@zaip-ai/cli 4.9.0 → 5.1.0

package/dist/services/codex-pre-tool-hook-template.js

@@ -5,12 +5,15 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { captureCliTurn, checkDestructivePatterns, configuredDeploymentBranches, gitInvocation, inside, isLiteralReadSequence, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { captureCliTurn, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, gitInvocation, inside, isLiteralReadSequence, parseHookEvent, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
 const execute = promisify(execFile);
 const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
 const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
 const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 let repositoryRoot = installedRoot;
+let principalFullAccess = false;
+let principalFullNetwork = false;
 const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
 const allowedExplicitNetworkHosts = new Set([
   "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
@@ -32,6 +35,10 @@ const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPAT
 const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:\.[A-Za-z0-9_-]+)*(?:[\\/\s"']|$)/i;
 const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
 const destructivePatterns = [
+  {
+    pattern: /\b(?:Restart-Computer|Stop-Computer|Restart-Host|shutdown(?:\.exe)?|reboot|poweroff|halt|Suspend-Computer|hibernate|logoff|Win32Shutdown)\b/i,
+    reason: "Local computer restart, shutdown, suspension, hibernation and session termination are blocked.",
+  },
   {
     pattern: /\b(?:Clear-Content|shred)\b/i,
     reason: "Unbounded content destruction is blocked.",
@@ -148,7 +155,7 @@ function repositoryPath(path) {
 }
 function isGitPath(path) {
   const scoped = repositoryPath(path).toLowerCase();
-  return scoped === ".git" || scoped.startsWith(".git/");
+  return scoped.split("/").includes(".git");
 }
 
 function unquote(value) {
@@ -172,7 +179,18 @@ function explicitPathCandidates(command) {
   }
   return [...candidates].map(unquote).filter(Boolean);
 }
-function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
+async function assertCanonicalLiteralPath(path, cwd = repositoryRoot) {
+  if (path.split(/[\\/]/).includes("..")) deny("Filesystem traversal is blocked.");
+  for (let cursor = resolve(cwd, path);; cursor = dirname(cursor)) {
+    try {
+      const info = await lstat(cursor);
+      if (info.isSymbolicLink() || (await realpath(cursor)).toLowerCase() !== cursor.toLowerCase())
+        deny("Filesystem links and aliases are blocked.");
+    } catch (error) { if (error?.code !== "ENOENT") deny("Filesystem path could not be safely verified."); }
+    if (dirname(cursor) === cursor) break;
+  }
+}
+async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
   const checked = reviewedPaths.reduce((text, path) => text.replaceAll(path, "REVIEWED_RELEASE_PATH"), command);
   if (homeReferencePattern.test(checked)) {
     deny("Direct user-profile path references are blocked; use repository-scoped paths.");
@@ -180,7 +198,7 @@ function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = [])
   if (credentialReferencePattern.test(checked) || sensitiveEnvironmentPattern.test(checked)) {
     deny("Direct credential and secret access is blocked.");
   }
-  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
+  if (/\b(?:Get-ChildItem|gci|dir|Get-Item|gi)(?:\s+-(?:LiteralPath|Path))?\s+(?:Env|Variable|Function|Alias):|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
     deny("Bulk environment enumeration is blocked.");
   }
   if (/(?:^|[\s"'=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(?:(?:\\\\){1,2}|\/\/)[^\\/\s"']+[\\/]/.test(checked)) {
@@ -191,13 +209,16 @@ function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = [])
     ? checked.replace(/(^|\s)--(?:agent-id|parent-agent-id)\s+\/root(?:\/[a-z][a-z0-9_]*_zaip_agent(?:_[a-z0-9]+)?)+(?=\s|$)/g, "$1--native-agent-id zaip-agent")
     : checked; if (/[\r\n]/.test(checked)) deny("Multiline shell commands are blocked.");
   for (const match of osPathCommand.matchAll(/(["'])(\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:\/[^\r\n]*?)?)\1|(?:^|[\s=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:\/[^\s"'\x60;,)|&]*)?)/gi)) {
-    const path = match[2] ?? match[3], before = osPathCommand[match.index - 1] ?? "", after = osPathCommand[match.index + match[0].length] ?? "", jsonPath = /(?:^|\s)'\{"path":$/.test(osPathCommand.slice(0, match.index)) && /^}'(?:\s|$)/.test(osPathCommand.slice(match.index + match[0].length)); if (jsonPath) { if (path.includes("\\") || !isWithinRepository(resolve(path))) deny("Explicit filesystem path escapes the repository boundary."); continue; }
+    const path = match[2] ?? match[3], before = osPathCommand[match.index - 1] ?? "", after = osPathCommand[match.index + match[0].length] ?? "", jsonPath = /(?:^|\s)'\{"path":$/.test(osPathCommand.slice(0, match.index)) && /^}'(?:\s|$)/.test(osPathCommand.slice(match.index + match[0].length));
+    if (principalFullAccess) { await assertCanonicalLiteralPath(path); continue; }
+    if (jsonPath) { if (path.includes("\\") || !isWithinRepository(resolve(path))) deny("Explicit filesystem path escapes the repository boundary."); continue; }
     if (path.includes("\\") || !isWithinRepository(resolve(path)) || (match[2] && before && !(/\s/.test(before) || before === "=" || jsonPath)) || (after && !/\s/.test(after) && !jsonPath)) deny("Explicit operating-system paths outside the repository are blocked.");
   }
   if (process.platform === "win32" && /(?:^|[\s"'=(,])\\(?!\\)[^\s\\/"'<>|;]+(?:\\[^\s"'<>|;]+|\.[A-Za-z0-9]{1,10})/.test(checked)) {
     deny("Drive-rooted filesystem paths outside the repository are blocked.");
   }
   for (const candidate of explicitPathCandidates(checked)) {
+    if (principalFullAccess) { await assertCanonicalLiteralPath(candidate, cwd); continue; }
     if (process.platform !== "win32" && /^[A-Za-z]:[\\/]/.test(candidate)) deny("Explicit filesystem path escapes the repository boundary.");
     const absolute = resolve(cwd, candidate);
     if (!isWithinRepository(absolute)) {
@@ -328,7 +349,7 @@ function validateExplicitNetwork(command) {
       deny("Malformed network target was rejected.");
     }
     const host = target.hostname.toLowerCase();
-    if (!allowedExplicitNetworkHosts.has(host)) {
+    if (!principalFullNetwork && !allowedExplicitNetworkHosts.has(host)) {
       deny("Explicit network target is outside the ZAIP allowlist.");
     }
     if (host === "releases.hashicorp.com") {
@@ -339,188 +360,6 @@ function validateExplicitNetwork(command) {
   }
 }
 
-function optionMap(tokens) {
-  if (tokens.length % 2 !== 0) return null;
-  const values = new Map();
-  for (let index = 0; index < tokens.length; index += 2) {
-    const key = tokens[index];
-    const value = tokens[index + 1];
-    if (!key.startsWith("--") || value.startsWith("--") || values.has(key)) return null;
-    values.set(key, value);
-  }
-  return values;
-}
-
-function requireExactOptions(options, allowed, required) {
-  if ([...options.keys()].some((key) => !allowed.has(key))) return false;
-  return [...required].every((key) => typeof options.get(key) === "string" && options.get(key).length > 0);
-}
-
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0);
-}
-
-async function readCloudContract(options) {
-  if (options.get("--contract") !== cloudContractPath) {
-    deny("Cloud runner must use the canonical autonomous-cloud contract path.");
-  }
-  const absolute = resolve(repositoryRoot, cloudContractPath);
-  if (!isWithinRepository(absolute)) deny("Cloud runner contract escapes the repository boundary.");
-  let contract;
-  try {
-    contract = JSON.parse(await readFile(absolute, "utf8"));
-  } catch {
-    deny("Cloud runner contract is absent or malformed.");
-  }
-  if (
-    contract === null ||
-    typeof contract !== "object" ||
-    contract.version !== 1 ||
-    contract.profile !== "autonomous-cloud" ||
-    contract.cloudflare === null ||
-    typeof contract.cloudflare !== "object" ||
-    contract.hostinger === null ||
-    typeof contract.hostinger !== "object"
-  ) {
-    deny("Cloud runner contract has no valid autonomous-cloud profile.");
-  }
-  return contract;
-}
-
-function cloudflareTargetMatches(contract, options, operation) {
-  const cloudflare = contract.cloudflare;
-  const record = options.get("--dns-record");
-  const managed = isStringArray(cloudflare.dns_records) && cloudflare.dns_records.includes(record);
-  const direct = cloudflare.direct_dns_records !== null && typeof cloudflare.direct_dns_records === "object" && Object.hasOwn(cloudflare.direct_dns_records, record);
-  return (
-    typeof cloudflare.account_id === "string" &&
-    typeof cloudflare.zone_id === "string" &&
-    isStringArray(cloudflare.allowed_operations) &&
-    cloudflare.account_id === options.get("--account-id") &&
-    cloudflare.zone_id === options.get("--zone-id") &&
-    cloudflare.allowed_operations.includes(operation) &&
-    (operation === "cloudflare:dns:read" ? managed || direct : direct && !managed)
-  );
-}
-
-function hostingerTargetMatches(contract, options, operation) {
-  const hostinger = contract.hostinger;
-  const role = options.get("--vps-role");
-  if (
-    typeof hostinger.account_id !== "string" ||
-    !isStringArray(hostinger.allowed_operations) ||
-    hostinger.account_id !== options.get("--account-id") ||
-    !hostinger.allowed_operations.includes(operation) ||
-    (role !== "edge" && role !== "application") ||
-    hostinger.vps === null ||
-    typeof hostinger.vps !== "object"
-  ) {
-    return false;
-  }
-  const target = hostinger.vps[role];
-  if (target === null || typeof target !== "object") return false;
-
-  if (typeof target.id !== "string" || target.id !== options.get("--vps-id")) return false;
-  if (operation.startsWith("hostinger:ssh:")) {
-    return typeof target.host_key_sha256 === "string" && target.host_key_sha256 === options.get("--host-key-sha256");
-  }
-  return true;
-}
-
-function terraformTargetMatches(contract, options, operation) {
-  const terraform = contract.terraform;
-  if (
-    terraform === null ||
-    typeof terraform !== "object" ||
-    !isStringArray(terraform.allowed_operations) ||
-    !terraform.allowed_operations.includes(operation)
-  ) return false;
-  if (operation === "terraform:plan") return terraform.working_directory === options.get("--terraform-directory");
-  if (operation === "terraform:apply") {
-    const plan = terraform.plan;
-    return plan !== null && typeof plan === "object" && typeof plan.path === "string" && typeof plan.sha256 === "string" && typeof plan.policy_result_sha256 === "string" && plan.path === options.get("--plan-path") && plan.sha256 === options.get("--plan-sha256") && plan.policy_result_sha256 === options.get("--policy-result-sha256");
-  }
-  return terraform.import_targets !== null && typeof terraform.import_targets === "object" && terraform.import_targets[options.get("--resource-address")] === options.get("--resource-id");
-}
-
-function validateDirectCloudProviderMutation(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (/^(?:node|node\.exe)$/i.test(tokens?.[0] ?? "") && tokens?.[1] === cloudRunnerScript) return;
-  if (/\bterraform(?:\.exe)?\s+(?:apply|destroy|import)\b/i.test(command)) deny("Direct Terraform mutation is blocked; use the contract-bound cloud runner.");
-  const provider = /^(?:wrangler|cloudflare|hostinger)(?:\.exe|\.cmd|\.js|\.mjs)?$/i;
-  const wrapperProvider = /^(?:wrangler|cloudflare|hostinger)(?:\.exe|\.cmd|\.js|\.mjs|@[A-Za-z0-9][A-Za-z0-9._-]*)?$/i;
-  const base = (token) => token?.split(/[\\/]/).at(-1) ?? "";
-  if (tokens === null) {
-    // Complex shell syntax stays fail-closed; literal arguments are inspected as tokens below.
-    if (/\b(?:wrangler|cloudflare|hostinger)(?:\.exe)?\b/i.test(command)) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
-    return;
-  }
-  let index = 0;
-  const launcher = base(tokens[0]);
-  if (/^(?:npx|pnpm|npm|yarn|bunx)(?:\.cmd|\.exe)?$/i.test(launcher)) {
-    // Package-manager options can move the executable. Inspect exact provider
-    // tokens across this recognized wrapper; paths and document names remain inert.
-    if (tokens.slice(1).some((token) => wrapperProvider.test(token))) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
-    index = 1;
-    if (/^npx(?:\.cmd|\.exe)?$/i.test(launcher) && /^(?:--yes|-y)$/.test(tokens[index] ?? "")) index += 1;
-    if (/^pnpm(?:\.cmd|\.exe)?$/i.test(launcher) && /^(?:--filter|--dir)$/.test(tokens[index] ?? "") && tokens[index + 1]) index += 2;
-    if (/^(?:exec|dlx)$/.test(tokens[index] ?? "")) index += 1;
-    if (tokens[index] === "--") index += 1;
-    if (/^(?:exec|dlx)$/.test(tokens[index] ?? "")) index += 1;
-  } else if (/^(?:node|node\.exe)$/i.test(launcher)) index = 1;
-  else if (/^(?:powershell|pwsh|cmd|bash|sh)(?:\.exe)?$/i.test(launcher)) {
-    if (/\b(?:wrangler|cloudflare|hostinger)(?:\.exe)?\b/i.test(command)) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
-    return;
-  }
-  if (provider.test(base(tokens[index]))) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
-}
-
-async function validateCloudRunner(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (tokens === null || tokens.length < 2 || !/^(?:node|node\.exe)$/i.test(tokens[0]) || tokens[1] !== cloudRunnerScript) {
-    return false;
-  }
-  const options = optionMap(tokens.slice(2));
-  if (options === null) deny("Cloud runner requires literal, named arguments.");
-  const operation = options.get("--operation");
-  if (operation === "contract:derive") {
-    if (!requireExactOptions(options, new Set(["--operation", "--credentials-source"]), new Set(["--operation", "--credentials-source"]))) {
-      deny("Cloud contract derivation has unrecognized arguments.");
-    }
-    if (options.get("--credentials-source") !== "root") {
-      deny("Cloud contract derivation requires the selected root credential source.");
-    }
-    return true;
-  }
-  const provider = cloudOperationProviders.get(operation);
-  if (provider === undefined) deny("Cloud runner operation is unrecognized or destructive.");
-  const common = new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source", "--zone-id", "--dns-record", "--vps-role", "--vps-id", "--host-key-sha256", "--terraform-directory", "--plan-path", "--plan-sha256", "--policy-result-sha256", "--resource-address", "--resource-id"]);
-  const baseRequired = provider === "terraform"
-    ? new Set(["--contract", "--operation", "--credentials-source"])
-    : new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source"]);
-  if (!requireExactOptions(options, common, baseRequired)) {
-    deny("Cloud runner invocation has unrecognized arguments.");
-  }
-  if ((provider !== "terraform" && options.get("--provider") !== provider) || !["root", "agents"].includes(options.get("--credentials-source"))) {
-    deny("Cloud runner provider or credential source is outside the approved contract.");
-  }
-  const contract = await readCloudContract(options);
-  const valid = provider === "cloudflare"
-    ? requireExactOptions(options, common, new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source", "--zone-id", "--dns-record"])) && cloudflareTargetMatches(contract, options, operation)
-    : provider === "hostinger"
-      ? requireExactOptions(options, common, new Set(["--contract", "--operation", "--provider", "--account-id", "--credentials-source", "--vps-role"])) && hostingerTargetMatches(contract, options, operation)
-      : requireExactOptions(
-          options,
-          common,
-          operation === "terraform:plan"
-            ? new Set(["--contract", "--operation", "--credentials-source", "--terraform-directory"])
-            : operation === "terraform:apply"
-              ? new Set(["--contract", "--operation", "--credentials-source", "--plan-path", "--plan-sha256", "--policy-result-sha256"])
-              : new Set(["--contract", "--operation", "--credentials-source", "--resource-address", "--resource-id"]),
-        ) && terraformTargetMatches(contract, options, operation);
-  if (!valid) deny("Cloud runner target, operation, or host identity is outside the approved contract.");
-  return true;
-}
 
 ${CODEX_STALE_GIT_LOCK_HELPER}
 
@@ -597,6 +436,10 @@ async function validateShellDeletion(command, cwd) {
 }
 
 async function validatePatch(command) {
+  for (const match of command.matchAll(/^\*\*\* (?:Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)) {
+    const rawPath = (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, "");
+    if (principalFullAccess) await assertCanonicalLiteralPath(rawPath);
+  }
   const paths = patchPaths(command);
   const lifecycleRecordTouched = paths.some((path) =>
     /^\.agents[\\/]records[\\/](?:prds|specs|tasks)[\\/]/i.test(path));
@@ -605,8 +448,10 @@ async function validatePatch(command) {
   }
   for (const path of paths) {
     const absolute = resolve(repositoryRoot, path);
-    if (!isWithinRepository(absolute)) deny("Patch path escapes the repository boundary.");
-    if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
+    if (credentialReferencePattern.test(absolute)) deny("Direct credential and secret access is blocked.");
+    if (!isWithinRepository(absolute) && !principalFullAccess) deny("Patch path escapes the repository boundary.");
+    if (principalFullAccess) await assertCanonicalLiteralPath(absolute);
+    else if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
     if (repositoryPath(absolute) === "") deny("Patching the repository root is blocked.");
     if (protectedTaskWorkspacePath(repositoryPath(absolute))) deny("Task workspace claims are managed only by the canonical CLI.");
     if (isGitPath(absolute)) {
@@ -628,13 +473,25 @@ async function requiresOrchestratorRun(event, command) {
     return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
   }
   if (event.tool_name === "Edit" || event.tool_name === "Write") {
-    if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
+    if (principalFullAccess) await assertCanonicalLiteralPath(command, event.cwd ?? repositoryRoot);
+    else if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
     const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, command));
     if (protectedTaskWorkspacePath(path)) deny("Task workspace claims are managed only by the canonical CLI.");
     return !lifecycleExemptPathPattern.test(path);
   }
   // Only single literal writes claim exemptions; compound commands remain gated.
   const tokens = tokenizeLiteralCommand(command);
+  // The public CLI validates the immutable post-publication receipt, observed
+  // invocation, completed maintenance Gui and exact target before any write.
+  // Its first call necessarily follows the maintenance root's terminal Stop.
+  if (tokens && !Object.values(shellSyntax(command)).some(Boolean) &&
+      /^(?:node|node\.exe)$/i.test(tokens[0] ?? "") &&
+      /^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") &&
+      tokens[2] === "task" && tokens[3] === "resume-post-publication" &&
+      /^TASK-[A-Z0-9-]+$/.test(tokens[4] ?? "") && tokens[5] === "--receipt" &&
+      /^\.local[\\/]recovery[\\/]post-publication[\\/][a-f0-9]{64}\.json$/.test(tokens[6] ?? "") &&
+      (tokens.length === 7 || (tokens.length === 8 && tokens[7] === "--json"))) return false;
+  if (tokens && tokens[2] === "task" && tokens[3] === "resume-post-publication") return true;
   if (tokens && /^(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|Rename-Item|sc|ac|ni|cp|mv|mi|ri|rm|git(?:\.exe)?)$/i.test(tokens[0] ?? "") &&
       tokens.some(token => token.toLowerCase().includes("task-workspaces") &&
         protectedTaskWorkspacePath(repositoryPath(resolve(event.cwd ?? repositoryRoot, token)))))
@@ -649,7 +506,8 @@ async function requiresOrchestratorRun(event, command) {
     }
     if (valid && options.has("-literalpath") && options.has("-value")) {
       const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, options.get("-literalpath")));
-      if (!await nativeAuthority?.isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) deny("Shell write path traverses a link or could not be safely verified.");
+      if (principalFullAccess) await assertCanonicalLiteralPath(options.get("-literalpath"), event.cwd ?? repositoryRoot);
+      else if (!await nativeAuthority?.isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) deny("Shell write path traverses a link or could not be safely verified.");
       if (protectedTaskWorkspacePath(path)) deny("Task workspace claims are managed only by the canonical CLI.");
       if (lifecycleExemptPathPattern.test(path)) return false;
     }
@@ -664,37 +522,65 @@ async function requiresOrchestratorRun(event, command) {
     try { optIn = JSON.parse(await readFile(resolve(repositoryRoot, ".local/validation-runtime.json"), "utf8")); }
     catch { optIn = null; }
     const reviewed = await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []);
-    if (optIn?.executable === tokens[0] && reviewed.length === 1 && reviewed[0] === tokens[0]) return false;
+    if (typeof optIn?.executable === "string" &&
+        tokens[0].replaceAll("/", "\\").toLowerCase() === optIn.executable.replaceAll("/", "\\").toLowerCase() &&
+        reviewed.length === 1 && reviewed[0] === tokens[0]) return false;
   }
   return requiresShellMutationRun(command, tokens, event.cwd ?? repositoryRoot, repositoryRoot);
 }
 
-async function boundedCanonicalText(path, maximumBytes, authorityRoot = repositoryRoot) {
-  const info = await lstat(path);
-  if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) throw new Error("Unsafe Run lookup file");
-  const physical = await realpath(path);
-  const identity = value => process.platform === "win32" ? value.toLowerCase() : value;
-  if (!inside(physical, authorityRoot) || identity(physical) !== identity(resolve(path))) throw new Error("Run lookup must not follow links");
-  return readFile(path, "utf8");
-}
+const boundedCanonicalText = (path, maximumBytes, authorityRoot = repositoryRoot) => readBoundedCanonicalText(path, maximumBytes, authorityRoot);
 
 let raw = "";
 for await (const chunk of process.stdin) raw += chunk;
 
 let event;
-try {
-  event = JSON.parse(raw);
-} catch {
-  deny("Malformed hook input was rejected.");
-}
+event = parseHookEvent(raw, deny);
 
 const toolInput = event?.tool_input;
-try { const scope = await selectHookExecutionWorkspace(installedRoot, event); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
+const candidateWorkdir = typeof toolInput?.workdir === "string" && isAbsolute(toolInput.workdir) ? toolInput.workdir : event.cwd;
+try { repositoryRoot = await selectHookRepositoryRoot(installedRoot, candidateWorkdir); }
+catch { repositoryRoot = installedRoot; }
+if (typeof activation?.hookPolicies !== "function") {
+  let projectConfig;
+  try {
+    projectConfig = await readBoundedCanonicalText(resolve(repositoryRoot, ".agents/config/project.yaml"), 65536, repositoryRoot);
+  } catch (error) {
+    if (error?.code === "ENOENT") { writeSync(1, "{}\n"); process.exit(0); }
+    deny("ZAIP project policy cannot be verified without hook activation.");
+  }
+  const sections = [...projectConfig.matchAll(/^zaip:([^\r\n]*)$/gm)];
+  const inlineDisabled = sections.length === 1 && /^\s*\{\s*enabled:\s*false\s*\}(?:\s*#.*)?$/.test(sections[0][1]);
+  const following = sections.length === 1 ? projectConfig.slice(sections[0].index + sections[0][0].length).split(/(?=^[^\s#])/m)[0] : "";
+  const enabledEntries = following.match(/^\s+enabled:/gm) ?? [];
+  const blockDisabled = sections.length === 1 && /^\s*(?:#.*)?$/.test(sections[0][1]) && enabledEntries.length === 1 && /^\s+enabled:\s*false(?:\s*#.*)?$/m.test(following);
+  if (inlineDisabled || blockDisabled) { writeSync(1, "{}\n"); process.exit(0); }
+  deny("ZAIP hook activation module is unavailable for an enabled or invalid project policy.");
+}
+const hookPolicy = await activation.hookPolicies(repositoryRoot, (path, maximumBytes) => readBoundedCanonicalText(path, maximumBytes, repositoryRoot));
+activation?.recordPolicyDiagnostic?.(repositoryRoot, hookPolicy);
+if (hookPolicy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, hookPolicy.governance);
+if (!hookPolicy.governance) {
+  if (hookPolicy.diagnostic && !["config_missing", "policy_missing"].includes(hookPolicy.diagnostic))
+    deny("ZAIP project policy is invalid or unavailable; restore the canonical activation and project configuration.");
+  writeSync(1, "{}\n");
+  process.exit(0);
+}
+const configuredPolicy = await configuredPermissionProfile(repositoryRoot);
+const principal = [event.agent_id, event.agent_type, event.agent_path, event.parent_agent_id].every(value => value === undefined) && event.permission_mode !== "plan";
+principalFullAccess = principal && configuredPolicy.filesystem;
+principalFullNetwork = principal && configuredPolicy.network;
+try { const scope = await selectHookExecutionWorkspace(installedRoot, event, principalFullAccess); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
 catch (error) { deny(error.message); }
-if (!isWithinRepository(event.cwd)) {
+if (credentialReferencePattern.test(event.cwd)) deny("Direct credential and secret access is blocked.");
+if (!principalFullAccess && !isWithinRepository(event.cwd)) {
   deny("Tool execution outside the ZAIP-AIOS repository is blocked.");
 }
 
+const { validateCloudRunner, validateDirectCloudProviderMutation } = createCloudValidators({
+  tokenizeLiteralCommand, deny, repositoryRoot, isWithinRepository, cloudRunnerScript, cloudContractPath, cloudOperationProviders,
+});
+
 const commandFromCmd = toolInput?.cmd;
 const commandFromCommand = toolInput?.command;
 if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string" && commandFromCmd !== commandFromCommand) {
@@ -703,7 +589,7 @@ if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string"
 const command = typeof commandFromCmd === "string" ? commandFromCmd : commandFromCommand;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
 
-if (await requiresOrchestratorRun(event, command) && !(await activation?.isZaipDisabled?.(repositoryRoot, boundedCanonicalText))) {
+if (await requiresOrchestratorRun(event, command)) {
   const directRun = await nativeAuthority?.hasCurrentTaskOrchestratorRun(event, installedRoot, boundedCanonicalText);
   const primaryRead = (path, maximumBytes) => boundedCanonicalText(path, maximumBytes, installedRoot);
   const delegated = directRun ? false : await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, primaryRead, installedRoot);
@@ -722,7 +608,7 @@ else {
     ...await reviewedReleasePaths(command, event.cwd, repositoryRoot, credentialReferencePattern, deny),
     ...await reviewedContextReadPaths(command, credentialReferencePattern, installedRoot), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []),
   ];
-  validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
+  await validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
   validateInlineExecution(command, deny);
   if (!isLiteralReadSequence(command)) {
   await validateGitPublication(command);

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2gB3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsN5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0W3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqQ5B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.test.js

@@ -3,22 +3,21 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, it } from "vitest";
-import { CODEX_HOOK_ACTIVATION } from "./codex-hook-activation.js";
-import { CODEX_NATIVE_TOOL_AUTHORITY_HOOK } from "./codex-native-tool-authority-template.js";
-import { CODEX_PRE_TOOL_HOOK } from "./codex-pre-tool-hook-template.js";
-import { CODEX_PRE_TOOL_SUPPORT_HOOK } from "./codex-pre-tool-support-template.js";
+import { installPreToolHook } from "./codex-pre-tool-hook-fixture.test-support.js";
 const roots = [];
+async function enableZaip(root) {
+    const config = join(root, ".agents", "config");
+    await mkdir(config, { recursive: true });
+    await writeFile(join(config, "project.yaml"), "zaip:\n  enabled: true\ntracking:\n  enabled: false\n");
+}
 afterEach(async () => {
     await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
 });
 it("portable hook restricts HashiCorp release reads to the exact HTTPS host and GET or HEAD", async () => {
     const root = await mkdtemp(join(tmpdir(), "zaip-cli-hashicorp-read-"));
     roots.push(root);
-    const hooks = join(root, ".codex", "hooks");
-    await mkdir(hooks, { recursive: true });
-    await writeFile(join(hooks, "zaip-pre-tool-use.mjs"), CODEX_PRE_TOOL_HOOK);
-    await writeFile(join(hooks, "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
-    await writeFile(join(hooks, "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
+    await enableZaip(root);
+    const { hooks } = await installPreToolHook(root);
     const invoke = (cmd) => spawnSync(process.execPath, [join(hooks, "zaip-pre-tool-use.mjs")], {
         cwd: root,
         encoding: "utf8",
@@ -50,12 +49,7 @@ it("portable hook restricts HashiCorp release reads to the exact HTTPS host and
 it("portable hook releases Task authority only for literal ZAIP disable", async () => {
     const root = await mkdtemp(join(tmpdir(), "zaip-cli-disabled-hook-"));
     roots.push(root);
-    const hooks = join(root, ".codex", "hooks");
-    await mkdir(hooks, { recursive: true });
-    await writeFile(join(hooks, "zaip-pre-tool-use.mjs"), CODEX_PRE_TOOL_HOOK);
-    await writeFile(join(hooks, "zaip-hook-activation.mjs"), CODEX_HOOK_ACTIVATION);
-    await writeFile(join(hooks, "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
-    await writeFile(join(hooks, "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
+    const { hooks } = await installPreToolHook(root);
     const config = join(root, ".agents", "config", "project.yaml");
     await mkdir(join(root, ".agents", "config"), { recursive: true });
     const run = () => spawnSync(process.execPath, [join(hooks, "zaip-pre-tool-use.mjs")], {
@@ -68,10 +62,11 @@ it("portable hook releases Task authority only for literal ZAIP disable", async
         }),
     });
     await writeFile(config, "schema_version: 1\nzaip:\n  enabled: false\n");
-    expect(run().stdout).toBe("");
+    expect(run().stdout).toBe("{}\n");
     await writeFile(config, 'schema_version: 1\nzaip:\n  enabled: "false"\n');
     expect(JSON.parse(run().stdout).hookSpecificOutput.permissionDecision).toBe("deny");
     await writeFile(config, "schema_version: 1\nzaip:\n  enabled: false\n");
+    await writeFile(config, "schema_version: 1\nzaip:\n  enabled: true\n");
     await rm(join(hooks, "zaip-hook-activation.mjs"));
     for (const state of ["missing", "legacy"]) {
         if (state === "legacy")
@@ -79,17 +74,14 @@ it("portable hook releases Task authority only for literal ZAIP disable", async
         const result = run();
         expect(result.status).toBe(0);
         expect(result.stderr).toBe("");
-        expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+        expect(JSON.parse(result.stdout).hookSpecificOutput?.permissionDecision).toBe("deny");
     }
 });
 it("permits only literal reviewed release commands with controlled external paths", async () => {
     const root = await mkdtemp(join(tmpdir(), "zaip-cli-release-hook-"));
     roots.push(root);
-    const hookPath = join(root, ".codex", "hooks", "zaip-pre-tool-use.mjs");
-    await mkdir(join(root, ".codex", "hooks"), { recursive: true });
-    await writeFile(hookPath, CODEX_PRE_TOOL_HOOK);
-    await writeFile(join(root, ".codex", "hooks", "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
-    await writeFile(join(root, ".codex", "hooks", "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
+    await enableZaip(root);
+    const { hookPath } = await installPreToolHook(root);
     await mkdir(join(root, "scripts"), { recursive: true });
     await writeFile(join(root, "scripts", "local-release-preparation.mjs"), "export default null;\n");
     await writeFile(join(root, "scripts", "local-release-deploy.mjs"), "export default null;\n");
@@ -160,11 +152,8 @@ it("permits only literal reviewed release commands with controlled external path
 it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git formatting", async () => {
     const root = await mkdtemp(join(tmpdir(), "zaip-cli-pre-tool-"));
     roots.push(root);
-    const hookPath = join(root, ".codex", "hooks", "zaip-pre-tool-use.mjs");
-    await mkdir(join(root, ".codex", "hooks"), { recursive: true });
-    await writeFile(hookPath, CODEX_PRE_TOOL_HOOK);
-    await writeFile(join(root, ".codex", "hooks", "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
-    await writeFile(join(root, ".codex", "hooks", "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
+    await enableZaip(root);
+    const { hookPath } = await installPreToolHook(root);
     const invoke = (tool_input) => spawnSync(process.execPath, [hookPath], {
         cwd: root,
         encoding: "utf8",
@@ -306,6 +295,22 @@ it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git f
         expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
         expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecisionReason).toContain(reason);
     }
+    const metadataAndSearch = invoke({
+        cmd: "Get-Item package.json | Select-Object FullName; rg -n 'spawn|execPath|node|runCli' packages/cli/src/index.ts | Select-Object -First 22",
+    });
+    expect(metadataAndSearch.status).toBe(0);
+    expect(metadataAndSearch.stdout).toBe("");
+    const originalRead = invoke({
+        cmd: "Get-Item -LiteralPath node_modules/vitest | Select-Object -ExpandProperty Target; rg -n 'spawn|execPath|node|runCli' packages/cli/src -g 'prd-spec-composite-create*.ts' -g 'cli-test-harness.ts' | Select-Object -First 22",
+    });
+    expect(originalRead.status).toBe(0);
+    expect(originalRead.stdout).toBe("");
+    const realInterpreterPipe = invoke({
+        cmd: "rg -n 'spawn|execPath|node|runCli' packages/cli/src/index.ts | node",
+    });
+    expect(JSON.parse(realInterpreterPipe.stdout).hookSpecificOutput.permissionDecisionReason).toContain("Inline or piped interpreter execution");
+    expect(JSON.parse(invoke({ cmd: "Get-Item Env:SECRET | Select-Object FullName" }).stdout)
+        .hookSpecificOutput.permissionDecision).toBe("deny");
     const denied = invoke({ cmd: "git status", command: "git reset --hard" });
     expect(denied.status).toBe(0);
     expect(JSON.parse(denied.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
@@ -314,57 +319,4 @@ it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git f
     const nestedDiskDenied = invoke({ cmd: "cmd /c " + "format" + " C:" });
     expect(JSON.parse(nestedDiskDenied.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
 });
-it("allows explicit acceptance arguments before Task capture without allowing writes", async () => {
-    const root = await mkdtemp(join(tmpdir(), "zaip-cli-bootstrap-hook-"));
-    roots.push(root);
-    const hooks = join(root, ".codex", "hooks");
-    await mkdir(hooks, { recursive: true });
-    await writeFile(join(hooks, "zaip-pre-tool-use.mjs"), CODEX_PRE_TOOL_HOOK);
-    await writeFile(join(hooks, "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
-    await writeFile(join(hooks, "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
-    const invoke = (cmd) => spawnSync(process.execPath, [join(hooks, "zaip-pre-tool-use.mjs")], {
-        cwd: root,
-        encoding: "utf8",
-        windowsHide: true,
-        env: { ...process.env, CODEX_THREAD_ID: "bootstrap-thread", CODEX_TURN_ID: "bootstrap-turn" },
-        input: JSON.stringify({
-            cwd: root,
-            session_id: "bootstrap-thread",
-            turn_id: "bootstrap-turn",
-            tool_use_id: "bootstrap-tool",
-            tool_name: "exec_command",
-            tool_input: { cmd },
-        }),
-    });
-    const result = invoke("node .agents/runtime/bin/zaip.mjs conversation start --intent new-work --acceptance AC-WORK-001-09 --json");
-    expect(result.status, result.stderr).toBe(0);
-    const output = JSON.parse(result.stdout).hookSpecificOutput;
-    expect(output.permissionDecision, result.stdout).toBe("allow");
-    expect(output.updatedInput.cmd).toContain("--codex-hook-id=");
-    for (const cmd of [
-        "ac src/a.ts payload",
-        "AC src/a.ts payload",
-        "(Set-Content -LiteralPath src/a.ts -Value code)",
-        "Write-Output (Set-Content -LiteralPath src/a.ts -Value code)",
-        "env cp src/a.ts src/b.ts",
-        "exec cp src/a.ts src/b.ts",
-        "FOO=1 cp src/a.ts src/b.ts",
-        "unknown-wrapper ac src/a.ts payload",
-        ".\\echo.cmd ac src/a.ts payload",
-        ".\\node.cmd .agents/runtime/bin/zaip.mjs conversation start --acceptance AC-WORK-001-09",
-        "echo.cmd ac src/a.ts payload",
-        "node.cmd .agents/runtime/bin/zaip.mjs conversation start --acceptance AC-WORK-001-09",
-        "node scripts/unknown.mjs --acceptance AC-WORK-001-09",
-        "command ac src/a.ts payload",
-        ".\\sed.exe -i s/a/b/ src/a.ts",
-        ".\\sed.exe -f script.sed src/input.ts",
-        "git apply patch.diff",
-        "node scripts/read.mjs --acceptance AC-WORK-001-09; ac src/a.ts payload",
-        "node scripts/read.mjs > src/a.ts",
-    ]) {
-        const blocked = invoke(cmd);
-        expect(blocked.status, blocked.stderr).toBe(0);
-        expect(JSON.parse(blocked.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
-    }
-});
 //# sourceMappingURL=codex-pre-tool-hook-template.test.js.map