@zaip-ai/cli 4.2.0 → 4.3.0

package/dist/services/codex-conversation-lifecycle-hook.js

@@ -2,11 +2,15 @@ export const CODEX_CONVERSATION_LIFECYCLE_HOOK = String.raw `import { writeSync
 import { lstat, open, readFile, realpath, mkdir, rename, writeFile, appendFile, unlink } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve, toNamespacedPath } from "node:path";
 import { fileURLToPath } from "node:url";
 const hookRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
 let root = hookRoot, local;
-const deadline = Date.now() + 8000;
+// The host hook stays below 10s. Explicit CLI recovery runs in the active Codex
+// tool session and may finish expensive canonical closure within its own bound.
+const replay = process.argv.length === 3 && process.argv[2] === "--replay-receipt";
+const deadline = Date.now() + (replay ? 45000 : 8000);
 const readChunkBytes = 1024 * 1024, maxLineBytes = 8 * 1024 * 1024, maxReadBytes = 16 * 1024 * 1024;
 const hash = value => createHash("sha256").update(value).digest("hex");
 const parse = value => { try { return JSON.parse(value); } catch { return null; } };
@@ -16,10 +20,10 @@ let raw = ""; for await (const chunk of process.stdin) raw += chunk;
 const event = parse(raw), session = text(event?.session_id), turn = text(event?.turn_id);
 let receipt, receiptPath, lease;
 function reply(pending = false) {
-  const result = { hookSpecificOutput: { hookEventName: "Stop" } };
-  // One continuation at most. Persistent failures remain an explicit durable pending event.
-  if (pending && event?.stop_hook_active !== true) Object.assign(result, { decision: "block", reason: receipt?.error === "owned_task_active" ? "ZAIP Task remains marked executing or verifying after Stop reconciliation; this does not prove a live worker. Inspect every launched process by fresh PID/session status, collect terminal exit and output, and either recover the lifecycle or report the concrete blocker. Never claim a process is still running from stale state." : receipt?.error === "owned_task_recoverable" ? "ZAIP Task " + receipt.recovery.task_id + " has a frozen recovery ledger. Observed attempts=" + receipt.recovery.progress.attempts + ", replans=" + (receipt.recovery.progress.total_replans ?? "unknown") + "; next ledger operation=" + receipt.recovery.operation + ". Evaluate the concrete blocker and perform only this authorized canonical operation in this turn. The hook did not dispatch an agent or prove the operation completed. Do not claim three replans without three observed ledger entries." : receipt?.error === "owned_task_unmetered" ? "ZAIP Task " + receipt.recovery.task_id + " is blocked without a frozen recovery ledger. The Stop hook cannot guarantee three replans or dispatch a model. Check the legacy policy and observed attempts, then report the concrete blocker and the missing enforcement honestly; never claim an unobserved replan." : "ZAIP closure or telemetry is pending. Retry this exact turn using its durable Stop receipt; do not report Task completion before canonical closure." });
-  writeSync(1, JSON.stringify(result) + "\n");
+  if (!replay) activation?.recordActivation(root, event, pending ? "pending" : "observed");
+  // Closure belongs to the live orchestrator. Stop only records/reconciles;
+  // a pending receipt must never manufacture another user prompt.
+  writeSync(1, JSON.stringify({}) + "\n");
 }
 async function save(path, value) {
   await mkdir(dirname(path), { recursive: true });
@@ -51,8 +55,11 @@ function proof(offset, line) { return { offset, length: line.length, sha256: has
 function sessionOf(row) { return row?.type === "session_meta" ? row.payload?.id ?? row.payload?.session_id : row?.payload?.type === "session_meta" ? row.payload.id ?? row.payload.session_id : null; }
 async function terminal(path) {
   if (!path || !isAbsolute(path)) throw new Error("transcript_missing");
+  // A local Windows namespace is not a network UNC path. Keep devices and UNC blocked.
+  if (/^(?:\\\\|\/\/)/.test(path) && !/^\\\\\?\\[a-z]:\\/i.test(path)) throw new Error("transcript_unsafe");
+  const identity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
   const link = await lstat(path);
-  if (!link.isFile() || link.isSymbolicLink() || (await realpath(path)).toLowerCase() !== resolve(path).toLowerCase()) throw new Error("transcript_unsafe");
+  if (!link.isFile() || link.isSymbolicLink() || identity(await realpath(path)) !== identity(path)) throw new Error("transcript_unsafe");
   const h = await open(path, "r");
   try {
     const stat = await h.stat(), sig = signature(stat), prior = receipt.cursor;
@@ -62,7 +69,23 @@ async function terminal(path) {
     if (same && prior.session_proof) same = hash(await bytes(h, prior.session_proof.offset, prior.session_proof.length)) === prior.session_proof.sha256;
     let offset = same ? prior.offset : 0, trusted = same && prior.trusted === true;
     let sessionProof = same ? prior.session_proof : null, terminalProof = same ? prior.terminal_proof : null, status = same ? prior.terminal_status : null;
-    let readBytes = 0, scanOffset = offset, lineOffset = offset, lineBytes = 0, lineParts = [];
+    let initialReadBytes = 0;
+    // The live Stop belongs to the current tail, not hundreds of MB of earlier
+    // turns. Authenticate the first session row, then align a bounded tail scan.
+    // Explicit historical replay retains the full resumable scan when no cursor exists.
+    if (!same && !replay && sig.size > maxReadBytes) {
+      const header = await bytes(h, 0, readChunkBytes), end = header.indexOf(10);
+      if (end < 0) throw new Error("transcript_session_header_too_large");
+      const first = header.subarray(0, end + 1);
+      if (sessionOf(parse(first.toString("utf8"))) !== session) throw new Error("transcript_session_mismatch");
+      trusted = true; sessionProof = proof(0, first);
+      const tailStart = sig.size - Math.floor((maxReadBytes - readChunkBytes) / 2);
+      const boundary = await bytes(h, tailStart, sig.size - tailStart), newline = boundary.indexOf(10);
+      if (newline < 0) throw new Error("transcript_tail_boundary_unavailable");
+      offset = tailStart + newline + 1;
+      initialReadBytes = header.length + boundary.length;
+    }
+    let readBytes = initialReadBytes, scanOffset = offset, lineOffset = offset, lineBytes = 0, lineParts = [];
     const consume = line => {
       const row = parse(line.toString("utf8"));
       if (!row && line.toString("utf8").trim()) throw new Error("transcript_invalid_jsonl");
@@ -153,11 +176,12 @@ try {
   if (!lease) { await note("stop_worker_busy"); reply(true); process.exit(0); }
   const old = parse(await readFile(receiptPath, "utf8").catch(() => ""));
   receipt = old?.schema_version === 1 && old.session_id === session && old.turn_id === turn ? old : { schema_version: 1, session_id: session, turn_id: turn, state: "pending", attempts: 0 };
-  receipt.event = { hook_event_name: "Stop", cwd: root, session_id: session, turn_id: turn, transcript_path: text(event.transcript_path), stop_hook_active: true };
+  const transcriptPath = text(event.transcript_path) ?? text(receipt.event?.transcript_path);
+  receipt.event = { hook_event_name: "Stop", cwd: root, session_id: session, turn_id: turn, transcript_path: transcriptPath, stop_hook_active: true };
   if (receipt.state === "persisted") { reply(); } else {
     receipt.attempts += 1; receipt.state = "pending"; await save(receiptPath, receipt);
     let status = null;
-    for (const delay of [0, 250, 750]) { if (delay) await new Promise(r => setTimeout(r, delay)); status = await terminal(text(event.transcript_path)); if (status) break; }
+    for (const delay of [0, 250, 750]) { if (delay) await new Promise(r => setTimeout(r, delay)); status = await terminal(transcriptPath); if (status) break; }
     if (!status) throw new Error("transcript_pending");
     const cli = resolve(root, ".agents/runtime/bin/zaip.mjs");
     const correlation = parse(await readFile(resolve(root, ".local/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
@@ -165,14 +189,14 @@ try {
     if (correlation?.schema_version === 1 && correlation.thread_id === session && correlation.turn_id === turn && correlation.agent_path === null && typeof correlation.run_id === "string") {
       intake = { run: { run_id: correlation.run_id }, task: correlation.task_id === null ? null : { id: correlation.task_id } };
     } else {
-      const started = await call(cli, ["conversation", "start", "--intent", "conversation"], text(event.transcript_path));
+      const started = await call(cli, ["conversation", "start", "--intent", "conversation"], transcriptPath);
       if (started.code !== 0) throw new Error("start_pending");
       intake = parse(started.out);
     }
     const run = intake?.run?.run_id;
     if (typeof run !== "string" || (intake.task !== null && typeof intake.task?.id !== "string")) throw new Error("start_pending");
     receipt.run_id = run; await save(receiptPath, receipt);
-    const result = await call(cli, ["subagent", "reconcile-stop", "--session", session, "--turn", turn], text(event.transcript_path));
+    const result = await call(cli, ["subagent", "reconcile-stop", "--session", session, "--turn", turn], transcriptPath);
     const outcome = parse(result.out);
     const terminalStates = ["completed", "blocked", "failed", "cancelled"];
     const closed = intake.task === null
@@ -180,7 +204,7 @@ try {
       : outcome?.status === "closed" && outcome.parent_run_id === run && outcome.reconciliation?.tasks?.some(task => task.id === intake.task.id && terminalStates.includes(task.status));
     if (result.code !== 0 || !closed) throw new Error("closure_pending");
     if (intake.task !== null && status === "completed") {
-      const shown = await call(cli, ["task", "recovery-status", intake.task.id], text(event.transcript_path));
+      const shown = await call(cli, ["task", "recovery-status", intake.task.id], transcriptPath);
       const recovery = parse(shown.out);
       if (shown.code !== 0 || recovery?.task_id !== intake.task.id || typeof recovery.task_status !== "string") throw new Error("task_state_pending");
       if (["executing", "verifying"].includes(recovery.task_status)) throw new Error("owned_task_active");
@@ -194,7 +218,7 @@ try {
       }
     }
     if (intake.task !== null) {
-      const usage = await call(cli, ["run", "usage", run, "--disable-codex-raw"], text(event.transcript_path));
+      const usage = await call(cli, ["run", "usage", run, "--disable-codex-raw"], transcriptPath);
       if (usage.code !== 0 || parse(usage.out) === null) throw new Error("telemetry_pending");
     }
     receipt.state = "persisted"; receipt.persisted_at = new Date().toISOString(); receipt.error = null;

package/dist/services/codex-conversation-lifecycle-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8M1D,CAAC"}
+{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsO1D,CAAC"}

package/dist/services/codex-hook-activation.d.ts

@@ -0,0 +1,4 @@
+export declare const HOOK_ACTIVATION_EVENTS: readonly ["PreToolUse", "SubagentStart", "SubagentStop", "Stop"];
+export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
+export declare const CODEX_HOOK_ACTIVATION: string;
+//# sourceMappingURL=codex-hook-activation.d.ts.map

package/dist/services/codex-hook-activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QA8CjC,CAAC"}

package/dist/services/codex-hook-activation.js

@@ -0,0 +1,64 @@
+export const HOOK_ACTIVATION_EVENTS = [
+    "PreToolUse",
+    "SubagentStart",
+    "SubagentStop",
+    "Stop",
+];
+export const HOOK_ACTIVATION_FILES = [
+    ".codex/config.toml",
+    ".codex/hooks/zaip-pre-tool-use.mjs",
+    ".codex/hooks/zaip-pre-tool-support.mjs",
+    ".codex/hooks/zaip-native-tool-authority.mjs",
+    ".codex/hooks/zaip-subagent-lifecycle.mjs",
+    ".codex/hooks/zaip-conversation-lifecycle.mjs",
+    ".codex/hooks/zaip-hook-activation.mjs",
+];
+// Local diagnostic evidence, not a replacement for Codex's trust store or a security boundary.
+export const CODEX_HOOK_ACTIVATION = String.raw `import { createHash, randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+const files = ${JSON.stringify(HOOK_ACTIVATION_FILES)};
+const events = ${JSON.stringify(HOOK_ACTIVATION_EVENTS)};
+const digest = text => createHash("sha256").update(text).digest("hex");
+function regular(path) {
+  const s = lstatSync(path);
+  if (!s.isFile() || s.isSymbolicLink() || s.size > 2097152) throw new Error("unsafe activation input");
+  return readFileSync(path);
+}
+export function recordActivation(root, event, outcome = "observed") {
+  try {
+    const name = event?.hook_event_name;
+    let directory = root;
+    for (const part of [".local", "hooks", "activation"]) {
+      directory = resolve(directory, part);
+      try { mkdirSync(directory); } catch (e) { if (e.code !== "EEXIST") throw e; }
+      const s = lstatSync(directory);
+      if (!s.isDirectory() || s.isSymbolicLink() || realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;
+    }
+    const reason = !events.includes(name) ? "event_missing_or_unknown" :
+      typeof event.session_id !== "string" || !event.session_id ? "session_missing" :
+      typeof event.turn_id !== "string" || !event.turn_id ? "turn_missing" :
+      process.env.CODEX_THREAD_ID && process.env.CODEX_THREAD_ID !== event.session_id ? "host_identity_mismatch" : null;
+    if (reason) {
+      // No payload, command, environment value or secret is persisted here.
+      const diagnostic = resolve(directory, "diagnostic.json");
+      const temporary = diagnostic + ".tmp-" + randomUUID();
+      writeFileSync(temporary, JSON.stringify({ reason, observed_at: new Date().toISOString() }), { flag: "wx", mode: 0o600 });
+      renameSync(temporary, diagnostic);
+      return;
+    }
+    // Hook processes do not necessarily inherit CODEX_THREAD_ID. The event is the
+    // protocol identity; receipts remain diagnostics, never proof of Codex trust.
+    const fingerprint = digest(JSON.stringify(files.map(file => [file, digest(regular(resolve(root, file)))])));
+    const path = resolve(directory, name + ".json");
+    const temporary = path + ".tmp-" + randomUUID();
+    writeFileSync(temporary, JSON.stringify({ schema_version: 1, event: name, fingerprint,
+      session_id: event.session_id, turn_id: event.turn_id, outcome,
+      identity_source: process.env.CODEX_THREAD_ID ? "event_and_environment" : "hook_event",
+      observed_at: new Date().toISOString() }) + "\n",
+      { flag: "wx", mode: 0o600 });
+    renameSync(temporary, path);
+  } catch { /* Diagnostics must not break a tool or turn. Missing evidence stays unknown. */ }
+}
+`;
+//# sourceMappingURL=codex-hook-activation.js.map

package/dist/services/codex-hook-activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;gBAG/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD,CAAC"}

package/dist/services/codex-model-policy.d.ts

@@ -0,0 +1,4 @@
+import type { GuidanceAgent } from "./agent-adapters.js";
+export declare function codexModelInstructions(agent: GuidanceAgent): readonly string[];
+export declare function codexModelConfig(agent: GuidanceAgent): string;
+//# sourceMappingURL=codex-model-policy.d.ts.map

package/dist/services/codex-model-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-model-policy.d.ts","sourceRoot":"","sources":["../../src/services/codex-model-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUzD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAM9E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAY7D"}

package/dist/services/codex-model-policy.js

@@ -0,0 +1,24 @@
+function followsDispatchPolicy(agent) {
+    return (agent.role === "orchestrator" ||
+        (["builder", "task-executor"].includes(agent.role) &&
+            agent.execution_eligibility.includes("delivery")));
+}
+export function codexModelInstructions(agent) {
+    return followsDispatchPolicy(agent)
+        ? [
+            "Model and reasoning effort are controlled by the authorized dispatch policy. Catalog preferences are dispatch defaults, not permanent native locks. Before dispatch, the authorized host must select and validate the model/effort allowed by the frozen Task policy and the host's manual selection. Record the requested configuration separately from the effective model/effort observed from the host; never silently inherit a parent configuration or claim a model switch from instructions. If the host cannot select or verify the required configuration, report the capability as unavailable and return the blocked dispatch to the orchestrator.",
+        ]
+        : [];
+}
+export function codexModelConfig(agent) {
+    const model = agent.model.preferred[0];
+    if (followsDispatchPolicy(agent) ||
+        agent.model.preferred.length !== 1 ||
+        model === undefined ||
+        model === "policy-selected") {
+        return "";
+    }
+    const effort = agent.model.reasoning_effort;
+    return `model = ${JSON.stringify(model)}\n${effort === undefined ? "" : `model_reasoning_effort = ${JSON.stringify(effort)}\n`}`;
+}
+//# sourceMappingURL=codex-model-policy.js.map

package/dist/services/codex-model-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-model-policy.js","sourceRoot":"","sources":["../../src/services/codex-model-policy.ts"],"names":[],"mappings":"AAEA,SAAS,qBAAqB,CAAC,KAAoB;IACjD,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,cAAc;QAC7B,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAChD,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,OAAO,qBAAqB,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC;YACE,goBAAgoB;SACjoB;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvC,IACE,qBAAqB,CAAC,KAAK,CAAC;QAC5B,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAClC,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,iBAAiB,EAC3B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC5C,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AACnI,CAAC"}

package/dist/services/codex-native-tool-authority-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_NATIVE_TOOL_AUTHORITY_HOOK: string;
+//# sourceMappingURL=codex-native-tool-authority-template.d.ts.map

package/dist/services/codex-native-tool-authority-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QAsFT,CAAC"}

package/dist/services/codex-native-tool-authority-template.js

@@ -0,0 +1,89 @@
+import { CODEX_VALIDATION_RUNTIME_SUPPORT } from "./codex-validation-runtime-template.js";
+export const CODEX_NATIVE_TOOL_AUTHORITY_HOOK = String.raw `import { createHash } from "node:crypto";
+import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+const inside = (path, root) => { const scoped = relative(root, resolve(path)); return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped)); };
+const authorityPath = path => /^(?:\.agents\/(?:records|data\/runs)\/|\.local\/(?:codex-hook-|codex-telemetry-spool\/|runs\/))/i.test(path.replaceAll("\\", "/"));
+/** Inspect existing ancestors too: a missing destination can still traverse a junction. */
+export async function isSafePatchPath(target, root) {
+  if (!inside(target, root)) return false;
+  for (let path = resolve(target);; path = dirname(path)) {
+    try {
+      const info = await lstat(path);
+      if (info.isSymbolicLink() || (info.isFile() && info.nlink !== 1)) return false;
+    } catch (error) { if (error.code !== "ENOENT") return false; }
+    if (path === resolve(root)) return true;
+    if (dirname(path) === path) return false;
+  }
+}
+async function canonicalScopes(id, root, boundedRead) {
+  const date = typeof id === "string" && /^TASK-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+$/.exec(id);
+  if (!date) throw new Error("invalid_task");
+  const text = await boundedRead(resolve(root, ".agents/records/tasks", date[1], date[2], id + ".md"), 262144);
+  const front = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text)?.[1];
+  if (!front || ["id", "status", "write_scopes"].some(key => (front.match(new RegExp("^" + key + ":", "gm")) ?? []).length !== 1) ||
+      !front.split(/\r?\n/).includes("id: " + id) || !/^status: (?:executing|verifying)$/m.test(front.replaceAll("\r", ""))) throw new Error("inactive_task");
+  const lists = [...front.matchAll(/^write_scopes:\r?\n((?:  - [^\r\n]+(?:\r?\n|$))+)/gm)];
+  if (lists.length !== 1) throw new Error("invalid_scopes");
+  return lists[0][1].trimEnd().split(/\r?\n/).map(line => {
+    const value = line.slice(4);
+    if (value.startsWith('"')) return JSON.parse(value);
+    if (value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1).replaceAll("''", "'");
+    if (/[\r\n\x00]|(?:^|\s)#|:\s|^[!&*\[{]/.test(value)) throw new Error("ambiguous_scope");
+    return value;
+  });
+}
+/** Validate only this native child's patch scope and its still-active canonical ancestry. */
+export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead) {
+  if (event.tool_name !== "apply_patch" || typeof event.session_id !== "string" || typeof event.turn_id !== "string") return false;
+  try {
+    const key = createHash("sha256").update(JSON.stringify([event.session_id, event.turn_id])).digest("hex");
+    const binding = JSON.parse(await boundedRead(resolve(repositoryRoot, ".local/codex-hook-native/v2", key + ".json"), 65536));
+    if (binding.schema_version !== 2 || binding.session_id !== event.session_id || binding.turn_id !== event.turn_id ||
+        typeof binding.native_session_id !== "string" || ![binding.native_session_id, binding.parent_session_id].includes(event.session_id) ||
+        !Array.isArray(binding.write_scopes) || !binding.write_scopes.length) return false;
+    const readRun = async id => {
+      const match = typeof id === "string" && /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id);
+      if (!match) throw new Error("invalid_run");
+      let text;
+      for (const directory of [match[1] + "/" + match[2], match[1] + "/" + match[2] + "/" + match[3]]) {
+        try {
+          const value = await boundedRead(resolve(repositoryRoot, ".agents/records/runs", directory, id + ".jsonl"), 8388608);
+          if (text !== undefined) throw new Error("ambiguous_run");
+          text = value;
+        } catch (error) { if (error.code !== "ENOENT") throw error; }
+      }
+      if (!text?.endsWith("\n")) throw new Error("incomplete_run");
+      const records = text.split(/\r?\n/).filter(Boolean).map(JSON.parse);
+      if (records.some((row, i) => row.schema_version !== 2 || row.sequence !== i + 1 || row.run_id !== id ||
+          row.type === "run.finished" || row.type === "run.finalization.decided")) throw new Error("inactive_run");
+      if (records[0]?.type !== "run.started") throw new Error("invalid_run");
+      return records[0];
+    };
+    const child = await readRun(binding.run_id), parent = await readRun(binding.parent_run_id);
+    if (child.client !== "codex-subagent" || child.run_role !== "subagent" || child.run_purpose !== "execution" ||
+        !child.execution_eligibility?.includes("delivery") || child.parent_run_id !== parent.run_id ||
+        child.client_thread_id !== binding.agent_id || child.client_turn_id !== event.turn_id ||
+        parent.agent !== "agent-orchestrator" || parent.run_role !== "orchestrator" || parent.parent_run_id !== null ||
+        parent.client_thread_id !== binding.parent_session_id ||
+        parent.entrypoint !== "task" || !binding.task_id || !binding.execution_id ||
+        child.task_id !== binding.task_id || parent.task_id !== binding.task_id ||
+        child.execution_id !== binding.execution_id || parent.execution_id !== binding.execution_id) return false;
+    const command = event.tool_input?.command;
+    if (typeof command !== "string") return false;
+    const scopes = await canonicalScopes(binding.task_id, repositoryRoot, boundedRead);
+    if (JSON.stringify(scopes) !== JSON.stringify(binding.write_scopes)) return false;
+    const paths = [...command.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)].map(match => match[1].trim());
+    for (const path of paths) if (!await isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) return false;
+    return paths.length > 0 && paths.every(path => {
+      const target = resolve(repositoryRoot, path);
+      return !authorityPath(relative(repositoryRoot, target)) && inside(target, repositoryRoot) && scopes.some(scope => {
+        if (typeof scope !== "string" || !scope || isAbsolute(scope) || scope.split(/[\\/]/).includes("..")) return false;
+        const base = resolve(repositoryRoot, scope.replace(/\/\*\*$/, ""));
+        return inside(base, repositoryRoot) && inside(target, base);
+      });
+    });
+  } catch { return false; }
+}
+` + CODEX_VALIDATION_RUNTIME_SUPPORT;
+//# sourceMappingURL=codex-native-tool-authority-template.js.map

package/dist/services/codex-native-tool-authority-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFzD,GAAG,gCAAgC,CAAC"}

package/dist/services/codex-pre-tool-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QA+vB/B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QAouB/B,CAAC"}