@zaip-ai/cli 5.5.0 → 5.7.0

package/dist/services/adapter-hook-sources.d.ts

@@ -1,6 +1,7 @@
 export { CODEX_CONVERSATION_LIFECYCLE_HOOK } from "./codex-conversation-lifecycle-hook.js";
 export { CODEX_PRE_TOOL_HOOK } from "./codex-pre-tool-hook-template.js";
 export { CODEX_PRE_TOOL_SUPPORT_HOOK } from "./codex-pre-tool-support-template.js";
+export { CODEX_PRE_TOOL_RELEASE_REVIEW } from "./codex-pre-tool-release-review-template.js";
 export { CODEX_SUBAGENT_LIFECYCLE_HOOK } from "./codex-subagent-hook-template.js";
 export { CODEX_PRE_TOOL_CLOUD_HOOK } from "./codex-pre-tool-cloud-template.js";
 export { CODEX_PRE_TOOL_HOST_CONTEXT_HOOK } from "./codex-pre-tool-host-context-template.js";

package/dist/services/adapter-hook-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-hook-sources.d.ts","sourceRoot":"","sources":["../../src/services/adapter-hook-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"adapter-hook-sources.d.ts","sourceRoot":"","sources":["../../src/services/adapter-hook-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/services/adapter-hook-sources.js

@@ -1,6 +1,7 @@
 export { CODEX_CONVERSATION_LIFECYCLE_HOOK } from "./codex-conversation-lifecycle-hook.js";
 export { CODEX_PRE_TOOL_HOOK } from "./codex-pre-tool-hook-template.js";
 export { CODEX_PRE_TOOL_SUPPORT_HOOK } from "./codex-pre-tool-support-template.js";
+export { CODEX_PRE_TOOL_RELEASE_REVIEW } from "./codex-pre-tool-release-review-template.js";
 export { CODEX_SUBAGENT_LIFECYCLE_HOOK } from "./codex-subagent-hook-template.js";
 export { CODEX_PRE_TOOL_CLOUD_HOOK } from "./codex-pre-tool-cloud-template.js";
 export { CODEX_PRE_TOOL_HOST_CONTEXT_HOOK } from "./codex-pre-tool-host-context-template.js";

package/dist/services/adapter-hook-sources.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-hook-sources.js","sourceRoot":"","sources":["../../src/services/adapter-hook-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"adapter-hook-sources.js","sourceRoot":"","sources":["../../src/services/adapter-hook-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/services/adapters.d.ts

@@ -1,6 +1,6 @@
 import { type PublicAgentCatalog } from "./agent-adapters.js";
 export { isManagedAdapter } from "./managed-adapter.js";
-export declare const ADAPTERS_VERSION = "5.5.0";
+export declare const ADAPTERS_VERSION = "5.7.0";
 export interface AdapterFile {
     path: string;
     content: string;

package/dist/services/adapters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,kBAAkB,EAGxB,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMxD,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAuLD,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,SAAS,WAAW,EAAE,CA2FxB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC,CAaD;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,UAAQ,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CA6B7D"}
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,kBAAkB,EAGxB,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMxD,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAuLD,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,SAAS,WAAW,EAAE,CAgGxB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC,CAaD;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,UAAQ,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CA6B7D"}

package/dist/services/adapters.js

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { CODEX_CONVERSATION_LIFECYCLE_HOOK, CODEX_PRE_TOOL_HOOK, CODEX_PRE_TOOL_SUPPORT_HOOK, CODEX_PRE_TOOL_CLOUD_HOOK, CODEX_PRE_TOOL_HOST_CONTEXT_HOOK, CODEX_PRE_TOOL_CLI_CAPTURE_HOOK, CODEX_SUBAGENT_LIFECYCLE_HOOK, } from "./adapter-hook-sources.js";
+import { CODEX_CONVERSATION_LIFECYCLE_HOOK, CODEX_PRE_TOOL_HOOK, CODEX_PRE_TOOL_SUPPORT_HOOK, CODEX_PRE_TOOL_RELEASE_REVIEW, CODEX_PRE_TOOL_CLOUD_HOOK, CODEX_PRE_TOOL_HOST_CONTEXT_HOOK, CODEX_PRE_TOOL_CLI_CAPTURE_HOOK, CODEX_SUBAGENT_LIFECYCLE_HOOK, } from "./adapter-hook-sources.js";
 import { codexAgentConfig, parsePublicAgentCatalog, publicAgentAdapterFiles, } from "./agent-adapters.js";
 import { serializeAgentDiscovery } from "./agent-discovery.js";
 import { isReconciledCodexConfig, reconcileCodexConfig } from "./codex-config-overlay.js";
@@ -11,7 +11,7 @@ export { isManagedAdapter } from "./managed-adapter.js";
 import { CODEX_GITHUB_DEPLOY_RULES, CODEX_SECURITY_RULES } from "./codex-rules.js";
 import { codexWindowsHookCommand } from "./codex-windows-hook-command.js";
 import { applyTransactionalChanges, assertSafeDestination } from "./transactional-files.js";
-export const ADAPTERS_VERSION = "5.5.0";
+export const ADAPTERS_VERSION = "5.7.0";
 const ROOT_GUIDANCE = `# ZAIP-AIOS
 
 Read \`.agents/config/project.yaml\` first. Apply ZAIP only for literal boolean \`zaip.enabled: true\`, except framework maintenance or \`zaip enable\`. \`AGENTS.md\` is a bootstrap; canonical guidance lives in \`.agents/\`.
@@ -203,6 +203,7 @@ export function adapterFiles(workspaceRoot, catalog) {
         managed(".codex/hooks/zaip-hook-activation.mjs", CODEX_HOOK_ACTIVATION, "codex-hook-activation"),
         managed(".codex/hooks/zaip-pre-tool-use.mjs", CODEX_PRE_TOOL_HOOK, "codex-safety-hook"),
         managed(".codex/hooks/zaip-pre-tool-support.mjs", CODEX_PRE_TOOL_SUPPORT_HOOK, "codex-safety-support"),
+        managed(".codex/hooks/zaip-pre-tool-release-review.mjs", CODEX_PRE_TOOL_RELEASE_REVIEW, "codex-safety-release-review"),
         managed(".codex/hooks/zaip-pre-tool-cloud.mjs", CODEX_PRE_TOOL_CLOUD_HOOK, "codex-safety-cloud"),
         managed(".codex/hooks/zaip-pre-tool-host-context.mjs", CODEX_PRE_TOOL_HOST_CONTEXT_HOOK, "codex-safety-host-context"),
         managed(".codex/hooks/zaip-pre-tool-cli-capture.mjs", CODEX_PRE_TOOL_CLI_CAPTURE_HOOK, "codex-safety-cli-capture"),

package/dist/services/adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAEhB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAOxC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;CAcrB,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAA4B;IACtD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC;IACvF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,CAC1B,8YAA8Y,EAC9Y,qlCAAqlC,CACtlC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG;;;;;;;;;;;;;;CAcvB,CAAC;AAEF,MAAM,+BAA+B,GAAG;;;;CAIvC,CAAC;AAEF,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;6CAgBwB,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoG5E,CAAC;AAEF,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,CAAC,WAAW,CAAU,CAAC;AAExD,MAAM,eAAe,GAAG;;;;;;CAMvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,OAA4B;IAE5B,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CACzC,gCAAgC,EAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CACvC;SACE,UAAU,CAAC,gCAAgC,EAAE,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;SAC9F,UAAU,CACT,oCAAoC,EACpC,uBAAuB,CAAC,iCAAiC,CAAC,CAC3D;SACA,UAAU,CACT,gCAAgC,EAChC,uBAAuB,CAAC,6BAA6B,CAAC,CACvD,CAAC;IACJ,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,CACL,sCAAsC,EACtC,uBAAuB,CAAC,OAAO,CAAC,EAChC,iBAAiB,CAClB;aACF,CAAC;QACN,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;QAClE,OAAO,CAAC,kCAAkC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAC/E,OAAO,CAAC,mCAAmC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAChF,OAAO,CACL,4CAA4C,EAC5C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,6CAA6C,EAC7C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,oBAAoB,EACpB,GAAG,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,EAChF,cAAc,CACf;QACD,OAAO,CACL,uCAAuC,EACvC,qBAAqB,EACrB,uBAAuB,CACxB;QACD,OAAO,CAAC,oCAAoC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACvF,OAAO,CACL,wCAAwC,EACxC,2BAA2B,EAC3B,sBAAsB,CACvB;QACD,OAAO,CACL,sCAAsC,EACtC,yBAAyB,EACzB,oBAAoB,CACrB;QACD,OAAO,CACL,6CAA6C,EAC7C,gCAAgC,EAChC,2BAA2B,CAC5B;QACD,OAAO,CACL,4CAA4C,EAC5C,+BAA+B,EAC/B,0BAA0B,CAC3B;QACD,OAAO,CACL,6CAA6C,EAC7C,gCAAgC,EAChC,6BAA6B,CAC9B;QACD,OAAO,CACL,8CAA8C,EAC9C,iCAAiC,EACjC,mCAAmC,CACpC;QACD,OAAO,CACL,0CAA0C,EAC1C,6BAA6B,EAC7B,+BAA+B,CAChC;QACD,OAAO,CACL,uCAAuC,EACvC,yBAAyB,EACzB,2BAA2B,CAC5B;QACD,OAAO,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;QACzF,OAAO,CAAC,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAI9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,KAAK,GAAG,KAAK;IAEb,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAgD,EAAE,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACjF,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,uBAAuB,CACrC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IACzD,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,mBAAmB,EACnB,2BAA2B,EAC3B,6BAA6B,EAC7B,yBAAyB,EACzB,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gBAAgB,EAEhB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAOxC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;CAcrB,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAA4B;IACtD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC;IACvF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,CAC1B,8YAA8Y,EAC9Y,qlCAAqlC,CACtlC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG;;;;;;;;;;;;;;CAcvB,CAAC;AAEF,MAAM,+BAA+B,GAAG;;;;CAIvC,CAAC;AAEF,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;6CAgBwB,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoG5E,CAAC;AAEF,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,CAAC,WAAW,CAAU,CAAC;AAExD,MAAM,eAAe,GAAG;;;;;;CAMvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,OAA4B;IAE5B,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CACzC,gCAAgC,EAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CACvC;SACE,UAAU,CAAC,gCAAgC,EAAE,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;SAC9F,UAAU,CACT,oCAAoC,EACpC,uBAAuB,CAAC,iCAAiC,CAAC,CAC3D;SACA,UAAU,CACT,gCAAgC,EAChC,uBAAuB,CAAC,6BAA6B,CAAC,CACvD,CAAC;IACJ,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,CACL,sCAAsC,EACtC,uBAAuB,CAAC,OAAO,CAAC,EAChC,iBAAiB,CAClB;aACF,CAAC;QACN,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;QAClE,OAAO,CAAC,kCAAkC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAC/E,OAAO,CAAC,mCAAmC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAChF,OAAO,CACL,4CAA4C,EAC5C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,6CAA6C,EAC7C,+BAA+B,EAC/B,iCAAiC,CAClC;QACD,OAAO,CACL,oBAAoB,EACpB,GAAG,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,EAChF,cAAc,CACf;QACD,OAAO,CACL,uCAAuC,EACvC,qBAAqB,EACrB,uBAAuB,CACxB;QACD,OAAO,CAAC,oCAAoC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACvF,OAAO,CACL,wCAAwC,EACxC,2BAA2B,EAC3B,sBAAsB,CACvB;QACD,OAAO,CACL,+CAA+C,EAC/C,6BAA6B,EAC7B,6BAA6B,CAC9B;QACD,OAAO,CACL,sCAAsC,EACtC,yBAAyB,EACzB,oBAAoB,CACrB;QACD,OAAO,CACL,6CAA6C,EAC7C,gCAAgC,EAChC,2BAA2B,CAC5B;QACD,OAAO,CACL,4CAA4C,EAC5C,+BAA+B,EAC/B,0BAA0B,CAC3B;QACD,OAAO,CACL,6CAA6C,EAC7C,gCAAgC,EAChC,6BAA6B,CAC9B;QACD,OAAO,CACL,8CAA8C,EAC9C,iCAAiC,EACjC,mCAAmC,CACpC;QACD,OAAO,CACL,0CAA0C,EAC1C,6BAA6B,EAC7B,+BAA+B,CAChC;QACD,OAAO,CACL,uCAAuC,EACvC,yBAAyB,EACzB,2BAA2B,CAC5B;QACD,OAAO,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;QACzF,OAAO,CAAC,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAI9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,KAAK,GAAG,KAAK;IAEb,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAgD,EAAE,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACjF,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,uBAAuB,CACrC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IACzD,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC"}

package/dist/services/codex-hook-activation.d.ts

@@ -1,4 +1,4 @@
 export declare const HOOK_ACTIVATION_EVENTS: readonly ["PreToolUse", "SubagentStart", "SubagentStop", "Stop"];
-export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-pre-tool-cloud.mjs", ".codex/hooks/zaip-pre-tool-host-context.mjs", ".codex/hooks/zaip-pre-tool-cli-capture.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
+export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-pre-tool-release-review.mjs", ".codex/hooks/zaip-pre-tool-cloud.mjs", ".codex/hooks/zaip-pre-tool-host-context.mjs", ".codex/hooks/zaip-pre-tool-cli-capture.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
 export declare const CODEX_HOOK_ACTIVATION: string;
 //# sourceMappingURL=codex-hook-activation.d.ts.map

package/dist/services/codex-hook-activation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,sCAAsC,EACtC,6CAA6C,EAC7C,4CAA4C,EAC5C,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QAiKjC,CAAC"}
+{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,+CAA+C,EAC/C,sCAAsC,EACtC,6CAA6C,EAC7C,4CAA4C,EAC5C,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QAiKjC,CAAC"}

package/dist/services/codex-hook-activation.js

@@ -8,6 +8,7 @@ export const HOOK_ACTIVATION_FILES = [
     ".codex/config.toml",
     ".codex/hooks/zaip-pre-tool-use.mjs",
     ".codex/hooks/zaip-pre-tool-support.mjs",
+    ".codex/hooks/zaip-pre-tool-release-review.mjs",
     ".codex/hooks/zaip-pre-tool-cloud.mjs",
     ".codex/hooks/zaip-pre-tool-host-context.mjs",
     ".codex/hooks/zaip-pre-tool-cli-capture.mjs",

package/dist/services/codex-hook-activation.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,sCAAsC;IACtC,6CAA6C;IAC7C,4CAA4C;IAC5C,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;gBAI/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JtD,CAAC"}
+{"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,+CAA+C;IAC/C,sCAAsC;IACtC,6CAA6C;IAC7C,4CAA4C;IAC5C,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;gBAI/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JtD,CAAC"}

package/dist/services/codex-pre-tool-dependencies.test-support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-dependencies.test-support.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-dependencies.test-support.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"codex-pre-tool-dependencies.test-support.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-dependencies.test-support.ts"],"names":[],"mappings":"AAKA,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/services/codex-pre-tool-dependencies.test-support.js

@@ -1,9 +1,11 @@
 import { CODEX_PRE_TOOL_CLOUD_HOOK } from "./codex-pre-tool-cloud-template.js";
 import { CODEX_PRE_TOOL_HOST_CONTEXT_HOOK } from "./codex-pre-tool-host-context-template.js";
 import { CODEX_PRE_TOOL_CLI_CAPTURE_HOOK } from "./codex-pre-tool-cli-capture-template.js";
+import { CODEX_PRE_TOOL_RELEASE_REVIEW } from "./codex-pre-tool-release-review-template.js";
 export async function writePreToolDependencies(write) {
     await write("zaip-pre-tool-cloud.mjs", CODEX_PRE_TOOL_CLOUD_HOOK);
     await write("zaip-pre-tool-host-context.mjs", CODEX_PRE_TOOL_HOST_CONTEXT_HOOK);
     await write("zaip-pre-tool-cli-capture.mjs", CODEX_PRE_TOOL_CLI_CAPTURE_HOOK);
+    await write("zaip-pre-tool-release-review.mjs", CODEX_PRE_TOOL_RELEASE_REVIEW);
 }
 //# sourceMappingURL=codex-pre-tool-dependencies.test-support.js.map

package/dist/services/codex-pre-tool-dependencies.test-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-dependencies.test-support.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-dependencies.test-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAE3F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAuD;IAEvD,MAAM,KAAK,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,CAAC;IAChF,MAAM,KAAK,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"codex-pre-tool-dependencies.test-support.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-dependencies.test-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAE5F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAuD;IAEvD,MAAM,KAAK,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,CAAC;IAChF,MAAM,KAAK,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;IAC9E,MAAM,KAAK,CAAC,kCAAkC,EAAE,6BAA6B,CAAC,CAAC;AACjF,CAAC"}

package/dist/services/codex-pre-tool-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,QAspB/B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,QAod/B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.js

@@ -1,139 +1,6 @@
+import { CODEX_PRE_TOOL_POLICY_HEADER } from "./codex-pre-tool-policy-template.js";
 import { CODEX_STALE_GIT_LOCK_HELPER } from "./codex-stale-git-lock-template.js";
-export const CODEX_PRE_TOOL_HOOK = String.raw `import { execFile } from "node:child_process";
-import { writeSync } from "node:fs";
-import { lstat, readFile, realpath } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
-import { captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, gitInvocation, inside, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
-import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
-const { execute, parseEvent } = createHookBudget(promisify(execFile));
-const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
-const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
-const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
-let repositoryRoot = installedRoot;
-let principalFullAccess = false;
-let principalFullNetwork = false;
-const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
-const allowedExplicitNetworkHosts = new Set([
-  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
-]);
-const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
-const cloudRunnerScript = ".agents/tools/cloud-runner.mjs";
-const cloudContractPath = ".agents/config/autonomous-cloud-contract.json";
-const cloudOperationProviders = new Map([
-  ["cloudflare:dns:read", "cloudflare"], ["cloudflare:dns:create", "cloudflare"], ["cloudflare:dns:edit", "cloudflare"],
-  ["hostinger:vps:read", "hostinger"],
-  ["hostinger:ssh:read", "hostinger"],
-  ["hostinger:ssh:configure", "hostinger"],
-  ["hostinger:ssh:test", "hostinger"],
-  ["terraform:plan", "terraform"],
-  ["terraform:apply", "terraform"],
-  ["terraform:import", "terraform"],
-]);
-const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPATH)\b|%(?:USERPROFILE|HOMEDRIVE|HOMEPATH)%|(?:^|[\s"'=])~[\\/])/i;
-const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:\.[A-Za-z0-9_-]+)*(?:[\\/\s"']|$)/i;
-const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
-const destructivePatterns = [
-  {
-    pattern: /\b(?:Restart-Computer|Stop-Computer|Restart-Host|shutdown(?:\.exe)?|reboot|poweroff|halt|Suspend-Computer|hibernate|logoff|Win32Shutdown)\b/i,
-    reason: "Local computer restart, shutdown, suspension, hibernation and session termination are blocked.",
-  },
-  {
-    pattern: /\b(?:Clear-Content|shred)\b/i,
-    reason: "Unbounded content destruction is blocked.",
-  },
-  {
-    pattern: /\bgit\s+(?:clean\b|reset\s+--hard\b|checkout\s+--\b|restore\b|branch\s+-d\b|tag\s+-d\b)/i,
-    reason: "Destructive Git state changes are blocked.",
-  },
-  {
-    pattern: /\bgit\s+push\b[\s\S]*(?:--force(?:-with-lease|-if-includes)?\b|-f\b|--mirror\b|--delete\b|--all\b|(?:^|\s):\S+)/i,
-    reason: "Force, mirror, bulk, and deletion pushes are blocked.",
-  },
-  {
-    pattern: /\bgit\s+commit\b[\s\S]*(?:--amend\b|--no-verify\b|-n\b)/i,
-    reason: "Commit history rewrites and hook bypasses are blocked.",
-  },
-  {
-    pattern: /\bgit\s+(?:-c\b|--config(?:-env)?\b|--git-dir\b|--work-tree\b|--namespace\b)/,
-    reason: "Git global configuration and repository-routing overrides are blocked.",
-  },
-  {
-    pattern: /\bgit\s+fetch\b[\s\S]*(?:--all\b|--prune\b|--prune-tags\b)/i,
-    reason: "Bulk or pruning fetches are outside the bounded deploy flow.",
-  },
-  {
-    pattern: /\bgit\s+add\b[\s\S]*(?:--force\b|-f\b|(?:^|[\\/\s])(?:\.env(?:\.|\s|$)|[^\s]*\.(?:pem|key|p12|pfx)\b|id_(?:rsa|ed25519)\b))/i,
-    reason: "Force-adding or explicitly staging credential-like files is blocked.",
-  },
-  {
-    pattern: /\bgit\s+add\b[\s\S]*(?:\s-A\b|--all\b|(?:^|\s)\.(?:\s|$)|\s-u\b)/i,
-    reason: "Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.",
-  },
-  {
-    pattern: /\bgit\s+(?:remote\s+(?:add|set-url|remove|rename)|config\b[\s\S]*(?:sshCommand|credential|url\.))/i,
-    reason: "Remote, SSH, and credential configuration changes are blocked.",
-  },
-  {
-    pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,
-    reason: "GitHub CLI commands must target the current repository.",
-  },
-  {
-    pattern: /\b(?:drop\s+(?:database|schema|table)|truncate\s+table|supabase\s+db\s+reset)\b/i,
-    reason: "Destructive database operations are blocked.",
-  },
-  {
-    pattern: /\b(?:rmSync|rmdirSync|unlinkSync|rmtree|remove|unlink|Directory\.Delete|File\.Delete)\s*\(/i,
-    reason: "Inline deletion APIs are blocked.",
-  },
-  {
-    pattern: /(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|\biwr\b|\birm\b)[\s\S]*\|[\s&]*(?:bash|sh|zsh|pwsh|powershell|cmd|node|python|iex|Invoke-Expression)\b/i,
-    reason: "Downloaded content cannot be piped into an interpreter.",
-  },
-  {
-    pattern: /(?:-(?:EncodedCommand|enc)\b|FromBase64String\s*\(|certutil\s+-(?:decode|urlcache)\b|mshta\s+https?:|rundll32\s+javascript:)/i,
-    reason: "Encoded or evasive command execution is blocked.",
-  },
-  {
-    pattern: /\b(?:Set-MpPreference|Add-MpPreference|Remove-MpPreference|Set-NetFirewallProfile|New-NetFirewallRule|Remove-NetFirewallRule|Disable-NetFirewallRule|Enable-PSRemoting|Set-WSManQuickConfig)\b|\bnetsh\s+advfirewall[\s\S]*(?:\boff\b|\badd\b|\bdelete\b|\bset\b)/i,
-    reason: "Firewall, antivirus, and remote-management changes are blocked.",
-  },
-  {
-    pattern: /\b(?:reg(?:\.exe)?\s+(?:add|delete)|schtasks(?:\.exe)?\s+\/(?:create|delete|change)|sc(?:\.exe)?\s+(?:create|delete|stop|config)|New-Service|Set-Service|Stop-Service)\b/i,
-    reason: "OS persistence and service changes are blocked.",
-  },
-  {
-    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[;&|({\r\n])\s*(?:&\s*)?["']?format(?:\.(?:com|exe))?["']?(?=\s|$)|\bcipher\s+\/w\b/i,
-    reason: "Disk, boot, ownership, and access-control changes are blocked.",
-  },
-  {
-    pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
-    reason: "Privilege escalation and persistent execution-policy changes are blocked.",
-  },
-  {
-    pattern: /\b(?:Start-Process|saps)\b[^\r\n;|]*(?:[$(]|\b(?:-FilePath\s+)?['"]?git(?:\.exe)?['"]?(?:\s|$))/i,
-    reason: "Dynamic or indirect Git process launch is blocked; use a reviewed repository script.",
-  },
-  {
-    pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
-    reason: "System-wide package changes are blocked.",
-  },
-  {
-    pattern: /(?:--host|--hostname|--listen(?:-address)?)\s+(?:0\.0\.0\.0|\*|::)\b/i,
-    reason: "Non-loopback listeners are blocked.",
-  },
-  {
-    pattern: /\bgh(?:\.exe)?\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:(?:--method|-X)(?:=|\s*)(?:POST|PUT|PATCH|DELETE)\b|(?:--field|--raw-field|--input)(?:=|\s+)|(?:^|\s)-[fF](?:=|\s+)))/i,
-    reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
-  },
-  {
-    pattern: /\b(?:npm|pnpm|yarn)\s+(?:publish|login|logout|token|owner|deprecate)\b/i,
-    reason: "Package-registry publication and credential changes are blocked.",
-  },
-];
-
-function deny(reason, record = true) {
+export const CODEX_PRE_TOOL_HOOK = String.raw `${CODEX_PRE_TOOL_POLICY_HEADER}function deny(reason, record = true) {
   if (record) activation?.recordActivation(repositoryRoot, event, "denied");
   writeSync(
     1,
@@ -305,67 +172,7 @@ async function validateGitPublication(command) {
   }
 }
 
-// These CLI values are data, never shell programs. Only one literal invocation of
-// the canonical runtime qualifies; interpolation, pipelines and other scripts do not.
-function executionPolicyCommand(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^(?:.*[\\/])?node(?:\.exe)?$/i.test(tokens[0] ?? "") ||
-      resolve(event.cwd, tokens[1] ?? "") !== resolve(repositoryRoot, ".agents/runtime/bin/zaip.mjs") ||
-      tokens[2] !== "conversation" || tokens[3] !== "finish") return command;
-  const result = [...tokens];
-  for (let index = 4; index < result.length; index++) {
-    if (result[index] === "--summary" && index + 1 < result.length) result[++index] = "literal-summary";
-    else if (result[index].startsWith("--summary=")) result[index] = "--summary=literal-summary";
-  }
-  return result.map(token => JSON.stringify(token)).join(" ");
-}
-
-async function isCurrentRepositoryRead(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^gh(?:\.exe)?$/i.test(tokens[0] ?? "")) return false;
-  const rest = [], repositories = [];
-  for (let index = 0; index < tokens.length; index++) {
-    const token = tokens[index];
-    if (token === "--repo" || token === "-R") repositories.push(tokens[++index]);
-    else if (token.startsWith("--repo=")) repositories.push(token.slice(7));
-    else if (token.startsWith("-R") && token.length > 2) repositories.push(token.slice(2));
-    else rest.push(token);
-  }
-  if (repositories.length !== 1 || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repositories[0] ?? "") ||
-      rest.some(token => token.includes("'")) || !isLiteralReadSequence(rest.map(token => "'" + token + "'").join(" "))) return false;
-  try {
-    const origin = (await execute("git", ["remote", "get-url", "origin"], { cwd: repositoryRoot, encoding: "utf8", windowsHide: true })).stdout.trim();
-    const match = /^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)\.git$|^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)\/?$/.exec(origin);
-    return !!match && (match[1] ?? match[2]).toLowerCase() === repositories[0].toLowerCase();
-  } catch { return false; }
-}
 
-function validateHashicorpRead(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (!tokens || !/^(?:curl(?:\.exe)?|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)$/i.test(tokens[0]))
-    deny("HashiCorp releases require a literal supported read command.");
-  let urlCount = 0;
-  for (let i = 1; i < tokens.length; i++) {
-    const token = tokens[i];
-    if (/^https:\/\//i.test(token)) {
-      const url = new URL(token);
-      if (url.hostname !== "releases.hashicorp.com" || url.username || url.password || url.port)
-        deny("HashiCorp reads require one exact HTTPS destination.");
-      urlCount++; continue;
-    }
-    if (["-I", "--head", "-s", "-S", "-sS", "--silent", "--show-error", "--fail", "-q", "--disable"].includes(token)) continue;
-    const namedMethod = /^(?:--request|--method|-Method)(?:=(.*))?$/i.exec(token);
-    const curlMethod = /^-X(.*)$/.exec(token);
-    if (namedMethod || curlMethod) {
-      const value = namedMethod ? (namedMethod[1] ?? tokens[++i]) : (curlMethod[1] || tokens[++i]);
-      if (!/^(?:GET|HEAD)$/i.test(value ?? "")) deny("HashiCorp releases permit only GET or HEAD requests.");
-      continue;
-    }
-    if (/^(?:-Uri|--url)$/i.test(token) && /^https:\/\//i.test(tokens[i + 1] ?? "")) continue;
-    deny("Unsupported option in the bounded HashiCorp read command.");
-  }
-  if (urlCount !== 1) deny("HashiCorp reads require exactly one HTTPS URL.");
-}
 
 function validateExplicitNetwork(command) {
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
@@ -393,7 +200,7 @@ function validateExplicitNetwork(command) {
     if (host === "releases.hashicorp.com") {
       if (target.protocol !== "https:" || target.username || target.password)
         deny("HashiCorp releases require an exact HTTPS read target.");
-      validateHashicorpRead(command);
+      validateHashicorpRead(command, deny);
     }
   }
 }
@@ -647,9 +454,9 @@ else {
     ...await reviewedContextReadPaths(command, credentialReferencePattern, installedRoot), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []),
   ];
   await validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
-  const policyCommand = executionPolicyCommand(command);
+  const policyCommand = await executionPolicyCommand(command, event.cwd, repositoryRoot, execute);
   validateInlineExecution(policyCommand, deny);
-  if (!isLiteralReadSequence(policyCommand) && !await isCurrentRepositoryRead(policyCommand)) {
+  if (!isLiteralReadSequence(policyCommand) && !await isCurrentRepositoryRead(policyCommand, repositoryRoot, execute)) {
   await validateGitPublication(policyCommand);
   await validateCloudRunner(policyCommand);
   validateDirectCloudProviderMutation(policyCommand);

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgZ3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsQ5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8M1E,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsQ5B,CAAC"}

package/dist/services/codex-pre-tool-policy-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_PRE_TOOL_POLICY_HEADER: string;
+//# sourceMappingURL=codex-pre-tool-policy-template.d.ts.map

package/dist/services/codex-pre-tool-policy-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-policy-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,QAsIxC,CAAC"}

package/dist/services/codex-pre-tool-policy-template.js

@@ -0,0 +1,136 @@
+export const CODEX_PRE_TOOL_POLICY_HEADER = String.raw `import { execFile } from "node:child_process";
+import { writeSync } from "node:fs";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, executionPolicyCommand, gitInvocation, inside, isCurrentRepositoryRead, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateHashicorpRead, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
+const { execute, parseEvent } = createHookBudget(promisify(execFile));
+const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
+const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
+const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+let repositoryRoot = installedRoot;
+let principalFullAccess = false;
+let principalFullNetwork = false;
+const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
+const allowedExplicitNetworkHosts = new Set([
+  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
+]);
+const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
+const cloudRunnerScript = ".agents/tools/cloud-runner.mjs";
+const cloudContractPath = ".agents/config/autonomous-cloud-contract.json";
+const cloudOperationProviders = new Map([
+  ["cloudflare:dns:read", "cloudflare"], ["cloudflare:dns:create", "cloudflare"], ["cloudflare:dns:edit", "cloudflare"],
+  ["hostinger:vps:read", "hostinger"],
+  ["hostinger:ssh:read", "hostinger"],
+  ["hostinger:ssh:configure", "hostinger"],
+  ["hostinger:ssh:test", "hostinger"],
+  ["terraform:plan", "terraform"],
+  ["terraform:apply", "terraform"],
+  ["terraform:import", "terraform"],
+]);
+const homeReferencePattern = /(?:\$HOME\b|\$env:(?:USERPROFILE|HOMEDRIVE|HOMEPATH)\b|%(?:USERPROFILE|HOMEDRIVE|HOMEPATH)%|(?:^|[\s"'=])~[\\/])/i;
+const credentialReferencePattern = /(?:^|[\\/\s"'=])(?:\.ssh|\.aws|\.azure|\.kube|\.docker|\.gnupg|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|ed25519)|[^\\/\s"']+\.(?:pem|key|p12|pfx))(?:[\\/\s"'=]|$)|(?:^|[\\/\s"'=])\.env(?:\.[A-Za-z0-9_-]+)*(?:[\\/\s"']|$)/i;
+const sensitiveEnvironmentPattern = /(?:\$env:|%|\$)[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)[A-Z0-9_]*%?/i;
+const destructivePatterns = [
+  {
+    pattern: /\b(?:Restart-Computer|Stop-Computer|Restart-Host|shutdown(?:\.exe)?|reboot|poweroff|halt|Suspend-Computer|hibernate|logoff|Win32Shutdown)\b/i,
+    reason: "Local computer restart, shutdown, suspension, hibernation and session termination are blocked.",
+  },
+  {
+    pattern: /\b(?:Clear-Content|shred)\b/i,
+    reason: "Unbounded content destruction is blocked.",
+  },
+  {
+    pattern: /\bgit\s+(?:clean\b|reset\s+--hard\b|checkout\s+--\b|restore\b|branch\s+-d\b|tag\s+-d\b)/i,
+    reason: "Destructive Git state changes are blocked.",
+  },
+  {
+    pattern: /\bgit\s+push\b[\s\S]*(?:--force(?:-with-lease|-if-includes)?\b|-f\b|--mirror\b|--delete\b|--all\b|(?:^|\s):\S+)/i,
+    reason: "Force, mirror, bulk, and deletion pushes are blocked.",
+  },
+  {
+    pattern: /\bgit\s+commit\b[\s\S]*(?:--amend\b|--no-verify\b|-n\b)/i,
+    reason: "Commit history rewrites and hook bypasses are blocked.",
+  },
+  {
+    pattern: /\bgit\s+(?:-c\b|--config(?:-env)?\b|--git-dir\b|--work-tree\b|--namespace\b)/,
+    reason: "Git global configuration and repository-routing overrides are blocked.",
+  },
+  {
+    pattern: /\bgit\s+fetch\b[\s\S]*(?:--all\b|--prune\b|--prune-tags\b)/i,
+    reason: "Bulk or pruning fetches are outside the bounded deploy flow.",
+  },
+  {
+    pattern: /\bgit\s+add\b[\s\S]*(?:--force\b|-f\b|(?:^|[\\/\s])(?:\.env(?:\.|\s|$)|[^\s]*\.(?:pem|key|p12|pfx)\b|id_(?:rsa|ed25519)\b))/i,
+    reason: "Force-adding or explicitly staging credential-like files is blocked.",
+  },
+  {
+    pattern: /\bgit\s+add\b[\s\S]*(?:\s-A\b|--all\b|(?:^|\s)\.(?:\s|$)|\s-u\b)/i,
+    reason: "Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.",
+  },
+  {
+    pattern: /\bgit\s+(?:remote\s+(?:add|set-url|remove|rename)|config\b[\s\S]*(?:sshCommand|credential|url\.))/i,
+    reason: "Remote, SSH, and credential configuration changes are blocked.",
+  },
+  {
+    pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,
+    reason: "GitHub CLI commands must target the current repository.",
+  },
+  {
+    pattern: /\b(?:drop\s+(?:database|schema|table)|truncate\s+table|supabase\s+db\s+reset)\b/i,
+    reason: "Destructive database operations are blocked.",
+  },
+  {
+    pattern: /\b(?:rmSync|rmdirSync|unlinkSync|rmtree|remove|unlink|Directory\.Delete|File\.Delete)\s*\(/i,
+    reason: "Inline deletion APIs are blocked.",
+  },
+  {
+    pattern: /(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|\biwr\b|\birm\b)[\s\S]*\|[\s&]*(?:bash|sh|zsh|pwsh|powershell|cmd|node|python|iex|Invoke-Expression)\b/i,
+    reason: "Downloaded content cannot be piped into an interpreter.",
+  },
+  {
+    pattern: /(?:-(?:EncodedCommand|enc)\b|FromBase64String\s*\(|certutil\s+-(?:decode|urlcache)\b|mshta\s+https?:|rundll32\s+javascript:)/i,
+    reason: "Encoded or evasive command execution is blocked.",
+  },
+  {
+    pattern: /\b(?:Set-MpPreference|Add-MpPreference|Remove-MpPreference|Set-NetFirewallProfile|New-NetFirewallRule|Remove-NetFirewallRule|Disable-NetFirewallRule|Enable-PSRemoting|Set-WSManQuickConfig)\b|\bnetsh\s+advfirewall[\s\S]*(?:\boff\b|\badd\b|\bdelete\b|\bset\b)/i,
+    reason: "Firewall, antivirus, and remote-management changes are blocked.",
+  },
+  {
+    pattern: /\b(?:reg(?:\.exe)?\s+(?:add|delete)|schtasks(?:\.exe)?\s+\/(?:create|delete|change)|sc(?:\.exe)?\s+(?:create|delete|stop|config)|New-Service|Set-Service|Stop-Service)\b/i,
+    reason: "OS persistence and service changes are blocked.",
+  },
+  {
+    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[;&|({\r\n])\s*(?:&\s*)?["']?format(?:\.(?:com|exe))?["']?(?=\s|$)|\bcipher\s+\/w\b/i,
+    reason: "Disk, boot, ownership, and access-control changes are blocked.",
+  },
+  {
+    pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
+    reason: "Privilege escalation and persistent execution-policy changes are blocked.",
+  },
+  {
+    pattern: /\b(?:Start-Process|saps)\b[^\r\n;|]*(?:[$(]|\b(?:-FilePath\s+)?['"]?git(?:\.exe)?['"]?(?:\s|$))/i,
+    reason: "Dynamic or indirect Git process launch is blocked; use a reviewed repository script.",
+  },
+  {
+    pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
+    reason: "System-wide package changes are blocked.",
+  },
+  {
+    pattern: /(?:--host|--hostname|--listen(?:-address)?)\s+(?:0\.0\.0\.0|\*|::)\b/i,
+    reason: "Non-loopback listeners are blocked.",
+  },
+  {
+    pattern: /\bgh(?:\.exe)?\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:(?:--method|-X)(?:=|\s*)(?:POST|PUT|PATCH|DELETE)\b|(?:--field|--raw-field|--input)(?:=|\s+)|(?:^|\s)-[fF](?:=|\s+)))/i,
+    reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
+  },
+  {
+    pattern: /\b(?:npm|pnpm|yarn)\s+(?:publish|login|logout|token|owner|deprecate)\b/i,
+    reason: "Package-registry publication and credential changes are blocked.",
+  },
+];
+
+`;
+//# sourceMappingURL=codex-pre-tool-policy-template.js.map

package/dist/services/codex-pre-tool-policy-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-policy-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsIrD,CAAC"}

package/dist/services/codex-pre-tool-release-review-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_PRE_TOOL_RELEASE_REVIEW: string;
+//# sourceMappingURL=codex-pre-tool-release-review-template.d.ts.map

package/dist/services/codex-pre-tool-release-review-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-pre-tool-release-review-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-release-review-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,QAgGzC,CAAC"}