codiedev 0.9.39 → 0.9.41

package/dist/codexHookTrust.d.ts

@@ -0,0 +1,34 @@
+interface CommandHandler {
+    type?: unknown;
+    command?: unknown;
+    commandWindows?: unknown;
+    command_windows?: unknown;
+    timeout?: unknown;
+    async?: unknown;
+    statusMessage?: unknown;
+    additionalContextLimit?: unknown;
+}
+interface MatcherGroup {
+    matcher?: unknown;
+    hooks?: unknown;
+}
+export interface CodexHookTrustEntry {
+    key: string;
+    eventName: string;
+    command: string;
+    currentHash: string;
+}
+/** Codex hashes a canonical, normalized hook identity before it will execute a
+ * user hook. Keep this compatible with codex_config::version_for_toml. */
+export declare function codexCommandHookHash(eventName: string, group: MatcherGroup, handler: CommandHandler): string;
+export declare function codiedevCodexHookTrustEntries(hooksPath: string, hooksFile: unknown): CodexHookTrustEntry[];
+/** `codiedev connect` is an explicit install action, so trust only the exact
+ * Codiedev commands it just wrote. Any later command change produces a new
+ * hash and Codex disables that hook until connect is run again. */
+export declare function writeCodexHookTrust(configPath: string, hooksPath: string, hooksFile: unknown): CodexHookTrustEntry[];
+export declare function inspectCodexHookTrust(configPath: string, hooksPath: string, hooksFile: unknown, requiredSubcommands?: string[]): {
+    ok: boolean;
+    total: number;
+    trusted: number;
+};
+export {};

package/dist/codexHookTrust.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexCommandHookHash = codexCommandHookHash;
+exports.codiedevCodexHookTrustEntries = codiedevCodexHookTrustEntries;
+exports.writeCodexHookTrust = writeCodexHookTrust;
+exports.inspectCodexHookTrust = inspectCodexHookTrust;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const detection_1 = require("./detection");
+const TRUST_BEGIN = "# codiedev-hook-trust:begin";
+const TRUST_END = "# codiedev-hook-trust:end";
+const EVENT_LABELS = {
+    PreToolUse: "pre_tool_use",
+    PermissionRequest: "permission_request",
+    PostToolUse: "post_tool_use",
+    PreCompact: "pre_compact",
+    PostCompact: "post_compact",
+    SessionStart: "session_start",
+    SessionEnd: "session_end",
+    UserPromptSubmit: "user_prompt_submit",
+    SubagentStart: "subagent_start",
+    SubagentStop: "subagent_stop",
+    Stop: "stop",
+};
+const MATCHER_EVENTS = new Set([
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PreCompact",
+    "PostCompact",
+    "SessionStart",
+    "SessionEnd",
+    "SubagentStart",
+    "SubagentStop",
+]);
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => [key, canonicalize(child)]));
+    }
+    return value;
+}
+function normalizedTimeout(eventName, value) {
+    const configured = typeof value === "number" && Number.isFinite(value)
+        ? Math.floor(value)
+        : undefined;
+    if (eventName === "SessionEnd")
+        return Math.min(3, Math.max(1, configured ?? 1));
+    return Math.max(1, configured ?? 600);
+}
+/** Codex hashes a canonical, normalized hook identity before it will execute a
+ * user hook. Keep this compatible with codex_config::version_for_toml. */
+function codexCommandHookHash(eventName, group, handler) {
+    const normalizedHandler = {
+        type: "command",
+        command: String(handler.command ?? ""),
+        timeout: normalizedTimeout(eventName, handler.timeout),
+        async: handler.async === true,
+    };
+    const commandWindows = typeof handler.commandWindows === "string"
+        ? handler.commandWindows
+        : typeof handler.command_windows === "string"
+            ? handler.command_windows
+            : undefined;
+    if (commandWindows !== undefined)
+        normalizedHandler.commandWindows = commandWindows;
+    if (typeof handler.statusMessage === "string")
+        normalizedHandler.statusMessage = handler.statusMessage;
+    if (typeof handler.additionalContextLimit === "number") {
+        normalizedHandler.additionalContextLimit = handler.additionalContextLimit;
+    }
+    const identity = {
+        event_name: EVENT_LABELS[eventName],
+        hooks: [normalizedHandler],
+    };
+    if (MATCHER_EVENTS.has(eventName) && typeof group.matcher === "string") {
+        identity.matcher = group.matcher;
+    }
+    const serialized = JSON.stringify(canonicalize(identity));
+    return `sha256:${crypto.createHash("sha256").update(serialized).digest("hex")}`;
+}
+function normalizedHooksPath(hooksPath) {
+    try {
+        return fs.realpathSync.native(hooksPath);
+    }
+    catch {
+        return path.resolve(hooksPath);
+    }
+}
+function codiedevCodexHookTrustEntries(hooksPath, hooksFile) {
+    const events = hooksFile?.hooks;
+    if (!events || typeof events !== "object")
+        return [];
+    const source = normalizedHooksPath(hooksPath);
+    const entries = [];
+    for (const [eventName, groupsValue] of Object.entries(events)) {
+        const eventLabel = EVENT_LABELS[eventName];
+        if (!eventLabel || !Array.isArray(groupsValue))
+            continue;
+        groupsValue.forEach((groupValue, groupIndex) => {
+            const group = groupValue;
+            if (!Array.isArray(group.hooks))
+                return;
+            group.hooks.forEach((handlerValue, handlerIndex) => {
+                const handler = handlerValue;
+                if (handler.type !== "command" || typeof handler.command !== "string")
+                    return;
+                if (!(0, detection_1.isCodiedevHookCommand)(handler.command))
+                    return;
+                entries.push({
+                    key: `${source}:${eventLabel}:${groupIndex}:${handlerIndex}`,
+                    eventName,
+                    command: handler.command,
+                    currentHash: codexCommandHookHash(eventName, group, handler),
+                });
+            });
+        });
+    }
+    return entries;
+}
+function tableHeader(key) {
+    return `[hooks.state.${JSON.stringify(key)}]`;
+}
+function removeTable(lines, header) {
+    const output = [];
+    let skipping = false;
+    for (const line of lines) {
+        if (line.trim() === header) {
+            skipping = true;
+            continue;
+        }
+        if (skipping && /^\s*\[/.test(line))
+            skipping = false;
+        if (!skipping)
+            output.push(line);
+    }
+    return output;
+}
+/** `codiedev connect` is an explicit install action, so trust only the exact
+ * Codiedev commands it just wrote. Any later command change produces a new
+ * hash and Codex disables that hook until connect is run again. */
+function writeCodexHookTrust(configPath, hooksPath, hooksFile) {
+    const entries = codiedevCodexHookTrustEntries(hooksPath, hooksFile);
+    let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+    existing = existing.replace(new RegExp(`\\n?${TRUST_BEGIN}\\n[\\s\\S]*?${TRUST_END}\\n?`, "g"), "\n");
+    let lines = existing.split("\n");
+    for (const entry of entries)
+        lines = removeTable(lines, tableHeader(entry.key));
+    const base = lines.join("\n").trimEnd();
+    const trustBlock = entries.flatMap((entry) => [
+        tableHeader(entry.key),
+        "enabled = true",
+        `trusted_hash = ${JSON.stringify(entry.currentHash)}`,
+        "",
+    ]).join("\n");
+    const next = `${base}${base ? "\n\n" : ""}${TRUST_BEGIN}\n${trustBlock}${TRUST_END}\n`;
+    fs.mkdirSync(path.dirname(configPath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(configPath, next, { encoding: "utf8", mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+    return entries;
+}
+function configuredTrust(configText, key) {
+    const lines = configText.split("\n");
+    const header = tableHeader(key);
+    const start = lines.findIndex((line) => line.trim() === header);
+    if (start < 0)
+        return { enabled: true };
+    let enabled = true;
+    let hash;
+    for (let index = start + 1; index < lines.length && !/^\s*\[/.test(lines[index]); index += 1) {
+        const enabledMatch = lines[index].match(/^\s*enabled\s*=\s*(true|false)\s*$/);
+        if (enabledMatch)
+            enabled = enabledMatch[1] === "true";
+        const hashMatch = lines[index].match(/^\s*trusted_hash\s*=\s*"([^"]+)"\s*$/);
+        if (hashMatch)
+            hash = hashMatch[1];
+    }
+    return { enabled, hash };
+}
+function inspectCodexHookTrust(configPath, hooksPath, hooksFile, requiredSubcommands = []) {
+    const configText = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+    const allEntries = codiedevCodexHookTrustEntries(hooksPath, hooksFile);
+    const entries = requiredSubcommands.length === 0
+        ? allEntries
+        : allEntries.filter((entry) => requiredSubcommands.some((subcommand) => entry.command.trim().endsWith(subcommand)));
+    const trusted = entries.filter((entry) => {
+        const state = configuredTrust(configText, entry.key);
+        return state.enabled && state.hash === entry.currentHash;
+    }).length;
+    return { ok: entries.length > 0 && trusted === entries.length, total: entries.length, trusted };
+}

package/dist/codie.js

@@ -232,9 +232,26 @@ async function main() {
         OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
     };
     const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
-    const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, { stdio: "inherit", env });
+    const nonInteractiveRun = runtimeArgs[0] === "run";
+    if (nonInteractiveRun)
+        env.CODIEDEV_SECURITY_BLOCK_OUTPUT = "marker";
+    const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, {
+        stdio: nonInteractiveRun ? ["inherit", "inherit", "pipe"] : "inherit",
+        encoding: nonInteractiveRun ? "utf8" : undefined,
+        env,
+    });
     if (result.error)
         throw result.error;
+    if (nonInteractiveRun) {
+        const stderr = typeof result.stderr === "string" ? result.stderr : result.stderr?.toString() ?? "";
+        const blockReason = (0, codieLauncher_1.extractCodieSecurityBlock)(stderr);
+        if (blockReason) {
+            console.error(`Codie Security blocked this action:\n${blockReason}`);
+        }
+        else if (stderr) {
+            process.stderr.write(stderr);
+        }
+    }
     process.exitCode = result.status === null ? 1 : result.status;
 }
 main().catch((error) => {

package/dist/codieLauncher.d.ts

@@ -2,6 +2,11 @@ export interface CatalogModel {
     id: string;
     name?: string;
 }
+export declare const CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
+/** Extract the private adapter marker used to carry a local block reason
+ * across OpenCode's generic 500 boundary. The marker never contains prompt or
+ * tool input — only the deterministic policy reason. */
+export declare function extractCodieSecurityBlock(stderr: string): string | undefined;
 /**
  * Pin non-interactive runs to the directory where `codie` was launched.
  * OpenCode can reuse a previously-known project instance; without an explicit

package/dist/codieLauncher.js

@@ -42,7 +42,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = void 0;
+exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.CODIE_SECURITY_BLOCK_MARKER = void 0;
+exports.extractCodieSecurityBlock = extractCodieSecurityBlock;
 exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
 exports.bareModel = bareModel;
 exports.buildCodieConfig = buildCodieConfig;
@@ -62,6 +63,26 @@ const DEFAULT_NAMES = {
     "z-ai/glm-5.2": "GLM 5.2 · Fireworks ZDR",
     "moonshotai/kimi-k2.7-code": "Kimi K2.7 Code · Fireworks ZDR",
 };
+exports.CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
+/** Extract the private adapter marker used to carry a local block reason
+ * across OpenCode's generic 500 boundary. The marker never contains prompt or
+ * tool input — only the deterministic policy reason. */
+function extractCodieSecurityBlock(stderr) {
+    for (const line of stderr.split(/\r?\n/)) {
+        const markerIndex = line.indexOf(exports.CODIE_SECURITY_BLOCK_MARKER);
+        if (markerIndex < 0)
+            continue;
+        try {
+            const parsed = JSON.parse(line.slice(markerIndex + exports.CODIE_SECURITY_BLOCK_MARKER.length));
+            if (typeof parsed?.reason === "string" && parsed.reason.trim())
+                return parsed.reason.trim();
+        }
+        catch {
+            // Ignore malformed or foreign stderr and preserve the original runtime error.
+        }
+    }
+    return undefined;
+}
 /**
  * Pin non-interactive runs to the directory where `codie` was launched.
  * OpenCode can reuse a previously-known project instance; without an explicit

package/dist/connect.js

@@ -292,6 +292,7 @@ async function runConnect(args = []) {
         path.join(home, ".claude", "settings.json"),
         path.join(home, ".codex", "hooks.json"),
         path.join(home, ".config", "opencode", "plugins", "codiedev.js"),
+        path.join(home, ".codex", "config.toml"),
     ];
     // Snapshot before any hook update. Rollback is intentionally not automatic:
     // an administrator can inspect these 0600 copies before restoring them.

package/dist/hook.js

@@ -269,7 +269,7 @@ function postJsonForResponse(url, body, bearerToken, timeoutMs) {
 // Local policy runs synchronously before a tool executes. Workflow telemetry
 // is dispatched separately and fail-open, so a detector outage or timeout can
 // never delay or override the deterministic endpoint decision.
-async function runSecurityHook(hookInput, phase, source) {
+async function runSecurityHook(hookInput, phase, source, uploadTelemetry = true) {
     const config = (0, utils_1.readConfig)();
     if (!config || !(0, securityFeature_1.isAgentSecurityEnabled)(config))
         return;
@@ -292,7 +292,8 @@ async function runSecurityHook(hookInput, phase, source) {
             outcome: "ok",
             detail: `phase=${phase} localDecision=block category=${localDecision.category}`,
         });
-        dispatchSecurityEventUpload(event);
+        if (uploadTelemetry)
+            dispatchSecurityEventUpload(event);
         process.stdout.write(JSON.stringify({
             hookSpecificOutput: {
                 hookEventName: "PreToolUse",
@@ -304,16 +305,25 @@ async function runSecurityHook(hookInput, phase, source) {
     }
     if (!event)
         return;
-    dispatchSecurityEventUpload(event);
+    if (uploadTelemetry)
+        dispatchSecurityEventUpload(event);
 }
-function runPromptSecurityHook(hookInput, source) {
+function runPromptSecurityHook(hookInput, source, uploadTelemetry = true) {
     const config = (0, utils_1.readConfig)();
     if (!config || !(0, securityFeature_1.isAgentSecurityEnabled)(config))
         return false;
     const decision = (0, security_1.evaluatePromptSecurity)(hookInput.prompt, (0, securityPolicy_1.readEndpointSecurityPolicy)(undefined, undefined, config.companyId), source);
     if (decision.action !== "block")
         return false;
-    dispatchSecurityEventUpload((0, security_1.buildBlockedSecurityPromptEvent)(hookInput, source, decision.category ?? "secret_in_prompt"));
+    (0, captureLog_1.appendCaptureLog)({
+        stage: "security",
+        sessionId: hookInput.session_id ?? hookInput.sessionId ?? "unknown",
+        outcome: "ok",
+        detail: `phase=prompt localDecision=block category=${decision.category} telemetry=${uploadTelemetry ? "enabled" : "suppressed"} cwd=${hookInput.cwd ?? "unknown"}`,
+    });
+    if (uploadTelemetry) {
+        dispatchSecurityEventUpload((0, security_1.buildBlockedSecurityPromptEvent)(hookInput, source, decision.category ?? "secret_in_prompt"));
+    }
     process.stdout.write(JSON.stringify({
         decision: "block",
         reason: decision.reason,
@@ -566,13 +576,10 @@ async function main() {
     catch {
         process.exit(0);
     }
-    // Local privacy boundary: every stdin-driven hook mode passes through this
-    // check BEFORE prompt discovery, limit-event tails, SessionStart pings,
-    // backup, self-heal, transcript reads, or detached dispatch. Ignored means
-    // no Codiedev request at all for this session.
-    if ((0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput)) {
-        process.exit(0);
-    }
+    // Privacy exclusions suppress every Codiedev upload, but they must never
+    // disable local security enforcement. Security hooks run first with telemetry
+    // disabled; all other hook modes still exit before making a network request.
+    const captureIgnored = (0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput);
     const securityCommand = process.argv[2] ?? "";
     const securityMatch = securityCommand.match(/^security-(pre|post|failure)(?:-(codex|codie))?$/);
     if (securityMatch) {
@@ -581,7 +588,7 @@ async function main() {
             : securityMatch[2] === "codie"
                 ? "codie-harness"
                 : "claude-code";
-        await runSecurityHook(hookInput, securityMatch[1], source);
+        await runSecurityHook(hookInput, securityMatch[1], source, !captureIgnored);
         process.exit(0);
     }
     // UserPromptSubmit discovery path — separate from session capture.
@@ -596,12 +603,16 @@ async function main() {
                 : "claude-code";
         // Security runs first and locally. A blocked prompt is erased before it
         // reaches the model, so discovery must not send it to the backend.
-        if (runPromptSecurityHook(hookInput, source))
+        if (runPromptSecurityHook(hookInput, source, !captureIgnored))
+            return;
+        if (captureIgnored)
             return;
         dispatchAllowedPromptSecurityEvent(hookInput, source);
         await runDiscover(hookInput.prompt);
         return;
     }
+    if (captureIgnored)
+        process.exit(0);
     // StopFailure (matcher rate_limit): post the rate-limit event.
     if (process.argv[2] === "limit") {
         await runStopFailure(hookInput);

package/dist/securityInstall.d.ts

@@ -57,5 +57,6 @@ export declare function restoreSecurityInstallSnapshot(manifest: SecurityInstall
 export declare function inspectSecurityInstallation(paths?: {
     claudeSettingsPath?: string;
     codexHooksPath?: string;
+    codexConfigPath?: string;
     codiePluginPath?: string;
 }): SecurityInstallInspection[];

package/dist/securityInstall.js

@@ -45,6 +45,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const configDir_1 = require("./configDir");
 const detection_1 = require("./detection");
+const codexHookTrust_1 = require("./codexHookTrust");
 const version_1 = require("./version");
 const MANIFEST_FILE = "security-install.json";
 function sha256File(filePath) {
@@ -169,7 +170,7 @@ function hookCommands(parsed, eventName) {
     }
     return commands;
 }
-function inspectJsonSurface(surface, filePath) {
+function inspectJsonSurface(surface, filePath, codexConfigPath) {
     if (!fs.existsSync(filePath)) {
         return { surface, status: "not-installed", detail: `${filePath} not found` };
     }
@@ -180,14 +181,23 @@ function inspectJsonSurface(surface, filePath) {
             ["UserPromptSubmit", `discover${suffix}`],
             ["PreToolUse", `security-pre${suffix}`],
             ["PostToolUse", `security-post${suffix}`],
-            ["PostToolUseFailure", `security-failure${suffix}`],
+            ...(surface === "claude-code"
+                ? [["PostToolUseFailure", `security-failure${suffix}`]]
+                : []),
         ];
         const missing = expected
             .filter(([eventName, subcommand]) => !hookCommands(parsed, eventName).some((command) => command.trim().endsWith(subcommand)))
             .map(([eventName]) => eventName);
-        return missing.length === 0
-            ? { surface, status: "pass", detail: "prompt guard and tool telemetry hooks installed" }
-            : { surface, status: "fail", detail: `missing security hooks: ${missing.join(", ")}` };
+        if (missing.length > 0) {
+            return { surface, status: "fail", detail: `missing security hooks: ${missing.join(", ")}` };
+        }
+        if (surface === "codex") {
+            const trust = (0, codexHookTrust_1.inspectCodexHookTrust)(codexConfigPath ?? path.join(path.dirname(filePath), "config.toml"), filePath, parsed, ["discover-codex", "security-pre-codex", "security-post-codex"]);
+            if (!trust.ok) {
+                return { surface, status: "fail", detail: `Codex hook trust missing or stale (${trust.trusted}/${trust.total} trusted)` };
+            }
+        }
+        return { surface, status: "pass", detail: "prompt guard and tool telemetry hooks installed and active" };
     }
     catch (error) {
         return { surface, status: "fail", detail: `invalid hook configuration: ${error.message}` };
@@ -200,7 +210,7 @@ function inspectSecurityInstallation(paths = {}) {
     const codie = paths.codiePluginPath ?? path.join(home, ".config", "opencode", "plugins", "codiedev.js");
     const results = [
         inspectJsonSurface("claude-code", claude),
-        inspectJsonSurface("codex", codex),
+        inspectJsonSurface("codex", codex, paths.codexConfigPath),
     ];
     if (!fs.existsSync(codie)) {
         results.push({ surface: "codie-harness", status: "not-installed", detail: `${codie} not found` });

package/dist/utils.js

@@ -117,6 +117,7 @@ const detection_1 = require("./detection");
 const captureLog_1 = require("./captureLog");
 const configDir_1 = require("./configDir");
 Object.defineProperty(exports, "codiedevStateDir", { enumerable: true, get: function () { return configDir_1.codiedevStateDir; } });
+const codexHookTrust_1 = require("./codexHookTrust");
 const CONFIG_DIR = (0, configDir_1.codiedevStateDir)();
 exports.CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 function readConfig() {
@@ -1076,6 +1077,7 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `const AGENT_SECURITY_ENABLED = ${JSON.stringify(agentSecurityEnabled)};\n` +
         `const fingerprints = new Map();\n\n` +
         `const transcriptPaths = new Map();\n\n` +
+        `const sessionDirectories = new Map();\n\n` +
         `function sessionId(event) {\n` +
         `  return event?.properties?.sessionID ?? event?.properties?.sessionId ?? event?.properties?.info?.id ?? null;\n` +
         `}\n\n` +
@@ -1091,20 +1093,44 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `}\n\n` +
         `function enforceSync(invocation, payload) {\n` +
         `  const result = spawnSync(invocation.command, invocation.args, { input: JSON.stringify(payload), encoding: "utf8", stdio: ["pipe", "pipe", "ignore"], timeout: 1500 });\n` +
-        `  if (result.error) return;\n` +
+        `  if (result.error) return null;\n` +
         `  try {\n` +
         `    const decision = JSON.parse(result.stdout || "{}");\n` +
         `    const denied = decision?.decision === "block" || decision?.hookSpecificOutput?.permissionDecision === "deny";\n` +
-        `    if (denied) throw new Error(decision?.reason || decision?.hookSpecificOutput?.permissionDecisionReason || "Codie security policy blocked this action");\n` +
+        `    return denied ? (decision?.reason || decision?.hookSpecificOutput?.permissionDecisionReason || "Codie security policy blocked this action") : null;\n` +
         `  } catch (error) {\n` +
-        `    if (error instanceof SyntaxError) return;\n` +
-        `    throw error;\n` +
+        `    if (error instanceof SyntaxError) return null;\n` +
+        `    return null;\n` +
         `  }\n` +
         `}\n\n` +
         `export const CodiedevCapture = async ({ client, directory, worktree }) => {\n` +
+        `  const enforce = async (invocation, payload) => {\n` +
+        `    const reason = enforceSync(invocation, payload);\n` +
+        `    if (!reason) return;\n` +
+        `    try { await client.tui.showToast({ title: "Codie Security", message: reason, variant: "error", duration: 10000 }); } catch {}\n` +
+        `    if (process.env.CODIEDEV_SECURITY_BLOCK_OUTPUT === "marker") {\n` +
+        `      process.stderr.write("__CODIEDEV_SECURITY_BLOCK__" + JSON.stringify({ reason }) + "\\n");\n` +
+        `    } else {\n` +
+        `      process.stderr.write("\\nCodie Security blocked this action:\\n" + reason + "\\n");\n` +
+        `    }\n` +
+        `    throw new Error(reason);\n` +
+        `  };\n` +
+        `  const resolveCwd = async (id, hint) => {\n` +
+        `    if (typeof hint === "string" && hint && hint !== "/") { sessionDirectories.set(id, hint); return hint; }\n` +
+        `    const remembered = sessionDirectories.get(id);\n` +
+        `    if (remembered) return remembered;\n` +
+        `    try {\n` +
+        `      const response = await client.session.get({ path: { id } });\n` +
+        `      const session = response?.data ?? response;\n` +
+        `      if (typeof session?.directory === "string" && session.directory) { sessionDirectories.set(id, session.directory); return session.directory; }\n` +
+        `    } catch {}\n` +
+        `    const fallback = worktree || directory || process.cwd();\n` +
+        `    sessionDirectories.set(id, fallback);\n` +
+        `    return fallback;\n` +
+        `  };\n` +
         `  const finalizeAll = () => {\n` +
         `    for (const [id, transcriptPath] of transcriptPaths) {\n` +
-        `      const cwd = worktree || directory || process.cwd();\n` +
+        `      const cwd = sessionDirectories.get(id) || worktree || directory || process.cwd();\n` +
         `      dispatchSync(FINISH, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
         `    }\n` +
         `  };\n` +
@@ -1112,25 +1138,27 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `  return ({\n` +
         `  "chat.message": async (input, output) => {\n` +
         `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
-        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const cwd = await resolveCwd(id);\n` +
         `    const prompt = Array.isArray(output?.parts) ? output.parts.filter((part) => part?.type === "text").map((part) => part.text || "").join("\\n") : "";\n` +
-        `    enforceSync(PROMPT, { sessionId: id, cwd, prompt });\n` +
+        `    await enforce(PROMPT, { sessionId: id, cwd, prompt });\n` +
         `  },\n` +
         `  "tool.execute.before": async (input, output) => {\n` +
         `    if (!AGENT_SECURITY_ENABLED) return;\n` +
-        `    const cwd = worktree || directory || process.cwd();\n` +
-        `    enforceSync(SECURITY_PRE, { sessionId: input?.sessionID ?? input?.sessionId ?? "unknown", cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: output?.args ?? output });\n` +
+        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
+        `    const cwd = await resolveCwd(id);\n` +
+        `    await enforce(SECURITY_PRE, { sessionId: id, cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: output?.args ?? output });\n` +
         `  },\n` +
         `  "tool.execute.after": async (input, output) => {\n` +
         `    if (!AGENT_SECURITY_ENABLED) return;\n` +
-        `    const cwd = worktree || directory || process.cwd();\n` +
-        `    const payload = { sessionId: input?.sessionID ?? input?.sessionId ?? "unknown", cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: input?.args, toolResponse: output };\n` +
+        `    const id = input?.sessionID ?? input?.sessionId ?? "unknown";\n` +
+        `    const cwd = await resolveCwd(id);\n` +
+        `    const payload = { sessionId: id, cwd, toolName: input?.tool ?? "unknown", toolUseId: input?.callID, toolInput: input?.args, toolResponse: output };\n` +
         `    dispatch(output?.error ? SECURITY_FAILURE : SECURITY_POST, payload);\n` +
         `  },\n` +
         `  event: async ({ event }) => {\n` +
         `    const id = sessionId(event);\n` +
         `    if (!id) return;\n` +
-        `    const cwd = worktree || directory || process.cwd();\n` +
+        `    const cwd = await resolveCwd(id, event?.properties?.info?.directory);\n` +
         `    if (event.type === "session.created") {\n` +
         `      dispatch(START, { session_id: id, cwd, workspace_roots: [cwd] });\n` +
         `      return;\n` +
@@ -1139,6 +1167,7 @@ function installOpenCodeCapturePlugin(agentSecurityEnabled = true) {
         `      const transcriptPath = transcriptPaths.get(id);\n` +
         `      if (transcriptPath) dispatch(FINISH, { session_id: id, transcript_path: transcriptPath, cwd, workspace_roots: [cwd] });\n` +
         `      transcriptPaths.delete(id);\n` +
+        `      sessionDirectories.delete(id);\n` +
         `      fingerprints.delete(id);\n` +
         `      return;\n` +
         `    }\n` +
@@ -1908,6 +1937,7 @@ function installCodexHook(agentSecurityEnabled = true) {
         fs.mkdirSync(CODEX_DIR, { recursive: true });
     }
     fs.writeFileSync(CODEX_HOOKS_PATH, JSON.stringify(hooksFile, null, 2), "utf8");
+    (0, codexHookTrust_1.writeCodexHookTrust)(CODEX_CONFIG_PATH, CODEX_HOOKS_PATH, hooksFile);
 }
 // Cursor's hooks.json uses { version: 1, hooks: { sessionEnd: [{ command, type, timeout }] } }.
 // `sessionEnd` fires when a conversation closes (completed, aborted, error,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.9.39",
+  "version": "0.9.41",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",