@zaip-ai/cli 4.1.0 → 4.3.0

package/dist/services/codex-pre-tool-hook-template.js

@@ -5,9 +5,12 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-
+import { captureCliTurn, checkDestructivePatterns, gitInvocation, inside, isLiteralReadSequence, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
 const execute = promisify(execFile);
-const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
+const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
+const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+let repositoryRoot = installedRoot;
 const deletionCommandPattern = /\b(?:Remove-Item|rm|rmdir|rd|del|erase)\b/i;
 const allowedExplicitNetworkHosts = new Set([
   "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "::1",
@@ -66,7 +69,7 @@ const destructivePatterns = [
     reason: "Remote, SSH, and credential configuration changes are blocked.",
   },
   {
-    pattern: /\bgh\b[\s\S]*\s--repo(?:=|\s)/i,
+    pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,
     reason: "GitHub CLI commands must target the current repository.",
   },
   {
@@ -94,13 +97,17 @@ const destructivePatterns = [
     reason: "OS persistence and service changes are blocked.",
   },
   {
-    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[\s;&|"'(])format(?:\.com)?\b|\bcipher\s+\/w\b/i,
+    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[;&|({\r\n])\s*(?:&\s*)?["']?format(?:\.(?:com|exe))?["']?(?=\s|$)|\bcipher\s+\/w\b/i,
     reason: "Disk, boot, ownership, and access-control changes are blocked.",
   },
   {
     pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
     reason: "Privilege escalation and persistent execution-policy changes are blocked.",
   },
+  {
+    pattern: /\b(?:Start-Process|saps)\b[^\r\n;|]*(?:[$(]|\b(?:-FilePath\s+)?['"]?git(?:\.exe)?['"]?(?:\s|$))/i,
+    reason: "Dynamic or indirect Git process launch is blocked; use a reviewed repository script.",
+  },
   {
     pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
     reason: "System-wide package changes are blocked.",
@@ -110,7 +117,7 @@ const destructivePatterns = [
     reason: "Non-loopback listeners are blocked.",
   },
   {
-    pattern: /\bgh\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:--method|-X)\s*(?:POST|PUT|PATCH|DELETE))\b/i,
+    pattern: /\bgh(?:\.exe)?\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:(?:--method|-X)(?:=|\s*)(?:POST|PUT|PATCH|DELETE)\b|(?:--field|--raw-field|--input)(?:=|\s+)|(?:^|\s)-[fF](?:=|\s+)))/i,
     reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
   },
   {
@@ -120,23 +127,21 @@ const destructivePatterns = [
 ];
 
 function deny(reason) {
+  activation?.recordActivation(repositoryRoot, event, "denied");
   writeSync(
     1,
     JSON.stringify({
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "deny",
-        permissionDecisionReason: "ZAIP safety policy: " + reason,
+        permissionDecisionReason: "ZAIP safety policy: " + reason + " [tool=" + String(event?.tool_name ?? "unknown").slice(0, 80) + "; session=" + String(event?.session_id ?? "missing").slice(0, 80) + "; turn=" + String(event?.turn_id ?? "missing").slice(0, 80) + "]",
       },
     }) + "\n",
   );
   process.exit(0);
 }
 
-function isWithinRepository(path) {
-  const candidate = relative(repositoryRoot, resolve(path));
-  return candidate === "" || (!candidate.startsWith("..") && !isAbsolute(candidate));
-}
+const isWithinRepository = path => inside(path, repositoryRoot);
 
 function repositoryPath(path) {
   return relative(repositoryRoot, resolve(path)).replaceAll("\\", "/");
@@ -168,56 +173,52 @@ function explicitPathCandidates(command) {
   }
   return [...candidates].map(unquote).filter(Boolean);
 }
-
-function validateExplicitFilesystemReferences(command, cwd) {
-  if (homeReferencePattern.test(command)) {
+function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
+  const checked = reviewedPaths.reduce((text, path) => text.replaceAll(path, "REVIEWED_RELEASE_PATH"), command);
+  if (homeReferencePattern.test(checked)) {
     deny("Direct user-profile path references are blocked; use repository-scoped paths.");
   }
-  if (credentialReferencePattern.test(command) || sensitiveEnvironmentPattern.test(command)) {
+  if (credentialReferencePattern.test(checked) || sensitiveEnvironmentPattern.test(checked)) {
     deny("Direct credential and secret access is blocked.");
   }
-  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(command) || /GetEnvironmentVariables\s*\(/i.test(command)) {
+  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
     deny("Bulk environment enumeration is blocked.");
   }
-  if (/\\\\[^\\\s"']+[\\/]/.test(command)) {
+  if (/(?:^|[\s"'=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(?:(?:\\\\){1,2}|\/\/)[^\\/\s"']+[\\/]/.test(checked)) {
     deny("UNC and network filesystem paths are blocked.");
   }
-  if (/(?:^|[\s"'=])\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:[\/\s"']|$)/i.test(command)) {
+  const osPathCommand = checked.replace(/^(node\s+\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs\s+subagent\s+capture-terminal\b[^;&|\x60\r\n]*?)--agent-id\s+\/root\/[a-z][a-z0-9_]*_zaip_agent(?:_[a-z0-9]+)?(?=\s|$)(?=[^;&|\x60\r\n]*$)/, "$1--agent-id zaip-agent");
+  if (/(?:^|[\s"'=])\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:[\/\s"']|$)/i.test(osPathCommand)) {
     deny("Explicit operating-system paths outside the repository are blocked.");
   }
-  for (const candidate of explicitPathCandidates(command)) {
+  if (process.platform === "win32" && /(?:^|[\s"'=(,])\\(?!\\)[^\s\\/"'<>|;]+(?:\\[^\s"'<>|;]+|\.[A-Za-z0-9]{1,10})/.test(checked)) {
+    deny("Drive-rooted filesystem paths outside the repository are blocked.");
+  }
+  for (const candidate of explicitPathCandidates(checked)) {
     if (process.platform !== "win32" && /^[A-Za-z]:[\\/]/.test(candidate)) deny("Explicit filesystem path escapes the repository boundary.");
     const absolute = resolve(cwd, candidate);
     if (!isWithinRepository(absolute)) {
-      deny("Explicit filesystem path escapes the repository boundary.");
+      deny("Explicit filesystem path escapes the repository boundary. Validated workspace: " + repositoryRoot + "; tool: " + event.tool_name + "; workdir override: " + (typeof event.tool_input?.workdir === "string"));
     }
   }
 }
-
-function validateInlineExecution(command) {
-  const inlinePatterns = [
-    /\b(?:node|deno)\s+(?:-e|--eval)\b/i,
-    /\b(?:python(?:3)?|ruby|perl|php)\s+(?:-c|-e)\b/i,
-    /\bdeno\s+eval\b/i,
-    /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]*\s-(?:Command|EncodedCommand|enc)\b/i,
-    /\bcmd(?:\.exe)?\s+\/c\b/i,
-    /\|\s*(?:node|deno|python(?:3)?|ruby|perl|php|powershell|pwsh|cmd)\b/i,
-    /\b(?:Invoke-Expression|iex)\b/i,
-  ];
-  if (inlinePatterns.some((pattern) => pattern.test(command))) {
-    deny("Inline or piped interpreter execution is blocked; use a reviewed repository script.");
-  }
-}
-
 async function validateGitPublication(command) {
+  if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
+      /&\s*\(\s*Get-Command\s+git(?:\.exe)?\b/i.test(command) ||
+      /(?:^|[\s;&|])&\s*\$[A-Za-z_]/i.test(command) || /\b(?:Set-Alias|New-Alias)\b[^\r\n;]*\bgit\b/i.test(command)) {
+    deny("Indirect Git execution is blocked; use a single literal command.");
+  }
+  if (/\(\s*git(?:\.exe)?\b/i.test(command)) {
+    deny("Nested Git execution is blocked; use a single literal command.");
+  }
   const tokens = tokenizeLiteralCommand(command);
   if (tokens === null) {
-    if (/(?:^|[;&|]\s*)git(?:\.exe)?\b/i.test(command)) {
+    if (/(?:^|[;&|\r\n(])\s*git(?:\.exe)?\b/i.test(command)) {
       deny("Git commands must be a single literal command; separate commands before requesting execution.");
     }
     return;
   }
-  const invocation = gitInvocation(tokens);
+  const invocation = gitInvocation(tokens, deny);
   if (invocation === null) return;
   const { subcommand, arguments: arguments_ } = invocation;
   if (subcommand === "commit" && arguments_.some((value) => /^(?:--amend|--no-verify|-n)/i.test(value))) {
@@ -331,39 +332,6 @@ function isSafeBranchName(branch) {
   return typeof branch === "string" && branch.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && !branch.endsWith(".") && !branch.endsWith("/") && !branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"));
 }
 
-function gitInvocation(tokens) {
-  if (tokens === null || !/^(?:git|git\.exe)$/i.test(tokens[0] ?? "")) return null;
-  let index = 1;
-  while (index < tokens.length && tokens[index].startsWith("-")) {
-    const rawOption = tokens[index];
-    const option = rawOption.toLowerCase();
-    if (option === "--version" || option === "--help") return null;
-    if (option === "--no-pager" || option === "--literal-pathspecs") {
-      index += 1;
-      continue;
-    }
-    if (
-      rawOption === "-c" ||
-      rawOption.startsWith("-c") ||
-      option.startsWith("--config") ||
-      option === "--git-dir" ||
-      option === "--work-tree" ||
-      option === "--namespace"
-    ) {
-      deny("Git global configuration and repository-routing overrides are blocked.");
-    }
-    if (rawOption === "-C" || rawOption.startsWith("-C")) {
-      const directory = rawOption === "-C" ? tokens[index + 1] : rawOption.slice(2);
-      if (directory !== ".") deny("Git working-directory overrides outside the repository root are blocked.");
-      index += rawOption === "-C" ? 2 : 1;
-      continue;
-    }
-    deny("Unknown Git global option is blocked.");
-  }
-  const subcommand = tokens[index]?.toLowerCase();
-  return subcommand === undefined ? null : { subcommand, arguments: tokens.slice(index + 1) };
-}
-
 function validateExplicitNetwork(command) {
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
     deny("Direct remote-shell and file-transfer clients are blocked.");
@@ -546,43 +514,6 @@ async function validateCloudRunner(command) {
   return true;
 }
 
-function tokenizeLiteralCommand(command) {
-  if (
-    command.includes("\r") ||
-    command.includes("\n") ||
-    command.includes(";") ||
-    command.includes("|") ||
-    command.includes("&") ||
-    command.includes(String.fromCharCode(96))
-  ) return null;
-
-  const tokens = [];
-  let token = "";
-  let quote = null;
-  let started = false;
-  for (const character of command) {
-    if (quote !== null) {
-      if (character === quote) quote = null;
-      else token += character;
-    } else if (character === "'" || character === '"') {
-      quote = character;
-      started = true;
-    } else if (/\s/.test(character)) {
-      if (started) {
-        tokens.push(token);
-        token = "";
-        started = false;
-      }
-    } else {
-      token += character;
-      started = true;
-    }
-  }
-  if (quote !== null) return null;
-  if (started) tokens.push(token);
-  return tokens;
-}
-
 function deletionTargets(command) {
   const tokens = tokenizeLiteralCommand(command);
   if (tokens === null || tokens.length < 2) return null;
@@ -652,7 +583,7 @@ async function validateShellDeletion(command, cwd) {
   for (const target of targets) await validateDeletionPath(target, cwd);
 }
 
-function validatePatch(command) {
+async function validatePatch(command) {
   const headers = [...command.matchAll(/^\*\*\* (Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)];
   const lifecycleRecordTouched = headers.some((match) => {
     const candidate = (match[2] ?? match[3]).trim().replace(/^["']|["']$/g, "");
@@ -665,28 +596,27 @@ function validatePatch(command) {
     const candidate = (match[2] ?? match[3]).trim().replace(/^["']|["']$/g, "");
     const absolute = resolve(repositoryRoot, candidate);
     if (!isWithinRepository(absolute)) deny("Patch path escapes the repository boundary.");
+    if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
     if (repositoryPath(absolute) === "") deny("Patching the repository root is blocked.");
     if (isGitPath(absolute)) {
       deny("Direct edits to protected Git control files are blocked.");
     }
   }
 }
-
-const lifecycleExemptPathPattern = /^(?:\.agents\/records|\.local)\//;
-const shellMutationPattern = /\b(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|git\s+apply|npm\s+version|pnpm\s+version)\b/i;
-
+const lifecycleExemptPathPattern = /^\.local\/(?!(?:codex-hook-|codex-telemetry-spool\/|runs\/))/;
 function patchPaths(command) {
   return [...command.matchAll(/^\*\*\* (?:Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)].map(
     (match) => repositoryPath(resolve(repositoryRoot, (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, ""))),
   );
 }
 
-function requiresOrchestratorRun(event, command) {
+async function requiresOrchestratorRun(event, command) {
   if (event.tool_name === "apply_patch") {
     const paths = patchPaths(command);
     return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
   }
   if (event.tool_name === "Edit" || event.tool_name === "Write") {
+    if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
     return !lifecycleExemptPathPattern.test(repositoryPath(resolve(event.cwd ?? repositoryRoot, command)));
   }
   // Only single literal writes claim exemptions; compound commands remain gated.
@@ -701,23 +631,25 @@ function requiresOrchestratorRun(event, command) {
     }
     if (valid && options.has("-literalpath") && options.has("-value")) {
       const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, options.get("-literalpath")));
+      if (!await nativeAuthority?.isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) deny("Shell write path traverses a link or could not be safely verified.");
       if (lifecycleExemptPathPattern.test(path)) return false;
     }
   }
-  return shellMutationPattern.test(command);
+  return requiresShellMutationRun(command, tokens, event.cwd ?? repositoryRoot, repositoryRoot);
 }
 
 async function boundedCanonicalText(path, maximumBytes) {
   const info = await lstat(path);
   if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) throw new Error("Unsafe Run lookup file");
   const physical = await realpath(path);
-  if (!isWithinRepository(physical) || physical.toLowerCase() !== resolve(path).toLowerCase()) throw new Error("Run lookup must not follow links");
+  const identity = value => process.platform === "win32" ? value.toLowerCase() : value;
+  if (!isWithinRepository(physical) || identity(physical) !== identity(resolve(path))) throw new Error("Run lookup must not follow links");
   return readFile(path, "utf8");
 }
 
 async function hasCurrentTaskOrchestratorRun(event) {
-  const threadId = event.session_id ?? process.env.CODEX_THREAD_ID;
-  const turnId = event.turn_id ?? process.env.CODEX_TURN_ID;
+  const threadId = event.session_id;
+  const turnId = event.turn_id;
   if (typeof threadId !== "string" || typeof turnId !== "string" || !threadId || !turnId) return false;
   if ((event.session_id && process.env.CODEX_THREAD_ID && event.session_id !== process.env.CODEX_THREAD_ID) ||
       (event.turn_id && process.env.CODEX_TURN_ID && event.turn_id !== process.env.CODEX_TURN_ID)) return false;
@@ -726,7 +658,7 @@ async function hasCurrentTaskOrchestratorRun(event) {
     const digest = createHash("sha256").update(JSON.stringify(["codex", threadId, turnId, null, null])).digest("hex");
     const correlation = JSON.parse(await boundedCanonicalText(resolve(repositoryRoot, ".local/codex-telemetry-spool/v1/correlations", digest + ".json"), 65536));
     const id = correlation.run_id;
-    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{4}$/.exec(id) : null;
+    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id) : null;
     if (!dated || correlation.schema_version !== 1 || correlation.thread_id !== threadId || correlation.turn_id !== turnId || correlation.agent_path !== null) return false;
     const candidates = [
       ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
@@ -766,11 +698,13 @@ try {
   deny("Malformed hook input was rejected.");
 }
 
-if (typeof event.cwd !== "string" || !isWithinRepository(event.cwd)) {
+const toolInput = event?.tool_input;
+try { const scope = await selectHookExecutionWorkspace(installedRoot, event); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
+catch (error) { deny(error.message); }
+if (!isWithinRepository(event.cwd)) {
   deny("Tool execution outside the ZAIP-AIOS repository is blocked.");
 }
 
-const toolInput = event?.tool_input;
 const commandFromCmd = toolInput?.cmd;
 const commandFromCommand = toolInput?.command;
 if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string" && commandFromCmd !== commandFromCommand) {
@@ -779,22 +713,30 @@ if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string"
 const command = typeof commandFromCmd === "string" ? commandFromCmd : commandFromCommand;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
 
-if (requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun(event))) {
+if (await requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun(event)) &&
+    !(await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, boundedCanonicalText))) {
   deny("Persistent mutation requires the exact active Task Run and its verified thread/turn correlation. Capture or reconcile this turn before retrying; no global Task fallback is allowed.");
 }
 
-if (event.tool_name === "apply_patch") validatePatch(command);
+if (event.tool_name === "apply_patch") await validatePatch(command);
 else {
-  validateExplicitFilesystemReferences(command, event.cwd);
-  validateInlineExecution(command);
+  const reviewedPaths = [
+    ...await reviewedReleasePaths(command, event.cwd, repositoryRoot, credentialReferencePattern, deny),
+    ...await reviewedContextReadPaths(command, credentialReferencePattern), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand) ?? []),
+  ];
+  validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
+  validateInlineExecution(command, deny);
+  if (!isLiteralReadSequence(command)) {
   await validateGitPublication(command);
   await validateCloudRunner(command);
   validateDirectCloudProviderMutation(command);
   validateExplicitNetwork(command);
   await validateShellDeletion(command, event.cwd);
-  for (const entry of destructivePatterns) {
-    if (entry.pattern.test(command)) deny(entry.reason);
+  checkDestructivePatterns(command, destructivePatterns, deny);
   }
+  try { const updated = await captureCliTurn(repositoryRoot, event, command); if (updated) writeSync(1, JSON.stringify(rewriteCliInput(toolInput, updated, commandFromCmd)) + "\n"); }
+  catch (error) { deny(error.message); }
 }
+activation?.recordActivation(repositoryRoot, event, "allowed");
 `;
 //# sourceMappingURL=codex-pre-tool-hook-template.js.map

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8xB5C,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAouB5C,CAAC"}