@zaip-ai/cli 4.1.0 → 4.3.0

package/dist/services/codex-pre-tool-support-template.js

@@ -0,0 +1,401 @@
+export const CODEX_PRE_TOOL_SUPPORT_HOOK = String.raw `import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { link, lstat, mkdir, readFile, realpath, unlink, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, toNamespacedPath } from "node:path";
+import { homedir } from "node:os";
+import { promisify } from "node:util";
+
+const execute = promisify(execFile);
+const pathIdentity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
+export const inside = (path, root) => {
+  const scoped = relative(root, resolve(path));
+  return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped));
+};
+
+export async function selectHookRepositoryRoot(installedRoot, cwd) {
+  if (typeof cwd !== "string") throw new Error("Tool execution without a workspace is blocked.");
+  const physicalCwd = await realpath(cwd).catch(() => null);
+  if (!physicalCwd || pathIdentity(physicalCwd) !== pathIdentity(cwd)) {
+    throw new Error("Tool workspace could not be safely resolved.");
+  }
+  if (resolve(cwd).toLowerCase() === installedRoot.toLowerCase()) return installedRoot;
+  if (inside(cwd, installedRoot)) {
+    let cursor = resolve(cwd);
+    while (cursor.toLowerCase() !== installedRoot.toLowerCase() &&
+      !(await lstat(resolve(cursor, ".git")).catch(() => null))) cursor = dirname(cursor);
+    if (cursor.toLowerCase() === installedRoot.toLowerCase()) return installedRoot;
+  }
+  try {
+    const git = async (path, ...args) => (await execute("git", ["-C", path, ...args], {
+      encoding: "utf8", windowsHide: true, timeout: 5000, maxBuffer: 1048576,
+    })).stdout.trim();
+    const primary = await git(installedRoot, "rev-parse", "--show-toplevel");
+    if ((await realpath(primary)).toLowerCase() !== installedRoot.toLowerCase()) throw new Error("primary_not_root");
+    const worktrees = await git(installedRoot, "worktree", "list", "--porcelain", "-z");
+    const registered = worktrees.split("\0").filter(line => line.startsWith("worktree ")).map(line => line.slice(9));
+    const candidate = await realpath(await git(cwd, "rev-parse", "--show-toplevel"));
+    if (!registered.some(path => resolve(path).toLowerCase() === candidate.toLowerCase()) || !inside(cwd, candidate)) {
+      throw new Error("worktree_not_registered");
+    }
+    const common = async path => (await realpath(await git(path, "rev-parse", "--path-format=absolute", "--git-common-dir"))).toLowerCase();
+    if (await common(installedRoot) !== await common(candidate)) throw new Error("common_git_dir_mismatch");
+    return candidate;
+  } catch {
+    throw new Error("Tool workspace could not be verified as a registered worktree.");
+  }
+}
+
+export async function selectHookExecutionWorkspace(installedRoot, event) {
+  // Codex normalizes shell tools to Bash; preserve the host-supplied literal workdir.
+  await selectHookRepositoryRoot(installedRoot, event.cwd);
+  const workdir = ["exec_command", "shell_command", "Bash"].includes(event.tool_name) ? event.tool_input?.workdir : undefined;
+  if (workdir !== undefined && (typeof workdir !== "string" || !isAbsolute(workdir)))
+    throw new Error("Tool workdir must be an absolute literal workspace.");
+  const cwd = workdir ?? event.cwd;
+  return { cwd, repositoryRoot: await selectHookRepositoryRoot(installedRoot, cwd) };
+}
+
+export function tokenizeLiteralCommand(command) {
+  if (command.includes("\r") || command.includes("\n")) return null;
+  const tokens = [];
+  let token = "", quote = null, started = false;
+  for (let index = 0; index < command.length; index++) {
+    const character = command[index];
+    if (quote !== null) {
+      if (quote === '"' && (character === "$" || character === String.fromCharCode(96))) return null;
+      if (quote === "'" && character === "'" && command[index + 1] === "'" && process.platform === "win32") {
+        token += "'"; index++; continue;
+      }
+      if (process.platform !== "win32" && quote === '"' && character === "\\") return null;
+      if (character === quote) quote = null;
+      else token += character;
+    } else if (character === "'" || character === '"') {
+      quote = character;
+      started = true;
+    } else if (/\s/.test(character)) {
+      if (started) { tokens.push(token); token = ""; started = false; }
+    } else {
+      if (";|&<>(){}$%".includes(character) || character === String.fromCharCode(96)) return null;
+      token += character;
+      started = true;
+    }
+  }
+  if (quote !== null) return null;
+  if (started) tokens.push(token);
+  return tokens;
+}
+
+export function shellSyntax(command) {
+  let quote = null, interpolation = false, redirection = false, grouping = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (quote === "'") {
+      if (character === "'" && command[index + 1] === "'") index += 1;
+      else if (character === "'") quote = null;
+      continue;
+    }
+    if (character === "'" && quote === null) { quote = "'"; continue; }
+    if (character === '"') { quote = quote === '"' ? null : '"'; continue; }
+    if (character === "$" && command[index + 1] === "(") interpolation = true;
+    if (character === String.fromCharCode(96)) interpolation = true;
+    if (character === ">" && quote === null) redirection = true;
+    if (quote === null && /[(){}]/.test(character)) grouping = true;
+  }
+  return { interpolation, redirection, grouping };
+}
+
+const shellMutationPattern = /\b(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|sc|ac|ni|cp|mv|mi|ri|tee|sed\b[^\r\n;|]*(?:\s-[A-Za-z]*i[^\s;|]*|--in-place(?:=[^\s;|]*)?)(?=\s|$)|git\s+apply|npm\s+version|pnpm\s+version)\b/i;
+
+export function requiresShellMutationRun(command, tokens, cwd, repositoryRoot) {
+  const syntax = shellSyntax(command);
+  if (!syntax.interpolation && !syntax.redirection && !syntax.grouping && isLiteralReadSequence(command)) return false;
+  const executable = tokens?.[0] ?? "";
+  const canonicalCli = /^(?:node|node\.exe)$/i.test(executable) && tokens?.[1] &&
+    resolve(cwd, tokens[1]).toLowerCase() === resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs").toLowerCase();
+  const dataCommand = canonicalCli || /^(?:Write-Output|echo|printf)$/i.test(executable);
+  if (tokens && !syntax.interpolation && !syntax.grouping && dataCommand) {
+    return syntax.redirection;
+  }
+  // Unknown executables, wrappers and assignments retain the original gate.
+  return (tokens && isSedMutation(tokens)) || shellMutationPattern.test(command) || syntax.redirection;
+}
+
+// Recognize only literal read-only pipelines/sequences. Quoted search text is data,
+// not a PowerShell alias (for example the AC prefix in acceptance-criterion IDs).
+export function isLiteralReadSequence(command) {
+  const parts = [];
+  let start = 0, quote = null;
+  for (let index = 0; index < command.length; index++) {
+    const char = command[index];
+    if (quote !== null) {
+      if (char === quote) {
+        if (quote === "'" && command[index + 1] === "'" && process.platform === "win32") index++;
+        else quote = null;
+      }
+    } else if (char === "'" || char === '"') quote = char;
+    else if (char === ";" || char === "|") { parts.push(command.slice(start, index)); start = index + 1; }
+  }
+  if (quote !== null) return false;
+  parts.push(command.slice(start));
+  return parts.every(part => {
+    const values = tokenizeLiteralCommand(part);
+    if (!values?.length) return false;
+    if (/^(?:Get-Content|Measure-Object)$/i.test(values[0])) return true;
+    if (!/^(?:rg|rg\.exe)$/i.test(values[0])) return false;
+    return !values.slice(1).some(value => /^--(?:pre|hostname-bin)(?:=|$)/i.test(value));
+  });
+}
+
+function isSedMutation(tokens) {
+  const executable = ((tokens[0] ?? "").split(/[\\/]/).pop() ?? "").replace(/\.(?:exe|cmd|bat)$/i, "");
+  return /^sed$/i.test(executable) && tokens.slice(1).some((token) =>
+    /^-[A-Za-z]*i/i.test(token) || /^--in-place(?:=|$)/i.test(token) ||
+    /^(?:-f|--file)(?:=|$)/i.test(token) || /(?:^|[;\/#@])w(?:\s+\S|[^\s\/;#@]+\/)/.test(token));
+}
+
+export function gitInvocation(tokens, deny) {
+  if (tokens === null || !/^(?:git|git\.exe)$/i.test(tokens[0] ?? "")) return null;
+  let index = 1;
+  while (index < tokens.length && tokens[index].startsWith("-")) {
+    const rawOption = tokens[index];
+    const option = rawOption.toLowerCase();
+    if (option === "--version" || option === "--help") return null;
+    if (option === "--no-pager" || option === "--literal-pathspecs") { index += 1; continue; }
+    if (rawOption === "-c" || rawOption.startsWith("-c") || option.startsWith("--config") ||
+        option === "--git-dir" || option === "--work-tree" || option === "--namespace") {
+      deny("Git global configuration and repository-routing overrides are blocked.");
+    }
+    if (rawOption === "-C" || rawOption.startsWith("-C")) {
+      const directory = rawOption === "-C" ? tokens[index + 1] : rawOption.slice(2);
+      if (directory !== ".") deny("Git working-directory overrides outside the repository root are blocked.");
+      index += rawOption === "-C" ? 2 : 1;
+      continue;
+    }
+    deny("Unknown Git global option is blocked.");
+  }
+  const subcommand = tokens[index]?.toLowerCase();
+  return subcommand === undefined ? null : { subcommand, arguments: tokens.slice(index + 1) };
+}
+
+export function checkDestructivePatterns(command, patterns, deny) {
+  if (/^(?:Write-Output|echo|printf)\s+'(?:[^']|'')*'\s*$/i.test(command)) return;
+  for (const entry of patterns) if (entry.pattern.test(command)) deny(entry.reason);
+}
+
+export async function reviewedReleasePaths(command, cwd, repositoryRoot, credentialReferencePattern, deny) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || tokens[0] !== "node" || ![
+    "scripts/local-release-preparation.mjs", "scripts/local-release-deploy.mjs",
+  ].includes(tokens[1])) return [];
+  if (resolve(cwd) !== repositoryRoot) return [];
+  const helper = resolve(repositoryRoot, tokens[1]);
+  try {
+    const info = await lstat(helper);
+    if (!info.isFile() || info.isSymbolicLink() || resolve(await realpath(helper)) !== helper) return [];
+  } catch { return []; }
+  const preparation = tokens[1] === "scripts/local-release-preparation.mjs";
+  const mode = preparation ? tokens[2] : "deploy";
+  const start = preparation && ["prepare", "verify"].includes(mode) ? 3 : !preparation ? 2 : -1;
+  if (start < 0) return [];
+  const values = new Map();
+  const switches = new Set(["--initial", "--dry-run", "--offline-dry-run", "--draft-only"]);
+  const allowed = new Set(mode === "verify"
+    ? ["--repository", "--expected-repository", "--receipt", "--tarball", "--policy", "--trust-store", "--sha", "--tree-sha256", "--channel", "--version", "--profile"]
+    : mode === "prepare"
+      ? ["--repository", "--expected-repository", "--sha", "--output-dir", "--policy", "--key-id", "--private-key", "--trust-store", "--channel", "--version", "--expires-at", "--profile"]
+      : ["--repository", "--expected-repository", "--branch", "--output-dir", "--policy", "--private-key", "--trust-store", "--key-id", "--sha", "--channel", "--version", "--expires-at", "--profile", "--notes-file", "--inventory-file", "--from", ...switches]);
+  for (let i = start; i < tokens.length; i += 1) {
+    const flag = tokens[i];
+    if (!allowed.has(flag) || values.has(flag)) return [];
+    if (switches.has(flag)) values.set(flag, true);
+    else {
+      const value = tokens[++i];
+      if (!value || value.startsWith("--")) return [];
+      values.set(flag, value);
+    }
+  }
+  const required = mode === "verify"
+    ? ["--repository", "--expected-repository", "--receipt", "--tarball", "--policy", "--trust-store", "--sha", "--tree-sha256", "--channel", "--version"]
+    : mode === "prepare"
+      ? ["--repository", "--expected-repository", "--sha", "--output-dir", "--policy", "--key-id", "--channel", "--version", "--expires-at"]
+      : ["--repository", "--expected-repository", "--branch", "--output-dir", "--policy", "--key-id", "--sha", "--channel", "--version", "--expires-at", "--notes-file", "--inventory-file"];
+  if (required.some(flag => !values.has(flag)) || values.get("--expected-repository") !== "zaip-ai/zaip-aios" ||
+      !/^[a-f0-9]{40}$/i.test(values.get("--sha")) ||
+      (mode === "verify" && !/^[a-f0-9]{64}$/i.test(values.get("--tree-sha256"))) ||
+      !["beta", "latest"].includes(values.get("--channel")) ||
+      !/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(values.get("--version")) ||
+      (values.has("--profile") && !["essential", "full"].includes(values.get("--profile"))) ||
+      (mode !== "verify" && (
+        !/^[a-z0-9][a-z0-9._-]{0,63}$/i.test(values.get("--key-id")) ||
+        !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(values.get("--expires-at")))) ||
+      (mode === "deploy" && (values.get("--branch") !== "main" ||
+        (values.has("--from") && !/^v\d+\.\d+$/.test(values.get("--from"))) ||
+        (values.has("--offline-dry-run") && !values.has("--dry-run")) ||
+        (values.has("--from") === values.has("--initial"))))) return [];
+  const repository = values.get("--repository");
+  if (!isAbsolute(repository) && repository !== ".") return [];
+  const releaseRoot = resolve(cwd, repository);
+  // The host may expose only Bash/chat cwd. This exact reviewed helper targets its explicit repository internally.
+  if (releaseRoot !== repositoryRoot) {
+    try { if (await selectHookRepositoryRoot(repositoryRoot, releaseRoot) !== releaseRoot) return []; }
+    catch { return []; }
+  }
+  const keyRoot = resolve(homedir(), ".codex/release-keys/zaip-aios");
+  const candidateRoot = resolve(homedir(), ".codex/release-candidates/zaip-aios");
+  const profile = values.get("--profile") ?? "essential";
+  const candidateName = new RegExp("^v" + values.get("--version").replace(".", "\\.") + "-" + profile + "-" + values.get("--sha").slice(0, 8) + "-[0-9]{8}$", "i");
+  const external = releaseRoot !== repositoryRoot ? [repository] : [];
+  let selectedCandidate = null;
+  let selectedKey = values.get("--key-id") ?? null;
+  for (const flag of ["--receipt", "--tarball", "--policy", "--trust-store", "--private-key", "--output-dir", "--notes-file", "--inventory-file"]) {
+    const value = values.get(flag);
+    if (!value) continue;
+    if ((!isAbsolute(value) && !inside(resolve(cwd, value), repositoryRoot)) ||
+        /[\x00-\x1f*?{}\[\]$%<>]/.test(value) || value.split(/[\\/]/).includes("..")) return [];
+    const path = resolve(cwd, value);
+    let parent = path;
+    while (parent !== dirname(parent)) {
+      try { if ((await lstat(parent)).isSymbolicLink()) deny("Reviewed release paths must not traverse links."); }
+      catch (error) { if (error?.code !== "ENOENT") deny("Reviewed release paths could not be safely resolved."); }
+      parent = dirname(parent);
+    }
+    if (inside(path, repositoryRoot) || inside(path, releaseRoot)) deny("Reviewed release artifacts and credentials must stay outside the repository.");
+    if (path !== (process.platform === "win32" ? value.replaceAll("/", "\\") : value)) return [];
+    if (flag !== "--private-key" && credentialReferencePattern.test(value)) return [];
+    const keyRelative = relative(keyRoot, path).replaceAll("\\", "/");
+    const keyMatch = /^([a-z0-9][a-z0-9._-]{0,63})\/(.+)$/i.exec(keyRelative);
+    const keyId = keyMatch?.[1];
+    const keyFile = keyMatch?.[2];
+    const keyPath = flag === "--trust-store" && keyFile === "trust" ||
+      flag === "--private-key" && keyFile === "release-private.pem" ||
+      flag === "--policy" && keyFile === "policy-v" + values.get("--version") + "-" + profile + ".json";
+    if (keyPath) {
+      if (!keyId || selectedKey && selectedKey !== keyId) return [];
+      selectedKey = keyId;
+    }
+    const candidateRelative = relative(candidateRoot, path).replaceAll("\\", "/");
+    const candidateParts = candidateRelative.split("/");
+    const candidate = candidateParts[0];
+    const candidatePath = candidateName.test(candidate) &&
+      (flag === "--output-dir" && candidateParts.length === 1 ||
+       flag !== "--output-dir" && candidateParts.length === 2 && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(candidateParts[1]));
+    if (candidatePath) {
+      if (selectedCandidate && selectedCandidate !== candidate) return [];
+      selectedCandidate = candidate;
+    }
+    if (!keyPath && !candidatePath) return [];
+    if (["--receipt", "--tarball", "--output-dir", "--notes-file", "--inventory-file"].includes(flag) && !candidatePath ||
+        ["--trust-store", "--private-key", "--policy"].includes(flag) && !keyPath) return [];
+    if (flag === "--receipt" && !path.endsWith("local-release-receipt.json") ||
+        flag === "--tarball" && !path.endsWith(".tgz") ||
+        flag === "--policy" && !path.endsWith(".json") ||
+        flag === "--notes-file" && !path.endsWith(".md") ||
+        flag === "--inventory-file" && !path.endsWith(".json")) return [];
+    external.push(value);
+  }
+  return external;
+}
+
+/** Narrow read capability, never a general external-path or executable allowlist. */
+export async function reviewedContextReadPaths(command, credentialPattern) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || tokens.length < 2 || credentialPattern.test(command)) return [];
+  const executable = tokens[0].toLowerCase();
+  if (!["get-content", "rg", "rg.exe"].includes(executable)) return [];
+  const flags = executable === "get-content"
+    ? new Set(["-literalpath", "-path", "-raw", "-totalcount", "-tail", "-encoding"])
+    : new Set(["-n", "--line-number", "-i", "--ignore-case", "-f", "--fixed-strings", "-e", "--regexp", "-m", "--max-count", "--"]);
+  // -f means a pattern file in ripgrep, not fixed strings: do not permit it.
+  if (tokens.slice(1).some(token => token.startsWith("-") && (!flags.has(token.toLowerCase()) || token === "-f"))) return [];
+  const roots = ["memories", "skills", "plugins/cache"].map(part => resolve(homedir(), ".codex", part));
+  const paths = tokens.slice(1).filter(value => isAbsolute(value));
+  if (!paths.length) return [];
+  for (const path of paths) {
+    if (!roots.some(root => inside(path, root)) || !/\.(?:md|txt|json|yaml|yml|toml)$/i.test(path)) return [];
+    try {
+      const info = await lstat(path);
+      if (!info.isFile() || info.isSymbolicLink() || pathIdentity(await realpath(path)) !== pathIdentity(path)) return [];
+    } catch { return []; }
+  }
+  return paths;
+}
+
+export async function captureCliTurn(repositoryRoot, event, command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || tokens.length < 4 || !/^(?:node|node\.exe)$/i.test(tokens[0])) return;
+  const script = resolve(event.cwd, tokens[1]);
+  if (script.toLowerCase() !== resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs").toLowerCase()) return;
+  if (!((tokens[2] === "conversation" || tokens[2] === "run") && tokens[3] === "start")) return;
+  if (tokens.includes("--help") || tokens.includes("-h")) return;
+  if (tokens.some(token => token.startsWith("--codex-hook-"))) throw new Error("Codex hook identity cannot be supplied by the caller.");
+  const threadId = event.session_id, turnId = event.turn_id, toolUseId = event.tool_use_id;
+  if (typeof threadId !== "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(threadId) ||
+      typeof turnId !== "string" || !turnId || turnId.length > 256 ||
+      typeof toolUseId !== "string" || !toolUseId || toolUseId.length > 256 ||
+      (process.env.CODEX_THREAD_ID && process.env.CODEX_THREAD_ID !== threadId) ||
+      (process.env.CODEX_TURN_ID && process.env.CODEX_TURN_ID !== turnId)) {
+    throw new Error("Codex thread, turn and tool identity could not be captured for the ZAIP CLI.");
+  }
+  const directory = resolve(repositoryRoot, ".local/codex-hook-turn/v1");
+  const argvSha256 = createHash("sha256").update(JSON.stringify(tokens.slice(2))).digest("hex");
+  const digest = createHash("sha256").update(JSON.stringify([threadId, toolUseId])).digest("hex");
+  const target = resolve(directory, digest + ".json");
+  const temporary = resolve(directory, digest + "." + randomUUID() + ".tmp");
+  try {
+    let parent = repositoryRoot;
+    for (const part of [".local", "codex-hook-turn", "v1"]) {
+      parent = resolve(parent, part);
+      try { await mkdir(parent); } catch (error) { if (error?.code !== "EEXIST") throw error; }
+      const info = await lstat(parent), physical = await realpath(parent);
+      if (!info.isDirectory() || info.isSymbolicLink() || !inside(physical, repositoryRoot)) throw new Error("Unsafe turn receipt directory");
+    }
+    const value = {
+      schema_version: 1, thread_id: threadId, turn_id: turnId,
+      tool_use_sha256: digest, argv_sha256: argvSha256, observed_at_ms: Date.now(),
+    };
+    await writeFile(temporary, JSON.stringify(value) + "\n", { flag: "wx", mode: 0o600 });
+    try { await link(temporary, target); }
+    catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const info = await lstat(target);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > 4096 ||
+          pathIdentity(await realpath(target)) !== pathIdentity(target)) throw new Error("Unsafe existing turn receipt");
+      const prior = JSON.parse(await readFile(target, "utf8"));
+      for (const key of ["schema_version", "thread_id", "turn_id", "tool_use_sha256", "argv_sha256"])
+        if (prior[key] !== value[key]) throw new Error("Conflicting existing turn receipt");
+      if (!Number.isSafeInteger(prior.observed_at_ms) || prior.observed_at_ms > Date.now()) throw new Error("Invalid turn receipt time");
+    }
+  } catch {
+    throw new Error("Codex turn identity could not be persisted for the ZAIP CLI.");
+  } finally { await unlink(temporary).catch(() => {}); }
+  return command + " --codex-hook-id=" + digest + " --codex-hook-thread=" + threadId;
+}
+
+export function validateInlineExecution(command, deny) {
+  if (shellSyntax(command).interpolation) {
+    deny("Nested shell execution is blocked; use a reviewed repository script.");
+  }
+  if (/(?:^|[;&|\r\n])\s*&\s*\(/.test(command)) deny("Dynamic shell invocation is blocked; use a literal command.");
+  const inlinePatterns = [
+    /\b(?:node|deno)\s+(?:-e|--eval)\b/i,
+    /\b(?:python(?:3)?|ruby|perl|php)\s+(?:-c|-e)\b/i,
+    /\bdeno\s+eval\b/i,
+    /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]*\s-(?:Command|EncodedCommand|enc)\b/i,
+    /\bcmd(?:\.exe)?\s+\/c\b/i,
+    /\b(?:bash|sh|zsh|dash|fish)(?:\.exe)?\b[^\r\n;|]*\s-[A-Za-z]*c(?=\s|$)/i,
+    /\|\s*(?:node|deno|python(?:3)?|ruby|perl|php|powershell|pwsh|cmd)\b/i,
+    /\b(?:Invoke-Expression|iex)\b/i,
+  ];
+  if (inlinePatterns.some((pattern) => pattern.test(command))) {
+    deny("Inline or piped interpreter execution is blocked; use a reviewed repository script.");
+  }
+}
+
+export function rewriteCliInput(toolInput, command, commandFromCmd) {
+  return { hookSpecificOutput: {
+    hookEventName: "PreToolUse", permissionDecision: "allow",
+    updatedInput: { ...toolInput, command, ...(commandFromCmd === undefined ? {} : { cmd: command }) },
+  } };
+}
+`;
+//# sourceMappingURL=codex-pre-tool-support-template.js.map

package/dist/services/codex-pre-tool-support-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+YpD,CAAC"}

package/dist/services/codex-subagent-hook-template.d.ts

@@ -1,2 +1,2 @@
-export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst repositoryRoot = resolve(dirname(hookPath), \"..\", \"..\");\nconst diagnosticPath = resolve(\n  repositoryRoot,\n  \".agents\",\n  \"local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nconst pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nif (process.argv[2] === \"--capture-runner\") {\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  const files = await fs.readdir(pendingRoot).catch(() => []);\n  let replayed = 0;\n  for (const file of files.filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).slice(0, 256)) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state === \"pending\" && Array.isArray(receipt.capture_arguments)) { await runCaptureRunner(path, true); if (++replayed >= 3) break; }\n  }\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  const scoped = cwd === null ? \"..\" : relative(repositoryRoot, resolve(cwd));\n  if (cwd === null || scoped.startsWith(\"..\")) process.exit(0);\n  const eventName = text(event.hook_event_name);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n  for (let retry = 0; ; retry++) {\n    try { await fs.rename(temporary, path); break; }\n    catch (error) { if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= 5) throw error; await new Promise(done => setTimeout(done, 20 * (retry + 1))); }\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return;\n    try { process.kill(owner.pid, 0); return; } catch (failure) { if (failure.code !== \"ESRCH\") return; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return;\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return;\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n      const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
+export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const files = await fs.readdir(pendingRoot).catch(() => []);\n  let replayed = 0;\n  for (const file of files.filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).slice(0, 256)) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state === \"pending\" && Array.isArray(receipt.capture_arguments)) { await runCaptureRunner(path, true); if (++replayed >= 3) break; }\n  }\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  if (cwd === null || !selectRoot(cwd)) process.exit(0);\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n  for (let retry = 0; ; retry++) {\n    try { await fs.rename(temporary, path); break; }\n    catch (error) { if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= 5) throw error; await new Promise(done => setTimeout(done, 20 * (retry + 1))); }\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return;\n    try { process.kill(owner.pid, 0); return; } catch (failure) { if (failure.code !== \"ESRCH\") return; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return;\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return;\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n      const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
 //# sourceMappingURL=codex-subagent-hook-template.d.ts.map

package/dist/services/codex-subagent-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,2ybAiTzC,CAAC"}
+{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,80fAqVzC,CAAC"}

package/dist/services/codex-subagent-hook-template.js

@@ -1,26 +1,62 @@
-export const CODEX_SUBAGENT_LIFECYCLE_HOOK = `import { existsSync } from "node:fs";
+export const CODEX_SUBAGENT_LIFECYCLE_HOOK = `import { existsSync, realpathSync } from "node:fs";
 import { promises as fs } from "node:fs";
-import { spawn } from "node:child_process";
+import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { dirname, relative, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const hookPath = fileURLToPath(import.meta.url);
-const repositoryRoot = resolve(dirname(hookPath), "..", "..");
-const diagnosticPath = resolve(
+const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
+const installedRoot = resolve(dirname(hookPath), "..", "..");
+let repositoryRoot = installedRoot;
+let diagnosticPath = resolve(
   repositoryRoot,
-  ".agents",
-  "local",
+  ".local",
   "hooks",
   "subagent-lifecycle.ndjson",
 );
-const pendingRoot = resolve(repositoryRoot, ".local", "hooks", "subagent-pending");
+let pendingRoot = resolve(repositoryRoot, ".local", "hooks", "subagent-pending");
+
+function inside(path, root) {
+  const scoped = relative(root, resolve(path));
+  return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped));
+}
+function selectRoot(cwd) {
+  if (typeof cwd !== "string") return false;
+  try {
+    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;
+    let nestedGit = false;
+    if (inside(cwd, installedRoot)) {
+      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {
+        if (existsSync(resolve(cursor, ".git"))) { nestedGit = true; break; }
+      }
+    }
+    if (!inside(cwd, installedRoot) || nestedGit) {
+      const git = (root, ...args) => execFileSync("git", ["-C", root, ...args], {
+        encoding: "utf8", windowsHide: true, timeout: 5000,
+      }).trim();
+      if (realpathSync(git(installedRoot, "rev-parse", "--show-toplevel")).toLowerCase() !== installedRoot.toLowerCase()) return false;
+      const registered = git(installedRoot, "worktree", "list", "--porcelain", "-z")
+        .split("\\0").filter(line => line.startsWith("worktree ")).map(line => resolve(line.slice(9)).toLowerCase());
+      const candidate = realpathSync(git(cwd, "rev-parse", "--show-toplevel"));
+      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;
+      const common = root => realpathSync(git(root, "rev-parse", "--path-format=absolute", "--git-common-dir")).toLowerCase();
+      if (common(installedRoot) !== common(candidate)) return false;
+      repositoryRoot = candidate;
+    }
+    diagnosticPath = resolve(repositoryRoot, ".local", "hooks", "subagent-lifecycle.ndjson");
+    pendingRoot = resolve(repositoryRoot, ".local", "hooks", "subagent-pending");
+    return true;
+  } catch { return false; }
+}
 
 if (process.argv[2] === "--capture-runner") {
+  if (!selectRoot(process.cwd())) process.exit(0);
   await runCaptureRunner(process.argv[3]);
   process.exit(0);
 }
 if (process.argv[2] === "--replay-pending") {
+  if (!selectRoot(process.cwd())) process.exit(0);
   const files = await fs.readdir(pendingRoot).catch(() => []);
   let replayed = 0;
   for (const file of files.filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).slice(0, 256)) {
@@ -37,9 +73,9 @@ for await (const chunk of process.stdin) raw += chunk;
 try {
   const event = JSON.parse(raw);
   const cwd = text(event.cwd);
-  const scoped = cwd === null ? ".." : relative(repositoryRoot, resolve(cwd));
-  if (cwd === null || scoped.startsWith("..")) process.exit(0);
+  if (cwd === null || !selectRoot(cwd)) process.exit(0);
   const eventName = text(event.hook_event_name);
+  activation?.recordActivation(repositoryRoot, event);
   const lifecycleEvent =
     eventName === "SubagentStart" ? "start" : eventName === "SubagentStop" ? "stop" : null;
   const session = text(event.session_id);

package/dist/services/codex-subagent-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-subagent-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiT5C,CAAC"}
+{"version":3,"file":"codex-subagent-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqV5C,CAAC"}

package/dist/services/codex-validation-runtime-template.d.ts

@@ -0,0 +1,3 @@
+/** Appended to native authority; receives the shared literal parser. */
+export declare const CODEX_VALIDATION_RUNTIME_SUPPORT: string;
+//# sourceMappingURL=codex-validation-runtime-template.d.ts.map

package/dist/services/codex-validation-runtime-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-validation-runtime-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-validation-runtime-template.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,QAe5C,CAAC"}

package/dist/services/codex-validation-runtime-template.js

@@ -0,0 +1,18 @@
+/** Appended to native authority; receives the shared literal parser. */
+export const CODEX_VALIDATION_RUNTIME_SUPPORT = String.raw `
+/** Candidate validation requires this exact host runtime, not arbitrary executables. */
+export async function reviewedValidationRuntimePaths(command, tokenizeLiteralCommand) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:node|node\.exe)$/i.test(tokens[0]) ||
+      !/^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") ||
+      tokens[2] !== "validation" || !["batch", "execute"].includes(tokens[3])) return [];
+  const positions = tokens.flatMap((value, index) => value === "--executable" ? [index] : []);
+  if (positions.length !== 1) return [];
+  const path = tokens[positions[0] + 1];
+  if (!path || !isAbsolute(path) || command.split(path).length !== 2) return [];
+  try {
+    return await realpath(path) === await realpath(process.execPath) ? [path] : [];
+  } catch { return []; }
+}
+`;
+//# sourceMappingURL=codex-validation-runtime-template.js.map

package/dist/services/codex-validation-runtime-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-validation-runtime-template.js","sourceRoot":"","sources":["../../src/services/codex-validation-runtime-template.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;CAezD,CAAC"}

package/dist/services/codex-windows-hook-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-windows-hook-command.d.ts","sourceRoot":"","sources":["../../src/services/codex-windows-hook-command.ts"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAKpF"}
+{"version":3,"file":"codex-windows-hook-command.d.ts","sourceRoot":"","sources":["../../src/services/codex-windows-hook-command.ts"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAQpF"}