@wooojin/forgen 0.5.5 → 0.5.6

package/dist/host/install-codex.js

@@ -11,12 +11,15 @@
  * - MCP 등록은 TOML 라이브러리 없이 marker block 으로 idempotent 관리.
  * - dryRun 시 파일을 쓰지 않고 결과만 반환 (테스트 + preview 용).
  */
+import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { generateHooksJson } from '../hooks/hooks-generator.js';
 const MCP_MARKER_BEGIN = '# >>> forgen-managed-mcp';
 const MCP_MARKER_END = '# <<< forgen-managed-mcp';
+const NOTIFY_MARKER_BEGIN = '# >>> forgen-managed-notify';
+const NOTIFY_MARKER_END = '# <<< forgen-managed-notify';
 const FORGEN_SKILL_MARKER = '<!-- forgen-managed -->';
 const AGENTS_MD_BEGIN = '<!-- >>> forgen-managed-rules -->';
 const AGENTS_MD_END = '<!-- <<< forgen-managed-rules -->';
@@ -47,31 +50,150 @@ function readJsonFile(p) {
         return null;
     }
 }
-function buildMcpBlock(pkgRoot) {
+function splitManagedSpan(lines, begin, end) {
+    const b = lines.findIndex((l) => l.trim() === begin);
+    if (b === -1)
+        return null;
+    const rel = lines.slice(b + 1).findIndex((l) => l.trim() === end);
+    if (rel === -1)
+        return null;
+    const e = b + 1 + rel;
+    return { before: lines.slice(0, b), inner: lines.slice(b + 1, e), after: lines.slice(e + 1) };
+}
+function trimBlankEdges(lines) {
+    let a = 0;
+    let z = lines.length;
+    while (a < z && lines[a].trim() === '')
+        a += 1;
+    while (z > a && lines[z - 1].trim() === '')
+        z -= 1;
+    return lines.slice(a, z);
+}
+/** BOM 은 파일 맨 앞에 있어야 한다 — 떼어 두었다가 결과 맨 앞에 다시 붙인다. 줄 끝(CRLF)도 보존. */
+function tomlShape(toml) {
+    const bom = toml.startsWith('') ? '' : '';
+    return { bom, body: toml.slice(bom.length), cr: /\r\n/.test(toml) ? '\r' : '' };
+}
+const MCP_TABLE_HEADER = '[mcp_servers.forgen-compound]';
+const MCP_OWN_KEY_RE = /^\s*(command|args)\s*=/;
+function upsertMcpBlock(currentToml, pkgRoot) {
+    const { bom, body, cr } = tomlShape(currentToml);
+    const serverPath = path.join(pkgRoot, 'dist', 'mcp', 'server.js');
     // forgen-mcp 는 dist/mcp/server.js. node 경로는 PATH 기반.
     // `--host=codex` 인자는 server.ts 가 process.env.FORGEN_HOST 로 set 하여
     // correction-record evidence 박제 시 host:"codex" 로 정확히 태깅되게 한다 (spec §10-5).
-    const serverPath = path.join(pkgRoot, 'dist', 'mcp', 'server.js');
-    return [
-        MCP_MARKER_BEGIN,
-        '[mcp_servers.forgen-compound]',
-        'command = "node"',
-        `args = [${JSON.stringify(serverPath)}, "--host=codex"]`,
-        MCP_MARKER_END,
-    ].join('\n');
+    const ownKeys = ['command = "node"', `args = [${JSON.stringify(serverPath)}, "--host=codex"]`];
+    const lines = body.split('\n');
+    const span = splitManagedSpan(lines, MCP_MARKER_BEGIN, MCP_MARKER_END);
+    if (!span) {
+        // 마커 없이 같은 테이블이 있으면(사용자 직접 작성 / 마커 손상) append 하지 않는다 — 중복 테이블 = 파싱 실패.
+        if (lines.some((l) => l.trim() === MCP_TABLE_HEADER))
+            return { content: currentToml, alreadyPresent: true };
+        const block = [MCP_MARKER_BEGIN, MCP_TABLE_HEADER, ...ownKeys, MCP_MARKER_END].map((l) => l + cr).join('\n');
+        const trimmed = body.replace(/\s+$/, '');
+        const sep = trimmed.length > 0 ? `${cr}\n${cr}\n` : '';
+        return { content: `${bom}${trimmed}${sep}${block}\n`, alreadyPresent: false };
+    }
+    const h = span.inner.findIndex((l) => l.trim() === MCP_TABLE_HEADER);
+    let extraKeys = [];
+    let foreign = span.inner;
+    if (h !== -1) {
+        const afterHeader = span.inner.slice(h + 1);
+        const next = afterHeader.findIndex((l) => /^\s*\[/.test(l));
+        const tableBody = next === -1 ? afterHeader : afterHeader.slice(0, next);
+        // 손으로 고쳐 여러 줄이 된 command/args 는 안전하게 다시 쓸 수 없다 — 블록을 그대로 둔다.
+        const own = tableBody.filter((l) => MCP_OWN_KEY_RE.test(l));
+        if (own.some((l) => !/(["'\]])\s*(#.*)?$/.test(l.trim())))
+            return { content: currentToml, alreadyPresent: true };
+        // 사용자가 Codex 로 이 서버에 붙인 설정(enabled, startup_timeout_sec …)은 테이블 안에 유지.
+        extraKeys = tableBody.filter((l) => l.trim() !== '' && !MCP_OWN_KEY_RE.test(l)).map((l) => l.replace(/\r$/, ''));
+        foreign = [...span.inner.slice(0, h), ...(next === -1 ? [] : afterHeader.slice(next))];
+    }
+    const block = [MCP_MARKER_BEGIN, MCP_TABLE_HEADER, ...ownKeys, ...extraKeys, MCP_MARKER_END].map((l) => l + cr);
+    const moved = trimBlankEdges(foreign);
+    const out = [...span.before, ...block, ...(moved.length > 0 ? [cr, ...moved] : []), ...span.after];
+    const content = bom + out.join('\n');
+    return { content, alreadyPresent: content === currentToml };
 }
-function upsertMcpBlock(currentToml, pkgRoot) {
-    const block = buildMcpBlock(pkgRoot);
-    // marker block 이 있으면 그 사이를 새 block 으로 교체
-    const reMarker = new RegExp(`${MCP_MARKER_BEGIN}[\\s\\S]*?${MCP_MARKER_END}`, 'g');
-    if (reMarker.test(currentToml)) {
-        const replaced = currentToml.replace(reMarker, block);
-        return { content: replaced, alreadyPresent: replaced === currentToml };
-    }
-    // 없으면 끝에 append
-    const trimmed = currentToml.replace(/\s+$/, '');
-    const sep = trimmed.length > 0 ? '\n\n' : '';
-    return { content: `${trimmed}${sep}${block}\n`, alreadyPresent: false };
+// ── ADR-016 D1: notify 폴백 (config.toml top-level `notify`) ───────────
+/** forgen notify 바이너리 argv 접두 (`--` 뒤는 사용자가 수동으로 붙인 체인 프로그램). */
+function forgenNotifyArgv(pkgRoot) {
+    return ['node', path.join(pkgRoot, 'dist', 'host', 'codex-notify.js')];
+}
+const NOTIFY_OWN_COMMENTS = [
+    '# forgen turn-complete fallback (ADR-016): works even while forgen hooks are untrusted.',
+    '# To chain your own notifier, append:  "--", "<program>", "<args…>"  (kept across re-install).',
+];
+/** `notify`, `"notify"`, `'notify'` 키 (dotted `notify.x` 포함) — 어느 것이든 forgen 의 notify 와 충돌한다. */
+const NOTIFY_KEY_RE = /^[ \t]*(?:notify|"notify"|'notify')[ \t]*[.=]/;
+function parseNotifyBlock(lines) {
+    const span = splitManagedSpan(lines, NOTIFY_MARKER_BEGIN, NOTIFY_MARKER_END);
+    if (!span)
+        return { span: null, foreign: [], argv: null };
+    const idx = span.inner.findIndex((l) => NOTIFY_KEY_RE.test(l));
+    let argv = null;
+    if (idx !== -1) {
+        argv = 'unparseable';
+        const value = span.inner[idx].trim().match(/^notify[ \t]*=[ \t]*(\[.*\])$/)?.[1];
+        try {
+            const parsed = value ? JSON.parse(value) : null;
+            if (Array.isArray(parsed) && parsed.every((a) => typeof a === 'string'))
+                argv = parsed;
+        }
+        catch { /* multi-line / single-quoted / trailing comment — 아래에서 블록을 그대로 둔다 */ }
+    }
+    const foreign = span.inner.filter((l, i) => i !== idx && l.trim() !== '' && !l.trim().startsWith('# forgen turn-complete fallback') && !l.trim().startsWith('# To chain your own notifier'));
+    return { span, foreign, argv };
+}
+/**
+ * config.toml 에 forgen notify 블록을 upsert.
+ *
+ * - Codex 의 `notify` 는 top-level 단일 argv 다. 사용자가 이미 정의했으면 **건드리지 않는다** — 그리고
+ *   forgen 블록이 남아 있으면 제거한다 (중복 키 = config.toml 파싱 실패 → Codex 기동 불가).
+ * - top-level 키는 첫 테이블 헤더 앞에 와야 하므로 블록은 항상 파일 최상단(BOM 뒤)에 둔다.
+ * - 사용자가 forgen 블록의 argv 뒤에 `"--", "<prog>", …` 로 자기 notifier 를 체인해 뒀으면 그 꼬리를 보존.
+ *   블록의 notify 줄을 한 줄 JSON 으로 읽을 수 없으면(여러 줄 배열 등 손편집) 아무것도 바꾸지 않는다.
+ * - 블록 사이에 Codex 가 끼워 넣은 줄(root 키)은 블록 바로 뒤로 옮겨 보존한다.
+ */
+export function upsertNotifyBlock(currentToml, pkgRoot) {
+    const { bom, body, cr } = tomlShape(currentToml);
+    const lines = body.split('\n');
+    const { span, foreign, argv: existingArgv } = parseNotifyBlock(lines);
+    const outside = span ? [...span.before, ...span.after] : lines;
+    // 보수적 판정: 블록 밖 어디든 `notify =` 줄이 있으면 사용자 정의로 본다 (프로필 테이블 안이어도 skip —
+    // 폴백을 못 넣는 쪽이 config 를 깨뜨리는 쪽보다 낫다).
+    if (outside.some((l) => NOTIFY_KEY_RE.test(l))) {
+        if (!span)
+            return { content: currentToml, status: 'user-defined' };
+        return { content: bom + [...span.before, ...foreign, ...span.after].join('\n'), status: 'user-defined' };
+    }
+    if (existingArgv === 'unparseable')
+        return { content: currentToml, status: 'custom-block' };
+    const sep = existingArgv ? existingArgv.indexOf('--') : -1;
+    const chainTail = existingArgv && sep !== -1 ? existingArgv.slice(sep) : [];
+    const argv = [...forgenNotifyArgv(pkgRoot), ...chainTail];
+    const block = [NOTIFY_MARKER_BEGIN, ...NOTIFY_OWN_COMMENTS, `notify = ${JSON.stringify(argv)}`, NOTIFY_MARKER_END].map((l) => l + cr);
+    const rest = span ? [...span.before, ...foreign, ...span.after] : lines;
+    let start = 0;
+    while (start < rest.length && rest[start].trim() === '')
+        start += 1;
+    const tail = rest.slice(start);
+    const content = bom + (tail.length > 0 ? [...block, cr, ...tail] : [...block, '']).join('\n');
+    return { content, status: content === currentToml ? 'already-present' : 'installed' };
+}
+/** forgen notify 블록 제거 (`--no-notify`, uninstall). 블록 사이에 끼어든 다른 줄은 보존. */
+export function removeNotifyBlock(currentToml) {
+    const { bom, body } = tomlShape(currentToml);
+    const { span, foreign } = parseNotifyBlock(body.split('\n'));
+    if (!span)
+        return { content: currentToml, removed: false };
+    const rest = [...span.before, ...foreign, ...span.after];
+    let start = 0;
+    if (span.before.every((l) => l.trim() === '') && foreign.length === 0) {
+        while (start < rest.length && rest[start].trim() === '')
+            start += 1;
+    }
+    return { content: bom + rest.slice(start).join('\n'), removed: true };
 }
 export function planCodexInstall(opts) {
     const codexHome = resolveCodexHome(opts);
@@ -131,22 +253,36 @@ export function planCodexInstall(opts) {
     const registerMcp = opts.registerMcp ?? true;
     let mcpAlreadyPresent = false;
     let mcpRegistered = false;
-    let mcpContentToWrite = null;
+    const currentToml = fs.existsSync(configTomlPath) ? fs.readFileSync(configTomlPath, 'utf-8') : '';
+    let configToml = currentToml;
     if (registerMcp) {
-        const currentToml = fs.existsSync(configTomlPath)
-            ? fs.readFileSync(configTomlPath, 'utf-8')
-            : '';
-        const { content, alreadyPresent } = upsertMcpBlock(currentToml, opts.pkgRoot);
+        const { content, alreadyPresent } = upsertMcpBlock(configToml, opts.pkgRoot);
         mcpAlreadyPresent = alreadyPresent;
         mcpRegistered = !alreadyPresent;
-        mcpContentToWrite = content;
+        configToml = content;
+    }
+    // 4b) ADR-016 D1: notify 폴백 (사용자 notify 가 있으면 보존)
+    let notify = 'skipped';
+    if (opts.registerNotify ?? true) {
+        const r = upsertNotifyBlock(configToml, opts.pkgRoot);
+        notify = r.status;
+        configToml = r.content;
+    }
+    else {
+        // opt-out 은 "더 이상 등록하지 않음" 이 아니라 "없앰" 이어야 한다 (이전 설치의 블록이 남지 않게).
+        const r = removeNotifyBlock(configToml);
+        if (r.removed) {
+            notify = 'removed';
+            configToml = r.content;
+        }
     }
+    const configTomlToWrite = configToml !== currentToml ? configToml : null;
     // 5) 실제 쓰기 (dryRun 이면 skip) — hooks.json + config.toml
     if (!opts.dryRun) {
         fs.mkdirSync(codexHome, { recursive: true });
         fs.writeFileSync(hooksPath, `${JSON.stringify(finalHooksFile, null, 2)}\n`, 'utf-8');
-        if (mcpContentToWrite !== null) {
-            fs.writeFileSync(configTomlPath, mcpContentToWrite, 'utf-8');
+        if (configTomlToWrite !== null) {
+            fs.writeFileSync(configTomlPath, configTomlToWrite, 'utf-8');
         }
     }
     // 6) P3-3 (US-013): Codex skills/ 에 forgen 10 commands install
@@ -178,9 +314,9 @@ export function planCodexInstall(opts) {
         configTomlPath,
         pkgRoot: opts.pkgRoot,
         hooksFile: opts.dryRun ? (existing ?? finalHooksFile) : finalHooksFile,
-        configToml: mcpContentToWrite ?? (fs.existsSync(configTomlPath) ? fs.readFileSync(configTomlPath, 'utf-8') : ''),
+        configToml: opts.dryRun ? currentToml : configToml,
     });
-    const multiAgentEnabled = isCodexMultiAgentEnabled(mcpContentToWrite ?? (fs.existsSync(configTomlPath) ? fs.readFileSync(configTomlPath, 'utf-8') : ''));
+    const multiAgentEnabled = isCodexMultiAgentEnabled(configToml);
     return {
         codexHome,
         hooksPath,
@@ -202,6 +338,7 @@ export function planCodexInstall(opts) {
         agentsRemoved: codexAgents.removed,
         hookTrust,
         multiAgentEnabled,
+        notify,
     };
 }
 /** `[features]` 섹션 안에 `multi_agent = true` 가 있는지 (TOML 라이브러리 없이 섹션 범위만 본다). */
@@ -224,25 +361,118 @@ export const CODEX_SUPPORTED_HOOK_EVENTS = new Set([
 export function codexHookEventKey(event) {
     return event.replace(/(?<!^)([A-Z])/g, '_$1').toLowerCase();
 }
+/** `additionalContextLimit` 을 인정하는 이벤트 (codex-rs/hooks/src/engine/discovery.rs). */
+const CODEX_CONTEXT_LIMIT_EVENTS = new Set([
+    'PreToolUse', 'PostToolUse', 'SessionStart', 'UserPromptSubmit', 'SubagentStart',
+]);
+/** matcher 를 해시에서 제외하는 이벤트 (Codex 가 matcher 를 무시). */
+const CODEX_NO_MATCHER_EVENTS = new Set(['UserPromptSubmit', 'Stop', 'Interrupt']);
+const CODEX_DEFAULT_CONTEXT_LIMIT = 2500;
+/** 키 정렬 + compact JSON (codex-rs/config/src/fingerprint.rs `canonical_json`). */
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const obj = value;
+        return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
 /**
- * hooks.json 의 forgen 엔트리 각각에 대해 config.toml 의
- * `[hooks.state."<hooksPath>:<event>:<groupIdx>:<hookIdx>"]` 섹션(trusted_hash) 존재를 대조한다.
- * trusted_hash 자체는 검증하지 않는다 — Codex 가 변경된 훅을 review 전까지 skip 하는 정책을
- * forgen 이 우회하지 않기 위해, *기록 유무* 만 가시화한다 (ADR-014 D4).
+ * ADR-016 D2 — Codex 0.153.4 의 hook trust 해시 재현 (`hook_hash`, discovery.rs).
+ *
+ * 해시는 *핸들러 단위*: `{event_name, matcher?, hooks:[정규화된 핸들러 1개]}` 의 canonical JSON sha256.
+ * 정규화: timeout 은 기본값/clamp 적용 후 항상 포함, async 항상 포함, statusMessage 는 있을 때만,
+ * additionalContextLimit 은 허용 이벤트에서 기본값(2500)이 아닐 때만. 파일 경로·인덱스·미지 필드는 불포함.
+ * `type:"command"` 가 아니면 null (forgen 은 command 훅만 쓴다).
+ */
+export function codexHookTrustHash(event, matcher, handler) {
+    if (handler.type !== 'command' || typeof handler.command !== 'string')
+        return null;
+    const rawTimeout = typeof handler.timeout === 'number' ? handler.timeout : undefined;
+    const timeout = event === 'SessionEnd' || event === 'Interrupt'
+        ? Math.min(3, Math.max(1, rawTimeout ?? 1))
+        : Math.max(1, rawTimeout ?? 600);
+    const normalized = {
+        type: 'command',
+        command: handler.command,
+        timeout,
+        // upstream 은 raw 플래그를 해시한다 (SessionEnd 의 "동기로 실행" 강등은 실행 방식에만 반영).
+        async: handler.async === true,
+    };
+    if (typeof handler.statusMessage === 'string')
+        normalized.statusMessage = handler.statusMessage;
+    if (typeof handler.additionalContextLimit === 'number' &&
+        CODEX_CONTEXT_LIMIT_EVENTS.has(event) &&
+        handler.additionalContextLimit !== CODEX_DEFAULT_CONTEXT_LIMIT) {
+        normalized.additionalContextLimit = handler.additionalContextLimit;
+    }
+    const identity = { event_name: codexHookEventKey(event), hooks: [normalized] };
+    if (!CODEX_NO_MATCHER_EVENTS.has(event) && typeof matcher === 'string')
+        identity.matcher = matcher;
+    return `sha256:${crypto.createHash('sha256').update(canonicalJson(identity)).digest('hex')}`;
+}
+/** config.toml 의 `[hooks.state."<key>"]` (또는 literal `'<key>'`) 섹션 → trusted_hash / enabled. */
+function parseCodexHookState(toml) {
+    const state = new Map();
+    let current = null;
+    for (const raw of toml.split('\n')) {
+        const line = raw.replace(/\r$/, '');
+        const header = line.match(/^\[hooks\.state\.(?:"((?:[^"\\]|\\.)*)"|'([^']*)')\]\s*(#.*)?$/);
+        if (header) {
+            // basic string 은 이스케이프(\\, \") 를 풀고, literal string 은 그대로.
+            const key = header[1] !== undefined ? header[1].replace(/\\(["\\])/g, '$1') : header[2];
+            current = { hash: null, enabled: true };
+            state.set(key, current);
+            continue;
+        }
+        if (/^\s*\[/.test(line)) {
+            current = null;
+            continue;
+        }
+        if (current === null)
+            continue;
+        const hash = line.match(/^\s*trusted_hash\s*=\s*(?:"([^"]*)"|'([^']*)')/);
+        if (hash)
+            current.hash = hash[1] ?? hash[2];
+        if (/^\s*enabled\s*=\s*false\b/.test(line))
+            current.enabled = false;
+    }
+    return state;
+}
+/**
+ * hooks.json 의 forgen 엔트리 각각을 config.toml 의
+ * `[hooks.state."<hooksPath>:<event>:<groupIdx>:<hookIdx>"] trusted_hash` 와 대조한다 (ADR-014 D4).
+ *
+ * ADR-016 D2: 이전엔 *기록 유무* 만 봤다 — 그래서 핸들러가 바뀌어 Codex 가 `modified` 로 skip 하는 훅을
+ * "trusted" 로 오표시했다. 이제 Codex 와 같은 해시를 계산해 trusted / modified / untrusted 를 구분한다.
+ * 읽기 전용 대조이며 trusted_hash 를 쓰지 않는다 — Codex 의 review 정책을 우회하지 않는다.
  */
 export function auditCodexHookTrust(opts) {
     const hooksFile = opts.hooksFile ?? readJsonFile(opts.hooksPath);
     const toml = opts.configToml ?? (fs.existsSync(opts.configTomlPath) ? fs.readFileSync(opts.configTomlPath, 'utf-8') : '');
-    const stateKeys = new Set();
-    const re = /^\[hooks\.state\."([^"]+)"\]\s*$/gm;
-    let m = re.exec(toml);
-    while (m !== null) {
-        stateKeys.add(m[1]);
-        m = re.exec(toml);
+    const state = parseCodexHookState(toml);
+    // Codex 는 $CODEX_HOME 을 canonicalize 한 경로로 키를 쓴다 — 심링크된 홈에서는 raw 경로와 다르다.
+    const keyPrefixes = [opts.hooksPath];
+    try {
+        const real = fs.realpathSync(opts.hooksPath);
+        if (real !== opts.hooksPath)
+            keyPrefixes.push(real);
     }
+    catch { /* hooks.json 없음 (dry-run) */ }
+    const lookup = (key) => {
+        for (const prefix of keyPrefixes) {
+            const hit = state.get(`${prefix}:${key}`);
+            if (hit)
+                return hit;
+        }
+        return undefined;
+    };
     let total = 0;
     let trusted = 0;
     const untrusted = [];
+    const modified = [];
+    const disabled = [];
     const ignoredByCodex = [];
     const events = (hooksFile?.hooks ?? {});
     for (const [event, groups] of Object.entries(events)) {
@@ -263,14 +493,24 @@ export function auditCodexHookTrust(opts) {
                     return;
                 }
                 total += 1;
-                if (stateKeys.has(`${opts.hooksPath}:${key}`))
-                    trusted += 1;
-                else
+                const recorded = lookup(key);
+                if (!recorded || recorded.hash === null) {
                     untrusted.push(key);
+                    return;
+                }
+                if (recorded.hash !== codexHookTrustHash(event, g.matcher, h)) {
+                    modified.push(key);
+                    return;
+                }
+                if (!recorded.enabled) {
+                    disabled.push(key);
+                    return;
+                }
+                trusted += 1;
             });
         });
     }
-    return { total, trusted, untrusted, ignoredByCodex, noStateRecorded: stateKeys.size === 0 };
+    return { total, trusted, untrusted, modified, disabled, ignoredByCodex, noStateRecorded: state.size === 0 };
 }
 // ── ADR-014 D2: Codex custom agents (~/.codex/agents/ch-*.toml) ──────
 const AGENT_TOML_MARKER = '# forgen-managed';

package/dist/host/install-orchestrator.d.ts

@@ -22,6 +22,10 @@ export interface OrchestratorOptions {
     pkgRoot: string;
     dryRun?: boolean;
     registerMcp?: boolean;
+    /** ADR-016 D1: Codex config.toml notify 폴백 등록 (default true). */
+    registerNotify?: boolean;
+    /** ADR-016 D3: Claude user-level `verify` 스킬 설치 (default true). */
+    installVerifySkill?: boolean;
 }
 export interface OrchestratorResult {
     target: InstallTarget;

package/dist/host/install-orchestrator.js

@@ -97,10 +97,10 @@ export async function runInstall(opts) {
     const dryRun = opts.dryRun ?? false;
     const registerMcp = opts.registerMcp ?? true;
     if (target === 'claude' || target === 'both') {
-        result.claude = planClaudeInstall({ pkgRoot: opts.pkgRoot, dryRun, registerMcp });
+        result.claude = planClaudeInstall({ pkgRoot: opts.pkgRoot, dryRun, registerMcp, installVerifySkill: opts.installVerifySkill });
     }
     if (target === 'codex' || target === 'both') {
-        result.codex = planCodexInstall({ pkgRoot: opts.pkgRoot, dryRun, registerMcp });
+        result.codex = planCodexInstall({ pkgRoot: opts.pkgRoot, dryRun, registerMcp, registerNotify: opts.registerNotify });
     }
     // W3-3: opencode 는 명시 타겟일 때만 설치('both' 는 claude+codex primary-pair 유지).
     if (target === 'opencode') {
@@ -120,6 +120,12 @@ export function renderResult(result, dryRun) {
         lines.push(`    settings.json hooks: ${result.claude.hooksInjected}`);
         lines.push(`    MCP: ${result.claude.mcpAlreadyPresent ? 'already present' : (result.claude.mcpRegistered ? 'registered' : 'skipped')}`);
         lines.push(`    skills: ${result.claude.skillsInstalled ?? 0} installed → ${result.claude.skillsPath ?? ''}`);
+        const verifyLine = {
+            installed: 'installed → ~/.claude/skills/verify (Claude runs it right before non-docs commits)',
+            'user-owned': 'skipped — you already have your own `verify` skill (kept as is)',
+            skipped: 'skipped (--no-verify-skill)',
+        };
+        lines.push(`    verify skill: ${verifyLine[result.claude.verifySkill]}`);
     }
     if (result.codex) {
         lines.push('');
@@ -135,8 +141,22 @@ export function renderResult(result, dryRun) {
             lines.push(`    hook trust: ${t.trusted}/${t.total} trusted${t.ignoredByCodex.length ? ` (+${t.ignoredByCodex.length} Claude-only event ignored by Codex)` : ''}`);
         }
         else {
-            lines.push(`    hook trust: ${t.trusted}/${t.total} trusted — ${t.untrusted.length} hook(s) need review. Codex skips untrusted hooks: run \`/hooks\` inside codex and trust the forgen entries.`);
+            const pending = [...t.modified.map((k) => `${k} (modified)`), ...t.untrusted.map((k) => `${k} (new)`), ...t.disabled.map((k) => `${k} (disabled)`)];
+            lines.push(`    hook trust: ${t.trusted}/${t.total} trusted — ${pending.length} hook(s) need review: ${pending.slice(0, 6).join(', ')}${pending.length > 6 ? ', …' : ''}`);
+            lines.push('      Codex skips these until approved/enabled: run `/hooks` inside codex and trust the forgen entries.');
+            if (t.modified.some((k) => k.startsWith('session_start:'))) {
+                lines.push('      ⚠ session_start is pending — the <forgen-rules> block is NOT injected into Codex sessions until you approve it.');
+            }
         }
+        const notifyLine = {
+            installed: 'registered (turn-complete fallback — runs even while hooks are untrusted)',
+            'already-present': 'already present',
+            'user-defined': 'skipped — your config.toml already defines `notify` (kept as is). To chain forgen: notify = ["node", "<pkgRoot>/dist/host/codex-notify.js", "--", <your argv…>]',
+            'custom-block': 'left as is — the forgen notify block in config.toml was hand-edited into a form forgen will not rewrite (keep it on one line as a JSON array to let forgen manage it)',
+            skipped: 'skipped (--no-notify)',
+            removed: 'removed (--no-notify)',
+        };
+        lines.push(`    notify: ${notifyLine[result.codex.notify]}`);
     }
     if (result.opencode) {
         lines.push('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wooojin/forgen",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "preferGlobal": true,
   "main": "dist/lib.js",
   "types": "./dist/lib.d.ts",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://claude.ai/schemas/claude-plugin.json",
   "name": "forgen",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Claude Code harness — the more you use Claude, the better it gets",
   "author": {
     "name": "jang-ujin",