@zaip-ai/cli 6.3.0 → 7.5.0

package/dist/services/codex-github-setup-template.js

@@ -0,0 +1,176 @@
+// Shared grammar: the request file is data, never authorization.
+export const CODEX_GITHUB_SETUP = String.raw `
+function githubSetupIntent(request) {
+  // An operational grammar, not keyword co-occurrence. Unknown prose never grants
+  // authority. Preserve a previous grant on neutral turns; revoke explicitly.
+  const text = request.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase();
+  const unquoted = text.replace(/\x60\x60\x60[\s\S]*?\x60\x60\x60|\x60[^\x60\n]*\x60|"[^"\n]*"|'[^'\n]*'|“[^”\n]*”/g, "")
+    .split(/\r?\n/).filter(line => !/^\s*>/.test(line)).join("\n");
+  const lines = unquoted.split(/\r?\n|(?<=[.!])\s+/).map(line => line.trim().replace(/[.!]+$/, "").replace(/\s+/g, " "));
+  // A refusal anywhere in the message wins over every affirmative directive in it.
+  const refused = lines.some(line =>
+    /\b(?:nao|nunca|jamais|not|never|don't)\b[^.!?]*\b(?:configur\w*|public\w*|publiqu\w*|deploy|cria\w*|crie|create|push|github|origin|remot[eo]s?)\b/.test(line) ||
+    /^(?:cancele|cancel|pare|stop|interrompa)(?: (?:tudo|everything|o trabalho|a execucao|a publicacao|o deploy|o setup|a configuracao|the deployment|the setup))?$/.test(line));
+  if (refused) return "revoke";
+  if (/\b(?:exemplo|example|disse|citou|quoted|said|imagine)\b/.test(unquoted)) return "neutral";
+  if (/[?]/.test(unquoted) || /\b(?:quando|se|apos|depois|somente|apenas|aguarde|espere|if|when|after|unless|wait)\b[^.!?]*\b(?:autor\w*|aprov\w*|confirm\w*|approval|permission)\b/.test(unquoted)) return "neutral";
+  const target = "(?:no github|a (?:versao )?v?\\d+\\.\\d+(?:\\.\\d+)?)";
+  const plan = new RegExp("^execute (?:a spec inteira|esse plano completo(?:, aplique as premissas de autonomia)?(?: e finalize)?) ate publicar " + target + "$");
+  const github = /^(?:(?:por favor|agora|please),? )?(?:configure (?:o )?github(?: (?:para|neste|deste) (?:este |o )?projeto)?|pode configurar (?:o )?github|configure o repositorio (?:no )?github(?: deste projeto)?|crie (?:um|o) repositorio(?: privado)? no github|pode criar (?:um|o) repositorio(?: privado)? no github|(?:faca|execute) (?:o )?deploy(?: no github)?|publique (?:este|o) projeto no github|configure github(?: for this project)?|create a private github repository|publish this project to github|deploy to github)$/;
+  return lines.some(line => github.test(line) || plan.test(line)) ? "grant" : "neutral";
+}
+async function githubSetupInvocation(command) {
+  const script = ".agents/skills/zaip-skill-github-setup/scripts/setup.mjs";
+  if (event.tool_name === "apply_patch") return null;
+  if (!command.includes("zaip-skill-github-setup/scripts/setup.mjs") &&
+      !command.includes("zaip-skill-github-setup\\scripts\\setup.mjs")) return null;
+  const tokens = tokenizeLiteralCommand(command);
+  const entrypoint = values => {
+    if (!values || !/^(?:node|node\.exe|.*[\\/]node(?:\.exe)?)$/i.test(values[0] ?? "")) return null;
+    // Only pre-entry options affect script selection; every later token is data.
+    let index = 1;
+    const switches = ["--test", "--test-only", "--test-force-exit", "--check", "-c", "--no-warnings", "--no-deprecation", "--trace-warnings", "--experimental-strip-types"];
+    const valued = ["--test-name-pattern", "--test-skip-pattern", "--test-concurrency", "--test-timeout"];
+    for (; index < values.length && values[index].startsWith("-"); index++) {
+      const option = values[index];
+      if (option === "--") { index++; break; }
+      if (switches.includes(option)) continue;
+      if (valued.includes(option.split("=")[0])) {
+        if (!option.includes("=")) index++;
+        continue;
+      }
+      deny("GitHub setup requires a canonical Node entrypoint without preloads or inline execution.");
+    }
+    return values[index]?.replaceAll("\\", "/") ?? null;
+  };
+  const helper = entry => entry === script || entry?.endsWith("/" + script);
+  if (tokens) {
+    if (!helper(entrypoint(tokens))) return null;
+  } else {
+    // Classification only: read expressions stay with the normal policy. Never
+    // turn an opaque sequence into a setup grant or execute quoted search data.
+    const parts = [];
+    let start = 0, quote = null;
+    for (let index = 0; index < command.length; index++) {
+      const character = command[index];
+      if (quote !== null) {
+        if (character === quote) {
+          if (quote === "'" && command[index + 1] === "'" && process.platform === "win32") index++;
+          else quote = null;
+        }
+      } else if (character === "'" || character === '"') quote = character;
+      else if (/[;|&(){}\r\n]/.test(character)) { parts.push(command.slice(start, index)); start = index + 1; }
+    }
+    parts.push(command.slice(start));
+    const invokesHelper = parts.some(part => {
+      const values = tokenizeLiteralCommand(part);
+      if (values) return helper(entrypoint(values));
+      return /^\s*(?:node(?:\.exe)?|["'][^"'\r\n]*[\\/]node(?:\.exe)?["'])(?:\s|$)/i.test(part);
+    });
+    if (!invokesHelper) return null;
+  }
+  if (!tokens || Object.values(shellSyntax(command)).some(Boolean) ||
+      !/^(?:node|node\.exe)$/i.test(tokens[0] ?? "") ||
+      tokens[1]?.replaceAll("\\", "/") !== script || tokens[2] !== "--request" ||
+      !/^\.agents\/private\/state\/github-setup\/[A-Za-z0-9_-]+\.json$/.test(tokens[3] ?? "") ||
+      !(tokens.length === 4 || (tokens.length === 5 && tokens[4] === "--apply")) ||
+      resolve(event.cwd) !== resolve(repositoryRoot))
+    deny("GitHub setup requires one literal canonical command and a checkout-local request; no routing or authorization overrides.");
+  if (tokens.length === 4) return { apply: false };
+  if (!principal || event.permission_mode === "plan")
+    deny("GitHub onboarding must run on the authorized principal; delegated/read-only agents cannot grant setup authority.");
+  const { createHash } = await import("node:crypto");
+  const { homedir } = await import("node:os");
+  const { open } = await import("node:fs/promises");
+  const pathIdentity = path => process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
+  const session = event.session_id, turn = event.turn_id, tool = event.tool_use_id;
+  if (![session, turn, tool].every(v => typeof v === "string" && /^[A-Za-z0-9_-]{1,256}$/.test(v)) ||
+      (process.env.CODEX_THREAD_ID && process.env.CODEX_THREAD_ID !== session) ||
+      (process.env.CODEX_TURN_ID && process.env.CODEX_TURN_ID !== turn))
+    deny("GitHub setup requires observed host session, turn and tool identity.");
+  const transcript = event.transcript_path;
+  const sessions = resolve(process.env.CODEX_HOME || resolve(homedir(), ".codex"), "sessions");
+  if (typeof transcript !== "string" || !isAbsolute(transcript) || !inside(transcript, sessions) || inside(transcript, repositoryRoot))
+    deny("GitHub setup requires the host transcript, not a caller-authored authorization file.");
+  let requestText, requestSha;
+  try {
+    await assertCanonicalLiteralPath(transcript);
+    await assertCanonicalLiteralPath(tokens[3], repositoryRoot);
+    await assertCanonicalLiteralPath(script, repositoryRoot);
+    requestText = await readBoundedCanonicalText(resolve(repositoryRoot, tokens[3]), 16384, repositoryRoot);
+    const request = JSON.parse(requestText);
+    if (request.schema_version !== 1 || typeof request.repository !== "string" || pathIdentity(request.repository) !== pathIdentity(repositoryRoot))
+      throw new Error("request target");
+    requestSha = createHash("sha256").update(requestText).digest("hex");
+    const file = await open(transcript, "r");
+    try {
+      const stat = await file.stat(), head = Buffer.alloc(Math.min(stat.size, 65536));
+      await file.read(head, 0, head.length, 0);
+      const first = JSON.parse(head.toString("utf8").split("\n")[0]);
+      if (first.type !== "session_meta" || first.payload?.id !== session ||
+          pathIdentity(first.payload?.cwd ?? "") !== pathIdentity(repositoryRoot)) throw new Error("transcript session");
+      let observedTurn = false, authorized = false;
+      const consume = line => {
+        if (!line.trim()) return;
+        const row = JSON.parse(line), payload = row.payload;
+        if ((row.type === "turn_context" && payload?.turn_id === turn) ||
+            (row.type === "event_msg" && payload?.type === "task_started" && payload.turn_id === turn)) observedTurn = true;
+        if (row.type !== "event_msg" || payload?.type !== "user_message" || typeof payload.message !== "string") return;
+        const intent = githubSetupIntent(payload.message);
+        if (intent === "revoke") authorized = false;
+        else if (intent === "grant") authorized = true;
+      };
+      // Stream from the authenticated header: a standing grant outside the tail
+      // remains valid, while every subsequent refusal is still evaluated.
+      const deadline = Date.now() + 4000, maxRecordBytes = 8 * 1024 * 1024;
+      let offset = 0, parts = [], recordBytes = 0;
+      while (offset < stat.size) {
+        if (Date.now() > deadline) throw new Error("transcript scan deadline");
+        const chunk = Buffer.alloc(Math.min(65536, stat.size - offset));
+        const { bytesRead } = await file.read(chunk, 0, chunk.length, offset);
+        if (bytesRead === 0) throw new Error("transcript truncated during scan");
+        offset += bytesRead;
+        let start = 0;
+        for (let i = 0; i < bytesRead; i++) {
+          if (chunk[i] !== 10) continue;
+          const part = chunk.subarray(start, i); recordBytes += part.length;
+          if (recordBytes > maxRecordBytes) throw new Error("transcript record bound");
+          parts.push(part); consume(Buffer.concat(parts, recordBytes).toString("utf8"));
+          parts = []; recordBytes = 0; start = i + 1;
+        }
+        if (start < bytesRead) {
+          const part = chunk.subarray(start, bytesRead); recordBytes += part.length;
+          if (recordBytes > maxRecordBytes) throw new Error("transcript record bound");
+          parts.push(part);
+        }
+      }
+      if (recordBytes) throw new Error("transcript incomplete record");
+      if (!observedTurn || !authorized) throw new Error("human setup request unavailable");
+    } finally { await file.close(); }
+  } catch { deny("GitHub setup authorization or exact target could not be verified from the host transcript. Keep the request and diagnose the missing evidence; do not fabricate a receipt."); }
+  const digest = createHash("sha256").update(JSON.stringify([session, turn, tool])).digest("hex");
+  return { apply: true, digest, receipt: {
+    schema_version: 1, repository: repositoryRoot, request_path: tokens[3], request_sha256: requestSha,
+    session_id: session, turn_id: turn, issued_at_ms: Date.now(),
+  } };
+}
+async function issueGithubSetupReceipt(setup, command) {
+  const { mkdir, writeFile } = await import("node:fs/promises");
+  const directory = resolve(repositoryRoot, ".agents/private/state/codex-hook-github-setup");
+  await assertCanonicalLiteralPath(directory);
+  await mkdir(directory, { recursive: true });
+  const path = resolve(directory, setup.digest + ".json");
+  await writeFile(path, JSON.stringify(setup.receipt), { flag: "wx", mode: 0o600 });
+  return command + " --host-receipt=" + setup.digest;
+}
+`;
+export const CODEX_GITHUB_SETUP_MODULE = `import { isAbsolute, resolve } from "node:path";
+export function createGithubSetupValidators({
+  event, repositoryRoot, principal, tokenizeLiteralCommand, shellSyntax, deny,
+  assertCanonicalLiteralPath, readBoundedCanonicalText, inside,
+}) {
+${CODEX_GITHUB_SETUP}
+  return { githubSetupInvocation, issueGithubSetupReceipt };
+}
+`;
+//# sourceMappingURL=codex-github-setup-template.js.map

package/dist/services/codex-github-setup-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-github-setup-template.js","sourceRoot":"","sources":["../../src/services/codex-github-setup-template.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoK3C,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;EAKvC,kBAAkB;;;CAGnB,CAAC"}

package/dist/services/codex-hook-activation.d.ts

@@ -1,4 +1,4 @@
 export declare const HOOK_ACTIVATION_EVENTS: readonly ["PreToolUse", "SubagentStart", "SubagentStop", "Stop"];
-export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-pre-tool-release-review.mjs", ".codex/hooks/zaip-pre-tool-cloud.mjs", ".codex/hooks/zaip-pre-tool-host-context.mjs", ".codex/hooks/zaip-pre-tool-cli-capture.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
+export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-pre-tool-release-review.mjs", ".codex/hooks/zaip-pre-tool-cloud.mjs", ".codex/hooks/zaip-pre-tool-github-setup.mjs", ".codex/hooks/zaip-pre-tool-host-context.mjs", ".codex/hooks/zaip-pre-tool-cli-capture.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-task-delivery-authority.mjs", ".codex/hooks/zaip-git-publication.mjs", ".codex/hooks/zaip-storage-handoff.mjs", ".codex/hooks/zaip-repository-profile.mjs", ".codex/hooks/zaip-native-authority-policy.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
 export declare const CODEX_HOOK_ACTIVATION: string;
 //# sourceMappingURL=codex-hook-activation.d.ts.map

package/dist/services/codex-hook-activation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,+CAA+C,EAC/C,sCAAsC,EACtC,6CAA6C,EAC7C,4CAA4C,EAC5C,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QAiKjC,CAAC"}
+{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,+CAA+C,EAC/C,sCAAsC,EACtC,6CAA6C,EAC7C,6CAA6C,EAC7C,4CAA4C,EAC5C,6CAA6C,EAC7C,+CAA+C,EAC/C,uCAAuC,EACvC,uCAAuC,EACvC,0CAA0C,EAC1C,+CAA+C,EAC/C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QAwMjC,CAAC"}

package/dist/services/codex-hook-activation.js

@@ -10,9 +10,15 @@ export const HOOK_ACTIVATION_FILES = [
     ".codex/hooks/zaip-pre-tool-support.mjs",
     ".codex/hooks/zaip-pre-tool-release-review.mjs",
     ".codex/hooks/zaip-pre-tool-cloud.mjs",
+    ".codex/hooks/zaip-pre-tool-github-setup.mjs",
     ".codex/hooks/zaip-pre-tool-host-context.mjs",
     ".codex/hooks/zaip-pre-tool-cli-capture.mjs",
     ".codex/hooks/zaip-native-tool-authority.mjs",
+    ".codex/hooks/zaip-task-delivery-authority.mjs",
+    ".codex/hooks/zaip-git-publication.mjs",
+    ".codex/hooks/zaip-storage-handoff.mjs",
+    ".codex/hooks/zaip-repository-profile.mjs",
+    ".codex/hooks/zaip-native-authority-policy.mjs",
     ".codex/hooks/zaip-subagent-lifecycle.mjs",
     ".codex/hooks/zaip-conversation-lifecycle.mjs",
     ".codex/hooks/zaip-hook-activation.mjs",
@@ -21,10 +27,45 @@ export const HOOK_ACTIVATION_FILES = [
 export const CODEX_HOOK_ACTIVATION = String.raw `import { createHash, randomUUID } from "node:crypto";
 import { lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync, existsSync, linkSync, unlinkSync } from "node:fs";
 import { spawn } from "node:child_process";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, resolve } from "node:path";
 const files = ${JSON.stringify(HOOK_ACTIVATION_FILES)};
 const events = ${JSON.stringify(HOOK_ACTIVATION_EVENTS)};
 const digest = text => createHash("sha256").update(text).digest("hex");
+// Windows' local extended-length spelling is the same directory, not a UNC
+// share or an alias. Resolve the physical path before using it for containment.
+export function canonicalHookCwd(value) {
+  if (typeof value !== "string" || value.length > 4096 || !isAbsolute(value)) return null;
+  let candidate = value;
+  if (process.platform === "win32") {
+    if (/^\\\\\?\\[a-z]:\\/i.test(candidate)) candidate = candidate.slice(4);
+    if (/^(?:\\\\|\/\/)/.test(candidate)) return null;
+  }
+  try {
+    const resolved = resolve(candidate), physical = realpathSync(resolved);
+    const identity = path => process.platform === "win32" ? path.toLowerCase() : path;
+    if (identity(physical) !== identity(resolved) || !lstatSync(resolved).isDirectory()) return null;
+    return physical;
+  } catch { return null; }
+}
+export function recordLifecycleIngress(root, event, policy) {
+  if (!policy?.tracking || !["Stop", "SubagentStop"].includes(event?.hook_event_name)) return;
+  try {
+    const session = typeof event.session_id === "string" && event.session_id.length <= 200 ? event.session_id : null;
+    const turn = typeof event.turn_id === "string" && event.turn_id.length <= 200 ? event.turn_id : null;
+    let directory = root;
+    for (const part of [".agents", "private", "state", "hooks", "diagnostics"]) {
+      directory = resolve(directory, part);
+      try { mkdirSync(directory); } catch (error) { if (error.code !== "EEXIST") throw error; }
+      const info = lstatSync(directory);
+      if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;
+    }
+    const path = resolve(directory, "ingress-" + digest(JSON.stringify([event.hook_event_name, session, turn])) + ".json");
+    const temporary = path + ".tmp-" + randomUUID();
+    const cwd_form = typeof event.cwd !== "string" ? "missing" : /^\\\\\?\\[a-z]:\\/i.test(event.cwd) ? "local_namespace" : /^(?:\\\\|\/\/)/.test(event.cwd) ? "unc_or_device" : "plain";
+    writeFileSync(temporary, JSON.stringify({ schema_version: 1, event: event.hook_event_name, session_id: session, turn_id: turn, cwd_form, cwd_accepted: canonicalHookCwd(event.cwd) !== null, observed_at: new Date().toISOString() }) + "\n", { flag: "wx", mode: 0o600 });
+    renameSync(temporary, path);
+  } catch { /* Arrival diagnostics never grant trust or canonical closure. */ }
+}
 function regular(path) {
   const s = lstatSync(path);
   if (!s.isFile() || s.isSymbolicLink() || s.size > 2097152) throw new Error("unsafe activation input");
@@ -34,7 +75,7 @@ export function recordActivation(root, event, outcome = "observed") {
   try {
     const name = event?.hook_event_name;
     let directory = root;
-    for (const part of [".local", "hooks", "activation"]) {
+    for (const part of [".agents", "private", "state", "hooks", "activation"]) {
       directory = resolve(directory, part);
       try { mkdirSync(directory); } catch (e) { if (e.code !== "EEXIST") throw e; }
       const s = lstatSync(directory);
@@ -55,14 +96,18 @@ export function recordActivation(root, event, outcome = "observed") {
     // Hook processes do not necessarily inherit CODEX_THREAD_ID. The event is the
     // protocol identity; receipts remain diagnostics, never proof of Codex trust.
     const fingerprint = digest(JSON.stringify(files.map(file => [file, digest(regular(resolve(root, file)))])));
-    const path = resolve(directory, name + ".json");
-    const temporary = path + ".tmp-" + randomUUID();
-    writeFileSync(temporary, JSON.stringify({ schema_version: 1, event: name, fingerprint,
+    const receipt = JSON.stringify({ schema_version: 1, event: name, fingerprint,
       session_id: event.session_id, turn_id: event.turn_id, outcome,
       identity_source: process.env.CODEX_THREAD_ID ? "event_and_environment" : "hook_event",
-      observed_at: new Date().toISOString() }) + "\n",
-      { flag: "wx", mode: 0o600 });
-    renameSync(temporary, path);
+      observed_at: new Date().toISOString() }) + "\n";
+    // Concurrent chats must not erase each other's diagnostic evidence. Keep
+    // the global receipt for older readers, but select by session when known.
+    for (const filename of [digest(event.session_id) + "-" + name + ".json", name + ".json"]) {
+      const path = resolve(directory, filename);
+      const temporary = path + ".tmp-" + randomUUID();
+      writeFileSync(temporary, receipt, { flag: "wx", mode: 0o600 });
+      renameSync(temporary, path);
+    }
   } catch { /* Diagnostics must not break a tool or turn. Missing evidence stays unknown. */ }
 }
 export function parseHookPolicies(source) {
@@ -119,7 +164,7 @@ export async function isZaipDisabled(repositoryRoot, boundedCanonicalText) {
 export function recordPolicyDiagnostic(root, policy) {
   if (!policy.diagnostic) return;
   try {
-    const directory = resolve(root, ".local/hooks");
+    const directory = resolve(root, ".agents/private/state/hooks");
     mkdirSync(directory, { recursive: true });
     if (!lstatSync(directory).isDirectory() || lstatSync(directory).isSymbolicLink() ||
         realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;
@@ -141,7 +186,7 @@ export function recordHookObservation(root, event, governance = false) {
     const agent_path = typeof event.agent_path === "string" && event.agent_path.length <= 500 ? event.agent_path : null;
     const tool_call_id = typeof event.tool_call_id === "string" && event.tool_call_id.length <= 200 ? event.tool_call_id : null;
     const source_key = JSON.stringify([name, session_id, turn_id, agent_id, agent_path, tool_call_id, name === "PreToolUse" && !tool_call_id ? digest(JSON.stringify(event.tool_input ?? null)) : null]);
-    const directory = resolve(root, ".local/hooks/observations");
+    const directory = resolve(root, ".agents/private/state/hooks/observations");
     mkdirSync(directory, { recursive: true });
     if (!lstatSync(directory).isDirectory() || lstatSync(directory).isSymbolicLink() ||
         realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;

package/dist/services/codex-hook-activation.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,+CAA+C;IAC/C,sCAAsC;IACtC,6CAA6C;IAC7C,4CAA4C;IAC5C,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;gBAI/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JtD,CAAC"}
+{"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,+CAA+C;IAC/C,sCAAsC;IACtC,6CAA6C;IAC7C,6CAA6C;IAC7C,4CAA4C;IAC5C,6CAA6C;IAC7C,+CAA+C;IAC/C,uCAAuC;IACvC,uCAAuC;IACvC,0CAA0C;IAC1C,+CAA+C;IAC/C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;gBAI/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmMtD,CAAC"}

package/dist/services/codex-host-diagnostic.d.ts

@@ -0,0 +1,10 @@
+import type { CodexProjectTrustResult } from "./global-codex-project-trust.js";
+import type { HookReadinessSummary } from "./hook-readiness.js";
+export interface CodexHostDiagnostic {
+    projectTrust: CodexProjectTrustResult | null;
+    hooks: HookReadinessSummary;
+    loadedAgents: "unverified";
+}
+/** Installed profiles and project trust cannot prove what the current host loaded. */
+export declare function codexHostDiagnostic(hooks: HookReadinessSummary, projectTrust?: CodexProjectTrustResult | null): CodexHostDiagnostic;
+//# sourceMappingURL=codex-host-diagnostic.d.ts.map

package/dist/services/codex-host-diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-host-diagnostic.d.ts","sourceRoot":"","sources":["../../src/services/codex-host-diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC7C,KAAK,EAAE,oBAAoB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,oBAAoB,EAC3B,YAAY,GAAE,uBAAuB,GAAG,IAAW,GAClD,mBAAmB,CAErB"}

package/dist/services/codex-host-diagnostic.js

@@ -0,0 +1,5 @@
+/** Installed profiles and project trust cannot prove what the current host loaded. */
+export function codexHostDiagnostic(hooks, projectTrust = null) {
+    return { projectTrust, hooks, loadedAgents: "unverified" };
+}
+//# sourceMappingURL=codex-host-diagnostic.js.map

package/dist/services/codex-host-diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-host-diagnostic.js","sourceRoot":"","sources":["../../src/services/codex-host-diagnostic.ts"],"names":[],"mappings":"AASA,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CACjC,KAA2B,EAC3B,YAAY,GAAmC,IAAI;IAEnD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC"}

package/dist/services/codex-host-diagnostic.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=codex-host-diagnostic.test.d.ts.map

package/dist/services/codex-host-diagnostic.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-host-diagnostic.test.d.ts","sourceRoot":"","sources":["../../src/services/codex-host-diagnostic.test.ts"],"names":[],"mappings":""}

package/dist/services/codex-host-diagnostic.test.js

@@ -0,0 +1,24 @@
+import { expect, it } from "vitest";
+import { codexHostDiagnostic } from "./codex-host-diagnostic.js";
+it("does not infer approved hooks or loaded agents from verified project trust", () => {
+    expect(codexHostDiagnostic({ state: "activation_unverified", full_integration: false }, {
+        state: "trusted",
+        project: "/current",
+        path: "/home/config.toml",
+        changed: true,
+        backupPath: null,
+        reason: null,
+    })).toMatchObject({
+        projectTrust: { state: "trusted" },
+        hooks: { full_integration: false },
+        loadedAgents: "unverified",
+    });
+});
+it("validated hook events still do not prove which agents the host loaded", () => {
+    expect(codexHostDiagnostic({ state: "validated", full_integration: true })).toMatchObject({
+        projectTrust: null,
+        hooks: { full_integration: true },
+        loadedAgents: "unverified",
+    });
+});
+//# sourceMappingURL=codex-host-diagnostic.test.js.map

package/dist/services/codex-host-diagnostic.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-host-diagnostic.test.js","sourceRoot":"","sources":["../../src/services/codex-host-diagnostic.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACpF,MAAM,CACJ,mBAAmB,CACjB,EAAE,KAAK,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAC3D;QACE,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,IAAI;KACb,CACF,CACF,CAAC,aAAa,CAAC;QACd,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAClC,KAAK,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE;QAClC,YAAY,EAAE,YAAY;KAC3B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;IAC/E,MAAM,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QACxF,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACjC,YAAY,EAAE,YAAY;KAC3B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/codex-literal-read-sequence-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-literal-read-sequence-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-literal-read-sequence-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QAyFvC,CAAC"}
+{"version":3,"file":"codex-literal-read-sequence-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-literal-read-sequence-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QAoLvC,CAAC"}

package/dist/services/codex-literal-read-sequence-template.js

@@ -9,18 +9,23 @@ function isLiteralGitRead(values) {
   if (args.shift() !== "--no-pager" || args.shift() !== "-c" || args.shift() !== "core.fsmonitor=false") return false;
   const subcommand = args.shift();
   if (!["status", "log", "rev-parse", "diff"].includes(subcommand)) return false;
-  if (["diff", "log"].includes(subcommand) && !["--no-ext-diff", "--no-textconv"].every(flag => args.includes(flag))) return false;
-  if (subcommand === "log" && !["--no-patch", "--no-show-signature"].every(flag => args.includes(flag))) return false;
-  if (subcommand === "diff" && !["--name-only", "--name-status", "--stat", "--check"].some(flag => args.includes(flag))) return false;
+  const delimiter = args.indexOf("--");
+  const beforePaths = delimiter < 0 ? args : args.slice(0, delimiter);
+  const paths = delimiter < 0 ? [] : args.slice(delimiter + 1);
+  // Protection flags after the delimiter are filenames, never Git options.
+  if (["diff", "log"].includes(subcommand) && !["--no-ext-diff", "--no-textconv"].every(flag => beforePaths.includes(flag))) return false;
+  if (subcommand === "log" && !["--no-patch", "--no-show-signature"].every(flag => beforePaths.includes(flag))) return false;
+  if (subcommand === "diff" && !["--name-only", "--name-status", "--stat", "--check"].some(flag => beforePaths.includes(flag))) return false;
   const options = {
     status: /^(?:-s|-b|--short|--branch|--porcelain(?:=v?[12])?|--untracked-files(?:=(?:no|normal|all))?|--ignored(?:=(?:traditional|matching|no))?)$/,
     log: /^(?:--no-ext-diff|--no-textconv|--no-patch|--no-show-signature|--oneline|--all|--decorate(?:=(?:short|full|no))?|--no-decorate|--date-order|--topo-order|--reverse|--no-merges|--merges|--max-count=\d+|-\d+|--format=(?:%H|%h|%s|%H%x09%s))$/,
     "rev-parse": /^(?:--show-toplevel|--git-common-dir|--absolute-git-dir|--is-inside-work-tree|--show-prefix|--verify|--short(?:=\d+)?|--symbolic-full-name|--abbrev-ref|--end-of-options)$/,
     diff: /^(?:--name-only|--name-status|--stat|--check|--cached|--staged|--no-ext-diff|--no-textconv|--exit-code|--quiet)$/,
   };
-  return args.every(value => value.startsWith("-") ? options[subcommand].test(value) :
+  const literalPath = value => /^[A-Za-z0-9_./@~^:\\-]+$/.test(value);
+  return paths.every(literalPath) && beforePaths.every(value => value.startsWith("-") ? options[subcommand].test(value) :
     // Plain revisions/pathspecs only; shell syntax was already parsed separately.
-    /^[A-Za-z0-9_./@~^:\\-]+$/.test(value));
+    literalPath(value));
 }
 function isLiteralReadSequence(command) {
   const syntax = shellSyntax(command);
@@ -43,7 +48,7 @@ function isLiteralReadSequence(command) {
     const values = tokenizeLiteralCommand(part);
     if (!values?.length) return false;
     if (isLiteralGitRead(values)) return true;
-    if (/^Get-Item$/i.test(values[0])) {
+    if (/^(?:Get-Item|Test-Path)$/i.test(values[0])) {
       const args = values.slice(1);
       const path = args[0] === "-LiteralPath" ? args[1] : args[0];
       return args.length === (args[0] === "-LiteralPath" ? 2 : 1) &&
@@ -87,5 +92,91 @@ function isLiteralReadSequence(command) {
 
 return isLiteralReadSequence;
 }
+
+export function withoutLiteralSearchPatterns(command, tokenizeLiteralCommand) {
+  const values = tokenizeLiteralCommand(command);
+  if (!values || !/^(?:rg(?:\.exe)?|Select-String)$/i.test(values[0])) return command;
+  const spans = [...command.matchAll(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+/g)];
+  // Ambiguous quoting/concatenation retains the conservative filesystem check.
+  if (spans.length !== values.length || spans.some((span, index) => {
+    const literal = tokenizeLiteralCommand(span[0]);
+    return literal?.length !== 1 || literal[0] !== values[index];
+  })) return command;
+  const patterns = new Set();
+  if (/^Select-String$/i.test(values[0])) {
+    for (let index = 1; index < values.length; index++) {
+      if (/^-(?:SimpleMatch|CaseSensitive|Quiet|List|AllMatches|NotMatch|Raw)$/i.test(values[index])) continue;
+      if (!/^-(?:Pattern|Path|LiteralPath|Context|Encoding)$/i.test(values[index]) || values[index + 1] === undefined) return command;
+      if (/^-Pattern$/i.test(values[index])) patterns.add(index + 1);
+      index++;
+    }
+  } else {
+    const positional = [];
+    let literal = false;
+    for (let index = 1; index < values.length; index++) {
+      const value = values[index];
+      if (literal) { positional.push(index); continue; }
+      if (value === "--") { literal = true; continue; }
+      if (/^(?:-e|--regexp)$/.test(value) && values[index + 1] !== undefined) { patterns.add(++index); continue; }
+      if (/^(?:-g|--glob|-t|--type|-T|--type-not|-m|--max-count|-A|-B|-C|--after-context|--before-context|--context)$/.test(value) && values[index + 1] !== undefined) { index++; continue; }
+      if (/^(?:-[niwFxqlso]+|--only-matching|--line-number|--ignore-case|--fixed-strings|--hidden|--no-heading|--files-with-matches|--count)$/.test(value)) continue;
+      if (value.startsWith("-")) return command;
+      positional.push(index);
+    }
+    if (patterns.size === 0 && positional.length > 0) patterns.add(positional[0]);
+  }
+  // Replace only the parsed pattern spans, never equal-looking path operands.
+  for (const index of [...patterns].sort((a, b) => b - a)) {
+    const span = spans[index];
+    command = command.slice(0, span.index) + "LITERAL_SEARCH_PATTERN" + command.slice(span.index + span[0].length);
+  }
+  return command;
+}
+
+/** Name discovery only. Null means unrelated; false means an unsafe listing attempt. */
+export function createDotenvFileDiscovery({ shellSyntax, tokenizeLiteralCommand, inside, resolve, dirname, lstat, realpath }) {
+return async function reviewedDotenvFileListing(command, cwd, root) {
+  if (/[\r\n]/.test(command)) return command.includes("--files") && command.includes(".env") ? false : null;
+  const values = tokenizeLiteralCommand(command);
+  if (!values) return /^\s*(?:&\s*)?rg(?:\.exe)?\s/.test(command) && command.includes("--files") && command.includes(".env") ? false : null;
+  if (!/^(?:rg|rg\.exe)$/.test(values[0]) || !values.includes("--files") || !values.some(value => value.includes(".env"))) return null;
+  const syntax = shellSyntax(command);
+  if (syntax.interpolation || syntax.redirection || syntax.grouping || /^\s*&/.test(command) || command.length > 4096 || values.length > 48) return false;
+  const flags = new Set(), globs = new Set();
+  const exclusions = new Set(["!**/node_modules/**", "!**/.git/**", "!**/dist/**", "!**/build/**", "!**/.cache/**", "!.local/**", "!.agents/private/**"]);
+  let positive = 0, target = null;
+  for (let index = 1; index < values.length; index++) {
+    const value = values[index];
+    if (["--files", "--no-config", "--hidden", "--no-ignore"].includes(value)) {
+      if (flags.has(value)) return false;
+      flags.add(value); continue;
+    }
+    if (value === "-g") {
+      const glob = values[++index];
+      if (!glob || globs.has(glob) || globs.size >= 16) return false;
+      if (/^\.env(?:\.[A-Za-z0-9_-]+)*$/.test(glob)) positive++;
+      else if (!exclusions.has(glob)) return false;
+      globs.add(glob); continue;
+    }
+    if (value.startsWith("-") || target !== null) return false;
+    target = value;
+  }
+  if (!flags.has("--no-config") || positive === 0) return false;
+  target ??= ".";
+  if (!target || !/^[A-Za-z0-9_. /\\-]+$/.test(target) || target.startsWith("/") || target.startsWith("\\") || target.split(/[\\/]/).includes("..") || (process.platform !== "win32" && target.includes("\\"))) return false;
+  const identity = value => process.platform === "win32" ? resolve(value).toLowerCase() : resolve(value);
+  if (!inside(cwd, root)) return false;
+  try {
+    // Explicit operands must be directories, with no aliases anywhere up to the repository root.
+    for (let cursor = resolve(cwd, target);; cursor = dirname(cursor)) {
+      if (!inside(cursor, root)) return false;
+      const info = await lstat(cursor);
+      if (!info.isDirectory() || info.isSymbolicLink() || identity(await realpath(cursor)) !== identity(cursor)) return false;
+      if (identity(cursor) === identity(root)) break;
+    }
+    return true;
+  } catch { return false; }
+};
+}
 `;
 //# sourceMappingURL=codex-literal-read-sequence-template.js.map

package/dist/services/codex-literal-read-sequence-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-literal-read-sequence-template.js","sourceRoot":"","sources":["../../src/services/codex-literal-read-sequence-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyFpD,CAAC"}
+{"version":3,"file":"codex-literal-read-sequence-template.js","sourceRoot":"","sources":["../../src/services/codex-literal-read-sequence-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoLpD,CAAC"}

package/dist/services/codex-native-authority-policy-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_NATIVE_AUTHORITY_POLICY: string;
+//# sourceMappingURL=codex-native-authority-policy-template.d.ts.map

package/dist/services/codex-native-authority-policy-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-native-authority-policy-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-authority-policy-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,QAkIzC,CAAC"}