@workit-dev/codex 0.0.0-stage → 1.0.0

package/dist/workit-hook-b8nrcfzr.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+import {
+  gitStoreDir2
+} from "./workit-hook-jy7y0gdx.js";
+
+// packages/workit-core/src/hooks/budget-signal.ts
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+var hash = (text) => createHash("sha256").update(text).digest("hex").slice(0, 32);
+var budgetDir = (store) => path.join(store, "budget");
+var agentBase = (store, session, agentId) => path.join(budgetDir(store), hash(`${session}\x00${agentId ?? ""}`));
+var spawnsFile = (store, session) => path.join(budgetDir(store), `spawns-${hash(session)}.jsonl`);
+var spawnBudget = (prompt) => {
+  const found = /^TIMEBOX:[^\n]*?\b(\d+)\s+tool calls\b/mu.exec(prompt);
+  const n = found ? Number(found[1]) : NaN;
+  return Number.isInteger(n) && n > 0 ? n : null;
+};
+var noteSpawnBudget = (cwd, session, type, prompt) => {
+  try {
+    const store = session ? gitStoreDir2(cwd) : null;
+    if (!store)
+      return;
+    fs.mkdirSync(budgetDir(store), { recursive: true });
+    fs.appendFileSync(spawnsFile(store, session), `${JSON.stringify({ type: type ?? "", n: spawnBudget(prompt) })}
+`);
+  } catch {}
+};
+var readBudget = (file) => {
+  try {
+    const { limit, told } = JSON.parse(fs.readFileSync(file, "utf8"));
+    return typeof limit === "number" && limit > 0 ? { limit, told: Number(told) || 0 } : null;
+  } catch {
+    return null;
+  }
+};
+var claimSpawnBudget = (cwd, session, agentId, agentType) => {
+  try {
+    const store = session ? gitStoreDir2(cwd) : null;
+    if (!store)
+      return null;
+    const file = spawnsFile(store, session);
+    const entries = fs.readFileSync(file, "utf8").split(`
+`).filter(Boolean).map((line) => JSON.parse(line));
+    const at = entries.findIndex((entry) => entry.type === (agentType ?? ""));
+    if (at < 0)
+      return null;
+    const [{ n }] = entries.splice(at, 1);
+    fs.writeFileSync(file, entries.map((entry) => `${JSON.stringify(entry)}
+`).join(""));
+    if (typeof n !== "number" || n <= 0)
+      return null;
+    startBudget(store, session, agentId, n);
+    return n;
+  } catch {
+    return null;
+  }
+};
+var startBudget = (store, session, agentId, n) => {
+  const dir = budgetDir(store);
+  fs.mkdirSync(dir, { recursive: true });
+  const cutoff = Date.now() - 604800000;
+  for (const name of fs.readdirSync(dir))
+    try {
+      if (fs.statSync(path.join(dir, name)).mtimeMs < cutoff)
+        fs.rmSync(path.join(dir, name));
+    } catch {}
+  const base = agentBase(store, session, agentId);
+  fs.writeFileSync(`${base}.json`, JSON.stringify({ limit: n, told: 0 }));
+  fs.rmSync(`${base}.calls`, { force: true });
+};
+var tickBudget = (cwd, session, agentId) => {
+  try {
+    const store = session ? gitStoreDir2(cwd) : null;
+    if (!store)
+      return false;
+    const base = agentBase(store, session, agentId);
+    const budget = readBudget(`${base}.json`);
+    if (!budget)
+      return false;
+    fs.appendFileSync(`${base}.calls`, ".");
+    return fs.statSync(`${base}.calls`).size >= budget.limit * (budget.told + 1);
+  } catch {
+    return false;
+  }
+};
+var lineFor = (calls) => `Tool-call budget reached (${calls}): commit your work, write your report, stop.`;
+var reachedOf = (cwd, session, agentId) => {
+  const store = session ? gitStoreDir2(cwd) : null;
+  const base = store && agentBase(store, session, agentId);
+  const budget = base && readBudget(`${base}.json`);
+  if (!budget)
+    return null;
+  return { base, budget, reached: Math.floor(fs.statSync(`${base}.calls`).size / budget.limit) };
+};
+var dropBudget = (cwd, session, agentId) => {
+  const store = session ? gitStoreDir2(cwd) : null;
+  if (store)
+    for (const ext of [".json", ".calls"])
+      fs.rmSync(agentBase(store, session, agentId) + ext, { force: true });
+};
+var budgetLine = (cwd, session, agentId) => {
+  try {
+    const at = reachedOf(cwd, session, agentId);
+    if (!at || at.reached <= at.budget.told)
+      return null;
+    fs.writeFileSync(`${at.base}.json`, JSON.stringify({ ...at.budget, told: at.reached }));
+    return lineFor(at.budget.limit * at.reached);
+  } catch {
+    return null;
+  }
+};
+var CODEX_GATED = new Set(["bash", "unifiedexec", "shell", "applypatch", "edit", "write"]);
+var observeHookBudget2 = (payload) => {
+  try {
+    const value = JSON.parse(payload);
+    if (value.hook_event_name !== "PreToolUse" || typeof value.session_id !== "string")
+      return false;
+    const cwd = typeof value.cwd === "string" ? value.cwd : ".";
+    const agentId = typeof value.agent_id === "string" && value.agent_id.trim() ? value.agent_id : null;
+    if (agentId)
+      return tickBudget(cwd, value.session_id, agentId);
+    const tool = typeof value.tool_name === "string" ? value.tool_name : "";
+    const spawn = value.tool_input;
+    if (CODEX_GATED.has(tool.toLowerCase().replace(/[_-]/g, "")) || !spawn || typeof spawn !== "object")
+      return false;
+    const fields = spawn;
+    const prompt = Object.values(fields).find((field) => typeof field === "string" && field.includes("TIMEBOX:"));
+    const type = [fields.agent_type, fields.subagent_type].find((field) => typeof field === "string");
+    if (prompt !== undefined || type !== undefined)
+      noteSpawnBudget(cwd, value.session_id, type ?? null, prompt ?? "");
+    return false;
+  } catch {
+    return false;
+  }
+};
+var budgetHooks2 = {
+  line: (input) => budgetLine(input.cwd, input.session.id ?? "", input.session.agentId),
+  start: (input, agentId, agentType) => void claimSpawnBudget(input.cwd, input.session.id ?? "", agentId, agentType),
+  spawn: (input, spawn) => {
+    if (!input.session.agentId)
+      noteSpawnBudget(input.cwd, input.session.id ?? "", String(spawn.subagent_type || "general-purpose"), String(spawn.prompt ?? ""));
+  },
+  stop: (input, agentId) => {
+    try {
+      dropBudget(input.cwd, input.session.id ?? "", agentId);
+    } catch {}
+  }
+};
+
+export { observeHookBudget2, budgetHooks2 };

package/dist/workit-hook-ehy7rps6.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+import"./workit-hook-am9gge2k.js";
+import {
+  recordHookFailure2
+} from "./workit-hook-zyzsv436.js";
+import {
+  stateDir3
+} from "./workit-hook-6n3h8wh7.js";
+
+// packages/workit-core/src/core/node-resolve.mjs
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+var HOOK_NODE_REEXEC_ENV = "WORKIT_HOOK_REEXEC";
+var MAX_ENTRIES_PER_ROOT = 200;
+var parseNodeVersion = (text) => {
+  const found = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(String(text).trim());
+  return found ? [Number(found[1]), Number(found[2] || 0), Number(found[3] || 0)] : null;
+};
+var compareVersions = (a, b) => {
+  for (let i = 0;i < 3; i++)
+    if (a[i] !== b[i])
+      return a[i] - b[i];
+  return 0;
+};
+var hookStateDir = (env) => stateDir3(env);
+var isFile = (file) => {
+  try {
+    return statSync(file).isFile();
+  } catch {
+    return false;
+  }
+};
+var readJson = (file) => {
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+};
+var scanRoots = (env, platform) => {
+  const home = env.HOME || env.USERPROFILE || os.homedir();
+  const win = platform === "win32";
+  const exe = win ? "node.exe" : "node";
+  const bin = win ? exe : path.join("bin", exe);
+  const roots = [];
+  const add = (dir, rel) => {
+    if (dir)
+      roots.push({ dir, bin: rel });
+  };
+  const fnmDirs = [
+    env.FNM_DIR,
+    win ? path.join(env.APPDATA || path.join(home, "AppData", "Roaming"), "fnm") : "",
+    win ? path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "fnm") : "",
+    env.XDG_DATA_HOME ? path.join(env.XDG_DATA_HOME, "fnm") : "",
+    path.join(home, ".local", "share", "fnm"),
+    path.join(home, "Library", "Application Support", "fnm"),
+    path.join(home, ".fnm")
+  ];
+  for (const dir of fnmDirs)
+    if (dir)
+      add(path.join(dir, "node-versions"), path.join("installation", bin));
+  for (const dir of [env.NVM_DIR, path.join(home, ".nvm")])
+    if (dir)
+      add(path.join(dir, "versions", "node"), bin);
+  if (env.NVM_HOME)
+    add(env.NVM_HOME, exe);
+  const volta = env.VOLTA_HOME || (win ? "" : path.join(home, ".volta"));
+  if (volta)
+    add(path.join(volta, "tools", "image", "node"), bin);
+  if (win)
+    add(path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "Volta", "tools", "image", "node"), bin);
+  const mise = env.MISE_DATA_DIR || path.join(home, ".local", "share", "mise");
+  add(path.join(mise, "installs", "node"), bin);
+  const asdf = env.ASDF_DATA_DIR || path.join(home, ".asdf");
+  add(path.join(asdf, "installs", "nodejs"), bin);
+  return roots;
+};
+var scanInstalledNodes = (env, platform = process.platform) => {
+  const found = [];
+  for (const root of scanRoots(env, platform)) {
+    let names;
+    try {
+      names = readdirSync(root.dir).slice(0, MAX_ENTRIES_PER_ROOT);
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      const version = parseNodeVersion(name);
+      if (!version || !/^v?\d/.test(name))
+        continue;
+      const candidate = path.join(root.dir, name, root.bin);
+      if (isFile(candidate))
+        found.push({ path: candidate, version, source: root.dir });
+    }
+  }
+  return found;
+};
+var resolveHookNode = ({ env, floor, platform = process.platform }) => {
+  if (env.WORKIT_NODE && isFile(env.WORKIT_NODE))
+    return { path: env.WORKIT_NODE, version: null, source: "env" };
+  const recorded = readJson(path.join(hookStateDir(env), "node.json"));
+  if (recorded && typeof recorded.path === "string" && isFile(recorded.path)) {
+    const version = parseNodeVersion(recorded.version);
+    if (version && compareVersions(version, floor) >= 0)
+      return { path: recorded.path, version: String(recorded.version), source: "recorded" };
+  }
+  let best = null;
+  for (const entry of scanInstalledNodes(env, platform))
+    if (compareVersions(entry.version, floor) >= 0 && (!best || compareVersions(entry.version, best.version) > 0))
+      best = entry;
+  return best ? { path: best.path, version: best.version.join("."), source: "scan" } : null;
+};
+var nodeFloorNotice = (found, range) => `Workit hooks are off: the Node on PATH is ${String(found).replace(/^v/, "")}, below the required ${range}, and no Node 24+ was found. ` + "Install Node 24 (fnm install 24, nvm install 24) or run `workit setup` from a Node 24 shell so Workit can record it; " + "`workit doctor` (check hook_node) shows what the hooks run on.";
+var reexecOnNode = (nodePath, script, args, env) => {
+  const child = Object.assign({}, env, { [HOOK_NODE_REEXEC_ENV]: "1" });
+  delete child.WORKIT_HOOK_NODE_VERSION;
+  const run = spawnSync(nodePath, [script].concat(args), {
+    stdio: "inherit",
+    env: child,
+    windowsHide: true
+  });
+  if (run.error)
+    return null;
+  return run.status === null ? 1 : run.status;
+};
+var handleBelowFloor = async (options) => {
+  if (!options.env[HOOK_NODE_REEXEC_ENV]) {
+    const hit = resolveHookNode({ env: options.env, floor: options.floor });
+    const code = hit ? reexecOnNode(hit.path, options.script, options.argv, options.env) : null;
+    if (code !== null)
+      return code;
+  }
+  process.stderr.write(`[workit] ${options.host} hook unavailable: needs Node ${options.range}, found ${options.found}
+`);
+  let early = "";
+  for await (const chunk of process.stdin)
+    early += String(chunk);
+  let event;
+  try {
+    event = JSON.parse(early).hook_event_name;
+  } catch {
+    event = undefined;
+  }
+  process.stdout.write(options.isStart(event) ? `${JSON.stringify(options.notice(nodeFloorNotice(options.found, options.range)))}
+` : `{}
+`);
+  return 0;
+};
+
+// packages/workit-codex/hooks/fail-loud.ts
+var LOUD_EVENTS = new Set(["SessionStart", "UserPromptSubmit", "SubagentStart"]);
+var SUBAGENT_NOTE = " This subagent got no Workit session: a verifier or reviewer cannot record a verdict (it fails with no_session) until the hook runs; fix the hook, run `workit doctor`, then spawn a fresh one.";
+var isLoudEvent = (event) => typeof event === "string" && LOUD_EVENTS.has(event);
+var failedAnswer = (event, text) => {
+  if (typeof event !== "string" || !LOUD_EVENTS.has(event))
+    return {};
+  const message = event === "SubagentStart" ? `${text}${SUBAGENT_NOTE}` : text;
+  return {
+    systemMessage: message,
+    hookSpecificOutput: { hookEventName: event, additionalContext: message }
+  };
+};
+var recordFailure = (host, event, cause) => recordHookFailure2(host, typeof event === "string" ? event : null, cause);
+var answerRuntimeFailure = (host, payload, error) => {
+  const reason = `could not run (${error instanceof Error ? error.message : String(error)})`;
+  process.stderr.write(`[workit] Codex hook unavailable: ${reason}
+`);
+  let event;
+  try {
+    event = JSON.parse(payload).hook_event_name;
+  } catch {
+    event = undefined;
+  }
+  recordFailure(host, event, reason);
+  process.stdout.write(`${JSON.stringify(failedAnswer(event, `Workit hooks are off: the Codex hook ${reason}. Branch policy, task context and verifier sessions are off until it does. Run \`workit upgrade\` to reinstall the plugin, then \`workit doctor\` (check hook_node runs each installed hook).`))}
+`);
+};
+var belowFloor = async (host, node, script) => {
+  const cause = `needs Node ${node.range}, found ${node.found}`;
+  let floorEvent;
+  return handleBelowFloor({
+    host: "Codex",
+    ...node,
+    script,
+    argv: process.argv.slice(2),
+    env: process.env,
+    isStart: (event) => {
+      floorEvent = event;
+      recordFailure(host, event, cause);
+      return isLoudEvent(event);
+    },
+    notice: (text) => failedAnswer(floorEvent, text)
+  });
+};
+export {
+  answerRuntimeFailure,
+  belowFloor
+};

package/dist/workit-hook-jy7y0gdx.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+
+// packages/workit-core/src/hooks/standing-signal.ts
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+var gitStoreDir2 = (cwd) => {
+  try {
+    for (let dir = path.resolve(cwd);; dir = path.dirname(dir)) {
+      const dotGit = path.join(dir, ".git");
+      if (fs.existsSync(dotGit)) {
+        let gitDir = dotGit;
+        if (fs.statSync(dotGit).isFile()) {
+          const target = /^gitdir:\s*(.+)$/mu.exec(fs.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+          if (!target)
+            return null;
+          gitDir = path.resolve(dir, target);
+          const common = path.join(gitDir, "commondir");
+          if (fs.existsSync(common))
+            gitDir = path.resolve(gitDir, fs.readFileSync(common, "utf8").trim());
+        }
+        return path.join(gitDir, "workit");
+      }
+      if (path.dirname(dir) === dir)
+        return null;
+    }
+  } catch {
+    return null;
+  }
+};
+var standingRevFile = (store) => path.join(store, "standing", "rev");
+var standingSeenFile2 = (store, session, agentId) => path.join(store, "standing", "seen", `${createHash("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`);
+var readStandingRev2 = (store) => {
+  try {
+    return fs.readFileSync(standingRevFile(store), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+};
+var readStandingSeen2 = (file) => {
+  try {
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    return {
+      rev: typeof value.rev === "string" ? value.rev : null,
+      ids: Array.isArray(value.ids) ? value.ids.filter((id) => typeof id === "string") : []
+    };
+  } catch {
+    return { rev: null, ids: [] };
+  }
+};
+var writeStandingSeen2 = (file, seen) => {
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(seen));
+  } catch {}
+};
+var bumpStandingRev2 = (store, rev) => {
+  try {
+    fs.mkdirSync(path.join(store, "standing"), { recursive: true });
+    fs.writeFileSync(standingRevFile(store), `${rev}
+`);
+  } catch {}
+};
+var standingPending2 = (cwd, session, agentId) => {
+  const store = gitStoreDir2(cwd);
+  const rev = store ? readStandingRev2(store) : null;
+  return rev !== null && readStandingSeen2(standingSeenFile2(store, session, agentId)).rev !== rev;
+};
+
+export { gitStoreDir2, standingSeenFile2, readStandingRev2, readStandingSeen2, writeStandingSeen2, bumpStandingRev2, standingPending2 };

package/dist/workit-hook-mk64s4fk.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import {
+  gitStoreDir2,
+  standingSeenFile2,
+  readStandingRev2,
+  readStandingSeen2,
+  writeStandingSeen2,
+  bumpStandingRev2,
+  standingPending2
+} from "./workit-hook-jy7y0gdx.js";
+export {
+  bumpStandingRev2 as bumpStandingRev,
+  gitStoreDir2 as gitStoreDir,
+  readStandingRev2 as readStandingRev,
+  readStandingSeen2 as readStandingSeen,
+  standingPending2 as standingPending,
+  standingSeenFile2 as standingSeenFile,
+  writeStandingSeen2 as writeStandingSeen
+};

package/dist/workit-hook-y0ga088a.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  stateDir2,
+  maybeHeavy2
+} from "./workit-hook-am9gge2k.js";
+export {
+  maybeHeavy2 as maybeHeavy,
+  stateDir2 as stateDir
+};

package/dist/workit-hook-zyzsv436.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import {
+  stateDir2
+} from "./workit-hook-am9gge2k.js";
+
+// packages/workit-core/src/hooks/hook-runs.ts
+import { mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+var HOOK_RUNS_DIR = "hook-runs";
+var HOOK_FAILURE_SUFFIX = "__failed";
+var safe = (part) => part.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 64);
+var runFile = (dir, host, event, failed = false) => path.join(dir, HOOK_RUNS_DIR, `${safe(host)}__${safe(event)}${failed ? HOOK_FAILURE_SUFFIX : ""}.json`);
+var recordHookRun2 = (host, event, env = process.env, now = Date.now) => {
+  if (event)
+    writeRun(host, event, undefined, env, now);
+};
+var recordHookFailure2 = (host, event, cause, env = process.env, now = Date.now) => writeRun(host, event || "unknown", cause.slice(0, 500), env, now);
+var writeRun = (host, event, failure, env, now) => {
+  try {
+    const dir = stateDir2(env);
+    const file = runFile(dir, host, event, failure !== undefined);
+    let count = 0;
+    try {
+      const previous = JSON.parse(readFileSync(file, "utf8"));
+      if (typeof previous.count === "number" && Number.isFinite(previous.count))
+        count = previous.count;
+    } catch {}
+    const row = {
+      host,
+      event,
+      at: new Date(now()).toISOString(),
+      count: count + 1,
+      ...failure === undefined ? {} : { failure }
+    };
+    try {
+      writeFileSync(file, JSON.stringify(row));
+    } catch {
+      mkdirSync(path.dirname(file), { recursive: true });
+      writeFileSync(file, JSON.stringify(row));
+    }
+  } catch {}
+};
+export { recordHookRun2, recordHookFailure2 };

package/dist/workit-hook.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+
+// packages/workit-codex/hooks/launcher.ts
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+var foundNode = process.env.WORKIT_HOOK_NODE_VERSION || process.versions.node;
+var nodeFloor = () => {
+  try {
+    const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+    const range = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).engines?.node;
+    const min = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(String(range ?? ""));
+    if (!min || !range)
+      return null;
+    const floor = [min[1], min[2] ?? 0, min[3] ?? 0].map(Number);
+    const have = String(foundNode).replace(/^v/, "").split(".").map(Number);
+    for (let i = 0;i < 3; i++) {
+      const a = have[i] ?? 0;
+      if (Number.isNaN(a))
+        return null;
+      if (a !== floor[i])
+        return a < floor[i] ? { range, floor } : null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+};
+var codexHost = () => process.env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || process.env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli";
+var tooOld = nodeFloor();
+if (tooOld) {
+  const { belowFloor } = await import("./workit-hook-ehy7rps6.js");
+  process.exit(await belowFloor(codexHost(), { ...tooOld, found: foundNode }, fileURLToPath(import.meta.url)));
+}
+var { useOwnedWorkitCli } = await import("./workit-hook-avy6vsn6.js");
+useOwnedWorkitCli();
+var { maybeHeavy, stateDir } = await import("./workit-hook-y0ga088a.js");
+var { standingPending } = await import("./workit-hook-mk64s4fk.js");
+var { recordHookRun } = await import("./workit-hook-3qaf6adn.js");
+var { observeHookBudget } = await import("./workit-hook-3g6cv3hd.js");
+var payload = "";
+for await (const chunk of process.stdin)
+  payload += String(chunk);
+var SHELL_TOOLS = new Set(["bash", "unified-exec"]);
+var WRITE_TOOLS = new Set(["applypatch", "edit", "write"]);
+var mentionsIssued = (text) => {
+  const flat = (value) => value.replaceAll("\\", "/").toLowerCase();
+  return /issued/i.test(text) || flat(text).includes(flat(stateDir(process.env)));
+};
+var quietEvent = () => {
+  try {
+    const value = JSON.parse(payload);
+    const event = value.hook_event_name;
+    if (event !== "PreToolUse" && event !== "PostToolUse")
+      return null;
+    if (typeof value.cwd !== "string" || typeof value.tool_name !== "string")
+      return null;
+    if (event === "PreToolUse" && typeof value.session_id === "string" && standingPending(value.cwd, value.session_id, typeof value.agent_id === "string" && value.agent_id.trim() ? value.agent_id : null))
+      return null;
+    const tool = value.tool_name.toLowerCase();
+    if (event === "PreToolUse" && WRITE_TOOLS.has(tool.replace(/[_-]/g, "")))
+      return null;
+    if (event === "PreToolUse" && value.agent_type === "workit-implementer")
+      return null;
+    const shell = SHELL_TOOLS.has(tool);
+    const command = value.tool_input?.command;
+    const text = Array.isArray(command) ? command.join(" ") : String(command ?? "");
+    if (!shell)
+      return event;
+    if (!text.trim())
+      return null;
+    if (event === "PostToolUse")
+      return /\bcommit\b/.test(text) ? null : event;
+    return /\b(?:git|gh|glab)\b/.test(text) || mentionsIssued(text) || maybeHeavy(text, value.cwd) ? null : event;
+  } catch {
+    return null;
+  }
+};
+var quiet = observeHookBudget(payload) ? null : quietEvent();
+if (quiet) {
+  if (quiet === "PreToolUse")
+    recordHookRun(codexHost(), quiet);
+  process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
+`);
+} else {
+  try {
+    const { runCodexHook } = await import("./workit-hook-2hj7pbaj.js");
+    await runCodexHook([payload]);
+  } catch (error) {
+    const { answerRuntimeFailure } = await import("./workit-hook-ehy7rps6.js");
+    answerRuntimeFailure(codexHost(), payload, error);
+    process.exitCode = 0;
+  }
+}

package/hooks/hooks.json

@@ -0,0 +1,46 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "*",
+        "hooks": [{ "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js" }]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [{ "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js" }]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [{ "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js" }]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [{ "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js" }]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "matcher": "*",
+        "hooks": [{ "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js" }]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          { "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js", "timeout": 20 }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "matcher": "*",
+        "hooks": [{ "type": "command", "command": "node ${PLUGIN_ROOT}/dist/workit-hook.js" }]
+      }
+    ]
+  }
+}