agent-control-plane-core 0.8.2 → 0.9.0

package/src/control-plane.mjs

@@ -398,7 +398,8 @@ export function classifyCallClass(tool, native) {
 /**
  * The result of rendering a {@link Verdict} for a specific agent's transport —
  * the ATTACH mechanism, not the decision. A caller applies whichever channels
- * are present: write `stdout`, exit with `exit_code`, or `throw`.
+ * are present: write `stdout`, write `stderr`, then exit with `exit_code`
+ * (`emit` in `agent-control-plane-core/runtime` does all three).
  * @typedef {object} NativeResponse
  * @property {"external_hook"|"in_process"|"observe_only"} transport
  * @property {number} exit_code process exit code carrying the decision (0 = proceed)
@@ -492,6 +493,30 @@ export function readonlySet(values) {
  */
 export const UNRENDERED_ON_UNKNOWN = readonlySet(VERDICT_CONTENT_FIELDS);
 
+/**
+ * PROBLEM CLASS — an event marked vetoable on a path where the host can never
+ * veto it, so a deny reads downstream as a block that never happened.
+ *
+ * Each entry names a field (`path` into the {@link ToolCallEvent}) whose `value`
+ * makes `this_call_vetoable: true` a false claim. This is the ONE list:
+ * {@link makeEvent} refuses an event that breaks an entry, and the JSON-schema
+ * generator writes one `if`/`then` rule per entry, so the runtime and the
+ * published schema cannot hold different invariants.
+ * @type {ReadonlyArray<{ path: readonly string[], value: string, why: string }>}
+ */
+export const VETO_IMPOSSIBLE = Object.freeze([
+  Object.freeze({
+    path: Object.freeze(["event"]),
+    value: EventKind.UNKNOWN,
+    why: "an unmodelled event has no host response to veto, so reporting one is a false block",
+  }),
+  Object.freeze({
+    path: Object.freeze(["meta", "integration_mode"]),
+    value: IntegrationMode.OBSERVE_ONLY,
+    why: "an observe-only transport reads a transcript and cannot pre-empt a call, so reporting a veto is a false block",
+  }),
+]);
+
 /**
  * The translator for one agent's protocol. `parse` maps a native event to a
  * {@link ToolCallEvent} (never throwing on unmodelled input, stamping the
@@ -537,16 +562,6 @@ export function makeEvent({
     throw new TypeError(
       `control-plane: makeEvent this_call_vetoable must be a boolean, got ${typeof this_call_vetoable}`,
     );
-  // The same fail-open seam, one step further: an event the adapter could not
-  // name is one whose host response nobody established, so a veto reported for
-  // it is a block the render claims and the host never performs. Refused HERE
-  // because every adapter builds its event through this call, so an adapter that
-  // computes the flag without `vetoableFor` cannot reach the wire either.
-  if (event === EventKind.UNKNOWN && this_call_vetoable)
-    throw new Error(
-      "control-plane: makeEvent got a vetoable UNKNOWN event — an unmodelled " +
-        "event has no host response to veto, so reporting one is a false block",
-    );
   /** @type {ToolCallEvent} */
   const evt = {
     schema_version: SCHEMA_VERSION,
@@ -557,6 +572,18 @@ export function makeEvent({
     meta,
   };
   if (response !== undefined) evt.response = response;
+  // Refused HERE because every adapter builds its event through this call, so an
+  // adapter that computes the flag without `vetoableFor` cannot reach the wire.
+  if (this_call_vetoable) {
+    const broken = VETO_IMPOSSIBLE.find(
+      ({ path, value }) =>
+        path.reduce((/** @type {any} */ at, key) => at[key], evt) === value,
+    );
+    if (broken !== undefined)
+      throw new Error(
+        `control-plane: makeEvent got a vetoable event whose ${broken.path.join(".")} is ${JSON.stringify(broken.value)} — ${broken.why}`,
+      );
+  }
   return evt;
 }
 
@@ -828,3 +855,106 @@ export function nativeResponse({
   if (stderr !== undefined) out.stderr = stderr;
   return out;
 }
+
+/**
+ * The block reason a render writes when the judge gave none (or an empty one).
+ * Codex drops an enforced deny whose reason is empty and runs the tool, and on
+ * every host the model is refused with no rationale without one.
+ */
+export const DEFAULT_DENY_REASON = "blocked by monitor";
+
+/**
+ * PROBLEM CLASS — an enforced block whose reason never reaches the host, or
+ * whose exit code is not the one the host treats as a block, because each
+ * adapter hand-wired its own stderr and exit code.
+ *
+ * One row per agent, describing that host's ENFORCED block:
+ * - `exit_code`: the exit status the host treats as a block.
+ * - `reason_stream`: the stream the host reads the block reason from on that
+ *   exit. Every host here discards (or never gets) the stdout body on exit 2.
+ * - `reason_required`: the host drops a block whose reason is empty and runs
+ *   the tool, so every body field that carries the reason must be non-empty.
+ *
+ * {@link gatedResponse} derives each adapter's enforced render from its row,
+ * and the conformance harness holds every enforced render to the same row.
+ * @type {Readonly<Record<string, Readonly<{ exit_code: number, reason_stream: "stderr", reason_required: boolean }>>>}
+ */
+export const BLOCK_TRANSPORT = Object.freeze({
+  claude: Object.freeze({
+    exit_code: 2,
+    reason_stream: "stderr",
+    reason_required: false,
+  }),
+  codex: Object.freeze({
+    exit_code: 2,
+    reason_stream: "stderr",
+    reason_required: true,
+  }),
+  amp: Object.freeze({
+    exit_code: 2,
+    reason_stream: "stderr",
+    reason_required: false,
+  }),
+  gemini: Object.freeze({
+    exit_code: 2,
+    reason_stream: "stderr",
+    reason_required: false,
+  }),
+});
+
+/**
+ * The {@link BLOCK_TRANSPORT} row for `agent`. Throws for an agent with no row:
+ * a missing row would otherwise render an enforced block with no exit code.
+ * @param {string} agent
+ * @returns {Readonly<{ exit_code: number, reason_stream: "stderr", reason_required: boolean }>}
+ */
+export function blockTransportFor(agent) {
+  const row = lookup(BLOCK_TRANSPORT, agent);
+  if (row === undefined)
+    throw new Error(
+      `control-plane: no BLOCK_TRANSPORT row for agent ${JSON.stringify(agent)}`,
+    );
+  return row;
+}
+
+/**
+ * `reason` when it holds visible text, else {@link DEFAULT_DENY_REASON}.
+ * @param {unknown} reason
+ * @returns {string}
+ */
+export function blockReason(reason) {
+  return typeof reason === "string" && reason.trim() !== ""
+    ? reason
+    : DEFAULT_DENY_REASON;
+}
+
+/**
+ * Build an adapter's {@link NativeResponse} from its {@link BLOCK_TRANSPORT}
+ * row. When `enforced`, the exit code is the row's and the reason (or the
+ * default) goes on the row's reason stream. Otherwise `unblocked_exit_code`
+ * stands and no reason stream is written: nothing was blocked, so the host
+ * reads the exit-0 (or ask) body instead.
+ * @param {string} agent
+ * @param {{ transport: string, enforced: boolean, unblocked_exit_code: number, stdout?: unknown, reason?: string }} parts
+ * @returns {NativeResponse}
+ */
+export function gatedResponse(
+  agent,
+  { transport, enforced, unblocked_exit_code, stdout, reason },
+) {
+  if (!enforced)
+    return nativeResponse({
+      transport,
+      exit_code: unblocked_exit_code,
+      enforced,
+      stdout,
+    });
+  const row = blockTransportFor(agent);
+  return nativeResponse({
+    transport,
+    exit_code: row.exit_code,
+    enforced,
+    stdout,
+    [row.reason_stream]: blockReason(reason),
+  });
+}

package/src/fixtures/codex.json

@@ -2,11 +2,10 @@
   "agent": "codex",
   "cases": [
     {
-      "name": "PreToolUse v0.135 enforcing, all verdicts",
+      "name": "PreToolUse on an enforcing Codex, all verdicts",
       "call_class": "builtin",
       "native": {
         "hook_event_name": "PreToolUse",
-        "version": "0.135.0",
         "session_id": "c1",
         "cwd": "/w",
         "permission_mode": "default",
@@ -100,7 +99,8 @@
                 "permissionDecision": "deny",
                 "permissionDecisionReason": "blocked"
               }
-            }
+            },
+            "stderr": "blocked"
           }
         },
         "ask": {
@@ -117,7 +117,8 @@
                 "permissionDecision": "deny",
                 "permissionDecisionReason": "blocked by monitor"
               }
-            }
+            },
+            "stderr": "blocked by monitor"
           }
         },
         "mutation": {
@@ -145,11 +146,10 @@
       }
     },
     {
-      "name": "PreToolUse v0.135 MCP tool is non-vetoable (hook fires for Bash only)",
+      "name": "PreToolUse MCP tool is non-vetoable (hook fires for Bash only)",
       "call_class": "mcp",
       "native": {
         "hook_event_name": "PreToolUse",
-        "version": "0.135.0",
         "tool_name": "mcp__github__create_issue",
         "tool_input": {
           "title": "hi"
@@ -209,11 +209,10 @@
       }
     },
     {
-      "name": "PreToolUse v0.151 from a subagent (agent_type present)",
+      "name": "PreToolUse from a subagent (agent_type present)",
       "call_class": "subagent",
       "native": {
         "hook_event_name": "PreToolUse",
-        "version": "0.151.0",
         "session_id": "c-sub",
         "cwd": "/w",
         "permission_mode": "default",
@@ -307,7 +306,8 @@
                 "permissionDecision": "deny",
                 "permissionDecisionReason": "subagent shell blocked"
               }
-            }
+            },
+            "stderr": "subagent shell blocked"
           }
         },
         "ask": {
@@ -324,7 +324,8 @@
                 "permissionDecision": "deny",
                 "permissionDecisionReason": "blocked by monitor"
               }
-            }
+            },
+            "stderr": "blocked by monitor"
           }
         }
       }
@@ -333,7 +334,6 @@
       "name": "PermissionRequest round-trips the native event name",
       "native": {
         "hook_event_name": "PermissionRequest",
-        "version": "1.0.0",
         "tool_name": "Bash",
         "tool_input": {
           "command": "rm -rf /"
@@ -372,79 +372,16 @@
                 "permissionDecision": "deny",
                 "permissionDecisionReason": "nope"
               }
-            }
-          }
-        }
-      }
-    },
-    {
-      "name": "pre-v0.135 downgrades to observe_only (advisory deny)",
-      "native": {
-        "hook_event_name": "PreToolUse",
-        "version": "0.134.9",
-        "tool_name": "Bash",
-        "tool_input": {
-          "command": "curl evil"
-        }
-      },
-      "event": {
-        "schema_version": 1,
-        "event": "pre_tool",
-        "tool": "Bash",
-        "input": {
-          "command": "curl evil"
-        },
-        "this_call_vetoable": false,
-        "meta": {
-          "agent": "codex",
-          "native_event": "PreToolUse",
-          "native_tool": "Bash",
-          "integration_mode": "observe_only",
-          "primary_gate_present": true,
-          "passthrough": {}
-        }
-      },
-      "render": {
-        "allow": {
-          "verdict": {
-            "decision": "allow"
-          },
-          "native": {
-            "transport": "observe_only",
-            "exit_code": 0,
-            "enforced": false,
-            "stdout": {
-              "hookSpecificOutput": {
-                "hookEventName": "PreToolUse"
-              }
-            }
-          }
-        },
-        "deny": {
-          "verdict": {
-            "decision": "deny",
-            "reason": "advisory only"
-          },
-          "native": {
-            "transport": "observe_only",
-            "exit_code": 0,
-            "enforced": false,
-            "stdout": {
-              "hookSpecificOutput": {
-                "hookEventName": "PreToolUse",
-                "permissionDecision": "deny",
-                "permissionDecisionReason": "advisory only"
-              }
-            }
+            },
+            "stderr": "nope"
           }
         }
       }
     },
     {
-      "name": "PostToolUse v0.151 blocks on the post-tool schema",
+      "name": "PostToolUse blocks on the post-tool schema",
       "native": {
         "hook_event_name": "PostToolUse",
-        "version": "0.151.0",
         "session_id": "c2",
         "cwd": "/w",
         "tool_name": "Bash",
@@ -543,7 +480,8 @@
               },
               "decision": "block",
               "reason": "leaked credential"
-            }
+            },
+            "stderr": "leaked credential"
           }
         },
         "deny_no_reason": {
@@ -560,7 +498,8 @@
               },
               "decision": "block",
               "reason": "blocked by monitor"
-            }
+            },
+            "stderr": "blocked by monitor"
           }
         }
       }

package/src/index.mjs

@@ -19,7 +19,7 @@
 
 export * from "./control-plane.mjs";
 export { claudeAdapter, HookEvent } from "./adapters/claude.mjs";
-export { codexAdapter } from "./adapters/codex.mjs";
+export { codexAdapter, createCodexAdapter } from "./adapters/codex.mjs";
 export { ampAdapter } from "./adapters/amp.mjs";
 export {
   geminiAdapter,

package/src/json-schema.mjs

@@ -49,6 +49,7 @@ import {
   SCHEMA_VERSION,
   STANDARD_META_FIELDS,
   VERDICT_CONTENT_FIELDS,
+  VETO_IMPOSSIBLE,
 } from "./control-plane.mjs";
 
 /** The JSON Schema dialect these documents are written in. */
@@ -236,42 +237,29 @@ export function toolCallEventSchema() {
       meta: { $ref: "#/$defs/EventMeta" },
     },
     additionalProperties: false,
-    // Two claims a producer must not make, both the same fail-open: a veto the
-    // host will never perform, read downstream as a block that happened.
-    //
-    // An event the adapter could not name has no host response to veto, so a
-    // vetoable UNKNOWN is that claim. `makeEvent` throws on one. An OBSERVE_ONLY
-    // transport reads a transcript and cannot pre-empt anything, so a vetoable
-    // event on one is the same claim by a different route — every shipped
-    // adapter derives both flags from one "can this host enforce" answer, but
-    // `makeEvent` does NOT refuse it, so this document is the only place a
-    // producer is held to it.
-    allOf: [
-      vetoImpossibleWhen({ event: { const: EventKind.UNKNOWN } }),
-      vetoImpossibleWhen({
-        meta: {
-          required: ["integration_mode"],
-          properties: {
-            integration_mode: { const: IntegrationMode.OBSERVE_ONLY },
-          },
-        },
-      }),
-    ],
+    // One rule per VETO_IMPOSSIBLE entry — the same list `makeEvent` enforces.
+    allOf: VETO_IMPOSSIBLE.map(({ path, value }) => ({
+      if: pathMatch(path, value),
+      then: { properties: { this_call_vetoable: { const: false } } },
+    })),
     $defs: { EventMeta: eventMetaSchema() },
   };
 }
 
 /**
- * A conditional subschema forcing `this_call_vetoable: false` wherever `match`
- * holds. `required` names every key `match` constrains, because an absent key
- * satisfies a bare `properties` and would leave the `then` branch dead.
- * @param {Record<string, unknown>} match
+ * A subschema that holds where the field at `path` equals `value`. Each level
+ * names its key in `required`, because an absent key satisfies a bare
+ * `properties` and would leave the `then` branch dead.
+ * @param {readonly string[]} path
+ * @param {string} value
  * @returns {Record<string, unknown>}
  */
-function vetoImpossibleWhen(match) {
+function pathMatch([key, ...rest], value) {
   return {
-    if: { required: Object.keys(match), properties: match },
-    then: { properties: { this_call_vetoable: { const: false } } },
+    required: [key],
+    properties: {
+      [key]: rest.length === 0 ? { const: value } : pathMatch(rest, value),
+    },
   };
 }
 

package/src/registry.mjs

@@ -16,7 +16,7 @@
 
 import { lookup } from "./control-plane.mjs";
 import { claudeAdapter } from "./adapters/claude.mjs";
-import { codexAdapter } from "./adapters/codex.mjs";
+import { codexAdapter, createCodexAdapter } from "./adapters/codex.mjs";
 import { ampAdapter } from "./adapters/amp.mjs";
 import { geminiAdapter } from "./adapters/gemini.mjs";
 
@@ -63,19 +63,39 @@ export function assertRegistryConsistent(adapters) {
 
 assertRegistryConsistent(ADAPTERS);
 
+/**
+ * The adapters that take launcher options, keyed by agent id. Only Codex does:
+ * its hook stdin carries no version, so the launcher pins one.
+ * @type {Readonly<Record<string, (options: any) => Adapter>>}
+ */
+const CONFIGURABLE = Object.freeze({
+  [codexAdapter.AGENT]: createCodexAdapter,
+});
+
 /**
  * Resolve an agent id to its adapter. Throws (fail loud) on an unknown id — a
  * selection signal that names no shipped adapter is a misconfiguration, not a
  * reason to silently fall back to a default agent (which would run the wrong
  * translator against the payloads and mis-render every verdict).
+ *
+ * `options` are the launcher's settings for that adapter (Codex:
+ * `{ version }`). Passing options to an adapter that takes none throws, so a
+ * setting the launcher believes it applied cannot be dropped in silence.
  * @param {string} id agent id (a {@link AGENT_IDS} member)
+ * @param {Record<string, unknown>} [options]
  * @returns {Adapter}
  */
-export function adapterFor(id) {
+export function adapterFor(id, options) {
   const adapter = lookup(ADAPTERS, id);
   if (adapter === undefined)
     throw new Error(
       `registry: no adapter for agent id ${JSON.stringify(id)} (known: ${AGENT_IDS.join(", ")})`,
     );
-  return adapter;
+  if (options === undefined) return adapter;
+  const configure = lookup(CONFIGURABLE, id);
+  if (configure === undefined)
+    throw new Error(
+      `registry: adapter ${JSON.stringify(id)} takes no options, got ${JSON.stringify(options)}`,
+    );
+  return configure(options);
 }

package/src/runtime.mjs

@@ -56,19 +56,22 @@ export function demoJudge(event) {
 
 /**
  * Run one host's parse→judge→render pipe over a raw stdin payload. If the payload
- * can't be parsed or the pipe throws, return `onFailure` — the host's OWN
+ * can't be parsed or the render throws, return `onFailure` — the host's OWN
  * fail-safe response — so a crashed hook degrades the way THAT host expects
  * (claude/codex fail OPEN = exit 0; amp fails to ASK = exit 1) instead of a
  * single shared default. This is the deliberate, necessary recovery the whole
  * per-host split exists for, not a blanket swallow.
  *
- * Before returning the fail-safe, the error is written to STDERR (never stdout,
- * which belongs to the host transport) so a regression that silently disables
- * enforcement leaves a greppable trace. Every host tolerates hook stderr:
- * claude/codex surface it only in verbose/debug on a 0 exit, amp forwards the
- * helper's stderr, and gemini reads stderr as a reason only on exit 2 — none of
- * these fail-safe exits is a 2 for a stdout-carrying transport, and amp's ask
- * (exit 1) shows the diagnostic alongside the prompt, which is the point.
+ * A judge that THROWS is not a malformed payload: the call parsed, and the judge
+ * failed to answer. That takes the same path as a judge that answers garbage —
+ * the clamp's `ask` (see below) — so a crashing guardrail puts the call in front
+ * of a human instead of taking an exit-0 fail-safe that runs it.
+ *
+ * Every error is written to STDERR (never stdout, which belongs to the host
+ * transport) so a regression that silently disables enforcement leaves a
+ * greppable trace. Every host tolerates hook stderr: claude/codex surface it
+ * only in verbose/debug on a 0 exit, amp forwards the helper's stderr, and
+ * gemini reads stderr as a reason only on exit 2.
  * `judge` is the seam a real deployment fills — {@link demoJudge} is a stand-in,
  * so the guardrail is supplied here rather than by forking this file. Whatever
  * it returns is treated as untrusted (see the clamp below).
@@ -96,23 +99,49 @@ export function renderHookResponse(
         `hook payload must be a JSON object, got ${native === null ? "null" : Array.isArray(native) ? "array" : typeof native}`,
       );
     const event = adapter.parse(native);
+    /** @type {unknown} */
+    let answer;
+    try {
+      answer = judge(event);
+    } catch (err) {
+      // No `decision`, so the clamp below turns this into an `ask`.
+      answer = { reason: `hook judge threw: ${describe(err).split("\n")[0]}` };
+      report("hook judge error", err);
+    }
     // A judge's answer is clamped, not trusted. `normalizeVerdict` (inside
     // every adapter's render) THROWS on a decision outside allow/deny/ask, and
-    // that throw lands in the catch below — which returns the host's fail-safe,
-    // exit 0 on claude/codex/gemini. So a judge that means DENY but spells it
-    // "denied" would let the tool run. Clamping to "ask" first keeps a
-    // malformed answer in front of a human. Prose is passed through: scrubbing
-    // monitor-authored text needs a scrubber this transport module has no
-    // business choosing, and the decision is the half that gates the call.
-    const verdict = sanitizeVerdict(judge(event), (text) => text);
+    // that throw would land in the catch below — the host's fail-safe, exit 0
+    // on claude/codex/gemini. So a judge that means DENY but spells it "denied"
+    // would let the tool run. Clamping to "ask" first keeps a malformed answer
+    // in front of a human. Prose is passed through: scrubbing monitor-authored
+    // text needs a scrubber this transport module has no business choosing.
+    const verdict = sanitizeVerdict(answer, (text) => text);
     return adapter.render(verdict, event);
   } catch (err) {
-    const detail = err instanceof Error ? (err.stack ?? err.message) : `${err}`;
-    process.stderr.write(`[acp] hook pipeline error: ${detail}\n`);
+    report("hook pipeline error", err);
     return onFailure;
   }
 }
 
+/**
+ * A thrown value as readable text: an Error's stack (or message when it has no
+ * stack), or the value itself for a bare throw.
+ * @param {unknown} err
+ * @returns {string}
+ */
+function describe(err) {
+  return err instanceof Error ? (err.stack ?? err.message) : `${err}`;
+}
+
+/**
+ * Write one diagnostic line for `err` to stderr.
+ * @param {string} label
+ * @param {unknown} err
+ */
+function report(label, err) {
+  process.stderr.write(`[acp] ${label}: ${describe(err)}\n`);
+}
+
 /**
  * A one-millisecond synchronous sleep buffer for the EAGAIN retry in
  * {@link writeAllSync}. Allocated once at module scope: the retry path must not

package/types/adapters/codex.d.mts

@@ -4,16 +4,12 @@
  * release core; anything it can't coerce to a valid version (missing, empty,
  * garbage) yields `null` and is treated as too old — fail closed to advisory.
  *
- * TRUST BOUNDARY (sandbox, not adapter): `version` is read from the hook stdin
- * payload, so a payload that under-reports it downgrades enforcement to advisory
- * (a deny renders exit 0). The adapter cannot distinguish a spoofed version from
- * a genuinely old Codex — the ground-truth version lives outside the payload —
- * so anti-spoofing belongs to the sandbox that controls what the hook is fed
- * (the same "pin it from outside" posture the managed-config mount enforces for
- * the hook binary; see docs/monitor-invariants.md §Invariant 1). Coercing an
- * absent/garbage version to enforcing HERE would break the legitimate old-Codex
- * case (rendering an exit-2 block a pre-0.135 Codex ignores, while dishonestly
- * marking it `enforced`), so the adapter stays faithful to what the payload says.
+ * WHERE THE VERSION COMES FROM: Codex's PreToolUse stdin carries no `version`
+ * field, so the launcher that pins the Codex binary supplies it, through
+ * {@link createCodexAdapter}. A payload `version` is a fallback only, and the
+ * payload is untrusted: one that under-reports downgrades a deny to advisory. Coercing an absent version to enforcing HERE would
+ * break the legitimate old-Codex case (an exit-2 block a pre-0.135 Codex
+ * ignores, dishonestly marked `enforced`), so an unknown version stays advisory.
  * @param {unknown} version
  * @returns {boolean}
  */
@@ -22,10 +18,18 @@ export function canEnforce(version: unknown): boolean;
  * Parse a raw Codex hook payload. Never throws on unmodelled input. Marks the
  * event observe-only (this_call_vetoable=false) when the Codex version
  * predates hook enforcement.
+ *
+ * `version` is the Codex version the LAUNCHER pinned, and it wins. Codex's
+ * hook stdin documents no version field, so a payload `version` is read only
+ * when no launcher version was given: a wrapper that injects one into stdin
+ * keeps working. With neither, the event is advisory.
  * @param {any} native
+ * @param {{ version?: string }} [options]
  * @returns {ToolCallEvent}
  */
-export function parse(native: any): ToolCallEvent;
+export function parse(native: any, { version }?: {
+    version?: string;
+}): ToolCallEvent;
 /**
  * Render into Codex's native external-hook transport: a JSON body preserving the
  * native event name (`PreToolUse`/`PermissionRequest`/`PostToolUse`) plus exit 2
@@ -49,6 +53,18 @@ export function parse(native: any): ToolCallEvent;
 export function render(verdict: Verdict, event: ToolCallEvent, { soleGate }?: {
     soleGate?: boolean;
 }): NativeResponse;
+/**
+ * Build a Codex adapter whose `parse` judges every payload against `version`,
+ * the Codex version the launcher pinned (Codex's hook stdin carries none).
+ * Below {@link MIN_ENFORCING_VERSION} every event parses observe-only and a
+ * deny renders advisory. With no `version`, `parse` falls back to a payload
+ * `version` (see {@link parse}).
+ * @param {{ version?: string }} [options]
+ * @returns {import("../control-plane.mjs").Adapter}
+ */
+export function createCodexAdapter({ version }?: {
+    version?: string;
+}): import("../control-plane.mjs").Adapter;
 /** @typedef {import("../control-plane.mjs").ToolCallEvent} ToolCallEvent */
 /** @typedef {import("../control-plane.mjs").Verdict} Verdict */
 /** @typedef {import("../control-plane.mjs").NativeResponse} NativeResponse */
@@ -124,8 +140,12 @@ export const NATIVE_EVENT_FOR: Record<string, string | undefined>;
  * naming a key the host discards.
  */
 export const NATIVE_ASK_TIER: false;
-export const DEFAULT_DENY_REASON: "blocked by monitor";
-/** @type {import("../control-plane.mjs").Adapter} */
+/**
+ * The Codex adapter with no launcher-pinned version. Real Codex sends no
+ * version, so every event it sends parses observe-only here. A deployment that
+ * runs Codex ≥ v0.135 builds its own with {@link createCodexAdapter}.
+ * @type {import("../control-plane.mjs").Adapter}
+ */
 export const codexAdapter: import("../control-plane.mjs").Adapter;
 export type ToolCallEvent = import("../control-plane.mjs").ToolCallEvent;
 export type Verdict = import("../control-plane.mjs").Verdict;