@zaip-ai/cli 6.3.0 → 7.6.0

package/dist/services/codex-release-publication-template.js

@@ -0,0 +1,127 @@
+// Exact reviewed builder release interface; the runner still authenticates every effect.
+export const CODEX_RELEASE_PUBLICATION = String.raw `function reviewedStageInputsPublisher(script, tokens) {
+  if (script !== "scripts/local-release-preparation.mjs" || tokens[2] !== "stage-inputs") return null;
+  const allowed = new Set(["--sha", "--version", "--profile", "--candidate-date", "--authorization-run", "--mode", "--package-version", "--condition-task", "--condition-validation", "--condition-run"]), values = new Map();
+  for (let index = 3; index < tokens.length; index++) {
+    const flag = tokens[index], value = tokens[++index];
+    if (!allowed.has(flag) || values.has(flag) || !value || value.startsWith("--") || /[\x00\r\n]/.test(value) || value.length > 256) deny("Unreviewed stage-inputs publication arguments.");
+    values.set(flag, value);
+  }
+  if (!/^[a-f0-9]{40}$/.test(values.get("--sha") ?? "") || !/^RUN-[A-Z0-9-]+$/.test(values.get("--authorization-run") ?? "") ||
+      !/^[1-9]\d*\.(?:0|[1-9]\d*)$/.test(values.get("--version") ?? "") || values.get("--profile") !== "essential" || !/^\d{8}$/.test(values.get("--candidate-date") ?? "")) deny("Stage-inputs requires an exact source Run, candidate and reviewed essential interface.");
+  const conditions = ["--condition-task", "--condition-validation", "--condition-run"];
+  if (conditions.some(flag => values.has(flag)) && (!conditions.every(flag => values.has(flag)) || !/^TASK-[A-Z0-9-]+$/.test(values.get("--condition-task")) || !/^TEST-[A-Z0-9-]+$/.test(values.get("--condition-validation")) || !/^RUN-[A-Z0-9-]+$/.test(values.get("--condition-run")))) deny("Stage-inputs requires all exact condition locators together.");
+  if (values.has("--mode") && !["standard", "patch"].includes(values.get("--mode")) || values.has("--package-version") && !/^\d+\.\d+\.\d+$/.test(values.get("--package-version"))) deny("Unreviewed stage-inputs version mode.");
+  return { script, values };
+}
+function reviewedLocalCatalogPublisher(script, tokens) {
+  const closure = script === "scripts/local-catalog-closure.mjs";
+  if (!closure && script !== "scripts/local-catalog-publication.mjs") return null;
+  const action = tokens[2], write = action === (closure ? "push" : "publish");
+  if (!write && action !== "verify") deny("Invalid local catalog publication action.");
+  const required = ["--repository", "--authorization-run", "--plan-file", "--request-file", "--artifacts", "--receipt", "--notes-file",
+    ...(closure ? ["--closure-sha", "--published-sha", "--metadata-paths", "--version"] : ["--sha"]),
+    ...(write ? ["--expected-remote-sha", ...(closure ? [] : ["--inventory-file", "--from", "--evidence"])] : [])];
+  const allowed = new Set([...required, ...(write ? ["--worktree-recovery"] : [])]), values = new Map();
+  for (let i = 3; i < tokens.length; i += 2) {
+    const flag = tokens[i], value = tokens[i + 1];
+    if (!allowed.has(flag) || values.has(flag) || !value || value.startsWith("-") || value.length > 32767 || /[\x00-\x1f]/.test(value)) deny("Unreviewed local catalog publication arguments.");
+    values.set(flag, value);
+  }
+  if (!required.every(flag => values.has(flag)) || values.get("--repository") !== "." || !/^RUN-[A-Z0-9-]+$/.test(values.get("--authorization-run")))
+    deny("Local catalog publication requires exact repository, source Run and reviewed inputs.");
+  for (const [flag, value] of values) if ((flag === "--sha" || flag.endsWith("-sha")) && !/^[a-f0-9]{40}$/.test(value)) deny("Local catalog publication requires immutable Git SHAs.");
+  const source = values.get(closure ? "--published-sha" : "--sha"), directory = values.get("--artifacts");
+  const prefix = ".agents/private/state/release-qualifications/" + source + "/";
+  if (!directory.startsWith(prefix) || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}\/artifacts$/.test(directory.slice(prefix.length)) ||
+      values.get("--receipt") !== directory + "/qualification-receipt.json") deny("Local catalog publication requires the exact candidate's signed artifacts.");
+  const safePath = path => /^[A-Za-z0-9_./-]+$/.test(path) && path.split("/").every(part => part && part !== "." && part !== "..");
+  const suffixes = {"--plan-file": ".json", "--request-file": ".txt", "--notes-file": ".md", "--inventory-file": ".json"};
+  for (const [flag, suffix] of Object.entries(suffixes)) if (values.has(flag)) {
+    const path = values.get(flag);
+    if (!path.startsWith(".local/") || !safePath(path) || !path.endsWith(suffix)) deny("Local catalog publication requires literal project-local metadata.");
+  }
+  if (values.has("--worktree-recovery") && !/^\.agents\/private\/state\/backup-worktrees\/[A-Za-z0-9_-]+\/receipt\.json$/.test(values.get("--worktree-recovery"))) deny("Invalid worktree preservation locator.");
+  if (closure) {
+    const paths = values.get("--metadata-paths").split(",");
+    if (!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(values.get("--version")) || (write && values.get("--expected-remote-sha") !== source) ||
+        new Set(paths).size !== paths.length || !paths.every(path => safePath(path) && (path.startsWith(".agents/records/") || path === ".agents/config/release-cycle.json")))
+      deny("Closure requires the exact published preimage and literal reviewed metadata inventory.");
+  } else if (write && (!/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(values.get("--from")) || !/^EVD-[A-Z0-9-]+(?:,EVD-[A-Z0-9-]+)*$/.test(values.get("--evidence"))))
+    deny("Local catalog publication requires the preceding release tag and exact Evidence IDs.");
+  return { script, values, localCatalog: true };
+}
+function reviewedClosurePublisher(script, tokens) {
+  if (script !== "scripts/local-release-deploy.mjs" || tokens[2] !== "push-closure") return null;
+  const allowed = new Set(["--repository", "--authorization-run", "--expected-repository", "--branch", "--version", "--mode", "--package-version", "--published-sha", "--closure-sha", "--expected-remote-sha", "--publisher-recovery-sha", "--publisher-recovery-ci-run-id", "--metadata-paths", "--metadata-paths-file", "--receipt", "--tarball", "--policy", "--trust-store", "--notes-file", "--output-dir", "--request-file", "--plan-file"]), values = new Map();
+  for (let index = 3; index < tokens.length; index++) {
+    const flag = tokens[index], value = tokens[++index];
+    if (!allowed.has(flag) || values.has(flag) || !value || value.startsWith("--") || value.length > 4096 || /[\x00\r\n]/.test(value)) deny("Unreviewed closure publication arguments.");
+    values.set(flag, value);
+  }
+  if (values.get("--repository") !== "." || values.get("--expected-repository") !== "zaip-ai/zaip-aios" || values.get("--branch") !== "main" ||
+      !/^RUN-[A-Z0-9-]+$/.test(values.get("--authorization-run") ?? "") || !/^[1-9]\d*\.(?:0|[1-9]\d*)$/.test(values.get("--version") ?? "") ||
+      ["--published-sha", "--closure-sha", "--expected-remote-sha"].some(flag => !/^[a-f0-9]{40}$/.test(values.get(flag) ?? "")) || values.has("--metadata-paths") === values.has("--metadata-paths-file")) deny("Closure publication requires exact current authority, child candidate, published parent and main destination.");
+  const directory = values.get("--output-dir")?.replaceAll("\\", "/");
+  for (const flag of ["--request-file", "--plan-file"]) {
+    const path = values.get(flag);
+    if (!path || !/^\.local\/[A-Za-z0-9_./-]+\.(?:json|txt|md)$/.test(path) || path.split("/").includes("..") || flag === "--plan-file" && !path.endsWith(".json")) deny("Closure publication requires new repository-local child request and plan locators.");
+  }
+  if (!directory || !/^(?:[A-Za-z]:\/|\/)/.test(directory) || directory.split("/").includes("..") || /[\x00-\x1f*?{}\[\]$%<>]/.test(directory)) deny("Closure publication requires the protected published candidate directory.");
+  for (const flag of ["--receipt", "--tarball", "--notes-file", ...(values.has("--metadata-paths-file") ? ["--metadata-paths-file"] : [])]) {
+    const path = values.get(flag)?.replaceAll("\\", "/");
+    if (!path || !path.startsWith(directory + "/") || path.split("/").includes("..")) deny("Closure metadata escaped the published candidate directory.");
+  }
+  if (!["--policy", "--trust-store"].every(flag => values.has(flag)) || values.has("--metadata-paths") && (!/^[A-Za-z0-9_./-]+(?:,[A-Za-z0-9_./-]+)*$/.test(values.get("--metadata-paths")) || values.get("--metadata-paths").split(",").some(path => path.startsWith("/") || path.split(/[\\/]/).includes("..")))) deny("Closure verification inputs are incomplete or unreviewed.");
+  if (values.has("--mode") && !["standard", "patch"].includes(values.get("--mode")) || values.has("--package-version") && !/^\d+\.\d+\.\d+$/.test(values.get("--package-version"))) deny("Unreviewed closure version mode.");
+  if (values.has("--publisher-recovery-sha") && !/^[a-f0-9]{40}$/.test(values.get("--publisher-recovery-sha")) || values.has("--publisher-recovery-ci-run-id") && !/^[1-9]\d*$/.test(values.get("--publisher-recovery-ci-run-id"))) deny("Unreviewed closure recovery identity.");
+  return { script, values };
+}
+function reviewedConsumerPublisher(script, tokens) {
+  if (script !== ".agents/skills/zaip-skill-github-deploy/scripts/consumer-release-preparation.mjs") return null;
+  if (tokens[2] !== "guarded-push") return null;
+  const flags = new Set(["--repository", "--authorization-run", "--sha", "--branch", "--scope", "--remote", "--remote-url", "--github-version", "--policy", "--trust-store", "--private-key", "--key-id", "--output-dir", "--commands-json", "--request-file", "--plan-file"]);
+  const values = new Map();
+  for (let index = 3; index < tokens.length; index++) {
+    const flag = tokens[index], value = tokens[++index];
+    if (!flags.has(flag) || values.has(flag) || !value || value.startsWith("--") || value.length > 65536 || /[\x00\r\n]/.test(value)) deny("Unreviewed consumer publication arguments.");
+    values.set(flag, value);
+  }
+  if (values.get("--repository") !== "." || !/^RUN-[A-Z0-9-]+$/.test(values.get("--authorization-run") ?? "") || !/^[a-f0-9]{40}$/.test(values.get("--sha") ?? "") ||
+      (values.has("--remote") && values.get("--remote") !== "origin") || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(values.get("--branch") ?? "") || values.get("--branch").includes("..")) deny("Consumer publication requires exact source, candidate and destination.");
+  for (const flag of ["--request-file", "--plan-file", "--policy", "--trust-store", "--private-key", "--output-dir"]) {
+    const path = values.get(flag);
+    if (!path || !/^\.local\/[A-Za-z0-9_./-]+$/.test(path) || path.split("/").includes("..")) deny("Consumer publication requires repository-local literal metadata and qualification paths.");
+  }
+  for (const flag of ["--remote-url", "--github-version", "--key-id", "--commands-json"]) if (!values.has(flag)) deny("Consumer qualification inputs are incomplete.");
+  return { script, values };
+}
+function reviewedFrameworkPublisher(script, tokens) {
+  if (script !== "scripts/local-release-deploy.mjs") return null;
+  if (tokens[2] === "push-closure") return reviewedClosurePublisher(script, tokens);
+  if (tokens[2] === "runtime-preflight") return null;
+  const booleanFlags = new Set(["--initial", "--dry-run", "--offline-dry-run", "--draft-only", "--resume-remote"]);
+  const flags = new Set(["--repository", "--authorization-run", "--expected-repository", "--sha", "--branch", "--output-dir", "--policy", "--key-id", "--channel", "--version", "--expires-at", "--notes-file", "--inventory-file", "--from", "--profile", "--mode", "--package-version", "--private-key", "--trust-store", ...booleanFlags]);
+  const values = new Map();
+  for (let index = 2; index < tokens.length; index++) {
+    const flag = tokens[index];
+    if (!flags.has(flag) || values.has(flag)) deny("Unreviewed framework publication arguments.");
+    if (booleanFlags.has(flag)) { values.set(flag, true); continue; }
+    const value = tokens[++index];
+    if (!value || value.startsWith("--") || value.length > 4096 || /[\x00\r\n]/.test(value)) deny("Missing framework publication value.");
+    values.set(flag, value);
+  }
+  if (values.get("--repository") !== "." || values.get("--expected-repository") !== "zaip-ai/zaip-aios" || values.get("--branch") !== "main" || values.get("--channel") !== "latest" ||
+      !/^RUN-[A-Z0-9-]+$/.test(values.get("--authorization-run") ?? "") || !/^[a-f0-9]{40}$/.test(values.get("--sha") ?? "")) deny("Framework publication requires exact source Run, candidate and main destination.");
+  for (const flag of ["--output-dir", "--policy", "--key-id", "--version", "--expires-at", "--notes-file", "--inventory-file"]) if (!values.has(flag)) deny("Incomplete framework publication contract.");
+  const directory = values.get("--output-dir").replaceAll("\\", "/");
+  if (!/^(?:[A-Za-z]:\/|\/)/.test(directory) || directory.split("/").includes("..") || /[\x00-\x1f*?{}\[\]$%<>]/.test(directory)) deny("Framework publication requires the exact protected candidate directory.");
+  for (const flag of ["--notes-file", "--inventory-file"]) {
+    const path = values.get(flag).replaceAll("\\", "/");
+    if (!path.startsWith(directory + "/") || path.split("/").includes("..") || !/\.(?:json|md|txt)$/.test(path)) deny("Framework publication metadata escaped the candidate directory.");
+  }
+  if (values.has("--offline-dry-run") && !values.has("--dry-run")) deny("Offline release validation requires dry run.");
+  return { script, values };
+}
+`;
+//# sourceMappingURL=codex-release-publication-template.js.map

package/dist/services/codex-release-publication-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-release-publication-template.js","sourceRoot":"","sources":["../../src/services/codex-release-publication-template.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4HlD,CAAC"}

package/dist/services/codex-repository-profile-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_REPOSITORY_PROFILE: string;
+//# sourceMappingURL=codex-repository-profile-template.d.ts.map

package/dist/services/codex-repository-profile-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-repository-profile-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-repository-profile-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB,QAkFpC,CAAC"}

package/dist/services/codex-repository-profile-template.js

@@ -0,0 +1,84 @@
+export const CODEX_REPOSITORY_PROFILE = String.raw `import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+// This boundary narrows existing authority; it never grants a command or writer.
+export async function enforceRepositoryProfile({ installedRoot, repositoryRoot, event, tokenizeLiteralCommand, shellSyntax, patchPaths, isLiteralReadSequence, deny }) {
+  const policyPath = resolve(installedRoot, ".agents/config/repository-policy.json");
+  try { await lstat(policyPath); } catch (error) { if (error.code === "ENOENT") return false; throw error; }
+  const modulePath = resolve(installedRoot, ".agents/tools/repository-policy.mjs");
+  for (let path = modulePath; path !== dirname(installedRoot); path = dirname(path)) {
+    const info = await lstat(path);
+    if (info.isSymbolicLink()) throw Error("repository_profile_linked_runtime");
+    if (path === installedRoot) break;
+  }
+  const { loadRepositoryPolicy, assertRepositoryWrite, assertRepositoryOperation } = await import(pathToFileURL(modulePath).href);
+  const policy = await loadRepositoryPolicy(installedRoot);
+  const identity = path => process.platform === "win32" ? path.toLowerCase() : path;
+  if (identity(await realpath(repositoryRoot)) !== identity(await realpath(installedRoot)))
+    deny("Repository profile cannot be escaped through another checkout; configure and operate that repository in its own context.");
+  const input = event.tool_input ?? {};
+  const command = input.cmd ?? input.command ?? input.patch;
+  const cwd = input.workdir ?? event.cwd ?? repositoryRoot;
+  const local = relative(repositoryRoot, resolve(cwd));
+  if (local === ".." || local.startsWith("..\\") || local.startsWith("../") || isAbsolute(local))
+    deny("Repository profile rejects an external working directory.");
+  const write = path => assertRepositoryWrite(policy, repositoryRoot, relative(repositoryRoot, resolve(cwd, path)).replaceAll("\\", "/"));
+  if (event.tool_name === "apply_patch") {
+    const paths = patchPaths(command, repositoryRoot);
+    if (!paths.length) deny("Repository profile requires explicit patch paths.");
+    for (const path of paths) await assertRepositoryWrite(policy, repositoryRoot, path);
+    return false;
+  }
+  if (["Write", "Edit"].includes(event.tool_name)) {
+    await write(input.file_path ?? input.path ?? command);
+    return false;
+  }
+  if (typeof command !== "string") deny("Repository profile requires a supported literal tool invocation.");
+  // A configured boundary also applies to general; absence preserves legacy command policy.
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || Object.values(shellSyntax(command)).some(Boolean))
+    deny("Restricted repository profiles reject compound, inline and indirect shell execution.");
+  const executable = (tokens[0] ?? "").toLowerCase();
+  if (isLiteralReadSequence(command)) return false;
+  const node = /^(?:node|node\.exe)$/.test(executable);
+  if (node && identity(await realpath(cwd)) !== identity(await realpath(repositoryRoot)))
+    deny("Canonical runners must execute from the repository root.");
+  if (node && tokens[1] === ".agents/tools/repository-profile.mjs") {
+    if (!["show", "configure"].includes(tokens[2])) deny("Unsupported repository profile setup action.");
+    if (tokens.includes("--apply")) deny("An installed repository policy cannot be replaced by agent authority. Prepare a preview; the human applies it from their own terminal.");
+    return false;
+  }
+  // The CLI enforces graph, writer and scoped paths. No inline source executes here.
+  if (node && tokens[1] === ".agents/runtime/bin/zaip.mjs") {
+    if (["enable", "disable", "adapters", "setup", "generate", "validation", "execution"].includes(tokens[2]))
+      deny("This operation requires a reviewed repository-specific execution boundary.");
+    if (["conversation", "run", "subagent", "change", "decision", "evidence", "context", "doctor", "status", "version", "hook", "manifest"].includes(tokens[2])) return false;
+    if (tokens[2] === "task" && ["workspace", "show", "list", "amend-scopes"].includes(tokens[3])) return false;
+    deny("Repository profile rejects this unclassified CLI operation.");
+  }
+  if (node && tokens[1] === ".agents/tools/cloud-runner.mjs") {
+    assertRepositoryOperation(policy, "infra");
+    // Existing cloud guard and runner still validate the exact operation and contract.
+    return false;
+  }
+  if (node && tokens[1] === ".agents/skills/zaip-skill-maintenance-enter/scripts/maintenance.mjs") {
+    if (tokens.length === 3 && ["enter", "exit", "status"].includes(tokens[2])) return false;
+    deny("Repository profile requires the local maintenance transition without root overrides.");
+  }
+  if (["set-content", "add-content"].includes(executable)) {
+    const options = new Map();
+    for (let index = 1; index < tokens.length; index += 2) {
+      const flag = tokens[index]?.toLowerCase(), value = tokens[index + 1];
+      if (!["-literalpath", "-value", "-encoding"].includes(flag) || value === undefined || options.has(flag))
+        deny("Repository profile requires a single literal file write.");
+      options.set(flag, value);
+    }
+    if (!options.has("-literalpath") || !options.has("-value")) deny("Repository profile requires an explicit write target.");
+    await write(options.get("-literalpath"));
+    return false;
+  }
+  deny("Repository profile " + policy.profile + " rejects unclassified execution, remote shells and container source edits. Use a scoped runner or hand off to the owning repository.");
+}
+`;
+//# sourceMappingURL=codex-repository-profile-template.js.map

package/dist/services/codex-repository-profile-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-repository-profile-template.js","sourceRoot":"","sources":["../../src/services/codex-repository-profile-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFjD,CAAC"}

package/dist/services/codex-rules.d.ts

@@ -1,3 +1,3 @@
-export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile\n# the branch resolved fresh from project.yaml deploy.branch and form evidenced functional commits\n# with explicit pathspecs. The validation fallback is beta; production defaults to main and is human-promoted.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the configured GitHub remote once before checking the configured deploy branch.\",\n    match = [\"git fetch origin\"],\n    not_match = [\"git pull origin\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\", \"--\"],\n    decision = \"allow\",\n    justification = \"Stage only an evidenced functional group with explicit pathspecs during an authorized deploy.\",\n    match = [\"git add -- README.md\", \"git add -- packages/core/src/example.ts\"],\n    not_match = [\"git add -A\", \"git add --all\", \"git add .\", \"git add -u\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\", \"-m\"],\n    decision = \"allow\",\n    justification = \"Create an evidenced functional commit without rewriting history during an authorized deploy.\",\n    match = ['git commit -m \"[CODEX] Atualizar contrato de deploy\"'],\n    not_match = [\"git commit --amend -m repair\", \"git commit --no-verify -m repair\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"push\", \"--include-untracked\"],\n    decision = \"allow\",\n    justification = \"Preserve the selected deploy diff without dropping history.\",\n    match = [\"git stash push --include-untracked -m deploy-preserve\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"apply\"],\n    decision = \"allow\",\n    justification = \"Reapply the preserved selected deploy diff.\",\n    match = [\"git stash apply\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"allow\",\n    justification = \"Publish only deploy.branch with an explicit refspec after ZAIP preflight.\",\n    match = [\"git push origin HEAD:refs/heads/beta\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/beta\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
+export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile\n# the branch resolved fresh from project.yaml deploy.branch and form evidenced functional commits\n# with explicit pathspecs. The validation fallback is beta; production defaults to main and is human-promoted.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the configured GitHub remote once before checking the configured deploy branch.\",\n    match = [\"git fetch origin\"],\n    not_match = [\"git pull origin\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\", \"--\"],\n    decision = \"allow\",\n    justification = \"Stage only an evidenced functional group with explicit pathspecs during an authorized deploy.\",\n    match = [\"git add -- README.md\", \"git add -- packages/core/src/example.ts\"],\n    not_match = [\"git add -A\", \"git add --all\", \"git add .\", \"git add -u\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\", \"-m\"],\n    decision = \"allow\",\n    justification = \"Create an evidenced functional commit without rewriting history during an authorized deploy.\",\n    match = ['git commit -m \"[CODEX] Atualizar contrato de deploy\"'],\n    not_match = [\"git commit --amend -m repair\", \"git commit --no-verify -m repair\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"push\", \"--include-untracked\"],\n    decision = \"allow\",\n    justification = \"Preserve the selected deploy diff without dropping history.\",\n    match = [\"git stash push --include-untracked -m deploy-preserve\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"apply\"],\n    decision = \"allow\",\n    justification = \"Reapply the preserved selected deploy diff.\",\n    match = [\"git stash apply\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"forbidden\",\n    justification = \"Direct push has no candidate-bound publication contract; use the reviewed publisher.\",\n    match = [\"git push origin HEAD:refs/heads/beta\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/beta\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
 export declare const CODEX_SECURITY_RULES = "# Fail-closed defense in depth for commands that must never prompt or execute.\n# Native permission profiles, repository instructions, and these forbidden rules form the active boundary.\n\nprefix_rule(\n    pattern = [\"git\", [\"clean\", \"reset\", \"restore\"]],\n    decision = \"forbidden\",\n    justification = \"Use non-destructive Git inspection and an explicit file-level patch instead.\",\n    match = [\"git reset --hard\", \"git clean -fd\", \"git restore README.md\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", [\"-c\", \"--config\", \"--config-env\", \"--git-dir\", \"--work-tree\", \"--namespace\"]],\n    decision = \"forbidden\",\n    justification = \"Git configuration and repository-routing overrides can bypass the managed safety hook.\",\n    match = [\"git -c core.hooksPath=/tmp/empty commit -m bypass\", \"git --config core.hooksPath=/tmp/empty commit -m bypass\"],\n)\n\nprefix_rule(\n    pattern = [[\"reg\", \"reg.exe\", \"schtasks\", \"schtasks.exe\", \"sc\", \"sc.exe\", \"diskpart\", \"format\", \"bcdedit\", \"fsutil\", \"takeown\", \"icacls\"]],\n    decision = \"forbidden\",\n    justification = \"Operating-system persistence, disk, service, ownership, and ACL changes are outside repository scope.\",\n    match = [\"reg add HKCU\\Software\\Example\", \"schtasks /create /tn example\", \"diskpart\"],\n)\n\nprefix_rule(\n    pattern = [[\"runas\", \"sudo\", \"gsudo\"]],\n    decision = \"forbidden\",\n    justification = \"Privilege escalation is never allowed from ZAIP repository work.\",\n    match = [\"runas /user:Administrator cmd\", \"sudo rm -rf /\"],\n)\n\nprefix_rule(\n    pattern = [[\"winget\", \"choco\", \"scoop\"]],\n    decision = \"forbidden\",\n    justification = \"System package management is outside repository scope; use project-local dependencies.\",\n    match = [\"winget install Git.Git\", \"choco upgrade nodejs\", \"scoop install jq\"],\n)\n\nprefix_rule(\n    pattern = [[\"ssh\", \"scp\", \"sftp\", \"rsync\", \"ftp\", \"telnet\", \"nc\", \"ncat\"]],\n    decision = \"forbidden\",\n    justification = \"Use the repository-owned GitHub deploy preflight and Git commands instead of direct remote clients.\",\n    match = [\"ssh host\", \"scp file host:/tmp\", \"nc -l 4444\"],\n)\n";
 //# sourceMappingURL=codex-rules.d.ts.map

package/dist/services/codex-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,4zHA4FrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,otEA4ChC,CAAC"}
+{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,20HA4FrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,otEA4ChC,CAAC"}

package/dist/services/codex-rules.js

@@ -53,8 +53,8 @@ prefix_rule(
 
 prefix_rule(
     pattern = ["git", "push"],
-    decision = "allow",
-    justification = "Publish only deploy.branch with an explicit refspec after ZAIP preflight.",
+    decision = "forbidden",
+    justification = "Direct push has no candidate-bound publication contract; use the reviewed publisher.",
     match = ["git push origin HEAD:refs/heads/beta"],
     not_match = ["git pull", "ssh -i key git@github.com"],
 )

package/dist/services/codex-storage-handoff-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_STORAGE_HANDOFF_REVIEW: string;
+//# sourceMappingURL=codex-storage-handoff-template.d.ts.map

package/dist/services/codex-storage-handoff-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-storage-handoff-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-storage-handoff-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,QAgBxC,CAAC"}

package/dist/services/codex-storage-handoff-template.js

@@ -0,0 +1,18 @@
+export const CODEX_STORAGE_HANDOFF_REVIEW = String.raw `export function isStorageHandoffCommand(tokens) {
+  if (!tokens || tokens[1] !== ".agents/private/state/storage-cutover/runtime/zaip.mjs" ||
+      tokens[2] !== "task" || tokens[3] !== "storage-handoff" || !/^TASK-[A-Z0-9-]+$/.test(tokens[4] ?? "")) return false;
+  const flags = new Set(), values = new Map();
+  for (let i = 5; i < tokens.length; i++) {
+    const flag = tokens[i];
+    if (flags.has(flag)) return false;
+    flags.add(flag);
+    if (["--inspect", "--apply", "--json"].includes(flag)) continue;
+    if (!["--run", "--generation"].includes(flag) || !tokens[i + 1] || tokens[i + 1].startsWith("--")) return false;
+    values.set(flag, tokens[++i]);
+  }
+  if (!/^RUN-[A-Z0-9-]+$/.test(values.get("--run") ?? "") || flags.has("--inspect") === flags.has("--apply")) return false;
+  return flags.has("--inspect") ? !flags.has("--generation")
+    : /^\.agents\/private\/state\/storage-cutover\/generations\/[a-f0-9]{64}\.json$/.test(values.get("--generation") ?? "");
+}
+`;
+//# sourceMappingURL=codex-storage-handoff-template.js.map

package/dist/services/codex-storage-handoff-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-storage-handoff-template.js","sourceRoot":"","sources":["../../src/services/codex-storage-handoff-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;CAgBrD,CAAC"}

package/dist/services/codex-subagent-hook-template.d.ts

@@ -1,2 +1,2 @@
-export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  if (!(await activation?.hookPolicies?.(repositoryRoot))?.governance) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const policy = await activation?.hookPolicies?.(repositoryRoot);\n  if (policy?.tracking) activation?.replayHookObservations?.(repositoryRoot);\n  if (!policy?.governance) { process.stdout.write(JSON.stringify({ attempted: 0, deferred: 0, pending: 0, disabled: true })); process.exit(0); }\n  const files = (await fs.readdir(pendingRoot).catch(() => []))\n    .filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).sort();\n  const cursorPath = resolve(pendingRoot, \".replay-cursor\");\n  const cursor = await fs.readFile(cursorPath, \"utf8\").then(JSON.parse).catch(() => null);\n  const start = (files.indexOf(cursor?.last) + 1) % (files.length || 1);\n  const selected = [...files.slice(start), ...files.slice(0, start)].slice(0, 256);\n  let attempted = 0, deferred = 0, pending = 0;\n  let lastAttempted = null;\n  for (const file of selected) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state !== \"pending\" || !Array.isArray(receipt.capture_arguments)) continue;\n    if (attempted < 3) {\n      attempted++; lastAttempted = file;\n      if (await replayPendingReceipt(path) === \"deferred\") deferred++;\n    }\n    if ((await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null))?.state === \"pending\") pending++;\n  }\n  if (selected.length) await atomicSave(cursorPath, { last: lastAttempted ?? selected.at(-1) });\n  process.stdout.write(JSON.stringify({ attempted, deferred, pending, uninspected: files.length - selected.length }));\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  if (cwd === null || !selectRoot(cwd)) process.exit(0);\n  const policy = await activation?.hookPolicies?.(repositoryRoot) ?? { governance: false, tracking: false, diagnostic: \"policy_module_unavailable\" };\n  activation?.recordPolicyDiagnostic?.(repositoryRoot, policy);\n  if (policy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, policy.governance);\n  if (policy.tracking && event.hook_event_name === \"SubagentStop\") activation?.replayHookObservations?.(repositoryRoot);\n  if (!policy.governance) { process.stdout.write(JSON.stringify({})); process.exit(0); }\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  const delays = [25, 50, 75, 100, 150, 225, 300, 400, 500];\n  try {\n    await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n    for (let retry = 0; ; retry++) {\n      try { await fs.rename(temporary, path); return; }\n      catch (error) {\n        if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= delays.length) throw error;\n        await new Promise(done => setTimeout(done, delays[retry]));\n      }\n    }\n  } finally {\n    await fs.unlink(temporary).catch(() => {});\n  }\n}\n\nasync function replayPendingReceipt(path) {\n  const deadline = Date.now() + 2000;\n  for (;;) {\n    if (await runCaptureRunner(path, true) !== \"lease_busy\") return \"attempted\";\n    if (Date.now() >= deadline) {\n      await persistDiagnostic(\"replay_deferred_active_lease\", { receipt: path });\n      return \"deferred\";\n    }\n    await new Promise(done => setTimeout(done, 50));\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return \"lease_busy\";\n    try { process.kill(owner.pid, 0); return \"lease_busy\"; } catch (failure) { if (failure.code !== \"ESRCH\") return \"lease_busy\"; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return \"lease_busy\"; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return \"lease_busy\";\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return \"lease_busy\";\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n    const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const policy = await activation?.hookPolicies?.(repositoryRoot);\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true,\n    env: { ...process.env, ZAIP_HOOK_TRACKING_ENABLED: policy?.tracking ? \"true\" : \"false\" }, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
+export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".agents/private/state\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".agents/private/state\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".agents/private/state\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".agents/private/state\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  if (!(await activation?.hookPolicies?.(repositoryRoot))?.governance) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const policy = await activation?.hookPolicies?.(repositoryRoot);\n  if (policy?.tracking) activation?.replayHookObservations?.(repositoryRoot);\n  if (!policy?.governance) { process.stdout.write(JSON.stringify({ attempted: 0, deferred: 0, pending: 0, disabled: true })); process.exit(0); }\n  const files = (await fs.readdir(pendingRoot).catch(() => []))\n    .filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).sort();\n  const cursorPath = resolve(pendingRoot, \".replay-cursor\");\n  const cursor = await fs.readFile(cursorPath, \"utf8\").then(JSON.parse).catch(() => null);\n  const start = (files.indexOf(cursor?.last) + 1) % (files.length || 1);\n  const selected = [...files.slice(start), ...files.slice(0, start)].slice(0, 256);\n  let attempted = 0, deferred = 0, pending = 0;\n  let lastAttempted = null;\n  for (const file of selected) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state !== \"pending\" || !Array.isArray(receipt.capture_arguments)) continue;\n    if (attempted < 3) {\n      attempted++; lastAttempted = file;\n      if (await replayPendingReceipt(path) === \"deferred\") deferred++;\n    }\n    if ((await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null))?.state === \"pending\") pending++;\n  }\n  if (selected.length) await atomicSave(cursorPath, { last: lastAttempted ?? selected.at(-1) });\n  process.stdout.write(JSON.stringify({ attempted, deferred, pending, uninspected: files.length - selected.length }));\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  activation?.recordLifecycleIngress?.(installedRoot, event, await activation?.hookPolicies?.(installedRoot));\n  const cwd = activation?.canonicalHookCwd?.(event.cwd);\n  if (!cwd || !selectRoot(cwd)) { process.stdout.write(JSON.stringify({})); process.exit(0); }\n  const policy = await activation?.hookPolicies?.(repositoryRoot) ?? { governance: false, tracking: false, diagnostic: \"policy_module_unavailable\" };\n  activation?.recordPolicyDiagnostic?.(repositoryRoot, policy);\n  if (policy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, policy.governance);\n  if (policy.tracking && event.hook_event_name === \"SubagentStop\") activation?.replayHookObservations?.(repositoryRoot);\n  if (!policy.governance) { process.stdout.write(JSON.stringify({})); process.exit(0); }\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  const delays = [25, 50, 75, 100, 150, 225, 300, 400, 500];\n  try {\n    await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n    for (let retry = 0; ; retry++) {\n      try { await fs.rename(temporary, path); return; }\n      catch (error) {\n        if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= delays.length) throw error;\n        await new Promise(done => setTimeout(done, delays[retry]));\n      }\n    }\n  } finally {\n    await fs.unlink(temporary).catch(() => {});\n  }\n}\n\nasync function replayPendingReceipt(path) {\n  const deadline = Date.now() + 2000;\n  for (;;) {\n    if (await runCaptureRunner(path, true) !== \"lease_busy\") return \"attempted\";\n    if (Date.now() >= deadline) {\n      await persistDiagnostic(\"replay_deferred_active_lease\", { receipt: path });\n      return \"deferred\";\n    }\n    await new Promise(done => setTimeout(done, 50));\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return \"lease_busy\";\n    try { process.kill(owner.pid, 0); return \"lease_busy\"; } catch (failure) { if (failure.code !== \"ESRCH\") return \"lease_busy\"; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return \"lease_busy\"; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return \"lease_busy\";\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return \"lease_busy\";\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n    const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const policy = await activation?.hookPolicies?.(repositoryRoot);\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true,\n    env: { ...process.env, ZAIP_HOOK_TRACKING_ENABLED: policy?.tracking ? \"true\" : \"false\" }, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
 //# sourceMappingURL=codex-subagent-hook-template.d.ts.map

package/dist/services/codex-subagent-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,i1kBAiYzC,CAAC"}
+{"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,6jlBAkYzC,CAAC"}

package/dist/services/codex-subagent-hook-template.js

@@ -11,11 +11,11 @@ const installedRoot = resolve(dirname(hookPath), "..", "..");
 let repositoryRoot = installedRoot;
 let diagnosticPath = resolve(
   repositoryRoot,
-  ".local",
+  ".agents/private/state",
   "hooks",
   "subagent-lifecycle.ndjson",
 );
-let pendingRoot = resolve(repositoryRoot, ".local", "hooks", "subagent-pending");
+let pendingRoot = resolve(repositoryRoot, ".agents/private/state", "hooks", "subagent-pending");
 
 function inside(path, root) {
   const scoped = relative(root, resolve(path));
@@ -44,8 +44,8 @@ function selectRoot(cwd) {
       if (common(installedRoot) !== common(candidate)) return false;
       repositoryRoot = candidate;
     }
-    diagnosticPath = resolve(repositoryRoot, ".local", "hooks", "subagent-lifecycle.ndjson");
-    pendingRoot = resolve(repositoryRoot, ".local", "hooks", "subagent-pending");
+    diagnosticPath = resolve(repositoryRoot, ".agents/private/state", "hooks", "subagent-lifecycle.ndjson");
+    pendingRoot = resolve(repositoryRoot, ".agents/private/state", "hooks", "subagent-pending");
     return true;
   } catch { return false; }
 }
@@ -89,8 +89,9 @@ for await (const chunk of process.stdin) raw += chunk;
 
 try {
   const event = JSON.parse(raw);
-  const cwd = text(event.cwd);
-  if (cwd === null || !selectRoot(cwd)) process.exit(0);
+  activation?.recordLifecycleIngress?.(installedRoot, event, await activation?.hookPolicies?.(installedRoot));
+  const cwd = activation?.canonicalHookCwd?.(event.cwd);
+  if (!cwd || !selectRoot(cwd)) { process.stdout.write(JSON.stringify({})); process.exit(0); }
   const policy = await activation?.hookPolicies?.(repositoryRoot) ?? { governance: false, tracking: false, diagnostic: "policy_module_unavailable" };
   activation?.recordPolicyDiagnostic?.(repositoryRoot, policy);
   if (policy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, policy.governance);

package/dist/services/codex-subagent-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-subagent-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiY5C,CAAC"}
+{"version":3,"file":"codex-subagent-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkY5C,CAAC"}

package/dist/services/codex-task-delivery-authority-template.d.ts

@@ -0,0 +1,3 @@
+/** A draft continuation keeps its immutable capture phase after canonical execution. */
+export declare const CODEX_TASK_DELIVERY_AUTHORITY_SUPPORT: string;
+//# sourceMappingURL=codex-task-delivery-authority-template.d.ts.map

package/dist/services/codex-task-delivery-authority-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-task-delivery-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-task-delivery-authority-template.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,eAAO,MAAM,qCAAqC,QAiPjD,CAAC"}