agent-control-plane-core 0.9.0 → 0.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-control-plane-core",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Vendor-neutral control-plane contract for coding agents: a normalized ToolCallEvent/Verdict schema with per-agent adapters (Claude Code, Codex, Amp, Gemini CLI) and a conformance suite.",
   "type": "module",
   "repository": {

package/src/adapters/codex.mjs

@@ -54,25 +54,25 @@ export const AGENT = "codex";
 export const INTEGRATION_MODE = IntegrationMode.EXTERNAL_HOOK;
 
 /**
- * Hook-coverage matrix row (`docs/hook-coverage-matrix.md`). `PreToolUse`
- * intercepts the shell (Bash) tool ONLY — other builtins and MCP tools never
- * reach it — so builtin is PARTIAL and MCP is UNCOVERED. A live probe
- * ([X3]/[X4]) fired `PreToolUse` for a SUBAGENT's call and for a call in a
- * RESUMED session, so both are PARTIAL too: covered, under the same Bash-only
- * limit as [X1], rather than the ❓ the matrix carried before the probe ran.
+ * Hook-coverage matrix row (`docs/hook-coverage-matrix.md`). `PreToolUse` fires
+ * for the shell tools, `apply_patch`, every MCP tool call and every other
+ * function tool ([X1]/[X2], read from Codex's own source at the enforcement
+ * floor). It never fires for `write_stdin`, which types into a process an
+ * earlier call started, nor for a tool OpenAI runs on its own side, so builtin
+ * and MCP are both PARTIAL. A live probe ([X3]/[X4]) fired `PreToolUse` for a
+ * SUBAGENT's call and for a call in a RESUMED session, so both are PARTIAL too.
  *
  * These rows describe PRE-TOOL routing, which is the only thing the matrix's
  * [X1]/[X2] sources speak about. `parse` applies them to a pre-tool event only
- * (see {@link vetoableCall}); Codex's `PostToolUse` fires for tools `PreToolUse`
- * never sees, so a post-tool event judged by the MCP row would drop a block
- * Codex documents it honours.
+ * (see {@link vetoableCall}); a `PostToolUse` payload in hand is proof the
+ * post-tool hook fired for that call, whatever the pre-tool row says.
  *
  * The SUBAGENT row is the one the classifier now reaches on this host: the same
  * probe found `agent_id`/`agent_type` present on a subagent's `PreToolUse`
  * payload and ABSENT on the main thread's, so {@link classifyCallClass} answers
  * SUBAGENT from that payload alone. It is PARTIAL, so such a call stays vetoable
  * — the row's job here is to be honest, not to degrade. An MCP-named call takes
- * the UNCOVERED MCP row either way, subagent or not.
+ * the MCP row either way, subagent or not.
  *
  * The RESUMED row is DECLARATIVE ONLY, for a reason no longer about coverage: a
  * resumed session announces itself on `SessionStart` (`source: "resume"`), not on
@@ -84,7 +84,7 @@ export const INTEGRATION_MODE = IntegrationMode.EXTERNAL_HOOK;
 /** @type {import("../control-plane.mjs").CoverageMap} */
 export const COVERAGE = Object.freeze({
   [CallClass.BUILTIN]: CoverageStatus.PARTIAL,
-  [CallClass.MCP]: CoverageStatus.UNCOVERED,
+  [CallClass.MCP]: CoverageStatus.PARTIAL,
   [CallClass.SUBAGENT]: CoverageStatus.PARTIAL,
   [CallClass.RESUMED]: CoverageStatus.PARTIAL,
 });
@@ -221,17 +221,13 @@ export function canEnforce(version) {
 /**
  * Whether an event of `kind` may be marked vetoable, given the tool it names.
  *
- * PRE_TOOL takes the coverage floor: `PreToolUse` fires for Bash only, so an
- * MCP-sourced call is un-vetoable regardless of version (COVERAGE.mcp).
+ * PRE_TOOL takes the coverage floor ({@link COVERAGE}).
  *
  * POST_TOOL does NOT, and that is deliberate: {@link COVERAGE} records which
  * calls reach `PreToolUse`, and a `PostToolUse` payload in hand is proof the
- * post-tool hook already fired for this call — Codex documents PostToolUse
- * firing for tools (apply_patch, MCP) that `PreToolUse` never sees. Judging it
- * by the pre-tool MCP row would degrade a block Codex honours to a notify,
- * which is a fail-CLOSED error but still a wrong one. It stays gated on
- * GATED_EVENTS and on the version floor, so nothing here can mark an unmodelled
- * or pre-0.135 event vetoable.
+ * post-tool hook already fired for this call. It stays gated on GATED_EVENTS
+ * and on the version floor, so nothing here can mark an unmodelled or pre-0.135
+ * event vetoable.
  * @param {string} kind an {@link EventKind} value
  * @param {string|null} nativeTool
  * @param {Record<string, unknown>} raw the native payload, for `mcp_context`

package/src/fixtures/codex.json

@@ -146,7 +146,7 @@
       }
     },
     {
-      "name": "PreToolUse MCP tool is non-vetoable (hook fires for Bash only)",
+      "name": "PreToolUse MCP tool is vetoable (the hook fires for MCP calls)",
       "call_class": "mcp",
       "native": {
         "hook_event_name": "PreToolUse",
@@ -162,7 +162,7 @@
         "input": {
           "title": "hi"
         },
-        "this_call_vetoable": false,
+        "this_call_vetoable": true,
         "meta": {
           "agent": "codex",
           "native_event": "PreToolUse",
@@ -195,15 +195,16 @@
           },
           "native": {
             "transport": "external_hook",
-            "exit_code": 0,
-            "enforced": false,
+            "exit_code": 2,
+            "enforced": true,
             "stdout": {
               "hookSpecificOutput": {
                 "hookEventName": "PreToolUse",
                 "permissionDecision": "deny",
                 "permissionDecisionReason": "mcp blocked"
               }
-            }
+            },
+            "stderr": "mcp blocked"
           }
         }
       }

package/types/adapters/codex.d.mts

@@ -72,25 +72,25 @@ export function createCodexAdapter({ version }?: {
 export const AGENT: "codex";
 export const INTEGRATION_MODE: "external_hook";
 /**
- * Hook-coverage matrix row (`docs/hook-coverage-matrix.md`). `PreToolUse`
- * intercepts the shell (Bash) tool ONLY — other builtins and MCP tools never
- * reach it — so builtin is PARTIAL and MCP is UNCOVERED. A live probe
- * ([X3]/[X4]) fired `PreToolUse` for a SUBAGENT's call and for a call in a
- * RESUMED session, so both are PARTIAL too: covered, under the same Bash-only
- * limit as [X1], rather than the ❓ the matrix carried before the probe ran.
+ * Hook-coverage matrix row (`docs/hook-coverage-matrix.md`). `PreToolUse` fires
+ * for the shell tools, `apply_patch`, every MCP tool call and every other
+ * function tool ([X1]/[X2], read from Codex's own source at the enforcement
+ * floor). It never fires for `write_stdin`, which types into a process an
+ * earlier call started, nor for a tool OpenAI runs on its own side, so builtin
+ * and MCP are both PARTIAL. A live probe ([X3]/[X4]) fired `PreToolUse` for a
+ * SUBAGENT's call and for a call in a RESUMED session, so both are PARTIAL too.
  *
  * These rows describe PRE-TOOL routing, which is the only thing the matrix's
  * [X1]/[X2] sources speak about. `parse` applies them to a pre-tool event only
- * (see {@link vetoableCall}); Codex's `PostToolUse` fires for tools `PreToolUse`
- * never sees, so a post-tool event judged by the MCP row would drop a block
- * Codex documents it honours.
+ * (see {@link vetoableCall}); a `PostToolUse` payload in hand is proof the
+ * post-tool hook fired for that call, whatever the pre-tool row says.
  *
  * The SUBAGENT row is the one the classifier now reaches on this host: the same
  * probe found `agent_id`/`agent_type` present on a subagent's `PreToolUse`
  * payload and ABSENT on the main thread's, so {@link classifyCallClass} answers
  * SUBAGENT from that payload alone. It is PARTIAL, so such a call stays vetoable
  * — the row's job here is to be honest, not to degrade. An MCP-named call takes
- * the UNCOVERED MCP row either way, subagent or not.
+ * the MCP row either way, subagent or not.
  *
  * The RESUMED row is DECLARATIVE ONLY, for a reason no longer about coverage: a
  * resumed session announces itself on `SessionStart` (`source: "resume"`), not on