@zaip-ai/cli 4.8.0 → 5.0.0

package/dist/services/codex-pre-tool-support-template.js

@@ -1,11 +1,8 @@
-export const CODEX_PRE_TOOL_SUPPORT_HOOK = String.raw `import { execFile } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
-import { link, lstat, mkdir, readFile, realpath, unlink, writeFile } from "node:fs/promises";
+export const CODEX_PRE_TOOL_SUPPORT_HOOK = String.raw `import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, toNamespacedPath } from "node:path";
 import { homedir } from "node:os";
-import { promisify } from "node:util";
-
-const execute = promisify(execFile);
+import { createHostContext } from "./zaip-pre-tool-host-context.mjs";
+import { createCliTurnCapture } from "./zaip-pre-tool-cli-capture.mjs";
 export { readAuthorityRunRecords, checkDestructivePatterns, configuredDeploymentBranches } from "./zaip-native-tool-authority.mjs";
 const pathIdentity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
 export const inside = (path, root) => {
@@ -13,51 +10,27 @@ export const inside = (path, root) => {
   return scoped === "" || (!scoped.startsWith("..") && !isAbsolute(scoped));
 };
 
-export async function selectHookRepositoryRoot(installedRoot, cwd) {
-  if (typeof cwd !== "string") throw new Error("Tool execution without a workspace is blocked.");
-  const physicalCwd = await realpath(cwd).catch(() => null);
-  if (!physicalCwd || pathIdentity(physicalCwd) !== pathIdentity(cwd)) {
-    throw new Error("Tool workspace could not be safely resolved.");
-  }
-  if (resolve(cwd).toLowerCase() === installedRoot.toLowerCase()) return installedRoot;
-  if (inside(cwd, installedRoot)) {
-    let cursor = resolve(cwd);
-    while (cursor.toLowerCase() !== installedRoot.toLowerCase() &&
-      !(await lstat(resolve(cursor, ".git")).catch(() => null))) cursor = dirname(cursor);
-    if (cursor.toLowerCase() === installedRoot.toLowerCase()) return installedRoot;
-  }
-  try {
-    const git = async (path, ...args) => (await execute("git", ["-C", path, ...args], {
-      encoding: "utf8", windowsHide: true, timeout: 5000, maxBuffer: 1048576,
-    })).stdout.trim();
-    const primary = await git(installedRoot, "rev-parse", "--show-toplevel");
-    if ((await realpath(primary)).toLowerCase() !== installedRoot.toLowerCase()) throw new Error("primary_not_root");
-    const worktrees = await git(installedRoot, "worktree", "list", "--porcelain", "-z");
-    const registered = worktrees.split("\0").filter(line => line.startsWith("worktree ")).map(line => line.slice(9));
-    const candidate = await realpath(await git(cwd, "rev-parse", "--show-toplevel"));
-    if (!registered.some(path => resolve(path).toLowerCase() === candidate.toLowerCase()) || !inside(cwd, candidate)) {
-      throw new Error("worktree_not_registered");
-    }
-    const common = async path => (await realpath(await git(path, "rev-parse", "--path-format=absolute", "--git-common-dir"))).toLowerCase();
-    if (await common(installedRoot) !== await common(candidate)) throw new Error("common_git_dir_mismatch");
-    return candidate;
-  } catch {
-    throw new Error("Tool workspace could not be verified as a registered worktree.");
-  }
+export async function readBoundedCanonicalText(path, maximumBytes, authorityRoot) {
+  const info = await lstat(path);
+  if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) throw new Error("Unsafe Run lookup file");
+  const physical = await realpath(path);
+  const identity = value => process.platform === "win32" ? value.toLowerCase() : value;
+  if (!inside(physical, authorityRoot) || identity(physical) !== identity(resolve(path))) throw new Error("Run lookup must not follow links");
+  return readFile(path, "utf8");
 }
 
-export async function selectHookExecutionWorkspace(installedRoot, event) {
-  // Codex normalizes shell tools to Bash; preserve the host-supplied literal workdir.
-  await selectHookRepositoryRoot(installedRoot, event.cwd);
-  const workdir = ["exec_command", "shell_command", "Bash"].includes(event.tool_name) ? event.tool_input?.workdir : undefined;
-  if (workdir !== undefined && (typeof workdir !== "string" || !isAbsolute(workdir)))
-    throw new Error("Tool workdir must be an absolute literal workspace.");
-  const cwd = workdir ?? event.cwd;
-  return { cwd, repositoryRoot: await selectHookRepositoryRoot(installedRoot, cwd) };
+export function parseHookEvent(raw, deny) {
+  try { return JSON.parse(raw); }
+  catch { deny("Malformed hook input was rejected."); }
 }
 
+export const { configuredPermissionProfile, selectHookRepositoryRoot, selectHookExecutionWorkspace } = createHostContext({ inside, readBoundedCanonicalText });
+
 export function tokenizeLiteralCommand(command) {
   if (command.includes("\r") || command.includes("\n")) return null;
+  // PowerShell's call operator invokes one literal executable; it grants no authority.
+  // All interpolation, composition and subsequent operators still fail below.
+  if (process.platform === "win32") command = command.replace(/^\s*&\s+/, "");
   const tokens = [];
   let token = "", quote = null, started = false;
   for (let index = 0; index < command.length; index++) {
@@ -83,7 +56,7 @@ export function tokenizeLiteralCommand(command) {
   }
   if (quote !== null) return null;
   if (started) tokens.push(token);
-  return tokens;
+  return tokens[0] === "" ? null : tokens;
 }
 
 export function shellSyntax(command) {
@@ -111,9 +84,12 @@ export function requiresShellMutationRun(command, tokens, cwd, repositoryRoot) {
   const syntax = shellSyntax(command);
   if (!syntax.interpolation && !syntax.redirection && !syntax.grouping && isLiteralReadSequence(command)) return false;
   const executable = tokens?.[0] ?? "";
-  const canonicalCli = /^(?:node|node\.exe)$/i.test(executable) && tokens?.[1] &&
+  const canonicalCli = /^(?:node|node\.exe)$/i.test(executable) || /[\\/]node(?:\.exe)?$/i.test(executable);
+  const canonicalRuntime = canonicalCli && tokens?.[1] &&
     resolve(cwd, tokens[1]).toLowerCase() === resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs").toLowerCase();
-  const dataCommand = canonicalCli || /^(?:Write-Output|echo|printf)$/i.test(executable);
+  if (canonicalRuntime && tokens?.[2] === "execution" && tokens?.[3] === "native-next" &&
+      tokens.includes("--reserve-causal")) return true;
+  const dataCommand = canonicalRuntime || /^(?:Write-Output|echo|printf)$/i.test(executable);
   if (tokens && !syntax.interpolation && !syntax.grouping && dataCommand) {
     return syntax.redirection;
   }
@@ -124,6 +100,8 @@ export function requiresShellMutationRun(command, tokens, cwd, repositoryRoot) {
 // Recognize only literal read-only pipelines/sequences. Quoted search text is data,
 // not a PowerShell alias (for example the AC prefix in acceptance-criterion IDs).
 export function isLiteralReadSequence(command) {
+  const syntax = shellSyntax(command);
+  if (syntax.interpolation || syntax.redirection || syntax.grouping) return false;
   const parts = [];
   let start = 0, quote = null;
   for (let index = 0; index < command.length; index++) {
@@ -141,6 +119,20 @@ export function isLiteralReadSequence(command) {
   return parts.every(part => {
     const values = tokenizeLiteralCommand(part);
     if (!values?.length) return false;
+    if (/^Get-Item$/i.test(values[0])) {
+      const args = values.slice(1);
+      const path = args[0] === "-LiteralPath" ? args[1] : args[0];
+      return args.length === (args[0] === "-LiteralPath" ? 2 : 1) &&
+        !!path && !/^(?:[a-z][\w-]*:)(?![\/])/i.test(path) && !/[*?]/.test(path);
+    }
+    if (/^Select-Object$/i.test(values[0])) {
+      const args = values.slice(1);
+      const metadata = /^(?:Name|FullName|Length|LastWriteTime|LastWriteTimeUtc|CreationTime|Attributes|IsReadOnly|LinkType|Target)(?:,(?:Name|FullName|Length|LastWriteTime|LastWriteTimeUtc|CreationTime|Attributes|IsReadOnly|LinkType|Target))*$/i;
+      return (args.length === 2 && args[0] === "-First" && /^\d+$/.test(args[1])) ||
+        (args.length === 2 && args[0] === "-ExpandProperty" && args[1] === "Target") ||
+        (args.length === 2 && args[0] === "-Property" && metadata.test(args[1])) ||
+        (args.length === 1 && metadata.test(args[0]));
+    }
     if (/^(?:Get-Content|Measure-Object)$/i.test(values[0])) return true;
     if (!/^(?:rg|rg\.exe)$/i.test(values[0])) return false;
     return !values.slice(1).some(value => /^--(?:pre|hostname-bin)(?:=|$)/i.test(value));
@@ -294,7 +286,7 @@ export async function reviewedReleasePaths(command, cwd, repositoryRoot, credent
 }
 
 /** Narrow read capability, never a general external-path or executable allowlist. */
-export async function reviewedContextReadPaths(command, credentialPattern) {
+export async function reviewedContextReadPaths(command, credentialPattern, repositoryRoot) {
   const tokens = tokenizeLiteralCommand(command);
   if (!tokens || tokens.length < 2 || credentialPattern.test(command)) return [];
   const executable = tokens[0].toLowerCase();
@@ -305,10 +297,28 @@ export async function reviewedContextReadPaths(command, credentialPattern) {
   // -f means a pattern file in ripgrep, not fixed strings: do not permit it.
   if (tokens.slice(1).some(token => token.startsWith("-") && (!flags.has(token.toLowerCase()) || token === "-f"))) return [];
   const roots = ["memories", "skills", "plugins/cache"].map(part => resolve(homedir(), ".codex", part));
+  // Project-owned policy records explicitly authorized files, never executable
+  // commands or a blanket permission for the user's home/attachments directory.
+  let authorizedFiles = [];
+  if (repositoryRoot) {
+    const policyPath = resolve(repositoryRoot, ".agents/config/external-read-policy.json");
+    try {
+      const info = await lstat(policyPath);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > 65536 ||
+          pathIdentity(await realpath(policyPath)) !== pathIdentity(policyPath)) return [];
+      const policy = JSON.parse(await readFile(policyPath, "utf8"));
+      if (policy?.schema_version !== 1 || !Array.isArray(policy.files) || policy.files.length > 128 ||
+          Object.keys(policy).sort().join(",") !== "files,schema_version" ||
+          policy.files.some(path => typeof path !== "string" || !isAbsolute(path) || hasTraversalSegment(path))) return [];
+      authorizedFiles = policy.files.map(pathIdentity);
+    } catch (error) { if (error.code !== "ENOENT") return []; }
+  }
   const paths = tokens.slice(1).filter(value => isAbsolute(value));
   if (!paths.length) return [];
   for (const path of paths) {
-    if (!roots.some(root => inside(path, root)) || !/\.(?:md|txt|json|yaml|yml|toml)$/i.test(path)) return [];
+    if (hasTraversalSegment(path) ||
+        (!roots.some(root => inside(path, root)) && !authorizedFiles.includes(pathIdentity(path))) ||
+        !/\.(?:md|txt|json|jsonl|yaml|yml|toml)$/i.test(path)) return [];
     try {
       const info = await lstat(path);
       if (!info.isFile() || info.isSymbolicLink() || pathIdentity(await realpath(path)) !== pathIdentity(path)) return [];
@@ -317,62 +327,26 @@ export async function reviewedContextReadPaths(command, credentialPattern) {
   return paths;
 }
 
-export async function captureCliTurn(repositoryRoot, event, command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || tokens.length < 4 || !/^(?:node|node\.exe)$/i.test(tokens[0])) return;
-  const script = resolve(event.cwd, tokens[1]);
-  if (script.toLowerCase() !== resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs").toLowerCase()) return;
-  if (!((tokens[2] === "conversation" || tokens[2] === "run") && tokens[3] === "start")) return;
-  if (tokens.includes("--help") || tokens.includes("-h")) return;
-  if (tokens.some(token => token.startsWith("--codex-hook-"))) throw new Error("Codex hook identity cannot be supplied by the caller.");
-  const threadId = event.session_id, turnId = event.turn_id, toolUseId = event.tool_use_id;
-  if (typeof threadId !== "string" || !/^[A-Za-z0-9_-]{1,256}$/.test(threadId) ||
-      typeof turnId !== "string" || !turnId || turnId.length > 256 ||
-      typeof toolUseId !== "string" || !toolUseId || toolUseId.length > 256 ||
-      (process.env.CODEX_THREAD_ID && process.env.CODEX_THREAD_ID !== threadId) ||
-      (process.env.CODEX_TURN_ID && process.env.CODEX_TURN_ID !== turnId)) {
-    throw new Error("Codex thread, turn and tool identity could not be captured for the ZAIP CLI.");
-  }
-  const directory = resolve(repositoryRoot, ".local/codex-hook-turn/v1");
-  const argvSha256 = createHash("sha256").update(JSON.stringify(tokens.slice(2))).digest("hex");
-  const digest = createHash("sha256").update(JSON.stringify([threadId, toolUseId])).digest("hex");
-  const target = resolve(directory, digest + ".json");
-  const temporary = resolve(directory, digest + "." + randomUUID() + ".tmp");
-  try {
-    let parent = repositoryRoot;
-    for (const part of [".local", "codex-hook-turn", "v1"]) {
-      parent = resolve(parent, part);
-      try { await mkdir(parent); } catch (error) { if (error?.code !== "EEXIST") throw error; }
-      const info = await lstat(parent), physical = await realpath(parent);
-      if (!info.isDirectory() || info.isSymbolicLink() || !inside(physical, repositoryRoot)) throw new Error("Unsafe turn receipt directory");
-    }
-    const value = {
-      schema_version: 1, thread_id: threadId, turn_id: turnId,
-      tool_use_sha256: digest, argv_sha256: argvSha256, observed_at_ms: Date.now(),
-    };
-    await writeFile(temporary, JSON.stringify(value) + "\n", { flag: "wx", mode: 0o600 });
-    try { await link(temporary, target); }
-    catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      const info = await lstat(target);
-      if (!info.isFile() || info.isSymbolicLink() || info.size > 4096 ||
-          pathIdentity(await realpath(target)) !== pathIdentity(target)) throw new Error("Unsafe existing turn receipt");
-      const prior = JSON.parse(await readFile(target, "utf8"));
-      for (const key of ["schema_version", "thread_id", "turn_id", "tool_use_sha256", "argv_sha256"])
-        if (prior[key] !== value[key]) throw new Error("Conflicting existing turn receipt");
-      if (!Number.isSafeInteger(prior.observed_at_ms) || prior.observed_at_ms > Date.now()) throw new Error("Invalid turn receipt time");
-    }
-  } catch {
-    throw new Error("Codex turn identity could not be persisted for the ZAIP CLI.");
-  } finally { await unlink(temporary).catch(() => {}); }
-  return command + " --codex-hook-id=" + digest + " --codex-hook-thread=" + threadId;
+function hasTraversalSegment(path) {
+  return path.split(/[\\/]/).includes("..");
 }
 
+export const captureCliTurn = createCliTurnCapture({ inside, tokenizeLiteralCommand });
+
 export function validateInlineExecution(command, deny) {
   if (shellSyntax(command).interpolation) {
     deny("Nested shell execution is blocked; use a reviewed repository script.");
   }
   if (/(?:^|[;&|\r\n])\s*&\s*\(/.test(command)) deny("Dynamic shell invocation is blocked; use a literal command.");
+  const tokens = tokenizeLiteralCommand(command);
+  const executable = tokens?.[0]?.split(/[\\/]/).at(-1) ?? "";
+  // Quoting and absolute paths do not change Node's inline-execution semantics.
+  // Stop at --, which makes subsequent arguments positional rather than options.
+  const argumentsBeforeDelimiter = tokens?.slice(1, tokens.includes("--") ? tokens.indexOf("--") : undefined) ?? [];
+  if (/^node(?:\.exe)?$/i.test(executable) &&
+      argumentsBeforeDelimiter.some(argument => /^(?:--(?:eval|print)(?:=|$)|-[ep](?:[ep]|$))/.test(argument))) {
+    deny("Inline or piped interpreter execution is blocked; use a reviewed repository script.");
+  }
   const inlinePatterns = [
     /\b(?:node|deno)\s+(?:-e|--eval)\b/i,
     /\b(?:python(?:3)?|ruby|perl|php)\s+(?:-c|-e)\b/i,
@@ -383,7 +357,10 @@ export function validateInlineExecution(command, deny) {
     /\|\s*(?:node|deno|python(?:3)?|ruby|perl|php|powershell|pwsh|cmd)\b/i,
     /\b(?:Invoke-Expression|iex)\b/i,
   ];
-  if (inlinePatterns.some((pattern) => pattern.test(command))) {
+  // A quoted rg expression can contain a literal pipe followed by "node".
+  // Only the parsed read command may exempt that data; a real pipe to an
+  // interpreter remains outside isLiteralReadSequence and is denied.
+  if (!isLiteralReadSequence(command) && inlinePatterns.some((pattern) => pattern.test(command))) {
     deny("Inline or piped interpreter execution is blocked; use a reviewed repository script.");
   }
 }

package/dist/services/codex-pre-tool-support-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4YpD,CAAC"}
+{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqXpD,CAAC"}

package/dist/services/codex-subagent-hook-template.d.ts

@@ -1,2 +1,2 @@
-export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const files = await fs.readdir(pendingRoot).catch(() => []);\n  let replayed = 0;\n  for (const file of files.filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).slice(0, 256)) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state === \"pending\" && Array.isArray(receipt.capture_arguments)) { await runCaptureRunner(path, true); if (++replayed >= 3) break; }\n  }\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  if (cwd === null || !selectRoot(cwd)) process.exit(0);\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n  for (let retry = 0; ; retry++) {\n    try { await fs.rename(temporary, path); break; }\n    catch (error) { if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= 5) throw error; await new Promise(done => setTimeout(done, 20 * (retry + 1))); }\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return;\n    try { process.kill(owner.pid, 0); return; } catch (failure) { if (failure.code !== \"ESRCH\") return; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return;\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return;\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n      const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
+export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  if (!(await activation?.hookPolicies?.(repositoryRoot))?.governance) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const policy = await activation?.hookPolicies?.(repositoryRoot);\n  if (policy?.tracking) activation?.replayHookObservations?.(repositoryRoot);\n  if (!policy?.governance) { process.stdout.write(JSON.stringify({ attempted: 0, deferred: 0, pending: 0, disabled: true })); process.exit(0); }\n  const files = (await fs.readdir(pendingRoot).catch(() => []))\n    .filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).sort();\n  const cursorPath = resolve(pendingRoot, \".replay-cursor\");\n  const cursor = await fs.readFile(cursorPath, \"utf8\").then(JSON.parse).catch(() => null);\n  const start = (files.indexOf(cursor?.last) + 1) % (files.length || 1);\n  const selected = [...files.slice(start), ...files.slice(0, start)].slice(0, 256);\n  let attempted = 0, deferred = 0, pending = 0;\n  let lastAttempted = null;\n  for (const file of selected) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state !== \"pending\" || !Array.isArray(receipt.capture_arguments)) continue;\n    if (attempted < 3) {\n      attempted++; lastAttempted = file;\n      if (await replayPendingReceipt(path) === \"deferred\") deferred++;\n    }\n    if ((await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null))?.state === \"pending\") pending++;\n  }\n  if (selected.length) await atomicSave(cursorPath, { last: lastAttempted ?? selected.at(-1) });\n  process.stdout.write(JSON.stringify({ attempted, deferred, pending, uninspected: files.length - selected.length }));\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  if (cwd === null || !selectRoot(cwd)) process.exit(0);\n  const policy = await activation?.hookPolicies?.(repositoryRoot) ?? { governance: false, tracking: false, diagnostic: \"policy_module_unavailable\" };\n  activation?.recordPolicyDiagnostic?.(repositoryRoot, policy);\n  if (policy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, policy.governance);\n  if (policy.tracking && event.hook_event_name === \"SubagentStop\") activation?.replayHookObservations?.(repositoryRoot);\n  if (!policy.governance) { process.stdout.write(JSON.stringify({})); process.exit(0); }\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  const delays = [25, 50, 75, 100, 150, 225, 300, 400, 500];\n  try {\n    await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n    for (let retry = 0; ; retry++) {\n      try { await fs.rename(temporary, path); return; }\n      catch (error) {\n        if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= delays.length) throw error;\n        await new Promise(done => setTimeout(done, delays[retry]));\n      }\n    }\n  } finally {\n    await fs.unlink(temporary).catch(() => {});\n  }\n}\n\nasync function replayPendingReceipt(path) {\n  const deadline = Date.now() + 2000;\n  for (;;) {\n    if (await runCaptureRunner(path, true) !== \"lease_busy\") return \"attempted\";\n    if (Date.now() >= deadline) {\n      await persistDiagnostic(\"replay_deferred_active_lease\", { receipt: path });\n      return \"deferred\";\n    }\n    await new Promise(done => setTimeout(done, 50));\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return \"lease_busy\";\n    try { process.kill(owner.pid, 0); return \"lease_busy\"; } catch (failure) { if (failure.code !== \"ESRCH\") return \"lease_busy\"; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return \"lease_busy\"; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return \"lease_busy\";\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return \"lease_busy\";\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n    const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const policy = await activation?.hookPolicies?.(repositoryRoot);\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true,\n    env: { ...process.env, ZAIP_HOOK_TRACKING_ENABLED: policy?.tracking ? \"true\" : \"false\" }, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
 //# sourceMappingURL=codex-subagent-hook-template.d.ts.map

package/dist/services/codex-subagent-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,80fAqVzC,CAAC"}
+{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,i1kBAiYzC,CAAC"}

package/dist/services/codex-subagent-hook-template.js

@@ -52,18 +52,35 @@ function selectRoot(cwd) {
 
 if (process.argv[2] === "--capture-runner") {
   if (!selectRoot(process.cwd())) process.exit(0);
+  if (!(await activation?.hookPolicies?.(repositoryRoot))?.governance) process.exit(0);
   await runCaptureRunner(process.argv[3]);
   process.exit(0);
 }
 if (process.argv[2] === "--replay-pending") {
   if (!selectRoot(process.cwd())) process.exit(0);
-  const files = await fs.readdir(pendingRoot).catch(() => []);
-  let replayed = 0;
-  for (const file of files.filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).slice(0, 256)) {
+  const policy = await activation?.hookPolicies?.(repositoryRoot);
+  if (policy?.tracking) activation?.replayHookObservations?.(repositoryRoot);
+  if (!policy?.governance) { process.stdout.write(JSON.stringify({ attempted: 0, deferred: 0, pending: 0, disabled: true })); process.exit(0); }
+  const files = (await fs.readdir(pendingRoot).catch(() => []))
+    .filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).sort();
+  const cursorPath = resolve(pendingRoot, ".replay-cursor");
+  const cursor = await fs.readFile(cursorPath, "utf8").then(JSON.parse).catch(() => null);
+  const start = (files.indexOf(cursor?.last) + 1) % (files.length || 1);
+  const selected = [...files.slice(start), ...files.slice(0, start)].slice(0, 256);
+  let attempted = 0, deferred = 0, pending = 0;
+  let lastAttempted = null;
+  for (const file of selected) {
     const path = resolve(pendingRoot, file);
     const receipt = await fs.readFile(path, "utf8").then(JSON.parse).catch(() => null);
-    if (receipt?.state === "pending" && Array.isArray(receipt.capture_arguments)) { await runCaptureRunner(path, true); if (++replayed >= 3) break; }
+    if (receipt?.state !== "pending" || !Array.isArray(receipt.capture_arguments)) continue;
+    if (attempted < 3) {
+      attempted++; lastAttempted = file;
+      if (await replayPendingReceipt(path) === "deferred") deferred++;
+    }
+    if ((await fs.readFile(path, "utf8").then(JSON.parse).catch(() => null))?.state === "pending") pending++;
   }
+  if (selected.length) await atomicSave(cursorPath, { last: lastAttempted ?? selected.at(-1) });
+  process.stdout.write(JSON.stringify({ attempted, deferred, pending, uninspected: files.length - selected.length }));
   process.exit(0);
 }
 
@@ -74,6 +91,11 @@ try {
   const event = JSON.parse(raw);
   const cwd = text(event.cwd);
   if (cwd === null || !selectRoot(cwd)) process.exit(0);
+  const policy = await activation?.hookPolicies?.(repositoryRoot) ?? { governance: false, tracking: false, diagnostic: "policy_module_unavailable" };
+  activation?.recordPolicyDiagnostic?.(repositoryRoot, policy);
+  if (policy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, policy.governance);
+  if (policy.tracking && event.hook_event_name === "SubagentStop") activation?.replayHookObservations?.(repositoryRoot);
+  if (!policy.governance) { process.stdout.write(JSON.stringify({})); process.exit(0); }
   const eventName = text(event.hook_event_name);
   activation?.recordActivation(repositoryRoot, event);
   const lifecycleEvent =
@@ -202,10 +224,30 @@ try {
 
 async function atomicSave(path, value) {
   const temporary = path + ".tmp-" + randomUUID();
-  await fs.writeFile(temporary, JSON.stringify(value), { flag: "wx", mode: 0o600 });
-  for (let retry = 0; ; retry++) {
-    try { await fs.rename(temporary, path); break; }
-    catch (error) { if (!["EPERM", "EACCES", "EBUSY"].includes(error.code) || retry >= 5) throw error; await new Promise(done => setTimeout(done, 20 * (retry + 1))); }
+  const delays = [25, 50, 75, 100, 150, 225, 300, 400, 500];
+  try {
+    await fs.writeFile(temporary, JSON.stringify(value), { flag: "wx", mode: 0o600 });
+    for (let retry = 0; ; retry++) {
+      try { await fs.rename(temporary, path); return; }
+      catch (error) {
+        if (!["EPERM", "EACCES", "EBUSY"].includes(error.code) || retry >= delays.length) throw error;
+        await new Promise(done => setTimeout(done, delays[retry]));
+      }
+    }
+  } finally {
+    await fs.unlink(temporary).catch(() => {});
+  }
+}
+
+async function replayPendingReceipt(path) {
+  const deadline = Date.now() + 2000;
+  for (;;) {
+    if (await runCaptureRunner(path, true) !== "lease_busy") return "attempted";
+    if (Date.now() >= deadline) {
+      await persistDiagnostic("replay_deferred_active_lease", { receipt: path });
+      return "deferred";
+    }
+    await new Promise(done => setTimeout(done, 50));
   }
 }
 
@@ -219,19 +261,19 @@ async function runCaptureRunner(receiptPath, replay = false) {
   } catch (error) {
     if (error.code !== "EEXIST") return;
     const owner = await fs.readFile(lockPath, "utf8").then(JSON.parse).catch(() => null);
-    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return;
-    try { process.kill(owner.pid, 0); return; } catch (failure) { if (failure.code !== "ESRCH") return; }
+    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return "lease_busy";
+    try { process.kill(owner.pid, 0); return "lease_busy"; } catch (failure) { if (failure.code !== "ESRCH") return "lease_busy"; }
     // Serialize stale lock recovery so two recovering workers cannot remove a new lease.
     let recovery;
-    try { recovery = await fs.open(lockPath + ".recover", "wx"); } catch { return; }
+    try { recovery = await fs.open(lockPath + ".recover", "wx"); } catch { return "lease_busy"; }
     try {
       const current = await fs.readFile(lockPath, "utf8").then(JSON.parse).catch(() => null);
-      if (current?.pid !== owner.pid) return;
+      if (current?.pid !== owner.pid) return "lease_busy";
       await fs.unlink(lockPath);
       lease = await fs.open(lockPath, "wx");
       await lease.writeFile(JSON.stringify({ pid: process.pid }));
     } finally { await recovery.close(); await fs.unlink(lockPath + ".recover").catch(() => {}); }
-    if (!lease) return;
+    if (!lease) return "lease_busy";
   }
   try {
     const receipt = await fs.readFile(receiptPath, "utf8").then(JSON.parse);
@@ -248,7 +290,7 @@ async function runCaptureRunner(receiptPath, replay = false) {
       receipt.attempts = (receipt.attempts ?? 0) + 1;
       receipt.updated_at = new Date().toISOString();
       await atomicSave(receiptPath, receipt);
-      const outcome = await capture(cli, args);
+    const outcome = await capture(cli, args);
       let result;
       try { result = JSON.parse(outcome.stdout); } catch { result = null; }
       const runId = result?.run?.run_id ?? result?.run?.id;
@@ -275,7 +317,9 @@ async function runCaptureRunner(receiptPath, replay = false) {
 }
 
 async function capture(cli, args) {
-  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+  const policy = await activation?.hookPolicies?.(repositoryRoot);
+  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true,
+    env: { ...process.env, ZAIP_HOOK_TRACKING_ENABLED: policy?.tracking ? "true" : "false" }, stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "", overflow = false;
   child.stdout.on("data", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = ""; child.kill(); } });
   child.stderr.resume();

package/dist/services/codex-subagent-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-subagent-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqV5C,CAAC"}
+{"version":3,"file":"codex-subagent-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiY5C,CAAC"}

package/dist/services/codex-validation-runtime-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-validation-runtime-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-validation-runtime-template.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,QAe5C,CAAC"}
+{"version":3,"file":"codex-validation-runtime-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-validation-runtime-template.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,QA0C5C,CAAC"}

package/dist/services/codex-validation-runtime-template.js

@@ -1,18 +1,45 @@
 /** Appended to native authority; receives the shared literal parser. */
 export const CODEX_VALIDATION_RUNTIME_SUPPORT = String.raw `
-/** Candidate validation requires this exact host runtime, not arbitrary executables. */
-export async function reviewedValidationRuntimePaths(command, tokenizeLiteralCommand) {
+/** A local opt-in may name only the Codex-owned Node under this user's profile. */
+export async function reviewedValidationRuntimePaths(command, tokenizeLiteralCommand, repositoryRoot) {
   const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^(?:node|node\.exe)$/i.test(tokens[0]) ||
-      !/^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") ||
-      tokens[2] !== "validation" || !["batch", "execute"].includes(tokens[3])) return [];
-  const positions = tokens.flatMap((value, index) => value === "--executable" ? [index] : []);
-  if (positions.length !== 1) return [];
-  const path = tokens[positions[0] + 1];
-  if (!path || !isAbsolute(path) || command.split(path).length !== 2) return [];
+  if (!tokens) return [];
+  const validation = (/^(?:node|node\.exe)$/i.test(tokens[0]) || isAbsolute(tokens[0])) &&
+    /^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") &&
+    tokens[2] === "validation" && ["batch", "execute"].includes(tokens[3]);
+  const positions = validation ? tokens.flatMap((value, index) => value === "--executable" ? [index] : []) : [];
+  const validationPath = positions.length === 1 ? tokens[positions[0] + 1] : null;
+  if (validationPath && isAbsolute(validationPath) && command.split(validationPath).length === 2) {
+    try { if (await realpath(validationPath) === await realpath(process.execPath)) return [validationPath]; }
+    catch { /* A missing executable has no exemption. */ }
+  }
+  if (!repositoryRoot || !process.env.USERPROFILE) return [];
+  let configured;
   try {
-    return await realpath(path) === await realpath(process.execPath) ? [path] : [];
+    configured = JSON.parse(await readFile(resolve(repositoryRoot, ".local/validation-runtime.json"), "utf8"));
   } catch { return []; }
+  if (!configured || configured.schema_version !== 1 ||
+      Object.keys(configured).sort().join(",") !== "executable,schema_version" ||
+      typeof configured.executable !== "string" || !isAbsolute(configured.executable)) return [];
+  const expected = resolve(process.env.USERPROFILE, ".cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node.exe");
+  if (resolve(configured.executable).toLowerCase() !== expected.toLowerCase()) return [];
+  // Windows accepts either separator spelling of the same configured literal.
+  // Do not admit aliases, traversal or another executable by realpath alone.
+  const configuredLiteral = value => typeof value === "string" &&
+    value.replaceAll("/", "\\").toLowerCase() === configured.executable.replaceAll("/", "\\").toLowerCase();
+  const directVersion = tokens.length === 2 && tokens[0] === configured.executable && tokens[1] === "--version";
+  const directPreflight = tokens.length === 3 && tokens[0] === configured.executable &&
+    /^packages[\\/]specs[\\/]qualify-proportional-v1\.mjs$/.test(tokens[1]) &&
+    tokens[2] === "preflight";
+  const configuredLauncher = tokens[0] === configured.executable;
+  const validationExecutable = configuredLiteral(validationPath) &&
+    (tokens[3] === "execute"
+      ? tokens[0] === validationPath
+      : configuredLauncher || /^(?:node|node\.exe)$/i.test(tokens[0])) &&
+    command.split(validationPath).length === (tokens[0] === validationPath ? 3 : 2);
+  if (!directVersion && !directPreflight && !validationExecutable) return [];
+  try { return await realpath(configured.executable) === await realpath(expected) ? [validationExecutable ? validationPath : configured.executable] : []; }
+  catch { return []; }
 }
 `;
 //# sourceMappingURL=codex-validation-runtime-template.js.map

package/dist/services/codex-validation-runtime-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-validation-runtime-template.js","sourceRoot":"","sources":["../../src/services/codex-validation-runtime-template.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;CAezD,CAAC"}
+{"version":3,"file":"codex-validation-runtime-template.js","sourceRoot":"","sources":["../../src/services/codex-validation-runtime-template.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CzD,CAAC"}

package/dist/services/runtime-template-test-support.d.ts

@@ -1,3 +1,4 @@
 export declare function run(runtime: string, cwd: string, arguments_: readonly string[]): Record<string, unknown>;
 export declare function snapshotTree(root: string): Promise<Record<string, string>>;
+export declare function testTemplate(roots: string[], name: string, files: readonly (readonly [path: string, content: string])[]): Promise<string>;
 //# sourceMappingURL=runtime-template-test-support.d.ts.map

package/dist/services/runtime-template-test-support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-template-test-support.d.ts","sourceRoot":"","sources":["../../src/services/runtime-template-test-support.ts"],"names":[],"mappings":"AAMA,wBAAgB,GAAG,CACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAchF"}
+{"version":3,"file":"runtime-template-test-support.d.ts","sourceRoot":"","sources":["../../src/services/runtime-template-test-support.ts"],"names":[],"mappings":"AAQA,wBAAgB,GAAG,CACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAchF;AACD,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,GAC3D,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/services/runtime-template-test-support.js

@@ -1,6 +1,8 @@
 import { spawnSync } from "node:child_process";
-import { readdir, readFile } from "node:fs/promises";
-import { relative, resolve } from "node:path";
+import { mkdir, mkdtemp, readdir, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
+import { digestRuntimeFiles, sha256 } from "./template-manifest.js";
 let turnSequence = 0;
 export function run(runtime, cwd, arguments_) {
     const result = spawnSync(process.execPath, [runtime, ...arguments_], {
@@ -29,4 +31,23 @@ export async function snapshotTree(root) {
         (await readFile(path)).toString("base64"),
     ])));
 }
+export async function testTemplate(roots, name, files) {
+    const root = await mkdtemp(join(tmpdir(), `zaip-${name}-template-`));
+    roots.push(root);
+    const records = await Promise.all(files.map(async ([path, content]) => {
+        await mkdir(dirname(resolve(root, path)), { recursive: true });
+        await writeFile(resolve(root, path), content, "utf8");
+        return { path, sha256: sha256(content) };
+    }));
+    await writeFile(resolve(root, "template-manifest.json"), `${JSON.stringify({
+        schemaVersion: 1,
+        templateVersion: "2.2.0",
+        minimumCliVersion: "2.2.0",
+        source: "test",
+        sourceFilesSha256: sha256("test"),
+        runtimeFilesSha256: digestRuntimeFiles([]),
+        files: records,
+    })}\n`, "utf8");
+    return root;
+}
 //# sourceMappingURL=runtime-template-test-support.js.map