@webpresso/agent-kit 0.21.0

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/index.d.ts

@@ -0,0 +1,68 @@
+import { type MergeOptions, type MergeResult } from '#cli/commands/init/merge';
+import type { CodexAppServerApi } from '#codex/app-server/types.js';
+import { type SyncCodexHookTrustResult } from './codex-trust-sync.js';
+type HookEntry = {
+    type: string;
+    command: string;
+    timeout?: number;
+};
+type HookGroup = {
+    matcher?: string;
+    hooks: HookEntry[];
+};
+type HooksMap = Record<string, HookGroup[]>;
+export type MatcherSet = {
+    preToolUse: string;
+    postToolUse: string;
+};
+type WebpressoHookBinClassification = {
+    kind: 'canonical';
+    binName: string;
+} | {
+    kind: 'legacy';
+    binName: string;
+};
+export declare function classifyWebpressoHookBin(binName: string | null): WebpressoHookBinClassification | null;
+/**
+ * Construct the canonical 5 wp-* hook groups (SessionStart, PreToolUse,
+ * PostToolUse, UserPromptSubmit, Stop). Single source of truth — adding a
+ * new wp-* hook is one append here and propagates to both surfaces.
+ */
+export declare function buildWebpressoHookGroups(input: {
+    resolveBin: (name: string) => string;
+    matchers: MatcherSet;
+}): HooksMap;
+/**
+ * Migration: Codex's canonical hooks.json schema is wrapped under a top-level
+ * `hooks` key (matching Codex's official docs at
+ * https://developers.openai.com/codex/hooks). Earlier versions of this
+ * scaffolder wrote event keys at the top level, which Codex silently ignored.
+ *
+ * Move any top-level `SessionStart|PreToolUse|PostToolUse|UserPromptSubmit|Stop`
+ * keys into `json.hooks`, deduping via `ensureGroup`, and delete the
+ * legacy top-level keys. Idempotent.
+ */
+export declare function hoistTopLevelEvents(json: Record<string, unknown>): Record<string, unknown>;
+export type CodexTrustSyncWarning = {
+    readonly kind: 'codex-app-server-trust-sync-warning';
+    readonly message: string;
+    readonly syncResult?: SyncCodexHookTrustResult;
+};
+type CodexAppServerFactory = (repoRoot: string) => Promise<CodexAppServerApi>;
+export declare function trustCodexWebpressoHooksForRepo(input: ScaffoldAgentHooksInput): Promise<void>;
+export declare function trustCodexPresetHooksForUser(input: ScaffoldAgentHooksInput): Promise<void>;
+export interface ScaffoldAgentHooksInput {
+    repoRoot: string;
+    options: MergeOptions;
+    createCodexAppServer?: CodexAppServerFactory;
+    onCodexTrustSyncWarning?: (warning: CodexTrustSyncWarning) => void;
+    trustCodexHooks?: boolean;
+}
+export interface ScaffoldAgentHooksResult {
+    claude: MergeResult;
+    codex: MergeResult;
+    claudeUser: MergeResult;
+}
+export declare function scaffoldAgentHooks(input: ScaffoldAgentHooksInput): Promise<ScaffoldAgentHooksResult>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/index.js

@@ -0,0 +1,585 @@
+/**
+ * `agent-hooks` scaffolder — wires wp-* hooks into:
+ *   - `.claude/settings.json` (Claude Code)
+ *   - `.codex/hooks.json` (Codex CLI)
+ *
+ * Mostly additive: preserves unrelated hooks, ensures webpresso's entries
+ * are present, and prunes stale legacy Claude ak-* hook commands that current
+ * setups no longer own. Uses installed bin paths so consumers don't need bun.
+ *
+ * Runs by default on every `wp setup`.
+ */
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { patchJsonFile } from '#cli/commands/init/merge';
+import { CodexAppServerClient } from '#codex/app-server/client.js';
+import { normalizeGlobalCodexHooksFile, resolveBinaryOnPath, } from '#cli/commands/init/scaffolders/agent-hooks/codex-global-normalize';
+import { isPresetOwnedGlobalCodexHook } from './codex-global-ownership.js';
+import { syncCodexHookTrustWithAppServer, } from './codex-trust-sync.js';
+import { buildSkillTag, extractSkillHooks, isTaggedSkillHook, } from './skill-hooks.js';
+// Claude Code uses $CLAUDE_PROJECT_DIR. Codex hook runners can execute while the
+// active session cwd points at a sibling repo, so Codex hook commands must be
+// path-stable and not depend on the caller's cwd.
+//
+// Hook command wrappers:
+// - default: fail-open to keep fresh repos usable while dependencies install
+// - pretool guard: fail-closed (explicit deny JSON) so policy cannot silently
+//   bypass when the guard binary is missing/non-executable.
+const PRETOOL_GUARD_BIN = 'wp-pretool-guard';
+const PRETOOL_GUARD_MISSING_DENY = `printf '%s\\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"wp-pretool-guard is unavailable. Run vp install or wp setup."}}'`;
+function buildGuardedHookCommand(binPath, name) {
+    if (name === PRETOOL_GUARD_BIN) {
+        return `[ -x "${binPath}" ] && "${binPath}" || ${PRETOOL_GUARD_MISSING_DENY}`;
+    }
+    return `[ -x "${binPath}" ] && "${binPath}" || true`;
+}
+const CC_BIN = (name) => buildGuardedHookCommand(`$CLAUDE_PROJECT_DIR/node_modules/.bin/${name}`, name);
+const CODEX_BIN = (repoRoot) => (name) => {
+    const binPath = resolve(repoRoot, 'node_modules', '.bin', name);
+    return buildGuardedHookCommand(binPath, name);
+};
+// Canonical hook event names recognised by both Claude Code and Codex CLI.
+// Used by `hoistTopLevelEvents` to identify legacy flat-form keys to migrate.
+const HOOK_EVENT_NAMES = [
+    'SessionStart',
+    'PreToolUse',
+    'PostToolUse',
+    'UserPromptSubmit',
+    'Stop',
+];
+/**
+ * Detect whether `groups` already contain a hook that invokes the same target
+ * as `command`. The "target" is whatever uniquely identifies the script being
+ * launched, regardless of shell-wrapping (e.g. `[ -x X ] && X || true` vs the
+ * raw `X` invocation).
+ *
+ * Two extractors run in order; the first match wins:
+ *   1. `node_modules/.bin/<name>` — installed bin (existing precedent).
+ *   2. `<basename>.<sh|ts|js|mjs|cjs|py>` — script file (covers
+ *      `.claude/hooks/check-gstack-session.sh`, `bun apps/scripts/foo.ts`,
+ *      etc.). Both wrapped and raw forms map to the same basename so dedup
+ *      catches them.
+ *
+ * Falls back to exact-string match when neither extractor applies.
+ */
+function commandMatches(left, right) {
+    if (left === right)
+        return true;
+    const leftTarget = extractCommandTarget(left);
+    return leftTarget !== null && extractCommandTarget(right) === leftTarget;
+}
+function findHookIndexByCommand(hooks, command) {
+    return hooks.findIndex((hook) => commandMatches(hook.command, command));
+}
+const SCRIPT_EXTENSIONS = ['sh', 'ts', 'js', 'mjs', 'cjs', 'py'];
+const DIRECT_NODE_MODULES_BIN_PATTERN = /^(?:\.\/|\/.*\/)?node_modules\/\.bin\/([\w-]+)$/u;
+const GUARDED_NODE_MODULES_BIN_PATTERN = /^\[ -x (["']?)((?:\.\/|\/.*\/)?node_modules\/\.bin\/([\w-]+))\1 \] && \1\2\1 \|\| (?:true|printf .+)$/u;
+const DIRECT_CLAUDE_NODE_MODULES_BIN_PATTERN = /^["']?\$CLAUDE_PROJECT_DIR\/node_modules\/\.bin\/([\w-]+)["']?$/u;
+const GUARDED_CLAUDE_NODE_MODULES_BIN_PATTERN = /^\[ -x (["']?)\$CLAUDE_PROJECT_DIR\/node_modules\/\.bin\/([\w-]+)\1 \] && \1\$CLAUDE_PROJECT_DIR\/node_modules\/\.bin\/\2\1 \|\| (?:true|printf .+)$/u;
+// Capture the basename of any path that ends in a known script extension.
+// Handles trailing chars (quote, space, end-of-string).
+const SCRIPT_BASENAME_PATTERN = new RegExp(String.raw `([\w-]+\.(?:${SCRIPT_EXTENSIONS.join('|')}))(?=$|["'\s])`, 'u');
+const WEBPRESSO_HOOK_BIN_NAMES = new Set([
+    'wp-sessionstart-routing',
+    'wp-check-dev-link',
+    'wp-pretool-guard',
+    'wp-post-tool',
+    'wp-guard-switch',
+    'wp-stop-qa',
+]);
+const LEGACY_WEBPRESSO_HOOK_BIN_NAMES = new Set([
+    'ak-sessionstart-routing',
+    'ak-check-dev-link',
+    'ak-pretool-guard',
+    'ak-post-tool',
+    'ak-guard-switch',
+    'ak-stop-qa',
+]);
+export function classifyWebpressoHookBin(binName) {
+    if (binName === null)
+        return null;
+    if (WEBPRESSO_HOOK_BIN_NAMES.has(binName))
+        return { kind: 'canonical', binName };
+    if (LEGACY_WEBPRESSO_HOOK_BIN_NAMES.has(binName))
+        return { kind: 'legacy', binName };
+    return null;
+}
+function extractAgentKitCodexBinName(command) {
+    const normalizedCommand = stripSingleShellQuotePair(command.trim());
+    const directBinMatch = DIRECT_NODE_MODULES_BIN_PATTERN.exec(normalizedCommand);
+    if (directBinMatch !== null)
+        return directBinMatch[1] ?? null;
+    const guardedBinMatch = GUARDED_NODE_MODULES_BIN_PATTERN.exec(command.trim());
+    if (guardedBinMatch !== null)
+        return guardedBinMatch[3] ?? null;
+    return null;
+}
+function extractClaudeBinName(command) {
+    const normalizedCommand = stripSingleShellQuotePair(command.trim());
+    const directBinMatch = DIRECT_CLAUDE_NODE_MODULES_BIN_PATTERN.exec(normalizedCommand);
+    if (directBinMatch !== null)
+        return directBinMatch[1] ?? null;
+    const guardedBinMatch = GUARDED_CLAUDE_NODE_MODULES_BIN_PATTERN.exec(command.trim());
+    if (guardedBinMatch !== null)
+        return guardedBinMatch[2] ?? null;
+    return null;
+}
+function stripSingleShellQuotePair(value) {
+    if (value.length < 2)
+        return value;
+    const first = value[0];
+    const last = value[value.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+/**
+ * Return a stable identifier for the script that `command` invokes, or null
+ * when none can be extracted (e.g. an opaque shell expression). Used by
+ * `hasCommand` for dedup across wrapped/raw invocation forms.
+ */
+function extractCommandTarget(command) {
+    const binName = extractAgentKitCodexBinName(command);
+    if (binName !== null)
+        return `bin:${binName}`;
+    const scriptMatch = SCRIPT_BASENAME_PATTERN.exec(command);
+    if (scriptMatch !== null)
+        return `script:${scriptMatch[1]}`;
+    return null;
+}
+function ensureGroup(groups, group) {
+    const incomingHook = group.hooks[0];
+    if (!incomingHook)
+        return groups;
+    let changed = false;
+    const nextGroups = groups.map((existingGroup) => {
+        const hookIndex = findHookIndexByCommand(existingGroup.hooks, incomingHook.command);
+        if (hookIndex === -1)
+            return existingGroup;
+        changed = true;
+        const hooks = existingGroup.hooks.map((hook, index) => index === hookIndex
+            ? {
+                ...hook,
+                ...incomingHook,
+                // Preserve the consumer's already-materialized command form when
+                // only the matcher/timeout changed. Codex command path migration is
+                // handled by normalizeCodexAgentKitCommands before this merge.
+                command: hook.command,
+            }
+            : hook);
+        return {
+            ...existingGroup,
+            ...(group.matcher !== undefined ? { matcher: group.matcher } : {}),
+            hooks,
+        };
+    });
+    if (changed)
+        return nextGroups;
+    return [...groups, group];
+}
+function orderStopGroups(groups) {
+    return [...groups].sort((left, right) => {
+        const leftCommand = left.hooks[0]?.command ?? '';
+        const rightCommand = right.hooks[0]?.command ?? '';
+        const leftIsGlobalStop = leftCommand.includes('wp-stop-qa');
+        const rightIsGlobalStop = rightCommand.includes('wp-stop-qa');
+        if (leftIsGlobalStop === rightIsGlobalStop)
+            return 0;
+        return leftIsGlobalStop ? 1 : -1;
+    });
+}
+function stripSkillManagedHooks(groups) {
+    return (groups ?? [])
+        .map((group) => ({
+        ...group,
+        hooks: group.hooks.filter((hook) => !isTaggedSkillHook(hook.command)),
+    }))
+        .filter((group) => group.hooks.length > 0);
+}
+function materializeClaudeSkillCommand(skillHook) {
+    const tag = buildSkillTag(skillHook.skillName);
+    if (skillHook.command.startsWith('wp ')) {
+        const args = skillHook.command.slice(3);
+        return `[ -x "$CLAUDE_PROJECT_DIR/node_modules/.bin/wp" ] && "$CLAUDE_PROJECT_DIR/node_modules/.bin/wp" ${args} || true ${tag}`;
+    }
+    return `${skillHook.command} ${tag}`;
+}
+function mergeSkillHooks(hooks, skillHooks) {
+    const nextHooks = Object.fromEntries(Object.entries(hooks).map(([event, groups]) => [event, stripSkillManagedHooks(groups)]));
+    for (const skillHook of skillHooks) {
+        const groups = nextHooks[skillHook.event] ?? [];
+        nextHooks[skillHook.event] = ensureGroup(groups, {
+            ...(skillHook.matcher ? { matcher: skillHook.matcher } : {}),
+            hooks: [
+                {
+                    type: 'command',
+                    command: materializeClaudeSkillCommand(skillHook),
+                    ...(skillHook.timeout ? { timeout: skillHook.timeout } : {}),
+                },
+            ],
+        });
+    }
+    return nextHooks;
+}
+// ── Shared webpresso hook construction ───────────────────────────────────────
+/**
+ * Construct the canonical 5 wp-* hook groups (SessionStart, PreToolUse,
+ * PostToolUse, UserPromptSubmit, Stop). Single source of truth — adding a
+ * new wp-* hook is one append here and propagates to both surfaces.
+ */
+export function buildWebpressoHookGroups(input) {
+    const { resolveBin, matchers } = input;
+    return {
+        SessionStart: [
+            {
+                hooks: [{ type: 'command', command: resolveBin('wp-sessionstart-routing'), timeout: 5 }],
+            },
+            {
+                hooks: [{ type: 'command', command: resolveBin('wp-check-dev-link'), timeout: 5 }],
+            },
+        ],
+        PreToolUse: [
+            {
+                matcher: matchers.preToolUse,
+                hooks: [{ type: 'command', command: resolveBin('wp-pretool-guard'), timeout: 5 }],
+            },
+        ],
+        PostToolUse: [
+            {
+                matcher: matchers.postToolUse,
+                hooks: [{ type: 'command', command: resolveBin('wp-post-tool'), timeout: 15 }],
+            },
+        ],
+        UserPromptSubmit: [
+            {
+                hooks: [{ type: 'command', command: resolveBin('wp-guard-switch'), timeout: 5 }],
+            },
+        ],
+        Stop: [
+            {
+                hooks: [{ type: 'command', command: resolveBin('wp-stop-qa') }],
+            },
+        ],
+    };
+}
+function mergeAgentKitGroups(existing, addition) {
+    const result = { ...existing };
+    for (const [event, groups] of Object.entries(addition)) {
+        let target = result[event] ?? [];
+        for (const group of groups) {
+            target = ensureGroup(target, group);
+        }
+        result[event] = target;
+    }
+    return result;
+}
+function normalizeCodexAgentKitCommands(hooks, repoRoot) {
+    const normalized = {};
+    for (const [event, groups] of Object.entries(hooks)) {
+        const normalizedGroups = groups.reduce((dedupedGroups, group) => {
+            const nextGroup = {
+                ...group,
+                hooks: group.hooks.flatMap((hook) => {
+                    const command = hook.command;
+                    if (typeof command !== 'string')
+                        return hook;
+                    const classification = classifyWebpressoHookBin(extractAgentKitCodexBinName(command));
+                    if (classification === null)
+                        return hook;
+                    if (classification.kind === 'legacy')
+                        return [];
+                    return {
+                        ...hook,
+                        command: CODEX_BIN(repoRoot)(classification.binName),
+                    };
+                }),
+            };
+            if (nextGroup.hooks.length === 0)
+                return dedupedGroups;
+            return ensureGroup(dedupedGroups, nextGroup);
+        }, []);
+        if (normalizedGroups.length > 0)
+            normalized[event] = normalizedGroups;
+    }
+    return normalized;
+}
+function pruneLegacyClaudeAgentKitCommands(hooks) {
+    const normalized = {};
+    for (const [event, groups] of Object.entries(hooks)) {
+        const keptGroups = groups
+            .map((group) => {
+            const keptHooks = group.hooks.filter((hook) => {
+                const classification = classifyWebpressoHookBin(extractClaudeBinName(hook.command));
+                return classification === null || classification.kind !== 'legacy';
+            });
+            return keptHooks.length > 0 ? { ...group, hooks: keptHooks } : null;
+        })
+            .filter((group) => group !== null);
+        if (keptGroups.length > 0)
+            normalized[event] = keptGroups;
+    }
+    return normalized;
+}
+/**
+ * Migration: Codex's canonical hooks.json schema is wrapped under a top-level
+ * `hooks` key (matching Codex's official docs at
+ * https://developers.openai.com/codex/hooks). Earlier versions of this
+ * scaffolder wrote event keys at the top level, which Codex silently ignored.
+ *
+ * Move any top-level `SessionStart|PreToolUse|PostToolUse|UserPromptSubmit|Stop`
+ * keys into `json.hooks`, deduping via `ensureGroup`, and delete the
+ * legacy top-level keys. Idempotent.
+ */
+export function hoistTopLevelEvents(json) {
+    const next = { ...json };
+    const wrapped = { ...(next.hooks ?? {}) };
+    let changed = false;
+    for (const event of HOOK_EVENT_NAMES) {
+        const top = next[event];
+        if (!Array.isArray(top))
+            continue;
+        const topGroups = top;
+        let merged = wrapped[event] ?? [];
+        for (const group of topGroups) {
+            if (group?.hooks?.[0]?.command) {
+                merged = ensureGroup(merged, group);
+            }
+        }
+        wrapped[event] = merged;
+        delete next[event];
+        changed = true;
+    }
+    if (changed || next.hooks)
+        next.hooks = wrapped;
+    return next;
+}
+// ── Claude Code (.claude/settings.json) ──────────────────────────────────────
+const CLAUDE_MATCHERS = {
+    preToolUse: 'Bash|Write|Edit|MultiEdit',
+    postToolUse: 'Write|Edit|MultiEdit',
+};
+const AGENT_KIT_CLAUDE_PLUGIN_ID = 'webpresso@webpresso';
+function defaultClaudeUserSettingsPath() {
+    return join(process.env.HOME || homedir(), '.claude', 'settings.json');
+}
+function patchClaudeUserSettings(existing) {
+    const next = { ...existing };
+    const enabledPluginsValue = next.enabledPlugins;
+    const enabledPlugins = enabledPluginsValue &&
+        typeof enabledPluginsValue === 'object' &&
+        !Array.isArray(enabledPluginsValue)
+        ? { ...enabledPluginsValue }
+        : {};
+    enabledPlugins[AGENT_KIT_CLAUDE_PLUGIN_ID] = true;
+    next.enabledPlugins = enabledPlugins;
+    if (next.disableAllHooks === true) {
+        next.disableAllHooks = false;
+    }
+    return next;
+}
+function patchClaudeSettings(existing, skillHooks) {
+    const existingHooks = pruneLegacyClaudeAgentKitCommands((existing.hooks ?? {}));
+    const withSkills = mergeSkillHooks(existingHooks, skillHooks);
+    const webpresso = buildWebpressoHookGroups({
+        resolveBin: CC_BIN,
+        matchers: CLAUDE_MATCHERS,
+    });
+    const merged = mergeAgentKitGroups(withSkills, webpresso);
+    // Claude-only extras: gstack soft-warning at SessionStart (non-blocking)
+    // and a Skill-matcher PreToolUse hook for stricter enforcement.
+    const withClaudeExtras = {
+        ...merged,
+        SessionStart: ensureGroup(merged.SessionStart ?? [], {
+            hooks: [
+                {
+                    type: 'command',
+                    command: '"$CLAUDE_PROJECT_DIR/.claude/hooks/check-gstack-session.sh"',
+                    timeout: 2,
+                },
+            ],
+        }),
+        PreToolUse: ensureGroup(merged.PreToolUse ?? [], {
+            matcher: 'Skill',
+            hooks: [
+                {
+                    type: 'command',
+                    command: '"$CLAUDE_PROJECT_DIR/.claude/hooks/check-gstack.sh"',
+                    timeout: 3,
+                },
+            ],
+        }),
+        Stop: orderStopGroups(merged.Stop ?? []),
+    };
+    const worktree = existing.worktree;
+    const symlinkDirectories = Array.isArray(worktree?.symlinkDirectories)
+        ? worktree?.symlinkDirectories.filter((value) => typeof value === 'string')
+        : [];
+    const normalizedSymlinkDirectories = symlinkDirectories.includes('.claude')
+        ? symlinkDirectories
+        : [...symlinkDirectories, '.claude'];
+    return {
+        ...existing,
+        worktree: {
+            ...worktree,
+            symlinkDirectories: normalizedSymlinkDirectories,
+        },
+        hooks: withClaudeExtras,
+    };
+}
+// ── Codex CLI (.codex/hooks.json) ────────────────────────────────────────────
+// Schema is wrapped under top-level `hooks` (Codex docs: developers.openai.com/codex/hooks).
+// Codex can run hooks for Bash, apply_patch, and MCP tool calls. Keep MCP
+// routing visible to the guard so ctx/context-mode shells that wrap quality
+// commands are denied before execution instead of silently bypassing wp_* MCPs.
+// File edits go through apply_patch; "Edit"/"Write" are accepted matcher aliases.
+const CODEX_MATCHERS = {
+    preToolUse: 'Bash|apply_patch|Edit|Write|mcp__.*',
+    postToolUse: 'Edit|Write',
+};
+function patchCodexHooks(existing, repoRoot) {
+    const migrated = hoistTopLevelEvents(existing);
+    const existingHooks = normalizeCodexAgentKitCommands((migrated.hooks ?? {}), repoRoot);
+    const webpresso = buildWebpressoHookGroups({
+        resolveBin: CODEX_BIN(repoRoot),
+        matchers: CODEX_MATCHERS,
+    });
+    return {
+        ...migrated,
+        hooks: mergeAgentKitGroups(existingHooks, webpresso),
+    };
+}
+function reportCodexTrustSyncWarning(input, warning) {
+    input.onCodexTrustSyncWarning?.(warning);
+    console.warn(`  codex hook trust: warning — ${warning.message}. Review in /hooks.`);
+}
+export async function trustCodexWebpressoHooksForRepo(input) {
+    if (shouldSkipCodexTrustSync(input))
+        return;
+    const hooksPath = resolve(input.repoRoot, '.codex', 'hooks.json');
+    if (!existsSync(hooksPath))
+        return;
+    const createCodexAppServer = input.createCodexAppServer ?? ((repoRoot) => CodexAppServerClient.start({ cwd: repoRoot }));
+    let api;
+    try {
+        api = await createCodexAppServer(input.repoRoot);
+    }
+    catch (error) {
+        reportCodexTrustSyncWarning(input, {
+            kind: 'codex-app-server-trust-sync-warning',
+            message: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    try {
+        const syncResult = await syncCodexHookTrustWithAppServer(api, { repoRoot: input.repoRoot });
+        if (!syncResult.ok && syncResult.reason !== 'no-webpresso-hooks-found') {
+            reportCodexTrustSyncWarning(input, {
+                kind: 'codex-app-server-trust-sync-warning',
+                message: syncResult.message,
+                syncResult,
+            });
+        }
+    }
+    finally {
+        await api.close();
+    }
+}
+export async function trustCodexPresetHooksForUser(input) {
+    if (shouldSkipCodexTrustSync(input))
+        return;
+    const codexHome = process.env.CODEX_HOME || join(homedir(), '.codex');
+    const hooksPath = resolve(codexHome, 'hooks.json');
+    if (!existsSync(hooksPath))
+        return;
+    const createCodexAppServer = input.createCodexAppServer ?? ((repoRoot) => CodexAppServerClient.start({ cwd: repoRoot }));
+    let api;
+    try {
+        api = await createCodexAppServer(input.repoRoot);
+    }
+    catch (error) {
+        reportCodexTrustSyncWarning(input, {
+            kind: 'codex-app-server-trust-sync-warning',
+            message: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    try {
+        const syncResult = await syncCodexHookTrustWithAppServer(api, {
+            repoRoot: input.repoRoot,
+            expectedSourcePaths: [hooksPath],
+            hookDescription: 'preset-owned global',
+            selectHook: isPresetOwnedGlobalCodexHook,
+        });
+        if (!syncResult.ok && syncResult.reason !== 'no-webpresso-hooks-found') {
+            reportCodexTrustSyncWarning(input, {
+                kind: 'codex-app-server-trust-sync-warning',
+                message: syncResult.message,
+                syncResult,
+            });
+        }
+    }
+    finally {
+        await api.close();
+    }
+}
+function shouldSkipCodexTrustSync(input) {
+    if (input.options.dryRun || process.env.WP_SKIP_CODEX_TRUST_SYNC === '1')
+        return true;
+    return process.env.VITEST === 'true' && !input.createCodexAppServer;
+}
+// Fast existence check — no network, no install, sub-10ms.
+// Installation is handled by `wp setup` (gstack scaffolder runs by default).
+const GSTACK_CHECK_SH = `#!/bin/sh
+if [ -d "$HOME/.claude/skills/gstack/bin" ]; then
+  exit 0
+fi
+printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"gstack is not installed. Fix: run \`wp setup\` then restart Claude Code."}}\\n'
+`;
+// SessionStart soft warning — emits additionalContext, never blocks.
+const GSTACK_SESSION_SH = `#!/bin/sh
+if [ -d "$HOME/.claude/skills/gstack/bin" ]; then
+  exit 0
+fi
+printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"WARNING: gstack is not installed. Skills like /browse, /qa, /ship are unavailable. Fix: run \`wp setup\` then restart."}}\n'
+`;
+function ensureGstackHooks(repoRoot, options = {}) {
+    if (options.dryRun)
+        return;
+    const hooksDir = join(repoRoot, '.claude', 'hooks');
+    mkdirSync(hooksDir, { recursive: true });
+    const preToolPath = join(hooksDir, 'check-gstack.sh');
+    if (!existsSync(preToolPath)) {
+        writeFileSync(preToolPath, GSTACK_CHECK_SH, 'utf8');
+        chmodSync(preToolPath, 0o755);
+    }
+    const sessionPath = join(hooksDir, 'check-gstack-session.sh');
+    if (!existsSync(sessionPath)) {
+        writeFileSync(sessionPath, GSTACK_SESSION_SH, 'utf8');
+        chmodSync(sessionPath, 0o755);
+    }
+}
+export async function scaffoldAgentHooks(input) {
+    ensureGstackHooks(input.repoRoot, input.options);
+    const skillHooks = extractSkillHooks(join(input.repoRoot, '.agent', 'skills'));
+    const result = {
+        claude: patchJsonFile(join(input.repoRoot, '.claude', 'settings.json'), (existing) => patchClaudeSettings(existing, skillHooks), input.options),
+        codex: patchJsonFile(join(input.repoRoot, '.codex', 'hooks.json'), (existing) => patchCodexHooks(existing, input.repoRoot), input.options),
+        claudeUser: patchJsonFile(defaultClaudeUserSettingsPath(), (existing) => patchClaudeUserSettings(existing), input.options),
+    };
+    const codexHooksPath = join(input.repoRoot, '.codex', 'hooks.json');
+    const codexNormalization = normalizeGlobalCodexHooksFile(codexHooksPath, {
+        contextModeBinary: resolveBinaryOnPath('context-mode'),
+        nodeBinary: process.execPath,
+    }, input.options);
+    if ((result.codex.action === 'identical' || result.codex.action === 'created') &&
+        codexNormalization.action === 'overwritten') {
+        result.codex = { ...codexNormalization };
+    }
+    if (input.trustCodexHooks !== false) {
+        await trustCodexWebpressoHooksForRepo(input);
+    }
+    return result;
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/skill-hooks.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+declare const SKILL_HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "Stop", "SessionStart", "UserPromptSubmit"];
+export type SkillHookEvent = (typeof SKILL_HOOK_EVENTS)[number];
+export interface SkillHook {
+    skillName: string;
+    event: SkillHookEvent;
+    matcher?: string;
+    command: string;
+    timeout?: number;
+}
+declare const SkillHookEntrySchema: z.ZodObject<{
+    matcher: z.ZodOptional<z.ZodString>;
+    command: z.ZodString;
+    timeout: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare function validateSkillHooks(skillName: string, hooks: unknown): Record<SkillHookEvent, Array<z.infer<typeof SkillHookEntrySchema>>>;
+export declare function extractSkillHooks(skillsDir: string): SkillHook[];
+export declare function buildSkillTag(skillName: string): string;
+export declare function isTaggedSkillHook(command: string | undefined): boolean;
+export {};
+//# sourceMappingURL=skill-hooks.d.ts.map