@webpieces/hook-runtime 0.0.1

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@webpieces/hook-runtime",
+  "version": "0.0.1",
+  "description": "Agent hook protocol, normalized events, and fail-closed application boundary.",
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./package.json": "./package.json",
+    "./harness-vocabulary": "./src/harness-vocabulary.js"
+  },
+  "files": [
+    "src/**/*"
+  ],
+  "author": "Dean Hiller",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/deanhiller/webpieces-ts.git",
+    "directory": "packages/tooling/hook-runtime"
+  },
+  "dependencies": {
+    "inversify": "7.10.4",
+    "reflect-metadata": "0.2.2",
+    "@webpieces/rules-config": "0.4.845",
+    "@webpieces/tooling-common": "0.0.1",
+    "tslib": "2.8.1",
+    "@webpieces/rules-sdk": "0.0.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@webpieces/tooling-testkit": "0.0.1"
+  },
+  "types": "./src/index.d.ts"
+}

package/src/adapters/agent-adapters.d.ts

@@ -0,0 +1,13 @@
+import { AgentPayload } from './agent-payload';
+import { AgentHookEvent } from '../protocol';
+/**
+ * The ONE place a payload is routed to its harness's adapter. Every other module takes an
+ * `AgentHookEvent` and never asks which agent produced it — except the two codex-only surfaces
+ * (read parity, the shared-tree subagent guard), which check `aiType` explicitly and say so.
+ */
+export declare class AgentAdapters {
+    private readonly claude;
+    private readonly codex;
+    envelope(payload: AgentPayload): AgentHookEvent;
+    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent;
+}

package/src/adapters/agent-adapters.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentAdapters = void 0;
+const detect_ai_1 = require("./detect-ai");
+const claude_code_adapter_1 = require("./claude-code-adapter");
+const codex_adapter_1 = require("./codex-adapter");
+/**
+ * The ONE place a payload is routed to its harness's adapter. Every other module takes an
+ * `AgentHookEvent` and never asks which agent produced it — except the two codex-only surfaces
+ * (read parity, the shared-tree subagent guard), which check `aiType` explicitly and say so.
+ */
+class AgentAdapters {
+    claude = new claude_code_adapter_1.ClaudeCodeAdapter();
+    codex = new codex_adapter_1.CodexAdapter();
+    envelope(payload) {
+        return (0, detect_ai_1.detectAiType)(payload) === 'codex' ? this.codex.envelope(payload) : this.claude.envelope(payload);
+    }
+    toEvent(payload, cwd) {
+        return (0, detect_ai_1.detectAiType)(payload) === 'codex' ? this.codex.toEvent(payload, cwd) : this.claude.toEvent(payload, cwd);
+    }
+}
+exports.AgentAdapters = AgentAdapters;
+//# sourceMappingURL=agent-adapters.js.map

package/src/adapters/agent-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-adapters.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/adapters/agent-adapters.ts"],"names":[],"mappings":";;;AAEA,2CAA2C;AAC3C,+DAA0D;AAC1D,mDAA+C;AAE/C;;;;GAIG;AACH,MAAa,aAAa;IACL,MAAM,GAAG,IAAI,uCAAiB,EAAE,CAAC;IACjC,KAAK,GAAG,IAAI,4BAAY,EAAE,CAAC;IAE5C,QAAQ,CAAC,OAAqB;QAC1B,OAAO,IAAA,wBAAY,EAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,CAAC,OAAqB,EAAE,GAAW;QACtC,OAAO,IAAA,wBAAY,EAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpH,CAAC;CACJ;AAXD,sCAWC","sourcesContent":["import { AgentPayload } from './agent-payload';\nimport { AgentHookEvent } from '../protocol';\nimport { detectAiType } from './detect-ai';\nimport { ClaudeCodeAdapter } from './claude-code-adapter';\nimport { CodexAdapter } from './codex-adapter';\n\n/**\n * The ONE place a payload is routed to its harness's adapter. Every other module takes an\n * `AgentHookEvent` and never asks which agent produced it — except the two codex-only surfaces\n * (read parity, the shared-tree subagent guard), which check `aiType` explicitly and say so.\n */\nexport class AgentAdapters {\n    private readonly claude = new ClaudeCodeAdapter();\n    private readonly codex = new CodexAdapter();\n\n    envelope(payload: AgentPayload): AgentHookEvent {\n        return detectAiType(payload) === 'codex' ? this.codex.envelope(payload) : this.claude.envelope(payload);\n    }\n\n    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent {\n        return detectAiType(payload) === 'codex' ? this.codex.toEvent(payload, cwd) : this.claude.toEvent(payload, cwd);\n    }\n}\n"]}

package/src/adapters/agent-payload.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The RAW PreToolUse wire envelope, as it arrives on stdin.
+ *
+ * ONE shape for both harnesses, because that is what was measured: Codex uses the SAME key names as
+ * Claude Code (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`,
+ * `agent_id`, `agent_type`) and merely ADDS `model`, `turn_id` and `tool_use_id`. A second payload
+ * type for the second harness would be two spellings of one thing.
+ *
+ * Interfaces, not classes, and deliberately so: nothing in this codebase ever CONSTRUCTS one of these.
+ * They describe bytes somebody else wrote, which `JSON.parse` hands back as a plain object — the same
+ * reason the shape this replaces was an interface.
+ */
+export interface AgentPayload {
+    tool_name: string;
+    tool_input: AgentToolInput;
+    /** The session's current working directory. Used to scope guards to the tree the agent is in. */
+    cwd?: string;
+    session_id?: string;
+    /** Empty/absent ⇒ the coordinator, populated ⇒ a subagent. MEASURED identical in both harnesses. */
+    agent_id?: string;
+    agent_type?: string;
+    /** Codex-only, and REQUIRED there. The one discriminator — see ./detect-ai.ts. */
+    turn_id?: string;
+}
+export interface AgentToolInput {
+    file_path?: string;
+    content?: string;
+    old_string?: string;
+    new_string?: string;
+    edits?: AgentEditEntry[];
+    command?: string;
+}
+export interface AgentEditEntry {
+    old_string?: string;
+    new_string?: string;
+}
+export declare class AgentPayloadParser {
+    /**
+     * Returns null for empty stdin (nothing to judge); throws InformAiError on unparseable bytes.
+     *
+     * The message still names Claude Code even though this path is shared, and that is DELIBERATE and
+     * temporary: the overriding constraint on this change is that no Claude Code behaviour moves, and a
+     * user-visible string is behaviour. Renaming it is a one-line follow-up once the Codex path is
+     * actually armed (it cannot mislead anyone before then — no Codex session reaches this code until
+     * the installer lands).
+     */
+    parse(raw: string): AgentPayload | null;
+}

package/src/adapters/agent-payload.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentPayloadParser = void 0;
+const tooling_common_1 = require("@webpieces/tooling-common");
+const to_error_1 = require("@webpieces/tooling-common/to-error");
+class AgentPayloadParser {
+    /**
+     * Returns null for empty stdin (nothing to judge); throws InformAiError on unparseable bytes.
+     *
+     * The message still names Claude Code even though this path is shared, and that is DELIBERATE and
+     * temporary: the overriding constraint on this change is that no Claude Code behaviour moves, and a
+     * user-visible string is behaviour. Renaming it is a one-line follow-up once the Codex path is
+     * actually armed (it cannot mislead anyone before then — no Codex session reaches this code until
+     * the installer lands).
+     */
+    parse(raw) {
+        if (!raw || raw.trim() === '')
+            return null;
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            throw new tooling_common_1.InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });
+        }
+    }
+}
+exports.AgentPayloadParser = AgentPayloadParser;
+//# sourceMappingURL=agent-payload.js.map

package/src/adapters/agent-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-payload.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/adapters/agent-payload.ts"],"names":[],"mappings":";;;AAAA,8DAA0D;AAC1D,iEAA6D;AAyC7D,MAAa,kBAAkB;IAC3B;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAW;QACb,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3C,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,8BAAa,CAAC,gDAAgD,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;CACJ;AApBD,gDAoBC","sourcesContent":["import { InformAiError } from '@webpieces/tooling-common';\nimport { toError } from '@webpieces/tooling-common/to-error';\n\n/**\n * The RAW PreToolUse wire envelope, as it arrives on stdin.\n *\n * ONE shape for both harnesses, because that is what was measured: Codex uses the SAME key names as\n * Claude Code (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`,\n * `agent_id`, `agent_type`) and merely ADDS `model`, `turn_id` and `tool_use_id`. A second payload\n * type for the second harness would be two spellings of one thing.\n *\n * Interfaces, not classes, and deliberately so: nothing in this codebase ever CONSTRUCTS one of these.\n * They describe bytes somebody else wrote, which `JSON.parse` hands back as a plain object — the same\n * reason the shape this replaces was an interface.\n */\nexport interface AgentPayload {\n    tool_name: string;\n    tool_input: AgentToolInput;\n    /** The session's current working directory. Used to scope guards to the tree the agent is in. */\n    cwd?: string;\n    session_id?: string;\n    /** Empty/absent ⇒ the coordinator, populated ⇒ a subagent. MEASURED identical in both harnesses. */\n    agent_id?: string;\n    agent_type?: string;\n    /** Codex-only, and REQUIRED there. The one discriminator — see ./detect-ai.ts. */\n    turn_id?: string;\n}\n\nexport interface AgentToolInput {\n    file_path?: string;\n    content?: string;\n    old_string?: string;\n    new_string?: string;\n    edits?: AgentEditEntry[];\n    command?: string;\n}\n\nexport interface AgentEditEntry {\n    old_string?: string;\n    new_string?: string;\n}\n\nexport class AgentPayloadParser {\n    /**\n     * Returns null for empty stdin (nothing to judge); throws InformAiError on unparseable bytes.\n     *\n     * The message still names Claude Code even though this path is shared, and that is DELIBERATE and\n     * temporary: the overriding constraint on this change is that no Claude Code behaviour moves, and a\n     * user-visible string is behaviour. Renaming it is a one-line follow-up once the Codex path is\n     * actually armed (it cannot mislead anyone before then — no Codex session reaches this code until\n     * the installer lands).\n     */\n    parse(raw: string): AgentPayload | null {\n        if (!raw || raw.trim() === '') return null;\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            return JSON.parse(raw) as AgentPayload;\n        } catch (err: unknown) {\n            const error = toError(err);\n            throw new InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });\n        }\n    }\n}\n"]}

package/src/adapters/claude-code-adapter.d.ts

@@ -0,0 +1,26 @@
+import { AgentPayload } from './agent-payload';
+import { AgentHookEvent } from '../protocol';
+/**
+ * Morphs a Claude Code PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * This is the SAME `normalizeToolKind` / `normalizeToolInput` logic that used to live inline in
+ * hook-core.ts, moved out unchanged so hook-core is written once for every harness. Claude Code is the
+ * harness every developer uses today, so nothing about the mapping is allowed to move: `Write` still
+ * becomes one edit of `content` against '', `Edit` one edit of `old_string`→`new_string`, `MultiEdit`
+ * one per entry, and a file tool with no `file_path` still ends up allowed (kind `Ignored`).
+ */
+export declare class ClaudeCodeAdapter {
+    /**
+     * What is known from the ENVELOPE ALONE, touching nothing but `tool_name` and the identity fields.
+     *
+     * Not a second spelling of `toEvent` — a different question, asked at a moment when the answer to
+     * the other one may not exist. `toEvent` reads `tool_input`, and a payload whose `tool_input` is
+     * missing makes it throw; the crash then still has to be DENIED, and the deny still has to know
+     * whether it is decorating a Bash block (which needs the red `systemMessage`) or a file block
+     * (which does not). This is the shape that answers that, and it cannot fail.
+     */
+    envelope(payload: AgentPayload): AgentHookEvent;
+    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent;
+    private kindOf;
+    private fileOperations;
+}

package/src/adapters/claude-code-adapter.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaudeCodeAdapter = void 0;
+const protocol_1 = require("../protocol");
+const protocol_2 = require("../protocol");
+/**
+ * The Claude Code tools that enter the file/edit rule pipeline. `Read` is deliberately NOT here — it
+ * has its own fast path and only one guard may see it.
+ */
+const HANDLED_FILE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);
+/**
+ * Morphs a Claude Code PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * This is the SAME `normalizeToolKind` / `normalizeToolInput` logic that used to live inline in
+ * hook-core.ts, moved out unchanged so hook-core is written once for every harness. Claude Code is the
+ * harness every developer uses today, so nothing about the mapping is allowed to move: `Write` still
+ * becomes one edit of `content` against '', `Edit` one edit of `old_string`→`new_string`, `MultiEdit`
+ * one per entry, and a file tool with no `file_path` still ends up allowed (kind `Ignored`).
+ */
+class ClaudeCodeAdapter {
+    /**
+     * What is known from the ENVELOPE ALONE, touching nothing but `tool_name` and the identity fields.
+     *
+     * Not a second spelling of `toEvent` — a different question, asked at a moment when the answer to
+     * the other one may not exist. `toEvent` reads `tool_input`, and a payload whose `tool_input` is
+     * missing makes it throw; the crash then still has to be DENIED, and the deny still has to know
+     * whether it is decorating a Bash block (which needs the red `systemMessage`) or a file block
+     * (which does not). This is the shape that answers that, and it cannot fail.
+     */
+    envelope(payload) {
+        return new protocol_1.AgentHookEvent('claude-code', this.kindOf(payload.tool_name), payload.tool_name, payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', [], null, []);
+    }
+    toEvent(payload, cwd) {
+        const kind = this.kindOf(payload.tool_name);
+        const toolInput = payload.tool_input;
+        const bash = kind === 'Bash' ? new protocol_2.NormalizedBashInput(toolInput.command ?? '') : null;
+        const reads = kind === 'Read' ? [toolInput.file_path ?? ''] : [];
+        const files = kind === 'File' ? this.fileOperations(payload.tool_name, toolInput) : [];
+        // A file tool that named no file has nothing to judge; fall back to Ignored so the hook allows
+        // it, exactly as the old `if (!input) emitAllow()` did.
+        const effective = kind === 'File' && files.length === 0 ? 'Ignored' : kind;
+        return new protocol_1.AgentHookEvent('claude-code', effective, payload.tool_name, cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', files, bash, reads);
+    }
+    kindOf(toolName) {
+        if (toolName === 'Bash')
+            return 'Bash';
+        if (toolName === 'Read')
+            return 'Read';
+        if (HANDLED_FILE_TOOLS.has(toolName))
+            return 'File';
+        return 'Ignored';
+    }
+    fileOperations(toolKind, toolInput) {
+        const filePath = toolInput.file_path;
+        if (!filePath)
+            return [];
+        if (toolKind === 'Write') {
+            return [new protocol_1.FileOperation(toolKind, new protocol_2.NormalizedToolInput(filePath, [new protocol_2.NormalizedEdit('', toolInput.content || '')]))];
+        }
+        if (toolKind === 'Edit') {
+            return [new protocol_1.FileOperation(toolKind, new protocol_2.NormalizedToolInput(filePath, [new protocol_2.NormalizedEdit(toolInput.old_string || '', toolInput.new_string || '')]))];
+        }
+        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];
+        const edits = raw.map((e) => new protocol_2.NormalizedEdit(e.old_string || '', e.new_string || ''));
+        return [new protocol_1.FileOperation(toolKind, new protocol_2.NormalizedToolInput(filePath, edits))];
+    }
+}
+exports.ClaudeCodeAdapter = ClaudeCodeAdapter;
+//# sourceMappingURL=claude-code-adapter.js.map

package/src/adapters/claude-code-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-adapter.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/adapters/claude-code-adapter.ts"],"names":[],"mappings":";;;AACA,0CAA4E;AAC5E,0CAAiG;AAEjG;;;GAGG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,MAAa,iBAAiB;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAqB;QAC1B,OAAO,IAAI,yBAAc,CACrB,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,EAChE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC7F,EAAE,EAAE,IAAI,EAAE,EAAE,CACf,CAAC;IACN,CAAC;IAED,OAAO,CAAC,OAAqB,EAAE,GAAW;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,8BAAmB,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,+FAA+F;QAC/F,wDAAwD;QACxD,MAAM,SAAS,GAAmB,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,OAAO,IAAI,yBAAc,CACrB,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAC3C,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC/E,KAAK,EAAE,IAAI,EAAE,KAAK,CACrB,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC3B,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QACpD,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,cAAc,CAAC,QAAkB,EAAE,SAAyB;QAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,wBAAa,CAAC,QAAQ,EAAE,IAAI,8BAAmB,CAAC,QAAQ,EAAE,CAAC,IAAI,yBAAc,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,wBAAa,CAAC,QAAQ,EAAE,IAAI,8BAAmB,CAAC,QAAQ,EAAE,CAAC,IAAI,yBAAc,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1J,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAkB,EAAE,CAAC,IAAI,yBAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QACzH,OAAO,CAAC,IAAI,wBAAa,CAAC,QAAQ,EAAE,IAAI,8BAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;CACJ;AAtDD,8CAsDC","sourcesContent":["import { AgentPayload, AgentToolInput, AgentEditEntry } from './agent-payload';\nimport { AgentHookEvent, AgentEventKind, FileOperation } from '../protocol';\nimport { NormalizedBashInput, NormalizedEdit, NormalizedToolInput, ToolKind } from '../protocol';\n\n/**\n * The Claude Code tools that enter the file/edit rule pipeline. `Read` is deliberately NOT here — it\n * has its own fast path and only one guard may see it.\n */\nconst HANDLED_FILE_TOOLS: ReadonlySet<string> = new Set(['Write', 'Edit', 'MultiEdit']);\n\n/**\n * Morphs a Claude Code PreToolUse payload into the one normalized `AgentHookEvent`.\n *\n * This is the SAME `normalizeToolKind` / `normalizeToolInput` logic that used to live inline in\n * hook-core.ts, moved out unchanged so hook-core is written once for every harness. Claude Code is the\n * harness every developer uses today, so nothing about the mapping is allowed to move: `Write` still\n * becomes one edit of `content` against '', `Edit` one edit of `old_string`→`new_string`, `MultiEdit`\n * one per entry, and a file tool with no `file_path` still ends up allowed (kind `Ignored`).\n */\nexport class ClaudeCodeAdapter {\n    /**\n     * What is known from the ENVELOPE ALONE, touching nothing but `tool_name` and the identity fields.\n     *\n     * Not a second spelling of `toEvent` — a different question, asked at a moment when the answer to\n     * the other one may not exist. `toEvent` reads `tool_input`, and a payload whose `tool_input` is\n     * missing makes it throw; the crash then still has to be DENIED, and the deny still has to know\n     * whether it is decorating a Bash block (which needs the red `systemMessage`) or a file block\n     * (which does not). This is the shape that answers that, and it cannot fail.\n     */\n    envelope(payload: AgentPayload): AgentHookEvent {\n        return new AgentHookEvent(\n            'claude-code', this.kindOf(payload.tool_name), payload.tool_name,\n            payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            [], null, [],\n        );\n    }\n\n    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent {\n        const kind = this.kindOf(payload.tool_name);\n        const toolInput = payload.tool_input;\n        const bash = kind === 'Bash' ? new NormalizedBashInput(toolInput.command ?? '') : null;\n        const reads = kind === 'Read' ? [toolInput.file_path ?? ''] : [];\n        const files = kind === 'File' ? this.fileOperations(payload.tool_name as ToolKind, toolInput) : [];\n        // A file tool that named no file has nothing to judge; fall back to Ignored so the hook allows\n        // it, exactly as the old `if (!input) emitAllow()` did.\n        const effective: AgentEventKind = kind === 'File' && files.length === 0 ? 'Ignored' : kind;\n        return new AgentHookEvent(\n            'claude-code', effective, payload.tool_name,\n            cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            files, bash, reads,\n        );\n    }\n\n    private kindOf(toolName: string): AgentEventKind {\n        if (toolName === 'Bash') return 'Bash';\n        if (toolName === 'Read') return 'Read';\n        if (HANDLED_FILE_TOOLS.has(toolName)) return 'File';\n        return 'Ignored';\n    }\n\n    private fileOperations(toolKind: ToolKind, toolInput: AgentToolInput): readonly FileOperation[] {\n        const filePath = toolInput.file_path;\n        if (!filePath) return [];\n        if (toolKind === 'Write') {\n            return [new FileOperation(toolKind, new NormalizedToolInput(filePath, [new NormalizedEdit('', toolInput.content || '')]))];\n        }\n        if (toolKind === 'Edit') {\n            return [new FileOperation(toolKind, new NormalizedToolInput(filePath, [new NormalizedEdit(toolInput.old_string || '', toolInput.new_string || '')]))];\n        }\n        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];\n        const edits = raw.map((e: AgentEditEntry): NormalizedEdit => new NormalizedEdit(e.old_string || '', e.new_string || ''));\n        return [new FileOperation(toolKind, new NormalizedToolInput(filePath, edits))];\n    }\n}\n"]}

package/src/adapters/codex-adapter.d.ts

@@ -0,0 +1,19 @@
+import { AgentPayload } from './agent-payload';
+import { AgentHookEvent } from '../protocol';
+/**
+ * Morphs a Codex PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * Codex exposes exactly two tools this hook has anything to say about. Everything else measured in a
+ * live session — `webrun`, `collaborationspawn_agent`, `collaborationwait_agent`, `view_image`,
+ * `update_plan` — and every tool not yet seen maps to `Ignored` and is allowed immediately. That
+ * default is chosen on purpose: an unknown tool is one we cannot judge, and inventing a mapping for it
+ * would apply file rules to bytes that are not a file edit.
+ */
+export declare class CodexAdapter {
+    private readonly patchParser;
+    private readonly readParity;
+    /** See ClaudeCodeAdapter.envelope — the pre-normalization shape the crash deny needs. */
+    envelope(payload: AgentPayload): AgentHookEvent;
+    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent;
+    private kindOf;
+}

package/src/adapters/codex-adapter.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexAdapter = void 0;
+const rules_config_1 = require("@webpieces/rules-config");
+const protocol_1 = require("../protocol");
+const protocol_2 = require("../protocol");
+const apply_patch_parse_1 = require("../core/apply-patch-parse");
+const shell_read_parity_1 = require("../core/shell-read-parity");
+/** Codex's shell tool. MEASURED: it reuses Claude's name — it is `Bash`, NOT `shell`. */
+const CODEX_BASH = 'Bash';
+/** Codex's ONLY file-editing tool. One envelope, many files, mixed operations. */
+const CODEX_APPLY_PATCH = 'apply_patch';
+/**
+ * Morphs a Codex PreToolUse payload into the one normalized `AgentHookEvent`.
+ *
+ * Codex exposes exactly two tools this hook has anything to say about. Everything else measured in a
+ * live session — `webrun`, `collaborationspawn_agent`, `collaborationwait_agent`, `view_image`,
+ * `update_plan` — and every tool not yet seen maps to `Ignored` and is allowed immediately. That
+ * default is chosen on purpose: an unknown tool is one we cannot judge, and inventing a mapping for it
+ * would apply file rules to bytes that are not a file edit.
+ */
+class CodexAdapter {
+    patchParser = new apply_patch_parse_1.ApplyPatchParser();
+    readParity = new shell_read_parity_1.ShellReadParity();
+    /** See ClaudeCodeAdapter.envelope — the pre-normalization shape the crash deny needs. */
+    envelope(payload) {
+        return new protocol_1.AgentHookEvent('codex', this.kindOf(payload.tool_name), payload.tool_name, payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', [], null, []);
+    }
+    toEvent(payload, cwd) {
+        const kind = this.kindOf(payload.tool_name);
+        const command = payload.tool_input.command ?? '';
+        const bash = kind === 'Bash' ? new protocol_2.NormalizedBashInput(command) : null;
+        // Read parity: Codex has no Read tool, so a read arrives as `Bash` running a pager. Synthesized
+        // reads run the read guard IN ADDITION to the bash guards — see ../core/shell-read-parity.ts.
+        const reads = kind === 'Bash' ? this.readParity.readTargets(command, cwd, new rules_config_1.RepoRootFinder().resolveRepoRoot(cwd)) : [];
+        const files = kind === 'File' ? this.patchParser.parse(command, cwd) : [];
+        return new protocol_1.AgentHookEvent('codex', kind, payload.tool_name, cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '', files, bash, reads);
+    }
+    kindOf(toolName) {
+        if (toolName === CODEX_BASH)
+            return 'Bash';
+        if (toolName === CODEX_APPLY_PATCH)
+            return 'File';
+        return 'Ignored';
+    }
+}
+exports.CodexAdapter = CodexAdapter;
+//# sourceMappingURL=codex-adapter.js.map

package/src/adapters/codex-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-adapter.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/adapters/codex-adapter.ts"],"names":[],"mappings":";;;AAAA,0DAAyD;AAGzD,0CAA6D;AAC7D,0CAAkD;AAClD,iEAA6D;AAC7D,iEAA4D;AAE5D,yFAAyF;AACzF,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAa,YAAY;IACJ,WAAW,GAAG,IAAI,oCAAgB,EAAE,CAAC;IACrC,UAAU,GAAG,IAAI,mCAAe,EAAE,CAAC;IAEpD,yFAAyF;IACzF,QAAQ,CAAC,OAAqB;QAC1B,OAAO,IAAI,yBAAc,CACrB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,EAC1D,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC7F,EAAE,EAAE,IAAI,EAAE,EAAE,CACf,CAAC;IACN,CAAC;IAED,OAAO,CAAC,OAAqB,EAAE,GAAW;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,8BAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,6BAAc,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,yBAAc,CACrB,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAChC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAC/E,KAAK,EAAE,IAAI,EAAE,KAAK,CACrB,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC3B,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC;QAC3C,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC;QAClD,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ;AAjCD,oCAiCC","sourcesContent":["import { RepoRootFinder } from '@webpieces/rules-config';\n\nimport { AgentPayload } from './agent-payload';\nimport { AgentHookEvent, AgentEventKind } from '../protocol';\nimport { NormalizedBashInput } from '../protocol';\nimport { ApplyPatchParser } from '../core/apply-patch-parse';\nimport { ShellReadParity } from '../core/shell-read-parity';\n\n/** Codex's shell tool. MEASURED: it reuses Claude's name — it is `Bash`, NOT `shell`. */\nconst CODEX_BASH = 'Bash';\n/** Codex's ONLY file-editing tool. One envelope, many files, mixed operations. */\nconst CODEX_APPLY_PATCH = 'apply_patch';\n\n/**\n * Morphs a Codex PreToolUse payload into the one normalized `AgentHookEvent`.\n *\n * Codex exposes exactly two tools this hook has anything to say about. Everything else measured in a\n * live session — `webrun`, `collaborationspawn_agent`, `collaborationwait_agent`, `view_image`,\n * `update_plan` — and every tool not yet seen maps to `Ignored` and is allowed immediately. That\n * default is chosen on purpose: an unknown tool is one we cannot judge, and inventing a mapping for it\n * would apply file rules to bytes that are not a file edit.\n */\nexport class CodexAdapter {\n    private readonly patchParser = new ApplyPatchParser();\n    private readonly readParity = new ShellReadParity();\n\n    /** See ClaudeCodeAdapter.envelope — the pre-normalization shape the crash deny needs. */\n    envelope(payload: AgentPayload): AgentHookEvent {\n        return new AgentHookEvent(\n            'codex', this.kindOf(payload.tool_name), payload.tool_name,\n            payload.cwd ?? '', payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            [], null, [],\n        );\n    }\n\n    toEvent(payload: AgentPayload, cwd: string): AgentHookEvent {\n        const kind = this.kindOf(payload.tool_name);\n        const command = payload.tool_input.command ?? '';\n        const bash = kind === 'Bash' ? new NormalizedBashInput(command) : null;\n        // Read parity: Codex has no Read tool, so a read arrives as `Bash` running a pager. Synthesized\n        // reads run the read guard IN ADDITION to the bash guards — see ../core/shell-read-parity.ts.\n        const reads = kind === 'Bash' ? this.readParity.readTargets(command, cwd, new RepoRootFinder().resolveRepoRoot(cwd)) : [];\n        const files = kind === 'File' ? this.patchParser.parse(command, cwd) : [];\n        return new AgentHookEvent(\n            'codex', kind, payload.tool_name,\n            cwd, payload.session_id ?? '', payload.agent_id ?? '', payload.agent_type ?? '',\n            files, bash, reads,\n        );\n    }\n\n    private kindOf(toolName: string): AgentEventKind {\n        if (toolName === CODEX_BASH) return 'Bash';\n        if (toolName === CODEX_APPLY_PATCH) return 'File';\n        return 'Ignored';\n    }\n}\n"]}

package/src/adapters/detect-ai.d.ts

@@ -0,0 +1,70 @@
+import { AiType } from '../protocol';
+/**
+ * THE discriminator, and the only one. Codex's PreToolUse envelope carries a REQUIRED `turn_id`;
+ * Claude Code's has no such key. Everything else in the two envelopes is the same key names
+ * (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`), which is
+ * exactly why one positive key is the whole test rather than a shape heuristic.
+ *
+ * Exported as a TWIN — an sh fragment and a JS predicate — because L0 has two halves that must
+ * answer the identical question: the rendered POSIX-sh shim (which has no JSON parser and scrapes
+ * text) and this binary (which has the parsed object). That is the same pattern
+ * ../bin/l0-allowlist.ts already uses for `L0_ALLOW_ERE_SH` / `L0_ALLOW_JS`, and detect-ai.spec.ts
+ * asserts the two agree over a corpus the same way.
+ *
+ * ─── THE SH HALF IS AN APPROXIMATION, AND SINCE L0 BRANCHES ON IT, HERE IS EXACTLY HOW FAR OFF ──────
+ *
+ * The JS half asks the precise question (`turn_id` is a key of the TOP-LEVEL envelope). The sh half has
+ * no JSON parser, so it asks a structural approximation of it: after deleting all whitespace, does the
+ * payload contain `{` or `,` immediately followed by `"turn_id":`? That is strictly narrower than the
+ * bare substring test it replaced, and the tightening is not cosmetic — `bin/l0-allowlist.ts` now gates
+ * an allowlist entry on this answer, so a wrong answer is a grant.
+ *
+ * WHAT IT CAN AND CANNOT DISTINGUISH:
+ *
+ *  - A Claude payload MENTIONING the key in a command — `grep '"turn_id":' x.json` — is answered
+ *    `claude-code`, and not by luck: JSON escapes every `"` inside a string value, so the bytes on the
+ *    wire are `\"turn_id\":`, which contains no `"turn_id":` at all. There is no spelling of a shell
+ *    command that puts the RAW token into the payload.
+ *  - A NESTED `turn_id` key — an MCP tool_input that happens to carry one — IS misread as `codex`.
+ *    This is the residual gap and sh cannot close it. Do not write a JSON parser in sh to try.
+ *
+ * WHY THE RESIDUAL GAP IS NOT A PRIVILEGE ESCALATION, stated as the property to preserve rather than
+ * as a reassurance: the ONLY thing the harness answer gates at L0 is `L0_CODEX_ALLOW_ERE` (built from
+ * `CODEX_READ_BODY_ERE` in ../bin/l0-codex-read.ts), which
+ * admits nothing but a single, unredirected, unchained READ (`cat`/`head`/`tail`/`less`/`more`/`bat`,
+ * or `sed -n '<range>p'`). Allowlist entry 1 — "any Read", with no path restriction — already grants
+ * Claude Code the identical capability under every L0 fault. So a misclassification hands a Claude
+ * session another SPELLING of a read it could already do, and never a capability it lacked. Anything
+ * added to the aiType-gated set later must be checked against that property, because it is what makes
+ * the approximation tolerable. `codex-l0-read.spec.ts` pins both halves of this.
+ *
+ * WHENEVER THE JS HALF IS RUNNING IT IS AUTHORITATIVE: the binary calls `detectAiType()` on the parsed
+ * envelope (see `enforceCommittedShim`), so the approximation decides only faults D/X/U/K, where the
+ * binary never runs at all.
+ *
+ * WIRED INTO THE RENDERED SHIM (`PARSE_PAYLOAD_SH` in ../bin/shim.ts), which is what makes the L0 audit
+ * line's `ai=` field possible. Note the release ordering that governs the ARTIFACT rather than this
+ * constant: `committedShimStale()` compares the committed `.claude/webpieces/ai-hook.sh` against
+ * `renderShim()` of the INSTALLED release, so the committed shim is NOT regenerated in the same PR that
+ * changes the renderer — it is regenerated after that release publishes, or by `wp-upgrade-shim`.
+ */
+export declare const AI_TYPE_TOKEN_SH = "\"turn_id\":";
+/**
+ * Sets `AI` to the literal `AiType` value — `codex` or `claude-code` — from `$PAYLOAD`. The values
+ * are the SAME strings the TypeScript union carries, so the twin test can compare them byte for byte
+ * instead of translating between two vocabularies (translation is where twins drift).
+ *
+ * Two steps, and both are load-bearing:
+ *   1. `tr -d` deletes every whitespace byte into `WP_AI_ENV`, so the structural test below does not
+ *      have to spell "optional whitespace" — which a POSIX `case` glob cannot express — and a
+ *      pretty-printed envelope is read exactly like a compact one. The stripped copy is used for THIS
+ *      test only; `$PAYLOAD` itself is untouched and stays the input every `sed` scrape reads.
+ *   2. the glob requires `{` or `,` IMMEDIATELY before the quoted key, i.e. the structural context a
+ *      real JSON key has and a mention inside a value does not.
+ */
+export declare const AI_TYPE_SH = "WP_AI_ENV=\"$(printf '%s' \"$PAYLOAD\" | tr -d ' \\t\\n\\r')\"\ncase \"$WP_AI_ENV\" in *[{,]'\"turn_id\":'*) AI=codex ;; *) AI=claude-code ;; esac";
+/**
+ * JS twin of AI_TYPE_SH. Asks the precise question the sh half approximates: is `turn_id` a key of
+ * the top-level envelope?
+ */
+export declare function detectAiType(payload: unknown): AiType;

package/src/adapters/detect-ai.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_TYPE_SH = exports.AI_TYPE_TOKEN_SH = void 0;
+exports.detectAiType = detectAiType;
+/**
+ * THE discriminator, and the only one. Codex's PreToolUse envelope carries a REQUIRED `turn_id`;
+ * Claude Code's has no such key. Everything else in the two envelopes is the same key names
+ * (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`), which is
+ * exactly why one positive key is the whole test rather than a shape heuristic.
+ *
+ * Exported as a TWIN — an sh fragment and a JS predicate — because L0 has two halves that must
+ * answer the identical question: the rendered POSIX-sh shim (which has no JSON parser and scrapes
+ * text) and this binary (which has the parsed object). That is the same pattern
+ * ../bin/l0-allowlist.ts already uses for `L0_ALLOW_ERE_SH` / `L0_ALLOW_JS`, and detect-ai.spec.ts
+ * asserts the two agree over a corpus the same way.
+ *
+ * ─── THE SH HALF IS AN APPROXIMATION, AND SINCE L0 BRANCHES ON IT, HERE IS EXACTLY HOW FAR OFF ──────
+ *
+ * The JS half asks the precise question (`turn_id` is a key of the TOP-LEVEL envelope). The sh half has
+ * no JSON parser, so it asks a structural approximation of it: after deleting all whitespace, does the
+ * payload contain `{` or `,` immediately followed by `"turn_id":`? That is strictly narrower than the
+ * bare substring test it replaced, and the tightening is not cosmetic — `bin/l0-allowlist.ts` now gates
+ * an allowlist entry on this answer, so a wrong answer is a grant.
+ *
+ * WHAT IT CAN AND CANNOT DISTINGUISH:
+ *
+ *  - A Claude payload MENTIONING the key in a command — `grep '"turn_id":' x.json` — is answered
+ *    `claude-code`, and not by luck: JSON escapes every `"` inside a string value, so the bytes on the
+ *    wire are `\"turn_id\":`, which contains no `"turn_id":` at all. There is no spelling of a shell
+ *    command that puts the RAW token into the payload.
+ *  - A NESTED `turn_id` key — an MCP tool_input that happens to carry one — IS misread as `codex`.
+ *    This is the residual gap and sh cannot close it. Do not write a JSON parser in sh to try.
+ *
+ * WHY THE RESIDUAL GAP IS NOT A PRIVILEGE ESCALATION, stated as the property to preserve rather than
+ * as a reassurance: the ONLY thing the harness answer gates at L0 is `L0_CODEX_ALLOW_ERE` (built from
+ * `CODEX_READ_BODY_ERE` in ../bin/l0-codex-read.ts), which
+ * admits nothing but a single, unredirected, unchained READ (`cat`/`head`/`tail`/`less`/`more`/`bat`,
+ * or `sed -n '<range>p'`). Allowlist entry 1 — "any Read", with no path restriction — already grants
+ * Claude Code the identical capability under every L0 fault. So a misclassification hands a Claude
+ * session another SPELLING of a read it could already do, and never a capability it lacked. Anything
+ * added to the aiType-gated set later must be checked against that property, because it is what makes
+ * the approximation tolerable. `codex-l0-read.spec.ts` pins both halves of this.
+ *
+ * WHENEVER THE JS HALF IS RUNNING IT IS AUTHORITATIVE: the binary calls `detectAiType()` on the parsed
+ * envelope (see `enforceCommittedShim`), so the approximation decides only faults D/X/U/K, where the
+ * binary never runs at all.
+ *
+ * WIRED INTO THE RENDERED SHIM (`PARSE_PAYLOAD_SH` in ../bin/shim.ts), which is what makes the L0 audit
+ * line's `ai=` field possible. Note the release ordering that governs the ARTIFACT rather than this
+ * constant: `committedShimStale()` compares the committed `.claude/webpieces/ai-hook.sh` against
+ * `renderShim()` of the INSTALLED release, so the committed shim is NOT regenerated in the same PR that
+ * changes the renderer — it is regenerated after that release publishes, or by `wp-upgrade-shim`.
+ */
+exports.AI_TYPE_TOKEN_SH = '"turn_id":';
+/**
+ * Sets `AI` to the literal `AiType` value — `codex` or `claude-code` — from `$PAYLOAD`. The values
+ * are the SAME strings the TypeScript union carries, so the twin test can compare them byte for byte
+ * instead of translating between two vocabularies (translation is where twins drift).
+ *
+ * Two steps, and both are load-bearing:
+ *   1. `tr -d` deletes every whitespace byte into `WP_AI_ENV`, so the structural test below does not
+ *      have to spell "optional whitespace" — which a POSIX `case` glob cannot express — and a
+ *      pretty-printed envelope is read exactly like a compact one. The stripped copy is used for THIS
+ *      test only; `$PAYLOAD` itself is untouched and stays the input every `sed` scrape reads.
+ *   2. the glob requires `{` or `,` IMMEDIATELY before the quoted key, i.e. the structural context a
+ *      real JSON key has and a mention inside a value does not.
+ */
+exports.AI_TYPE_SH = `WP_AI_ENV="$(printf '%s' "$PAYLOAD" | tr -d ' \\t\\n\\r')"
+case "$WP_AI_ENV" in *[{,]'${exports.AI_TYPE_TOKEN_SH}'*) AI=codex ;; *) AI=claude-code ;; esac`;
+/**
+ * JS twin of AI_TYPE_SH. Asks the precise question the sh half approximates: is `turn_id` a key of
+ * the top-level envelope?
+ */
+// webpieces-disable no-any-unknown -- the argument IS unparsed JSON from another process's stdout; naming a type here would assert a shape we have not yet established, which is the question this function exists to answer
+// webpieces-disable no-function-outside-class -- twin of an sh fragment in the dependency-free adapter layer; it must stay callable on a tree too broken to build a DI container, exactly like isAllowed()
+function detectAiType(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return 'claude-code';
+    // webpieces-disable no-any-unknown -- narrowing the same unparsed JSON; the index signature is the widest true statement about it
+    return 'turn_id' in payload ? 'codex' : 'claude-code';
+}
+//# sourceMappingURL=detect-ai.js.map

package/src/adapters/detect-ai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-ai.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/adapters/detect-ai.ts"],"names":[],"mappings":";;;AA2EA,oCAIC;AA7ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACU,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACU,QAAA,UAAU,GAAG;6BACG,wBAAgB,2CAA2C,CAAC;AAEzF;;;GAGG;AACH,6NAA6N;AAC7N,2MAA2M;AAC3M,SAAgB,YAAY,CAAC,OAAgB;IACzC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IAC1E,kIAAkI;IAClI,OAAO,SAAS,IAAK,OAAmC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;AACvF,CAAC","sourcesContent":["import { AiType } from '../protocol';\n\n/**\n * THE discriminator, and the only one. Codex's PreToolUse envelope carries a REQUIRED `turn_id`;\n * Claude Code's has no such key. Everything else in the two envelopes is the same key names\n * (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`), which is\n * exactly why one positive key is the whole test rather than a shape heuristic.\n *\n * Exported as a TWIN — an sh fragment and a JS predicate — because L0 has two halves that must\n * answer the identical question: the rendered POSIX-sh shim (which has no JSON parser and scrapes\n * text) and this binary (which has the parsed object). That is the same pattern\n * ../bin/l0-allowlist.ts already uses for `L0_ALLOW_ERE_SH` / `L0_ALLOW_JS`, and detect-ai.spec.ts\n * asserts the two agree over a corpus the same way.\n *\n * ─── THE SH HALF IS AN APPROXIMATION, AND SINCE L0 BRANCHES ON IT, HERE IS EXACTLY HOW FAR OFF ──────\n *\n * The JS half asks the precise question (`turn_id` is a key of the TOP-LEVEL envelope). The sh half has\n * no JSON parser, so it asks a structural approximation of it: after deleting all whitespace, does the\n * payload contain `{` or `,` immediately followed by `\"turn_id\":`? That is strictly narrower than the\n * bare substring test it replaced, and the tightening is not cosmetic — `bin/l0-allowlist.ts` now gates\n * an allowlist entry on this answer, so a wrong answer is a grant.\n *\n * WHAT IT CAN AND CANNOT DISTINGUISH:\n *\n *  - A Claude payload MENTIONING the key in a command — `grep '\"turn_id\":' x.json` — is answered\n *    `claude-code`, and not by luck: JSON escapes every `\"` inside a string value, so the bytes on the\n *    wire are `\\\"turn_id\\\":`, which contains no `\"turn_id\":` at all. There is no spelling of a shell\n *    command that puts the RAW token into the payload.\n *  - A NESTED `turn_id` key — an MCP tool_input that happens to carry one — IS misread as `codex`.\n *    This is the residual gap and sh cannot close it. Do not write a JSON parser in sh to try.\n *\n * WHY THE RESIDUAL GAP IS NOT A PRIVILEGE ESCALATION, stated as the property to preserve rather than\n * as a reassurance: the ONLY thing the harness answer gates at L0 is `L0_CODEX_ALLOW_ERE` (built from\n * `CODEX_READ_BODY_ERE` in ../bin/l0-codex-read.ts), which\n * admits nothing but a single, unredirected, unchained READ (`cat`/`head`/`tail`/`less`/`more`/`bat`,\n * or `sed -n '<range>p'`). Allowlist entry 1 — \"any Read\", with no path restriction — already grants\n * Claude Code the identical capability under every L0 fault. So a misclassification hands a Claude\n * session another SPELLING of a read it could already do, and never a capability it lacked. Anything\n * added to the aiType-gated set later must be checked against that property, because it is what makes\n * the approximation tolerable. `codex-l0-read.spec.ts` pins both halves of this.\n *\n * WHENEVER THE JS HALF IS RUNNING IT IS AUTHORITATIVE: the binary calls `detectAiType()` on the parsed\n * envelope (see `enforceCommittedShim`), so the approximation decides only faults D/X/U/K, where the\n * binary never runs at all.\n *\n * WIRED INTO THE RENDERED SHIM (`PARSE_PAYLOAD_SH` in ../bin/shim.ts), which is what makes the L0 audit\n * line's `ai=` field possible. Note the release ordering that governs the ARTIFACT rather than this\n * constant: `committedShimStale()` compares the committed `.claude/webpieces/ai-hook.sh` against\n * `renderShim()` of the INSTALLED release, so the committed shim is NOT regenerated in the same PR that\n * changes the renderer — it is regenerated after that release publishes, or by `wp-upgrade-shim`.\n */\nexport const AI_TYPE_TOKEN_SH = '\"turn_id\":';\n\n/**\n * Sets `AI` to the literal `AiType` value — `codex` or `claude-code` — from `$PAYLOAD`. The values\n * are the SAME strings the TypeScript union carries, so the twin test can compare them byte for byte\n * instead of translating between two vocabularies (translation is where twins drift).\n *\n * Two steps, and both are load-bearing:\n *   1. `tr -d` deletes every whitespace byte into `WP_AI_ENV`, so the structural test below does not\n *      have to spell \"optional whitespace\" — which a POSIX `case` glob cannot express — and a\n *      pretty-printed envelope is read exactly like a compact one. The stripped copy is used for THIS\n *      test only; `$PAYLOAD` itself is untouched and stays the input every `sed` scrape reads.\n *   2. the glob requires `{` or `,` IMMEDIATELY before the quoted key, i.e. the structural context a\n *      real JSON key has and a mention inside a value does not.\n */\nexport const AI_TYPE_SH = `WP_AI_ENV=\"$(printf '%s' \"$PAYLOAD\" | tr -d ' \\\\t\\\\n\\\\r')\"\ncase \"$WP_AI_ENV\" in *[{,]'${AI_TYPE_TOKEN_SH}'*) AI=codex ;; *) AI=claude-code ;; esac`;\n\n/**\n * JS twin of AI_TYPE_SH. Asks the precise question the sh half approximates: is `turn_id` a key of\n * the top-level envelope?\n */\n// webpieces-disable no-any-unknown -- the argument IS unparsed JSON from another process's stdout; naming a type here would assert a shape we have not yet established, which is the question this function exists to answer\n// webpieces-disable no-function-outside-class -- twin of an sh fragment in the dependency-free adapter layer; it must stay callable on a tree too broken to build a DI container, exactly like isAllowed()\nexport function detectAiType(payload: unknown): AiType {\n    if (payload === null || typeof payload !== 'object') return 'claude-code';\n    // webpieces-disable no-any-unknown -- narrowing the same unparsed JSON; the index signature is the widest true statement about it\n    return 'turn_id' in (payload as Record<string, unknown>) ? 'codex' : 'claude-code';\n}\n"]}

package/src/core/apply-patch-parse.d.ts

@@ -0,0 +1,36 @@
+import { FileOperation } from '../protocol';
+/**
+ * Parses Codex's `apply_patch` envelope into the same `FileOperation[]` the rest of the hook already
+ * understands, so a Codex edit is judged by the identical rules a Claude edit is.
+ *
+ * The grammar is MEASURED from a live codex-cli 0.151.0 session, not inferred from a diff format it
+ * resembles. Two properties of it drive every design choice here:
+ *
+ *  - ONE envelope carries MANY files with MIXED operations, which is why the result is a LIST of
+ *    `FileOperation` (each with its own kind) rather than one kind for the call.
+ *  - Hunk headers are a BARE `@@` with NO line numbers. A unified-diff `@@ -1,3 +1,4 @@` is therefore
+ *    not a stricter spelling of the same thing — it is an envelope we have never seen, and guessing at
+ *    it is how a guard silently judges the wrong bytes. It is rejected.
+ *
+ * Paths are sometimes relative and sometimes absolute (measured: subagents used relative, the
+ * coordinator absolute), so a relative path is resolved against the payload's `cwd`.
+ *
+ * FAIL CLOSED. Every malformed envelope THROWS `InformAiError`, which the hook's one top-level handler
+ * turns into a deny naming the offending line. A parser that "did its best" on an envelope it did not
+ * understand would hand the rule engine a subset of the real edit and allow the rest unjudged, which is
+ * strictly worse than refusing the call.
+ */
+export declare class ApplyPatchParser {
+    parse(command: string, cwd: string): readonly FileOperation[];
+    /** `*** Add File: <p>` plus a body of `+` lines → a Write of the joined body. */
+    private parseAdd;
+    /**
+     * `*** Update File: <p>`, an optional `*** Move to: <q>`, then one or more bare-`@@` hunks.
+     *
+     * A `Move to` makes the DESTINATION the judged path. That is the file whose bytes will exist after
+     * the call, so it is the one a path-scoped rule must see; judging the source would let a rename
+     * into a guarded directory land unjudged.
+     */
+    private parseUpdate;
+    private resolve;
+}