codiedev 0.10.0-beta.1 → 0.10.0-beta.11

package/dist/cliSession.js

@@ -0,0 +1,456 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_CODE_GRANT = exports.LOCK_STALE_MS = exports.DEFAULT_MIN_VALIDITY_MS = void 0;
+exports.readConfigAt = readConfigAt;
+exports.renameWithRetry = renameWithRetry;
+exports.writeConfigAtomic = writeConfigAtomic;
+exports.ensureFreshToken = ensureFreshToken;
+exports.pkcePair = pkcePair;
+exports.openBrowser = openBrowser;
+exports.parseCallback = parseCallback;
+exports.browserLogin = browserLogin;
+exports.isHeadless = isHeadless;
+exports.deviceLogin = deviceLogin;
+exports.logout = logout;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+exports.DEFAULT_MIN_VALIDITY_MS = 10 * 60_000;
+exports.LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 20_000;
+const REFRESH_TIMEOUT_MS = 10_000;
+const LOGIN_TIMEOUT_MS = 10 * 60_000;
+function readConfigAt(configPath) {
+    try {
+        return JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+const RENAME_RETRY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_RETRY_MS = [10, 25, 50, 100, 200, 400, 800];
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function renameWithRetry(from, to, rename = fs.renameSync, sleep = sleepSync) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (err) {
+            const code = err?.code ?? "";
+            if (!RENAME_RETRY_CODES.has(code) || attempt >= RENAME_RETRY_MS.length)
+                throw err;
+            sleep(RENAME_RETRY_MS[attempt]);
+        }
+    }
+}
+function writeConfigAtomic(configPath, config) {
+    const dir = path.dirname(configPath);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const data = JSON.stringify(config, null, 2);
+    const tmp = path.join(dir, `.config.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+    fs.writeFileSync(tmp, data, { encoding: "utf8", mode: 0o600 });
+    try {
+        fs.chmodSync(tmp, 0o600);
+        renameWithRetry(tmp, configPath);
+        return;
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { }
+        if (!RENAME_RETRY_CODES.has(err?.code ?? ""))
+            throw err;
+    }
+    fs.writeFileSync(configPath, data, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+}
+function lockPathFor(configPath) {
+    return path.join(path.dirname(configPath), "refresh.lock");
+}
+function tryLock(lockPath, now) {
+    try {
+        const fd = fs.openSync(lockPath, "wx", 0o600);
+        fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: now }));
+        fs.closeSync(fd);
+        return true;
+    }
+    catch (err) {
+        if (err?.code !== "EEXIST")
+            throw err;
+        try {
+            const age = now - fs.statSync(lockPath).mtimeMs;
+            if (age > exports.LOCK_STALE_MS)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+        }
+        return false;
+    }
+}
+function unlock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch { }
+}
+function needsRefresh(config, now, minValidityMs) {
+    const auth = config.auth;
+    return !!auth && !!config.token && auth.accessTokenExpiresAt - now < minValidityMs;
+}
+async function postForm(fetchImpl, url, form, timeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form).toString(),
+            signal: ctl.signal,
+        });
+        return { status: res.status, body: (await res.json().catch(() => null)) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDITY_MS) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const first = readConfigAt(deps.configPath);
+    if (!first?.auth)
+        return { status: "none", config: first };
+    if (!needsRefresh(first, now(), minValidityMs))
+        return { status: "fresh", config: first };
+    const seen = first.token;
+    const lockPath = lockPathFor(deps.configPath);
+    const deadline = now() + LOCK_WAIT_MS;
+    let locked = false;
+    try {
+        while (!(locked = tryLock(lockPath, now()))) {
+            if (now() > deadline)
+                return { status: "unavailable", config: first };
+            await sleep(50 + Math.floor(Math.random() * 100));
+        }
+        const current = readConfigAt(deps.configPath);
+        if (!current?.auth)
+            return { status: "none", config: current };
+        if (current.token !== seen)
+            return { status: "adopted", config: current };
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${current.backendUrl}/oauth/token`, {
+                grant_type: "refresh_token",
+                client_id: current.auth.clientId,
+                refresh_token: current.auth.refreshToken,
+            }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            return { status: "unavailable", config: current };
+        }
+        if (res.status === 200 && typeof res.body?.access_token === "string" && typeof res.body.refresh_token === "string") {
+            const next = {
+                ...current,
+                token: res.body.access_token,
+                auth: {
+                    ...current.auth,
+                    refreshToken: res.body.refresh_token,
+                    accessTokenExpiresAt: now() + Number(res.body.expires_in ?? 0) * 1000,
+                },
+            };
+            writeConfigAtomic(deps.configPath, next);
+            return { status: "refreshed", config: next };
+        }
+        if (res.status === 400 && res.body?.error === "invalid_grant") {
+            const out = { ...current, token: "" };
+            delete out.auth;
+            writeConfigAtomic(deps.configPath, out);
+            return { status: "signed_out", config: out };
+        }
+        return { status: "unavailable", config: current };
+    }
+    finally {
+        if (locked)
+            unlock(lockPath);
+    }
+}
+function base64Url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+    const verifier = base64Url(crypto.randomBytes(32));
+    const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function openBrowser(url) {
+    try {
+        const [cmd, args] = process.platform === "darwin"
+            ? ["open", [url]]
+            : process.platform === "win32"
+                ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+                : ["xdg-open", [url]];
+        const child = (0, child_process_1.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const DONE_PAGE = (ok, msg) => `<!doctype html><html><head><meta charset="utf-8">
+<title>Codiedev CLI</title><style>body{font-family:system-ui,sans-serif;display:grid;place-items:center;
+height:100vh;margin:0;background:#fbfbfa;color:#1f1f1f}main{max-width:28rem;text-align:center}
+h1{font-size:1.25rem}</style></head><body><main><h1>${ok ? "You're signed in" : "Sign-in didn't finish"}</h1>
+<p>${msg}</p></main></body></html>`;
+function parseCallback(input) {
+    try {
+        const u = new URL(input.trim());
+        return {
+            code: u.searchParams.get("code") ?? undefined,
+            state: u.searchParams.get("state") ?? undefined,
+            error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? undefined,
+        };
+    }
+    catch {
+        return { error: "That isn't the address from the browser's address bar." };
+    }
+}
+async function browserLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const state = base64Url(crypto.randomBytes(16));
+    const { verifier, challenge } = pkcePair();
+    let settle;
+    const result = new Promise((r) => (settle = r));
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        const cb = parseCallback(url.toString());
+        const ok = !cb.error && cb.state === state && !!cb.code;
+        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(DONE_PAGE(ok, ok
+            ? "You can close this tab and go back to your terminal."
+            : "Go back to your terminal and run <code>codiedev connect</code> again."));
+        if (cb.error)
+            settle({ error: cb.error });
+        else if (cb.state !== state)
+            settle({ error: "The sign-in response didn't match this request (state mismatch)." });
+        else
+            settle({ code: cb.code });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const timer = setTimeout(() => settle({ error: "Timed out waiting for the browser (10 minutes)." }), LOGIN_TIMEOUT_MS);
+    try {
+        const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+                redirect_uris: [redirectUri],
+            }),
+        });
+        if (reg.status !== 201)
+            throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+        const { client_id: clientId } = (await reg.json());
+        const authorize = new URL(`${opts.backendUrl}/oauth/authorize`);
+        authorize.search = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            response_type: "code",
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+            scope: "cli",
+        }).toString();
+        const link = authorize.toString();
+        if (opts.onAuthorizeUrl) {
+            opts.onAuthorizeUrl(link);
+        }
+        else {
+            log("Opening your browser to sign in…");
+            log(`If it doesn't open, visit:\n  ${link}\n`);
+            openBrowser(link);
+        }
+        const cb = await result;
+        if (cb.error || !cb.code)
+            throw new Error(cb.error ?? "Sign-in was cancelled.");
+        const tok = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, {
+            grant_type: "authorization_code",
+            code: cb.code,
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+        }, REFRESH_TIMEOUT_MS);
+        const body = tok.body;
+        if (tok.status !== 200 || typeof body?.access_token !== "string" || typeof body.refresh_token !== "string") {
+            throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${tok.status}`}`);
+        }
+        if (body.scope !== "cli")
+            throw new Error("The server didn't grant CLI access.");
+        return {
+            accessToken: body.access_token,
+            refreshToken: body.refresh_token,
+            expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+            clientId,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        server.close();
+    }
+}
+exports.DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function isHeadless(env = process.env, platform = process.platform) {
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return true;
+    if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
+async function deviceLogin(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const log = opts.log ?? ((line) => console.log(line));
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const reg = await fetchImpl(`${opts.backendUrl}/oauth/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            client_name: opts.clientName ?? `Codiedev CLI on ${os.hostname()}`,
+            redirect_uris: [],
+            grant_types: [exports.DEVICE_CODE_GRANT, "refresh_token"],
+        }),
+    });
+    if (reg.status !== 201)
+        throw new Error(`Sign-in setup failed (HTTP ${reg.status}).`);
+    const { client_id: clientId } = (await reg.json());
+    const start = await fetchImpl(`${opts.backendUrl}/oauth/device_authorization`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, scope: "cli" }).toString(),
+    });
+    const auth = (await start.json().catch(() => null));
+    if (start.status !== 200 || !auth?.device_code || !auth.user_code || !auth.verification_uri) {
+        throw new Error(`Sign-in setup failed: ${auth?.error_description ?? `HTTP ${start.status}`}`);
+    }
+    const complete = auth.verification_uri_complete ?? auth.verification_uri;
+    if (opts.onCode) {
+        opts.onCode({ userCode: auth.user_code, verificationUri: auth.verification_uri, verificationUriComplete: complete });
+    }
+    log("To sign in, open this link on any device (your laptop or phone) and approve:\n");
+    log(`  ${complete}\n`);
+    log(`Your code: ${auth.user_code}   (check it matches the page)\n`);
+    log("Waiting for approval…");
+    let intervalMs = Math.max(1, Number(auth.interval ?? 5)) * 1000;
+    const deadline = now() + Number(auth.expires_in ?? 600) * 1000;
+    for (;;) {
+        await sleep(intervalMs);
+        if (now() > deadline)
+            throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+        let res;
+        try {
+            res = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, { grant_type: exports.DEVICE_CODE_GRANT, device_code: auth.device_code, client_id: clientId }, REFRESH_TIMEOUT_MS);
+        }
+        catch {
+            continue;
+        }
+        const body = res.body;
+        if (res.status === 200 && typeof body?.access_token === "string" && typeof body.refresh_token === "string") {
+            if (body.scope !== "cli")
+                throw new Error("The server didn't grant CLI access.");
+            return {
+                accessToken: body.access_token,
+                refreshToken: body.refresh_token,
+                expiresAt: now() + Number(body.expires_in ?? 0) * 1000,
+                clientId,
+            };
+        }
+        switch (body?.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                intervalMs += 5000;
+                continue;
+            case "access_denied":
+                throw new Error("Sign-in was denied in the browser.");
+            case "expired_token":
+                throw new Error("The code expired before it was approved. Run `codiedev connect` again.");
+            default:
+                throw new Error(`Sign-in failed: ${body?.error_description ?? body?.error ?? `HTTP ${res.status}`}`);
+        }
+    }
+}
+async function logout(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const config = readConfigAt(deps.configPath);
+    if (!config?.token)
+        return { wasConnected: false, hadBrowserAuth: false, serverRevoked: false };
+    let serverRevoked = false;
+    const hadBrowserAuth = !!config.auth;
+    if (config.token && config.auth) {
+        try {
+            const res = await fetchImpl(`${config.backendUrl}/api/cli/logout`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${config.token}` },
+            });
+            serverRevoked = res.ok && (await res.json().catch(() => null))?.revoked === true;
+        }
+        catch {
+        }
+    }
+    const out = { ...config, token: "" };
+    delete out.auth;
+    writeConfigAtomic(deps.configPath, out);
+    return { wasConnected: true, hadBrowserAuth, serverRevoked };
+}

package/dist/codexHookTrust.js

@@ -33,10 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexPluginContentHash = codexPluginContentHash;
 exports.codexCommandHookHash = codexCommandHookHash;
 exports.codiedevCodexHookTrustEntries = codiedevCodexHookTrustEntries;
 exports.writeCodexHookTrust = writeCodexHookTrust;
 exports.inspectCodexHookTrust = inspectCodexHookTrust;
+exports.packCodexHookTrustEntries = packCodexHookTrustEntries;
+exports.writeCodexPackHookTrust = writeCodexPackHookTrust;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -67,6 +70,42 @@ const MATCHER_EVENTS = new Set([
     "SubagentStart",
     "SubagentStop",
 ]);
+function codexPluginContentHash(root) {
+    const hash = crypto.createHash("sha256");
+    hash.update("codex-plugin-bundle-v1");
+    const u64 = (n) => {
+        const b = Buffer.alloc(8);
+        b.writeBigUInt64LE(BigInt(n));
+        return b;
+    };
+    const pending = [root];
+    while (pending.length) {
+        const current = pending.pop();
+        const relative = path.relative(root, current).split(path.sep).join("/");
+        const name = path.posix.basename(relative);
+        if (name === "__pycache__" || name === ".venv" || name.endsWith(".pyc") || name.endsWith(".egg-info"))
+            continue;
+        const nameBytes = Buffer.from(relative, "utf8");
+        hash.update(u64(nameBytes.length));
+        hash.update(nameBytes);
+        const stat = fs.lstatSync(current);
+        if (stat.isDirectory()) {
+            hash.update("directory");
+            const entries = fs.readdirSync(current).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+            for (const entry of entries.reverse())
+                pending.push(path.join(current, entry));
+        }
+        else if (stat.isFile()) {
+            hash.update("file");
+            hash.update(u64(stat.size));
+            hash.update(fs.readFileSync(current));
+        }
+        else {
+            throw new Error(`unsupported plugin entry type: ${current}`);
+        }
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
 function canonicalize(value) {
     if (Array.isArray(value))
         return value.map(canonicalize);
@@ -85,8 +124,6 @@ function normalizedTimeout(eventName, value) {
         return Math.min(3, Math.max(1, configured ?? 1));
     return Math.max(1, configured ?? 600);
 }
-/** Codex hashes a canonical, normalized hook identity before it will execute a
- * user hook. Keep this compatible with codex_config::version_for_toml. */
 function codexCommandHookHash(eventName, group, handler) {
     const normalizedHandler = {
         type: "command",
@@ -155,6 +192,27 @@ function codiedevCodexHookTrustEntries(hooksPath, hooksFile) {
     }
     return entries;
 }
+function stripBlockKeepingForeign(text, begin, end) {
+    const foreign = [];
+    const stripped = text.replace(new RegExp(`\\n?${begin}\\n([\\s\\S]*?)${end}\\n?`, "g"), (_match, body) => {
+        let table = null;
+        const flush = () => {
+            if (table && table.join("").trim())
+                foreign.push(table.join("\n").trimEnd());
+        };
+        for (const line of body.split("\n")) {
+            if (/^\s*\[/.test(line)) {
+                flush();
+                table = /^\s*\[hooks\.state\./.test(line) ? null : [];
+            }
+            if (table)
+                table.push(line);
+        }
+        flush();
+        return "\n";
+    });
+    return foreign.length ? `${stripped.trimEnd()}\n\n${foreign.join("\n\n")}\n` : stripped;
+}
 function tableHeader(key) {
     return `[hooks.state.${JSON.stringify(key)}]`;
 }
@@ -173,13 +231,10 @@ function removeTable(lines, header) {
     }
     return output;
 }
-/** `codiedev connect` is an explicit install action, so trust only the exact
- * Codiedev commands it just wrote. Any later command change produces a new
- * hash and Codex disables that hook until connect is run again. */
 function writeCodexHookTrust(configPath, hooksPath, hooksFile) {
     const entries = codiedevCodexHookTrustEntries(hooksPath, hooksFile);
     let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
-    existing = existing.replace(new RegExp(`\\n?${TRUST_BEGIN}\\n[\\s\\S]*?${TRUST_END}\\n?`, "g"), "\n");
+    existing = stripBlockKeepingForeign(existing, TRUST_BEGIN, TRUST_END);
     let lines = existing.split("\n");
     for (const entry of entries)
         lines = removeTable(lines, tableHeader(entry.key));
@@ -226,3 +281,67 @@ function inspectCodexHookTrust(configPath, hooksPath, hooksFile, requiredSubcomm
     }).length;
     return { ok: entries.length > 0 && trusted === entries.length, total: entries.length, trusted };
 }
+const PACK_TRUST_BEGIN = "# codiedev-pack-trust:begin";
+const PACK_TRUST_END = "# codiedev-pack-trust:end";
+function packCodexHookTrustEntries(hooksPath, hooksFile, plugin) {
+    const events = hooksFile?.hooks;
+    if (!events || typeof events !== "object")
+        return [];
+    const source = plugin
+        ? `${plugin.id}:${path.relative(plugin.root, hooksPath).split(path.sep).join("/")}`
+        : normalizedHooksPath(hooksPath);
+    const contentHash = plugin ? codexPluginContentHash(plugin.root) : undefined;
+    const entries = [];
+    for (const [eventName, groupsValue] of Object.entries(events)) {
+        const eventLabel = EVENT_LABELS[eventName];
+        if (!eventLabel || !Array.isArray(groupsValue))
+            continue;
+        groupsValue.forEach((groupValue, groupIndex) => {
+            const group = groupValue;
+            if (!group || !Array.isArray(group.hooks))
+                return;
+            group.hooks.forEach((handlerValue, handlerIndex) => {
+                const handler = handlerValue;
+                if (!handler || handler.type !== "command" || typeof handler.command !== "string")
+                    return;
+                entries.push({
+                    key: `${source}:${eventLabel}:${groupIndex}:${handlerIndex}`,
+                    eventName,
+                    command: handler.command,
+                    currentHash: codexCommandHookHash(eventName, group, handler),
+                    ...(contentHash ? { contentHash } : {}),
+                });
+            });
+        });
+    }
+    return entries;
+}
+function writeCodexPackHookTrust(configPath, entries) {
+    let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+    existing = stripBlockKeepingForeign(existing, PACK_TRUST_BEGIN, PACK_TRUST_END);
+    let lines = existing.split("\n");
+    for (const entry of entries)
+        lines = removeTable(lines, tableHeader(entry.key));
+    const base = lines.join("\n").trimEnd();
+    if (entries.length === 0) {
+        const next = base ? `${base}\n` : "";
+        if (!fs.existsSync(configPath) && !next)
+            return entries;
+        fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+        fs.chmodSync(configPath, 0o600);
+        return entries;
+    }
+    const trustBlock = entries.flatMap((entry) => [
+        tableHeader(entry.key),
+        "enabled = true",
+        `trusted_hash = ${JSON.stringify(entry.currentHash)}`,
+        ...(entry.contentHash ? [`trusted_content_hash = ${JSON.stringify(entry.contentHash)}`] : []),
+        "",
+    ]).join("\n");
+    const next = `${base}${base ? "\n\n" : ""}${PACK_TRUST_BEGIN}\n${trustBlock}${PACK_TRUST_END}\n`;
+    fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+    return entries;
+}