@webpieces/ai-hook-rules 0.4.710 → 0.4.712

package/src/bin/setup.js

@@ -2,11 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GUARDS_HOOK = exports.RULES_HOOK = exports.InstallTarget = void 0;
 exports.installTargets = installTargets;
-exports.migrate = migrate;
 exports.hasHook = hasHook;
 exports.applyHook = applyHook;
 exports.resolveTargetChoice = resolveTargetChoice;
 exports.parseTargetArg = parseTargetArg;
+exports.applyChoice = applyChoice;
 exports.main = main;
 const tslib_1 = require("tslib");
 const fs = tslib_1.__importStar(require("fs"));
@@ -14,17 +14,13 @@ const path = tslib_1.__importStar(require("path"));
 const os_1 = require("os");
 const readline_1 = require("readline");
 const rules_config_1 = require("@webpieces/rules-config");
-const to_error_1 = require("../core/to-error");
 const shim_1 = require("./shim");
 const hook_registration_1 = require("./hook-registration");
 const managed_env_1 = require("./managed-env");
-const CONFIG_FILENAME = 'webpieces.config.json';
-// The seeded buildCommand comes from @webpieces/rules-config, NOT from a copy here. This file used to
-// hold its own — with `--base=origin/main`, a DIFFERENT base from the one the gate documents — so a
-// freshly set-up repo was seeded with a command that rebuilds projects touched by other people's
-// merged PRs, and whole-repo-build-guard then quoted that command back in its refusals.
-const DEFAULT_UPSERT_PR = 'pnpm wp-start-upsert-pr';
-const DEFAULT_MERGE_COMPLETE = 'pnpm wp-finish-upsert-pr';
+const codex_trust_1 = require("./codex-trust");
+// The config half of the installer — seeding and migrating webpieces.config.json. Split for size along
+// the seam that was already there: this module is hook WIRING, that one is CONFIG SHAPE.
+const setup_config_1 = require("./setup-config");
 // ---------------------------------------------------------------------------
 // The two independently-installable GUARD hooks. Each can land in a different settings file (see
 // InstallTarget) so a team can ship the guards while a developer keeps the code-style rules local
@@ -35,23 +31,32 @@ const DEFAULT_MERGE_COMPLETE = 'pnpm wp-finish-upsert-pr';
 class HookSpec {
     key;
     label;
-    matcher;
     bin;
-    constructor(key, label, matcher, bin) {
+    constructor(key, label, bin) {
         this.key = key;
         this.label = label;
-        this.matcher = matcher;
         this.bin = bin;
     }
+    /**
+     * WHICH TOOL NAMES this hook must see, in the harness the target belongs to.
+     *
+     * It is a lookup on the target rather than a field on the spec because the answer is not a property
+     * of the hook: the rules hook matches `Write|Edit|MultiEdit` under Claude Code and `apply_patch`
+     * under Codex, and a single stored matcher is exactly how `.codex/hooks.json` came to be registered
+     * against tool names Codex never emits.
+     */
+    matcherFor(target) {
+        return target.harness.matcherFor(this.bin);
+    }
     // Absolute targets (global) need the exact path to this repo's bin — no ~/.webpieces bridge.
-    // Project targets get the ABSOLUTE shim command, `$CLAUDE_PROJECT_DIR/.claude/webpieces/ai-hook.sh`
-    // (see hook-registration.ts for why): it resolves from ANY cwd, so a hook can never fail to launch —
-    // which per the hooks reference would be exit 127, a SILENT UNGUARDED ALLOW rather than a block.
+    // Project targets get the ABSOLUTE shim command, anchored on the harness's own project-root variable
+    // (see HarnessRegistration.shimCommand): it resolves from ANY cwd, so a hook can never fail to
+    // launch — which per the hooks reference would be exit 127, a SILENT UNGUARDED ALLOW, not a block.
     commandFor(target, projectRoot) {
         if (target.absolute) {
             return `node ${path.join(projectRoot, 'node_modules', '.bin', this.bin)}`;
         }
-        return (0, hook_registration_1.shimCommand)(this.bin);
+        return target.harness.shimCommand(this.bin);
     }
 }
 // Idempotent: re-running the installer overwrites the managed shim in place.
@@ -105,361 +110,58 @@ class InstallTarget {
     label;
     settingsPath;
     absolute;
-    constructor(choice, label, settingsPath, absolute) {
+    harness;
+    // eslint-disable-next-line @typescript-eslint/max-params
+    constructor(choice, label, settingsPath, absolute, 
+    /**
+     * WHICH HARNESS this file arms — it decides the matcher and the shim anchor written into it.
+     *
+     * REQUIRED, with no default, and the absence of one is the point. A default of
+     * CLAUDE_REGISTRATION would make "omit the harness" mean "Claude Code" — a widening that is an
+     * ABSENCE rather than a token, so a target built for Codex without it would silently carry
+     * `Write|Edit|MultiEdit` and `$CLAUDE_PROJECT_DIR`, which is EXACTLY the silently-unguarded
+     * state this class exists to end, and ungreppable besides.
+     */
+    harness) {
         this.choice = choice;
         this.label = label;
         this.settingsPath = settingsPath;
         this.absolute = absolute;
+        this.harness = harness;
     }
 }
 exports.InstallTarget = InstallTarget;
-// The matchers and bin names come from ./hook-registration, which is also what the drift check and
-// wp-upgrade-shim compare against — one spelling of the registration, or the installer and the
-// validator can disagree about what "installed" means.
-exports.RULES_HOOK = new HookSpec('rules', 'Rules hook (code-style validation)', hook_registration_1.RULES_MATCHER, hook_registration_1.RULES_BIN);
-exports.GUARDS_HOOK = new HookSpec('guards', 'Guards hook (git/PR/branch protection)', hook_registration_1.GUARDS_MATCHER, hook_registration_1.GUARDS_BIN);
-// `homeDir` is injectable so tests can point the global target at a temp dir instead of the real
-// ~/.claude/settings.json (a unit test must never write the user's actual global settings).
-function installTargets(projectRoot, homeDir = (0, os_1.homedir)()) {
-    return [
-        new InstallTarget('1', 'project (.claude/settings.json — committed, for the team)', path.join(projectRoot, '.claude', 'settings.json'), false),
-        new InstallTarget('2', 'project for you (.claude/settings.local.json — personal)', path.join(projectRoot, '.claude', 'settings.local.json'), false),
-        new InstallTarget('3', 'global (~/.claude/settings.json — exact path, this repo only)', path.join(homeDir, '.claude', 'settings.json'), true),
-    ];
-}
-// webpieces-disable no-function-outside-class -- sibling of the other seed* helpers; this module is config-shape builders by design
-function seedRule(ruleName) {
-    // Both escape hatches are seeded (and REQUIRED) so every rule block shows them: 0 = active,
-    // null = no branch scoping. A human/AI edits these to time-box or branch-scope a rule off.
-    //
-    // The ENTIRE entry comes from rules-config's seedEntryForRule() — the same module that owns the
-    // schema the loader validates against, so the installer can never emit an entry the loader
-    // rejects. It supplies: the recommended mode (the SAME recommendation the validator prints in its
-    // copy-paste snippet, so seed and advice cannot disagree), both hatches, and a default for every
-    // other schema-REQUIRED field. Seeding used to be a flat 'OFF' plus the two hatches, which was
-    // wrong twice over: adopters got nothing enforced, AND the entry was missing required fields
-    // (e.g. branch-creation-guard.autoReapMergedBranches), so the config failed to load on first run.
-    return (0, rules_config_1.seedEntryForRule)(ruleName);
-}
-// The guard-hint command strings live under `guardHints`. The flat `upsertPr`/`mergeComplete` keys this
-// used to seed are RETIRED and now fail validation — seeding them meant every freshly installed repo was
-// born on a shape the validator rejects.
-function seedCommands() {
-    return {
-        'pr-gate': { mode: 'OFF', buildCommand: rules_config_1.DEFAULT_BUILD_COMMAND, gates: [] },
-        guardHints: { prCreationOrPush: DEFAULT_UPSERT_PR, mergeInProgress: DEFAULT_MERGE_COMPLETE },
-    };
-}
-// Required excludePaths block: ONE glob list suppressing hook enforcement per file path. Seeded empty
-// (enforce everywhere) — a client adds paths (e.g. "repositories/**") to exempt vendored trees.
-//
-// Deliberately NOT seeded with webpieces' own `.webpieces/` state dir. That exemption lives in CODE
-// (`isWebpiecesStateDir`, consulted by `filterByExcludedPaths` ahead of this list and regardless of it),
-// and a glob here would be a second, weaker spelling of it — weaker because `.webpieces/**` compiles to
-// an anchored regex that misses the bare directory the predicate matches, and because a config entry
-// invites a consumer to delete it and believe the exemption went with it.
-// webpieces-disable no-function-outside-class -- sibling of the other seed* helpers; this module is config-shape builders by design
-function seedExcludePaths() {
-    return [];
-}
-// Bring an existing `excludePaths` forward to the single-list shape. Already a list → untouched.
-// Legacy `{ rules, guards }` → unioned (order preserved, duplicates dropped) and recorded as a change
-// so `wp-install-ai-hooks` is the migration path rather than a hand-edit. Anything else → seeded [].
-// webpieces-disable no-any-unknown -- `raw` is opaque consumer JSON until narrowed here
-// webpieces-disable no-function-outside-class -- sibling of the other seed*/migrate* helpers; this module is config-shape builders by design
-function migrateExcludePaths(raw, changes) {
-    if (Array.isArray(raw))
-        return raw.filter(p => typeof p === 'string');
-    if (typeof raw === 'object' && raw !== null) {
-        // webpieces-disable no-any-unknown -- narrowing the opaque legacy block from consumer JSON
-        const legacy = raw;
-        const rules = Array.isArray(legacy['rules']) ? legacy['rules'] : [];
-        const guards = Array.isArray(legacy['guards']) ? legacy['guards'] : [];
-        const merged = [...new Set([...rules, ...guards].filter(p => typeof p === 'string'))];
-        changes.push(`migrated excludePaths {rules,guards} -> one list (${merged.length} path(s))`);
-        return merged;
-    }
-    changes.push('added excludePaths ([])');
-    return seedExcludePaths();
-}
-/** One retired flat command string and the guardHints field it becomes. Data-only (per CLAUDE.md). */
-class GuardHintMove {
-    retiredKey;
-    hintKey;
-    fallback;
-    constructor(retiredKey, hintKey, fallback) {
-        this.retiredKey = retiredKey;
-        this.hintKey = hintKey;
-        this.fallback = fallback;
-    }
-}
+// The bin names come from ./hook-registration, which is also what the drift check and wp-upgrade-shim
+// compare against — one spelling of the registration, or the installer and the validator can disagree
+// about what "installed" means. The MATCHER is not here: it belongs to the harness, not the hook (see
+// HookSpec.matcherFor).
+exports.RULES_HOOK = new HookSpec('rules', 'Rules hook (code-style validation)', hook_registration_1.RULES_BIN);
+exports.GUARDS_HOOK = new HookSpec('guards', 'Guards hook (git/PR/branch protection)', hook_registration_1.GUARDS_BIN);
 /**
- * Bring `commands` forward to the `guardHints` shape, moving the RETIRED flat `upsertPr`/`mergeComplete`
- * strings and DELETING them. Deleting is the point: the validator now rejects them, so leaving them behind
- * would keep the config failing after a "successful" sync.
+ * Every file the installer can write, keyed by the CHOICE a human makes.
  *
- * The consumer's own value wins over the default — a repo that renamed its gated command keeps that name.
- */
-// webpieces-disable no-function-outside-class -- sibling of the other seed*/migrate* helpers; this module is config-shape builders by design
-function migrateGuardHints(commands, changes) {
-    const hints = (typeof commands['guardHints'] === 'object' && commands['guardHints'] !== null)
-        ? commands['guardHints'] : {};
-    const moves = [
-        new GuardHintMove('upsertPr', 'prCreationOrPush', DEFAULT_UPSERT_PR),
-        new GuardHintMove('mergeComplete', 'mergeInProgress', DEFAULT_MERGE_COMPLETE),
-    ];
-    for (const move of moves) {
-        const retiredKey = move.retiredKey;
-        const hintKey = move.hintKey;
-        const fallback = move.fallback;
-        const carried = commands[retiredKey];
-        if (carried !== undefined) {
-            delete commands[retiredKey];
-            if (hints[hintKey] === undefined)
-                hints[hintKey] = carried;
-            changes.push(`moved retired commands.${retiredKey} -> commands.guardHints.${hintKey}`);
-        }
-        if (hints[hintKey] === undefined) {
-            hints[hintKey] = fallback;
-            changes.push(`added commands.guardHints.${hintKey}`);
-        }
-    }
-    commands['guardHints'] = hints;
-}
-/**
- * Apply the RETIRED rule/guard retirements in place. These used to be rewritten silently at load time, so
- * a consumer's file kept the dead name forever; the loader now rejects it, which makes this the one
- * command that can fix the file. Skips a rename when the new name is already configured, so an explicit
- * entry is never clobbered by a stale one.
+ * TWO TARGETS SHARE CHOICE `1`, and that is the design rather than an oversight: "the project, committed,
+ * for the team" is ONE intention, and a repo that is worked on by both harnesses needs both files armed
+ * to mean it. Splitting it into two questions would let a human answer them differently and end up with a
+ * repo where Codex is silently unguarded — which is the state this whole change exists to end. Every
+ * caller selects by choice id (`targets.filter(t => t.choice === answer)`), never by index, so adding a
+ * harness adds a row and changes no numbering.
  *
- * NOT EVERY RETIREMENT IS A RENAME, and treating them all as one produced garbage. `whole-repo-build-guard`
- * moved OUT of webpieces.config.json entirely — its `movedTo` is the PROSE destination
- * `~/.webpieces/config.json → experimental.whole-repo-build-guard`, not a sibling key — so the rename
- * branch below would have created a hookGuards entry literally named that whole sentence, which no
- * validator knows and which the next run reports as another unknown rule. `prunable` is the discriminator:
- * when the entry says deleting is the whole fix, DELETE it, exactly as `ConfigPruner` does.
- */
-// webpieces-disable no-function-outside-class -- sibling of the other seed*/migrate* helpers; this module is config-shape builders by design
-function migrateRetiredRuleNames(section, changes) {
-    for (const entry of rules_config_1.RETIRED_CONFIG_KEYS) {
-        if (entry.scope !== rules_config_1.RETIRED_SCOPE_RULE)
-            continue;
-        if (!(entry.key in section))
-            continue;
-        if (entry.prunable) {
-            delete section[entry.key];
-            changes.push(`deleted retired "${entry.key}" (it moved to ${entry.movedTo})`);
-            continue;
-        }
-        mergeIntoDestination(section, entry.key, entry.movedTo, changes);
-    }
-    fillRequiredFields(section, changes);
-}
-/**
- * Fold one retired key's entry into its destination, whether the destination exists yet or not.
- *
- * THIS IS N→1, NOT 1:1, and the difference is the whole reason this helper exists. Four retired keys
- * now point at ONE destination (`branch-state-guard`, `pr-lifecycle-guard`). The previous code renamed
- * the first key it met and then, finding the destination already present, DELETED each of the other
- * three outright — so which guard's settings survived depended on RETIRED_CONFIG_KEYS declaration
- * order rather than on the consumer's file, and the survivor carried only that one guard's fields, so
- * it was missing required fields of the merged schema. `wp-install-ai-hooks` is the command advertised
- * as the migration path; half-migrating every consumer into an invalid config is not an option.
+ * `2` (personal) and `3` (global) stay Claude-only because neither has a Codex counterpart: Codex reads
+ * one repo-local `hooks.json` and has no personal or home-scoped hook file.
  *
- * UNION, first writer wins per field. Earlier-declared keys are the more specific ones (only
- * feature-branch-guard carries `branchNamingConvention`), and a field already present on the
- * destination — because the consumer wrote it, or an earlier key contributed it — is never overwritten.
- * Fields the merged schema does not know are dropped by the same pass, since carrying a deleted field
- * across (`upsertPrCommand`) would produce a config the validator immediately rejects.
+ * `homeDir` is injectable so tests can point the global target at a temp dir instead of the real
+ * ~/.claude/settings.json (a unit test must never write the user's actual global settings).
  */
-// webpieces-disable no-function-outside-class -- sibling of the other seed*/migrate* helpers; this module is config-shape builders by design
-function mergeIntoDestination(section, key, destination, changes) {
-    const source = asSection(section[key]);
-    delete section[key];
-    const fields = (0, rules_config_1.schemaFieldNames)(destination);
-    const target = asSection(section[destination]);
-    const existed = destination in section;
-    const carried = [];
-    const dropped = [];
-    for (const field of Object.keys(source)) {
-        if (fields !== null && !fields.includes(field)) {
-            dropped.push(field);
-            continue;
-        }
-        if (field in target)
-            continue;
-        target[field] = source[field];
-        carried.push(field);
-    }
-    section[destination] = target;
-    const verb = existed ? 'merged' : 'renamed';
-    const droppedNote = dropped.length > 0 ? `; dropped deleted field(s) ${dropped.join(', ')}` : '';
-    changes.push(`${verb} retired "${key}" -> "${destination}" (carried ${carried.join(', ') || 'nothing new'}${droppedNote})`);
-}
-/**
- * Fill any schema-REQUIRED field a migrated entry ended up without.
- *
- * A union of four partial entries is not guaranteed to satisfy the destination's schema — the merged
- * `branch-state-guard` needs `mode` and both escape hatches, and a consumer whose four old entries
- * predate one of them would land short. Seeding the gap from the SAME source the installer and the
- * validator use (seedEntryForRule) is what makes the install command a complete instruction
- * rather than a first step. Only ever ADDS; a value the consumer stated is never touched.
- */
-// webpieces-disable no-function-outside-class -- sibling of the other seed*/migrate* helpers; this module is config-shape builders by design
-function fillRequiredFields(section, changes) {
-    for (const name of Object.keys(section)) {
-        if ((0, rules_config_1.schemaFieldNames)(name) === null)
-            continue;
-        // A rule ENTRY is a flat bag of scalars, so it is read as Json here rather than through
-        // asSection (whose values are whole entries). Same object either way; only the view differs.
-        const entry = asSection(section[name]);
-        const seed = (0, rules_config_1.seedEntryForRule)(name);
-        const added = [];
-        for (const field of Object.keys(seed)) {
-            if (field in entry)
-                continue;
-            entry[field] = seed[field];
-            added.push(field);
-        }
-        if (added.length === 0)
-            continue;
-        section[name] = entry;
-        changes.push(`filled required field(s) on "${name}": ${added.join(', ')}`);
-    }
-}
-// Deep-copy the framework's default match-rules (the no-fetch guard) into plain JSON for the config
-// file. Round-tripping through JSON turns the MatchRuleConfig instances into plain objects.
-function seedMatchRules() {
-    return JSON.parse(JSON.stringify(rules_config_1.DEFAULT_MATCH_RULES));
-}
-function buildSeedConfig() {
-    const rules = {};
-    const hookGuards = {};
-    for (const name of (0, rules_config_1.allRuleNames)()) {
-        if ((0, rules_config_1.sectionForRule)(name) === 'hookGuards')
-            hookGuards[name] = seedRule(name);
-        else
-            rules[name] = seedRule(name);
-    }
-    return {
-        rules, hookGuards, commands: seedCommands(), excludePaths: seedExcludePaths(),
-        // Seed the required match-rules array with the framework's default no-fetch guard. A fresh
-        // project gets contract-first enforcement out of the box; clients edit it and add more entries.
-        'match-rules': seedMatchRules(),
-        rulesDir: [],
-    };
-}
-function writeConfig(configPath, config) {
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 4) + '\n');
-}
-function readConfig(configPath) {
-    const raw = fs.readFileSync(configPath, 'utf8');
-    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
-    try {
-        return JSON.parse(raw);
-    }
-    catch (err) {
-        const error = (0, to_error_1.toError)(err);
-        throw new Error(`${CONFIG_FILENAME} has invalid JSON — fix it, then retry: ${error.message}`, { cause: error });
-    }
-}
-function asSection(value) {
-    return (typeof value === 'object' && value !== null && !Array.isArray(value)) ? value : {};
-}
-// Migrate an existing config to the rules / hookGuards / commands layout and add any missing rules.
-// Returns a human-readable list of what changed (empty = already up to date).
-function migrate(existing) {
-    const changes = [];
-    const rules = asSection(existing['rules']);
-    const hookGuards = asSection(existing['hookGuards']);
-    const commands = (typeof existing['commands'] === 'object' && existing['commands'] !== null)
-        ? existing['commands'] : {};
-    // Move a deprecated top-level pr-gate block under commands.
-    if (existing['pr-gate'] !== undefined && commands['pr-gate'] === undefined) {
-        commands['pr-gate'] = existing['pr-gate'];
-        changes.push('moved top-level "pr-gate" → commands["pr-gate"]');
-    }
-    // Apply retired RENAMES first, so a renamed guard is placed and presence-checked under its new name
-    // rather than being treated as unknown and re-added alongside its own stale entry.
-    migrateRetiredRuleNames(rules, changes);
-    migrateRetiredRuleNames(hookGuards, changes);
-    // Move guards mistakenly left in rules into hookGuards.
-    for (const name of Object.keys(rules)) {
-        if ((0, rules_config_1.isHookGuard)(name)) {
-            hookGuards[name] = rules[name];
-            delete rules[name];
-            changes.push(`moved "${name}" from rules → hookGuards`);
-        }
-    }
-    // Move code rules mistakenly placed in hookGuards back into rules.
-    for (const name of Object.keys(hookGuards)) {
-        if (!(0, rules_config_1.isHookGuard)(name) && (0, rules_config_1.allRuleNames)().includes(name)) {
-            rules[name] = hookGuards[name];
-            delete hookGuards[name];
-            changes.push(`moved "${name}" from hookGuards → rules`);
-        }
-    }
-    // Add any missing built-in into its correct section, ENFORCING at its recommended mode (not OFF).
-    for (const name of (0, rules_config_1.allRuleNames)()) {
-        const target = (0, rules_config_1.sectionForRule)(name) === 'hookGuards' ? hookGuards : rules;
-        if (!(name in target)) {
-            const entry = seedRule(name);
-            target[name] = entry;
-            changes.push(`added "${name}" (${String(entry['mode'])}) to ${(0, rules_config_1.sectionForRule)(name)}`);
-        }
-    }
-    // Fill command defaults.
-    if (commands['pr-gate'] === undefined) {
-        commands['pr-gate'] = { mode: 'OFF', buildCommand: rules_config_1.DEFAULT_BUILD_COMMAND, gates: [] };
-        changes.push('added commands["pr-gate"] (OFF)');
-    }
-    migrateGuardHints(commands, changes);
-    // Seed the now-required excludePaths list (empty = enforce everywhere) if the config predates it,
-    // and MIGRATE the legacy `{ rules: [], guards: [] }` object to the single list by unioning them.
-    // The union is behaviour-preserving for every config we have seen (both lists set identically), and
-    // widening is the safe direction anyway: a path either side excluded stays excluded.
-    const excludePaths = migrateExcludePaths(existing['excludePaths'], changes);
-    // Seed the now-required match-rules array (with the default no-fetch guard) if the config predates
-    // it. A client that has already customized it keeps their array untouched.
-    let matchRules;
-    if (Array.isArray(existing['match-rules'])) {
-        matchRules = existing['match-rules'];
-    }
-    else {
-        matchRules = seedMatchRules();
-        changes.push('added "match-rules" (seeded with the no-fetch guard)');
-    }
-    const rulesDir = Array.isArray(existing['rulesDir']) ? existing['rulesDir'] : [];
-    const config = { rules, hookGuards, commands, excludePaths, 'match-rules': matchRules, rulesDir };
-    if (typeof existing['extends'] === 'string')
-        config.extends = existing['extends'];
-    return { config, changes };
-}
-// Seed the config when it is missing, migrate it when it is not. ONE behaviour, always — there is no
-// "migrate but stop here" mode any more. The flag that used to select it was never NECESSARY (the validator prints
-// the exact edit for every error at once, and editing webpieces.config.json is always allowed through the
-// guard — the documented primary cure), it REFUSED to act when the config was missing (useless in the one
-// case automation would have helped), and it gave deny messages a second competing path when they are
-// supposed to end in exactly one action. Readers also mistook it for the shim-repair command, which it
-// never was — `wp-upgrade-shim` is that.
-// webpieces-disable no-function-outside-class -- setup.ts is deliberately DI-free (it must run on a half-written node_modules; see install-entry.ts), so every function here is module-scope
-function seedOrSyncConfig(projectRoot) {
-    const configPath = path.join(projectRoot, CONFIG_FILENAME);
-    if (!fs.existsSync(configPath)) {
-        writeConfig(configPath, buildSeedConfig());
-        console.log(`  [ai-hooks] Created ${CONFIG_FILENAME} (rules / hookGuards / commands); each rule seeded at its recommended mode — gradual where supported, so only code you change is enforced.`);
-        console.log('  Enable the ones you want by changing "mode".');
-        return;
-    }
-    const result = migrate(readConfig(configPath));
-    if (result.changes.length === 0) {
-        console.log(`  [ai-hooks] ${CONFIG_FILENAME} already uses the rules / hookGuards / commands layout — no changes.`);
-        return;
-    }
-    writeConfig(configPath, result.config);
-    console.log(`  [ai-hooks] Migrated ${CONFIG_FILENAME}:`);
-    for (const change of result.changes)
-        console.log(`    - ${change}`);
+function installTargets(projectRoot, homeDir = (0, os_1.homedir)()) {
+    return [
+        new InstallTarget('1', 'project (.claude/settings.json — committed, for the team)', path.join(projectRoot, '.claude', 'settings.json'), false, hook_registration_1.CLAUDE_REGISTRATION),
+        new InstallTarget('2', 'project for you (.claude/settings.local.json — personal)', path.join(projectRoot, '.claude', 'settings.local.json'), false, hook_registration_1.CLAUDE_REGISTRATION),
+        new InstallTarget('3', 'global (~/.claude/settings.json — exact path, this repo only)', path.join(homeDir, '.claude', 'settings.json'), true, hook_registration_1.CLAUDE_REGISTRATION),
+        // Given choice `1` so one answer arms the whole project — see the docblock. Its position in the
+        // array carries no meaning: every caller selects by choice id.
+        new InstallTarget('1', 'project, for Codex too (.codex/hooks.json — committed, for the team)', path.join(projectRoot, ...hook_registration_1.CODEX_REGISTRATION.settingsFiles[0].split('/')), false, hook_registration_1.CODEX_REGISTRATION),
+    ];
 }
 // ---------------------------------------------------------------------------
 // Claude Code settings.json hook wiring.
@@ -493,19 +195,26 @@ function removeHookByMarker(settings, marker) {
 // Apply the chosen install for one hook: remove it from every target file, then add it back to the
 // chosen one (or nowhere, for uninstall). Writes only the files that changed.
 function applyHook(hook, chosen, targets, projectRoot) {
-    for (const target of targets) {
+    // SCOPED TO THE CHOSEN HARNESS, and this is what makes one call per target composable. Installing
+    // the Claude hook must not strip the Codex one, so "remove it from everywhere else" means everywhere
+    // else THIS HARNESS could live. Uninstall (chosen === null) is the one case that means every
+    // harness, because "not installed" has to be true everywhere or the hook is still armed somewhere.
+    const scope = chosen === null ? targets : targets.filter((t) => t.harness === chosen.harness);
+    for (const target of scope) {
         const settings = (0, hook_registration_1.readSettings)(target.settingsPath);
         const removed = removeHookByMarker(settings, hook.bin);
         const isChosen = chosen !== null && chosen.settingsPath === target.settingsPath;
         if (isChosen) {
-            (0, hook_registration_1.addHookEntry)(settings, new hook_registration_1.HookRegistrationEntry(hook.matcher, hook.commandFor(target, projectRoot)));
+            (0, hook_registration_1.addHookEntry)(settings, new hook_registration_1.HookRegistrationEntry(hook.matcherFor(target), hook.commandFor(target, projectRoot)));
             // The managed `env` entry goes into the SAME file the hooks go into, on every path that
             // writes hooks — interactive or `--target=`. It pins the Bash cwd to the project root, so a
             // guard's answer depends on the command rather than on where an earlier `cd` left the shell,
             // and settings `env` is inherited, so every subagent gets the identical cwd and therefore the
             // identical guard verdict. (It no longer has a RESOLUTION job — the hooks are absolute.) See
             // hook-registration.ts for the full argument; `wp-upgrade-shim` self-heals it afterwards.
-            if ((0, hook_registration_1.applyManagedEnv)(settings)) {
+            // …in the harness that HAS that surface. Codex has no settings `env`, and needs none: its
+            // cwd is MEASURED not to drift, which is the whole thing this entry buys under Claude Code.
+            if (target.harness.managesEnv && (0, hook_registration_1.applyManagedEnv)(settings)) {
                 console.log(`  ✅ env.${managed_env_1.BASH_CWD_ENV_KEY}=${managed_env_1.BASH_CWD_ENV_VALUE} → ${target.label} (pins the Bash cwd to the project root, for this session and every subagent)`);
             }
             (0, hook_registration_1.writeSettings)(target.settingsPath, settings);
@@ -531,6 +240,30 @@ function applyHook(hook, chosen, targets, projectRoot) {
     if (chosen === null)
         console.log(`  ⛔ ${hook.label} not installed (removed from all locations).`);
 }
+/**
+ * Say whether Codex will actually RUN what we just registered — the one thing the installer cannot do
+ * anything about and therefore must not leave silent.
+ *
+ * Codex trusts a hook entry TOFU and re-prompts whenever its bytes change, and the prompt's third option
+ * is "Continue without trusting (hooks won't run)". So a perfectly successful install can be followed by
+ * a fully unguarded session, and the only honest thing to print is what is true plus the one action a
+ * HUMAN has to take. Nothing here writes `~/.codex/config.toml` — see codex-trust.ts for why forging a
+ * `trusted_hash` is not on the table.
+ *
+ * Silent when this repo did not arm Codex, so a Claude-only install gains no noise.
+ */
+// webpieces-disable no-function-outside-class -- setup.ts is deliberately DI-free (it must run on a half-written node_modules; see install-entry.ts), so every function here is module-scope
+function reportCodexTrust(projectRoot, targets, choice) {
+    const armed = targets.some((t) => t.choice === choice && t.harness === hook_registration_1.CODEX_REGISTRATION);
+    if (!armed)
+        return;
+    const lines = new codex_trust_1.CodexTrustProbe().read(projectRoot).lines();
+    if (lines.length === 0)
+        return;
+    console.log('');
+    for (const line of lines)
+        console.log(line);
+}
 function currentLocation(hook, targets) {
     const here = targets.filter((t) => hasHook((0, hook_registration_1.readSettings)(t.settingsPath), hook.bin));
     return here.length === 0 ? 'none' : here.map((t) => t.label.split(' (')[0]).join(', ');
@@ -560,16 +293,35 @@ function parseTargetArg(args) {
     const flag = args.find((a) => a.startsWith('--target='));
     return flag ? flag.slice('--target='.length) : null;
 }
+/**
+ * Apply ONE choice for one hook: every target that answer selects, or uninstall when it selects none.
+ *
+ * The loop is what lets one choice arm several harnesses (choice `1` writes both the Claude settings
+ * file and the Codex hooks file — see installTargets). `applyHook` scopes its removals to the chosen
+ * target's harness, which is what keeps these calls from undoing one another.
+ */
+// webpieces-disable no-function-outside-class -- setup.ts is deliberately DI-free (it must run on a half-written node_modules; see install-entry.ts), so every function here is module-scope
+function applyChoice(hook, choice, targets, projectRoot) {
+    const chosen = targets.filter((t) => t.choice === choice);
+    if (chosen.length === 0) {
+        applyHook(hook, null, targets, projectRoot);
+        return;
+    }
+    for (const target of chosen)
+        applyHook(hook, target, targets, projectRoot);
+}
 async function wireHook(hook, targets, projectRoot) {
     console.log('');
-    console.log(`${hook.label}  [matcher: ${hook.matcher}]`);
+    console.log(`${hook.label}`);
     console.log(`  currently installed in: ${currentLocation(hook, targets)}`);
+    // The matcher is printed PER TARGET now, because it differs per harness — Codex's file tool is
+    // `apply_patch`, Claude's are Write|Edit|MultiEdit — and one matcher printed above the list would be
+    // wrong for whichever harness it did not describe.
     for (const target of targets)
-        console.log(`    ${target.choice}) ${target.label}`);
+        console.log(`    ${target.choice}) ${target.label}  [matcher: ${hook.matcherFor(target)}]`);
     console.log('    4) none / uninstall');
     const answer = await prompt('  Where should it live? [1/2/3/4, default 4]: ');
-    const chosen = targets.find((t) => t.choice === answer) ?? null;
-    applyHook(hook, chosen, targets, projectRoot);
+    applyChoice(hook, answer, targets, projectRoot);
 }
 /**
  * Scaffold the SERVER-SIDE PR gate: the CI workflow plus the doc explaining how to turn it on.
@@ -601,7 +353,7 @@ async function main() {
     // Anchor the install at the repo root (git toplevel — webpieces.config.json may not exist yet on
     // a first install), never a subdir cwd, so `.webpieces`/hooks/config all land at the root.
     const projectRoot = new rules_config_1.RepoRootFinder().resolveRepoRoot(process.cwd());
-    seedOrSyncConfig(projectRoot);
+    (0, setup_config_1.seedOrSyncConfig)(projectRoot);
     // Always refreshed: it explains why a retired key is rejected rather than accepted, and what to do
     // about it — which is exactly what an agent needs on the run where a migration just moved keys out
     // from under its config.
@@ -619,16 +371,19 @@ async function main() {
             process.exitCode = 1;
             return;
         }
-        const chosen = targets.find((t) => t.choice === choice) ?? null;
-        applyHook(exports.RULES_HOOK, chosen, targets, projectRoot);
-        applyHook(exports.GUARDS_HOOK, chosen, targets, projectRoot);
+        applyChoice(exports.RULES_HOOK, choice, targets, projectRoot);
+        applyChoice(exports.GUARDS_HOOK, choice, targets, projectRoot);
         console.log(`\nDone. Both hooks set to: ${targetName}.`);
+        reportCodexTrust(projectRoot, targets, choice);
         return;
     }
     console.log('');
     console.log('Two webpieces hooks can be installed independently — choose a location for each:');
     await wireHook(exports.RULES_HOOK, targets, projectRoot);
     await wireHook(exports.GUARDS_HOOK, targets, projectRoot);
+    // Whichever choices were made above, report Codex trust for the project choice — an interactive run
+    // that armed Codex needs the same warning the --target path prints.
+    reportCodexTrust(projectRoot, targets, '1');
     console.log('');
     console.log('Done. Re-run `pnpm wp-install-ai-hooks` anytime to move or uninstall a hook.');
     console.log('(Non-interactive: pnpm wp-install-ai-hooks --target=project|project-personal|global|none)');