@zaip-ai/cli 4.8.0 → 5.0.0

package/dist/services/codex-pre-tool-hook-template.js

@@ -5,15 +5,18 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { captureCliTurn, checkDestructivePatterns, configuredDeploymentBranches, gitInvocation, inside, isLiteralReadSequence, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { captureCliTurn, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, gitInvocation, inside, isLiteralReadSequence, parseHookEvent, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
 const execute = promisify(execFile);
 const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
 const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
 const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 let repositoryRoot = installedRoot;
+let principalFullAccess = false;
+let principalFullNetwork = false;
 const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
 const allowedExplicitNetworkHosts = new Set([
-  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "::1",
+  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
 ]);
 const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
 const cloudRunnerScript = ".agents/tools/cloud-runner.mjs";
@@ -32,6 +35,10 @@ const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPAT
 const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:\.[A-Za-z0-9_-]+)*(?:[\\/\s"']|$)/i;
 const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
 const destructivePatterns = [
+  {
+    pattern: /\b(?:Restart-Computer|Stop-Computer|Restart-Host|shutdown(?:\.exe)?|reboot|poweroff|halt|Suspend-Computer|hibernate|logoff|Win32Shutdown)\b/i,
+    reason: "Local computer restart, shutdown, suspension, hibernation and session termination are blocked.",
+  },
   {
     pattern: /\b(?:Clear-Content|shred)\b/i,
     reason: "Unbounded content destruction is blocked.",
@@ -148,7 +155,7 @@ function repositoryPath(path) {
 }
 function isGitPath(path) {
   const scoped = repositoryPath(path).toLowerCase();
-  return scoped === ".git" || scoped.startsWith(".git/");
+  return scoped.split("/").includes(".git");
 }
 
 function unquote(value) {
@@ -172,7 +179,18 @@ function explicitPathCandidates(command) {
   }
   return [...candidates].map(unquote).filter(Boolean);
 }
-function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
+async function assertCanonicalLiteralPath(path, cwd = repositoryRoot) {
+  if (path.split(/[\\/]/).includes("..")) deny("Filesystem traversal is blocked.");
+  for (let cursor = resolve(cwd, path);; cursor = dirname(cursor)) {
+    try {
+      const info = await lstat(cursor);
+      if (info.isSymbolicLink() || (await realpath(cursor)).toLowerCase() !== cursor.toLowerCase())
+        deny("Filesystem links and aliases are blocked.");
+    } catch (error) { if (error?.code !== "ENOENT") deny("Filesystem path could not be safely verified."); }
+    if (dirname(cursor) === cursor) break;
+  }
+}
+async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
   const checked = reviewedPaths.reduce((text, path) => text.replaceAll(path, "REVIEWED_RELEASE_PATH"), command);
   if (homeReferencePattern.test(checked)) {
     deny("Direct user-profile path references are blocked; use repository-scoped paths.");
@@ -180,7 +198,7 @@ function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = [])
   if (credentialReferencePattern.test(checked) || sensitiveEnvironmentPattern.test(checked)) {
     deny("Direct credential and secret access is blocked.");
   }
-  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
+  if (/\b(?:Get-ChildItem|gci|dir|Get-Item|gi)(?:\s+-(?:LiteralPath|Path))?\s+(?:Env|Variable|Function|Alias):|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
     deny("Bulk environment enumeration is blocked.");
   }
   if (/(?:^|[\s"'=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(?:(?:\\\\){1,2}|\/\/)[^\\/\s"']+[\\/]/.test(checked)) {
@@ -191,13 +209,16 @@ function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = [])
     ? checked.replace(/(^|\s)--(?:agent-id|parent-agent-id)\s+\/root(?:\/[a-z][a-z0-9_]*_zaip_agent(?:_[a-z0-9]+)?)+(?=\s|$)/g, "$1--native-agent-id zaip-agent")
     : checked; if (/[\r\n]/.test(checked)) deny("Multiline shell commands are blocked.");
   for (const match of osPathCommand.matchAll(/(["'])(\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:\/[^\r\n]*?)?)\1|(?:^|[\s=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:\/[^\s"'\x60;,)|&]*)?)/gi)) {
-    const path = match[2] ?? match[3], before = osPathCommand[match.index - 1] ?? "", after = osPathCommand[match.index + match[0].length] ?? "", jsonPath = /(?:^|\s)'\{"path":$/.test(osPathCommand.slice(0, match.index)) && /^}'(?:\s|$)/.test(osPathCommand.slice(match.index + match[0].length)); if (jsonPath) { if (path.includes("\\") || !isWithinRepository(resolve(path))) deny("Explicit filesystem path escapes the repository boundary."); continue; }
+    const path = match[2] ?? match[3], before = osPathCommand[match.index - 1] ?? "", after = osPathCommand[match.index + match[0].length] ?? "", jsonPath = /(?:^|\s)'\{"path":$/.test(osPathCommand.slice(0, match.index)) && /^}'(?:\s|$)/.test(osPathCommand.slice(match.index + match[0].length));
+    if (principalFullAccess) { await assertCanonicalLiteralPath(path); continue; }
+    if (jsonPath) { if (path.includes("\\") || !isWithinRepository(resolve(path))) deny("Explicit filesystem path escapes the repository boundary."); continue; }
     if (path.includes("\\") || !isWithinRepository(resolve(path)) || (match[2] && before && !(/\s/.test(before) || before === "=" || jsonPath)) || (after && !/\s/.test(after) && !jsonPath)) deny("Explicit operating-system paths outside the repository are blocked.");
   }
   if (process.platform === "win32" && /(?:^|[\s"'=(,])\\(?!\\)[^\s\\/"'<>|;]+(?:\\[^\s"'<>|;]+|\.[A-Za-z0-9]{1,10})/.test(checked)) {
     deny("Drive-rooted filesystem paths outside the repository are blocked.");
   }
   for (const candidate of explicitPathCandidates(checked)) {
+    if (principalFullAccess) { await assertCanonicalLiteralPath(candidate, cwd); continue; }
     if (process.platform !== "win32" && /^[A-Za-z]:[\\/]/.test(candidate)) deny("Explicit filesystem path escapes the repository boundary.");
     const absolute = resolve(cwd, candidate);
     if (!isWithinRepository(absolute)) {
@@ -206,15 +227,20 @@ function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = [])
   }
 }
 async function validateGitPublication(command) {
-  if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
+  const tokens = tokenizeLiteralCommand(command);
+  if (tokens !== null) {
+    const launcher = tokens[0]?.toLowerCase();
+    if (((launcher === "env" || launcher === "command") && /^git(?:\.exe)?$/i.test(tokens[1] ?? "")) ||
+        (/^(?:Set-Alias|New-Alias)$/i.test(launcher ?? "") && tokens.slice(1).some(token => /^git(?:\.exe)?$/i.test(token))))
+      deny("Indirect Git execution is blocked; use a single literal command.");
+  } else if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
       /&\s*\(\s*Get-Command\s+git(?:\.exe)?\b/i.test(command) ||
       /(?:^|[\s;&|])&\s*\$[A-Za-z_]/i.test(command) || /\b(?:Set-Alias|New-Alias)\b[^\r\n;]*\bgit\b/i.test(command)) {
     deny("Indirect Git execution is blocked; use a single literal command.");
   }
-  if (/\(\s*git(?:\.exe)?\b/i.test(command)) {
+  if (tokens === null && /\(\s*git(?:\.exe)?\b/i.test(command)) {
     deny("Nested Git execution is blocked; use a single literal command.");
   }
-  const tokens = tokenizeLiteralCommand(command);
   if (tokens === null) {
     if (/(?:^|[;&|\r\n(])\s*git(?:\.exe)?\b/i.test(command)) {
       deny("Git commands must be a single literal command; separate commands before requesting execution.");
@@ -276,6 +302,33 @@ async function validateGitPublication(command) {
   }
 }
 
+function validateHashicorpRead(command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:curl(?:\.exe)?|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)$/i.test(tokens[0]))
+    deny("HashiCorp releases require a literal supported read command.");
+  let urlCount = 0;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (/^https:\/\//i.test(token)) {
+      const url = new URL(token);
+      if (url.hostname !== "releases.hashicorp.com" || url.username || url.password || url.port)
+        deny("HashiCorp reads require one exact HTTPS destination.");
+      urlCount++; continue;
+    }
+    if (["-I", "--head", "-s", "-S", "-sS", "--silent", "--show-error", "--fail", "-q", "--disable"].includes(token)) continue;
+    const namedMethod = /^(?:--request|--method|-Method)(?:=(.*))?$/i.exec(token);
+    const curlMethod = /^-X(.*)$/.exec(token);
+    if (namedMethod || curlMethod) {
+      const value = namedMethod ? (namedMethod[1] ?? tokens[++i]) : (curlMethod[1] || tokens[++i]);
+      if (!/^(?:GET|HEAD)$/i.test(value ?? "")) deny("HashiCorp releases permit only GET or HEAD requests.");
+      continue;
+    }
+    if (/^(?:-Uri|--url)$/i.test(token) && /^https:\/\//i.test(tokens[i + 1] ?? "")) continue;
+    deny("Unsupported option in the bounded HashiCorp read command.");
+  }
+  if (urlCount !== 1) deny("HashiCorp reads require exactly one HTTPS URL.");
+}
+
 function validateExplicitNetwork(command) {
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
     deny("Direct remote-shell and file-transfer clients are blocked.");
@@ -289,174 +342,24 @@ function validateExplicitNetwork(command) {
     deny("Network clients require an explicit allowlisted URL.");
   }
   for (const match of urls) {
-    let host;
+    let target;
     try {
-      host = new URL("https://" + match[1]).hostname.toLowerCase();
+      target = new URL(match[0]);
     } catch {
       deny("Malformed network target was rejected.");
     }
-    if (!allowedExplicitNetworkHosts.has(host)) {
+    const host = target.hostname.toLowerCase();
+    if (!principalFullNetwork && !allowedExplicitNetworkHosts.has(host)) {
       deny("Explicit network target is outside the ZAIP allowlist.");
     }
+    if (host === "releases.hashicorp.com") {
+      if (target.protocol !== "https:" || target.username || target.password)
+        deny("HashiCorp releases require an exact HTTPS read target.");
+      validateHashicorpRead(command);
+    }
   }
 }
 
-function optionMap(tokens) {
-  if (tokens.length % 2 !== 0) return null;
-  const values = new Map();
-  for (let index = 0; index < tokens.length; index += 2) {
-    const key = tokens[index];
-    const value = tokens[index + 1];
-    if (!key.startsWith("--") || value.startsWith("--") || values.has(key)) return null;
-    values.set(key, value);
-  }
-  return values;
-}
-
-function requireExactOptions(options, allowed, required) {
-  if ([...options.keys()].some((key) => !allowed.has(key))) return false;
-  return [...required].every((key) => typeof options.get(key) === "string" && options.get(key).length > 0);
-}
-
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0);
-}
-
-async function readCloudContract(options) {
-  if (options.get("--contract") !== cloudContractPath) {
-    deny("Cloud runner must use the canonical autonomous-cloud contract path.");
-  }
-  const absolute = resolve(repositoryRoot, cloudContractPath);
-  if (!isWithinRepository(absolute)) deny("Cloud runner contract escapes the repository boundary.");
-  let contract;
-  try {
-    contract = JSON.parse(await readFile(absolute, "utf8"));
-  } catch {
-    deny("Cloud runner contract is absent or malformed.");
-  }
-  if (
-    contract === null ||
-    typeof contract !== "object" ||
-    contract.version !== 1 ||
-    contract.profile !== "autonomous-cloud" ||
-    contract.cloudflare === null ||
-    typeof contract.cloudflare !== "object" ||
-    contract.hostinger === null ||
-    typeof contract.hostinger !== "object"
-  ) {
-    deny("Cloud runner contract has no valid autonomous-cloud profile.");
-  }
-  return contract;
-}
-
-function cloudflareTargetMatches(contract, options, operation) {
-  const cloudflare = contract.cloudflare;
-  const record = options.get("--dns-record");
-  const managed = isStringArray(cloudflare.dns_records) && cloudflare.dns_records.includes(record);
-  const direct = cloudflare.direct_dns_records !== null && typeof cloudflare.direct_dns_records === "object" && Object.hasOwn(cloudflare.direct_dns_records, record);
-  return (
-    typeof cloudflare.account_id === "string" &&
-    typeof cloudflare.zone_id === "string" &&
-    isStringArray(cloudflare.allowed_operations) &&
-    cloudflare.account_id === options.get("--account-id") &&
-    cloudflare.zone_id === options.get("--zone-id") &&
-    cloudflare.allowed_operations.includes(operation) &&
-    (operation === "cloudflare:dns:read" ? managed || direct : direct && !managed)
-  );
-}
-
-function hostingerTargetMatches(contract, options, operation) {
-  const hostinger = contract.hostinger;
-  const role = options.get("--vps-role");
-  if (
-    typeof hostinger.account_id !== "string" ||
-    !isStringArray(hostinger.allowed_operations) ||
-    hostinger.account_id !== options.get("--account-id") ||
-    !hostinger.allowed_operations.includes(operation) ||
-    (role !== "edge" && role !== "application") ||
-    hostinger.vps === null ||
-    typeof hostinger.vps !== "object"
-  ) {
-    return false;
-  }
-  const target = hostinger.vps[role];
-  if (target === null || typeof target !== "object") return false;
-
-  if (typeof target.id !== "string" || target.id !== options.get("--vps-id")) return false;
-  if (operation.startsWith("hostinger:ssh:")) {
-    return typeof target.host_key_sha256 === "string" && target.host_key_sha256 === options.get("--host-key-sha256");
-  }
-  return true;
-}
-
-function terraformTargetMatches(contract, options, operation) {
-  const terraform = contract.terraform;
-  if (
-    terraform === null ||
-    typeof terraform !== "object" ||
-    !isStringArray(terraform.allowed_operations) ||
-    !terraform.allowed_operations.includes(operation)
-  ) return false;
-  if (operation === "terraform:plan") return terraform.working_directory === options.get("--terraform-directory");
-  if (operation === "terraform:apply") {
-    const plan = terraform.plan;
-    return plan !== null && typeof plan === "object" && typeof plan.path === "string" && typeof plan.sha256 === "string" && typeof plan.policy_result_sha256 === "string" && plan.path === options.get("--plan-path") && plan.sha256 === options.get("--plan-sha256") && plan.policy_result_sha256 === options.get("--policy-result-sha256");
-  }
-  return terraform.import_targets !== null && typeof terraform.import_targets === "object" && terraform.import_targets[options.get("--resource-address")] === options.get("--resource-id");
-}
-
-function validateDirectCloudProviderMutation(command) {
-  if (command.includes(cloudRunnerScript)) return;
-  if (/\bterraform(?:\.exe)?\s+(?:apply|destroy|import)\b/i.test(command)) deny("Direct Terraform mutation is blocked; use the contract-bound cloud runner.");
-  if (/\b(?:wrangler|cloudflare|hostinger)(?:\.exe)?\b/i.test(command)) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
-}
-
-async function validateCloudRunner(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (tokens === null || tokens.length < 2 || !/^(?:node|node\.exe)$/i.test(tokens[0]) || tokens[1] !== cloudRunnerScript) {
-    return false;
-  }
-  const options = optionMap(tokens.slice(2));
-  if (options === null) deny("Cloud runner requires literal, named arguments.");
-  const operation = options.get("--operation");
-  if (operation === "contract:derive") {
-    if (!requireExactOptions(options, new Set(["--operation", "--credentials-source"]), new Set(["--operation", "--credentials-source"]))) {
-      deny("Cloud contract derivation has unrecognized arguments.");
-    }
-    if (options.get("--credentials-source") !== "root") {
-      deny("Cloud contract derivation requires the selected root credential source.");
-    }
-    return true;
-  }
-  const provider = cloudOperationProviders.get(operation);
-  if (provider === undefined) deny("Cloud runner operation is unrecognized or destructive.");
-  const common = new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source", "--zone-id", "--dns-record", "--vps-role", "--vps-id", "--host-key-sha256", "--terraform-directory", "--plan-path", "--plan-sha256", "--policy-result-sha256", "--resource-address", "--resource-id"]);
-  const baseRequired = provider === "terraform"
-    ? new Set(["--contract", "--operation", "--credentials-source"])
-    : new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source"]);
-  if (!requireExactOptions(options, common, baseRequired)) {
-    deny("Cloud runner invocation has unrecognized arguments.");
-  }
-  if ((provider !== "terraform" && options.get("--provider") !== provider) || !["root", "agents"].includes(options.get("--credentials-source"))) {
-    deny("Cloud runner provider or credential source is outside the approved contract.");
-  }
-  const contract = await readCloudContract(options);
-  const valid = provider === "cloudflare"
-    ? requireExactOptions(options, common, new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source", "--zone-id", "--dns-record"])) && cloudflareTargetMatches(contract, options, operation)
-    : provider === "hostinger"
-      ? requireExactOptions(options, common, new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source", "--vps-role"])) && hostingerTargetMatches(contract, options, operation)
-      : requireExactOptions(
-          options,
-          common,
-          operation === "terraform:plan"
-            ? new Set(["--contract", "--operation", "--credentials-source", "--terraform-directory"])
-            : operation === "terraform:apply"
-              ? new Set(["--contract", "--operation", "--credentials-source", "--plan-path", "--plan-sha256", "--policy-result-sha256"])
-              : new Set(["--contract", "--operation", "--credentials-source", "--resource-address", "--resource-id"]),
-        ) && terraformTargetMatches(contract, options, operation);
-  if (!valid) deny("Cloud runner target, operation, or host identity is outside the approved contract.");
-  return true;
-}
 
 ${CODEX_STALE_GIT_LOCK_HELPER}
 
@@ -533,6 +436,10 @@ async function validateShellDeletion(command, cwd) {
 }
 
 async function validatePatch(command) {
+  for (const match of command.matchAll(/^\*\*\* (?:Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)) {
+    const rawPath = (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, "");
+    if (principalFullAccess) await assertCanonicalLiteralPath(rawPath);
+  }
   const paths = patchPaths(command);
   const lifecycleRecordTouched = paths.some((path) =>
     /^\.agents[\\/]records[\\/](?:prds|specs|tasks)[\\/]/i.test(path));
@@ -541,8 +448,10 @@ async function validatePatch(command) {
   }
   for (const path of paths) {
     const absolute = resolve(repositoryRoot, path);
-    if (!isWithinRepository(absolute)) deny("Patch path escapes the repository boundary.");
-    if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
+    if (credentialReferencePattern.test(absolute)) deny("Direct credential and secret access is blocked.");
+    if (!isWithinRepository(absolute) && !principalFullAccess) deny("Patch path escapes the repository boundary.");
+    if (principalFullAccess) await assertCanonicalLiteralPath(absolute);
+    else if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
     if (repositoryPath(absolute) === "") deny("Patching the repository root is blocked.");
     if (protectedTaskWorkspacePath(repositoryPath(absolute))) deny("Task workspace claims are managed only by the canonical CLI.");
     if (isGitPath(absolute)) {
@@ -564,13 +473,25 @@ async function requiresOrchestratorRun(event, command) {
     return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
   }
   if (event.tool_name === "Edit" || event.tool_name === "Write") {
-    if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
+    if (principalFullAccess) await assertCanonicalLiteralPath(command, event.cwd ?? repositoryRoot);
+    else if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
     const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, command));
     if (protectedTaskWorkspacePath(path)) deny("Task workspace claims are managed only by the canonical CLI.");
     return !lifecycleExemptPathPattern.test(path);
   }
   // Only single literal writes claim exemptions; compound commands remain gated.
   const tokens = tokenizeLiteralCommand(command);
+  // The public CLI validates the immutable post-publication receipt, observed
+  // invocation, completed maintenance Gui and exact target before any write.
+  // Its first call necessarily follows the maintenance root's terminal Stop.
+  if (tokens && !Object.values(shellSyntax(command)).some(Boolean) &&
+      /^(?:node|node\.exe)$/i.test(tokens[0] ?? "") &&
+      /^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") &&
+      tokens[2] === "task" && tokens[3] === "resume-post-publication" &&
+      /^TASK-[A-Z0-9-]+$/.test(tokens[4] ?? "") && tokens[5] === "--receipt" &&
+      /^\.local[\\/]recovery[\\/]post-publication[\\/][a-f0-9]{64}\.json$/.test(tokens[6] ?? "") &&
+      (tokens.length === 7 || (tokens.length === 8 && tokens[7] === "--json"))) return false;
+  if (tokens && tokens[2] === "task" && tokens[3] === "resume-post-publication") return true;
   if (tokens && /^(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|Rename-Item|sc|ac|ni|cp|mv|mi|ri|rm|git(?:\.exe)?)$/i.test(tokens[0] ?? "") &&
       tokens.some(token => token.toLowerCase().includes("task-workspaces") &&
         protectedTaskWorkspacePath(repositoryPath(resolve(event.cwd ?? repositoryRoot, token)))))
@@ -585,40 +506,81 @@ async function requiresOrchestratorRun(event, command) {
     }
     if (valid && options.has("-literalpath") && options.has("-value")) {
       const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, options.get("-literalpath")));
-      if (!await nativeAuthority?.isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) deny("Shell write path traverses a link or could not be safely verified.");
+      if (principalFullAccess) await assertCanonicalLiteralPath(options.get("-literalpath"), event.cwd ?? repositoryRoot);
+      else if (!await nativeAuthority?.isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) deny("Shell write path traverses a link or could not be safely verified.");
       if (protectedTaskWorkspacePath(path)) deny("Task workspace claims are managed only by the canonical CLI.");
       if (lifecycleExemptPathPattern.test(path)) return false;
     }
   }
+  // The external Node is only a literal canonical validation command when the
+  // native authority has verified this workspace's exact opt-in executable.
+  if (tokens && isAbsolute(tokens[0]) &&
+      /^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") &&
+      tokens[2] === "validation" && ["execute", "batch"].includes(tokens[3]) &&
+      !Object.values(shellSyntax(command)).some(Boolean)) {
+    let optIn;
+    try { optIn = JSON.parse(await readFile(resolve(repositoryRoot, ".local/validation-runtime.json"), "utf8")); }
+    catch { optIn = null; }
+    const reviewed = await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []);
+    if (typeof optIn?.executable === "string" &&
+        tokens[0].replaceAll("/", "\\").toLowerCase() === optIn.executable.replaceAll("/", "\\").toLowerCase() &&
+        reviewed.length === 1 && reviewed[0] === tokens[0]) return false;
+  }
   return requiresShellMutationRun(command, tokens, event.cwd ?? repositoryRoot, repositoryRoot);
 }
 
-async function boundedCanonicalText(path, maximumBytes, authorityRoot = repositoryRoot) {
-  const info = await lstat(path);
-  if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) throw new Error("Unsafe Run lookup file");
-  const physical = await realpath(path);
-  const identity = value => process.platform === "win32" ? value.toLowerCase() : value;
-  if (!inside(physical, authorityRoot) || identity(physical) !== identity(resolve(path))) throw new Error("Run lookup must not follow links");
-  return readFile(path, "utf8");
-}
+const boundedCanonicalText = (path, maximumBytes, authorityRoot = repositoryRoot) => readBoundedCanonicalText(path, maximumBytes, authorityRoot);
 
 let raw = "";
 for await (const chunk of process.stdin) raw += chunk;
 
 let event;
-try {
-  event = JSON.parse(raw);
-} catch {
-  deny("Malformed hook input was rejected.");
-}
+event = parseHookEvent(raw, deny);
 
 const toolInput = event?.tool_input;
-try { const scope = await selectHookExecutionWorkspace(installedRoot, event); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
+const candidateWorkdir = typeof toolInput?.workdir === "string" && isAbsolute(toolInput.workdir) ? toolInput.workdir : event.cwd;
+try { repositoryRoot = await selectHookRepositoryRoot(installedRoot, candidateWorkdir); }
+catch { repositoryRoot = installedRoot; }
+if (typeof activation?.hookPolicies !== "function") {
+  let projectConfig;
+  try {
+    projectConfig = await readBoundedCanonicalText(resolve(repositoryRoot, ".agents/config/project.yaml"), 65536, repositoryRoot);
+  } catch (error) {
+    if (error?.code === "ENOENT") { writeSync(1, "{}\n"); process.exit(0); }
+    deny("ZAIP project policy cannot be verified without hook activation.");
+  }
+  const sections = [...projectConfig.matchAll(/^zaip:([^\r\n]*)$/gm)];
+  const inlineDisabled = sections.length === 1 && /^\s*\{\s*enabled:\s*false\s*\}(?:\s*#.*)?$/.test(sections[0][1]);
+  const following = sections.length === 1 ? projectConfig.slice(sections[0].index + sections[0][0].length).split(/(?=^[^\s#])/m)[0] : "";
+  const enabledEntries = following.match(/^\s+enabled:/gm) ?? [];
+  const blockDisabled = sections.length === 1 && /^\s*(?:#.*)?$/.test(sections[0][1]) && enabledEntries.length === 1 && /^\s+enabled:\s*false(?:\s*#.*)?$/m.test(following);
+  if (inlineDisabled || blockDisabled) { writeSync(1, "{}\n"); process.exit(0); }
+  deny("ZAIP hook activation module is unavailable for an enabled or invalid project policy.");
+}
+const hookPolicy = await activation.hookPolicies(repositoryRoot, (path, maximumBytes) => readBoundedCanonicalText(path, maximumBytes, repositoryRoot));
+activation?.recordPolicyDiagnostic?.(repositoryRoot, hookPolicy);
+if (hookPolicy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, hookPolicy.governance);
+if (!hookPolicy.governance) {
+  if (hookPolicy.diagnostic && !["config_missing", "policy_missing"].includes(hookPolicy.diagnostic))
+    deny("ZAIP project policy is invalid or unavailable; restore the canonical activation and project configuration.");
+  writeSync(1, "{}\n");
+  process.exit(0);
+}
+const configuredPolicy = await configuredPermissionProfile(repositoryRoot);
+const principal = [event.agent_id, event.agent_type, event.agent_path, event.parent_agent_id].every(value => value === undefined) && event.permission_mode !== "plan";
+principalFullAccess = principal && configuredPolicy.filesystem;
+principalFullNetwork = principal && configuredPolicy.network;
+try { const scope = await selectHookExecutionWorkspace(installedRoot, event, principalFullAccess); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
 catch (error) { deny(error.message); }
-if (!isWithinRepository(event.cwd)) {
+if (credentialReferencePattern.test(event.cwd)) deny("Direct credential and secret access is blocked.");
+if (!principalFullAccess && !isWithinRepository(event.cwd)) {
   deny("Tool execution outside the ZAIP-AIOS repository is blocked.");
 }
 
+const { validateCloudRunner, validateDirectCloudProviderMutation } = createCloudValidators({
+  tokenizeLiteralCommand, deny, repositoryRoot, isWithinRepository, cloudRunnerScript, cloudContractPath, cloudOperationProviders,
+});
+
 const commandFromCmd = toolInput?.cmd;
 const commandFromCommand = toolInput?.command;
 if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string" && commandFromCmd !== commandFromCommand) {
@@ -627,7 +589,7 @@ if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string"
 const command = typeof commandFromCmd === "string" ? commandFromCmd : commandFromCommand;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
 
-if (await requiresOrchestratorRun(event, command) && !(await activation?.isZaipDisabled?.(repositoryRoot, boundedCanonicalText))) {
+if (await requiresOrchestratorRun(event, command)) {
   const directRun = await nativeAuthority?.hasCurrentTaskOrchestratorRun(event, installedRoot, boundedCanonicalText);
   const primaryRead = (path, maximumBytes) => boundedCanonicalText(path, maximumBytes, installedRoot);
   const delegated = directRun ? false : await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, primaryRead, installedRoot);
@@ -644,9 +606,9 @@ if (event.tool_name === "apply_patch") await validatePatch(command);
 else {
   const reviewedPaths = [
     ...await reviewedReleasePaths(command, event.cwd, repositoryRoot, credentialReferencePattern, deny),
-    ...await reviewedContextReadPaths(command, credentialReferencePattern), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand) ?? []),
+    ...await reviewedContextReadPaths(command, credentialReferencePattern, installedRoot), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []),
   ];
-  validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
+  await validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
   validateInlineExecution(command, deny);
   if (!isLiteralReadSequence(command)) {
   await validateGitPublication(command);

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2c3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0M5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0W3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqQ5B,CAAC"}