@zaip-ai/cli 1.0.6 → 1.0.7

package/dist/services/codex-pre-tool-hook-template.js

@@ -0,0 +1,472 @@
+export const CODEX_PRE_TOOL_HOOK = String.raw `import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const deletionCommandPattern = /\b(?:Remove-Item|rm|rmdir|rd|del|erase)\b/i;
+const allowedExplicitNetworkHosts = new Set([
+  "127.0.0.1",
+  "api.github.com",
+  "github.com",
+  "localhost",
+  "objects.githubusercontent.com",
+  "::1",
+]);
+const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
+const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPATH)\b|%(?:USERPROFILE|HOMEDRIVE|HOMEPATH)%|(?:^|[\s"'=])~[\\/])/i;
+const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:[\\/\s"']|$)/i;
+const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
+const destructivePatterns = [
+  {
+    pattern: /\b(?:Clear-Content|shred)\b/i,
+    reason: "Unbounded content destruction is blocked.",
+  },
+  {
+    pattern: /\bgit\s+(?:clean\b|reset\s+--hard\b|checkout\s+--\b|restore\b|branch\s+-d\b|tag\s+-d\b)/i,
+    reason: "Destructive Git state changes are blocked.",
+  },
+  {
+    pattern: /\bgit\s+push\b[\s\S]*(?:--force(?:-with-lease|-if-includes)?\b|-f\b|--mirror\b|--delete\b|--all\b|(?:^|\s):\S+)/i,
+    reason: "Force, mirror, bulk, and deletion pushes are blocked.",
+  },
+  {
+    pattern: /\bgit\s+commit\b[\s\S]*(?:--amend\b|--no-verify\b|-n\b)/i,
+    reason: "Commit history rewrites and hook bypasses are blocked.",
+  },
+  {
+    pattern: /\bgit\s+fetch\b[\s\S]*(?:--all\b|--prune\b|--prune-tags\b)/i,
+    reason: "Bulk or pruning fetches are outside the bounded deploy flow.",
+  },
+  {
+    pattern: /\bgit\s+add\b[\s\S]*(?:--force\b|-f\b|(?:^|[\\/\s])(?:\.env(?:\.|\s|$)|[^\s]*\.(?:pem|key|p12|pfx)\b|id_(?:rsa|ed25519)\b))/i,
+    reason: "Force-adding or explicitly staging credential-like files is blocked.",
+  },
+  {
+    pattern: /\bgit\s+add\b[\s\S]*(?:\s-A\b|--all\b|(?:^|\s)\.(?:\s|$)|\s-u\b)/i,
+    reason: "Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.",
+  },
+  {
+    pattern: /\bgit\s+(?:remote\s+(?:add|set-url|remove|rename)|config\b[\s\S]*(?:sshCommand|credential|url\.))/i,
+    reason: "Remote, SSH, and credential configuration changes are blocked.",
+  },
+  {
+    pattern: /\bgh\b[\s\S]*\s--repo(?:=|\s)/i,
+    reason: "GitHub CLI commands must target the current repository.",
+  },
+  {
+    pattern: /\b(?:drop\s+(?:database|schema|table)|truncate\s+table|supabase\s+db\s+reset)\b/i,
+    reason: "Destructive database operations are blocked.",
+  },
+  {
+    pattern: /\b(?:rmSync|rmdirSync|unlinkSync|rmtree|remove|unlink|Directory\.Delete|File\.Delete)\s*\(/i,
+    reason: "Inline deletion APIs are blocked.",
+  },
+  {
+    pattern: /(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|\biwr\b|\birm\b)[\s\S]*\|[\s&]*(?:bash|sh|zsh|pwsh|powershell|cmd|node|python|iex|Invoke-Expression)\b/i,
+    reason: "Downloaded content cannot be piped into an interpreter.",
+  },
+  {
+    pattern: /(?:-(?:EncodedCommand|enc)\b|FromBase64String\s*\(|certutil\s+-(?:decode|urlcache)\b|mshta\s+https?:|rundll32\s+javascript:)/i,
+    reason: "Encoded or evasive command execution is blocked.",
+  },
+  {
+    pattern: /\b(?:Set-MpPreference|Add-MpPreference|Remove-MpPreference|Set-NetFirewallProfile|New-NetFirewallRule|Remove-NetFirewallRule|Disable-NetFirewallRule|Enable-PSRemoting|Set-WSManQuickConfig)\b|\bnetsh\s+advfirewall[\s\S]*(?:\boff\b|\badd\b|\bdelete\b|\bset\b)/i,
+    reason: "Firewall, antivirus, and remote-management changes are blocked.",
+  },
+  {
+    pattern: /\b(?:reg(?:\.exe)?\s+(?:add|delete)|schtasks(?:\.exe)?\s+\/(?:create|delete|change)|sc(?:\.exe)?\s+(?:create|delete|stop|config)|New-Service|Set-Service|Stop-Service)\b/i,
+    reason: "OS persistence and service changes are blocked.",
+  },
+  {
+    pattern: /\b(?:diskpart|format(?:\.com)?|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|\bcipher\s+\/w\b/i,
+    reason: "Disk, boot, ownership, and access-control changes are blocked.",
+  },
+  {
+    pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
+    reason: "Privilege escalation and persistent execution-policy changes are blocked.",
+  },
+  {
+    pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
+    reason: "System-wide package changes are blocked.",
+  },
+  {
+    pattern: /(?:--host|--hostname|--listen(?:-address)?)\s+(?:0\.0\.0\.0|\*|::)\b/i,
+    reason: "Non-loopback listeners are blocked.",
+  },
+  {
+    pattern: /\bgh\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:--method|-X)\s*(?:POST|PUT|PATCH|DELETE))\b/i,
+    reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
+  },
+  {
+    pattern: /\b(?:npm|pnpm|yarn)\s+(?:publish|login|logout|token|owner|deprecate)\b/i,
+    reason: "Package-registry publication and credential changes are blocked.",
+  },
+];
+
+function deny(reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: "ZAIP safety policy: " + reason,
+      },
+    }) + "\n",
+  );
+  process.exit(0);
+}
+
+function isWithinRepository(path) {
+  const candidate = relative(repositoryRoot, resolve(path));
+  return candidate === "" || (!candidate.startsWith("..") && !isAbsolute(candidate));
+}
+
+function repositoryPath(path) {
+  return relative(repositoryRoot, resolve(path)).replaceAll("\\", "/");
+}
+
+function isGitPath(path) {
+  const scoped = repositoryPath(path);
+  return scoped === ".git" || scoped.startsWith(".git/");
+}
+
+function unquote(value) {
+  return value.trim().replace(/^["']|["']$/g, "");
+}
+
+function explicitPathCandidates(command) {
+  const withoutUrls = command.replace(/https?:\/\/[^\s"'\x60]+/gi, "");
+  const candidates = new Set();
+  for (const match of withoutUrls.matchAll(/["']([A-Za-z]:[\\/][^"']+)["']/g)) {
+    candidates.add(match[1]);
+  }
+  for (const match of withoutUrls.matchAll(/(?:^|[\s=(:,])([A-Za-z]:[\\/][^\s"'\x60;|&),]+)/g)) {
+    candidates.add(match[1]);
+  }
+  for (const match of withoutUrls.matchAll(/["']([^"']*\.\.[\\/][^"']*)["']/g)) {
+    candidates.add(match[1]);
+  }
+  for (const match of withoutUrls.matchAll(/(?:^|[\s=(:,])(\.\.[\\/][^\s"'\x60;|&),]+)/g)) {
+    candidates.add(match[1]);
+  }
+  return [...candidates].map(unquote).filter(Boolean);
+}
+
+function validateExplicitFilesystemReferences(command, cwd) {
+  if (homeReferencePattern.test(command)) {
+    deny("Direct user-profile path references are blocked; use repository-scoped paths.");
+  }
+  if (credentialReferencePattern.test(command) || sensitiveEnvironmentPattern.test(command)) {
+    deny("Direct credential and secret access is blocked.");
+  }
+  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(command) || /GetEnvironmentVariables\s*\(/i.test(command)) {
+    deny("Bulk environment enumeration is blocked.");
+  }
+  if (/\\\\[^\\\s"']+[\\/]/.test(command)) {
+    deny("UNC and network filesystem paths are blocked.");
+  }
+  if (/(?:^|[\s"'=])\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:[\/\s"']|$)/i.test(command)) {
+    deny("Explicit operating-system paths outside the repository are blocked.");
+  }
+  for (const candidate of explicitPathCandidates(command)) {
+    const absolute = resolve(cwd, candidate);
+    if (!isWithinRepository(absolute)) {
+      deny("Explicit filesystem path escapes the repository boundary.");
+    }
+  }
+}
+
+function validateInlineExecution(command) {
+  const inlinePatterns = [
+    /\b(?:node|deno)\s+(?:-e|--eval)\b/i,
+    /\b(?:python(?:3)?|ruby|perl|php)\s+(?:-c|-e)\b/i,
+    /\bdeno\s+eval\b/i,
+    /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]*\s-(?:Command|EncodedCommand|enc)\b/i,
+    /\bcmd(?:\.exe)?\s+\/c\b/i,
+    /\|\s*(?:node|deno|python(?:3)?|ruby|perl|php|powershell|pwsh|cmd)\b/i,
+    /\b(?:Invoke-Expression|iex)\b/i,
+  ];
+  if (inlinePatterns.some((pattern) => pattern.test(command))) {
+    deny("Inline or piped interpreter execution is blocked; use a reviewed repository script.");
+  }
+}
+
+function validateGitPublication(command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (tokens === null || tokens[0]?.toLowerCase() !== "git" || tokens[1]?.toLowerCase() !== "push") return;
+  const branch =
+    tokens.length === 4 && tokens[2] === "origin"
+      ? tokens[3]
+      : tokens.length === 5 && tokens[2] === "-u" && tokens[3] === "origin"
+        ? tokens[4]
+        : null;
+  if (branch === null || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch)) {
+    deny("Git publication must use an explicit valid branch on origin.");
+  }
+}
+
+function validateExplicitNetwork(command) {
+  if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
+    deny("Direct remote-shell and file-transfer clients are blocked.");
+  }
+  if (!networkClientPattern.test(command)) return;
+  if (/(?:--request|-X|--method|-Method)\s*(?:POST|PUT|PATCH|DELETE)\b|(?:--data|--data-binary|--upload-file|-T)\b/i.test(command)) {
+    deny("Explicit HTTP mutations and uploads are blocked.");
+  }
+  const urls = [...command.matchAll(/https?:\/\/([^\s\/"'\x60]+)/gi)];
+  if (urls.length === 0) {
+    deny("Network clients require an explicit allowlisted URL.");
+  }
+  for (const match of urls) {
+    let host;
+    try {
+      host = new URL("https://" + match[1]).hostname.toLowerCase();
+    } catch {
+      deny("Malformed network target was rejected.");
+    }
+    if (!allowedExplicitNetworkHosts.has(host)) {
+      deny("Explicit network target is outside the ZAIP allowlist.");
+    }
+  }
+}
+
+function tokenizeLiteralCommand(command) {
+  if (
+    command.includes("\r") ||
+    command.includes("\n") ||
+    command.includes(";") ||
+    command.includes("|") ||
+    command.includes("&") ||
+    command.includes(String.fromCharCode(96))
+  ) return null;
+
+  const tokens = [];
+  let token = "";
+  let quote = null;
+  let started = false;
+  for (const character of command) {
+    if (quote !== null) {
+      if (character === quote) quote = null;
+      else token += character;
+    } else if (character === "'" || character === '"') {
+      quote = character;
+      started = true;
+    } else if (/\s/.test(character)) {
+      if (started) {
+        tokens.push(token);
+        token = "";
+        started = false;
+      }
+    } else {
+      token += character;
+      started = true;
+    }
+  }
+  if (quote !== null) return null;
+  if (started) tokens.push(token);
+  return tokens;
+}
+
+function deletionTargets(command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (tokens === null || tokens.length < 2) return null;
+  const executable = tokens[0].toLowerCase();
+
+  if (executable === "remove-item") {
+    let target = null;
+    for (let index = 1; index < tokens.length; index += 1) {
+      const option = tokens[index].toLowerCase();
+      if (option === "-literalpath") {
+        if (target !== null || index + 1 >= tokens.length) return null;
+        target = tokens[index + 1];
+        index += 1;
+      } else if (option === "-erroraction") {
+        const action = tokens[index + 1]?.toLowerCase();
+        if (action !== "stop" && action !== "silentlycontinue") return null;
+        index += 1;
+      } else if (option !== "-force" && option !== "-recurse") {
+        return null;
+      }
+    }
+    return target === null ? null : [target];
+  }
+
+  if (!new Set(["rm", "rmdir", "rd", "del", "erase"]).has(executable)) return null;
+  const targets = [];
+  for (const token of tokens.slice(1)) {
+    if (token === "--") continue;
+    if (executable === "rm" && /^-[rRf]+$/.test(token)) continue;
+    if ((executable === "rd" || executable === "del" || executable === "erase") && /^\/[fqs]$/i.test(token)) continue;
+    if (token.startsWith("-") && !isAbsolute(token)) return null;
+    targets.push(token);
+  }
+  return targets.length === 0 ? null : targets;
+}
+
+async function validateDeletionPath(path, cwd) {
+  const unsafeCharacters = ["*", "?", "[", "]", "{", "}", "$", "%"];
+  if (
+    path.length === 0 ||
+    path.startsWith("~") ||
+    unsafeCharacters.some((character) => path.includes(character))
+  ) {
+    deny("Deletion requires an explicit literal path without variables or wildcards.");
+  }
+  const absolute = resolve(cwd, path);
+  if (!isWithinRepository(absolute)) deny("Deletion target escapes the repository boundary.");
+  if (repositoryPath(absolute) === "") deny("Deleting the repository root is blocked.");
+  if (isGitPath(absolute)) deny("Deletion of protected Git control files is blocked.");
+
+  try {
+    const information = await lstat(absolute);
+    if (information.isSymbolicLink() && !isWithinRepository(await realpath(absolute))) {
+      deny("Deletion through a link that resolves outside the repository is blocked.");
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") deny("Deletion target could not be safely resolved.");
+  }
+}
+
+async function validateShellDeletion(command, cwd) {
+  if (!deletionCommandPattern.test(command)) return;
+  const targets = deletionTargets(command);
+  if (targets === null) {
+    deny("Deletion commands must use a single literal operation with explicit repository-scoped paths.");
+  }
+  for (const target of targets) await validateDeletionPath(target, cwd);
+}
+
+function validatePatch(command) {
+  const headers = [...command.matchAll(/^\*\*\* (Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)];
+  const lifecycleRecordTouched = headers.some((match) => {
+    const candidate = (match[2] ?? match[3]).trim().replace(/^["']|["']$/g, "");
+    return /^\.agents[\\/]records[\\/](?:prds|specs|tasks)[\\/]/i.test(candidate);
+  });
+  if (lifecycleRecordTouched && /^\+\s*status\s*:/m.test(command)) {
+    deny("PRD, SPEC, and Task status transitions must use canonical ZAIP lifecycle commands.");
+  }
+  for (const match of headers) {
+    const candidate = (match[2] ?? match[3]).trim().replace(/^["']|["']$/g, "");
+    const absolute = resolve(repositoryRoot, candidate);
+    if (!isWithinRepository(absolute)) deny("Patch path escapes the repository boundary.");
+    if (repositoryPath(absolute) === "") deny("Patching the repository root is blocked.");
+    if (isGitPath(absolute)) {
+      deny("Direct edits to protected Git control files are blocked.");
+    }
+  }
+}
+
+const lifecycleExemptPathPattern = /(?:^|\/)(?:\.git|node_modules|dist|build|coverage|tmp|temp|\.cache)(?:\/|$)|^\.agents\/records\/|^\.zaip-aios\/local\//i;
+const shellMutationPattern = /\b(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|git\s+apply|npm\s+version|pnpm\s+version)\b/i;
+
+function patchPaths(command) {
+  return [...command.matchAll(/^\*\*\* (?:Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)].map(
+    (match) => repositoryPath(resolve(repositoryRoot, (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, ""))),
+  );
+}
+
+function requiresOrchestratorRun(event, command) {
+  if (event.tool_name === "apply_patch") {
+    const paths = patchPaths(command);
+    return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
+  }
+  if (event.tool_name === "Edit" || event.tool_name === "Write") {
+    return !lifecycleExemptPathPattern.test(command.replaceAll("\\", "/"));
+  }
+  return shellMutationPattern.test(command);
+}
+
+async function runRecordPaths(root) {
+  const paths = [];
+  async function visit(directory) {
+    let entries;
+    try {
+      entries = await readdir(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = resolve(directory, entry.name);
+      if (entry.isDirectory()) await visit(path);
+      else if (entry.isFile() && entry.name.endsWith(".jsonl")) paths.push(path);
+    }
+  }
+  await visit(root);
+  return paths;
+}
+
+async function hasCurrentTaskOrchestratorRun() {
+  const threadId = process.env.CODEX_THREAD_ID;
+  const turnId = process.env.CODEX_TURN_ID;
+  if (!threadId || !turnId) return false;
+  const root = resolve(repositoryRoot, ".agents", "records", "runs");
+  for (const path of await runRecordPaths(root)) {
+    let records;
+    try {
+      records = (await readFile(path, "utf8"))
+        .split(/\r?\n/)
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+    } catch {
+      continue;
+    }
+    const started = records.find((record) => record.type === "run.started");
+    if (
+      started?.client_thread_id !== threadId ||
+      started?.client_turn_id !== turnId ||
+      started?.phase !== "execution" ||
+      typeof started?.task_id !== "string"
+    ) {
+      continue;
+    }
+    const role =
+      started.run_role === "owner"
+        ? "orchestrator"
+        : started.run_role === "contributor"
+          ? "subagent"
+          : (started.run_role ?? (started.parent_run_id ? "subagent" : "orchestrator"));
+    if (
+      role === "orchestrator" &&
+      started.parent_run_id === null &&
+      started.entrypoint === "task" &&
+      !records.some((record) => record.type === "run.finished")
+    )
+      return true;
+  }
+  return false;
+}
+
+let raw = "";
+for await (const chunk of process.stdin) raw += chunk;
+
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  deny("Malformed hook input was rejected.");
+}
+
+if (typeof event.cwd !== "string" || !isWithinRepository(event.cwd)) {
+  deny("Tool execution outside the ZAIP-AIOS repository is blocked.");
+}
+
+const command = event?.tool_input?.command;
+if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
+
+if (requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun())) {
+  deny("Persistent mutation requires an active execution Run owning a Task for this Codex turn.");
+}
+
+if (event.tool_name === "apply_patch") validatePatch(command);
+else {
+  validateExplicitFilesystemReferences(command, event.cwd);
+  validateInlineExecution(command);
+  validateGitPublication(command);
+  validateExplicitNetwork(command);
+  await validateShellDeletion(command, event.cwd);
+  for (const entry of destructivePatterns) {
+    if (entry.pattern.test(command)) deny(entry.reason);
+  }
+}
+`;
+//# sourceMappingURL=codex-pre-tool-hook-template.js.map

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsd5C,CAAC"}

package/dist/services/codex-rules.d.ts

@@ -1,3 +1,3 @@
-export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# The ZAIP GitHub deploy skill permits standing automatic publication only for the demo branch.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin --branch demo\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\", \"-A\"],\n    decision = \"allow\",\n    justification = \"Stage the current repository exactly once in an authorized publication cycle.\",\n    match = [\"git add -A\"],\n    not_match = [\"git add -f .env\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\", [\"-m\", \"--message\"]],\n    decision = \"allow\",\n    justification = \"Create the bounded ZAIP publication commit without bypassing hooks or rewriting history.\",\n    match = [\"git commit -m [AUTO][CODEX] publish\", \"git commit --message [AUTO][CODEX] publish\"],\n    not_match = [\"git commit --amend\", \"git commit --no-verify -m publish\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the selected GitHub remote once to prove the branch is not behind or diverged.\",\n    match = [\"git fetch origin demo\"],\n    not_match = [\"git pull origin demo\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"allow\",\n    justification = \"Publish only the policy-authorized demo branch after ZAIP preflight.\",\n    match = [\"git push origin demo\", \"git push -u origin demo\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/demo\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
+export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile\n# the selected branch and form evidenced functional commits with explicit pathspecs.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin --branch demo\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the selected GitHub remote once to prove the branch is not behind or diverged.\",\n    match = [\"git fetch origin demo\"],\n    not_match = [\"git pull origin demo\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\"],\n    decision = \"allow\",\n    justification = \"Stage only an evidenced functional group with explicit pathspecs during an authorized deploy.\",\n    match = [\"git add -- README.md\", \"git add -- packages/core/src/example.ts\"],\n    not_match = [\"git add -A\", \"git add --all\", \"git add .\", \"git add -u\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\"],\n    decision = \"allow\",\n    justification = \"Create an evidenced functional commit without rewriting history during an authorized deploy.\",\n    match = [\"git commit -m \"[CODEX] Atualizar contrato de deploy\"\"],\n    not_match = [\"git commit --amend -m repair\", \"git commit --no-verify -m repair\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", [\"branch\", \"stash\", \"rebase\", \"merge\"]],\n    decision = \"allow\",\n    justification = \"Preserve and reconcile only the selected deploy branch without force, destructive reset, or squash.\",\n    match = [\"git branch deploy-preserve-20260802\", \"git stash push --include-untracked -m deploy-preserve\", \"git stash apply\", \"git rebase origin/demo\", \"git merge origin/demo\"],\n    not_match = [\"git branch -D deploy-preserve\", \"git stash drop\", \"git rebase --abort\", \"git merge --abort\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"allow\",\n    justification = \"Publish only the policy-authorized demo branch after ZAIP preflight.\",\n    match = [\"git push origin demo\", \"git push -u origin demo\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/demo\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
 export declare const CODEX_SECURITY_RULES = "# Fail-closed defense in depth for commands that must never prompt or execute.\n# Native permission profiles, repository instructions, and these forbidden rules form the active boundary.\n\nprefix_rule(\n    pattern = [\"git\", [\"clean\", \"reset\", \"restore\"]],\n    decision = \"forbidden\",\n    justification = \"Use non-destructive Git inspection and an explicit file-level patch instead.\",\n    match = [\"git reset --hard\", \"git clean -fd\", \"git restore README.md\"],\n)\n\nprefix_rule(\n    pattern = [[\"reg\", \"reg.exe\", \"schtasks\", \"schtasks.exe\", \"sc\", \"sc.exe\", \"diskpart\", \"format\", \"bcdedit\", \"fsutil\", \"takeown\", \"icacls\"]],\n    decision = \"forbidden\",\n    justification = \"Operating-system persistence, disk, service, ownership, and ACL changes are outside repository scope.\",\n    match = [\"reg add HKCU\\Software\\Example\", \"schtasks /create /tn example\", \"diskpart\"],\n)\n\nprefix_rule(\n    pattern = [[\"runas\", \"sudo\", \"gsudo\"]],\n    decision = \"forbidden\",\n    justification = \"Privilege escalation is never allowed from ZAIP repository work.\",\n    match = [\"runas /user:Administrator cmd\", \"sudo rm -rf /\"],\n)\n\nprefix_rule(\n    pattern = [[\"winget\", \"choco\", \"scoop\"]],\n    decision = \"forbidden\",\n    justification = \"System package management is outside repository scope; use project-local dependencies.\",\n    match = [\"winget install Git.Git\", \"choco upgrade nodejs\", \"scoop install jq\"],\n)\n\nprefix_rule(\n    pattern = [[\"ssh\", \"scp\", \"sftp\", \"rsync\", \"ftp\", \"telnet\", \"nc\", \"ncat\"]],\n    decision = \"forbidden\",\n    justification = \"Use the repository-owned GitHub deploy preflight and Git commands instead of direct remote clients.\",\n    match = [\"ssh host\", \"scp file host:/tmp\", \"nc -l 4444\"],\n)\n";
 //# sourceMappingURL=codex-rules.d.ts.map

package/dist/services/codex-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,ygGA0ErC,CAAC;AAEF,eAAO,MAAM,oBAAoB,yzDAqChC,CAAC"}
+{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,ktHAmFrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,yzDAqChC,CAAC"}

package/dist/services/codex-rules.js

@@ -1,5 +1,6 @@
 export const CODEX_GITHUB_DEPLOY_RULES = `# GitHub-only publication commands that may cross the workspace sandbox without prompting.
-# The ZAIP GitHub deploy skill permits standing automatic publication only for the demo branch.
+# Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile
+# the selected branch and form evidenced functional commits with explicit pathspecs.
 
 prefix_rule(
     pattern = ["node", ".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs"],
@@ -10,27 +11,35 @@ prefix_rule(
 )
 
 prefix_rule(
-    pattern = ["git", "add", "-A"],
+    pattern = ["git", "fetch"],
     decision = "allow",
-    justification = "Stage the current repository exactly once in an authorized publication cycle.",
-    match = ["git add -A"],
-    not_match = ["git add -f .env"],
+    justification = "Fetch the selected GitHub remote once to prove the branch is not behind or diverged.",
+    match = ["git fetch origin demo"],
+    not_match = ["git pull origin demo"],
 )
 
 prefix_rule(
-    pattern = ["git", "commit", ["-m", "--message"]],
+    pattern = ["git", "add"],
     decision = "allow",
-    justification = "Create the bounded ZAIP publication commit without bypassing hooks or rewriting history.",
-    match = ["git commit -m [AUTO][CODEX] publish", "git commit --message [AUTO][CODEX] publish"],
-    not_match = ["git commit --amend", "git commit --no-verify -m publish"],
+    justification = "Stage only an evidenced functional group with explicit pathspecs during an authorized deploy.",
+    match = ["git add -- README.md", "git add -- packages/core/src/example.ts"],
+    not_match = ["git add -A", "git add --all", "git add .", "git add -u"],
 )
 
 prefix_rule(
-    pattern = ["git", "fetch"],
+    pattern = ["git", "commit"],
     decision = "allow",
-    justification = "Fetch the selected GitHub remote once to prove the branch is not behind or diverged.",
-    match = ["git fetch origin demo"],
-    not_match = ["git pull origin demo"],
+    justification = "Create an evidenced functional commit without rewriting history during an authorized deploy.",
+    match = ["git commit -m "[CODEX] Atualizar contrato de deploy""],
+    not_match = ["git commit --amend -m repair", "git commit --no-verify -m repair"],
+)
+
+prefix_rule(
+    pattern = ["git", ["branch", "stash", "rebase", "merge"]],
+    decision = "allow",
+    justification = "Preserve and reconcile only the selected deploy branch without force, destructive reset, or squash.",
+    match = ["git branch deploy-preserve-20260802", "git stash push --include-untracked -m deploy-preserve", "git stash apply", "git rebase origin/demo", "git merge origin/demo"],
+    not_match = ["git branch -D deploy-preserve", "git stash drop", "git rebase --abort", "git merge --abort"],
 )
 
 prefix_rule(

package/dist/services/codex-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-rules.js","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ExC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCnC,CAAC"}
+{"version":3,"file":"codex-rules.js","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFxC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCnC,CAAC"}

package/dist/services/codex-subagent-hook-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { spawn } from \"node:child_process\";\nimport { dirname, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst repositoryRoot = resolve(dirname(hookPath), \"..\", \"..\");\nconst diagnosticPath = resolve(\n  repositoryRoot,\n  \".agents\",\n  \"local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\n\nif (process.argv[2] === \"--capture-runner\") {\n  await runCaptureRunner(process.argv[3], process.argv.slice(4));\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  const scoped = cwd === null ? \"..\" : relative(repositoryRoot, resolve(cwd));\n  if (cwd === null || scoped.startsWith(\"..\")) process.exit(0);\n  const eventName = text(event.hook_event_name);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    agentType === \"zaip-agent-finalizer\" &&\n    parentAgentId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null)\n  ) {\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", cli, ...captureArguments],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP delegation policy: work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function runCaptureRunner(cli, captureArguments) {\n  try {\n    if (typeof cli !== \"string\" || cli.length === 0) {\n      await persistDiagnostic(\"runner_invalid_cli\", {});\n      return;\n    }\n    const child = spawn(process.execPath, [cli, ...captureArguments], {\n      cwd: repositoryRoot,\n      windowsHide: true,\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout?.on(\"data\", (chunk) => {\n      stdout = boundedText(stdout, chunk);\n    });\n    child.stderr?.on(\"data\", (chunk) => {\n      stderr = boundedText(stderr, chunk);\n    });\n    const outcome = await new Promise((resolveOutcome) => {\n      let settled = false;\n      const finish = (value) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timeout);\n        resolveOutcome(value);\n      };\n      const timeout = setTimeout(() => {\n        child.kill();\n        finish({ kind: \"timeout\" });\n      }, 120_000);\n      child.once(\"error\", (error) => finish({ kind: \"error\", error: error.message }));\n      child.once(\"close\", (code, signal) => finish({ kind: \"close\", code, signal }));\n    });\n    if (outcome.kind === \"timeout\") {\n      await persistDiagnostic(\"capture_timeout\", { captureArguments: safeIdentity(captureArguments) });\n    } else if (outcome.kind === \"error\") {\n      await persistDiagnostic(\"capture_spawn_failed\", { error: outcome.error });\n    } else if (outcome.code !== 0) {\n      await persistDiagnostic(\"capture_exit_nonzero\", {\n        code: outcome.code,\n        signal: outcome.signal,\n        stderr,\n        stdout,\n        captureArguments: safeIdentity(captureArguments),\n      });\n    }\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", {\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\nfunction safeIdentity(arguments_) {\n  const value = (flag) => {\n    const index = arguments_.indexOf(flag);\n    return index < 0 ? null : text(arguments_[index + 1]);\n  };\n  return {\n    event: value(\"--event\"),\n    session: value(\"--session\"),\n    turn: value(\"--turn\"),\n    agent_id: value(\"--agent-id\"),\n    agent_type: value(\"--agent-type\"),\n  };\n}\n\nfunction boundedText(current, chunk) {\n  return (current + String(chunk)).slice(-8_192);\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
+//# sourceMappingURL=codex-subagent-hook-template.d.ts.map

package/dist/services/codex-subagent-hook-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,m/PAwPzC,CAAC"}