devrites 4.0.0 → 4.0.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.1](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.0...v4.0.1) (2026-08-03)
+
+### Fixed
+
+* **installer:** clean legacy Codex hooks during v4 updates ([4908945](https://github.com/ViktorsBaikers/DevRites/commit/49089453ade730a9fede6c9fade180457d8ce2f9))
+
 ## [4.0.0](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.28...v4.0.0) (2026-08-03)
 
 ### ⚠ BREAKING CHANGES

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -107,6 +107,11 @@ Some work needs a different route:
 
 The npm or shell updater acquires a local install candidate and uses
 `devrites-engine update` to refresh the installed engine and pack offline.
+For a pre-v4 install, do not retry an older engine directly if it reports
+`missing codex/hooks.json`. Run `npx devrites@latest update`, or verify the
+release `install.sh` as shown below and run `bash ./install.sh update`. The v4
+engine updates locally and offline; those adapters acquire its compatible
+candidate first.
 `/rite-upgrade` is the separate native, preservation-first route for reconciling
 an unfinished workspace. It proves a current-contract defect before routing
 Clarify, Plan repair, Converge, Vet, Prove, Polish, Review, or Seal; it never

package/docs/cli.md

@@ -46,6 +46,12 @@ the exact release candidate selected by the adapter without changing the
 installation. Use `npx devrites uninstall --keep-binary` to remove managed host
 artifacts while retaining the shared `devrites-engine` binary.
 
+For a pre-v4 install, an older direct `devrites-engine update` can report
+`missing codex/hooks.json`; do not retry that command. Run
+`npx devrites@latest update`, or use a checksum-verified release `install.sh` and
+run `bash ./install.sh update`. The v4 engine update is local and offline; the
+npm or shell adapter acquires the compatible candidate before invoking it.
+
 ## Checks
 
 - `check candidate <slug>` validates the strict `touched-files.md` manifest and

package/engine/internal/hostpack/hostpack.go

@@ -93,6 +93,12 @@ var CodexConfigMerge = MarkerMerge{
 	MarkerText: ".codex/config.toml contains the DevRites read-only-root permission profile.",
 }
 
+var LegacyCodexHooksMerge = ManagedMerge{
+	MarkerRel: ".claude/devrites.codex-hooks-merge",
+	TargetRel: ".codex/hooks.json",
+	DryRun:    ".codex/hooks.json legacy DevRites hooks",
+}
+
 var managedMerges = []ManagedMerge{
 	{
 		MarkerRel: CodexAgentsMerge.MarkerRel,
@@ -113,6 +119,7 @@ var managedMerges = []ManagedMerge{
 		TargetRel: ClaudeSettingsMerge.TargetRel,
 		DryRun:    ".claude/settings.json DevRites permissions",
 	},
+	LegacyCodexHooksMerge,
 }
 
 func RequiredPayload(withCodex bool) []string {

package/engine/internal/install/install.go

@@ -925,7 +925,11 @@ func (r *runner) pruneDropped() error {
 				if err := r.recheckPath(merge.TargetRel); err != nil {
 					return err
 				}
-				if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
+				if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
+					if err := stripHooksPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))); err != nil {
+						return fmt.Errorf("strip hooks from %s: %w", merge.TargetRel, err)
+					}
+				} else if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
 					_ = r.stripClaudeSettings(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), true)
 				} else {
 					_ = stripMarkerPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), merge.Begin, merge.End)
@@ -1023,6 +1027,12 @@ func (r *runner) uninstall() error {
 		if err := r.recheckPath(merge.TargetRel); err != nil {
 			return err
 		}
+		if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
+			if err := stripHooksPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))); err != nil {
+				return fmt.Errorf("strip hooks from %s: %w", merge.TargetRel, err)
+			}
+			continue
+		}
 		if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
 			if err := r.stripClaudeSettings(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), true); err != nil {
 				return fmt.Errorf("strip DevRites settings from %s: %w", merge.TargetRel, err)
@@ -1092,6 +1102,26 @@ func (r *runner) uninstall() error {
 	return nil
 }
 
+func stripHooksPath(path string) error {
+	current, err := readJSON(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("load hooks config: %w", err)
+	}
+	next := stripDevritesHooks(current)
+	if len(next) == 0 {
+		return os.Remove(path)
+	}
+	data, err := json.MarshalIndent(next, "", "  ")
+	if err != nil {
+		return fmt.Errorf("encode hooks config: %w", err)
+	}
+	data = append(data, '\n')
+	return fsutil.WriteFileAtomic(path, data, 0o644)
+}
+
 func (r *runner) stripClaudeSettings(path string, preserveEmpty bool) error {
 	current, err := readJSON(path)
 	if err != nil {
@@ -1310,9 +1340,12 @@ func stripDevritesHooks(config map[string]any) map[string]any {
 		}
 		next[k] = v
 	}
-	rawHooks, ok := next["hooks"].(map[string]any)
+	rawHooksValue, exists := next["hooks"]
+	if !exists {
+		return next
+	}
+	rawHooks, ok := rawHooksValue.(map[string]any)
 	if !ok {
-		delete(next, "hooks")
 		return next
 	}
 	hooks := map[string]any{}

package/engine/internal/install/install_test.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -551,6 +552,106 @@ func TestUpdateInstallsLocalPayload(t *testing.T) {
 	}
 }
 
+func TestUpdateCleansLegacyCodexHooks(t *testing.T) {
+	t.Setenv("DEVRITES_NO_BINARY", "1")
+	payload := testPayload(t)
+	source := testSource(t, "4.0.0")
+
+	t.Run("preserves user hooks", func(t *testing.T) {
+		target := t.TempDir()
+		hooks := `{
+  "$comment": "DevRites hooks for Codex. Project hooks load only after trust.",
+  "hooks": {"Stop":[{"hooks":[
+    {"type":"command","command":"devrites-engine hook stop-gate --harness=codex"},
+    {"type":"command","command":"echo user"}
+  ]}]}
+}` + "\n"
+		seedLegacyCodexHooksInstall(t, target, hooks)
+
+		runLocalUpdate(t, target, source, payload)
+
+		if exists(filepath.Join(target, ".claude", "devrites.codex-hooks-merge")) {
+			t.Fatal("update kept the legacy Codex hooks marker")
+		}
+		got := testutil.ReadFile(t, filepath.Join(target, ".codex", "hooks.json"))
+		if strings.Contains(got, "devrites-engine hook") || strings.Contains(got, "DevRites hooks") || !strings.Contains(got, "echo user") {
+			t.Fatalf("legacy Codex hook cleanup mismatch:\n%s", got)
+		}
+	})
+
+	t.Run("removes empty hooks file", func(t *testing.T) {
+		target := t.TempDir()
+		hooks := `{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"devrites-engine hook stop-gate --harness=codex"}]}]}}` + "\n"
+		seedLegacyCodexHooksInstall(t, target, hooks)
+
+		runLocalUpdate(t, target, source, payload)
+
+		if exists(filepath.Join(target, ".codex", "hooks.json")) {
+			t.Fatal("update kept an empty legacy Codex hooks file")
+		}
+	})
+
+	t.Run("preserves unrecognized user hook shape", func(t *testing.T) {
+		target := t.TempDir()
+		seedLegacyCodexHooksInstall(t, target, `{"hooks":"user-defined"}`+"\n")
+
+		runLocalUpdate(t, target, source, payload)
+
+		got := testutil.ReadFile(t, filepath.Join(target, ".codex", "hooks.json"))
+		if !strings.Contains(got, `"hooks": "user-defined"`) {
+			t.Fatalf("legacy cleanup removed unrecognized user hooks: %s", got)
+		}
+	})
+
+	t.Run("malformed hooks keep ownership marker", func(t *testing.T) {
+		target := t.TempDir()
+		seedLegacyCodexHooksInstall(t, target, "{\n")
+
+		err := applyUpdate(target, source, payload)
+		if err == nil || !strings.Contains(err.Error(), "load hooks config") {
+			t.Fatalf("update error = %v, want malformed legacy hooks error", err)
+		}
+		if !exists(filepath.Join(target, ".claude", "devrites.codex-hooks-merge")) {
+			t.Fatal("failed cleanup removed the legacy ownership marker")
+		}
+		if got := testutil.ReadFile(t, filepath.Join(target, ".codex", "hooks.json")); got != "{\n" {
+			t.Fatalf("failed cleanup changed hooks: %q", got)
+		}
+	})
+
+	t.Run("uninstall preserves user hooks", func(t *testing.T) {
+		target := t.TempDir()
+		hooks := `{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"devrites-engine hook stop-gate"},{"type":"command","command":"echo user"}]}]}}` + "\n"
+		seedLegacyCodexHooksInstall(t, target, hooks)
+
+		runUninstall(t, target)
+
+		got := testutil.ReadFile(t, filepath.Join(target, ".codex", "hooks.json"))
+		if strings.Contains(got, "devrites-engine hook") || !strings.Contains(got, "echo user") {
+			t.Fatalf("legacy Codex hook uninstall mismatch:\n%s", got)
+		}
+	})
+}
+
+func TestLegacyCodexHooksMergeIsCleanupOnly(t *testing.T) {
+	legacy := hostpack.LegacyCodexHooksMerge
+	merge, ok := hostpack.ManagedMergeForMarker(legacy.MarkerRel)
+	if !ok || merge != legacy {
+		t.Fatalf("legacy marker lookup = %#v, %t", merge, ok)
+	}
+	if slices.Contains(hostpack.RequiredPayload(true), "codex/hooks.json") {
+		t.Fatal("legacy Codex hooks entered the required payload")
+	}
+	r := runner{opts: DefaultOptions(ModeInstall), payloadFS: os.DirFS(testPayload(t))}
+	desired, err := r.desiredInstallPaths()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if desired[legacy.MarkerRel] || desired[legacy.TargetRel] || slices.Contains(r.installMergeTargets(), legacy.TargetRel) {
+		t.Fatalf("legacy Codex hooks entered active install paths: desired=%v merge-targets=%v", desired, r.installMergeTargets())
+	}
+}
+
 func TestUpdateRejectsMissingGeneratedPayload(t *testing.T) {
 	t.Setenv("DEVRITES_NO_BINARY", "1")
 	oldPayload := testPayload(t)
@@ -939,6 +1040,33 @@ func applyInstall(target, payload string, force, dryRun bool, out *bytes.Buffer)
 	return Apply(opts)
 }
 
+func applyUpdate(target, source, payload string) error {
+	opts := DefaultOptions(ModeUpdate)
+	opts.Target = target
+	opts.SourceDir = source
+	opts.PayloadDir = payload
+	opts.Stdout = &bytes.Buffer{}
+	opts.Stderr = &bytes.Buffer{}
+	return Apply(opts)
+}
+
+func runLocalUpdate(t *testing.T, target, source, payload string) {
+	t.Helper()
+	if err := applyUpdate(target, source, payload); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func seedLegacyCodexHooksInstall(t *testing.T, target, hooks string) {
+	t.Helper()
+	markerRel := ".claude/devrites.codex-hooks-merge"
+	marker := []byte(".codex/hooks.json contains DevRites managed hook entries.\n")
+	testutil.WriteFile(t, filepath.Join(target, ".codex", "hooks.json"), hooks)
+	testutil.WriteFile(t, filepath.Join(target, filepath.FromSlash(markerRel)), string(marker))
+	testutil.WriteFile(t, filepath.Join(target, ManifestName), "# DevRites install manifest - do not edit by hand.\n# devrites-version: 3.2.27\n# devrites-flags: \n")
+	addManifestRecord(t, filepath.Join(target, ManifestName), markerRel, marker)
+}
+
 func addManifestRecord(t *testing.T, manifest, rel string, data []byte) {
 	t.Helper()
 	hash := fmt.Sprintf("sha256:%x", sha256.Sum256(data))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",