commandmate 0.44.2 → 0.44.3

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -34,6 +34,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeAgentEventSource = void 0;
 exports.encodeClaudeVerdict = encodeClaudeVerdict;
+const uat_isolation_1 = require("../../../../config/uat-isolation");
 const agent_event_types_1 = require("../../../../lib/hooks/agent-event-types");
 const ask_user_question_payload_1 = require("../../../../lib/hooks/ask-user-question-payload");
 const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
@@ -42,6 +43,7 @@ const define_source_1 = require("../define-source");
 const event_mapper_1 = require("../event-mapper");
 const hook_event_vocabulary_1 = require("../hook-event-vocabulary");
 const model_switch_1 = require("./model-switch");
+const queued_notice_1 = require("./queued-notice");
 const tool_id_1 = require("./tool-id");
 /**
  * The no-decision body, byte for byte what the #1721 spike returned for D5.
@@ -158,6 +160,9 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
     // the latch. `extractModel` runs before `modelFields`, and answers null for
     // every other event so the flat lookup above is unchanged for them.
     extractModel: model_switch_1.extractClaudeSwitchedModel,
+    // Issue #3330. A background-task notice attached to the running turn fires
+    // `UserPromptSubmit` too, and continues that turn rather than opening one.
+    promptJoinsOpenTurn: queued_notice_1.isClaudeQueuedNoticePrompt,
     // S2.
     extractDetail: hook_event_vocabulary_1.extractSnakeCaseEventDetail,
     // S7. Both parsers are strict and answer null for anything they cannot vouch
@@ -171,22 +176,47 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
     // writes the settings file, falls back to the bare path on any failure, and is
     // covered byte-for-byte by `tests/unit/hooks/hook-settings-generator.test.ts`.
     prepareLaunch: ({ target, executablePath }) => {
-        const command = (0, hook_settings_generator_1.buildClaudeLaunchCommand)(executablePath, {
+        // Issue #3312: under `own-home` the settings file goes in only once its
+        // directory and the file itself check out inside the dedicated user's
+        // HOME; else the launch is refused.
+        const ownHome = (0, uat_isolation_1.getUatIsolationMode)() === 'own-home';
+        const hookTarget = {
             worktreeId: target.worktreeId,
             instanceId: target.instanceId,
             cliToolId: target.cliToolId,
-        });
+        };
+        if ((0, hook_settings_generator_1.isHookInjectionEnabled)()) {
+            (0, uat_isolation_1.assertUatOwnHomeWriteTargets)(tool_id_1.CLAUDE_CLI_TOOL_ID, [
+                (0, hook_settings_generator_1.getHookSettingsDirectory)(),
+                (0, hook_settings_generator_1.getHookSettingsPath)(hookTarget),
+            ]);
+        }
+        const baseCommand = (0, hook_settings_generator_1.buildClaudeLaunchCommand)(executablePath, hookTarget);
+        // Issue #3312: under `own-home` a claude without its settings file is a
+        // check that cannot see `hook_stop`, so injection switched off or a file
+        // that could not be written refuses the launch. `1` and normal mode keep
+        // starting the bare executable.
+        if (ownHome && baseCommand === executablePath) {
+            throw new uat_isolation_1.UatIsolationLaunchRefusedError(tool_id_1.CLAUDE_CLI_TOOL_ID, (0, hook_settings_generator_1.isHookInjectionEnabled)() ? 'the hook settings file could not be written' : 'CM_AGENT_HOOKS_INJECT=0', (0, hook_settings_generator_1.isHookInjectionEnabled)()
+                ? 'Make CM_AGENT_HOOKS_DIR writable by the dedicated user.'
+                : 'Do not combine CM_AGENT_HOOKS_INJECT=0 with own-home.');
+        }
         // The path is reported only when the command actually names it. Injection
         // can be switched off (`CM_AGENT_HOOKS_INJECT=0`) or fail to write, and both
         // return the bare executable — claiming a settings file in that case would
         // be telling the caller about a file that is not there.
-        const settingsPath = (0, hook_settings_generator_1.isHookInjectionEnabled)() && command !== executablePath
+        const settingsPath = (0, hook_settings_generator_1.isHookInjectionEnabled)() && baseCommand !== executablePath
             ? (0, hook_settings_generator_1.getHookSettingsPath)({
                 worktreeId: target.worktreeId,
                 instanceId: target.instanceId,
                 cliToolId: target.cliToolId,
             })
             : null;
+        // Issue #3360: in UAT isolation the user's own `~/.claude/settings.json`
+        // (whose hooks post to production) is not loaded; `--settings` still is.
+        const command = (0, uat_isolation_1.isUatIsolationEnabled)()
+            ? `${baseCommand} --setting-sources ${uat_isolation_1.CLAUDE_UAT_SETTING_SOURCES}`
+            : baseCommand;
         // Empty, and the only source for which that is uninteresting: `--settings`
         // carries the correlation keys inside the file, so Claude never needed the
         // environment prefix the other four sources reached for (#1846).

package/dist/server/src/lib/hooks/sources/claude/transcript.js

@@ -297,18 +297,12 @@ function readToolDetail(input) {
     for (const field of CLAUDE_TOOL_DETAIL_FIELDS) {
         const value = (0, event_mapper_1.readStringField)(input, field);
         if (value)
-            return boundToolDetail(collapseToLine(value));
+            return boundToolDetail((0, turn_body_1.collapseToLine)(value));
     }
     return null;
 }
-/** A tool detail on one line. A heredoc `command` puts newlines in it. */
-function collapseToLine(value) {
-    return value.replace(/\s+/g, ' ').trim();
-}
 function boundToolDetail(value) {
-    return value.length <= exports.MAX_CLAUDE_TOOL_DETAIL_LENGTH
-        ? value
-        : `${value.slice(0, exports.MAX_CLAUDE_TOOL_DETAIL_LENGTH - 1)}…`;
+    return (0, turn_body_1.boundDetail)(value, exports.MAX_CLAUDE_TOOL_DETAIL_LENGTH);
 }
 /**
  * Read one parsed transcript line.
@@ -787,11 +781,7 @@ function renderClaudeTurn(turn) {
             unknown.add(block.type);
     }
     let body = (0, turn_body_1.separateTurnBody)(rendered).body;
-    if (body.length > exports.MAX_CLAUDE_TURN_BODY_LENGTH) {
-        body =
-            body.slice(0, exports.MAX_CLAUDE_TURN_BODY_LENGTH - exports.CLAUDE_TURN_TRUNCATION_MARKER.length) +
-                exports.CLAUDE_TURN_TRUNCATION_MARKER;
-    }
+    body = (0, turn_body_1.truncateTurnBody)(body, exports.MAX_CLAUDE_TURN_BODY_LENGTH, exports.CLAUDE_TURN_TRUNCATION_MARKER);
     return {
         sessionId: turn.sessionId,
         promptUuid: turn.promptUuid,

package/dist/server/src/lib/hooks/sources/codex/history.js

@@ -95,6 +95,7 @@ exports.isCodexRolloutFileFor = isCodexRolloutFileFor;
 exports.findCodexRolloutPath = findCodexRolloutPath;
 exports.captureCodexTranscriptTurn = captureCodexTranscriptTurn;
 exports.resolveCodexTranscriptPath = resolveCodexTranscriptPath;
+const global_state_1 = require("../../../../lib/global-state");
 const promises_1 = require("fs/promises");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -104,6 +105,7 @@ const user_turn_recorder_1 = require("../../../../lib/history/user-turn-recorder
 const assistant_response_saver_1 = require("../../../../lib/assistant-response-saver");
 const logger_1 = require("../../../../lib/logger");
 const agent_transcript_1 = require("../../../../types/agent-transcript");
+const transcript_history_1 = require("../transcript-history");
 const transcript_1 = require("./transcript");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/codex/history');
 /**
@@ -151,7 +153,7 @@ const CODEX_SESSION_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-
  * codex sends `session_id` on every event it delivers — but a future one that
  * did not would otherwise blank the pointer mid-session.
  */
-const sessionPointers = (globalThis.__codexTranscriptSessions ??= new Map());
+const sessionPointers = (0, global_state_1.getOrInitGlobal)('__codexTranscriptSessions', () => new Map());
 /**
  * Where each session id's rollout file was found.
  *
@@ -161,7 +163,7 @@ const sessionPointers = (globalThis.__codexTranscriptSessions ??= new Map());
  * session started, which is not derivable from the id — and a scan of 1,791
  * files on every finished turn is not something to do twice.
  */
-const rolloutPaths = (globalThis.__codexTranscriptPaths ??= new Map());
+const rolloutPaths = (0, global_state_1.getOrInitGlobal)('__codexTranscriptPaths', () => new Map());
 function keyOf(target) {
     return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
 }
@@ -185,24 +187,7 @@ function resetCodexTranscriptSessions() {
  * keeps being the only record, which is merely the status quo.
  */
 async function resolveCodexSessionId(target) {
-    const key = keyOf(target);
-    try {
-        const { getLastAgentEvent } = await Promise.resolve().then(() => __importStar(require('../../../../lib/session/agent-event-state')));
-        const sessionId = getLastAgentEvent(target.worktreeId, target.cliToolId, target.instanceId)?.sessionId;
-        if (typeof sessionId === 'string' && sessionId.length > 0) {
-            sessionPointers.set(key, sessionId);
-            return sessionId;
-        }
-    }
-    catch (error) {
-        // A state module that cannot be reached is one that knows no session id.
-        logger.debug('codex-transcript-session-lookup-failed', {
-            worktreeId: target.worktreeId,
-            instanceId: target.instanceId ?? target.cliToolId,
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
-    return sessionPointers.get(key) ?? null;
+    return (0, transcript_history_1.resolveSessionIdFromEvents)(target, sessionPointers, keyOf(target), logger, 'codex-transcript-session-lookup-failed');
 }
 /**
  * `$CODEX_HOME`, or `~/.codex`.
@@ -234,15 +219,7 @@ function codexSessionsRoot(codexHome) {
  * @returns The resolved path, or null when it is not acceptable
  */
 function acceptCodexRolloutPath(codexHome, candidate) {
-    if (!candidate.endsWith(transcript_1.CODEX_ROLLOUT_EXTENSION))
-        return null;
-    if (candidate.includes('\0'))
-        return null;
-    const root = (0, path_1.resolve)(codexSessionsRoot(codexHome));
-    const resolved = (0, path_1.resolve)(candidate);
-    if (resolved !== root && !resolved.startsWith(root + path_1.sep))
-        return null;
-    return resolved;
+    return (0, transcript_history_1.acceptPathUnderRoot)(codexSessionsRoot(codexHome), transcript_1.CODEX_ROLLOUT_EXTENSION, candidate);
 }
 /** Whether a file name is the rollout of this session. */
 function isCodexRolloutFileFor(name, sessionId) {
@@ -440,7 +417,7 @@ async function captureCodexTranscriptTurn(target, capture = {}, report) {
         let captured = false;
         for (let index = 0; index < pending.turns.length; index += 1) {
             const turn = pending.turns[index];
-            captured = await writeCodexTurn(target, turn, (0, transcript_1.renderCodexTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastRecordAt.get(turn.turnId) ?? 0, nextTurnOpensAt(pending.turns, userRows, index)), windowFacts, report);
+            captured = await writeCodexTurn(target, turn, (0, transcript_1.renderCodexTurn)(turn), (0, transcript_history_1.resolveAssistantTimestampMs)(turn, userRows[index], lastRecordAt.get(turn.turnId) ?? 0, (0, transcript_history_1.nextTurnOpensAt)(pending.turns, userRows, index)), windowFacts, report);
         }
         if (captured) {
             // Issue #2437: History now holds this turn as the agent's own Markdown.
@@ -506,26 +483,7 @@ function firstCodexRecordAt(records) {
  * @param turns - Every turn in the window, oldest first
  */
 async function selectUnwrittenCodexTurns(target, turns) {
-    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-    ]);
-    const db = getDbInstance();
-    for (let index = turns.length - 1; index >= 0; index -= 1) {
-        const requestId = (0, agent_transcript_1.codexTurnRequestId)(turns[index].turnId);
-        if (!findMessageByRequestId(db, target.worktreeId, requestId))
-            continue;
-        return {
-            turns: turns.slice(index + 1),
-            previousStartedAt: turns[index].startedAt,
-            anchored: true,
-        };
-    }
-    return {
-        turns: turns.slice(-1),
-        previousStartedAt: turns.length > 1 ? turns[turns.length - 2].startedAt : 0,
-        anchored: false,
-    };
+    return (0, transcript_history_1.selectUnwrittenTurns)(target, turns, (turn) => (0, agent_transcript_1.codexTurnRequestId)(turn.turnId));
 }
 /**
  * The rollout file for this session, or null.
@@ -537,7 +495,7 @@ async function selectUnwrittenCodexTurns(target, turns) {
 async function locateCodexRollout(codexHome, sessionId) {
     const memoKey = `${codexHome}\0${sessionId}`;
     const memoised = rolloutPaths.get(memoKey);
-    if (memoised && (await isReadableFile(memoised)))
+    if (memoised && (await (0, transcript_history_1.isReadableFile)(memoised)))
         return memoised;
     if (memoised)
         rolloutPaths.delete(memoKey);
@@ -550,14 +508,6 @@ async function locateCodexRollout(codexHome, sessionId) {
     rolloutPaths.set(memoKey, accepted);
     return accepted;
 }
-async function isReadableFile(path) {
-    try {
-        return (await (0, promises_1.stat)(path)).isFile();
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Record every prompt this turn answers, before the reply is written (#2196).
  *
@@ -598,7 +548,7 @@ async function recordCodexUserTurns(target, turn, previousStartedAt = 0) {
     }
     return last;
 }
-/**
+/*
  * When the assistant row for this turn is dated.
  *
  * **The turn's LAST record, not its first (Issue #2273).** #2197 dated the reply
@@ -626,13 +576,6 @@ async function recordCodexUserTurns(target, turn, previousStartedAt = 0) {
  * @param nextTurnOpensAt - Epoch ms of the next turn's user row, or null when
  *   this is the newest turn in the window
  */
-function resolveAssistantTimestampMs(turn, userRow, lastRecordAt = 0, nextTurnOpensAt = null) {
-    const earliest = userRow.timestampMs === null
-        ? turn.startedAt
-        : Math.max(turn.startedAt, userRow.timestampMs + 1);
-    const latest = nextTurnOpensAt === null ? Number.POSITIVE_INFINITY : nextTurnOpensAt - 1;
-    return Math.max(earliest, Math.min(lastRecordAt, latest));
-}
 /**
  * When each turn's last record was written (Issue #2273).
  *
@@ -660,7 +603,7 @@ function lastCodexRecordAt(records) {
     }
     return at;
 }
-/**
+/*
  * The instant the next pending turn's prompt row carries, or null (Issue #2273).
  *
  * The user row's own timestamp when there is one, because that is what History
@@ -669,12 +612,6 @@ function lastCodexRecordAt(records) {
  * prompt is while the previous turn was still running. The turn's start is the
  * fallback for a turn that produced no row at all.
  */
-function nextTurnOpensAt(turns, userRows, index) {
-    const next = turns[index + 1];
-    if (!next)
-        return null;
-    return userRows[index + 1]?.timestampMs ?? next.startedAt;
-}
 /**
  * Write one rendered turn, unless it is already there.
  *

package/dist/server/src/lib/hooks/sources/codex/hooks-config.js

@@ -63,7 +63,9 @@
  * start. Those post too, with the environment variables unset; the relay omits
  * the correlation keys it does not have and the receiver falls back to
  * resolving the worktree from `cwd`, which is exactly the hand-configured
- * behaviour of Issue #1549. `CM_AGENT_HOOKS_INJECT=0` turns the whole thing off.
+ * behaviour of Issue #1549. `CM_AGENT_HOOKS_INJECT=0` turns the whole thing off;
+ * `CM_UAT_ISOLATION=1` keeps it on without writing any shared file (Issue #3360,
+ * {@link reuseCodexHookSettingsReadOnly}).
  *
  * ## The shared app-server daemon (Issue #2874)
  *
@@ -96,12 +98,15 @@ exports.buildCodexPermissionHookCommand = buildCodexPermissionHookCommand;
 exports.buildCodexHookSettings = buildCodexHookSettings;
 exports.mergeCodexHookSettings = mergeCodexHookSettings;
 exports.writeCodexHookSettings = writeCodexHookSettings;
+exports.inspectCodexSharedHooksReadOnly = inspectCodexSharedHooksReadOnly;
+exports.reuseCodexHookSettingsReadOnly = reuseCodexHookSettingsReadOnly;
 exports.buildCodexLaunchPlan = buildCodexLaunchPlan;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const safe_directory_1 = require("../../../../config/safe-directory");
+const uat_isolation_1 = require("../../../../config/uat-isolation");
 const types_1 = require("../../../../lib/cli-tools/types");
 const env_1 = require("../../../../lib/env");
 const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
@@ -313,6 +318,13 @@ function isCodexHookTrustBypassEnabled() {
 function shouldTrustCodexHooks(worktreePath) {
     if (resolveCodexHookTrustPolicy() === 'never')
         return false;
+    // Issue #3360: a grant is codex writing the user's own `config.toml`, which a
+    // UAT / daily-check server must not cause. Declined, the hooks stay inert for
+    // that session — the "no hooks" case the UAT already has to tolerate.
+    // Issue #3312: under `own-home` the `config.toml` is the dedicated user's and
+    // was checked with the rest of `$CODEX_HOME` before the launch, so it may.
+    if ((0, uat_isolation_1.getUatIsolationMode)() === 'shared-read-only')
+        return false;
     try {
         // codex reads `<cwd>/.codex/hooks.json` as well as the home one, and a
         // review that includes a hook from the repository is a review this server
@@ -531,6 +543,10 @@ function mergeCodexHookSettings(existing, generated) {
     base.hooks = merged;
     return base;
 }
+/** The bytes `hooks.json` should hold, given what it holds now. */
+function renderCodexHookSettings(existing, options) {
+    return `${JSON.stringify(mergeCodexHookSettings(existing, buildCodexHookSettings(options)), null, 2)}\n`;
+}
 /**
  * Write the hooks file, and answer where it is.
  *
@@ -543,6 +559,21 @@ function mergeCodexHookSettings(existing, generated) {
  */
 function writeCodexHookSettings(options = {}) {
     const settingsPath = getCodexHooksPath(options);
+    // Issue #3360: UAT isolation never writes the shared files. See
+    // {@link reuseCodexHookSettingsReadOnly}. Issue #3312: `own-home` writes
+    // them, after checking every path below is inside the dedicated user's HOME
+    // (and refuses the launch when one is not).
+    const codexHome = getCodexHome(options);
+    const relayPath = (0, relay_install_1.getCodexRelayInstallPath)(codexHome);
+    const policy = (0, uat_isolation_1.sharedHookWritePolicy)('codex', [
+        codexHome,
+        settingsPath,
+        relayPath,
+        (0, relay_install_1.getCodexRelayStagingPath)(relayPath),
+        (0, path_1.join)(codexHome, 'config.toml'),
+    ]);
+    if (policy === 'read-only')
+        return reuseCodexHookSettingsReadOnly(options);
     // Issue #2315: put the relay where the generated file can name it without
     // naming a checkout, BEFORE the content is built — `buildCodexHookSettings`
     // only reads what is installed, so an install that had not happened yet would
@@ -550,7 +581,15 @@ function writeCodexHookSettings(options = {}) {
     // between. Best-effort by construction: the installer never throws, and a
     // machine where it cannot write simply keeps whatever copy is already there.
     if (options.relayScriptPath === undefined) {
-        (0, relay_install_1.installCodexRelayScript)(getCodexHome(options), (0, hook_settings_generator_1.resolveRelayScriptPath)());
+        if ((0, uat_isolation_1.getUatIsolationMode)() === 'own-home') {
+            // Issue #3312: a relay that could not be updated is a failed
+            // preparation here (the caller refuses the launch), not an older relay
+            // the check would quietly run against.
+            (0, relay_install_1.installCodexRelayScriptOrThrow)(codexHome, (0, hook_settings_generator_1.resolveRelayScriptPath)());
+        }
+        else {
+            (0, relay_install_1.installCodexRelayScript)(codexHome, (0, hook_settings_generator_1.resolveRelayScriptPath)());
+        }
     }
     let existing = null;
     let previous = null;
@@ -569,19 +608,100 @@ function writeCodexHookSettings(options = {}) {
             return null;
         }
     }
-    const content = `${JSON.stringify(mergeCodexHookSettings(existing, buildCodexHookSettings(options)), null, 2)}\n`;
+    const content = renderCodexHookSettings(existing, options);
     if (previous === content)
         return settingsPath;
     (0, fs_1.mkdirSync)((0, path_1.dirname)(settingsPath), { recursive: true, mode: 0o700 });
     (0, fs_1.writeFileSync)(settingsPath, content, { mode: 0o600 });
     return settingsPath;
 }
+/**
+ * Whether the shared `$CODEX_HOME/hooks.json` may be used, unwritten, by a
+ * server in UAT isolation mode (`CM_UAT_ISOLATION=1`, Issue #3360).
+ *
+ * `$CODEX_HOME/hooks.json`, the installed relay and the hook trust in
+ * `config.toml` are shared with the user's production server and live beside
+ * codex's login, so they cannot be moved for a UAT either. They do not need to
+ * be written to work for one: the file holds no port, worktree or instance —
+ * {@link buildCodexLaunchPlan} hands those to the session in its environment —
+ * so a file production has already written delivers this session's events to
+ * THIS server.
+ *
+ * Usable means exactly one thing: the file is byte-identical to what this build
+ * writes into an EMPTY file. Comparing against the merge with what is there
+ * ({@link mergeCodexHookSettings}) would not do — the merge keeps the user's own
+ * handlers, so a file holding a hand-written hook that posts straight to
+ * production would compare equal and run in the UAT session. So these are all
+ * unusable, each with its reason: no file, an unreadable one, hooks or keys
+ * CommandMate did not write, a file this build would change (a newer or older
+ * CommandMate), or an installed relay whose bytes differ from the one this build
+ * ships (the command string would match while running another script).
+ */
+function inspectCodexSharedHooksReadOnly(options = {}) {
+    const settingsPath = getCodexHooksPath(options);
+    if (options.relayScriptPath === undefined) {
+        const shipped = (0, hook_settings_generator_1.resolveRelayScriptPath)();
+        const installed = (0, relay_install_1.getCodexRelayInstallPath)(getCodexHome(options));
+        try {
+            if (shipped &&
+                (0, fs_1.existsSync)(installed) &&
+                (0, fs_1.readFileSync)(shipped, 'utf8') !== (0, fs_1.readFileSync)(installed, 'utf8')) {
+                logger.info('codex-hooks-shared-relay-differs-readonly', { installed });
+                return { usable: false, reason: `the installed relay ${installed} differs from the one this build ships`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+            }
+        }
+        catch {
+            return { usable: false, reason: `the installed relay ${installed} could not be read`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+        }
+    }
+    try {
+        if (!(0, fs_1.existsSync)(settingsPath)) {
+            logger.info('codex-hooks-shared-absent-readonly', { settingsPath });
+            return { usable: false, reason: `${settingsPath} does not exist`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+        }
+        const previous = (0, fs_1.readFileSync)(settingsPath, 'utf8');
+        if (previous === renderCodexHookSettings(null, options)) {
+            return { usable: true, settingsPath };
+        }
+        if (previous === renderCodexHookSettings(JSON.parse(previous), options)) {
+            logger.info('codex-hooks-shared-foreign-readonly', { settingsPath });
+            return {
+                usable: false,
+                reason: `${settingsPath} also holds hooks (or keys) CommandMate did not write, which would run in the UAT session`,
+                fix: 'Skip codex scenarios in this UAT, or run it where the shared hooks file holds only the hooks CommandMate writes.',
+            };
+        }
+        logger.info('codex-hooks-shared-differs-readonly', { settingsPath });
+        return { usable: false, reason: `${settingsPath} differs from what this build writes`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+    }
+    catch (error) {
+        logger.warn('codex-hooks-config-unreadable', {
+            settingsPath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return { usable: false, reason: `${settingsPath} could not be read`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+    }
+}
+/**
+ * {@link writeCodexHookSettings} for a server in UAT isolation mode: the path
+ * when {@link inspectCodexSharedHooksReadOnly} finds the shared file usable,
+ * else null — which the launch plan turns into a refused launch
+ * ({@link UatIsolationLaunchRefusedError}), not "codex without hooks", because
+ * a bare codex reads the shared file anyway.
+ */
+function reuseCodexHookSettingsReadOnly(options = {}) {
+    const inspection = inspectCodexSharedHooksReadOnly(options);
+    return inspection.usable ? inspection.settingsPath : null;
+}
 /**
  * The plan that starts codex for one instance.
  *
- * Never throws: hooks are an enhancement to a session that has to start anyway,
- * so anything that goes wrong here returns the bare executable — which is
- * byte-for-byte the pre-#1760 launch.
+ * Never throws outside UAT isolation: hooks are an enhancement to a session
+ * that has to start anyway, so anything that goes wrong here returns the bare
+ * executable — which is byte-for-byte the pre-#1760 launch. Under
+ * `CM_UAT_ISOLATION=1` (Issue #3360) each of those roads throws
+ * {@link UatIsolationLaunchRefusedError} instead: a bare codex still reads the
+ * shared, trusted `hooks.json`.
  *
  * The environment assignments are the per-session half of the design. The
  * hooks file cannot hold them (there is one file for the machine), the payload
@@ -604,19 +724,33 @@ function writeCodexHookSettings(options = {}) {
  */
 function buildCodexLaunchPlan(executablePath, target, options = {}) {
     const bare = { command: executablePath, settingsPath: null, env: {} };
-    if (!(0, hook_settings_generator_1.isHookInjectionEnabled)())
+    // Issue #3360: under UAT isolation every road to `bare` is refused instead.
+    // A bare codex still reads `$CODEX_HOME/hooks.json` — production's trusted
+    // hooks, with no correlation keys and no `--no-daemon` — so "without hooks"
+    // would really be "with production's hooks, posting to production".
+    const fallback = (reason, fix) => {
+        if ((0, uat_isolation_1.isUatIsolationEnabled)())
+            throw new uat_isolation_1.UatIsolationLaunchRefusedError('codex', reason, fix);
         return bare;
+    };
+    if (!(0, hook_settings_generator_1.isHookInjectionEnabled)()) {
+        return fallback('CM_AGENT_HOOKS_INJECT=0', 'Do not combine CM_AGENT_HOOKS_INJECT=0 with UAT isolation.');
+    }
     const instanceId = target.instanceId ?? tool_id_1.CODEX_CLI_TOOL_ID;
     if (!(0, path_validator_1.isValidWorktreeId)(target.worktreeId) || !(0, types_1.isValidInstanceId)(instanceId)) {
         // Both become URL parameters the receiver re-validates; a value that would
         // be rejected there is not worth injecting.
         logger.warn('codex-hooks-invalid-correlation-key', { worktreeId: target.worktreeId });
-        return bare;
+        return fallback('the worktree or instance id is not a valid correlation key', 'Use a valid worktree and instance id.');
     }
     try {
         const settingsPath = writeCodexHookSettings(options);
-        if (!settingsPath)
-            return bare;
+        if (!settingsPath) {
+            const inspection = (0, uat_isolation_1.getUatIsolationMode)() === 'shared-read-only' ? inspectCodexSharedHooksReadOnly(options) : null;
+            if (inspection && !inspection.usable)
+                return fallback(inspection.reason, inspection.fix);
+            return fallback(`${getCodexHooksPath(options)} or its relay is missing or differs from what this build writes`, uat_isolation_1.UAT_SAME_BUILD_FIX);
+        }
         const port = options.port ?? (0, env_1.getServerPort)();
         const query = new URLSearchParams({
             tool: tool_id_1.CODEX_CLI_TOOL_ID,
@@ -652,10 +786,12 @@ function buildCodexLaunchPlan(executablePath, target, options = {}) {
         };
     }
     catch (error) {
+        if (error instanceof uat_isolation_1.UatIsolationLaunchRefusedError)
+            throw error;
         logger.warn('codex-hooks-config-write-failed', {
             worktreeId: target.worktreeId,
             error: error instanceof Error ? error.message : String(error),
         });
-        return bare;
+        return fallback(`the hook config could not be prepared (${error instanceof Error ? error.message : String(error)})`, uat_isolation_1.UAT_SAME_BUILD_FIX);
     }
 }

package/dist/server/src/lib/hooks/sources/codex/relay-install.js

@@ -57,6 +57,8 @@ exports.CODEX_RELAY_INSTALL_BASENAME = exports.CODEX_RELAY_INSTALL_DIRNAME = voi
 exports.getCodexRelayInstallPath = getCodexRelayInstallPath;
 exports.getInstalledCodexRelayPath = getInstalledCodexRelayPath;
 exports.installCodexRelayScript = installCodexRelayScript;
+exports.installCodexRelayScriptOrThrow = installCodexRelayScriptOrThrow;
+exports.getCodexRelayStagingPath = getCodexRelayStagingPath;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const logger_1 = require("../../../../lib/logger");
@@ -109,27 +111,7 @@ function installCodexRelayScript(codexHome, sourcePath) {
     const target = getCodexRelayInstallPath(codexHome);
     if (sourcePath && sourcePath !== target) {
         try {
-            const desired = (0, fs_1.readFileSync)(sourcePath, 'utf8');
-            const current = (0, fs_1.existsSync)(target) ? (0, fs_1.readFileSync)(target, 'utf8') : null;
-            if (current !== desired) {
-                (0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true, mode: 0o700 });
-                // `.tmp` beside the target so the rename cannot cross a filesystem.
-                const staging = `${target}.tmp`;
-                try {
-                    (0, fs_1.writeFileSync)(staging, desired, { mode: 0o700 });
-                    (0, fs_1.renameSync)(staging, target);
-                }
-                catch (error) {
-                    try {
-                        (0, fs_1.unlinkSync)(staging);
-                    }
-                    catch {
-                        // Nothing to clean up, or nothing that can be.
-                    }
-                    throw error;
-                }
-                logger.info('codex-relay-installed', { target });
-            }
+            copyRelayIfChanged(sourcePath, target);
         }
         catch (error) {
             // An install that failed is not a launch that failed. If a previous
@@ -143,3 +125,64 @@ function installCodexRelayScript(codexHome, sourcePath) {
     }
     return (0, fs_1.existsSync)(target) ? target : null;
 }
+/**
+ * {@link installCodexRelayScript} for `CM_UAT_ISOLATION=own-home` (Issue #3312):
+ * every failure throws instead of being absorbed — no shipped relay, a copy
+ * that could not be written, an installed copy whose bytes still differ from
+ * the shipped one — so the launch plan refuses the launch rather than running
+ * the check against an older relay.
+ *
+ * @returns The installed path, byte-identical to `sourcePath`
+ * @throws When the relay is missing or could not be made identical
+ */
+function installCodexRelayScriptOrThrow(codexHome, sourcePath) {
+    if (!sourcePath)
+        throw new Error('this build ships no relay script');
+    const target = getCodexRelayInstallPath(codexHome);
+    if (sourcePath !== target)
+        copyRelayIfChanged(sourcePath, target);
+    if (!(0, fs_1.existsSync)(target) || (0, fs_1.readFileSync)(target, 'utf8') !== (0, fs_1.readFileSync)(sourcePath, 'utf8')) {
+        throw new Error(`the installed relay ${target} differs from the one this build ships`);
+    }
+    return target;
+}
+/**
+ * Copy `sourcePath` to `target` when the bytes differ. Throws on any failure.
+ *
+ * The write goes through `<target>.tmp` and a rename, because the file being
+ * replaced is one a *running* codex session may be executing at that moment —
+ * truncating it in place would hand that session half a script. The temp file
+ * is removed first and then created exclusively (`wx`), so a symlink planted
+ * at that name is removed, never written through (Issue #3312).
+ */
+function copyRelayIfChanged(sourcePath, target) {
+    const desired = (0, fs_1.readFileSync)(sourcePath, 'utf8');
+    const current = (0, fs_1.existsSync)(target) ? (0, fs_1.readFileSync)(target, 'utf8') : null;
+    if (current === desired)
+        return;
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true, mode: 0o700 });
+    // `.tmp` beside the target so the rename cannot cross a filesystem.
+    const staging = getCodexRelayStagingPath(target);
+    try {
+        unlinkIfPresent(staging);
+        (0, fs_1.writeFileSync)(staging, desired, { mode: 0o700, flag: 'wx' });
+        (0, fs_1.renameSync)(staging, target);
+    }
+    catch (error) {
+        unlinkIfPresent(staging);
+        throw error;
+    }
+    logger.info('codex-relay-installed', { target });
+}
+/** The temp file the relay is written to before it is renamed over `target`. */
+function getCodexRelayStagingPath(target) {
+    return `${target}.tmp`;
+}
+function unlinkIfPresent(file) {
+    try {
+        (0, fs_1.unlinkSync)(file);
+    }
+    catch {
+        // Nothing to clean up, or nothing that can be.
+    }
+}