cabloy 5.1.192 → 5.1.193

package/.cabloy-version

@@ -1 +1 @@
-5.1.192
+5.1.193

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 5.1.193
+
+### Features
+
+- Add support for Cursor and Codex agents.
+- Update agent capabilities and integrations.
+
 ## 5.1.192
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.192",
+  "version": "5.1.193",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-agent-governance/adapters/claude/contract-loop-gate.ts

@@ -1,198 +1,26 @@
 #!/usr/bin/env node
-import type { SpawnSyncReturns } from 'node:child_process';
-
-import { spawnSync } from 'node:child_process';
-import { readFileSync, statSync, writeFileSync, existsSync } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
+import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import {
-  analyze,
-  buildMessages,
-  isCodeFile,
-  isHighConfidenceReverseSource,
-  normalizePath,
-  resolveEdition,
-  toPosixPath,
-} from '../../repo-agent-governance/tools/contract-loop/core.mjs';
-
-interface EditionConfig {
-  id: 'basic' | 'start';
-  label: string;
-  reverseAutoSyncCommands: ReadonlyArray<{ args: readonly string[]; display: string }>;
-}
-
-interface HookPayload {
-  tool_input?: {
-    file_path?: string;
-  };
-}
-
-interface SyncStateEntry {
-  fingerprint: string;
-  timestamp: number;
-}
-
-type ReverseSyncOutcome =
-  | { kind: 'not-applicable'; message: string }
-  | { kind: 'skipped'; message: string }
-  | { kind: 'success'; message: string }
-  | { kind: 'failure'; message: string };
+  evaluateEditedFile,
+  extractClaudeEditedFilePath,
+  formatClaudeHookOutput,
+  readHookPayload,
+} from '../../repo-agent-governance/tools/contract-loop/hook-runtime.mjs';
 
-type SyncState = Record<string, SyncStateEntry>;
-
-const SCRIPT_FILE = fileURLToPath(import.meta.url);
-const ROOT = path.resolve(path.dirname(SCRIPT_FILE), '../..');
-const ROOT_KEY = toPosixPath(ROOT);
-const STATE_FILE = path.join(os.tmpdir(), 'cabloy-contract-loop-gate-state.json');
-const AUTO_SYNC_WINDOW_SECONDS = 300;
-
-function readText(filePath: string): string | null {
-  try {
-    return readFileSync(filePath, 'utf8');
-  } catch {
-    return null;
-  }
-}
-
-function loadState(): SyncState {
-  if (!existsSync(STATE_FILE)) return {};
-  try {
-    return JSON.parse(readFileSync(STATE_FILE, 'utf8')) as SyncState;
-  } catch {
-    return {};
-  }
-}
-
-function saveState(state: SyncState): void {
-  try {
-    writeFileSync(STATE_FILE, JSON.stringify(state), 'utf8');
-  } catch {
-    // State prevents duplicate convenience syncs only; it must not block guidance.
-  }
-}
-
-function syncFingerprint(filePath: string): string {
-  try {
-    const stats = statSync(filePath, { bigint: true });
-    return `${filePath}:${stats.mtimeNs.toString()}`;
-  } catch {
-    return filePath;
-  }
-}
-
-function shouldSkipAutoSync(filePath: string): boolean {
-  const state = loadState();
-  const entry = state[ROOT_KEY];
-  return Boolean(
-    entry &&
-    entry.fingerprint === syncFingerprint(filePath) &&
-    Date.now() - entry.timestamp <= AUTO_SYNC_WINDOW_SECONDS * 1000,
-  );
-}
-
-function markAutoSync(filePath: string): void {
-  const state = loadState();
-  state[ROOT_KEY] = { fingerprint: syncFingerprint(filePath), timestamp: Date.now() };
-  saveState(state);
-}
-
-function runNpm(args: readonly string[]): SpawnSyncReturns<string> {
-  const command = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  return spawnSync(command, [...args], { cwd: ROOT, encoding: 'utf8' });
-}
-
-function summarizeProcess(result: SpawnSyncReturns<string>): string {
-  if (result.error) return result.error.message;
-  const combined = [result.stdout?.trim(), result.stderr?.trim()].filter(Boolean).join('\n');
-  const exitCode = result.status ?? 1;
-  if (!combined) return `command exited with code ${exitCode}`;
-  return `exit ${exitCode}: ${combined
-    .split(/\r?\n/)
-    .map(line => line.trim())
-    .filter(Boolean)
-    .slice(-3)
-    .join(' | ')}`;
-}
-
-function autoSyncReverse(filePath: string, edition: EditionConfig): ReverseSyncOutcome {
-  for (const command of edition.reverseAutoSyncCommands) {
-    const result = runNpm(command.args);
-    if (result.status !== 0) {
-      return {
-        kind: 'failure',
-        message: `Auto-sync failed during \`${command.display}\`: ${summarizeProcess(result)}`,
-      };
-    }
-  }
-  markAutoSync(filePath);
-  return {
-    kind: 'success',
-    message: `Auto-sync ran ${edition.reverseAutoSyncCommands
-      .map(command => `\`${command.display}\``)
-      .join(' and ')} for this ${edition.label} reverse-chain edit.`,
-  };
-}
-
-function resolveReverseSyncOutcome(
-  filePath: string,
-  reverseReason: string | null,
-): ReverseSyncOutcome {
-  if (!reverseReason) return { kind: 'not-applicable', message: '' };
-  if (!isHighConfidenceReverseSource(filePath)) {
-    return {
-      kind: 'not-applicable',
-      message:
-        'Auto-sync did not run because this reverse-chain signal came from the consumer side rather than a high-confidence frontend source edit.',
-    };
-  }
-  const resolution = resolveEdition(ROOT);
-  if (resolution.kind !== 'resolved') {
-    return {
-      kind: 'not-applicable',
-      message: `Auto-sync did not run because ${resolution.kind === 'ambiguous' ? 'both Cabloy edition markers are present' : 'no Cabloy edition marker is present'}.`,
-    };
-  }
-  if (shouldSkipAutoSync(filePath)) {
-    return {
-      kind: 'skipped',
-      message:
-        'Auto-sync skipped because the same reverse-source edit was already synced recently in this repo.',
-    };
-  }
-  return autoSyncReverse(filePath, resolution.edition);
-}
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
 
 function runClaudeHook(): number {
-  let payload: HookPayload;
-  try {
-    payload = JSON.parse(readFileSync(0, 'utf8')) as HookPayload;
-  } catch {
-    return 0;
-  }
-  const filePath = normalizePath(ROOT, payload.tool_input?.file_path);
-  if (!filePath || !isCodeFile(filePath)) return 0;
-  const content = readText(filePath);
-  if (content === null) return 0;
-
-  const resolution = resolveEdition(ROOT);
-  const result = analyze(
-    filePath,
-    content,
-    resolution.kind === 'resolved' ? resolution.edition : null,
-  );
-  if (!result.forwardReason && !result.reverseReason) return 0;
-
-  const reverseSyncOutcome = resolveReverseSyncOutcome(filePath, result.reverseReason);
-  const message = buildMessages(result, resolution, reverseSyncOutcome);
+  // Cursor can import this Claude-compatible bridge alongside its native hook. Its native
+  // Cursor adapter owns that event, so avoid duplicate context and reverse auto-sync work.
+  if (process.env.CURSOR_PROJECT_DIR) return 0;
+  const payload = readHookPayload();
+  if (!payload) return 0;
+  const evaluated = evaluateEditedFile(ROOT, extractClaudeEditedFilePath(payload));
+  if (!evaluated) return 0;
   // eslint-disable-next-line
-  console.log(
-    JSON.stringify({
-      hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: message },
-      systemMessage: message,
-    }),
-  );
+  console.log(JSON.stringify(formatClaudeHookOutput(evaluated.message)));
   return 0;
 }
 

package/repo-agent-governance/adapters/codex/contract-loop-gate.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  evaluateCodexEditedFiles,
+  extractCodexEditedFiles,
+  formatCodexHookOutput,
+  readHookPayload,
+} from '../../repo-agent-governance/tools/contract-loop/hook-runtime.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+
+function runCodexHook() {
+  const payload = readHookPayload();
+  if (!payload) return 0;
+  const evaluated = evaluateCodexEditedFiles(ROOT, extractCodexEditedFiles(payload), payload.cwd);
+  if (!evaluated.length) return 0;
+  const message = evaluated.map(item => item.message).join('\n\n');
+  // eslint-disable-next-line
+  console.log(JSON.stringify(formatCodexHookOutput(message)));
+  return 0;
+}
+
+process.exit(runCodexHook());

package/repo-agent-governance/adapters/codex/hooks.json

@@ -0,0 +1,19 @@
+{
+  "description": "Cabloy repository lifecycle hooks generated from repo-agent-governance.",
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "apply_patch|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const fs=require('node:fs'),path=require('node:path'),{pathToFileURL}=require('node:url');let d=process.cwd();for(;;){const h=path.join(d,'.codex','hooks','contract-loop-gate.mjs');if(fs.existsSync(h)){import(pathToFileURL(h).href);break}const p=path.dirname(d);if(p===d)break;d=p}\"",
+            "commandWindows": "node -e \"const fs=require('node:fs'),path=require('node:path'),{pathToFileURL}=require('node:url');let d=process.cwd();for(;;){const h=path.join(d,'.codex','hooks','contract-loop-gate.mjs');if(fs.existsSync(h)){import(pathToFileURL(h).href);break}const p=path.dirname(d);if(p===d)break;d=p}\"",
+            "timeout": 600,
+            "statusMessage": "Checking contract-loop gate"
+          }
+        ]
+      }
+    ]
+  }
+}

package/repo-agent-governance/adapters/cursor/contract-loop-gate.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  evaluateEditedFile,
+  extractCursorEditedFilePath,
+  formatCursorHookOutput,
+  inferCursorHookEvent,
+  readHookPayload,
+} from '../../repo-agent-governance/tools/contract-loop/hook-runtime.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+
+function runCursorHook() {
+  const payload = readHookPayload();
+  if (!payload) return 0;
+  const evaluated = evaluateEditedFile(ROOT, extractCursorEditedFilePath(payload));
+  if (!evaluated) return 0;
+  const output = formatCursorHookOutput(evaluated.message, inferCursorHookEvent(payload));
+  if (output) {
+    // eslint-disable-next-line
+    console.log(JSON.stringify(output));
+  }
+  return 0;
+}
+
+process.exit(runCursorHook());

package/repo-agent-governance/adapters/cursor/hooks.json

@@ -0,0 +1,19 @@
+{
+  "version": 1,
+  "hooks": {
+    "postToolUse": [
+      {
+        "command": "node .cursor/hooks/contract-loop-gate.mjs",
+        "matcher": "Write",
+        "timeout": 600
+      }
+    ],
+    "afterTabFileEdit": [
+      {
+        "command": "node .cursor/hooks/contract-loop-gate.mjs",
+        "matcher": "TabWrite",
+        "timeout": 600
+      }
+    ]
+  }
+}

package/repo-agent-governance/managed-assets.json

@@ -53,14 +53,14 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "c8dcc0ce6b27b9bac4197e600f1444162dba1a520d05791b38f9197917034c93",
+      "sha256": "004d81369d47f539092bf054cf5604f3185805391110553f349dd53247bed386",
       "source": "skills/cabloy-contract-loop/references/verification-checklist.md",
       "target": ".agents/skills/cabloy-contract-loop/references/verification-checklist.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "02daa2135016d46f021c7df7d47d64af8cf64371d9f30e59390a9e63aca165fc",
+      "sha256": "897a2bda7df448cc2f8468c9e23a090f0bd16bcd49fbb30427c95b11340b64c8",
       "source": "skills/cabloy-contract-loop/SKILL.md",
       "target": ".agents/skills/cabloy-contract-loop/SKILL.md"
     },
@@ -291,7 +291,7 @@
     {
       "adapter": "claude",
       "category": "runtime",
-      "sha256": "13c431fcea31168c7bce53a742d3d21484f1b1346744a15f8a20cb4ceb0e9cce",
+      "sha256": "47be90e9311379a981b3a5e01a6ed33bf51c9653a3b4ebf95426253db44ffcb4",
       "source": "adapters/claude/contract-loop-gate.ts",
       "target": ".claude/hooks/contract-loop-gate.ts"
     },
@@ -354,14 +354,14 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "c8dcc0ce6b27b9bac4197e600f1444162dba1a520d05791b38f9197917034c93",
+      "sha256": "004d81369d47f539092bf054cf5604f3185805391110553f349dd53247bed386",
       "source": "skills/cabloy-contract-loop/references/verification-checklist.md",
       "target": ".claude/skills/cabloy-contract-loop/references/verification-checklist.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "02daa2135016d46f021c7df7d47d64af8cf64371d9f30e59390a9e63aca165fc",
+      "sha256": "897a2bda7df448cc2f8468c9e23a090f0bd16bcd49fbb30427c95b11340b64c8",
       "source": "skills/cabloy-contract-loop/SKILL.md",
       "target": ".claude/skills/cabloy-contract-loop/SKILL.md"
     },
@@ -582,10 +582,38 @@
       "source": "skills/cabloy-zova-source-reading/SKILL.md",
       "target": ".claude/skills/cabloy-zova-source-reading/SKILL.md"
     },
+    {
+      "adapter": "codex",
+      "category": "runtime",
+      "sha256": "0d5fcf1261dab374778df9a970e99dda7afedbfe3b9819feb38562ec8c7c65d5",
+      "source": "adapters/codex/hooks.json",
+      "target": ".codex/hooks.json"
+    },
+    {
+      "adapter": "codex",
+      "category": "runtime",
+      "sha256": "3f3fcc1824f18bcdc2040d65932a47cb74b477ad21670dae957de61540af0154",
+      "source": "adapters/codex/contract-loop-gate.mjs",
+      "target": ".codex/hooks/contract-loop-gate.mjs"
+    },
+    {
+      "adapter": "cursor",
+      "category": "runtime",
+      "sha256": "c619d001ff60ee8f5f0e5aab6fa3fa73d218f2e89d1aa3e62e451f8580290c54",
+      "source": "adapters/cursor/hooks.json",
+      "target": ".cursor/hooks.json"
+    },
+    {
+      "adapter": "cursor",
+      "category": "runtime",
+      "sha256": "da224fb581fde615273af8db4e2bfca513233a83e69a0803442dfec86bbd6ba6",
+      "source": "adapters/cursor/contract-loop-gate.mjs",
+      "target": ".cursor/hooks/contract-loop-gate.mjs"
+    },
     {
       "adapter": "cursor",
       "category": "policy",
-      "sha256": "f7db85ff63f6a36f19ce9c990a2d2c3a3f715043986cd0bef224cad330b3b826",
+      "sha256": "f0a6dd9005443bdc194e8a1cd8e8f303a139f9bb838205d68d722379f6889b4f",
       "source": "policies/repository.md",
       "target": ".cursor/rules/cabloy-governance.mdc"
     },
@@ -641,14 +669,14 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "c8dcc0ce6b27b9bac4197e600f1444162dba1a520d05791b38f9197917034c93",
+      "sha256": "004d81369d47f539092bf054cf5604f3185805391110553f349dd53247bed386",
       "source": "skills/cabloy-contract-loop/references/verification-checklist.md",
       "target": ".cursor/skills/cabloy-contract-loop/references/verification-checklist.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "02daa2135016d46f021c7df7d47d64af8cf64371d9f30e59390a9e63aca165fc",
+      "sha256": "897a2bda7df448cc2f8468c9e23a090f0bd16bcd49fbb30427c95b11340b64c8",
       "source": "skills/cabloy-contract-loop/SKILL.md",
       "target": ".cursor/skills/cabloy-contract-loop/SKILL.md"
     },
@@ -872,14 +900,14 @@
     {
       "adapter": "codex",
       "category": "policy",
-      "sha256": "baaab679e04af3e386cb0b22dd5f69ad47bd19acf569f319c69c44afdb70c06a",
+      "sha256": "c87071f6f34adaaaf25aac5cb41d9ff10daea1743a31bd3344517d68a3d4082a",
       "source": "policies/repository.md",
       "target": "AGENTS.md"
     },
     {
       "adapter": "claude",
       "category": "policy",
-      "sha256": "baaab679e04af3e386cb0b22dd5f69ad47bd19acf569f319c69c44afdb70c06a",
+      "sha256": "c87071f6f34adaaaf25aac5cb41d9ff10daea1743a31bd3344517d68a3d4082a",
       "source": "policies/repository.md",
       "target": "CLAUDE.md"
     }

package/repo-agent-governance/manifest.json

@@ -52,5 +52,29 @@
         "target": ".claude/hooks/contract-loop-gate.ts"
       }
     ]
+  },
+  "cursor": {
+    "hooksJson": {
+      "source": "adapters/cursor/hooks.json",
+      "target": ".cursor/hooks.json"
+    },
+    "hooks": [
+      {
+        "source": "adapters/cursor/contract-loop-gate.mjs",
+        "target": ".cursor/hooks/contract-loop-gate.mjs"
+      }
+    ]
+  },
+  "codex": {
+    "hooksJson": {
+      "source": "adapters/codex/hooks.json",
+      "target": ".codex/hooks.json"
+    },
+    "hooks": [
+      {
+        "source": "adapters/codex/contract-loop-gate.mjs",
+        "target": ".codex/hooks/contract-loop-gate.mjs"
+      }
+    ]
   }
 }

package/repo-agent-governance/policies/repository.md

@@ -22,7 +22,7 @@ Always perform this detection before making UI-sensitive assumptions, choosing f
 - `repo-e2e/` contains the end-to-end test project.
 - `repo-observability/` contains local observability infrastructure.
 - `repo-agent-governance/` is the authored source for portable agent rules, root skills, adapters, and deterministic governance tools.
-- `.claude/`, `.agents/`, and `.cursor/` contain generated platform adapters plus platform-specific runtime integration.
+- `.claude/`, `.agents/`, `.codex/`, and `.cursor/` contain generated platform adapters plus platform-specific runtime integration.
 
 ## Preferred workflow
 

package/repo-agent-governance/scripts/governance.mjs

@@ -31,7 +31,14 @@ const GENERATED_HEADER =
   '<!-- Generated from repo-agent-governance/. Do not edit this adapter output directly. -->\n\n';
 const CURSOR_HEADER =
   '---\ndescription: Cabloy repository governance generated from repo-agent-governance.\nglobs: []\nalwaysApply: true\n---\n\n';
-const ALLOWED_TARGET_ROOTS = ['CLAUDE.md', 'AGENTS.md', '.claude/', '.agents/', '.cursor/'];
+const ALLOWED_TARGET_ROOTS = [
+  'CLAUDE.md',
+  'AGENTS.md',
+  '.claude/',
+  '.agents/',
+  '.cursor/',
+  '.codex/',
+];
 const FORBIDDEN_TARGET_SEGMENTS = [
   'settings.local.json',
   'worktrees',
@@ -163,7 +170,7 @@ function validateManifest() {
   );
   assertKeys(
     manifest,
-    ['schemaVersion', 'policy', 'skills', 'commands', 'claude'],
+    ['schemaVersion', 'policy', 'skills', 'commands', 'claude', 'cursor', 'codex'],
     'Governance manifest',
   );
   if (manifest.schemaVersion !== 1) throw new Error('Governance manifest must use schemaVersion 1');
@@ -204,6 +211,24 @@ function validateManifest() {
     : (() => {
         throw new Error('Claude hooks must be an array');
       })();
+  const cursor = requireObject(manifest.cursor, 'Cursor manifest section');
+  assertKeys(cursor, ['hooksJson', 'hooks'], 'Cursor manifest section');
+  const cursorHooksJson = requireObject(cursor.hooksJson, 'Cursor hooks.json manifest section');
+  assertKeys(cursorHooksJson, ['source', 'target'], 'Cursor hooks.json manifest section');
+  const cursorHooks = Array.isArray(cursor.hooks)
+    ? cursor.hooks
+    : (() => {
+        throw new Error('Cursor hooks must be an array');
+      })();
+  const codex = requireObject(manifest.codex, 'Codex manifest section');
+  assertKeys(codex, ['hooksJson', 'hooks'], 'Codex manifest section');
+  const codexHooksJson = requireObject(codex.hooksJson, 'Codex hooks.json manifest section');
+  assertKeys(codexHooksJson, ['source', 'target'], 'Codex hooks.json manifest section');
+  const codexHooks = Array.isArray(codex.hooks)
+    ? codex.hooks
+    : (() => {
+        throw new Error('Codex hooks must be an array');
+      })();
 
   const targets = new Set();
   const claimTarget = target => {
@@ -246,6 +271,24 @@ function validateManifest() {
     assertKeys(hook, ['source', 'target'], `Claude hook ${index}`);
     return { source: readCanonical(hook.source).source, target: claimTarget(hook.target) };
   });
+  const normalizedCursorHooksJson = {
+    source: readCanonical(cursorHooksJson.source).source,
+    target: claimTarget(cursorHooksJson.target),
+  };
+  const normalizedCursorHooks = cursorHooks.map((item, index) => {
+    const hook = requireObject(item, `Cursor hook ${index}`);
+    assertKeys(hook, ['source', 'target'], `Cursor hook ${index}`);
+    return { source: readCanonical(hook.source).source, target: claimTarget(hook.target) };
+  });
+  const normalizedCodexHooksJson = {
+    source: readCanonical(codexHooksJson.source).source,
+    target: claimTarget(codexHooksJson.target),
+  };
+  const normalizedCodexHooks = codexHooks.map((item, index) => {
+    const hook = requireObject(item, `Codex hook ${index}`);
+    assertKeys(hook, ['source', 'target'], `Codex hook ${index}`);
+    return { source: readCanonical(hook.source).source, target: claimTarget(hook.target) };
+  });
 
   return {
     manifest,
@@ -257,6 +300,8 @@ function validateManifest() {
     skills: { directory: skillsDirectory, path: skillsPath, targets: normalizedSkillTargets },
     commands,
     claude: { settings: normalizedSettings, hooks: normalizedHooks },
+    cursor: { hooksJson: normalizedCursorHooksJson, hooks: normalizedCursorHooks },
+    codex: { hooksJson: normalizedCodexHooksJson, hooks: normalizedCodexHooks },
   };
 }
 
@@ -331,6 +376,26 @@ function buildAssets() {
   for (const hook of config.claude.hooks) {
     add(hook.target, readCanonical(hook.source).content, hook.source, 'claude', 'runtime');
   }
+  add(
+    config.cursor.hooksJson.target,
+    readCanonical(config.cursor.hooksJson.source).content,
+    config.cursor.hooksJson.source,
+    'cursor',
+    'runtime',
+  );
+  for (const hook of config.cursor.hooks) {
+    add(hook.target, readCanonical(hook.source).content, hook.source, 'cursor', 'runtime');
+  }
+  add(
+    config.codex.hooksJson.target,
+    readCanonical(config.codex.hooksJson.source).content,
+    config.codex.hooksJson.source,
+    'codex',
+    'runtime',
+  );
+  for (const hook of config.codex.hooks) {
+    add(hook.target, readCanonical(hook.source).content, hook.source, 'codex', 'runtime');
+  }
 
   const targets = new Set();
   for (const asset of assets) {
@@ -358,6 +423,31 @@ function lockText(assets) {
   return `${JSON.stringify(lockFromAssets(assets), null, 2)}\n`;
 }
 
+function previousManagedAssets() {
+  if (!existsSync(LOCK_PATH)) return [];
+  try {
+    const lock = readJson(LOCK_PATH, 'managed governance lock');
+    if (lock?.schemaVersion !== 1 || !Array.isArray(lock.assets)) return [];
+    const targets = new Set();
+    return lock.assets.map(asset => {
+      if (
+        !asset ||
+        typeof asset !== 'object' ||
+        typeof asset.target !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(asset.sha256)
+      ) {
+        throw new Error('invalid managed asset');
+      }
+      const target = assertAllowedTarget(asset.target);
+      if (targets.has(target)) throw new Error('duplicate managed asset');
+      targets.add(target);
+      return { target, sha256: asset.sha256 };
+    });
+  } catch {
+    return [];
+  }
+}
+
 function targetPath(target) {
   const path = resolve(ROOT_DIR, target);
   assertInside(ROOT_DIR, path, 'Managed target');
@@ -377,11 +467,20 @@ function writeAtomic(path, content) {
 
 export function render() {
   const assets = buildAssets();
+  const previousAssets = previousManagedAssets();
   for (const asset of assets) {
     const path = targetPath(asset.target);
     const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
     if (existing !== asset.content) writeAtomic(path, asset.content);
   }
+  const activeTargets = new Set(assets.map(asset => asset.target));
+  for (const asset of previousAssets) {
+    if (activeTargets.has(asset.target)) continue;
+    const path = targetPath(asset.target);
+    if (existsSync(path) && sha256(readFileSync(path, 'utf8')) === asset.sha256) {
+      rmSync(path, { force: true });
+    }
+  }
   const lock = lockText(assets);
   const existingLock = existsSync(LOCK_PATH) ? readFileSync(LOCK_PATH, 'utf8') : null;
   if (existingLock !== lock) writeAtomic(LOCK_PATH, lock);

package/repo-agent-governance/scripts/pack-check.mjs

@@ -16,6 +16,11 @@ const required = [
   'repo-agent-governance/managed-assets.json',
   'repo-agent-governance/scripts/governance.mjs',
   'repo-agent-governance/tools/contract-loop/core.mjs',
+  'repo-agent-governance/tools/contract-loop/hook-runtime.mjs',
+  'repo-agent-governance/adapters/cursor/hooks.json',
+  'repo-agent-governance/adapters/cursor/contract-loop-gate.mjs',
+  'repo-agent-governance/adapters/codex/hooks.json',
+  'repo-agent-governance/adapters/codex/contract-loop-gate.mjs',
 ];
 const forbidden = [
   '.cabloy-agent-governance-state.json',