codex-toolkit 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-toolkit",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Stop AI scope creep in Codex CLI. A toolkit of practical hooks that keep your AI edits scoped, budgeted, and safe.",
   "type": "module",
   "main": "src/index.js",

package/src/installer.js

@@ -83,6 +83,19 @@ function copyHook(file) {
   const dst = path.join(HOOKS_INSTALLED, file);
   fs.copyFileSync(src, dst);
   fs.chmodSync(dst, 0o755);
+  // Also copy the shared support modules so the installed hook can
+  // resolve its relative `import './hook-protocol.js'` etc. The hooks
+  // run from ~/.codex/hooks/ as a fresh subprocess, so they need their
+  // deps next to them — they cannot import from src/ inside the npm
+  // package because that path varies by install location.
+  for (const dep of ['hook-protocol.js', 'state-store.js']) {
+    const depSrc = path.join(HOOKS_DIR, dep);
+    const depDst = path.join(HOOKS_INSTALLED, dep);
+    if (fs.existsSync(depSrc)) {
+      fs.copyFileSync(depSrc, depDst);
+      fs.chmodSync(depDst, 0o644);
+    }
+  }
   return dst;
 }
 

package/src/scope-guard.js

@@ -33,8 +33,26 @@ import {
 
 const DEFAULT_CONFIG = {
   mode: 'enforce',
+  // Default allow: everything except the deny list. Users override this
+  // with their own scope-guard.json when they want a tighter scope.
   allow: ['**/*'],
-  deny: [],
+  // Default deny: paths that almost never should be AI-edited, even when
+  // the user has not configured anything. v0.1.0–v0.4.1 had `deny: []`,
+  // which meant "default mode: enforce" was a no-op for users who never
+  // wrote a config. The P1 bug found in v0.4.1 dogfooding was that the
+  // installed hook also broke (couldn't find its deps), so users
+  // installed + doctor reported green even though real Codex sessions
+  // would never fire the guard. This default deny list means a brand
+  // new install now refuses the most common dangerous writes out of
+  // the box, which matches the README's "default mode: enforce" claim.
+  deny: [
+    '.env',
+    '.env.*',
+    '**/.env',
+    '**/.env.*',
+    '**/secrets/**',
+    '**/.git/**',
+  ],
   log: true,
 };