@zaip-ai/cli 4.2.0 → 4.3.0

package/dist/services/global-codex-config-transaction.test.js

@@ -0,0 +1,145 @@
+import { link, open, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { installSecurityHook, reconcileGlobalCodexConfig, } from "./global-codex-config.js";
+import { cleanupProjectFixtures, nodeFileSystem, projectFixture, } from "./global-codex-config-fixtures.js";
+afterEach(cleanupProjectFixtures);
+describe("global Codex config transaction concurrency", () => {
+    it.each([
+        "before return",
+        "after return",
+    ])("retains saves through an open original handle %s", async (stage) => {
+        const fixture = await projectFixture();
+        const original = installSecurityHook('model = "original"\n');
+        const newer = 'model = "saved through original handle"\n';
+        await writeFile(fixture.configPath, original);
+        const handle = await open(fixture.configPath, "r+");
+        const save = async () => {
+            await handle.truncate(0);
+            await handle.write(newer, 0, "utf8");
+        };
+        try {
+            const filesystem = {
+                ...nodeFileSystem,
+                link: async (...args) => {
+                    if (stage === "before return" && String(args[0]).includes(".zaip-tmp-"))
+                        await save();
+                    await link(...args);
+                },
+            };
+            const result = await reconcileGlobalCodexConfig(fixture.codexHome, fixture.catalogPath, filesystem);
+            if (stage === "after return") {
+                expect(result.installed).toBe(true);
+                await save();
+            }
+            else {
+                expect(result.installed).toBe(false);
+                expect(result.error).toContain("Concurrent save detected");
+            }
+            const preserved = (await readdir(fixture.codexHome)).filter((name) => name.startsWith("config.toml.zaip-saved-"));
+            expect(preserved).toHaveLength(1);
+            expect(await readFile(`${fixture.codexHome}/${preserved[0]}`, "utf8")).toBe(newer);
+            expect(await readFile(fixture.configPath, "utf8")).toBe('model = "original"\n\n');
+        }
+        finally {
+            await handle.close();
+        }
+    });
+    it.each([
+        "promotion",
+        "rollback",
+    ])("preserves a concurrent editor save during %s", async (stage) => {
+        const fixture = await projectFixture();
+        const original = installSecurityHook('model = "original"\n');
+        const newer = 'model = "newer user setting"\n';
+        await writeFile(fixture.configPath, original);
+        const filesystem = {
+            ...nodeFileSystem,
+            link: vi.fn(async (...args) => {
+                const promoting = String(args[0]).includes(".zaip-tmp-");
+                if (stage === "promotion" && promoting)
+                    await writeFile(fixture.configPath, newer);
+                if (stage === "rollback") {
+                    if (promoting)
+                        throw new Error("promotion fault");
+                    await writeFile(fixture.configPath, newer);
+                }
+                await link(...args);
+            }),
+        };
+        const result = await reconcileGlobalCodexConfig(fixture.codexHome, fixture.catalogPath, filesystem);
+        expect(result.installed).toBe(false);
+        expect(result.error).toContain("Concurrent global config preserved");
+        expect(await readFile(fixture.configPath, "utf8")).toBe(newer);
+        expect(await readFile(`${fixture.configPath}.zaip-backup-${process.pid}`, "utf8")).toBe(original);
+        expect((await readdir(fixture.codexHome)).sort()).toEqual([
+            "config.toml",
+            `config.toml.zaip-backup-${process.pid}`,
+        ]);
+    });
+    it.each([
+        "changed",
+        "appeared",
+        "disappeared",
+    ])("preserves a config that %s after the initial read", async (scenario) => {
+        const fixture = await projectFixture();
+        const original = Buffer.from(installSecurityHook('model = "original"\r\n'));
+        const newer = Buffer.from('\uFEFFmodel = "newer"\r\n[desktop]\r\nlabel = "ação concorrente"\r\n');
+        if (scenario === "appeared") {
+            // Force a fallback write when there is no initial global config to migrate.
+            await writeFile(fixture.projectConfigPath, "zaip:\n  enabled: false\n");
+        }
+        else {
+            await writeFile(fixture.configPath, original);
+        }
+        const filesystem = {
+            ...nodeFileSystem,
+            rename: vi.fn(async (...args) => {
+                if (args[0] === fixture.configPath) {
+                    if (scenario === "disappeared")
+                        await rm(fixture.configPath);
+                    else
+                        await writeFile(fixture.configPath, newer);
+                }
+                await rename(...args);
+            }),
+        };
+        const result = await reconcileGlobalCodexConfig(fixture.codexHome, fixture.catalogPath, filesystem);
+        if (scenario === "appeared") {
+            // Repository-only policy has no write to race when global config is absent.
+            expect(result).toMatchObject({ installed: true, securityHookInstalled: false, error: null });
+            expect(filesystem.rename).not.toHaveBeenCalled();
+            await expect(readFile(fixture.configPath)).rejects.toMatchObject({ code: "ENOENT" });
+            return;
+        }
+        expect(result).toMatchObject({
+            installed: false,
+            securityHookInstalled: false,
+            securityHookOwner: null,
+        });
+        expect(result.error).toContain("concurrently");
+        if (scenario === "disappeared") {
+            await expect(readFile(fixture.configPath)).rejects.toMatchObject({ code: "ENOENT" });
+            expect(await readdir(fixture.codexHome)).toEqual([]);
+        }
+        else {
+            expect(result.error).toContain("newer config restored");
+            expect(await readFile(fixture.configPath)).toEqual(newer);
+            expect(await readdir(fixture.codexHome)).toEqual(["config.toml"]);
+        }
+    });
+    it("preserves non-UTF-8 user bytes instead of rewriting a lossy decoding", async () => {
+        const fixture = await projectFixture();
+        const original = Buffer.from([0xff, 0xfe, 0x61, 0x00]);
+        await writeFile(fixture.configPath, original);
+        const result = await reconcileGlobalCodexConfig(fixture.codexHome, fixture.catalogPath);
+        expect(result).toMatchObject({
+            installed: false,
+            securityHookInstalled: false,
+            securityHookOwner: null,
+        });
+        expect(result.error).not.toBeNull();
+        expect(await readFile(fixture.configPath)).toEqual(original);
+        expect(await readdir(fixture.codexHome)).toEqual(["config.toml"]);
+    });
+});
+//# sourceMappingURL=global-codex-config-transaction.test.js.map

package/dist/services/global-codex-config-transaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-codex-config-transaction.test.js","sourceRoot":"","sources":["../../src/services/global-codex-config-transaction.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAEL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,GACf,MAAM,mCAAmC,CAAC;AAE3C,SAAS,CAAC,sBAAsB,CAAC,CAAC;AAElC,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,IAAI,CAAC;QACN,eAAe;QACf,cAAc;KACf,CAAC,CAAC,kDAAkD,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,2CAA2C,CAAC;QAC1D,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,UAAU,GAAgC;gBAC9C,GAAG,cAAc;gBACjB,IAAI,EAAE,KAAK,EAAE,GAAG,IAA6B,EAAE,EAAE;oBAC/C,IAAI,KAAK,KAAK,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;wBAAE,MAAM,IAAI,EAAE,CAAC;oBACtF,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtB,CAAC;aACF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,EACnB,UAAU,CACX,CAAC;YACF,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;gBAC7B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnE,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAC3C,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnF,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC;QACN,WAAW;QACX,UAAU;KACX,CAAC,CAAC,8CAA8C,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,gCAAgC,CAAC;QAC/C,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAgC;YAC9C,GAAG,cAAc;YACjB,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,IAA6B,EAAE,EAAE;gBACrD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBACzD,IAAI,KAAK,KAAK,WAAW,IAAI,SAAS;oBAAE,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACnF,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;oBACzB,IAAI,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAClD,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACtB,CAAC,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,EACnB,UAAU,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,OAAO,CAAC,UAAU,gBAAgB,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACrF,QAAQ,CACT,CAAC;QACF,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACxD,aAAa;YACb,2BAA2B,OAAO,CAAC,GAAG,EAAE;SACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC;QACN,SAAS;QACT,UAAU;QACV,aAAa;KACd,CAAC,CAAC,mDAAmD,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,sEAAsE,CACvE,CAAC;QACF,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,4EAA4E;YAC5E,MAAM,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,UAAU,GAAgC;YAC9C,GAAG,cAAc;YACjB,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,IAA+B,EAAE,EAAE;gBACzD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;oBACnC,IAAI,QAAQ,KAAK,aAAa;wBAAE,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;;wBACxD,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAClD,CAAC;gBACD,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YACxB,CAAC,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,EACnB,UAAU,CACX,CAAC;QACF,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,4EAA4E;YAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7F,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACjD,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,SAAS,EAAE,KAAK;YAChB,qBAAqB,EAAE,KAAK;YAC5B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrF,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,SAAS,EAAE,KAAK;YAChB,qBAAqB,EAAE,KAAK;YAC5B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/global-codex-config.d.ts

@@ -1,4 +1,5 @@
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { type GlobalCodexConfigFileSystem } from "./global-codex-config-transaction.js";
+export type { GlobalCodexConfigFileSystem } from "./global-codex-config-transaction.js";
 export interface GlobalCodexConfigResult {
     path: string;
     sourcePath: string;
@@ -6,21 +7,19 @@ export interface GlobalCodexConfigResult {
     agentFilesInstalled: number;
     removedRegistrations: number;
     securityHookInstalled: boolean;
+    securityHookOwner: "project" | "global" | null;
+    projectHookFinding?: string | null;
+    backupPath: string | null;
     error: string | null;
 }
-export interface GlobalCodexConfigFileSystem {
-    mkdir: typeof mkdir;
-    readFile: typeof readFile;
-    rename: typeof rename;
-    rm: typeof rm;
-    writeFile: typeof writeFile;
-}
 /**
  * Removes only catalog-declared legacy Codex identity aliases and installs the
- * portable command-safety hook. Project permissions, profiles, and canonical
- * agent definitions remain project-owned.
+ * repository-only hook policy. Never installs a global fallback.
+ * All unrelated global configuration remains byte-for-byte intact.
  */
-export declare function reconcileGlobalCodexConfig(codexHome?: string, sourcePath?: string, filesystem?: GlobalCodexConfigFileSystem): Promise<GlobalCodexConfigResult>;
+export declare function reconcileGlobalCodexConfig(codexHome?: string, sourcePath?: string, filesystem?: GlobalCodexConfigFileSystem, options?: {
+    migrateLegacyAgents?: boolean;
+}): Promise<GlobalCodexConfigResult>;
 export declare function installSecurityHook(config: string): string;
 export declare function stripLegacyRegistrations(config: string, legacyAgentNames?: readonly string[]): {
     content: string;

package/dist/services/global-codex-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-codex-config.d.ts","sourceRoot":"","sources":["../../src/services/global-codex-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAM1E,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,EAAE,EAAE,OAAO,EAAE,CAAC;IACd,SAAS,EAAE,OAAO,SAAS,CAAC;CAC7B;AAgBD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,SAAsD,EAC/D,UAAU,SAAiD,EAC3D,UAAU,GAAE,2BAA4C,GACvD,OAAO,CAAC,uBAAuB,CAAC,CAuClC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAY1D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,gBAAgB,GAAE,SAAS,MAAM,EAAO,GACvC;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CASA"}
+{"version":3,"file":"global-codex-config.d.ts","sourceRoot":"","sources":["../../src/services/global-codex-config.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,2BAA2B,EAIjC,MAAM,sCAAsC,CAAC;AAE9C,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAExF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/C,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAQD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,SAAsD,EAC/D,UAAU,SAAiD,EAC3D,UAAU,GAAE,2BAA4C,EACxD,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAqElC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAS1D;AAyGD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,gBAAgB,GAAE,SAAS,MAAM,EAAO,GACvC;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAMA"}

package/dist/services/global-codex-config.js

@@ -1,56 +1,73 @@
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { parse } from "yaml";
+import { adapterFiles } from "./adapters.js";
 import { CODEX_PRE_TOOL_USE_HOOK } from "./codex-config-template.js";
-const nodeFileSystem = { mkdir, readFile, rename, rm, writeFile };
-const ANY_TOML_TABLE = /^\[\[?[^\]\r\n]+\]\]?(?:\r?\n|$)/;
-const AGENT_TABLE = /^\[agents\."([^"]+)"\](?:\r?\n|$)/;
-const HOOK_TABLE = /^\[\[hooks\.(PreToolUse|Stop|SubagentStart|SubagentStop)\]\](?:\r?\n|$)/;
-const ZAIP_HOOK_SIGNATURES = [
-    ".codex/hooks/zaip-pre-tool-use.mjs",
-    ".codex/hooks/zaip-conversation-lifecycle.mjs",
-    ".codex/hooks/zaip-subagent-lifecycle.mjs",
-    'statusMessage = "Applying ZAIP workspace safety policy"',
-    'statusMessage = "Reconciling ZAIP task closure and telemetry"',
-    'statusMessage = "Attributing ZAIP subagent Run"',
-    'statusMessage = "Finalizing ZAIP subagent Run"',
-];
+import { codexWindowsHookCommand } from "./codex-windows-hook-command.js";
+import { assertNoConfigBackup, isMissingFile, nodeFileSystem, replaceConfig, } from "./global-codex-config-transaction.js";
+const ANY_TOML_TABLE = /^\s*\[\[?[^\r\n]+\]\]?\s*(?:#.*)?$/;
+const AGENT_TABLE = /^\s*\[agents\."([^"]+)"\]\s*(?:#.*)?$/;
+const HOOK_TABLE = /^\s*\[\[hooks\.(PreToolUse|Stop|SubagentStart|SubagentStop)\]\]\s*(?:#.*)?$/;
+const ZAIP_HOOK_PATH = /(?:^|[/\\])\.codex[/\\]hooks[/\\]zaip-(?:pre-tool-use|conversation-lifecycle|subagent-lifecycle)\.mjs$/;
 /**
  * Removes only catalog-declared legacy Codex identity aliases and installs the
- * portable command-safety hook. Project permissions, profiles, and canonical
- * agent definitions remain project-owned.
+ * repository-only hook policy. Never installs a global fallback.
+ * All unrelated global configuration remains byte-for-byte intact.
  */
-export async function reconcileGlobalCodexConfig(codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex"), sourcePath = "<project>/.agents/config/agents/catalog.yaml", filesystem = nodeFileSystem) {
+export async function reconcileGlobalCodexConfig(codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex"), sourcePath = "<project>/.agents/config/agents/catalog.yaml", filesystem = nodeFileSystem, options = {}) {
     const path = join(codexHome, "config.toml");
-    const temporary = `${path}.zaip-tmp-${process.pid}`;
     const backup = `${path}.zaip-backup-${process.pid}`;
     try {
-        const current = await filesystem.readFile(path, "utf8").catch((error) => {
+        const homeInfo = await filesystem.lstat(codexHome).catch((error) => {
             if (isMissingFile(error))
                 return null;
             throw error;
         });
-        const legacyAgentNames = await catalogedCodexAliases(sourcePath, filesystem);
+        if (homeInfo && (!homeInfo.isDirectory() || homeInfo.isSymbolicLink()))
+            throw new Error(`ENOTDIR: Codex home must be a real directory: ${codexHome}`);
+        const fileInfo = await filesystem.lstat(path).catch((error) => {
+            if (isMissingFile(error))
+                return null;
+            throw error;
+        });
+        if (fileInfo && (!fileInfo.isFile() || fileInfo.isSymbolicLink() || fileInfo.nlink !== 1))
+            throw new Error(`Global Codex config must be a regular unlinked file: ${path}`);
+        await assertNoConfigBackup(backup, filesystem);
+        const original = await filesystem.readFile(path).catch((error) => {
+            if (isMissingFile(error))
+                return null;
+            throw error;
+        });
+        const current = original === null
+            ? null
+            : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(original);
+        const legacyAgentNames = options.migrateLegacyAgents === false
+            ? [] : await catalogedCodexAliases(sourcePath, filesystem);
         const { content: stripped, removedRegistrations } = current === null
             ? { content: "", removedRegistrations: 0 }
             : stripLegacyRegistrations(current, legacyAgentNames);
-        const content = installSecurityHook(stripped);
-        if (content !== current) {
-            await replaceConfig(path, content, temporary, backup, filesystem);
-        }
+        let projectHookFinding = null;
+        const projectHooksVerified = await hasCanonicalProjectHooks(sourcePath, filesystem, (reason) => {
+            projectHookFinding = reason;
+        });
+        const content = stripZaipHooks(stripped);
+        const backupPath = content !== (current ?? "")
+            ? await replaceConfig(path, content, original, filesystem, fileInfo?.mode)
+            : null;
         return {
             path,
             sourcePath,
             installed: true,
             agentFilesInstalled: 0,
             removedRegistrations,
-            securityHookInstalled: true,
+            securityHookInstalled: projectHooksVerified,
+            securityHookOwner: projectHooksVerified ? "project" : null,
+            projectHookFinding,
+            backupPath,
             error: null,
         };
     }
     catch (error) {
-        await filesystem.rm(temporary, { force: true }).catch(() => undefined);
         return {
             path,
             sourcePath,
@@ -58,6 +75,8 @@ export async function reconcileGlobalCodexConfig(codexHome = process.env.CODEX_H
             agentFilesInstalled: 0,
             removedRegistrations: 0,
             securityHookInstalled: false,
+            securityHookOwner: null,
+            backupPath: null,
             error: error instanceof Error ? error.message : String(error),
         };
     }
@@ -67,68 +86,114 @@ export function installSecurityHook(config) {
     if (zaipHookSpans.length === 1 && normalizeNewlines(config).includes(CODEX_PRE_TOOL_USE_HOOK)) {
         return config;
     }
-    const stripped = zaipHookSpans.reduceRight((remaining, span) => remaining.slice(0, span.start) + remaining.slice(span.end), config);
+    const stripped = stripZaipHooks(config);
     const prefix = stripped.length === 0 ? "" : stripped.endsWith("\n") ? `${stripped}\n` : `${stripped}\n\n`;
     return `${prefix}${CODEX_PRE_TOOL_USE_HOOK}\n`;
 }
+function stripZaipHooks(config) {
+    return stripOwnedSpans(config, zaipOwnedHookSpans(config));
+}
+function stripOwnedSpans(config, spans) {
+    return spans.reduceRight((remaining, span) => {
+        const block = config.slice(span.start, span.end);
+        const comments = tomlStatements(block)
+            .filter(({ text }) => /^\s*#/.test(text))
+            .map(({ start, end }) => block.slice(start, end))
+            .join("");
+        const bom = span.start === 0 && block.startsWith("\uFEFF") ? "\uFEFF" : "";
+        return remaining.slice(0, span.start) + bom + comments + remaining.slice(span.end);
+    }, config);
+}
+async function hasCanonicalProjectHooks(sourcePath, filesystem, finding) {
+    const fail = (reason) => {
+        finding(reason);
+        return false;
+    };
+    if (!/[/\\]\.agents[/\\]config[/\\]agents[/\\]catalog\.yaml$/.test(sourcePath))
+        return fail("catalog-path");
+    const root = resolve(dirname(sourcePath), "../../..");
+    try {
+        const project = parse(await filesystem.readFile(join(root, ".agents/config/project.yaml"), "utf8"));
+        if (project?.zaip?.enabled !== true)
+            return fail("project-disabled");
+        const config = await filesystem.readFile(join(root, ".codex/config.toml"), "utf8");
+        const features = tomlTables(config).filter(({ text }) => /^\s*\[features\]\s*(?:#.*)?$/.test(text));
+        const feature = features[0];
+        if (features.length !== 1 || feature === undefined)
+            return fail("features-table");
+        const hooks = tomlStatements(config.slice(feature.start, feature.end)).filter(({ text }) => /^\s*hooks\s*=/.test(text));
+        if (hooks.length !== 1 || !/^\s*hooks\s*=\s*true\s*(?:#.*)?$/.test(hooks[0]?.text ?? ""))
+            return fail("hooks-disabled-or-ambiguous");
+        const expected = adapterFiles(root);
+        const expectedConfig = expected.find((file) => file.path === ".codex/config.toml")?.content;
+        if (expectedConfig === undefined)
+            return fail("expected-config-missing");
+        const expectedTables = tomlTables(expectedConfig);
+        const installedTables = tomlTables(config);
+        const normalizeWindowsCommand = (text) => [
+            "zaip-pre-tool-use.mjs",
+            "zaip-conversation-lifecycle.mjs",
+            "zaip-subagent-lifecycle.mjs",
+        ].reduce((value, hook) => value.replaceAll(codexWindowsHookCommand(hook), codexWindowsHookCommand(hook, root)), text);
+        const tableContent = (source, table) => tomlStatements(source.slice(table.start, table.end))
+            .filter(({ text }) => text.trim() !== "" && !/^\s*(?:#|statusMessage\s*=)/.test(text))
+            .map(({ text }) => normalizeWindowsCommand(normalizeNewlines(text).trim()))
+            .join("\n");
+        // Verify every migrated event and its executable dependencies before retiring globals.
+        for (const [index, table] of expectedTables.entries()) {
+            const eventName = HOOK_TABLE.exec(table.text)?.[1];
+            if (eventName === undefined)
+                continue;
+            const child = expectedTables[index + 1];
+            if (child === undefined)
+                return fail(`expected-child:${eventName}`);
+            const childHeader = new RegExp(`^\\s*\\[\\[hooks\\.${eventName}\\.hooks\\]\\]`);
+            if (!installedTables.some((candidate, candidateIndex) => {
+                if (tableContent(config, candidate) !== tableContent(expectedConfig, table))
+                    return false;
+                for (let position = candidateIndex + 1; position < installedTables.length; position += 1) {
+                    const installedChild = installedTables[position];
+                    if (installedChild === undefined || !childHeader.test(installedChild.text))
+                        break;
+                    if (tableContent(config, installedChild) === tableContent(expectedConfig, child))
+                        return true;
+                }
+                return false;
+            }))
+                return fail(`event-mismatch:${eventName}`);
+        }
+        for (const file of expected.filter((file) => file.path.startsWith(".codex/hooks/"))) {
+            if (normalizeNewlines(await filesystem.readFile(join(root, file.path), "utf8")) !==
+                normalizeNewlines(file.content))
+                return fail(`executable-mismatch:${file.path}`);
+        }
+        return true;
+    }
+    catch {
+        // Missing/customized hooks require onboarding; never recreate a global fallback.
+        return fail("project-config-or-executable-unreadable");
+    }
+}
 export function stripLegacyRegistrations(config, legacyAgentNames = []) {
     const spans = legacyAgentTableSpans(config, new Set(legacyAgentNames));
     return {
-        content: spans.reduceRight((remaining, span) => remaining.slice(0, span.start) + remaining.slice(span.end), config),
+        content: stripOwnedSpans(config, spans),
         removedRegistrations: spans.length,
     };
 }
 function legacyAgentTableSpans(config, legacyAgentNames) {
-    const tables = [];
-    let offset = 0;
-    let inMultilineBasic = false;
-    let inMultilineLiteral = false;
-    for (const line of config.matchAll(/.*(?:\r?\n|$)/g)) {
-        const text = line[0];
-        if (text.length === 0)
-            continue;
-        if (!inMultilineBasic && !inMultilineLiteral && ANY_TOML_TABLE.test(text)) {
-            const agentName = AGENT_TABLE.exec(text)?.[1];
-            tables.push({
-                start: offset,
-                legacy: agentName !== undefined && legacyAgentNames.has(agentName),
-            });
-        }
-        if (!inMultilineLiteral && hasUnescapedTripleQuote(text, '"""')) {
-            inMultilineBasic = !inMultilineBasic;
-        }
-        if (!inMultilineBasic && hasUnescapedTripleQuote(text, "'''")) {
-            inMultilineLiteral = !inMultilineLiteral;
-        }
-        offset += text.length;
-    }
-    return tables.flatMap((table, index) => table.legacy ? [{ start: table.start, end: tables[index + 1]?.start ?? config.length }] : []);
+    return tomlTables(config).filter(({ text }) => {
+        const agentName = AGENT_TABLE.exec(text)?.[1];
+        return agentName !== undefined && legacyAgentNames.has(agentName);
+    });
 }
 function zaipOwnedHookSpans(config) {
-    const tables = [];
-    let offset = 0;
-    let inMultilineBasic = false;
-    let inMultilineLiteral = false;
-    for (const line of config.matchAll(/.*(?:\r?\n|$)/g)) {
-        const text = line[0];
-        if (text.length === 0)
-            continue;
-        if (!inMultilineBasic && !inMultilineLiteral && ANY_TOML_TABLE.test(text)) {
-            tables.push({ start: offset, text });
-        }
-        if (!inMultilineLiteral && hasUnescapedTripleQuote(text, '"""')) {
-            inMultilineBasic = !inMultilineBasic;
-        }
-        if (!inMultilineBasic && hasUnescapedTripleQuote(text, "'''")) {
-            inMultilineLiteral = !inMultilineLiteral;
-        }
-        offset += text.length;
-    }
+    const tables = tomlTables(config);
     return tables.flatMap((table, index) => {
         const eventName = HOOK_TABLE.exec(table.text)?.[1];
         if (eventName === undefined)
             return [];
-        const childTable = new RegExp(`^\\[\\[hooks\\.${eventName}\\.[^\\]]+\\]\\]`);
+        const childTable = new RegExp(`^\\s*\\[\\[hooks\\.${eventName}\\.[^\\]]+\\]\\]`);
         let boundary = index + 1;
         while (boundary < tables.length && childTable.test(tables[boundary]?.text ?? ""))
             boundary += 1;
@@ -137,7 +202,27 @@ function zaipOwnedHookSpans(config) {
             start: child.start,
             end: siblings[childIndex + 1]?.start ?? end,
         }));
-        const isZaip = (span) => ZAIP_HOOK_SIGNATURES.some((signature) => config.slice(span.start, span.end).includes(signature));
+        const isZaip = (span) => {
+            const commands = tomlStatements(config.slice(span.start, span.end)).filter(({ text }) => /^\s*command(?:_windows)?\s*=/.test(text));
+            return (commands.length > 0 &&
+                commands.every(({ text }) => {
+                    const match = /^\s*command(?:_windows)?\s*=\s*("""[\s\S]*?"""|'''[\s\S]*?'''|"(?:\\.|[^"\\])*"|'[^']*')\s*(?:#.*)?$/.exec(text);
+                    if (match?.[1] === undefined)
+                        return false;
+                    const literal = match[1];
+                    try {
+                        const command = literal.startsWith('"""') || literal.startsWith("'''")
+                            ? literal.slice(3, -3)
+                            : literal.startsWith('"')
+                                ? JSON.parse(literal)
+                                : literal.slice(1, -1);
+                        return isZaipCommand(command);
+                    }
+                    catch {
+                        return false;
+                    }
+                }));
+        };
         if (children.length === 0)
             return isZaip({ start: table.start, end }) ? [{ start: table.start, end }] : [];
         const owned = children.filter(isZaip);
@@ -157,40 +242,73 @@ async function catalogedCodexAliases(sourcePath, filesystem) {
 function normalizeNewlines(value) {
     return value.replaceAll("\r\n", "\n");
 }
-function hasUnescapedTripleQuote(line, quote) {
-    let occurrences = 0;
-    for (let index = line.indexOf(quote); index >= 0; index = line.indexOf(quote, index + 3)) {
-        if (quote === "'''" || line[index - 1] !== "\\")
-            occurrences += 1;
-    }
-    return occurrences % 2 === 1;
+function isZaipCommand(command) {
+    const node = /^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))(?:\s+([^\r\n]*))?$/.exec(command.trim());
+    if (node !== null &&
+        ZAIP_HOOK_PATH.test(node[1] ?? node[2] ?? node[3] ?? "") &&
+        !/[;&|<>]/.test(node[4] ?? ""))
+        return true;
+    const encoded = /^powershell(?:\.exe)?\s+-NoProfile\s+-NonInteractive\s+-EncodedCommand\s+([A-Za-z0-9+/=]+)\s*$/i.exec(command.trim());
+    if (encoded?.[1] === undefined)
+        return false;
+    const script = Buffer.from(encoded[1], "base64").toString("utf16le");
+    const path = /\$hook\s*=\s*Join-Path\s+\$root\s+'([^']+)'/.exec(script)?.[1];
+    if (path === undefined || !ZAIP_HOOK_PATH.test(path))
+        return false;
+    const hook = path.split(/[/\\]/).at(-1) ?? "";
+    const root = /\$search = '((?:''|[^'])*)';/.exec(script)?.[1]?.replaceAll("''", "'");
+    // A matching path inside an arbitrary encoded user script is not ownership proof.
+    return encoded[1] === codexWindowsHookCommand(hook, root).split(" ").at(-1);
 }
-async function replaceConfig(path, content, temporary, backup, filesystem) {
-    let previousConfigMoved = false;
-    await filesystem.mkdir(dirname(path), { recursive: true });
-    await filesystem.rm(temporary, { force: true });
-    await filesystem.rm(backup, { force: true });
-    await filesystem.writeFile(temporary, content, { encoding: "utf8", flag: "wx" });
-    try {
-        await filesystem.rename(path, backup);
-        previousConfigMoved = true;
-    }
-    catch (error) {
-        if (!isMissingFile(error))
-            throw error;
-    }
-    try {
-        await filesystem.rename(temporary, path);
-    }
-    catch (error) {
-        if (previousConfigMoved)
-            await filesystem.rename(backup, path);
-        throw error;
-    }
-    if (previousConfigMoved)
-        await filesystem.rm(backup, { force: true });
+function tomlTables(config) {
+    const tables = tomlStatements(config).filter(({ text }) => ANY_TOML_TABLE.test(text));
+    return tables.map((table, index) => ({
+        ...table,
+        end: tables[index + 1]?.start ?? config.length,
+    }));
 }
-function isMissingFile(error) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+/** Keep table-looking text, comments and assignments inside strings out of ownership checks. */
+function tomlStatements(config) {
+    const statements = [];
+    let quote = "";
+    let nesting = 0;
+    let start = 0;
+    let offset = 0;
+    for (const match of config.matchAll(/.*(?:\r?\n|$)/g)) {
+        const line = match[0];
+        if (!line)
+            continue;
+        if (!quote && nesting === 0)
+            start = offset;
+        for (let index = 0; index < line.length; index += 1) {
+            if (quote) {
+                if (quote.startsWith('"') && line[index] === "\\") {
+                    index += 1;
+                    continue;
+                }
+                if (line.startsWith(quote, index)) {
+                    index += quote.length - 1;
+                    quote = "";
+                }
+            }
+            else {
+                if (line[index] === "#")
+                    break;
+                const character = line[index];
+                if (character === '"' || character === "'") {
+                    quote = line.startsWith(character.repeat(3), index) ? character.repeat(3) : character;
+                    index += quote.length - 1;
+                }
+                if (line[index] === "[" || line[index] === "{")
+                    nesting += 1;
+                if (line[index] === "]" || line[index] === "}")
+                    nesting -= 1;
+            }
+        }
+        offset += line.length;
+        if (!quote && nesting === 0)
+            statements.push({ start, end: offset, text: config.slice(start, offset).trimEnd() });
+    }
+    return statements;
 }
 //# sourceMappingURL=global-codex-config.js.map