@zaip-ai/cli 6.3.0 → 7.6.0

package/dist/services/client-selection.js

@@ -0,0 +1,67 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { parse } from "yaml";
+import { assertSafeDestination } from "./transactional-files.js";
+export const CLAUDE_SETTINGS = `{\n  "permissions": {\n    "allow": [],\n    "deny": []\n  }\n}\n`;
+export async function readGuidanceClients(filesystem) {
+    const path = ".agents/config/project.yaml";
+    if (await filesystem.exists(path))
+        return parseAdapterClients(await filesystem.readText(path));
+    const legacy = ".agents/manifest.yaml";
+    return (await filesystem.exists(legacy))
+        ? parseLegacyAdapterClients(await filesystem.readText(legacy))
+        : parseAdapterClients();
+}
+/** Missing legacy selection means Codex; existing booleans are never inferred from files. */
+export function parseAdapterClients(source) {
+    const value = source === undefined ? undefined : parse(source);
+    if (value !== undefined && (value === null || typeof value !== "object" || Array.isArray(value)))
+        throw new Error("Invalid project configuration for client selection");
+    const clients = value?.clients;
+    if (clients === undefined)
+        return { codex: true, claude: false };
+    if (clients === null || typeof clients !== "object" || Array.isArray(clients))
+        throw new Error("Invalid clients: expected explicit boolean choices");
+    const selected = clients;
+    if (Object.keys(selected).some((key) => !["codex", "claude"].includes(key)))
+        throw new Error("Invalid clients: unknown client");
+    for (const key of ["codex", "claude"])
+        if (selected[key] !== undefined && typeof selected[key] !== "boolean")
+            throw new Error(`Invalid clients.${key}: expected boolean`);
+    return { codex: selected.codex ?? true, claude: selected.claude ?? false };
+}
+export async function readProjectClientSource(root) {
+    return readSelectionSource(root, ".agents/config/project.yaml");
+}
+async function readSelectionSource(root, path) {
+    await assertSafeDestination(root, path);
+    return readFile(resolve(root, path), "utf8").catch((error) => {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    });
+}
+export async function readAdapterClients(root) {
+    const source = await readProjectClientSource(root);
+    if (source !== undefined)
+        return parseAdapterClients(source);
+    const legacy = await readSelectionSource(root, ".agents/manifest.yaml");
+    return legacy === undefined ? parseAdapterClients() : parseLegacyAdapterClients(legacy);
+}
+export function parseLegacyAdapterClients(source) {
+    const value = parse(source);
+    if (value?.schema_version !== 1)
+        throw new Error("Invalid legacy manifest client selection");
+    const agents = value.agents === undefined ? ["codex"] : value.agents;
+    if (!Array.isArray(agents) || agents.some((agent) => !["codex", "claude"].includes(agent)))
+        throw new Error("Invalid legacy manifest agents");
+    return { codex: agents.includes("codex"), claude: agents.includes("claude") };
+}
+/** Ignore disabled projections without deleting or adopting their existing customizations. */
+export function isClientAdapterEnabled(path, clients) {
+    for (const client of ["codex", "claude"])
+        if (path.startsWith(`.${client}/`) || path.startsWith(`.agents/config/clients/${client}/`))
+            return clients[client];
+    return path !== "CLAUDE.md";
+}
+//# sourceMappingURL=client-selection.js.map

package/dist/services/client-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-selection.js","sourceRoot":"","sources":["../../src/services/client-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAOjE,MAAM,CAAC,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAEnG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAGzC;IACC,MAAM,IAAI,GAAG,6BAA6B,CAAC;IAC3C,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,mBAAmB,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,uBAAuB,CAAC;IACvC,OAAO,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,yBAAyB,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC,CAAC,mBAAmB,EAAE,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,MAAM,OAAO,GAAI,KAA2C,EAAE,OAAO,CAAC;IACtE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,OAAkC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;YACnE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAoB,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,OAAO,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC3D,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACpE,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACxE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAA0D,CAAC;IACrF,IAAI,KAAK,EAAE,cAAc,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,OAAuB;IAC1E,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAU;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,MAAM,GAAG,CAAC;YACxF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,IAAI,KAAK,WAAW,CAAC;AAC9B,CAAC"}

package/dist/services/codex-conversation-lifecycle-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-conversation-lifecycle-hook.d.ts","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,QAgS7C,CAAC"}
+{"version":3,"file":"codex-conversation-lifecycle-hook.d.ts","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,QA2S7C,CAAC"}

package/dist/services/codex-conversation-lifecycle-hook.js

@@ -76,7 +76,7 @@ async function terminal(path) {
     // The live Stop belongs to the current tail, not hundreds of MB of earlier
     // turns. Authenticate the first session row, then align a bounded tail scan.
     // Explicit historical replay retains the full resumable scan when no cursor exists.
-    if (!same && !replay && sig.size > maxReadBytes) {
+    if (!same && (!replay || automatic) && sig.size > maxReadBytes) {
       const header = await bytes(h, 0, readChunkBytes), end = header.indexOf(10);
       if (end < 0) throw new Error("transcript_session_header_too_large");
       const first = header.subarray(0, end + 1);
@@ -158,7 +158,7 @@ function gitWorktrees() {
 async function selectWorkspace(correlationKey, worktrees) {
   const matches = [];
   for (const candidate of worktrees.slice(0, 256)) {
-    const correlation = parse(await readFile(resolve(candidate, ".local/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
+    const correlation = parse(await readFile(resolve(candidate, ".agents/private/state/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
     if (correlation?.schema_version === 1 && correlation.thread_id === session && correlation.turn_id === turn && correlation.agent_path === null && typeof correlation.run_id === "string") matches.push(candidate);
   }
   if (matches.length > 1) throw new Error("workspace_correlation_ambiguous");
@@ -169,6 +169,10 @@ async function selectWorkspace(correlationKey, worktrees) {
 }
 try {
   if (event?.hook_event_name !== "Stop" || !session || !turn || !text(event.cwd)) { reply(); process.exit(0); }
+  if (!replay) activation?.recordLifecycleIngress?.(hookRoot, event, await activation?.hookPolicies?.(hookRoot));
+  const canonicalCwd = activation?.canonicalHookCwd?.(event.cwd);
+  if (!canonicalCwd) { reply(); process.exit(0); }
+  event.cwd = canonicalCwd;
   // Automatic recovery is already bound to one canonical workspace by intake.
   // Never discover another worktree or manufacture a historical Conversation.
   const worktrees = automatic ? [hookRoot] : await gitWorktrees();
@@ -176,11 +180,15 @@ try {
   if (!worktrees.some(candidate => inside(event.cwd, candidate))) { reply(); process.exit(0); }
   const correlationKey = hash(JSON.stringify(["codex", session, turn, null, null]));
   root = automatic ? hookRoot : await selectWorkspace(correlationKey, worktrees);
-  local = resolve(root, ".local/hooks");
+  local = resolve(root, ".agents/private/state/hooks");
   const policy = await activation?.hookPolicies?.(root) ?? { governance: false, tracking: false, diagnostic: "policy_module_unavailable" };
   activation?.recordPolicyDiagnostic?.(root, policy);
   trackingEnabled = policy.tracking;
   governanceEnabled = policy.governance;
+  // Persist the native invocation before expensive observation replay or closure.
+  // A host timeout must not erase activation; pending is never closure proof.
+  // Recovery is not a native event and must never manufacture activation.
+  if (!replay && governanceEnabled) activation?.recordActivation(root, event, "pending");
   if (!replay && policy.tracking) activation?.recordHookObservation?.(root, event, policy.governance);
   if (policy.tracking) activation?.replayHookObservations?.(root);
   if (!policy.governance) { reply(); process.exit(0); }
@@ -211,7 +219,7 @@ try {
     for (const delay of automatic ? [0] : [0, 250, 750]) { if (delay) await new Promise(r => setTimeout(r, delay)); status = await terminal(transcriptPath); if (status) break; }
     if (!status) throw new Error("transcript_pending");
     const cli = resolve(root, ".agents/runtime/bin/zaip.mjs");
-    const correlation = parse(await readFile(resolve(root, ".local/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
+    const correlation = parse(await readFile(resolve(root, ".agents/private/state/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
     let intake;
     if (correlation?.schema_version === 1 && correlation.thread_id === session && correlation.turn_id === turn && correlation.agent_path === null && typeof correlation.run_id === "string") {
       intake = { run: { run_id: correlation.run_id }, task: correlation.task_id === null ? null : { id: correlation.task_id } };
@@ -235,18 +243,21 @@ try {
     if (automatic && intake.task !== null &&
         (!outcome.finalization_decision || (outcome.finalization_decision.outcome === "completed" && outcome.finalization_barrier?.satisfied !== true)))
       throw new Error("closure_gates_pending");
-    if (intake.task !== null && status === "completed") {
+    // Completed/cancelled Tasks cannot recover. Their authenticated terminal
+    // result already proves closure; an advisory ledger query must not undo it.
+    const settledTask = intake.task === null ? null : outcome.reconciliation.tasks.find(task => task.id === intake.task.id);
+    if (intake.task !== null && status === "completed" && !["completed", "cancelled"].includes(settledTask.status)) {
       const shown = await call(cli, ["task", "recovery-status", intake.task.id], transcriptPath);
       const recovery = parse(shown.out);
       if (shown.code !== 0 || recovery?.task_id !== intake.task.id || typeof recovery.task_status !== "string") throw new Error("task_state_pending");
       if (["executing", "verifying"].includes(recovery.task_status)) throw new Error("owned_task_active");
       if (["blocked", "failed"].includes(recovery.task_status) && recovery.policy === "legacy_or_unmigrated" && recovery.operation === null) {
-        receipt.recovery = { task_id: intake.task.id };
-        throw new Error("owned_task_unmetered");
+        // Canonical closure is already proved. Recovery eligibility is advisory;
+        // it must not turn a blocked terminal Task into a pending Stop receipt.
+        receipt.recovery = { task_id: intake.task.id, reason: "owned_task_unmetered" };
       }
       if (["blocked", "failed"].includes(recovery.task_status) && ["attempt", "replan", "reconcile"].includes(recovery.operation) && recovery.policy === "frozen_autonomy_v1" && Number.isSafeInteger(recovery.progress?.attempts) && (recovery.progress?.total_replans === null || Number.isSafeInteger(recovery.progress?.total_replans))) {
-        receipt.recovery = { task_id: intake.task.id, operation: recovery.operation, progress: { attempts: recovery.progress.attempts, total_replans: recovery.progress.total_replans } };
-        throw new Error("owned_task_recoverable");
+        receipt.recovery = { task_id: intake.task.id, reason: "owned_task_recoverable", operation: recovery.operation, progress: { attempts: recovery.progress.attempts, total_replans: recovery.progress.total_replans } };
       }
     }
     closureVerified = true; receipt.error = null;

package/dist/services/codex-conversation-lifecycle-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgS1D,CAAC"}
+{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2S1D,CAAC"}

package/dist/services/codex-git-publication-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_GIT_PUBLICATION: string;
+//# sourceMappingURL=codex-git-publication-template.d.ts.map

package/dist/services/codex-git-publication-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-git-publication-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-git-publication-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,QAoHjC,CAAC"}

package/dist/services/codex-git-publication-template.js

@@ -0,0 +1,120 @@
+import { CODEX_RELEASE_PUBLICATION } from "./codex-release-publication-template.js";
+// One emitted module owns Git parsing and the exact reviewed runner interfaces.
+export const CODEX_GIT_PUBLICATION = String.raw `export function createGitPublication({ tokenizeLiteralCommand, gitInvocation, deny }) {
+${CODEX_RELEASE_PUBLICATION}
+function isGitSshMetadataRead(arguments_) {
+  const args = [...arguments_];
+  const seen = new Set();
+  while (["--local", "--show-origin"].includes(args[0])) {
+    if (seen.has(args[0])) return false;
+    seen.add(args.shift());
+  }
+  return args.length === 2 && args[0] === "--get" && args[1] === "core.sshCommand";
+}
+
+function reviewedGitPublisherInvocation(command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:node|node\.exe)$/i.test(tokens[0] ?? "")) return null;
+  const script = tokens[1];
+  const catalog = reviewedLocalCatalogPublisher(script, tokens);
+  if (catalog) return catalog;
+  const staging = reviewedStageInputsPublisher(script, tokens);
+  if (staging) return staging;
+  const consumer = reviewedConsumerPublisher(script, tokens);
+  if (consumer) return consumer;
+  const framework = reviewedFrameworkPublisher(script, tokens);
+  if (framework) return framework;
+  const contract = ".agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.mjs";
+  const publisher = ".agents/skills/zaip-skill-github-deploy/scripts/guarded-commits.mjs";
+  if (![contract, publisher].includes(script)) return null;
+  const allowed = new Set(["--repository", "--request-file", "--plan-file", "--authorization-run", "--condition-task", "--condition-validation", "--condition-run", "--scope",
+    ...(script === publisher ? ["--sha", "--branch", "--remote", "--checks-file", "--evidence-map-file", "--local-catalog-receipt-file", "--dry-run"] : [])]);
+  const values = new Map();
+  for (let index = 2; index < tokens.length; index++) {
+    const flag = tokens[index];
+    if (!allowed.has(flag) || values.has(flag)) deny("Unreviewed publication runner arguments; use its exact candidate-bound interface.");
+    if (flag === "--dry-run") { values.set(flag, true); continue; }
+    const value = tokens[++index];
+    if (!value || value.startsWith("--")) deny("Publication runner argument value is missing.");
+    values.set(flag, value);
+  }
+  if (values.get("--repository") !== "." || !/^RUN-[A-Z0-9-]+$/.test(values.get("--authorization-run") ?? values.get("--condition-run") ?? ""))
+    deny("Publication runner requires the current repository and its exact observed source Run.");
+  for (const flag of ["--request-file", ...(script === publisher ? ["--plan-file", "--checks-file"] : [])])
+    if (!values.has(flag)) deny("Publication runner requires exact request, plan and check locators.");
+  for (const [flag, value] of values) if (flag.endsWith("-file") &&
+      (typeof value !== "string" || !/^\.local\/[A-Za-z0-9_./-]+\.(?:json|txt|md)$/.test(value) || value.split("/").includes("..")))
+    deny("Publication runner metadata must use literal repository-local .local paths.");
+  if (values.has("--remote") && values.get("--remote") !== "origin") deny("Only the contract-bound origin remote is authorized.");
+  if (values.has("--scope") && !["frontend", "backend", "framework"].includes(values.get("--scope"))) deny("Unsupported publication scope.");
+  if (script === publisher && (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(values.get("--sha") ?? "") ||
+      !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(values.get("--branch") ?? "") || values.get("--branch").includes("..")))
+    deny("Publication runner requires one full immutable candidate SHA and literal branch.");
+  return { script, values };
+}
+
+async function validateGitPublication(command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (tokens !== null) {
+    const launcher = tokens[0]?.toLowerCase();
+    if (((launcher === "env" || launcher === "command") && /^git(?:\.exe)?$/i.test(tokens[1] ?? "")) ||
+        (/^(?:Set-Alias|New-Alias)$/i.test(launcher ?? "") && tokens.slice(1).some(token => /^git(?:\.exe)?$/i.test(token))))
+      deny("Indirect Git execution is blocked; use a single literal command.");
+  } else if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
+      /&\s*\(\s*Get-Command\s+git(?:\.exe)?\b/i.test(command) ||
+      /(?:^|[\s;&|])&\s*\$[A-Za-z_]/i.test(command) || /\b(?:Set-Alias|New-Alias)\b[^\r\n;]*\bgit\b/i.test(command)) {
+    deny("Indirect Git execution is blocked; use a single literal command.");
+  }
+  if (tokens === null && /\(\s*git(?:\.exe)?\b/i.test(command)) {
+    deny("Nested Git execution is blocked; use a single literal command.");
+  }
+  if (tokens === null) {
+    if (/(?:^|[;&|\r\n(])\s*git(?:\.exe)?\b/i.test(command)) {
+      deny("Git commands must be a single literal command; separate commands before requesting execution.");
+    }
+    return;
+  }
+  const invocation = gitInvocation(tokens, deny);
+  if (invocation === null) return;
+  const { subcommand, arguments: arguments_ } = invocation;
+  if (subcommand === "commit" && arguments_.some((value) => /^(?:--amend|--no-verify|-n)/i.test(value))) {
+    deny("Commit history rewrites and hook bypasses are blocked.");
+  }
+  if (subcommand === "push" && arguments_.some((value) => /^(?:--force(?:-with-lease|-if-includes)?|-f|--mirror|--delete|--all)$/i.test(value))) {
+    deny("Force, mirror, bulk, and deletion pushes are blocked.");
+  }
+  if (["clean", "reset", "restore", "checkout"].includes(subcommand)) {
+    deny("Destructive Git state changes are blocked.");
+  }
+  if (["branch", "tag"].includes(subcommand) && arguments_.some((value) => /^-d/i.test(value))) {
+    deny("Destructive Git state changes are blocked.");
+  }
+  if (subcommand === "fetch" && arguments_.some((value) => /^--(?:all|prune|prune-tags)$/i.test(value))) {
+    deny("Bulk or pruning fetches are outside the bounded deploy flow.");
+  }
+  if (subcommand === "add") {
+    const broad = arguments_.some((value) => /^(?:-A|--all|-u|\.)$/i.test(value));
+    const force = arguments_.some((value) => /^(?:--force|-f)$/i.test(value));
+    if (broad) deny("Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.");
+    if (force) deny("Force-adding or explicitly staging credential-like files is blocked.");
+  }
+  if (
+    subcommand === "remote" &&
+    ["add", "set-url", "remove", "rename"].includes(arguments_[0]?.toLowerCase())
+  ) {
+    deny("Remote, SSH, and credential configuration changes are blocked.");
+  }
+  if (
+    subcommand === "config" &&
+    arguments_.some((value) => /(?:sshcommand|credential|url\.)/i.test(value) || /^(?:--get-regexp|--get-all|--list|-l)$/.test(value)) &&
+    !isGitSshMetadataRead(arguments_)
+  ) {
+    deny("Remote, SSH, and credential configuration changes are blocked.");
+  }
+  if (subcommand !== "push") return;
+  deny("Direct Git push has no candidate-bound publication contract. Use the reviewed guarded publisher with the exact authorized repository, SHA and destination; a Task writer claim is not publication authority.");
+}
+return { reviewedGitPublisherInvocation, validateGitPublication };
+}
+`;
+//# sourceMappingURL=codex-git-publication-template.js.map

package/dist/services/codex-git-publication-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-git-publication-template.js","sourceRoot":"","sources":["../../src/services/codex-git-publication-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;EAC7C,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmH1B,CAAC"}

package/dist/services/codex-github-setup-template.d.ts

@@ -0,0 +1,3 @@
+export declare const CODEX_GITHUB_SETUP: string;
+export declare const CODEX_GITHUB_SETUP_MODULE: string;
+//# sourceMappingURL=codex-github-setup-template.d.ts.map

package/dist/services/codex-github-setup-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-github-setup-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-github-setup-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,kBAAkB,QAoK9B,CAAC;AAEF,eAAO,MAAM,yBAAyB,QAQrC,CAAC"}

package/dist/services/codex-github-setup-template.js

@@ -0,0 +1,176 @@
+// Shared grammar: the request file is data, never authorization.
+export const CODEX_GITHUB_SETUP = String.raw `
+function githubSetupIntent(request) {
+  // An operational grammar, not keyword co-occurrence. Unknown prose never grants
+  // authority. Preserve a previous grant on neutral turns; revoke explicitly.
+  const text = request.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase();
+  const unquoted = text.replace(/\x60\x60\x60[\s\S]*?\x60\x60\x60|\x60[^\x60\n]*\x60|"[^"\n]*"|'[^'\n]*'|“[^”\n]*”/g, "")
+    .split(/\r?\n/).filter(line => !/^\s*>/.test(line)).join("\n");
+  const lines = unquoted.split(/\r?\n|(?<=[.!])\s+/).map(line => line.trim().replace(/[.!]+$/, "").replace(/\s+/g, " "));
+  // A refusal anywhere in the message wins over every affirmative directive in it.
+  const refused = lines.some(line =>
+    /\b(?:nao|nunca|jamais|not|never|don't)\b[^.!?]*\b(?:configur\w*|public\w*|publiqu\w*|deploy|cria\w*|crie|create|push|github|origin|remot[eo]s?)\b/.test(line) ||
+    /^(?:cancele|cancel|pare|stop|interrompa)(?: (?:tudo|everything|o trabalho|a execucao|a publicacao|o deploy|o setup|a configuracao|the deployment|the setup))?$/.test(line));
+  if (refused) return "revoke";
+  if (/\b(?:exemplo|example|disse|citou|quoted|said|imagine)\b/.test(unquoted)) return "neutral";
+  if (/[?]/.test(unquoted) || /\b(?:quando|se|apos|depois|somente|apenas|aguarde|espere|if|when|after|unless|wait)\b[^.!?]*\b(?:autor\w*|aprov\w*|confirm\w*|approval|permission)\b/.test(unquoted)) return "neutral";
+  const target = "(?:no github|a (?:versao )?v?\\d+\\.\\d+(?:\\.\\d+)?)";
+  const plan = new RegExp("^execute (?:a spec inteira|esse plano completo(?:, aplique as premissas de autonomia)?(?: e finalize)?) ate publicar " + target + "$");
+  const github = /^(?:(?:por favor|agora|please),? )?(?:configure (?:o )?github(?: (?:para|neste|deste) (?:este |o )?projeto)?|pode configurar (?:o )?github|configure o repositorio (?:no )?github(?: deste projeto)?|crie (?:um|o) repositorio(?: privado)? no github|pode criar (?:um|o) repositorio(?: privado)? no github|(?:faca|execute) (?:o )?deploy(?: no github)?|publique (?:este|o) projeto no github|configure github(?: for this project)?|create a private github repository|publish this project to github|deploy to github)$/;
+  return lines.some(line => github.test(line) || plan.test(line)) ? "grant" : "neutral";
+}
+async function githubSetupInvocation(command) {
+  const script = ".agents/skills/zaip-skill-github-setup/scripts/setup.mjs";
+  if (event.tool_name === "apply_patch") return null;
+  if (!command.includes("zaip-skill-github-setup/scripts/setup.mjs") &&
+      !command.includes("zaip-skill-github-setup\\scripts\\setup.mjs")) return null;
+  const tokens = tokenizeLiteralCommand(command);
+  const entrypoint = values => {
+    if (!values || !/^(?:node|node\.exe|.*[\\/]node(?:\.exe)?)$/i.test(values[0] ?? "")) return null;
+    // Only pre-entry options affect script selection; every later token is data.
+    let index = 1;
+    const switches = ["--test", "--test-only", "--test-force-exit", "--check", "-c", "--no-warnings", "--no-deprecation", "--trace-warnings", "--experimental-strip-types"];
+    const valued = ["--test-name-pattern", "--test-skip-pattern", "--test-concurrency", "--test-timeout"];
+    for (; index < values.length && values[index].startsWith("-"); index++) {
+      const option = values[index];
+      if (option === "--") { index++; break; }
+      if (switches.includes(option)) continue;
+      if (valued.includes(option.split("=")[0])) {
+        if (!option.includes("=")) index++;
+        continue;
+      }
+      deny("GitHub setup requires a canonical Node entrypoint without preloads or inline execution.");
+    }
+    return values[index]?.replaceAll("\\", "/") ?? null;
+  };
+  const helper = entry => entry === script || entry?.endsWith("/" + script);
+  if (tokens) {
+    if (!helper(entrypoint(tokens))) return null;
+  } else {
+    // Classification only: read expressions stay with the normal policy. Never
+    // turn an opaque sequence into a setup grant or execute quoted search data.
+    const parts = [];
+    let start = 0, quote = null;
+    for (let index = 0; index < command.length; index++) {
+      const character = command[index];
+      if (quote !== null) {
+        if (character === quote) {
+          if (quote === "'" && command[index + 1] === "'" && process.platform === "win32") index++;
+          else quote = null;
+        }
+      } else if (character === "'" || character === '"') quote = character;
+      else if (/[;|&(){}\r\n]/.test(character)) { parts.push(command.slice(start, index)); start = index + 1; }
+    }
+    parts.push(command.slice(start));
+    const invokesHelper = parts.some(part => {
+      const values = tokenizeLiteralCommand(part);
+      if (values) return helper(entrypoint(values));
+      return /^\s*(?:node(?:\.exe)?|["'][^"'\r\n]*[\\/]node(?:\.exe)?["'])(?:\s|$)/i.test(part);
+    });
+    if (!invokesHelper) return null;
+  }
+  if (!tokens || Object.values(shellSyntax(command)).some(Boolean) ||
+      !/^(?:node|node\.exe)$/i.test(tokens[0] ?? "") ||
+      tokens[1]?.replaceAll("\\", "/") !== script || tokens[2] !== "--request" ||
+      !/^\.agents\/private\/state\/github-setup\/[A-Za-z0-9_-]+\.json$/.test(tokens[3] ?? "") ||
+      !(tokens.length === 4 || (tokens.length === 5 && tokens[4] === "--apply")) ||
+      resolve(event.cwd) !== resolve(repositoryRoot))
+    deny("GitHub setup requires one literal canonical command and a checkout-local request; no routing or authorization overrides.");
+  if (tokens.length === 4) return { apply: false };
+  if (!principal || event.permission_mode === "plan")
+    deny("GitHub onboarding must run on the authorized principal; delegated/read-only agents cannot grant setup authority.");
+  const { createHash } = await import("node:crypto");
+  const { homedir } = await import("node:os");
+  const { open } = await import("node:fs/promises");
+  const pathIdentity = path => process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
+  const session = event.session_id, turn = event.turn_id, tool = event.tool_use_id;
+  if (![session, turn, tool].every(v => typeof v === "string" && /^[A-Za-z0-9_-]{1,256}$/.test(v)) ||
+      (process.env.CODEX_THREAD_ID && process.env.CODEX_THREAD_ID !== session) ||
+      (process.env.CODEX_TURN_ID && process.env.CODEX_TURN_ID !== turn))
+    deny("GitHub setup requires observed host session, turn and tool identity.");
+  const transcript = event.transcript_path;
+  const sessions = resolve(process.env.CODEX_HOME || resolve(homedir(), ".codex"), "sessions");
+  if (typeof transcript !== "string" || !isAbsolute(transcript) || !inside(transcript, sessions) || inside(transcript, repositoryRoot))
+    deny("GitHub setup requires the host transcript, not a caller-authored authorization file.");
+  let requestText, requestSha;
+  try {
+    await assertCanonicalLiteralPath(transcript);
+    await assertCanonicalLiteralPath(tokens[3], repositoryRoot);
+    await assertCanonicalLiteralPath(script, repositoryRoot);
+    requestText = await readBoundedCanonicalText(resolve(repositoryRoot, tokens[3]), 16384, repositoryRoot);
+    const request = JSON.parse(requestText);
+    if (request.schema_version !== 1 || typeof request.repository !== "string" || pathIdentity(request.repository) !== pathIdentity(repositoryRoot))
+      throw new Error("request target");
+    requestSha = createHash("sha256").update(requestText).digest("hex");
+    const file = await open(transcript, "r");
+    try {
+      const stat = await file.stat(), head = Buffer.alloc(Math.min(stat.size, 65536));
+      await file.read(head, 0, head.length, 0);
+      const first = JSON.parse(head.toString("utf8").split("\n")[0]);
+      if (first.type !== "session_meta" || first.payload?.id !== session ||
+          pathIdentity(first.payload?.cwd ?? "") !== pathIdentity(repositoryRoot)) throw new Error("transcript session");
+      let observedTurn = false, authorized = false;
+      const consume = line => {
+        if (!line.trim()) return;
+        const row = JSON.parse(line), payload = row.payload;
+        if ((row.type === "turn_context" && payload?.turn_id === turn) ||
+            (row.type === "event_msg" && payload?.type === "task_started" && payload.turn_id === turn)) observedTurn = true;
+        if (row.type !== "event_msg" || payload?.type !== "user_message" || typeof payload.message !== "string") return;
+        const intent = githubSetupIntent(payload.message);
+        if (intent === "revoke") authorized = false;
+        else if (intent === "grant") authorized = true;
+      };
+      // Stream from the authenticated header: a standing grant outside the tail
+      // remains valid, while every subsequent refusal is still evaluated.
+      const deadline = Date.now() + 4000, maxRecordBytes = 8 * 1024 * 1024;
+      let offset = 0, parts = [], recordBytes = 0;
+      while (offset < stat.size) {
+        if (Date.now() > deadline) throw new Error("transcript scan deadline");
+        const chunk = Buffer.alloc(Math.min(65536, stat.size - offset));
+        const { bytesRead } = await file.read(chunk, 0, chunk.length, offset);
+        if (bytesRead === 0) throw new Error("transcript truncated during scan");
+        offset += bytesRead;
+        let start = 0;
+        for (let i = 0; i < bytesRead; i++) {
+          if (chunk[i] !== 10) continue;
+          const part = chunk.subarray(start, i); recordBytes += part.length;
+          if (recordBytes > maxRecordBytes) throw new Error("transcript record bound");
+          parts.push(part); consume(Buffer.concat(parts, recordBytes).toString("utf8"));
+          parts = []; recordBytes = 0; start = i + 1;
+        }
+        if (start < bytesRead) {
+          const part = chunk.subarray(start, bytesRead); recordBytes += part.length;
+          if (recordBytes > maxRecordBytes) throw new Error("transcript record bound");
+          parts.push(part);
+        }
+      }
+      if (recordBytes) throw new Error("transcript incomplete record");
+      if (!observedTurn || !authorized) throw new Error("human setup request unavailable");
+    } finally { await file.close(); }
+  } catch { deny("GitHub setup authorization or exact target could not be verified from the host transcript. Keep the request and diagnose the missing evidence; do not fabricate a receipt."); }
+  const digest = createHash("sha256").update(JSON.stringify([session, turn, tool])).digest("hex");
+  return { apply: true, digest, receipt: {
+    schema_version: 1, repository: repositoryRoot, request_path: tokens[3], request_sha256: requestSha,
+    session_id: session, turn_id: turn, issued_at_ms: Date.now(),
+  } };
+}
+async function issueGithubSetupReceipt(setup, command) {
+  const { mkdir, writeFile } = await import("node:fs/promises");
+  const directory = resolve(repositoryRoot, ".agents/private/state/codex-hook-github-setup");
+  await assertCanonicalLiteralPath(directory);
+  await mkdir(directory, { recursive: true });
+  const path = resolve(directory, setup.digest + ".json");
+  await writeFile(path, JSON.stringify(setup.receipt), { flag: "wx", mode: 0o600 });
+  return command + " --host-receipt=" + setup.digest;
+}
+`;
+export const CODEX_GITHUB_SETUP_MODULE = `import { isAbsolute, resolve } from "node:path";
+export function createGithubSetupValidators({
+  event, repositoryRoot, principal, tokenizeLiteralCommand, shellSyntax, deny,
+  assertCanonicalLiteralPath, readBoundedCanonicalText, inside,
+}) {
+${CODEX_GITHUB_SETUP}
+  return { githubSetupInvocation, issueGithubSetupReceipt };
+}
+`;
+//# sourceMappingURL=codex-github-setup-template.js.map

package/dist/services/codex-github-setup-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-github-setup-template.js","sourceRoot":"","sources":["../../src/services/codex-github-setup-template.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoK3C,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;EAKvC,kBAAkB;;;CAGnB,CAAC"}

package/dist/services/codex-hook-activation.d.ts

@@ -1,4 +1,4 @@
 export declare const HOOK_ACTIVATION_EVENTS: readonly ["PreToolUse", "SubagentStart", "SubagentStop", "Stop"];
-export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-pre-tool-release-review.mjs", ".codex/hooks/zaip-pre-tool-cloud.mjs", ".codex/hooks/zaip-pre-tool-host-context.mjs", ".codex/hooks/zaip-pre-tool-cli-capture.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
+export declare const HOOK_ACTIVATION_FILES: readonly [".codex/config.toml", ".codex/hooks/zaip-pre-tool-use.mjs", ".codex/hooks/zaip-pre-tool-support.mjs", ".codex/hooks/zaip-pre-tool-release-review.mjs", ".codex/hooks/zaip-pre-tool-cloud.mjs", ".codex/hooks/zaip-pre-tool-github-setup.mjs", ".codex/hooks/zaip-pre-tool-host-context.mjs", ".codex/hooks/zaip-pre-tool-cli-capture.mjs", ".codex/hooks/zaip-native-tool-authority.mjs", ".codex/hooks/zaip-task-delivery-authority.mjs", ".codex/hooks/zaip-git-publication.mjs", ".codex/hooks/zaip-storage-handoff.mjs", ".codex/hooks/zaip-repository-profile.mjs", ".codex/hooks/zaip-native-authority-policy.mjs", ".codex/hooks/zaip-subagent-lifecycle.mjs", ".codex/hooks/zaip-conversation-lifecycle.mjs", ".codex/hooks/zaip-hook-activation.mjs"];
 export declare const CODEX_HOOK_ACTIVATION: string;
 //# sourceMappingURL=codex-hook-activation.d.ts.map

package/dist/services/codex-hook-activation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,+CAA+C,EAC/C,sCAAsC,EACtC,6CAA6C,EAC7C,4CAA4C,EAC5C,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QAiKjC,CAAC"}
+{"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,+CAA+C,EAC/C,sCAAsC,EACtC,6CAA6C,EAC7C,6CAA6C,EAC7C,4CAA4C,EAC5C,6CAA6C,EAC7C,+CAA+C,EAC/C,uCAAuC,EACvC,uCAAuC,EACvC,0CAA0C,EAC1C,+CAA+C,EAC/C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QAwMjC,CAAC"}

package/dist/services/codex-hook-activation.js

@@ -10,9 +10,15 @@ export const HOOK_ACTIVATION_FILES = [
     ".codex/hooks/zaip-pre-tool-support.mjs",
     ".codex/hooks/zaip-pre-tool-release-review.mjs",
     ".codex/hooks/zaip-pre-tool-cloud.mjs",
+    ".codex/hooks/zaip-pre-tool-github-setup.mjs",
     ".codex/hooks/zaip-pre-tool-host-context.mjs",
     ".codex/hooks/zaip-pre-tool-cli-capture.mjs",
     ".codex/hooks/zaip-native-tool-authority.mjs",
+    ".codex/hooks/zaip-task-delivery-authority.mjs",
+    ".codex/hooks/zaip-git-publication.mjs",
+    ".codex/hooks/zaip-storage-handoff.mjs",
+    ".codex/hooks/zaip-repository-profile.mjs",
+    ".codex/hooks/zaip-native-authority-policy.mjs",
     ".codex/hooks/zaip-subagent-lifecycle.mjs",
     ".codex/hooks/zaip-conversation-lifecycle.mjs",
     ".codex/hooks/zaip-hook-activation.mjs",
@@ -21,10 +27,45 @@ export const HOOK_ACTIVATION_FILES = [
 export const CODEX_HOOK_ACTIVATION = String.raw `import { createHash, randomUUID } from "node:crypto";
 import { lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync, existsSync, linkSync, unlinkSync } from "node:fs";
 import { spawn } from "node:child_process";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, resolve } from "node:path";
 const files = ${JSON.stringify(HOOK_ACTIVATION_FILES)};
 const events = ${JSON.stringify(HOOK_ACTIVATION_EVENTS)};
 const digest = text => createHash("sha256").update(text).digest("hex");
+// Windows' local extended-length spelling is the same directory, not a UNC
+// share or an alias. Resolve the physical path before using it for containment.
+export function canonicalHookCwd(value) {
+  if (typeof value !== "string" || value.length > 4096 || !isAbsolute(value)) return null;
+  let candidate = value;
+  if (process.platform === "win32") {
+    if (/^\\\\\?\\[a-z]:\\/i.test(candidate)) candidate = candidate.slice(4);
+    if (/^(?:\\\\|\/\/)/.test(candidate)) return null;
+  }
+  try {
+    const resolved = resolve(candidate), physical = realpathSync(resolved);
+    const identity = path => process.platform === "win32" ? path.toLowerCase() : path;
+    if (identity(physical) !== identity(resolved) || !lstatSync(resolved).isDirectory()) return null;
+    return physical;
+  } catch { return null; }
+}
+export function recordLifecycleIngress(root, event, policy) {
+  if (!policy?.tracking || !["Stop", "SubagentStop"].includes(event?.hook_event_name)) return;
+  try {
+    const session = typeof event.session_id === "string" && event.session_id.length <= 200 ? event.session_id : null;
+    const turn = typeof event.turn_id === "string" && event.turn_id.length <= 200 ? event.turn_id : null;
+    let directory = root;
+    for (const part of [".agents", "private", "state", "hooks", "diagnostics"]) {
+      directory = resolve(directory, part);
+      try { mkdirSync(directory); } catch (error) { if (error.code !== "EEXIST") throw error; }
+      const info = lstatSync(directory);
+      if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;
+    }
+    const path = resolve(directory, "ingress-" + digest(JSON.stringify([event.hook_event_name, session, turn])) + ".json");
+    const temporary = path + ".tmp-" + randomUUID();
+    const cwd_form = typeof event.cwd !== "string" ? "missing" : /^\\\\\?\\[a-z]:\\/i.test(event.cwd) ? "local_namespace" : /^(?:\\\\|\/\/)/.test(event.cwd) ? "unc_or_device" : "plain";
+    writeFileSync(temporary, JSON.stringify({ schema_version: 1, event: event.hook_event_name, session_id: session, turn_id: turn, cwd_form, cwd_accepted: canonicalHookCwd(event.cwd) !== null, observed_at: new Date().toISOString() }) + "\n", { flag: "wx", mode: 0o600 });
+    renameSync(temporary, path);
+  } catch { /* Arrival diagnostics never grant trust or canonical closure. */ }
+}
 function regular(path) {
   const s = lstatSync(path);
   if (!s.isFile() || s.isSymbolicLink() || s.size > 2097152) throw new Error("unsafe activation input");
@@ -34,7 +75,7 @@ export function recordActivation(root, event, outcome = "observed") {
   try {
     const name = event?.hook_event_name;
     let directory = root;
-    for (const part of [".local", "hooks", "activation"]) {
+    for (const part of [".agents", "private", "state", "hooks", "activation"]) {
       directory = resolve(directory, part);
       try { mkdirSync(directory); } catch (e) { if (e.code !== "EEXIST") throw e; }
       const s = lstatSync(directory);
@@ -55,14 +96,18 @@ export function recordActivation(root, event, outcome = "observed") {
     // Hook processes do not necessarily inherit CODEX_THREAD_ID. The event is the
     // protocol identity; receipts remain diagnostics, never proof of Codex trust.
     const fingerprint = digest(JSON.stringify(files.map(file => [file, digest(regular(resolve(root, file)))])));
-    const path = resolve(directory, name + ".json");
-    const temporary = path + ".tmp-" + randomUUID();
-    writeFileSync(temporary, JSON.stringify({ schema_version: 1, event: name, fingerprint,
+    const receipt = JSON.stringify({ schema_version: 1, event: name, fingerprint,
       session_id: event.session_id, turn_id: event.turn_id, outcome,
       identity_source: process.env.CODEX_THREAD_ID ? "event_and_environment" : "hook_event",
-      observed_at: new Date().toISOString() }) + "\n",
-      { flag: "wx", mode: 0o600 });
-    renameSync(temporary, path);
+      observed_at: new Date().toISOString() }) + "\n";
+    // Concurrent chats must not erase each other's diagnostic evidence. Keep
+    // the global receipt for older readers, but select by session when known.
+    for (const filename of [digest(event.session_id) + "-" + name + ".json", name + ".json"]) {
+      const path = resolve(directory, filename);
+      const temporary = path + ".tmp-" + randomUUID();
+      writeFileSync(temporary, receipt, { flag: "wx", mode: 0o600 });
+      renameSync(temporary, path);
+    }
   } catch { /* Diagnostics must not break a tool or turn. Missing evidence stays unknown. */ }
 }
 export function parseHookPolicies(source) {
@@ -119,7 +164,7 @@ export async function isZaipDisabled(repositoryRoot, boundedCanonicalText) {
 export function recordPolicyDiagnostic(root, policy) {
   if (!policy.diagnostic) return;
   try {
-    const directory = resolve(root, ".local/hooks");
+    const directory = resolve(root, ".agents/private/state/hooks");
     mkdirSync(directory, { recursive: true });
     if (!lstatSync(directory).isDirectory() || lstatSync(directory).isSymbolicLink() ||
         realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;
@@ -141,7 +186,7 @@ export function recordHookObservation(root, event, governance = false) {
     const agent_path = typeof event.agent_path === "string" && event.agent_path.length <= 500 ? event.agent_path : null;
     const tool_call_id = typeof event.tool_call_id === "string" && event.tool_call_id.length <= 200 ? event.tool_call_id : null;
     const source_key = JSON.stringify([name, session_id, turn_id, agent_id, agent_path, tool_call_id, name === "PreToolUse" && !tool_call_id ? digest(JSON.stringify(event.tool_input ?? null)) : null]);
-    const directory = resolve(root, ".local/hooks/observations");
+    const directory = resolve(root, ".agents/private/state/hooks/observations");
     mkdirSync(directory, { recursive: true });
     if (!lstatSync(directory).isDirectory() || lstatSync(directory).isSymbolicLink() ||
         realpathSync(directory).toLowerCase() !== directory.toLowerCase()) return;