approval-md 0.1.0 → 0.2.0

package/dist/src/cli/hook.js

@@ -86,6 +86,7 @@ import { abandonedAfterMs, HOOK_DEFAULT_WAIT, HOOK_RETRY_GRACE_MS, } from "../co
 import { harnessLoopFloor, isLoopEscalated, isSideEffectingClass, loopClearance, UNKNOWN_SESSION, } from "../core/loop.js";
 import { drawSocketPathFor, drawSocketUsable } from "../core/live-draw.js";
 import { payloadHash } from "../core/payload.js";
+import { classifyApplyPatch, parseApplyPatch } from "../core/apply-patch.js";
 import { loadPolicy, parseDuration } from "../core/policy-load.js";
 import { humanOnlyRefusal, resolve as resolvePolicy } from "../core/policy-match.js";
 import { payloadOf, readVerifiedRecords, requestState, useVerifiedSnapshots, } from "../core/state.js";
@@ -96,6 +97,7 @@ import { HOOK_HELP } from "./help.js";
 import { DEFAULT_LOG_PATH } from "./paths.js";
 import { refusal as renderRefusal, style, table } from "./style.js";
 import { usageErrorText } from "./usage.js";
+import { checkCodexHookInput, codexBinding, CODEX_POST_TOOL_EVENT, readCodexReportedOutcome, } from "./hook-codex.js";
 /** Identity accepted for the proposing side: a person or an agent. */
 const PRINCIPAL_ACTOR = /^(human|agent):.+/u;
 /**
@@ -290,6 +292,14 @@ const CURSOR_ADAPTER = {
     shellTool: "Shell",
     fileTools: ["Write", "Delete"],
 };
+const CODEX_ADAPTER = {
+    kind: "codex",
+    originApp: "codex-hook",
+    defaultActor: "agent:codex",
+    shellTool: "Bash",
+    fileTools: ["apply_patch"],
+    bindToolName: true,
+};
 /**
  * The decision object the harness reads from stdout.
  *
@@ -297,7 +307,7 @@ const CURSOR_ADAPTER = {
  * `{permission, user_message, agent_message}`. One construction site per
  * harness, still never `ask`.
  */
-function decision(permission, reason, harness) {
+function decision(permission, reason, harness, codexCommand) {
     if (harness === "cursor") {
         return `${JSON.stringify({
             permission,
@@ -305,16 +315,22 @@ function decision(permission, reason, harness) {
             agent_message: reason,
         })}\n`;
     }
-    return `${JSON.stringify({
-        hookSpecificOutput: {
-            hookEventName: "PreToolUse",
-            permissionDecision: permission,
-            permissionDecisionReason: reason,
-        },
-    })}\n`;
+    const hookSpecificOutput = {
+        hookEventName: "PreToolUse",
+        permissionDecision: permission,
+        permissionDecisionReason: reason,
+    };
+    if (harness === "codex" && permission === "allow") {
+        if (codexCommand !== undefined)
+            hookSpecificOutput["updatedInput"] = { command: codexCommand };
+    }
+    return `${JSON.stringify({ hookSpecificOutput })}\n`;
 }
-function allow(streams, reason, harness) {
-    streams.out(decision("allow", reason, harness));
+function allow(streams, reason, harness, codexCommand) {
+    if (harness === "codex" && codexCommand === undefined) {
+        return deny(streams, "hook-io", "the Codex allow lost its exact bound tool_input.command", harness);
+    }
+    streams.out(decision("allow", reason, harness, codexCommand));
     return EXIT_OK;
 }
 function deny(streams, code, detail, harness) {
@@ -359,13 +375,15 @@ function parseHookInput(raw) {
         ? toolInputValue
         : {};
     const responseValue = fields["tool_response"];
+    const sessionId = readString(fields, "session_id");
     return {
         ok: true,
         input: {
             // The ONE shared bucket for an unreadable session (`core/loop.ts`'s
             // `UNKNOWN_SESSION`): absence accrues faster than a readable id and never
             // slower, which is the fail-closed direction.
-            sessionId: readString(fields, "session_id") ?? UNKNOWN_SESSION,
+            sessionId: sessionId ?? UNKNOWN_SESSION,
+            sessionIdPresent: sessionId !== null,
             cwd: readString(fields, "cwd") ?? "",
             toolName,
             toolInput,
@@ -376,6 +394,7 @@ function parseHookInput(raw) {
             toolResponse: typeof responseValue === "object" && responseValue !== null && !Array.isArray(responseValue)
                 ? responseValue
                 : null,
+            toolResponseRaw: responseValue,
         },
     };
 }
@@ -1037,13 +1056,12 @@ const WORKSPACE_WRITE_CLASS = "files.write.workspace";
 /**
  * What a non-Bash tool call asks for, or `null` when it names no file at all.
  *
- * Only one thing about a file edit is a gate question at v0.1: whether the file
- * is one only a human may write. Everything else the harness edits is
- * `files.write.workspace`, which this repository's policy makes autonomous, and
- * routing every keystroke of ordinary editing through a gate check would spend
- * latency to reach a foregone conclusion.
+ * Every file edit is a gate question. Protected targets take their derived
+ * protected class; every other target is `files.write.workspace`. The policy
+ * decides the autonomy of either class, so changing the ordinary-file rule to
+ * manual, supervised or human-only changes the hook verdict too (APRV-304).
  *
- * ## The ordinary edit still gets a class (APRV-303)
+ * ## The ordinary edit gets a class and follows it (APRV-303, APRV-304)
  *
  * It used to get none: an unprotected target returned `null` here, and
  * `describeToolCall` answered `allow` from a branch that sits ABOVE the loop
@@ -1053,12 +1071,10 @@ const WORKSPACE_WRITE_CLASS = "files.write.workspace";
  * eight edits to the same file, under a standing floor, none of them routed and
  * none of them counted.
  *
- * The foregone conclusion is still foregone, and is still answered without
- * asking anybody: `describeToolCall` marks the call {@link FileGate.protectedPath}
- * `false`, and `runHarnessHook` allows it outright the moment it establishes
- * that no floor is standing. What it can no longer do is skip that
- * establishment. The floor predicate is now one predicate over one class for
- * every tool kind, which is what amended SPEC.md §10.2 asks for.
+ * APRV-303 made the floor predicate one predicate over one class for every tool
+ * kind. APRV-304 carries the same class through the rest of the shared path:
+ * policy resolution, human-only refusal, budgets, registration and execution
+ * accounting. An open window records the bypass before allowing the edit.
  *
  * ## The payload is the change (APRV-124)
  *
@@ -1639,7 +1655,7 @@ floor = null) {
     const floorApplies = (cls) => floor !== null && isSideEffectingClass(cls);
     const hash = payloadHash(payload);
     const summary = truncate(headline, SUMMARY_LIMIT);
-    const sayAllow = (reason) => allow(streams, reason, run.harness);
+    const sayAllow = (reason) => allow(streams, reason, run.harness, run.codexCommand);
     /**
      * Every deny this function can print, with the floor's own sentence appended
      * when a floor is what routed the command here (APRV-280). One wrapper rather
@@ -2077,7 +2093,9 @@ function report(streams, code, detail, extra = {}) {
  * whether two enumerated fields are present and what kind of value they hold.
  * No text from any of them reaches the log or this function's return.
  */
-function readReportedOutcome(input) {
+function readReportedOutcome(input, adapter) {
+    if (adapter.kind === "codex")
+        return readCodexReportedOutcome(input);
     const event = input.hookEventName;
     if (event !== "PostToolUse" && event !== "PostToolUseFailure") {
         return {
@@ -2124,7 +2142,7 @@ function runPostToolUse(flags, streams, cwd, input, actor, adapter) {
         // `approval status` rather than closed against a guess.
         return report(streams, "post-tool-unidentified", "the event carries no tool_use_id, so the task id the pre-execution hook minted cannot be reconstructed; nothing was appended");
     }
-    const reading = readReportedOutcome(input);
+    const reading = readReportedOutcome(input, adapter);
     if (!reading.ok) {
         return report(streams, "post-tool-unreadable-outcome", `${reading.detail}; nothing was appended`);
     }
@@ -2133,8 +2151,8 @@ function runPostToolUse(flags, streams, cwd, input, actor, adapter) {
         return report(streams, "post-tool-log-unreachable", `no log at ${logPath}; the hook writes to an existing log and never creates one. Run \`approval init\` in ${root}`);
     }
     const finished = finishHarnessExecution(logPath, {
-        sessionId: input.sessionId,
-        toolUseId: input.toolUseId,
+        sessionId: adapter.kind === "codex" ? codexBinding(input, cwd).finishSessionId : input.sessionId,
+        toolUseId: adapter.kind === "codex" ? codexBinding(input, cwd).finishToolUseId : input.toolUseId,
         outcome: reading.outcome,
         // The one member of the closed set at v0.1. It names the untrusted
         // reporter and reduces nothing.
@@ -2146,6 +2164,25 @@ function runPostToolUse(flags, streams, cwd, input, actor, adapter) {
     return report(streams, POST_TOOL_REPORTED, `recorded ${reading.outcome} for ${String(finished.records.length)} delegated execution(s) of ${finished.task}`, { task: finished.task, outcome: reading.outcome, appended: finished.records.length });
 }
 function describeToolCall(input, adapter, protectedPaths, cwd) {
+    if (adapter.kind === "codex" && input.toolName === "apply_patch") {
+        const raw = readString(input.toolInput, "command");
+        if (raw === null) {
+            return { kind: "deny", code: "hook-io", detail: "apply_patch tool_input carries no command string" };
+        }
+        const parsed = parseApplyPatch(raw);
+        if (!parsed.ok)
+            return { kind: "deny", code: "hook-io", detail: parsed.detail };
+        const classified = classifyApplyPatch(parsed, cwd, protectedPaths);
+        if (!classified.ok)
+            return { kind: "deny", code: "hook-io", detail: classified.detail };
+        return {
+            kind: "gated",
+            classes: classified.classes,
+            payload: codexBinding(input, cwd).payload,
+            headline: `apply_patch ${classified.operations.length} operation(s)`,
+            notes: classified.targets.map((target) => `${target.role} ${target.path} (${target.classes.join(", ")})`),
+        };
+    }
     if (input.toolName === adapter.shellTool) {
         const raw = readString(input.toolInput, "command");
         if (raw === null) {
@@ -2158,7 +2195,9 @@ function describeToolCall(input, adapter, protectedPaths, cwd) {
         // Unchanged since APRV-117, deliberately: the payload is the WHOLE command
         // and the directory it runs in, so the FULL PAYLOAD block on the phone
         // carries every byte the harness will execute. Only `summary` is shortened.
-        const payload = { command: raw, cwd: input.cwd };
+        const payload = adapter.bindToolName
+            ? codexBinding(input, cwd).payload
+            : { command: raw, cwd: input.cwd };
         // APRV-108: a local rewrite of history this checkout never published is a
         // commit. APRV-267: a delete confined to the agent's own scratch is not a
         // decision. Both run in the hook's own cwd, after classification and never
@@ -2172,9 +2211,82 @@ function describeToolCall(input, adapter, protectedPaths, cwd) {
                 detail: `${classified.detail} (segment: ${classified.segment}). Rewrite it as a command the classifier can read, or run the effect through \`approval run\` with a granted token.`,
             };
         }
+        const classes = classified.classes.filter((cls) => cls !== GATE_SELF_CLASS);
+        if (adapter.kind === "codex") {
+            // The pure shell classifier sees each segment independently. Preserve
+            // Codex hook organs when an earlier simple `cd` changes the directory or
+            // when the hook itself runs inside an organ directory by resolving every
+            // later side-effecting segment's words from the effective directory.
+            const possibleCwds = new Set([cwd]);
+            for (const segment of classified.segments) {
+                const parsedWords = commandSegmentWords(segment.text)?.[0];
+                if (parsedWords?.bin === "cd" && parsedWords.args.length !== 1) {
+                    return {
+                        kind: "deny",
+                        code: "hook-io",
+                        detail: "Codex Bash cwd changes must use exact `cd <directory>` with no additional words",
+                    };
+                }
+                if (parsedWords?.bin === "cd" &&
+                    (parsedWords.args[0] === "-" ||
+                        (!isAbsolute(parsedWords.args[0] ?? "") &&
+                            parsedWords.args[0] !== "." &&
+                            parsedWords.args[0] !== ".." &&
+                            !(parsedWords.args[0] ?? "").startsWith("./") &&
+                            !(parsedWords.args[0] ?? "").startsWith("../")))) {
+                    return {
+                        kind: "deny",
+                        code: "hook-io",
+                        detail: "Codex Bash cwd changes must name an absolute path, `.`, `..`, `./...`, or `../...`; OLDPWD and CDPATH-dependent operands are unsupported",
+                    };
+                }
+                if (isSideEffectingClass(segment.class)) {
+                    for (const possibleCwd of possibleCwds) {
+                        const cwdSegments = possibleCwd.split(/[/\\]+/u);
+                        const cwdClass = cwdSegments.includes(".codex")
+                            ? "policy.core"
+                            : protectedPathClass(possibleCwd, protectedPaths);
+                        if (cwdClass !== null && !classes.includes(cwdClass))
+                            classes.push(cwdClass);
+                        for (const word of parsedWords === undefined ? [] : [parsedWords.bin, ...parsedWords.args]) {
+                            const cls = protectedPathClass(resolvePathSegments(possibleCwd, word), protectedPaths);
+                            if (cls !== null && !classes.includes(cls))
+                                classes.push(cls);
+                        }
+                    }
+                }
+                if (parsedWords?.bin === "cd" && parsedWords.args.length === 1) {
+                    // Lists and conditionals may skip a cd. Retain every prior directory
+                    // and add each directory the cd could establish; later writes are
+                    // checked against their union.
+                    const priorCwds = Array.from(possibleCwds);
+                    for (const possibleCwd of priorCwds) {
+                        const lexical = resolvePathSegments(possibleCwd, parsedWords.args[0] ?? "");
+                        possibleCwds.add(lexical);
+                        try {
+                            possibleCwds.add(realpathSync(lexical));
+                        }
+                        catch {
+                            return {
+                                kind: "deny",
+                                code: "hook-io",
+                                detail: `Codex Bash cd target ${JSON.stringify(parsedWords.args[0])} could not be resolved`,
+                            };
+                        }
+                        if (possibleCwds.size > 64) {
+                            return {
+                                kind: "deny",
+                                code: "hook-io",
+                                detail: "Codex Bash command has more than 64 possible working directories",
+                            };
+                        }
+                    }
+                }
+            }
+        }
         return {
             kind: "gated",
-            classes: classified.classes.filter((cls) => cls !== GATE_SELF_CLASS),
+            classes,
             payload,
             headline: raw,
             notes: refined.notes,
@@ -2185,16 +2297,6 @@ function describeToolCall(input, adapter, protectedPaths, cwd) {
     if (gated === null) {
         return { kind: "allow", reason: `${input.toolName} names no file, so there is nothing to gate` };
     }
-    if (!gated.protectedPath) {
-        return {
-            kind: "gated",
-            classes: [gated.cls],
-            payload: gated.payload,
-            headline: gated.summary,
-            notes: [],
-            passthrough: `${input.toolName} is not a gated edit`,
-        };
-    }
     return {
         kind: "gated",
         classes: [gated.cls],
@@ -2202,7 +2304,7 @@ function describeToolCall(input, adapter, protectedPaths, cwd) {
         headline: gated.summary,
         // The tier rides in the verdict's note as well as in the payload, so an
         // `allow` says which checkout it authorized (APRV-124).
-        notes: [fileTierNote(gated)],
+        notes: gated.protectedPath ? [fileTierNote(gated)] : [],
     };
 }
 /** The environment variable that turns the sandbox requirement on (APRV-193). */
@@ -2328,6 +2430,7 @@ function runBypass(streams, input, adapter, cwd, logPath, flags, actor, window,
  * shape.
  */
 decidedOn) {
+    const codexCommand = adapter.kind === "codex" ? codexBinding(input, cwd).payload.command : undefined;
     const scope = hookScope(flags, cwd);
     const load = loadPolicy(scope.options.policy?.file === undefined
         ? { dir: scope.options.policy?.dir ?? cwd }
@@ -2340,16 +2443,8 @@ decidedOn) {
     if (described.kind === "deny") {
         return deny(streams, described.code, `${described.detail} The open window does not reach this: a command the classifier cannot read is a command nothing here can establish is safe to run unapproved.`, adapter.kind);
     }
-    if (described.kind === "allow")
-        return allow(streams, described.reason, adapter.kind);
-    if (described.passthrough !== undefined) {
-        // APRV-303. An ordinary workspace edit is allowed by the policy on its own
-        // merits, so there is nothing here for the window to suspend and nothing
-        // for a `gate.bypassed` record to say. The only thing that would have made
-        // this call a question is a §10.2 floor, and a window bypasses the floor
-        // outright. Answered here rather than below so the bypass log stays a
-        // record of calls the window actually let through.
-        return allow(streams, described.passthrough, adapter.kind);
+    if (described.kind === "allow") {
+        return allow(streams, described.reason, adapter.kind, codexCommand);
     }
     const classes = described.classes;
     if (classes.length === 0) {
@@ -2357,7 +2452,7 @@ decidedOn) {
         // record for the reason it is allowed outside a window: gating the gate
         // with the gate recurses, and a window that recorded its own closing verb
         // would be recording the act that ends it.
-        return allow(streams, "the approval CLI is the gate itself and is not gated by it", adapter.kind);
+        return allow(streams, "the approval CLI is the gate itself and is not gated by it", adapter.kind, codexCommand);
     }
     const mutation = classes.find((cls) => cls === "log.mutate");
     if (mutation !== undefined) {
@@ -2400,9 +2495,10 @@ decidedOn) {
     }
     streams.err(bypassBanner(window, classes, recorded.record.seq));
     const notes = [...described.notes, ...(policyNote === null ? [] : [policyNote])];
-    return allow(streams, `gate-open: ${classes.join(", ")} bypassed by the window opened at seq ${String(window.seq)} by ${window.openedBy} (expires ${window.expiresAt}); recorded as gate.bypassed seq ${String(recorded.record.seq)}${notes.length === 0 ? "" : ` (${notes.join("; ")})`}`, adapter.kind);
+    return allow(streams, `gate-open: ${classes.join(", ")} bypassed by the window opened at seq ${String(window.seq)} by ${window.openedBy} (expires ${window.expiresAt}); recorded as gate.bypassed seq ${String(recorded.record.seq)}${notes.length === 0 ? "" : ` (${notes.join("; ")})`}`, adapter.kind, codexCommand);
 }
 function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
+    const configurationError = (message) => adapter.kind === "codex" ? deny(streams, "hook-io", message, adapter.kind) : usageError(streams, message);
     const parsed = parseFlags(argv, {
         ...COMMON_FLAGS,
         ...POLICY_FLAGS,
@@ -2413,29 +2509,29 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
         "--retry-grace": "string",
     });
     if (!parsed.ok)
-        return usageError(streams, parsed.message);
+        return configurationError(parsed.message);
     if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
         streams.out(`${HOOK_HELP}\n`);
         return EXIT_OK;
     }
     const extra = parsed.positionals[0];
     if (extra !== undefined) {
-        return usageError(streams, `unexpected argument ${JSON.stringify(extra)}`);
+        return configurationError(`unexpected argument ${JSON.stringify(extra)}`);
     }
     const asFlag = stringFlag(parsed.flags, "--as");
     const actor = asFlag ?? adapter.defaultActor;
     if (!PRINCIPAL_ACTOR.test(actor)) {
-        return usageError(streams, `--as expects agent:<id> or human:<id>, got ${JSON.stringify(asFlag)}`);
+        return configurationError(`--as expects agent:<id> or human:<id>, got ${JSON.stringify(asFlag)}`);
     }
     const timeoutText = stringFlag(parsed.flags, "--timeout") ?? DEFAULT_TIMEOUT;
     const timeoutMs = parseDuration(timeoutText);
     if (timeoutMs === null) {
-        return usageError(streams, `--timeout expects a duration like 30s, 9m, got ${JSON.stringify(timeoutText)}`);
+        return configurationError(`--timeout expects a duration like 30s, 9m, got ${JSON.stringify(timeoutText)}`);
     }
     const intervalText = stringFlag(parsed.flags, "--interval");
     const intervalMs = intervalText === null ? DEFAULT_INTERVAL_MS : parseDuration(intervalText);
     if (intervalMs === null) {
-        return usageError(streams, `--interval expects a duration like 500ms, 2s, got ${JSON.stringify(intervalText)}`);
+        return configurationError(`--interval expects a duration like 500ms, 2s, got ${JSON.stringify(intervalText)}`);
     }
     // APRV-287. How long the question outlives the wait, for the retry that
     // adopts it. The duration grammar has no zero, so the shortest window is
@@ -2443,12 +2539,18 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
     const graceText = stringFlag(parsed.flags, "--retry-grace");
     const graceMs = graceText === null ? HOOK_RETRY_GRACE_MS : parseDuration(graceText);
     if (graceMs === null) {
-        return usageError(streams, `--retry-grace expects a duration like 5m, 30s, 1ms, got ${JSON.stringify(graceText)}`);
+        return configurationError(`--retry-grace expects a duration like 5m, 30s, 1ms, got ${JSON.stringify(graceText)}`);
     }
     const parsedInput = parseHookInput(readStdin());
     if (!parsedInput.ok)
         return deny(streams, "hook-io", parsedInput.detail, adapter.kind);
     const input = parsedInput.input;
+    if (adapter.kind === "codex") {
+        const checked = checkCodexHookInput(input, cwd);
+        if (!checked.ok)
+            return deny(streams, "hook-io", checked.detail, adapter.kind);
+    }
+    const codexCommand = adapter.kind === "codex" ? codexBinding(input, cwd).payload.command : undefined;
     // APRV-145: WHICH EVENT THIS IS, read first and read at all. One command is
     // registered for two events, and they do opposite things — one answers before
     // the tool runs, the other records how it went — so the dispatch is the first
@@ -2459,7 +2561,10 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
     // harness whose event this runtime does not recognize is a harness about to
     // run a command, and treating an unknown name as a no-op would be an ungated
     // one.
-    if (input.hookEventName !== null && POST_TOOL_EVENTS.includes(input.hookEventName)) {
+    const postToolEvent = adapter.kind === "codex"
+        ? input.hookEventName === CODEX_POST_TOOL_EVENT
+        : input.hookEventName !== null && POST_TOOL_EVENTS.includes(input.hookEventName);
+    if (postToolEvent) {
         // APRV-303. `commandHarnessHook`'s catch turns a throw into a DENY, which is
         // the right answer for a call that has not run yet and exactly the wrong one
         // here: it would print a verdict object about a tool call the harness has
@@ -2473,8 +2578,17 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
             return report(streams, "post-tool-io", `the counterpart failed: ${cause instanceof Error ? cause.message : String(cause)}; nothing was appended, so the start this event would have closed is still open`);
         }
     }
+    // Codex 0.152.1 can execute Bash in a per-call working directory that is
+    // absent from tool_input while both the event cwd and this hook process stay
+    // at the session root (APRV-310 native v6). A decision over the visible
+    // `{command, cwd}` would therefore bind different bytes from the action the
+    // harness executes. Refuse before the open-window, gate-self, carry, or
+    // registration paths; none of those can supply the missing directory fact.
+    if (adapter.kind === "codex" && input.toolName === "Bash") {
+        return deny(streams, "hook-io", "Codex Bash is disabled because the native hook contract does not expose the effective per-call working directory; no policy or open window can authorize bytes the hook cannot bind", adapter.kind);
+    }
     if (input.toolName !== adapter.shellTool && !adapter.fileTools.includes(input.toolName)) {
-        return allow(streams, `${input.toolName} is not a gated tool`, adapter.kind);
+        return allow(streams, `${input.toolName} is not a gated tool`, adapter.kind, codexCommand);
     }
     // APRV-188. From here on this process may resume a verified read behind the
     // snapshot the daemon published, instead of walking the chain from genesis:
@@ -2534,13 +2648,14 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
     if (described.kind === "deny") {
         return deny(streams, described.code, described.detail, adapter.kind);
     }
-    if (described.kind === "allow")
-        return allow(streams, described.reason, adapter.kind);
+    if (described.kind === "allow") {
+        return allow(streams, described.reason, adapter.kind, codexCommand);
+    }
     const { classes, payload, headline } = described;
     /** What the history-rewrite refinement did, for the decision reason. */
     const notes = [...described.notes];
     if (classes.length === 0) {
-        return allow(streams, "the approval CLI is the gate itself and is not gated by it", adapter.kind);
+        return allow(streams, "the approval CLI is the gate itself and is not gated by it", adapter.kind, codexCommand);
     }
     // Every path from here needs the log, the fast paths included (APRV-139):
     // attestation and loop-escalation are facts about the log, so the
@@ -2553,7 +2668,9 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
     }
     // Minted once, here, and carried into `gateAndWait`: the loop-escalation
     // check below and any registration that follows must name the same task.
-    const task = `hook:${input.sessionId}:${input.toolUseId ?? randomBytes(8).toString("hex")}`;
+    const task = adapter.kind === "codex"
+        ? codexBinding(input, cwd).task
+        : `hook:${input.sessionId}:${input.toolUseId ?? randomBytes(8).toString("hex")}`;
     const run = {
         logPath,
         options,
@@ -2564,6 +2681,7 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
         ttlMs: load.durations.approvalTtlMs,
         harness: adapter.kind,
         originApp: adapter.originApp,
+        ...(codexCommand === undefined ? {} : { codexCommand }),
         eventVersion: input.harnessVersion,
         // Off the policy this function already loaded and validated, so the names
         // printed are the names a channel process would serve (APRV-281). Sorted
@@ -2659,20 +2777,6 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
      * refinement's own words, and the loop floor's when one applied.
      */
     const note = notes.length === 0 ? "" : ` (${notes.join("; ")})`;
-    // APRV-303, and the last thing that can answer without touching the log: an
-    // ordinary workspace edit, which the policy allows on its own merits and which
-    // is a question only while a floor stands.
-    //
-    // The order is the whole fix. Until APRV-303 this allow was printed from
-    // `describeToolCall`'s own branch, several hundred lines above the floor
-    // lookup, so a session whose Bash calls were all being routed to a human went
-    // on editing files unrouted and uncounted. Now the same allow is printed, in
-    // the same words, from BELOW the floor: the fast path is as fast as it was,
-    // and the floored path routes an Edit exactly as it routes an `echo >`,
-    // because both are `files.write.workspace` and one predicate decides.
-    if (described.passthrough !== undefined && floor === null) {
-        return allow(streams, `${described.passthrough}${note}`, adapter.kind);
-    }
     /** No class here needs a human, so nothing downstream will ask for one. */
     const unattended = floor === null && autonomies.every((autonomy) => autonomy !== "manual");
     if (unattended) {
@@ -2690,7 +2794,7 @@ function runHarnessHook(argv, streams, cwd, readStdin, adapter) {
         if (charged !== null) {
             return deny(streams, `hook-gate-refused:${charged.code}`, charged.message, adapter.kind);
         }
-        return allow(streams, `autonomous: ${classes.join(", ")}${note}`, adapter.kind);
+        return allow(streams, `autonomous: ${classes.join(", ")}${note}`, adapter.kind, codexCommand);
     }
     // Past here the hook appends. It writes to a log that already exists and
     // creates none: a log the hook scaffolded where it happened to be standing
@@ -2734,6 +2838,8 @@ export function commandHook(argv, streams, cwd, readStdin = defaultStdin) {
             return commandHarnessHook(rest, streams, cwd, readStdin, CLAUDE_ADAPTER);
         case "cursor":
             return commandHarnessHook(rest, streams, cwd, readStdin, CURSOR_ADAPTER);
+        case "codex":
+            return commandHarnessHook(rest, streams, cwd, readStdin, CODEX_ADAPTER);
         case "classify":
             return commandClassify(rest, streams, cwd);
         default: