evolcore 0.0.23 → 0.0.25

package/bin/codex-managed-acl.ps1

@@ -1,155 +1,160 @@
-param([Parameter(Mandatory = $true)][string]$Request)
-
-# Called by the Node installer. Paths and security descriptors are data, never
-# interpolated into PowerShell source. Use Windows PowerShell's built-in .NET ACL API.
-$ErrorActionPreference = 'Stop'
-# A parent pwsh session can export its incompatible PowerShell 7 modules.
-# This helper always runs in Windows PowerShell 5.1.
-$env:PSModulePath = Join-Path $PSHOME 'Modules'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-
-function Get-Descriptor([string]$Target) {
-  return (Get-Acl -LiteralPath $Target).GetSecurityDescriptorSddlForm(
-    [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
-}
-
-function Set-Descriptor([string]$Target, [string]$Sddl) {
-  $acl = Get-Acl -LiteralPath $Target
-  $acl.SetSecurityDescriptorSddlForm($Sddl, [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
-  Set-Acl -LiteralPath $Target -AclObject $acl
-}
-
-function Add-Grant($Acl, [string]$Sid, [Security.AccessControl.FileSystemRights]$Rights, [bool]$Directory) {
-  $inheritance = if ($Directory) { [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' } else { [Security.AccessControl.InheritanceFlags]::None }
-  $rule = New-Object Security.AccessControl.FileSystemAccessRule(
-    (New-Object Security.Principal.SecurityIdentifier($Sid)), $Rights, $inheritance,
-    [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow)
-  $Acl.AddAccessRule($rule)
-}
-
-function Initialize-AccessProbe {
-  # An elevated process reading the file is not evidence that a normal process
-  # can read it. Evaluate the DACL with its UAC linked token when available.
-  Add-Type -TypeDefinition @'
-using System;
-using System.Runtime.InteropServices;
-using System.Security.Principal;
-public static class EvolCoreAclProbe {
-  [StructLayout(LayoutKind.Sequential)]
-  struct Mapping { public uint Read, Write, Execute, All; }
-  [DllImport("advapi32.dll", SetLastError=true)]
-  static extern bool GetTokenInformation(IntPtr token, int type, out IntPtr linked, int size, out int returned);
-  [DllImport("advapi32.dll", SetLastError=true)]
-  static extern bool DuplicateToken(IntPtr token, int level, out IntPtr duplicate);
-  [DllImport("advapi32.dll", SetLastError=true)]
-  static extern bool AccessCheck(byte[] descriptor, IntPtr token, uint desired,
-    ref Mapping mapping, byte[] privileges, ref uint length, out uint granted, out bool allowed);
-  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
-  public static string TokenKind;
-  public static long Granted(byte[] descriptor) {
-    using (var identity = WindowsIdentity.GetCurrent()) {
-      var principal = new WindowsPrincipal(identity);
-      IntPtr token = identity.Token, linked = IntPtr.Zero, duplicate = IntPtr.Zero;
-      try {
-        if (identity.IsSystem || principal.IsInRole(WindowsBuiltInRole.Administrator)) {
-          int size;
-          if (!GetTokenInformation(token, 19, out linked, IntPtr.Size, out size)) {
-            TokenKind = "unavailable";
-            return -1;
-          }
-          token = linked;
-          TokenKind = "linked-token";
-        } else { TokenKind = "current-token"; }
-        if (!DuplicateToken(token, 2, out duplicate))
-          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
-        var mapping = new Mapping { Read=0x120089, Write=0x120116, Execute=0x1200a0, All=0x1f01ff };
-        uint length=1024, granted;
-        bool allowed;
-        if (!AccessCheck(descriptor, duplicate, 0x02000000, ref mapping,
-            new byte[length], ref length, out granted, out allowed))
-          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
-        return allowed ? granted : 0;
-      } finally {
-        if (duplicate != IntPtr.Zero) CloseHandle(duplicate);
-        if (linked != IntPtr.Zero) CloseHandle(linked);
-      }
-    }
-  }
-}
-'@
-}
-
-function Verify-Access($Entry) {
-  $target = [string]$Entry.path
-  $acl = Get-Acl -LiteralPath $target
-  $read = [long][Security.AccessControl.FileSystemRights]::ReadAndExecute
-  $write = [long][Security.AccessControl.FileSystemRights]'Write,Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership'
-  if ($Entry.protected) {
-    $grants = @{}
-    foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
-      if (($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0) { continue }
-      $sid = $rule.IdentityReference.Value
-      $rights = [long]$rule.FileSystemRights
-      if ($sid -in @('S-1-1-0','S-1-5-11','S-1-5-32-545')) {
-        if ($rule.AccessControlType -eq 'Allow' -and ($rights -band $write) -ne 0) {
-          throw "Unsafe write permission on ${target}: $sid has $($rule.FileSystemRights). Existing policy was not removed."
-        }
-        if ($rule.AccessControlType -eq 'Deny' -and ($rights -band $read) -ne 0) {
-          throw "Read permission denied on ${target}: $sid. Existing policy was not removed."
-        }
-      }
-      if ($rule.AccessControlType -eq 'Allow') { $grants[$sid] = ([long]$grants[$sid]) -bor $rights }
-    }
-    foreach ($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')) {
-      $required = if ($sid -eq 'S-1-5-32-545') { $read } else { [long][Security.AccessControl.FileSystemRights]::FullControl }
-      if ((([long]$grants[$sid]) -band $required) -ne $required) { throw "Missing required access on ${target}: $sid" }
-    }
-  }
-  $granted = [EvolCoreAclProbe]::Granted($acl.GetSecurityDescriptorBinaryForm())
-  if ($granted -ge 0) {
-    $required = if ($Entry.execute) { $read } else { [long][Security.AccessControl.FileSystemRights]::Read }
-    if (($granted -band $required) -ne $required) { throw "Normal-token read/execute access denied: $target" }
-    if ($Entry.protected -and ($granted -band $write) -ne 0) { throw "Normal token can modify the protected file or its ACL: $target" }
-  }
-  return @{ path = $target; userProbe = [EvolCoreAclProbe]::TokenKind }
-}
-
-try {
-  $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Request)) | ConvertFrom-Json
-  $result = switch ($payload.action) {
-    'preflight' {
-      $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
-      if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-        throw 'Machine-wide Codex hook provisioning requires an elevated Windows installer. npm installation does not require this step.'
-      }
-      @{ elevated = $true }
-    }
-    'snapshot' { @{ sddl = (Get-Descriptor $payload.path) } }
-    'prepare' {
-      $target = [string]$payload.path
-      if ($payload.reference) {
-        # Same-directory staging preserves the shared configuration's owner,
-        # inherited policy and custom administrator ACEs. Never reset its ACL.
-        Set-Descriptor $target (Get-Descriptor $payload.reference)
-      } else {
-        $flags = if ($payload.directory) { 'OICI' } else { '' }
-        Set-Descriptor $target "O:BAG:BAD:P(A;${flags};FA;;;SY)(A;${flags};FA;;;BA)(A;${flags};FRFX;;;BU)"
-      }
-      $acl = Get-Acl -LiteralPath $target
-      Add-Grant $acl 'S-1-5-18' 'FullControl' ([bool]$payload.directory)
-      Add-Grant $acl 'S-1-5-32-544' 'FullControl' ([bool]$payload.directory)
-      Add-Grant $acl 'S-1-5-32-545' 'ReadAndExecute' ([bool]$payload.directory)
-      Set-Acl -LiteralPath $target -AclObject $acl
-      @{ prepared = $true }
-    }
-    'verify' {
-      Initialize-AccessProbe
-      @($payload.entries | ForEach-Object { Verify-Access $_ })
-    }
-    default { throw "Unknown ACL operation: $($payload.action)" }
-  }
-  ConvertTo-Json -InputObject $result -Depth 8 -Compress
-} catch {
-  [Console]::Error.WriteLine("[evolcore] ACL $($payload.action) failed for $($payload.path): $($_.Exception.Message)")
-  exit 1
-}
+param([Parameter(Mandatory = $true)][string]$Request)
+
+# Called by the Node installer. Paths and security descriptors are data, never
+# interpolated into PowerShell source. Use Windows PowerShell's built-in .NET ACL API.
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+# A parent pwsh session can export its incompatible PowerShell 7 modules.
+# This helper always runs in Windows PowerShell 5.1.
+$env:PSModulePath = Join-Path $PSHOME 'Modules'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+
+function Get-Descriptor([string]$Target) {
+  return (Get-Acl -LiteralPath $Target).GetSecurityDescriptorSddlForm(
+    [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
+}
+
+function Set-Descriptor([string]$Target, [string]$Sddl) {
+  $acl = Get-Acl -LiteralPath $Target
+  $acl.SetSecurityDescriptorSddlForm($Sddl, [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
+  Set-Acl -LiteralPath $Target -AclObject $acl
+}
+
+function Add-Grant($Acl, [string]$Sid, [Security.AccessControl.FileSystemRights]$Rights, [bool]$Directory) {
+  $inheritance = if ($Directory) { [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' } else { [Security.AccessControl.InheritanceFlags]::None }
+  $rule = New-Object Security.AccessControl.FileSystemAccessRule(
+    (New-Object Security.Principal.SecurityIdentifier($Sid)), $Rights, $inheritance,
+    [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow)
+  $Acl.AddAccessRule($rule)
+}
+
+function Initialize-AccessProbe {
+  # An elevated process reading the file is not evidence that a normal process
+  # can read it. Evaluate the DACL with its UAC linked token when available.
+  Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+public static class EvolCoreAclProbe {
+  [StructLayout(LayoutKind.Sequential)]
+  struct Mapping { public uint Read, Write, Execute, All; }
+  [DllImport("advapi32.dll", SetLastError=true)]
+  static extern bool GetTokenInformation(IntPtr token, int type, out IntPtr linked, int size, out int returned);
+  [DllImport("advapi32.dll", SetLastError=true)]
+  static extern bool DuplicateTokenEx(IntPtr token, uint desiredAccess, IntPtr tokenAttributes,
+    int impersonationLevel, int tokenType, out IntPtr duplicate);
+  [DllImport("advapi32.dll", SetLastError=true)]
+  static extern bool AccessCheck(byte[] descriptor, IntPtr token, uint desired,
+    ref Mapping mapping, byte[] privileges, ref uint length, out uint granted, out bool allowed);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  public static string TokenKind;
+  public static long Granted(byte[] descriptor) {
+    using (var identity = WindowsIdentity.GetCurrent()) {
+      var principal = new WindowsPrincipal(identity);
+      IntPtr token = identity.Token, linked = IntPtr.Zero, duplicate = IntPtr.Zero;
+      try {
+        if (identity.IsSystem || principal.IsInRole(WindowsBuiltInRole.Administrator)) {
+          int size;
+          if (!GetTokenInformation(token, 19, out linked, IntPtr.Size, out size)) {
+            TokenKind = "unavailable";
+            return -1;
+          }
+          token = linked;
+          TokenKind = "linked-token";
+        } else { TokenKind = "current-token"; }
+        // AccessCheck only needs SecurityIdentification (1). A UAC linked
+        // token can be limited to that level, so requesting the higher
+        // SecurityImpersonation level fails with ERROR_BAD_IMPERSONATION_LEVEL.
+        if (!DuplicateTokenEx(token, 0x0000000A, IntPtr.Zero, 1, 2, out duplicate))
+          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+        var mapping = new Mapping { Read=0x120089, Write=0x120116, Execute=0x1200a0, All=0x1f01ff };
+        uint length=1024, granted;
+        bool allowed;
+        if (!AccessCheck(descriptor, duplicate, 0x02000000, ref mapping,
+            new byte[length], ref length, out granted, out allowed))
+          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+        return allowed ? granted : 0;
+      } finally {
+        if (duplicate != IntPtr.Zero) CloseHandle(duplicate);
+        if (linked != IntPtr.Zero) CloseHandle(linked);
+      }
+    }
+  }
+}
+'@
+}
+
+function Verify-Access($Entry) {
+  $target = [string]$Entry.path
+  $acl = Get-Acl -LiteralPath $target
+  $read = [long][Security.AccessControl.FileSystemRights]::ReadAndExecute
+  $write = [long][Security.AccessControl.FileSystemRights]'Write,Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership'
+  if ($Entry.protected) {
+    $grants = @{}
+    foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+      if (($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0) { continue }
+      $sid = $rule.IdentityReference.Value
+      $rights = [long]$rule.FileSystemRights
+      if ($sid -in @('S-1-1-0','S-1-5-11','S-1-5-32-545')) {
+        if ($rule.AccessControlType -eq 'Allow' -and ($rights -band $write) -ne 0) {
+          throw "Unsafe write permission on ${target}: $sid has $($rule.FileSystemRights). Existing policy was not removed."
+        }
+        if ($rule.AccessControlType -eq 'Deny' -and ($rights -band $read) -ne 0) {
+          throw "Read permission denied on ${target}: $sid. Existing policy was not removed."
+        }
+      }
+      if ($rule.AccessControlType -eq 'Allow') { $grants[$sid] = ([long]$grants[$sid]) -bor $rights }
+    }
+    foreach ($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')) {
+      $required = if ($sid -eq 'S-1-5-32-545') { $read } else { [long][Security.AccessControl.FileSystemRights]::FullControl }
+      if ((([long]$grants[$sid]) -band $required) -ne $required) { throw "Missing required access on ${target}: $sid" }
+    }
+  }
+  $granted = [EvolCoreAclProbe]::Granted($acl.GetSecurityDescriptorBinaryForm())
+  if ($granted -ge 0) {
+    $required = if ($Entry.execute) { $read } else { [long][Security.AccessControl.FileSystemRights]::Read }
+    if (($granted -band $required) -ne $required) { throw "Normal-token read/execute access denied: $target" }
+    if ($Entry.protected -and ($granted -band $write) -ne 0) { throw "Normal token can modify the protected file or its ACL: $target" }
+  }
+  return @{ path = $target; userProbe = [EvolCoreAclProbe]::TokenKind }
+}
+
+try {
+  $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Request)) | ConvertFrom-Json
+  $result = switch ($payload.action) {
+    'preflight' {
+      $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
+      if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        throw 'Machine-wide Codex hook provisioning requires an elevated Windows installer. npm installation does not require this step.'
+      }
+      @{ elevated = $true }
+    }
+    'snapshot' { @{ sddl = (Get-Descriptor $payload.path) } }
+    'prepare' {
+      $target = [string]$payload.path
+      if ($payload.reference) {
+        # Same-directory staging preserves the shared configuration's owner,
+        # inherited policy and custom administrator ACEs. Never reset its ACL.
+        Set-Descriptor $target (Get-Descriptor $payload.reference)
+      } else {
+        $flags = if ($payload.directory) { 'OICI' } else { '' }
+        Set-Descriptor $target "O:BAG:BAD:P(A;${flags};FA;;;SY)(A;${flags};FA;;;BA)(A;${flags};FRFX;;;BU)"
+      }
+      $acl = Get-Acl -LiteralPath $target
+      Add-Grant $acl 'S-1-5-18' 'FullControl' ([bool]$payload.directory)
+      Add-Grant $acl 'S-1-5-32-544' 'FullControl' ([bool]$payload.directory)
+      Add-Grant $acl 'S-1-5-32-545' 'ReadAndExecute' ([bool]$payload.directory)
+      Set-Acl -LiteralPath $target -AclObject $acl
+      @{ prepared = $true }
+    }
+    'verify' {
+      Initialize-AccessProbe
+      @($payload.entries | ForEach-Object { Verify-Access $_ })
+    }
+    default { throw "Unknown ACL operation: $($payload.action)" }
+  }
+  ConvertTo-Json -InputObject $result -Depth 8 -Compress
+} catch {
+  [Console]::Error.WriteLine("[evolcore] ACL $($payload.action) failed for $($payload.path): $($_.Exception.Message)")
+  exit 1
+}

package/bin/codex-managed-hook.mjs

@@ -1,95 +1,212 @@
-import fs from 'node:fs';
-import net from 'node:net';
-
-// Only bound socket establishment. Once connected, the official Codex hook
-// timeout owns the lifetime of this process; an application timeout here would
-// turn /pause into a denial/allow race.
-const connectTimeoutMs = 1500;
-
-function deny(reason) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
-    },
-  }));
-  // Exit 2 is the documented blocking transport. Keep the structured JSON as
-  // well so Codex can surface the policy reason through the PreToolUse result.
-  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
-  process.exitCode = 2;
-}
-
-function queryDaemon(socketPath, payload) {
-  return new Promise(resolve => {
-    const socket = net.createConnection(socketPath);
-    let buffer = '';
-    let settled = false;
-    let timer;
-    let connected = false;
-    const finish = value => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      socket.destroy();
-      resolve(value);
-    };
-    timer = setTimeout(() => {
-      if (!connected) finish(null);
-    }, connectTimeoutMs);
-    timer.unref?.();
-    socket.once('error', () => finish(null));
-    socket.once('connect', () => {
-      connected = true;
-      clearTimeout(timer);
-      socket.write(JSON.stringify(payload) + '\n');
-    });
-    socket.on('data', chunk => {
-      buffer += String(chunk);
-      const index = buffer.indexOf('\n');
-      if (index < 0) return;
-      try { finish(JSON.parse(buffer.slice(0, index))); } catch { finish(null); }
-    });
-  });
-}
-
-async function main() {
-  // Windows managed requirements use one machine-wide command. Resolve the
-  // per-daemon named pipe from the inherited environment so multiple EvolCore
-  // homes can share the installed hook without rewriting requirements.toml.
-  const socketPath = process.argv[2] || process.env.EVOLCORE_INSTANCE_SOCKET;
-  let input;
-  try {
-    input = JSON.parse(fs.readFileSync(0, 'utf8'));
-  } catch {
-    deny('Invalid Codex PreToolUse payload.');
-    return;
-  }
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const startedAt = Date.now();
+const runId = randomUUID();
+let logPath;
+let logFailed = false;
+let context = {};
+
+// This file is also copied into the Linux runtime; keep diagnostics self-contained.
+function diagnostic(event, details = {}) {
+  if (process.env.EVOLCORE_CODEX_HOOK_LOG === '0' || logFailed) return;
+  try {
+    if (!logPath) {
+      logPath = path.resolve(process.env.EVOLCORE_CODEX_HOOK_LOG
+        || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'log', 'evolcore-hook.jsonl'));
+      fs.mkdirSync(path.dirname(logPath), { recursive: true, mode: 0o700 });
+      // Rotation is best-effort when concurrent tool calls start together.
+      try {
+        if (fs.statSync(logPath).size >= 2 * 1024 * 1024) fs.renameSync(logPath, `${logPath}.1`);
+      } catch {}
+    }
+    fs.appendFileSync(logPath, JSON.stringify({
+      time: new Date().toISOString(), runId, pid: process.pid,
+      elapsedMs: Date.now() - startedAt, event, ...context, ...details,
+    }) + '\n', { mode: 0o600 });
+  } catch (error) {
+    logFailed = true;
+    process.stderr.write(`[evolcore] Hook diagnostic log unavailable (${error?.code || 'unknown'}): ${logPath || '(unresolved)'}\n`);
+  }
+}
+
+function errorDetails(error) {
+  // JSON parser messages and policy reasons can contain tool input. Omit them.
+  return {
+    errorName: error?.name,
+    errorCode: error?.code,
+    syscall: error?.syscall,
+    frames: typeof error?.stack === 'string'
+      ? error.stack.split('\n').filter(line => /^\s+at /.test(line)).slice(0, 6) : undefined,
+  };
+}
+
+process.on('uncaughtExceptionMonitor', error => diagnostic('uncaught_exception', errorDetails(error)));
+process.on('exit', code => diagnostic('exit', { exitCode: code }));
+diagnostic('start', {
+  nodeVersion: process.version, execPath: process.execPath, entrypoint: process.argv[1],
+  argumentCount: Math.max(0, process.argv.length - 2),
+  socketArgumentPresent: Boolean(process.argv[2]),
+  socketEnvironmentPresent: Boolean(process.env.EVOLCORE_INSTANCE_SOCKET),
+  socketArgumentUnexpanded: /^%EVOLCORE_INSTANCE_SOCKET%$/i.test(process.argv[2] || ''),
+  socketSource: process.argv[2] ? 'argument' : process.env.EVOLCORE_INSTANCE_SOCKET ? 'environment' : 'missing',
+});
+
+// Only bound socket establishment. Once connected, the official Codex hook
+// timeout owns the lifetime of this process; an application timeout here would
+// turn /pause into a denial/allow race.
+const connectTimeoutMs = 1500;
+
+function deny(reason, category) {
+  diagnostic('decision', { decision: 'deny', category });
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
+    },
+  }));
+  // Exit 2 is the documented blocking transport. Keep the structured JSON as
+  // well so Codex can surface the policy reason through the PreToolUse result.
+  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
+  process.exitCode = 2;
+}
+
+function queryDaemon(socketPath, payload) {
+  diagnostic('connect_start', { timeoutMs: connectTimeoutMs });
+  return new Promise(resolve => {
+    const socket = net.createConnection(socketPath);
+    let buffer = '';
+    let settled = false;
+    let timer;
+    let connected = false;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    timer = setTimeout(() => {
+      if (!connected) {
+        diagnostic('connect_timeout');
+        finish(null);
+      }
+    }, connectTimeoutMs);
+    timer.unref?.();
+    socket.once('error', error => {
+      diagnostic('socket_error', { connected, ...errorDetails(error) });
+      finish(null);
+    });
+    socket.once('close', () => {
+      if (!settled) diagnostic('socket_closed_without_response', { connected, responseBytes: Buffer.byteLength(buffer) });
+    });
+    socket.once('connect', () => {
+      connected = true;
+      clearTimeout(timer);
+      diagnostic('connected');
+      socket.write(JSON.stringify(payload) + '\n');
+    });
+    socket.on('data', chunk => {
+      buffer += String(chunk);
+      const index = buffer.indexOf('\n');
+      if (index < 0) return;
+      try {
+        const result = JSON.parse(buffer.slice(0, index));
+        diagnostic('response', {
+          ok: result?.ok === true, applicable: result?.applicable === true,
+          decision: ['allow', 'deny'].includes(result?.decision) ? result.decision : 'other',
+          reasonPresent: typeof result?.reason === 'string',
+        });
+        finish(result);
+      } catch (error) {
+        diagnostic('invalid_response', { responseBytes: Buffer.byteLength(buffer), ...errorDetails(error) });
+        finish(null);
+      }
+    });
+  });
+}
+
+// The Windows managed requirements are machine-wide, so unmanaged Codex
+// processes also reach this hook. EvolCore-owned threads carry a per-thread
+// credential (EVOLCORE_CODEX_SESSION_TOKEN, injected through the thread's
+// shell environment policy); unmanaged ones do not. Unmanaged calls are
+// allowed outright and never contact the daemon — EvolCore being stopped must
+// not break a standalone Codex. Credentialed calls always require an explicit
+// daemon allow: a credential without its daemon is an orphaned managed thread
+// and fails closed.
+async function main() {
+  // Windows managed requirements use one machine-wide command. Resolve the
+  // per-daemon named pipe from the inherited environment so multiple EvolCore
+  // homes can share the installed hook without rewriting requirements.toml.
+  const socketPath = process.argv[2] || process.env.EVOLCORE_INSTANCE_SOCKET;
+  let input;
+  try {
+    input = JSON.parse(fs.readFileSync(0, 'utf8'));
+  } catch (error) {
+    diagnostic('invalid_input', errorDetails(error));
+    deny('Invalid Codex PreToolUse payload.', 'invalid_input');
+    return;
+  }
+  context = {
+    sessionId: typeof input?.session_id === 'string' ? input.session_id.slice(0, 128) : undefined,
+    toolName: typeof input?.tool_name === 'string' ? input.tool_name.slice(0, 128) : undefined,
+    callId: typeof (input?.tool_use_id ?? input?.toolUseId ?? input?.item_id ?? input?.itemId) === 'string'
+      ? (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId).slice(0, 128) : undefined,
+  };
+  diagnostic('input', {
+    preToolUse: input?.hook_event_name === 'PreToolUse',
+    sessionIdPresent: typeof input?.session_id === 'string' && Boolean(input.session_id),
+    toolNamePresent: typeof input?.tool_name === 'string' && Boolean(input.tool_name),
+    toolInputPresent: input?.tool_input !== undefined,
+  });
   if (!socketPath
     || input?.hook_event_name !== 'PreToolUse'
     || typeof input?.session_id !== 'string'
-    || !input.session_id
-    || typeof input?.tool_name !== 'string'
-    || !input.tool_name) {
-    deny('Incomplete Codex PreToolUse payload.');
-    return;
-  }
-
-  const result = await queryDaemon(socketPath, {
-    type: 'codex-pre-tool-use',
-    threadId: input.session_id,
-    toolName: input.tool_name,
-    toolInput: input.tool_input ?? null,
-    ...(typeof (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId) === 'string'
-      ? { callId: input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId }
-      : {}),
-  });
-  if (!result) {
-    deny('EvolCore policy service is unavailable.');
-    return;
-  }
-  if (result.ok === true && result.applicable === true && result.decision === 'allow') return;
-  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.');
-}
-
-void main();
+    || !input.session_id
+    || typeof input?.tool_name !== 'string'
+    || !input.tool_name) {
+    deny('Incomplete Codex PreToolUse payload.', 'incomplete_input');
+    return;
+  }
+
+  const sessionToken = typeof process.env.EVOLCORE_CODEX_SESSION_TOKEN === 'string'
+    && process.env.EVOLCORE_CODEX_SESSION_TOKEN
+    ? process.env.EVOLCORE_CODEX_SESSION_TOKEN
+    : undefined;
+
+  if (!sessionToken) {
+    // Unmanaged process: nothing to enforce, and no reason to pay the daemon
+    // round-trip (or its outage) for a call we would allow anyway.
+    return;
+  }
+  if (!socketPath) {
+    deny('EvolCore session credential is present but the policy service address is missing.');
+    return;
+  }
+
+  const result = await queryDaemon(socketPath, {
+    type: 'codex-pre-tool-use',
+    threadId: input.session_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input ?? null,
+    sessionToken,
+    ...(typeof (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId) === 'string'
+      ? { callId: input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId }
+      : {}),
+  });
+  if (!result) {
+    deny('EvolCore policy service is unavailable.', 'service_unavailable');
+    return;
+  }
+  if (result.ok === true && result.applicable === true && result.decision === 'allow') {
+    diagnostic('decision', { decision: 'allow' });
+    return;
+  }
+  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.', 'policy_denied');
+}
+
+void main();