@webpresso/agent-kit 0.21.0

package/dist/esm/cli/commands/init/scaffold-monorepo-nav.js

@@ -0,0 +1,101 @@
+/**
+ * Render `catalog/agent/skills/monorepo-navigation/SKILL.md.tpl` into the
+ * consumer-owned `agent-skills/monorepo-navigation/SKILL.md`, filling in
+ * placeholders with workspace introspection. Unified sync projects it into
+ * generated host surfaces. Copy the `examples/` directory verbatim.
+ */
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { copyDirectoryMerged, writeFileMerged, } from './merge.js';
+export function renderPackagesTable(packages) {
+    if (packages.length === 0) {
+        return 'This repo is a single-package project.';
+    }
+    const header = '| Package | Path | Purpose | Common Files |\n| ------- | ---- | ------- | ------------ |';
+    const rows = packages.map((p) => `| \`${p.name}\` | \`${p.relativePath}\` | {{TODO: describe}} | {{TODO: common files}} |`);
+    return [header, ...rows].join('\n');
+}
+/**
+ * Infer coarse key locations from package naming. Always leaves a TODO so
+ * the human can refine. Never fabricates paths — only reports what we saw.
+ */
+export function renderKeyLocations(packages) {
+    if (packages.length === 0) {
+        return '{{TODO: populate this section — list the typical file roots in your project.}}';
+    }
+    const bullets = [];
+    for (const pkg of packages) {
+        const lower = pkg.name.toLowerCase();
+        if (lower.endsWith('-api') || lower.endsWith('/api')) {
+            bullets.push(`- **API routes** (${pkg.name}): look in \`${pkg.relativePath}/src/routes/\` or \`${pkg.relativePath}/src/handlers/\``);
+        }
+        if (lower.includes('ui') || lower.includes('components')) {
+            bullets.push(`- **Components** (${pkg.name}): look in \`${pkg.relativePath}/src/components/\``);
+        }
+        if (lower.includes('database') || lower.includes('db')) {
+            bullets.push(`- **Database schemas** (${pkg.name}): look in \`${pkg.relativePath}/src/schemas/\` or \`${pkg.relativePath}/migrations/\``);
+        }
+        if (lower.includes('test-utils') || lower.includes('testing')) {
+            bullets.push(`- **Test utilities** (${pkg.name}): \`${pkg.relativePath}\``);
+        }
+    }
+    if (bullets.length === 0) {
+        return '{{TODO: populate this section — list the typical file roots in your project.}}';
+    }
+    bullets.push('', '{{TODO: refine — the above is heuristic. Add project-specific locations.}}');
+    return bullets.join('\n');
+}
+export function renderCrossPackageImports(packages) {
+    if (packages.length === 0) {
+        return '{{TODO: document cross-package imports if this repo later becomes a monorepo.}}';
+    }
+    const lines = ['```typescript'];
+    for (const pkg of packages.slice(0, 6)) {
+        lines.push(`import { /* ... */ } from '${pkg.name}'`);
+    }
+    lines.push('```');
+    return lines.join('\n');
+}
+export function renderPackageNames(packages) {
+    if (packages.length === 0)
+        return '_n/a — single-package project_';
+    const lines = [];
+    for (const pkg of packages) {
+        lines.push(`- \`${pkg.shortName}\` → \`${pkg.name}\``);
+    }
+    return lines.join('\n');
+}
+export function renderTemplate(template, consumer) {
+    const projectName = consumer.packageJson?.name ?? basename(consumer.repoRoot);
+    const replacements = {
+        '{{PROJECT_NAME}}': projectName,
+        '{{PACKAGES_TABLE}}': renderPackagesTable(consumer.workspacePackages),
+        '{{KEY_LOCATIONS}}': renderKeyLocations(consumer.workspacePackages),
+        '{{CROSS_PACKAGE_IMPORTS}}': renderCrossPackageImports(consumer.workspacePackages),
+        '{{PACKAGE_NAMES}}': renderPackageNames(consumer.workspacePackages),
+    };
+    let output = template;
+    for (const [key, value] of Object.entries(replacements)) {
+        // Replace all occurrences without regex escaping headaches.
+        output = output.split(key).join(value);
+    }
+    return output;
+}
+export function scaffoldMonorepoNav(input) {
+    const { catalogDir, repoRoot, consumer, options } = input;
+    const skillSrc = join(catalogDir, 'agent', 'skills', 'monorepo-navigation');
+    const skillDst = join(repoRoot, 'agent-skills', 'monorepo-navigation');
+    const results = [];
+    const tplPath = join(skillSrc, 'SKILL.md.tpl');
+    if (!existsSync(tplPath))
+        return results;
+    const template = readFileSync(tplPath, 'utf8');
+    const rendered = renderTemplate(template, consumer);
+    results.push(writeFileMerged(join(skillDst, 'SKILL.md'), rendered, options));
+    const examplesSrc = join(skillSrc, 'examples');
+    if (existsSync(examplesSrc) && statSync(examplesSrc).isDirectory()) {
+        results.push(...copyDirectoryMerged(examplesSrc, join(skillDst, 'examples'), options));
+    }
+    return results;
+}
+//# sourceMappingURL=scaffold-monorepo-nav.js.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-global-normalize.d.ts

@@ -0,0 +1,20 @@
+import type { MergeOptions, MergeResult } from '#cli/commands/init/merge';
+export interface NormalizeGlobalCodexHooksOptions {
+    readonly contextModeBinary?: string | null;
+    readonly nodeBinary?: string | null;
+}
+export declare const MANAGED_GLOBAL_CODEX_HOOK_DIRNAME = "managed-hooks";
+export declare const MANAGED_OMX_GLOBAL_HOOK_BASENAME = "wp-global-codex-omx-hook.sh";
+export declare const MANAGED_CONTEXT_MODE_GLOBAL_HOOK_BASENAMES: readonly ["wp-global-codex-context-mode-sessionstart.sh", "wp-global-codex-context-mode-pretooluse.sh", "wp-global-codex-context-mode-posttooluse.sh", "wp-global-codex-context-mode-userpromptsubmit.sh", "wp-global-codex-context-mode-stop.sh", "wp-global-codex-context-mode-precompact.sh", "wp-global-codex-context-mode-postcompact.sh"];
+export declare function resolveBinaryOnPath(command: string, pathValue?: string, platformValue?: NodeJS.Platform): string | null;
+export declare function normalizeGlobalCodexHooksJson(raw: Record<string, unknown>, options: NormalizeGlobalCodexHooksOptions, managedHooksDir?: string): {
+    readonly changed: boolean;
+    readonly value: Record<string, unknown>;
+};
+export declare function normalizeGlobalCodexHooksFile(hooksPath: string, options: NormalizeGlobalCodexHooksOptions, mergeOptions?: MergeOptions): MergeResult;
+export declare function defaultCodexHooksPathFromConfig(configPath: string): string;
+export declare function defaultManagedCodexHooksDir(hooksPath: string): string;
+export declare function isManagedContextModeGlobalLauncherBasename(basenameValue: string): boolean;
+export declare function isManagedOmxGlobalLauncherBasename(basenameValue: string): boolean;
+export declare function extractManagedLauncherBasename(command: string): string | null;
+//# sourceMappingURL=codex-global-normalize.d.ts.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-global-normalize.js

@@ -0,0 +1,258 @@
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from 'node:fs';
+import { basename, delimiter, dirname, join } from 'node:path';
+export const MANAGED_GLOBAL_CODEX_HOOK_DIRNAME = 'managed-hooks';
+export const MANAGED_OMX_GLOBAL_HOOK_BASENAME = 'wp-global-codex-omx-hook.sh';
+export const MANAGED_CONTEXT_MODE_GLOBAL_HOOK_BASENAMES = [
+    'wp-global-codex-context-mode-sessionstart.sh',
+    'wp-global-codex-context-mode-pretooluse.sh',
+    'wp-global-codex-context-mode-posttooluse.sh',
+    'wp-global-codex-context-mode-userpromptsubmit.sh',
+    'wp-global-codex-context-mode-stop.sh',
+    'wp-global-codex-context-mode-precompact.sh',
+    'wp-global-codex-context-mode-postcompact.sh',
+];
+const MANAGED_CONTEXT_MODE_GLOBAL_HOOK_BASENAME_SET = new Set(MANAGED_CONTEXT_MODE_GLOBAL_HOOK_BASENAMES);
+export function resolveBinaryOnPath(command, pathValue = process.env.PATH ?? '', platformValue = process.platform) {
+    if (command.trim() === '')
+        return null;
+    const pathEntries = pathValue.split(delimiter).filter((entry) => entry.length > 0);
+    const candidateNames = platformValue === 'win32'
+        ? [command, `${command}.exe`, `${command}.cmd`, `${command}.bat`]
+        : [command];
+    for (const entry of pathEntries) {
+        for (const name of candidateNames) {
+            const candidate = join(entry, name);
+            if (!existsSync(candidate))
+                continue;
+            try {
+                const stat = statSync(candidate);
+                if (!stat.isFile())
+                    continue;
+                if (platformValue !== 'win32')
+                    accessSync(candidate, constants.X_OK);
+                return candidate;
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    return null;
+}
+export function normalizeGlobalCodexHooksJson(raw, options, managedHooksDir) {
+    const hooks = raw.hooks;
+    if (!hooks || typeof hooks !== 'object' || Array.isArray(hooks)) {
+        return { changed: false, value: raw };
+    }
+    let changed = false;
+    const nextHooks = {};
+    for (const [event, groups] of Object.entries(hooks)) {
+        const seen = new Set();
+        const deduped = [];
+        for (const group of groups ?? []) {
+            const normalizedHooks = (group.hooks ?? []).map((hook) => {
+                const nextCommand = normalizeGlobalCodexHookCommand(hook.command, options, managedHooksDir);
+                if (nextCommand !== hook.command)
+                    changed = true;
+                return nextCommand === hook.command ? hook : { ...hook, command: nextCommand };
+            });
+            const normalizedGroup = {
+                ...group,
+                ...(normalizedHooks.length > 0 ? { hooks: normalizedHooks } : {}),
+            };
+            const key = stableHookGroupKey(normalizedGroup);
+            if (seen.has(key)) {
+                changed = true;
+                continue;
+            }
+            seen.add(key);
+            deduped.push(normalizedGroup);
+        }
+        nextHooks[event] = deduped;
+    }
+    if (!changed)
+        return { changed: false, value: raw };
+    return { changed: true, value: { ...raw, hooks: nextHooks } };
+}
+export function normalizeGlobalCodexHooksFile(hooksPath, options, mergeOptions = {}) {
+    if (mergeOptions.dryRun)
+        return { targetPath: hooksPath, action: 'skipped-dry' };
+    if (!existsSync(hooksPath))
+        return { targetPath: hooksPath, action: 'identical' };
+    const existing = readFileSync(hooksPath, 'utf8');
+    const parsed = JSON.parse(existing);
+    const managedHooksDir = defaultManagedCodexHooksDir(hooksPath);
+    const launchers = collectManagedGlobalCodexLaunchers(parsed, options, managedHooksDir);
+    const normalized = normalizeGlobalCodexHooksJson(parsed, options, managedHooksDir);
+    const launcherChanged = writeManagedGlobalCodexLaunchers(launchers);
+    if (!normalized.changed && !launcherChanged)
+        return { targetPath: hooksPath, action: 'identical' };
+    if (normalized.changed) {
+        writeFileSync(hooksPath, `${JSON.stringify(normalized.value, null, 2)}\n`, 'utf8');
+    }
+    return {
+        targetPath: hooksPath,
+        action: normalized.changed ? 'overwritten' : launcherChanged ? 'overwritten' : 'identical',
+    };
+}
+function normalizeGlobalCodexHookCommand(command, options, managedHooksDir) {
+    if (typeof command !== 'string')
+        return command;
+    const trimmed = command.trim();
+    const managedContextModePath = managedHooksDir && options.contextModeBinary
+        ? contextModeManagedLauncherPath(trimmed, managedHooksDir)
+        : null;
+    if (managedContextModePath) {
+        return quoteShell(managedContextModePath);
+    }
+    if (options.contextModeBinary && /^context-mode\s+hook\s+codex\b/u.test(trimmed)) {
+        return `${quoteShell(options.contextModeBinary)}${trimmed.slice('context-mode'.length)}`;
+    }
+    if (managedHooksDir && options.nodeBinary) {
+        const managedOmxPath = omxManagedLauncherPath(trimmed, managedHooksDir);
+        if (managedOmxPath)
+            return quoteShell(managedOmxPath);
+    }
+    if (options.nodeBinary &&
+        /^node\s+/u.test(trimmed) &&
+        /codex-native-hook(?:\.js)?/u.test(trimmed)) {
+        return `${quoteShell(options.nodeBinary)}${trimmed.slice('node'.length)}`;
+    }
+    return command;
+}
+function stableHookGroupKey(group) {
+    return JSON.stringify({
+        matcher: group.matcher ?? '',
+        hooks: (group.hooks ?? []).map((hook) => ({
+            type: hook.type ?? '',
+            command: typeof hook.command === 'string' ? hook.command.trim() : '',
+            timeout: hook.timeout ?? null,
+        })),
+    });
+}
+function quoteShell(value) {
+    return JSON.stringify(value);
+}
+export function defaultCodexHooksPathFromConfig(configPath) {
+    return join(dirname(configPath), 'hooks.json');
+}
+export function defaultManagedCodexHooksDir(hooksPath) {
+    return join(dirname(hooksPath), MANAGED_GLOBAL_CODEX_HOOK_DIRNAME);
+}
+function collectManagedGlobalCodexLaunchers(raw, options, managedHooksDir) {
+    const hooks = raw.hooks;
+    if (!hooks || typeof hooks !== 'object' || Array.isArray(hooks))
+        return [];
+    const launchers = new Map();
+    for (const groups of Object.values(hooks)) {
+        for (const group of groups ?? []) {
+            for (const hook of group.hooks ?? []) {
+                const command = typeof hook.command === 'string' ? hook.command.trim() : '';
+                if (command.length === 0)
+                    continue;
+                const launcher = launcherForCommand(command, options, managedHooksDir);
+                if (launcher)
+                    launchers.set(launcher.path, launcher);
+            }
+        }
+    }
+    return [...launchers.values()];
+}
+function writeManagedGlobalCodexLaunchers(launchers) {
+    let changed = false;
+    for (const launcher of launchers) {
+        const existing = existsSync(launcher.path) ? readFileSync(launcher.path, 'utf8') : null;
+        if (existing === launcher.content)
+            continue;
+        mkdirSync(dirname(launcher.path), { recursive: true });
+        writeFileSync(launcher.path, launcher.content, { mode: 0o755 });
+        changed = true;
+    }
+    return changed;
+}
+function launcherForCommand(command, options, managedHooksDir) {
+    const contextModeSpec = parseContextModeHookCommand(command);
+    if (contextModeSpec && options.contextModeBinary) {
+        const path = join(managedHooksDir, contextModeLauncherBasename(contextModeSpec.subcommand));
+        return {
+            path,
+            content: renderShellLauncher([
+                quoteShell(options.contextModeBinary),
+                'hook',
+                'codex',
+                contextModeSpec.subcommand,
+                '"$@"',
+            ]),
+        };
+    }
+    const omxSpec = parseOmxHookCommand(command);
+    if (omxSpec && options.nodeBinary) {
+        const path = join(managedHooksDir, MANAGED_OMX_GLOBAL_HOOK_BASENAME);
+        return {
+            path,
+            content: renderShellLauncher([
+                quoteShell(options.nodeBinary),
+                quoteShell(omxSpec.scriptPath),
+                ...omxSpec.trailingArgs.map(quoteShell),
+                '"$@"',
+            ]),
+        };
+    }
+    return null;
+}
+function renderShellLauncher(parts) {
+    return `#!/bin/sh\nexec ${parts.join(' ')}\n`;
+}
+function contextModeManagedLauncherPath(command, managedHooksDir) {
+    const parsed = parseContextModeHookCommand(command);
+    if (!parsed)
+        return null;
+    return join(managedHooksDir, contextModeLauncherBasename(parsed.subcommand));
+}
+function omxManagedLauncherPath(command, managedHooksDir) {
+    if (parseOmxHookCommand(command) === null)
+        return null;
+    return join(managedHooksDir, MANAGED_OMX_GLOBAL_HOOK_BASENAME);
+}
+function contextModeLauncherBasename(subcommand) {
+    return `wp-global-codex-context-mode-${subcommand}.sh`;
+}
+function parseContextModeHookCommand(command) {
+    const trimmed = stripSingleShellQuotePair(command.trim());
+    const match = /^context-mode\s+hook\s+codex\s+([\w-]+)$/u.exec(trimmed);
+    if (!match?.[1])
+        return null;
+    return { subcommand: match[1] };
+}
+function parseOmxHookCommand(command) {
+    const trimmed = command.trim();
+    const match = /^node\s+"?([^"\s]+codex-native-hook(?:\.js)?)"?\s*(.*)$/u.exec(trimmed);
+    if (!match?.[1])
+        return null;
+    const trailingArgs = match[2]?.trim().length ? match[2].trim().split(/\s+/u) : [];
+    return { scriptPath: match[1], trailingArgs };
+}
+function stripSingleShellQuotePair(value) {
+    if (value.length < 2)
+        return value;
+    const first = value[0];
+    const last = value[value.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+export function isManagedContextModeGlobalLauncherBasename(basenameValue) {
+    return MANAGED_CONTEXT_MODE_GLOBAL_HOOK_BASENAME_SET.has(basenameValue);
+}
+export function isManagedOmxGlobalLauncherBasename(basenameValue) {
+    return basenameValue === MANAGED_OMX_GLOBAL_HOOK_BASENAME;
+}
+export function extractManagedLauncherBasename(command) {
+    const trimmed = stripSingleShellQuotePair(command.trim());
+    const match = /^["']?([^"']+\.sh)["']?$/u.exec(trimmed);
+    if (match?.[1])
+        return basename(match[1]);
+    return null;
+}
+//# sourceMappingURL=codex-global-normalize.js.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-global-ownership.d.ts

@@ -0,0 +1,3 @@
+import type { CommandHookMetadata } from '#codex/app-server/types.js';
+export declare function isPresetOwnedGlobalCodexHook(metadata: unknown, expectedSourcePaths: readonly string[]): metadata is CommandHookMetadata;
+//# sourceMappingURL=codex-global-ownership.d.ts.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-global-ownership.js

@@ -0,0 +1,36 @@
+import { normalize } from 'node:path';
+import { MANAGED_OMX_GLOBAL_HOOK_BASENAME, extractManagedLauncherBasename, } from './codex-global-normalize.js';
+export function isPresetOwnedGlobalCodexHook(metadata, expectedSourcePaths) {
+    if (!isObject(metadata))
+        return false;
+    const candidate = metadata;
+    if (candidate.isManaged !== false)
+        return false;
+    if (candidate.handlerType !== 'command')
+        return false;
+    if (candidate.pluginId !== null)
+        return false;
+    if (typeof candidate.sourcePath !== 'string')
+        return false;
+    if (typeof candidate.command !== 'string' || candidate.command.trim() === '')
+        return false;
+    if (!isExpectedSourcePath(candidate.sourcePath, expectedSourcePaths))
+        return false;
+    return isOmxCodexCommand(candidate.command);
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function isExpectedSourcePath(sourcePath, expectedSourcePaths) {
+    if (expectedSourcePaths.length === 0)
+        return false;
+    const normalizedSourcePath = normalize(sourcePath);
+    return expectedSourcePaths.some((expectedPath) => normalize(expectedPath) === normalizedSourcePath);
+}
+function isOmxCodexCommand(command) {
+    const launcherBasename = extractManagedLauncherBasename(command);
+    if (launcherBasename === MANAGED_OMX_GLOBAL_HOOK_BASENAME)
+        return true;
+    return false;
+}
+//# sourceMappingURL=codex-global-ownership.js.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-ownership.d.ts

@@ -0,0 +1,11 @@
+import type { CommandHookMetadata } from '#codex/app-server/types.js';
+export declare const KNOWN_WEBPRESSO_CODEX_BINS: readonly ["wp-sessionstart-routing", "wp-check-dev-link", "wp-pretool-guard", "wp-post-tool", "wp-guard-switch", "wp-stop-qa"];
+export interface CodexHookOwnershipMetadata {
+    readonly isManaged?: unknown;
+    readonly handlerType?: unknown;
+    readonly pluginId?: unknown;
+    readonly sourcePath?: unknown;
+    readonly command?: unknown;
+}
+export declare function isWebpressoOwnedCodexHook(metadata: unknown, expectedSourcePaths: readonly string[]): metadata is CommandHookMetadata;
+//# sourceMappingURL=codex-ownership.d.ts.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-ownership.js

@@ -0,0 +1,62 @@
+import { normalize } from 'node:path';
+export const KNOWN_WEBPRESSO_CODEX_BINS = [
+    'wp-sessionstart-routing',
+    'wp-check-dev-link',
+    'wp-pretool-guard',
+    'wp-post-tool',
+    'wp-guard-switch',
+    'wp-stop-qa',
+];
+const KNOWN_WEBPRESSO_CODEX_BIN_SET = new Set(KNOWN_WEBPRESSO_CODEX_BINS);
+const NODE_MODULES_BIN_PATTERN = /^(?:\.\/|\/.*\/)?node_modules\/\.bin\/([\w-]+)$/u;
+const GUARDED_NODE_MODULES_BIN_PATTERN = /^\[ -x (["']?)((?:\.\/|\/.*\/)?node_modules\/\.bin\/([\w-]+))\1 \] && \1\2\1 \|\| (?:true|printf .+)$/u;
+export function isWebpressoOwnedCodexHook(metadata, expectedSourcePaths) {
+    if (!isObject(metadata))
+        return false;
+    const candidate = metadata;
+    if (candidate.isManaged !== false)
+        return false;
+    if (candidate.handlerType !== 'command')
+        return false;
+    if (candidate.pluginId !== null)
+        return false;
+    if (typeof candidate.sourcePath !== 'string')
+        return false;
+    if (typeof candidate.command !== 'string' || candidate.command.trim() === '')
+        return false;
+    if (!isExpectedSourcePath(candidate.sourcePath, expectedSourcePaths))
+        return false;
+    const binName = extractDirectNodeModulesBin(candidate.command);
+    return binName !== null && isKnownWebpressoCodexBin(binName);
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function isExpectedSourcePath(sourcePath, expectedSourcePaths) {
+    if (expectedSourcePaths.length === 0)
+        return false;
+    const normalizedSourcePath = normalize(sourcePath);
+    return expectedSourcePaths.some((expectedPath) => normalize(expectedPath) === normalizedSourcePath);
+}
+function isKnownWebpressoCodexBin(binName) {
+    return KNOWN_WEBPRESSO_CODEX_BIN_SET.has(binName);
+}
+function extractDirectNodeModulesBin(command) {
+    const normalizedCommand = stripSingleShellQuotePair(command.trim());
+    const match = NODE_MODULES_BIN_PATTERN.exec(normalizedCommand);
+    if (match?.[1])
+        return match[1];
+    const guardedMatch = GUARDED_NODE_MODULES_BIN_PATTERN.exec(command.trim());
+    return guardedMatch?.[3] ?? null;
+}
+function stripSingleShellQuotePair(value) {
+    if (value.length < 2)
+        return value;
+    const first = value[0];
+    const last = value[value.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+//# sourceMappingURL=codex-ownership.js.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-trust-sync.d.ts

@@ -0,0 +1,24 @@
+import type { CodexAppServerApi, CommandHookMetadata } from '#codex/app-server/types.js';
+export interface SyncCodexHookTrustInput {
+    readonly repoRoot: string;
+    readonly expectedSourcePaths?: readonly string[];
+    readonly hookDescription?: string;
+    readonly selectHook?: (metadata: unknown, expectedSourcePaths: readonly string[]) => metadata is CommandHookMetadata;
+}
+export type CodexTrustStateUpdate = Record<string, {
+    enabled: true;
+    trusted_hash: string;
+}>;
+export type SyncCodexHookTrustResult = {
+    readonly ok: true;
+    readonly trustedKeys: readonly string[];
+    readonly state: CodexTrustStateUpdate;
+} | {
+    readonly ok: false;
+    readonly reason: 'no-webpresso-hooks-found' | 'hooks-list-failed' | 'config-write-failed' | 'verification-failed';
+    readonly message: string;
+};
+export declare function syncCodexHookTrustWithAppServer(api: CodexAppServerApi, input: SyncCodexHookTrustInput): Promise<SyncCodexHookTrustResult>;
+export declare function defaultExpectedCodexHookSourcePaths(repoRoot: string): readonly string[];
+export declare function buildCodexTrustStateUpdate(hooks: readonly CommandHookMetadata[]): CodexTrustStateUpdate;
+//# sourceMappingURL=codex-trust-sync.d.ts.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-trust-sync.js

@@ -0,0 +1,101 @@
+import { resolve } from 'node:path';
+import { isWebpressoOwnedCodexHook } from './codex-ownership.js';
+export async function syncCodexHookTrustWithAppServer(api, input) {
+    const expectedSourcePaths = normalizeExpectedSourcePaths(input);
+    const hookDescription = input.hookDescription ?? 'webpresso-owned';
+    const selectHook = input.selectHook ?? isWebpressoOwnedCodexHook;
+    let firstList;
+    try {
+        firstList = await api.hooksList([input.repoRoot]);
+    }
+    catch (error) {
+        return failure('hooks-list-failed', error);
+    }
+    const ownedHooks = collectOwnedHooks(firstList, expectedSourcePaths, selectHook);
+    if (ownedHooks.length === 0) {
+        return {
+            ok: false,
+            reason: 'no-webpresso-hooks-found',
+            message: `No ${hookDescription} Codex hooks found for ${input.repoRoot}`,
+        };
+    }
+    const state = buildCodexTrustStateUpdate(ownedHooks);
+    try {
+        await api.configBatchWrite({
+            edits: [{ keyPath: 'hooks.state', value: state, mergeStrategy: 'upsert' }],
+            reloadUserConfig: true,
+        });
+    }
+    catch (error) {
+        return failure('config-write-failed', error);
+    }
+    let secondList;
+    try {
+        secondList = await api.hooksList([input.repoRoot]);
+    }
+    catch (error) {
+        return failure('verification-failed', error);
+    }
+    const verification = verifyTrustedHooks(secondList, ownedHooks);
+    if (!verification.ok) {
+        return verification;
+    }
+    return {
+        ok: true,
+        trustedKeys: ownedHooks.map((hook) => hook.key),
+        state,
+    };
+}
+export function defaultExpectedCodexHookSourcePaths(repoRoot) {
+    return [resolve(repoRoot, '.codex', 'hooks.json')];
+}
+export function buildCodexTrustStateUpdate(hooks) {
+    return Object.fromEntries(hooks.map((hook) => [hook.key, { enabled: true, trusted_hash: hook.currentHash }]));
+}
+function collectOwnedHooks(response, expectedSourcePaths, selectHook) {
+    return response.data.flatMap((entry) => entry.hooks.filter((hook) => selectHook(hook, expectedSourcePaths)));
+}
+function verifyTrustedHooks(response, ownedHooks) {
+    const latestByKey = new Map();
+    for (const entry of response.data) {
+        for (const hook of entry.hooks) {
+            if (hook.handlerType === 'command' &&
+                typeof hook.command === 'string' &&
+                hook.command.length > 0) {
+                latestByKey.set(hook.key, hook);
+            }
+        }
+    }
+    const failed = ownedHooks.find((hook) => {
+        const latest = latestByKey.get(hook.key);
+        return latest === undefined || latest.trustStatus !== 'trusted' || latest.enabled !== true;
+    });
+    if (!failed) {
+        return {
+            ok: true,
+            trustedKeys: ownedHooks.map((hook) => hook.key),
+            state: buildCodexTrustStateUpdate(ownedHooks),
+        };
+    }
+    const latest = latestByKey.get(failed.key);
+    return {
+        ok: false,
+        reason: 'verification-failed',
+        message: latest === undefined
+            ? `Hook ${failed.key} was not returned by hooks/list after trust sync`
+            : `Hook ${failed.key} remained ${latest.trustStatus} enabled=${String(latest.enabled)} after trust sync`,
+    };
+}
+function normalizeExpectedSourcePaths(input) {
+    return input.expectedSourcePaths?.length
+        ? input.expectedSourcePaths.map((path) => resolve(path))
+        : defaultExpectedCodexHookSourcePaths(input.repoRoot);
+}
+function failure(reason, error) {
+    return {
+        ok: false,
+        reason,
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+//# sourceMappingURL=codex-trust-sync.js.map