@zaip-ai/cli 4.4.0 → 4.6.0

package/README.md

@@ -226,3 +226,5 @@ Run `corepack pnpm verify` from `public-cli` before submitting a change. The pac
 uses `SEE LICENSE IN LICENSE`; the bundled [LICENSE](LICENSE) carries the proprietary
 ZAIP-AIOS Commercial License notice. Consult that file for the applicable terms, npm for
 the published version, and the release evidence for the qualification status.
+
+Repository source v4.5 defines a shared writer claim for serial Tasks, limited parallel worktrees, recoverable isolated checkout closure, a current-release manifest and exact-SHA pre-main CI for critical/builder release delivery. The packaged CLI must pass template/runtime parity and installation qualification before those source rules are treated as an installed version.

package/dist/services/adapters.d.ts

@@ -1,6 +1,6 @@
 import { type PublicAgentCatalog } from "./agent-adapters.js";
 export { isManagedAdapter } from "./managed-adapter.js";
-export declare const ADAPTERS_VERSION = "4.4.0";
+export declare const ADAPTERS_VERSION = "4.6.0";
 export interface AdapterFile {
     path: string;
     content: string;

package/dist/services/adapters.js

@@ -11,7 +11,7 @@ export { isManagedAdapter } from "./managed-adapter.js";
 import { CODEX_GITHUB_DEPLOY_RULES, CODEX_SECURITY_RULES } from "./codex-rules.js";
 import { codexWindowsHookCommand } from "./codex-windows-hook-command.js";
 import { applyTransactionalChanges, assertSafeDestination } from "./transactional-files.js";
-export const ADAPTERS_VERSION = "4.4.0";
+export const ADAPTERS_VERSION = "4.6.0";
 const ROOT_GUIDANCE = `# ZAIP-AIOS
 
 Read \`.agents/config/project.yaml\` first. Apply ZAIP only for literal boolean \`zaip.enabled: true\`, except framework maintenance or \`zaip enable\`. \`AGENTS.md\` is a bootstrap; canonical guidance lives in \`.agents/\`.
@@ -185,9 +185,9 @@ const CLAUDE_SETTINGS = `{
 `;
 export function adapterFiles(workspaceRoot, catalog) {
     const codexConfig = CODEX_CONFIG.replaceAll(CODEX_WORKSPACE_ROOT_PLACEHOLDER, JSON.stringify(resolve(workspaceRoot)))
-        .replaceAll("__ZAIP_WINDOWS_PRE_TOOL_HOOK__", codexWindowsHookCommand("zaip-pre-tool-use.mjs", workspaceRoot))
-        .replaceAll("__ZAIP_WINDOWS_CONVERSATION_HOOK__", codexWindowsHookCommand("zaip-conversation-lifecycle.mjs", workspaceRoot))
-        .replaceAll("__ZAIP_WINDOWS_SUBAGENT_HOOK__", codexWindowsHookCommand("zaip-subagent-lifecycle.mjs", workspaceRoot));
+        .replaceAll("__ZAIP_WINDOWS_PRE_TOOL_HOOK__", codexWindowsHookCommand("zaip-pre-tool-use.mjs"))
+        .replaceAll("__ZAIP_WINDOWS_CONVERSATION_HOOK__", codexWindowsHookCommand("zaip-conversation-lifecycle.mjs"))
+        .replaceAll("__ZAIP_WINDOWS_SUBAGENT_HOOK__", codexWindowsHookCommand("zaip-subagent-lifecycle.mjs"));
     return [
         ...(catalog === undefined
             ? []

package/dist/services/adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,mBAAmB,EACnB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAEhB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAOxC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;CAcrB,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAA4B;IACtD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC;IACvF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,CAC1B,8YAA8Y,EAC9Y,qlCAAqlC,CACtlC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG;;;;;;;;;;;;;;CAcvB,CAAC;AAEF,MAAM,+BAA+B,GAAG;;;;CAIvC,CAAC;AAEF,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;6CAgBwB,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoG5E,CAAC;AAEF,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,CAAC,WAAW,CAAU,CAAC;AAExD,MAAM,eAAe,GAAG;;;;;;CAMvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,OAA4B;IAE5B,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CACzC,gCAAgC,EAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CACvC;SACE,UAAU,CACT,gCAAgC,EAChC,uBAAuB,CAAC,uBAAuB,EAAE,aAAa,CAAC,CAChE;SACA,UAAU,CACT,oCAAoC,EACpC,uBAAuB,CAAC,iCAAiC,EAAE,aAAa,CAAC,CAC1E;SACA,UAAU,CACT,gCAAgC,EAChC,uBAAuB,CAAC,6BAA6B,EAAE,aAAa,CAAC,CACtE,CAAC;IACJ,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,CACL,sCAAsC,EACtC,uBAAuB,CAAC,OAAO,CAAC,EAChC,iBAAiB,CAClB;aACF,CAAC;QACN,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;QAClE,OAAO,CAAC,kCAAkC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAC/E,OAAO,CAAC,mCAAmC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAChF,OAAO,CACL,4CAA4C,EAC5C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,6CAA6C,EAC7C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,oBAAoB,EACpB,GAAG,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,EAChF,cAAc,CACf;QACD,OAAO,CAAC,uCAAuC,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAChG,OAAO,CAAC,oCAAoC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACvF,OAAO,CACL,wCAAwC,EACxC,2BAA2B,EAC3B,sBAAsB,CACvB;QACD,OAAO,CACL,6CAA6C,EAC7C,gCAAgC,EAChC,6BAA6B,CAC9B;QACD,OAAO,CACL,8CAA8C,EAC9C,iCAAiC,EACjC,mCAAmC,CACpC;QACD,OAAO,CACL,0CAA0C,EAC1C,6BAA6B,EAC7B,+BAA+B,CAChC;QACD,OAAO,CACL,uCAAuC,EACvC,yBAAyB,EACzB,2BAA2B,CAC5B;QACD,OAAO,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;QACzF,OAAO,CAAC,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAI9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,KAAK,GAAG,KAAK;IAEb,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAgD,EAAE,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACjF,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,uBAAuB,CACrC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IACzD,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,mBAAmB,EACnB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAEhB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAOxC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;CAcrB,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAA4B;IACtD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC;IACvF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,CAC1B,8YAA8Y,EAC9Y,qlCAAqlC,CACtlC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG;;;;;;;;;;;;;;CAcvB,CAAC;AAEF,MAAM,+BAA+B,GAAG;;;;CAIvC,CAAC;AAEF,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;6CAgBwB,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoG5E,CAAC;AAEF,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,CAAC,WAAW,CAAU,CAAC;AAExD,MAAM,eAAe,GAAG;;;;;;CAMvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,OAA4B;IAE5B,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CACzC,gCAAgC,EAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CACvC;SACE,UAAU,CACT,gCAAgC,EAChC,uBAAuB,CAAC,uBAAuB,CAAC,CACjD;SACA,UAAU,CACT,oCAAoC,EACpC,uBAAuB,CAAC,iCAAiC,CAAC,CAC3D;SACA,UAAU,CACT,gCAAgC,EAChC,uBAAuB,CAAC,6BAA6B,CAAC,CACvD,CAAC;IACJ,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,CACL,sCAAsC,EACtC,uBAAuB,CAAC,OAAO,CAAC,EAChC,iBAAiB,CAClB;aACF,CAAC;QACN,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;QAClE,OAAO,CAAC,kCAAkC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAC/E,OAAO,CAAC,mCAAmC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAChF,OAAO,CACL,4CAA4C,EAC5C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,6CAA6C,EAC7C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,oBAAoB,EACpB,GAAG,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,EAChF,cAAc,CACf;QACD,OAAO,CAAC,uCAAuC,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAChG,OAAO,CAAC,oCAAoC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACvF,OAAO,CACL,wCAAwC,EACxC,2BAA2B,EAC3B,sBAAsB,CACvB;QACD,OAAO,CACL,6CAA6C,EAC7C,gCAAgC,EAChC,6BAA6B,CAC9B;QACD,OAAO,CACL,8CAA8C,EAC9C,iCAAiC,EACjC,mCAAmC,CACpC;QACD,OAAO,CACL,0CAA0C,EAC1C,6BAA6B,EAC7B,+BAA+B,CAChC;QACD,OAAO,CACL,uCAAuC,EACvC,yBAAyB,EACzB,2BAA2B,CAC5B;QACD,OAAO,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;QACzF,OAAO,CAAC,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAI9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,KAAK,GAAG,KAAK;IAEb,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAgD,EAAE,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACjF,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,uBAAuB,CACrC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IACzD,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC"}

package/dist/services/codex-conversation-lifecycle-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-conversation-lifecycle-hook.d.ts","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,QAsO7C,CAAC"}
+{"version":3,"file":"codex-conversation-lifecycle-hook.d.ts","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,QAyP7C,CAAC"}

package/dist/services/codex-conversation-lifecycle-hook.js

@@ -9,8 +9,9 @@ const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
 let root = hookRoot, local;
 // The host hook stays below 10s. Explicit CLI recovery runs in the active Codex
 // tool session and may finish expensive canonical closure within its own bound.
-const replay = process.argv.length === 3 && process.argv[2] === "--replay-receipt";
-const deadline = Date.now() + (replay ? 45000 : 8000);
+const automatic = process.argv.length === 3 && process.argv[2] === "--recover-previous-turn";
+const replay = automatic || (process.argv.length === 3 && process.argv[2] === "--replay-receipt");
+const deadline = Date.now() + (automatic ? 7000 : replay ? 45000 : 8000);
 const readChunkBytes = 1024 * 1024, maxLineBytes = 8 * 1024 * 1024, maxReadBytes = 16 * 1024 * 1024;
 const hash = value => createHash("sha256").update(value).digest("hex");
 const parse = value => { try { return JSON.parse(value); } catch { return null; } };
@@ -163,10 +164,13 @@ async function selectWorkspace(correlationKey, worktrees) {
 }
 try {
   if (event?.hook_event_name !== "Stop" || !session || !turn || !text(event.cwd)) { reply(); process.exit(0); }
-  const worktrees = await gitWorktrees();
+  // Automatic recovery is already bound to one canonical workspace by intake.
+  // Never discover another worktree or manufacture a historical Conversation.
+  const worktrees = automatic ? [hookRoot] : await gitWorktrees();
+  if (automatic && resolve(event.cwd) !== hookRoot) throw new Error("recovery_workspace_mismatch");
   if (!worktrees.some(candidate => inside(event.cwd, candidate))) { reply(); process.exit(0); }
   const correlationKey = hash(JSON.stringify(["codex", session, turn, null, null]));
-  root = await selectWorkspace(correlationKey, worktrees);
+  root = automatic ? hookRoot : await selectWorkspace(correlationKey, worktrees);
   local = resolve(root, ".local/hooks");
   const config = await readFile(resolve(root, ".agents/config/project.yaml"), "utf8");
   if (!/zaip:\s*\r?\n\s*enabled:\s*true\s*(?:\r?\n|$)/.test(config)) { reply(); process.exit(0); }
@@ -175,13 +179,23 @@ try {
   lease = await acquire(receiptPath + ".lock");
   if (!lease) { await note("stop_worker_busy"); reply(true); process.exit(0); }
   const old = parse(await readFile(receiptPath, "utf8").catch(() => ""));
+  if (automatic) {
+    const info = await lstat(receiptPath);
+    const identity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
+    if (!info.isFile() || info.isSymbolicLink() || identity(await realpath(receiptPath)) !== identity(receiptPath) ||
+        old?.schema_version !== 1 || old.session_id !== session || old.turn_id !== turn ||
+        old.event?.hook_event_name !== "Stop" || old.event.session_id !== session || old.event.turn_id !== turn ||
+        typeof old.event.cwd !== "string" || identity(old.event.cwd) !== identity(root) ||
+        typeof old.event.transcript_path !== "string" || identity(old.event.transcript_path) !== identity(event.transcript_path) ||
+        !["pending", "persisted"].includes(old.state)) throw new Error("recovery_receipt_invalid");
+  }
   receipt = old?.schema_version === 1 && old.session_id === session && old.turn_id === turn ? old : { schema_version: 1, session_id: session, turn_id: turn, state: "pending", attempts: 0 };
   const transcriptPath = text(event.transcript_path) ?? text(receipt.event?.transcript_path);
   receipt.event = { hook_event_name: "Stop", cwd: root, session_id: session, turn_id: turn, transcript_path: transcriptPath, stop_hook_active: true };
   if (receipt.state === "persisted") { reply(); } else {
     receipt.attempts += 1; receipt.state = "pending"; await save(receiptPath, receipt);
     let status = null;
-    for (const delay of [0, 250, 750]) { if (delay) await new Promise(r => setTimeout(r, delay)); status = await terminal(transcriptPath); if (status) break; }
+    for (const delay of automatic ? [0] : [0, 250, 750]) { if (delay) await new Promise(r => setTimeout(r, delay)); status = await terminal(transcriptPath); if (status) break; }
     if (!status) throw new Error("transcript_pending");
     const cli = resolve(root, ".agents/runtime/bin/zaip.mjs");
     const correlation = parse(await readFile(resolve(root, ".local/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
@@ -189,11 +203,13 @@ try {
     if (correlation?.schema_version === 1 && correlation.thread_id === session && correlation.turn_id === turn && correlation.agent_path === null && typeof correlation.run_id === "string") {
       intake = { run: { run_id: correlation.run_id }, task: correlation.task_id === null ? null : { id: correlation.task_id } };
     } else {
+      if (automatic) throw new Error("recovery_correlation_missing");
       const started = await call(cli, ["conversation", "start", "--intent", "conversation"], transcriptPath);
       if (started.code !== 0) throw new Error("start_pending");
       intake = parse(started.out);
     }
     const run = intake?.run?.run_id;
+    if (automatic && receipt.run_id !== undefined && receipt.run_id !== run) throw new Error("recovery_run_mismatch");
     if (typeof run !== "string" || (intake.task !== null && typeof intake.task?.id !== "string")) throw new Error("start_pending");
     receipt.run_id = run; await save(receiptPath, receipt);
     const result = await call(cli, ["subagent", "reconcile-stop", "--session", session, "--turn", turn], transcriptPath);
@@ -203,6 +219,9 @@ try {
       ? outcome?.run?.id === run && terminalStates.includes(outcome.run.status) && typeof outcome.run.finished_at === "string"
       : outcome?.status === "closed" && outcome.parent_run_id === run && outcome.reconciliation?.tasks?.some(task => task.id === intake.task.id && terminalStates.includes(task.status));
     if (result.code !== 0 || !closed) throw new Error("closure_pending");
+    if (automatic && intake.task !== null &&
+        (!outcome.finalization_decision || (outcome.finalization_decision.outcome === "completed" && outcome.finalization_barrier?.satisfied !== true)))
+      throw new Error("closure_gates_pending");
     if (intake.task !== null && status === "completed") {
       const shown = await call(cli, ["task", "recovery-status", intake.task.id], transcriptPath);
       const recovery = parse(shown.out);

package/dist/services/codex-conversation-lifecycle-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsO1D,CAAC"}
+{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyP1D,CAAC"}

package/dist/services/codex-native-tool-authority-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QAsFT,CAAC"}
+{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QA0QT,CAAC"}

package/dist/services/codex-native-tool-authority-template.js

@@ -1,7 +1,92 @@
 import { CODEX_VALIDATION_RUNTIME_SUPPORT } from "./codex-validation-runtime-template.js";
-export const CODEX_NATIVE_TOOL_AUTHORITY_HOOK = String.raw `import { createHash } from "node:crypto";
-import { lstat, realpath } from "node:fs/promises";
+export const CODEX_NATIVE_TOOL_AUTHORITY_HOOK = String.raw `import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+// Run starts remain JSON objects; subsequent canonical v3 events are compact arrays.
+// Decode only identity/terminal fields needed for authority, never infer a Run.
+export function readAuthorityRunRecords(text, id) {
+  if (typeof text !== "string" || !text.endsWith("\n")) throw new Error("incomplete_run");
+  const types = { f: "run.finished", d: "run.finalization.decided", a: "run.attribution.recovered", m: "model.selection.recorded", p: "provider.invocation.finished", c: "model.call.observed", u: "usage.recorded" };
+  const records = text.split(/\r?\n/).filter(Boolean).map((line, index) => {
+    const value = JSON.parse(line);
+    const record = Array.isArray(value)
+      ? value[0] === 3 && Object.hasOwn(types, value[1]) && value.length >= 7
+        ? { schema_version: 2, type: types[value[1]], event_id: value[2], sequence: value[3], run_id: id }
+        : null
+      : value;
+    if (!record || record.schema_version !== 2 || record.run_id !== id || record.sequence !== index + 1 ||
+        ((Array.isArray(value) || record.event_id !== undefined) && record.event_id !== id + ":" + String(index + 1).padStart(6, "0")) ||
+        typeof record.type !== "string" || (index === 0 ? record.type !== "run.started" : record.type === "run.started"))
+      throw new Error("invalid_run_identity");
+    return record;
+  });
+  if (!records.length) throw new Error("empty_run");
+  return records;
+}
+
+export function checkDestructivePatterns(command, patterns, deny) {
+  if (/^(?:Write-Output|echo|printf)\s+'(?:[^']|'')*'\s*$/i.test(command)) return;
+  for (const entry of patterns) if (entry.pattern.test(command)) deny(entry.reason);
+}
+export async function configuredDeploymentBranches(repositoryRoot, deny) {
+  const defaults = { applicationBranches: ["beta"], scopeBranches: { frontend: "beta", backend: "beta" }, productionBranch: "main" };
+  let source;
+  try {
+    source = await readFile(resolve(repositoryRoot, ".agents/config/project.yaml"), "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return defaults;
+    deny("Could not read project.yaml deploy policy.");
+  }
+  let document;
+  try {
+    const parser = await import(
+      pathToFileURL(
+        resolve(repositoryRoot, ".agents/skills/zaip-skill-github-deploy/scripts/yaml-parser.mjs"),
+      ).href,
+    );
+    document = parser.parseDocument(source, { strict: true, uniqueKeys: true });
+  } catch {
+    deny("Canonical deploy YAML parser is unavailable.");
+  }
+  if (document.errors.length > 0) deny("project.yaml deploy policy is malformed.");
+  const config = document.toJS();
+  if (config === null || typeof config !== "object" || Array.isArray(config)) {
+    deny("project.yaml must contain a mapping.");
+  }
+  const deploy = config.deploy;
+  if (deploy === undefined) return defaults;
+  if (deploy === null || typeof deploy !== "object" || Array.isArray(deploy)) {
+    deny("project.yaml deploy must be a mapping.");
+  }
+  if (!Object.keys(deploy).every((key) => ["branch", "production_branch", "allow_production", "frontend", "backend", "database"].includes(key))) {
+    deny("project.yaml deploy has unsupported keys.");
+  }
+  for (const key of ["frontend", "backend", "database"]) {
+    if (deploy[key] !== undefined && (deploy[key] === null || typeof deploy[key] !== "object" || Array.isArray(deploy[key]) || !Object.keys(deploy[key]).every((nested) => nested === "branch"))) deny("project.yaml deploy scope is invalid.");
+  }
+  const productionBranch = Object.hasOwn(deploy, "production_branch")
+    ? deploy.production_branch
+    : defaults.productionBranch;
+  const frontend = deploy.frontend !== undefined && Object.hasOwn(deploy.frontend, "branch") ? deploy.frontend.branch : "beta";
+  const backend = deploy.backend !== undefined && Object.hasOwn(deploy.backend, "branch") ? deploy.backend.branch : "beta";
+  const database = deploy.database !== undefined && Object.hasOwn(deploy.database, "branch") ? deploy.database.branch : "beta";
+  if (database !== "beta") deny("project.yaml deploy.database.branch must be beta.");
+  if (
+    !isSafeBranchName(frontend) ||
+    !isSafeBranchName(backend) ||
+    !isSafeBranchName(productionBranch) ||
+    (frontend !== "main" && frontend === productionBranch) ||
+    (backend !== "main" && backend === productionBranch)
+  ) {
+    deny("project.yaml application deploy policy is invalid.");
+  }
+  return { applicationBranches: [...new Set([frontend, backend])], scopeBranches: { frontend, backend }, productionBranch };
+}
+function isSafeBranchName(branch) {
+  return typeof branch === "string" && branch.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && !branch.endsWith(".") && !branch.endsWith("/") && !branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"));
+}
 const inside = (path, root) => { const scoped = relative(root, resolve(path)); return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped)); };
 const authorityPath = path => /^(?:\.agents\/(?:records|data\/runs)\/|\.local\/(?:codex-hook-|codex-telemetry-spool\/|runs\/))/i.test(path.replaceAll("\\", "/"));
 /** Inspect existing ancestors too: a missing destination can still traverse a junction. */
@@ -34,13 +119,14 @@ async function canonicalScopes(id, root, boundedRead) {
   });
 }
 /** Validate only this native child's patch scope and its still-active canonical ancestry. */
-export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead) {
+export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead, authorityRoot = repositoryRoot) {
   if (event.tool_name !== "apply_patch" || typeof event.session_id !== "string" || typeof event.turn_id !== "string") return false;
   try {
     const key = createHash("sha256").update(JSON.stringify([event.session_id, event.turn_id])).digest("hex");
-    const binding = JSON.parse(await boundedRead(resolve(repositoryRoot, ".local/codex-hook-native/v2", key + ".json"), 65536));
+    const binding = JSON.parse(await boundedRead(resolve(authorityRoot, ".local/codex-hook-native/v2", key + ".json"), 65536));
     if (binding.schema_version !== 2 || binding.session_id !== event.session_id || binding.turn_id !== event.turn_id ||
-        typeof binding.native_session_id !== "string" || ![binding.native_session_id, binding.parent_session_id].includes(event.session_id) ||
+        typeof binding.native_session_id !== "string" ||
+        ![binding.native_session_id, binding.parent_session_id, binding.host_session_id].includes(event.session_id) ||
         !Array.isArray(binding.write_scopes) || !binding.write_scopes.length) return false;
     const readRun = async id => {
       const match = typeof id === "string" && /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id);
@@ -48,30 +134,42 @@ export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead
       let text;
       for (const directory of [match[1] + "/" + match[2], match[1] + "/" + match[2] + "/" + match[3]]) {
         try {
-          const value = await boundedRead(resolve(repositoryRoot, ".agents/records/runs", directory, id + ".jsonl"), 8388608);
+          const value = await boundedRead(resolve(authorityRoot, ".agents/records/runs", directory, id + ".jsonl"), 8388608);
           if (text !== undefined) throw new Error("ambiguous_run");
           text = value;
         } catch (error) { if (error.code !== "ENOENT") throw error; }
       }
       if (!text?.endsWith("\n")) throw new Error("incomplete_run");
-      const records = text.split(/\r?\n/).filter(Boolean).map(JSON.parse);
+      const records = readAuthorityRunRecords(text, id);
       if (records.some((row, i) => row.schema_version !== 2 || row.sequence !== i + 1 || row.run_id !== id ||
           row.type === "run.finished" || row.type === "run.finalization.decided")) throw new Error("inactive_run");
       if (records[0]?.type !== "run.started") throw new Error("invalid_run");
       return records[0];
     };
     const child = await readRun(binding.run_id), parent = await readRun(binding.parent_run_id);
+    const macro = parent.parent_run_id === null ? null : await readRun(parent.parent_run_id);
+    const ownTaskRoot = parent.parent_run_id === null && parent.run_role === "orchestrator";
+    const delegatedTaskOrchestrator = macro !== null &&
+      parent.run_role === "subagent" && parent.run_purpose === "orchestration" &&
+      parent.entrypoint === "task" && typeof parent.spec_id === "string" &&
+      macro.agent === "agent-orchestrator" && macro.run_role === "orchestrator" &&
+      macro.parent_run_id === null && macro.entrypoint === "spec" &&
+      macro.task_id === null && macro.spec_id === parent.spec_id &&
+      macro.execution_id === parent.execution_id &&
+      child.spec_id === parent.spec_id && child.change_id === parent.change_id;
+    if (binding.host_session_id !== undefined &&
+        binding.host_session_id !== (macro === null ? parent.client_thread_id : macro.client_thread_id)) return false;
     if (child.client !== "codex-subagent" || child.run_role !== "subagent" || child.run_purpose !== "execution" ||
         !child.execution_eligibility?.includes("delivery") || child.parent_run_id !== parent.run_id ||
         child.client_thread_id !== binding.agent_id || child.client_turn_id !== event.turn_id ||
-        parent.agent !== "agent-orchestrator" || parent.run_role !== "orchestrator" || parent.parent_run_id !== null ||
+        parent.agent !== "agent-orchestrator" || !(ownTaskRoot || delegatedTaskOrchestrator) ||
         parent.client_thread_id !== binding.parent_session_id ||
         parent.entrypoint !== "task" || !binding.task_id || !binding.execution_id ||
         child.task_id !== binding.task_id || parent.task_id !== binding.task_id ||
         child.execution_id !== binding.execution_id || parent.execution_id !== binding.execution_id) return false;
     const command = event.tool_input?.command;
     if (typeof command !== "string") return false;
-    const scopes = await canonicalScopes(binding.task_id, repositoryRoot, boundedRead);
+    const scopes = await canonicalScopes(binding.task_id, authorityRoot, boundedRead);
     if (JSON.stringify(scopes) !== JSON.stringify(binding.write_scopes)) return false;
     const paths = [...command.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)].map(match => match[1].trim());
     for (const path of paths) if (!await isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) return false;
@@ -85,5 +183,86 @@ export async function hasNativeDelegatedPatch(event, repositoryRoot, boundedRead
     });
   } catch { return false; }
 }
+export async function hasCurrentTaskOrchestratorRun(event, installedRoot, boundedRead) {
+  const threadId = event.session_id, turnId = event.turn_id;
+  if (typeof threadId !== "string" || typeof turnId !== "string" || !threadId || !turnId) return false;
+  if ((process.env.CODEX_THREAD_ID && threadId !== process.env.CODEX_THREAD_ID) ||
+      (process.env.CODEX_TURN_ID && turnId !== process.env.CODEX_TURN_ID)) return false;
+  try {
+    const digest = createHash("sha256").update(JSON.stringify(["codex", threadId, turnId, null, null])).digest("hex");
+    const correlation = JSON.parse(await boundedRead(resolve(installedRoot, ".local/codex-telemetry-spool/v1/correlations", digest + ".json"), 65536, installedRoot));
+    const id = correlation.run_id;
+    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id) : null;
+    if (!dated || correlation.schema_version !== 1 || correlation.thread_id !== threadId || correlation.turn_id !== turnId || correlation.agent_path !== null) return false;
+    const candidates = [
+      ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
+      ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + dated[3] + "/" + id + ".jsonl",
+      ".agents/data/runs/" + dated[1] + "/" + dated[2] + "/" + dated[3] + "/" + id + ".jsonl",
+      ".local/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
+    ];
+    let selected = null;
+    for (const candidate of candidates) {
+      try {
+        const source = await boundedRead(resolve(installedRoot, candidate), 8388608, installedRoot);
+        if (selected !== null) return false;
+        selected = source;
+      } catch (error) { if (error.code !== "ENOENT") return false; }
+    }
+    if (selected === null || !selected.endsWith("\n")) return false;
+    const records = readAuthorityRunRecords(selected, id), started = records[0];
+    if (records.some((record, i) => record.run_id !== id || record.sequence !== i + 1 || record.schema_version !== 2)) return false;
+    const valid = started?.type === "run.started" && started.client_thread_id === threadId && started.client_turn_id === turnId &&
+      ["codex", "codex-desktop"].includes(started.client) && started.phase === "execution" &&
+      typeof started.task_id === "string" && started.task_id.startsWith("TASK-") &&
+      typeof started.execution_id === "string" && started.execution_id.startsWith("EXEC-") &&
+      started.agent === "agent-orchestrator" && started.run_role === "orchestrator" && started.parent_run_id === null && started.entrypoint === "task" &&
+      correlation.task_id === started.task_id && correlation.execution_id === started.execution_id &&
+      !records.some(record => record.type === "run.finished" || record.type === "run.finalization.decided");
+    return valid ? started : false;
+  } catch { return false; }
+}
+
+/** A Task's product writer is claimed centrally before any edit. */
+function isolatedGitMatchesClaim(repositoryRoot, authorityRoot, claim) {
+  const git = (root, args) => execFileSync("git", ["-C", root, ...args], {
+    encoding: "utf8", windowsHide: true, timeout: 15000,
+    env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^(GIT_|NODE_OPTIONS$)/i.test(key))),
+  }).trim();
+  if (resolve(git(repositoryRoot, ["rev-parse", "--show-toplevel"])) !== resolve(repositoryRoot) ||
+      git(repositoryRoot, ["branch", "--show-current"]) !== claim.branch) return false;
+  const head = git(repositoryRoot, ["rev-parse", "HEAD"]);
+  if (head !== git(authorityRoot, ["rev-parse", claim.branch])) return false;
+  return git(authorityRoot, ["worktree", "list", "--porcelain"]).split(/\r?\n\r?\n/).some(block => {
+    const lines = block.split(/\r?\n/);
+    return lines.some(line => line.startsWith("worktree ") && resolve(line.slice(9)) === resolve(repositoryRoot)) &&
+      lines.includes("HEAD " + head) && lines.includes("branch refs/heads/" + claim.branch);
+  });
+}
+export async function hasClaimedTaskWriter(event, repositoryRoot, boundedRead, directRun = null, authorityRoot = repositoryRoot) {
+  try {
+    let runId = directRun?.run_id, taskId = directRun?.task_id, executionId = directRun?.execution_id;
+    if (!runId) {
+      const key = createHash("sha256").update(JSON.stringify([event.session_id, event.turn_id])).digest("hex");
+      const binding = JSON.parse(await boundedRead(resolve(authorityRoot, ".local/codex-hook-native/v2", key + ".json"), 65536));
+      if (binding.session_id !== event.session_id || binding.turn_id !== event.turn_id) return false;
+      runId = binding.parent_run_id; taskId = binding.task_id; executionId = binding.execution_id;
+    }
+    if (!/^RUN-[A-Z0-9-]+$/.test(runId ?? "") || !/^TASK-[A-Z0-9-]+$/.test(taskId ?? "") ||
+        !/^EXEC-[A-Z0-9-]+$/.test(executionId ?? "")) return false;
+    const source = await boundedRead(resolve(authorityRoot, ".local/task-workspaces/shared-writer.json"), 65536).catch(() => null);
+    const claim = source === null ? null : JSON.parse(source);
+    if (claim?.mode === "shared" && claim.status === "ready" && claim.branch === null &&
+      claim.run_id === runId && claim.task_id === taskId && claim.execution_id === executionId &&
+      resolve(claim.path) === resolve(authorityRoot) && resolve(repositoryRoot) === resolve(authorityRoot) &&
+      resolve(claim.canonical_workspace) === resolve(authorityRoot)) return true;
+    const isolated = JSON.parse(await boundedRead(resolve(authorityRoot, ".local/task-workspaces/claims", taskId + ".json"), 65536));
+    return isolated.status === "ready" && isolated.mode !== "shared" &&
+      isolated.run_id === runId && isolated.task_id === taskId && isolated.execution_id === executionId &&
+      typeof isolated.branch === "string" && isolated.branch.startsWith("codex/") &&
+      resolve(isolated.path) === resolve(repositoryRoot) &&
+      resolve(isolated.canonical_workspace) === resolve(authorityRoot) &&
+      isolatedGitMatchesClaim(repositoryRoot, authorityRoot, isolated);
+  } catch { return false; }
+}
 ` + CODEX_VALIDATION_RUNTIME_SUPPORT;
 //# sourceMappingURL=codex-native-tool-authority-template.js.map

package/dist/services/codex-native-tool-authority-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFzD,GAAG,gCAAgC,CAAC"}
+{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyQX,GAAG,gCAAgC,CAAC"}

package/dist/services/codex-pre-tool-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QAouB/B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,QAqpB/B,CAAC"}