.state."<abs path to .codex/hooks.json>:pre_tool_use:<group>:<index>"]
+ *     trusted_hash = "sha256:…"
+ *
+ * ─── Why this only ever REPORTS ───────────────────────────────────────────────────────────────────
+ * The hash is NOT reproducible from outside Codex. Sixteen encodings were tried against a hooks.json we
+ * wrote ourselves and none of them produced the recorded value. So an installer that tried to write one
+ * would be guessing at a security decision on a human's behalf, and would either be ignored or — worse —
+ * appear to succeed. Forging it is not on the table even if the encoding were known: the prompt IS the
+ * mechanism, and the whole point of TOFU is that a person saw the command once.
+ *
+ * The consequence the installer must therefore SAY OUT LOUD: the prompt's third option is
+ * `Continue without trusting (hooks won't run)`. That is one keystroke to a fully unguarded session,
+ * with no later warning of any kind. Install-time verification cannot see that choice — it happens
+ * afterwards, in another process — which is exactly why guard-presence attestation exists as a separate
+ * mechanism (see ./codex-guard-presence.ts) rather than being folded into this check.
+ */
+/** What one repo's Codex trust looks like right now. Data-only → a class, per CLAUDE.md. */
+class CodexTrustStatus {
+    configPath;
+    configExists;
+    projectTrusted;
+    hooksPath;
+    registeredEntries;
+    trustedEntries;
+    // eslint-disable-next-line @typescript-eslint/max-params
+    constructor(
+    /** `~/.codex/config.toml`, named even when it does not exist so the report can point at it. */
+    configPath, configExists, 
+    /** `[projects."<root>"] trust_level = "trusted"`. */
+    projectTrusted, 
+    /** The repo's `.codex/hooks.json`, absolute — the key every `hooks.state` entry is prefixed by. */
+    hooksPath, 
+    /** How many webpieces-managed PreToolUse entries that file registers. 0 ⇒ Codex is not armed. */
+    registeredEntries, 
+    /** How many of them `~/.codex/config.toml` records a `trusted_hash` for. */
+    trustedEntries) {
+        this.configPath = configPath;
+        this.configExists = configExists;
+        this.projectTrusted = projectTrusted;
+        this.hooksPath = hooksPath;
+        this.registeredEntries = registeredEntries;
+        this.trustedEntries = trustedEntries;
+    }
+    /** True when Codex is armed here AND every entry it would run is trusted. */
+    fullyTrusted() {
+        return this.registeredEntries > 0 && this.trustedEntries >= this.registeredEntries && this.projectTrusted;
+    }
+    /** True when there is nothing to say — this repo has not armed Codex at all. */
+    notArmed() {
+        return this.registeredEntries === 0;
+    }
+    /**
+     * The report, as lines. It states what IS, then the one action that changes it — and the action is
+     * always the human's, because nothing here can be repaired by a tool.
+     */
+    lines() {
+        if (this.notArmed())
+            return [];
+        if (this.fullyTrusted()) {
+            return [`  ✅ Codex trusts all ${String(this.registeredEntries)} webpieces hook(s) in ${this.hooksPath}`];
+        }
+        const out = [];
+        out.push(`  ⚠️  Codex has NOT yet trusted the webpieces hooks in ${this.hooksPath}`);
+        if (!this.configExists) {
+            out.push(`     ${this.configPath} does not exist yet — Codex has never run for this user.`);
+        }
+        else if (!this.projectTrusted) {
+            out.push('     this project is not marked trusted in ~/.codex/config.toml.');
+        }
+        if (this.trustedEntries < this.registeredEntries) {
+            out.push(`     ${String(this.trustedEntries)} of ${String(this.registeredEntries)} hook entries carry a trusted_hash.`);
+        }
+        out.push('     Fix: run `codex` in this repo and choose "Trust all" when it asks about hooks.');
+        out.push('     Until you do, its third option ("Continue without trusting") leaves the session UNGUARDED —');
+        out.push('     which is what the guard-presence check on the build exists to catch.');
+        return out;
+    }
+}
+exports.CodexTrustStatus = CodexTrustStatus;
+/**
+ * Reads Codex's trust state. Never writes, never throws — an unreadable or absent config reports as
+ * "not trusted", which is the true and safe answer.
+ */
+class CodexTrustProbe {
+    /** `~/.codex/config.toml`. `homeDir` is injectable so a unit test never reads the real one. */
+    configPath(homeDir = (0, os_1.homedir)()) {
+        return path.join(homeDir, '.codex', 'config.toml');
+    }
+    read(projectRoot, homeDir = (0, os_1.homedir)()) {
+        const configPath = this.configPath(homeDir);
+        const hooksPath = path.join(projectRoot, ...hook_registration_1.CODEX_REGISTRATION.settingsFiles[0].split('/'));
+        const registered = this.registeredEntryCount(hooksPath);
+        const raw = this.readOrEmpty(configPath);
+        return new CodexTrustStatus(configPath, raw !== null, this.projectTrusted(raw ?? '', projectRoot), hooksPath, registered, this.trustedEntryCount(raw ?? '', hooksPath));
+    }
+    /**
+     * How many webpieces-managed PreToolUse commands `.codex/hooks.json` registers.
+     *
+     * It counts what WE own, not every hook in the file: a consumer's own unrelated hook is none of this
+     * check's business, and counting it would make the report say "1 of 3 trusted" about hooks webpieces
+     * neither wrote nor can advise on.
+     */
+    registeredEntryCount(hooksPath) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            if (!fs.existsSync(hooksPath))
+                return 0;
+            const entries = (0, hook_registration_1.readSettings)(hooksPath).hooks?.PreToolUse ?? [];
+            return entries.reduce((total, entry) => total + entry.hooks.filter((h) => (0, hook_registration_1.isManagedCommand)(h.command)).length, 0);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error; // an unreadable/invalid hooks.json is "not armed"; the drift check is what reports that
+            return 0;
+        }
+    }
+    readOrEmpty(configPath) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            return fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8') : null;
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error; // unreadable → treated as absent, which reports as "not trusted"
+            return null;
+        }
+    }
+    /**
+     * `[projects."<root>"]` carrying `trust_level = "trusted"`.
+     *
+     * A LINE SCAN, not a TOML parser, and deliberately: this package must load on a tree too broken to
+     * build a DI container, so it takes no dependency it does not need, and the two shapes it reads are
+     * both written by Codex itself in one fixed form. It over-reports "not trusted" for anything it
+     * cannot recognise, which is the safe direction — the consequence is one advisory line too many,
+     * never a session reported as guarded when it is not.
+     */
+    projectTrusted(raw, projectRoot) {
+        return this.sectionBody(raw, `projects."${projectRoot}"`)
+            .some((line) => /^\s*trust_level\s*=\s*"trusted"\s*$/.test(line));
+    }
+    /**
+     * How many `hooks.state."<hooksPath>:pre_tool_use:<group>:<index>"` sections carry a `trusted_hash`.
+     *
+     * The count is compared against the number of entries the file registers rather than matched
+     * one-for-one to a specific group/index: the group and index are Codex's own numbering of a file it
+     * re-reads on every launch, and an installer that assumed a numbering would report a false alarm the
+     * first time Codex renumbered.
+     */
+    trustedEntryCount(raw, hooksPath) {
+        const prefix = `hooks.state."${hooksPath}:pre_tool_use:`;
+        let trusted = 0;
+        let inEntry = false;
+        for (const line of raw.split('\n')) {
+            const header = this.headerOf(line);
+            if (header !== null)
+                inEntry = header.startsWith(prefix);
+            else if (inEntry && /^\s*trusted_hash\s*=\s*"/.test(line))
+                trusted += 1;
+        }
+        return trusted;
+    }
+    /** The body lines of one TOML section, or [] when the file carries no such header. */
+    sectionBody(raw, wanted) {
+        const body = [];
+        let inside = false;
+        for (const line of raw.split('\n')) {
+            const header = this.headerOf(line);
+            if (header !== null)
+                inside = header === wanted;
+            else if (inside)
+                body.push(line);
+        }
+        return body;
+    }
+    /** The `<name>` of a `[<name>]` header line, or null for anything else. */
+    headerOf(line) {
+        const match = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+        return match === null ? null : match[1];
+    }
+}
+exports.CodexTrustProbe = CodexTrustProbe;
+//# sourceMappingURL=codex-trust.js.map

package/src/bin/codex-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-trust.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/bin/codex-trust.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAC7B,2BAA6B;AAE7B,+CAA2C;AAC3C,2DAAiH;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,4FAA4F;AAC5F,MAAa,gBAAgB;IAIZ;IACA;IAEA;IAEA;IAEA;IAEA;IAZb,yDAAyD;IACzD;IACI,+FAA+F;IACtF,UAAkB,EAClB,YAAqB;IAC9B,qDAAqD;IAC5C,cAAuB;IAChC,mGAAmG;IAC1F,SAAiB;IAC1B,iGAAiG;IACxF,iBAAyB;IAClC,4EAA4E;IACnE,cAAsB;QATtB,eAAU,GAAV,UAAU,CAAQ;QAClB,iBAAY,GAAZ,YAAY,CAAS;QAErB,mBAAc,GAAd,cAAc,CAAS;QAEvB,cAAS,GAAT,SAAS,CAAQ;QAEjB,sBAAiB,GAAjB,iBAAiB,CAAQ;QAEzB,mBAAc,GAAd,cAAc,CAAQ;IAChC,CAAC;IAEJ,6EAA6E;IAC7E,YAAY;QACR,OAAO,IAAI,CAAC,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,cAAc,CAAC;IAC9G,CAAC;IAED,gFAAgF;IAChF,QAAQ;QACJ,OAAO,IAAI,CAAC,iBAAiB,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,0DAA0D,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,0DAA0D,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;QAC5H,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAChG,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC7G,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC;IACf,CAAC;CACJ;AAlDD,4CAkDC;AAED;;;GAGG;AACH,MAAa,eAAe;IACxB,+FAA+F;IAC/F,UAAU,CAAC,UAAkB,IAAA,YAAO,GAAE;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,WAAmB,EAAE,UAAkB,IAAA,YAAO,GAAE;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,sCAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,OAAO,IAAI,gBAAgB,CACvB,UAAU,EAAE,GAAG,KAAK,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,EAAE,WAAW,CAAC,EACrE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,EAAE,EAAE,SAAS,CAAC,CACtE,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAAC,SAAiB;QAC1C,8DAA8D;QAC9D,IAAI,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,CAAC;YACxC,MAAM,OAAO,GAAyB,IAAA,gCAAY,EAAC,SAAS,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;YACtF,OAAO,OAAO,CAAC,MAAM,CACjB,CAAC,KAAa,EAAE,KAAgB,EAAU,EAAE,CACxC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAc,EAAW,EAAE,CAAC,IAAA,oCAAgB,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAC/F,CAAC,CACJ,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC,CAAC,wFAAwF;YACpG,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,UAAkB;QAClC,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC,CAAC,iEAAiE;YAC7E,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,cAAc,CAAC,GAAW,EAAE,WAAmB;QACnD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,aAAa,WAAW,GAAG,CAAC;aACpD,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,GAAW,EAAE,SAAiB;QACpD,MAAM,MAAM,GAAG,gBAAgB,SAAS,gBAAgB,CAAC;QACzD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACpD,IAAI,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,sFAAsF;IAC9E,WAAW,CAAC,GAAW,EAAE,MAAc;QAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;iBAC3C,IAAI,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,2EAA2E;IACnE,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;CACJ;AAvGD,0CAuGC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { homedir } from 'os';\n\nimport { toError } from '../core/to-error';\nimport { CODEX_REGISTRATION, HookCommand, HookEntry, isManagedCommand, readSettings } from './hook-registration';\n\n/**\n * CODEX HOOK TRUST — read it, report it, NEVER write it.\n *\n * ─── What Codex actually does ─────────────────────────────────────────────────────────────────────\n * Codex trusts a hook entry TOFU. On first sight of a new or changed entry it PROMPTS\n * (`Hooks need review / 1 hook is new or changed`) and, if the human accepts, records a hash in\n * `~/.codex/config.toml`:\n *\n *     [hooks.state.\"<abs path to .codex/hooks.json>:pre_tool_use:<group>:<index>\"]\n *     trusted_hash = \"sha256:…\"\n *\n * ─── Why this only ever REPORTS ───────────────────────────────────────────────────────────────────\n * The hash is NOT reproducible from outside Codex. Sixteen encodings were tried against a hooks.json we\n * wrote ourselves and none of them produced the recorded value. So an installer that tried to write one\n * would be guessing at a security decision on a human's behalf, and would either be ignored or — worse —\n * appear to succeed. Forging it is not on the table even if the encoding were known: the prompt IS the\n * mechanism, and the whole point of TOFU is that a person saw the command once.\n *\n * The consequence the installer must therefore SAY OUT LOUD: the prompt's third option is\n * `Continue without trusting (hooks won't run)`. That is one keystroke to a fully unguarded session,\n * with no later warning of any kind. Install-time verification cannot see that choice — it happens\n * afterwards, in another process — which is exactly why guard-presence attestation exists as a separate\n * mechanism (see ./codex-guard-presence.ts) rather than being folded into this check.\n */\n\n/** What one repo's Codex trust looks like right now. Data-only → a class, per CLAUDE.md. */\nexport class CodexTrustStatus {\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        /** `~/.codex/config.toml`, named even when it does not exist so the report can point at it. */\n        readonly configPath: string,\n        readonly configExists: boolean,\n        /** `[projects.\"<root>\"] trust_level = \"trusted\"`. */\n        readonly projectTrusted: boolean,\n        /** The repo's `.codex/hooks.json`, absolute — the key every `hooks.state` entry is prefixed by. */\n        readonly hooksPath: string,\n        /** How many webpieces-managed PreToolUse entries that file registers. 0 ⇒ Codex is not armed. */\n        readonly registeredEntries: number,\n        /** How many of them `~/.codex/config.toml` records a `trusted_hash` for. */\n        readonly trustedEntries: number,\n    ) {}\n\n    /** True when Codex is armed here AND every entry it would run is trusted. */\n    fullyTrusted(): boolean {\n        return this.registeredEntries > 0 && this.trustedEntries >= this.registeredEntries && this.projectTrusted;\n    }\n\n    /** True when there is nothing to say — this repo has not armed Codex at all. */\n    notArmed(): boolean {\n        return this.registeredEntries === 0;\n    }\n\n    /**\n     * The report, as lines. It states what IS, then the one action that changes it — and the action is\n     * always the human's, because nothing here can be repaired by a tool.\n     */\n    lines(): readonly string[] {\n        if (this.notArmed()) return [];\n        if (this.fullyTrusted()) {\n            return [`  ✅ Codex trusts all ${String(this.registeredEntries)} webpieces hook(s) in ${this.hooksPath}`];\n        }\n        const out: string[] = [];\n        out.push(`  ⚠️  Codex has NOT yet trusted the webpieces hooks in ${this.hooksPath}`);\n        if (!this.configExists) {\n            out.push(`     ${this.configPath} does not exist yet — Codex has never run for this user.`);\n        } else if (!this.projectTrusted) {\n            out.push('     this project is not marked trusted in ~/.codex/config.toml.');\n        }\n        if (this.trustedEntries < this.registeredEntries) {\n            out.push(`     ${String(this.trustedEntries)} of ${String(this.registeredEntries)} hook entries carry a trusted_hash.`);\n        }\n        out.push('     Fix: run `codex` in this repo and choose \"Trust all\" when it asks about hooks.');\n        out.push('     Until you do, its third option (\"Continue without trusting\") leaves the session UNGUARDED —');\n        out.push('     which is what the guard-presence check on the build exists to catch.');\n        return out;\n    }\n}\n\n/**\n * Reads Codex's trust state. Never writes, never throws — an unreadable or absent config reports as\n * \"not trusted\", which is the true and safe answer.\n */\nexport class CodexTrustProbe {\n    /** `~/.codex/config.toml`. `homeDir` is injectable so a unit test never reads the real one. */\n    configPath(homeDir: string = homedir()): string {\n        return path.join(homeDir, '.codex', 'config.toml');\n    }\n\n    read(projectRoot: string, homeDir: string = homedir()): CodexTrustStatus {\n        const configPath = this.configPath(homeDir);\n        const hooksPath = path.join(projectRoot, ...CODEX_REGISTRATION.settingsFiles[0].split('/'));\n        const registered = this.registeredEntryCount(hooksPath);\n        const raw = this.readOrEmpty(configPath);\n        return new CodexTrustStatus(\n            configPath, raw !== null, this.projectTrusted(raw ?? '', projectRoot),\n            hooksPath, registered, this.trustedEntryCount(raw ?? '', hooksPath),\n        );\n    }\n\n    /**\n     * How many webpieces-managed PreToolUse commands `.codex/hooks.json` registers.\n     *\n     * It counts what WE own, not every hook in the file: a consumer's own unrelated hook is none of this\n     * check's business, and counting it would make the report say \"1 of 3 trusted\" about hooks webpieces\n     * neither wrote nor can advise on.\n     */\n    private registeredEntryCount(hooksPath: string): number {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            if (!fs.existsSync(hooksPath)) return 0;\n            const entries: readonly HookEntry[] = readSettings(hooksPath).hooks?.PreToolUse ?? [];\n            return entries.reduce(\n                (total: number, entry: HookEntry): number =>\n                    total + entry.hooks.filter((h: HookCommand): boolean => isManagedCommand(h.command)).length,\n                0,\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error; // an unreadable/invalid hooks.json is \"not armed\"; the drift check is what reports that\n            return 0;\n        }\n    }\n\n    private readOrEmpty(configPath: string): string | null {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            return fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8') : null;\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error; // unreadable → treated as absent, which reports as \"not trusted\"\n            return null;\n        }\n    }\n\n    /**\n     * `[projects.\"<root>\"]` carrying `trust_level = \"trusted\"`.\n     *\n     * A LINE SCAN, not a TOML parser, and deliberately: this package must load on a tree too broken to\n     * build a DI container, so it takes no dependency it does not need, and the two shapes it reads are\n     * both written by Codex itself in one fixed form. It over-reports \"not trusted\" for anything it\n     * cannot recognise, which is the safe direction — the consequence is one advisory line too many,\n     * never a session reported as guarded when it is not.\n     */\n    private projectTrusted(raw: string, projectRoot: string): boolean {\n        return this.sectionBody(raw, `projects.\"${projectRoot}\"`)\n            .some((line: string): boolean => /^\\s*trust_level\\s*=\\s*\"trusted\"\\s*$/.test(line));\n    }\n\n    /**\n     * How many `hooks.state.\"<hooksPath>:pre_tool_use:<group>:<index>\"` sections carry a `trusted_hash`.\n     *\n     * The count is compared against the number of entries the file registers rather than matched\n     * one-for-one to a specific group/index: the group and index are Codex's own numbering of a file it\n     * re-reads on every launch, and an installer that assumed a numbering would report a false alarm the\n     * first time Codex renumbered.\n     */\n    private trustedEntryCount(raw: string, hooksPath: string): number {\n        const prefix = `hooks.state.\"${hooksPath}:pre_tool_use:`;\n        let trusted = 0;\n        let inEntry = false;\n        for (const line of raw.split('\\n')) {\n            const header = this.headerOf(line);\n            if (header !== null) inEntry = header.startsWith(prefix);\n            else if (inEntry && /^\\s*trusted_hash\\s*=\\s*\"/.test(line)) trusted += 1;\n        }\n        return trusted;\n    }\n\n    /** The body lines of one TOML section, or [] when the file carries no such header. */\n    private sectionBody(raw: string, wanted: string): readonly string[] {\n        const body: string[] = [];\n        let inside = false;\n        for (const line of raw.split('\\n')) {\n            const header = this.headerOf(line);\n            if (header !== null) inside = header === wanted;\n            else if (inside) body.push(line);\n        }\n        return body;\n    }\n\n    /** The `<name>` of a `[<name>]` header line, or null for anything else. */\n    private headerOf(line: string): string | null {\n        const match = /^\\s*\\[([^\\]]+)\\]\\s*$/.exec(line);\n        return match === null ? null : match[1];\n    }\n}\n"]}