failproofai 1.0.11-beta.1 → 1.0.11-beta.2

package/src/hooks/collector-config.ts

@@ -137,7 +137,7 @@ export function writeCollectorSettings(settings: CollectorSettings): void {
 
 export type KeyCheck =
   | { ok: true }
-  | { ok: false; reason: string };
+  | { ok: false; reason: string; status?: number };
 
 /**
  * Verify a key against the endpoint before writing it anywhere.
@@ -179,18 +179,19 @@ export async function validateIngestKey(
     if (res.status >= 300 && res.status < 400) {
       return {
         ok: false,
+        status: res.status,
         reason:
           "that URL redirects rather than accepting events — it looks like the dashboard, not the ingest API",
       };
     }
     if (res.status === 401 || res.status === 403) {
-      return { ok: false, reason: `the server rejected that key (${res.status})` };
+      return { ok: false, status: res.status, reason: `the server rejected that key (${res.status})` };
     }
     if (res.status === 404) {
-      return { ok: false, reason: `no ingest endpoint at that URL (404)` };
+      return { ok: false, status: res.status, reason: `no ingest endpoint at that URL (404)` };
     }
     if (!res.ok) {
-      return { ok: false, reason: `the server answered ${res.status}` };
+      return { ok: false, status: res.status, reason: `the server answered ${res.status}` };
     }
     // A 2xx is not enough either. Ingest answers `{"accepted":N,"skipped":M}`;
     // anything else returning 200 (a proxy, a static host, a catch-all router)

package/src/hooks/config-status.ts

@@ -24,6 +24,7 @@
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { readCloudCredentials } from "./cloud-enrollment";
+import { CODEX_UNTRUSTED_NOTICE, codexHookTrust, type CodexHookTrust } from "./codex-system-hooks";
 import { describeMachine } from "./cloud-enrollment-cli";
 import { cloudBaseFor } from "./cloud-connection";
 import { readActiveCloudManagedPolicies } from "./cloud-managed-policies";
@@ -88,6 +89,7 @@ export type StatusCloud =
       machine?: string;
       pullsPolicies: boolean;
       sendsEvents: boolean;
+      splitKeys?: boolean;
     };
 
 /** Where the policies on this machine come from, counted. */
@@ -145,6 +147,11 @@ export interface StatusFacts {
   agents: { traced: number; notTraced?: number; notInstalled: number };
   policies: StatusPolicies;
   notEnforcing: NotEnforcingReason | null;
+  /**
+   * Whether Codex runs failproofai's user-scope hooks. Codex skips hooks.json
+   * hooks nobody has trusted, so hooks being installed is not enough.
+   */
+  codex?: CodexHookTrust;
 }
 
 /** Seams for everything that would otherwise reach a service manager, PATH or the network. */
@@ -155,6 +162,7 @@ export interface StatusDeps {
   daemonAnswering?: () => boolean;
   detectInstalled?: () => IntegrationType[];
   notEnforcing?: (cwd?: string) => NotEnforcingReason | null;
+  codexTrust?: () => CodexHookTrust;
 }
 
 /**
@@ -316,6 +324,7 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
         ...(machineId ? { machine: describeMachine(machineId, creds?.machineLabel) } : {}),
         pullsPolicies: Boolean(creds),
         sendsEvents: Boolean(ingest),
+        ...(creds && ingest && creds.token !== ingest.key ? { splitKeys: true } : {}),
       };
     }
   }
@@ -364,14 +373,25 @@ export async function gatherStatusFacts(deps: StatusDeps = {}): Promise<StatusFa
     },
     policies: summarizePolicySources(cwd),
     notEnforcing,
+    codex: readCodexTrust(deps),
   };
 }
 
+function readCodexTrust(deps: StatusDeps): CodexHookTrust {
+  try {
+    return (deps.codexTrust ?? codexHookTrust)();
+  } catch {
+    return { kind: "none" };
+  }
+}
+
 /** The one line that needs attention, before it is painted. */
 export interface StatusAttention {
   severity: "fail" | "caution";
   text: string;
   fix?: string;
+  /** A second line for a fix that is more than one command; `backticks` mark commands. */
+  detail?: string;
 }
 
 /**
@@ -416,6 +436,10 @@ export function pickStatusAttention(facts: StatusFacts): StatusAttention | null
             : `failproofai policies add ${CORE_SOURCE}`;
     return { severity: "caution", text: "Policies are not enforcing yet.", fix };
   }
+  if (facts.codex?.kind === "untrusted") {
+    const [text, fixLine] = CODEX_UNTRUSTED_NOTICE.split("\n");
+    return { severity: "caution", text, detail: fixLine };
+  }
   if (cloud.kind !== "none" && !daemon.answering && daemon.service !== "running") {
     const idle =
       cloud.kind === "file" && !cloud.sendsEvents
@@ -531,6 +555,18 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
     return policies.anyPack ? `0 on from ${policies.anyPack}` : "None installed";
   };
 
+  // Only when failproofai's Codex hooks are installed at user scope: whether
+  // Codex actually runs them is the one per-agent fact this screen keeps,
+  // because hooks being written does not make them run.
+  const codexValue = (): string | null => {
+    const codex = facts.codex;
+    if (!codex || codex.kind === "none") return null;
+    if (codex.kind === "system") return `${kit.on} Enforcing (system config)`;
+    if (codex.kind === "trusted") return `${kit.on} Enforcing (hooks trusted)`;
+    if (codex.kind === "ungated") return `${kit.on} Enforcing`;
+    return `${kit.off} Not enforcing: ${codex.untrusted === codex.total ? "hooks not trusted" : `${codex.untrusted} of ${codex.total} hooks not trusted`}`;
+  };
+
   const machineRows: Array<[string, string]> = [
     ["daemon", daemonValue()],
     ["paused", facts.pauses.length === 0 ? "No" : many(facts.pauses.length, "session")],
@@ -560,6 +596,9 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
                 `${cloud.pullsPolicies ? "" : ", for reporting only"}`,
             ],
             ...(cloud.machine ? [["machine", cloud.machine] as [string, string]] : []),
+            ...(cloud.splitKeys
+              ? [["keys", `Policy and ingest use different keys; reconnect with ${kit.cmd("failproofai config")}.`] as [string, string]]
+              : []),
             ["delivery", deliveryValue()],
           ];
 
@@ -571,6 +610,7 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
         (agents.notInstalled > 0 ? `, ${agents.notInstalled} not installed` : ""),
     ],
     ["policies", policiesValue()],
+    ...(codexValue() ? [["codex", codexValue()!] as [string, string]] : []),
   ];
 
   const sections: Array<[string, Array<[string, string]>]> = [
@@ -588,7 +628,11 @@ export function renderStatusScreen(facts: StatusFacts, opts: ScreenKitOpts & { c
 
   const attention = pickStatusAttention(facts);
   if (attention) {
-    screen.push("", attention.severity === "fail" ? kit.fail(attention.text, attention.fix) : kit.caution(attention.text, attention.fix));
+    if (attention.detail) {
+      screen.push("", ...kit.notice(attention.severity, `${attention.text}\n${attention.detail}`));
+    } else {
+      screen.push("", attention.severity === "fail" ? kit.fail(attention.text, attention.fix) : kit.caution(attention.text, attention.fix));
+    }
   }
   if (facts.pauses.length > 0) {
     const id = facts.pauses.length === 1 ? facts.pauses[0].sessionId : "<id>";

package/src/hooks/configure-wizard.ts

@@ -56,6 +56,12 @@ import {
 } from "./integrations";
 import { INTEGRATION_TYPES, type IntegrationType, type HookScope } from "./types";
 import { enforcingPolicyCount, installHooks, notEnforcingReason } from "./manager";
+import {
+  CODEX_UNTRUSTED_NOTICE,
+  codexHookTrust,
+  removeCodexSystemHooks,
+  type CodexHookTrust,
+} from "./codex-system-hooks";
 import { readInstalledPacks } from "./pack-manifest";
 import { getConfigPathForScope, readScopedHooksConfig } from "./hooks-config";
 import { discoverPolicyFiles, findSkippedPolicyFiles } from "./custom-hooks-loader";
@@ -404,6 +410,15 @@ export function removeUserScopeHooks(clis: IntegrationType[], cwd: string): numb
   for (const id of clis) {
     const integration = getIntegration(id);
     if (!integration.scopes.includes("user")) continue;
+    if (id === "codex") {
+      // Codex's user-scope hooks may live in its system config instead; setup
+      // primed sudo, so taking them out of there needs no prompt.
+      const system = removeCodexSystemHooks();
+      if (system.status === "removed") removed += system.hooks;
+      else if (system.status === "failed") {
+        hookLogWarn(`could not remove failproofai's Codex hooks from ${system.path}: ${system.reason}`);
+      }
+    }
     for (const settingsPath of settingsPathsFor(integration, "user", cwd)) {
       // Hermes is asked even without a config file, so it can clear a plugin
       // directory left behind by an interrupted install.
@@ -905,6 +920,9 @@ export async function runConfigureWizard(
   // — no `connectToCloud`, which would reset collector settings — after
   // checking that it still works.
   const saved = savedConnection();
+  if (saved?.splitKeys) {
+    write([kit.caution("Saved policy and ingest keys differ. Paste one replacement key to reconcile them, or Tab to leave both unchanged.")]);
+  }
   const urlChoice = resolveCloudUrl(answers.url, saved?.url);
   // An unusable --url or FAILPROOFAI_CLOUD_URL is refused loudly, never a silent
   // fall-back to the hosted service: whoever set it wants THAT endpoint, and
@@ -950,7 +968,7 @@ export async function runConfigureWizard(
       meta: source ? `${host}  ·  from ${source}` : host,
       tabHint: saved ? "skip" : "use open source instead",
       emptyError: saved ? "Paste a key, or press tab to skip." : "Paste a key, or press tab to use open source.",
-      saved: saved
+      saved: saved && !saved.splitKeys
         ? {
             masked: maskToken(saved.token),
             check: async () => {
@@ -1269,6 +1287,7 @@ export async function runConfigureWizard(
         }),
       );
       connected = outcome.anyConfigured;
+      done.push(...(outcome.changes ?? []));
       done.push(...connectDoneLines(kit, outcome, host, cloud.org));
       if (outcome.ingest.ok && answers.noTranscripts === true) {
         done.push("  Decisions only: session transcripts are not sent (--no-transcripts).");
@@ -1292,7 +1311,20 @@ export async function runConfigureWizard(
   // And any record of an earlier failure is now false: this machine got set up.
   clearOnboardingAttempt();
 
-  write(doneLines(kit, { elapsedMs: Date.now() - started, done, cwd, agents: selected.length, connected: connected || cloud.kind === "kept" }));
+  // Codex runs hooks from hooks.json only once they are trusted; from its
+  // system config always. Said here, and not counted as enforcing until it is.
+  const codexTrust = selected.includes("codex") ? codexHookTrust() : undefined;
+  if (codexTrust?.kind === "system") done.push(kit.ok(`Codex hooks are in its system config (${codexTrust.path}), which Codex runs without asking`));
+  write(
+    doneLines(kit, {
+      elapsedMs: Date.now() - started,
+      done,
+      cwd,
+      agents: selected.length,
+      connected: connected || cloud.kind === "kept",
+      codexTrust,
+    }),
+  );
 
   return {
     applied: true,
@@ -1320,11 +1352,12 @@ type CloudPlan =
  * one and the collector's ingest key. Reading only the first, as setup used to,
  * showed a collector-only machine as unconnected.
  */
-function savedConnection(): {
+export function savedConnection(): {
   url: string;
   token: string;
   org?: string;
   machineLabel?: string;
+  splitKeys?: boolean;
 } | null {
   const cloud = readCloudCredentials();
   const ingest = readIngestCredential();
@@ -1338,7 +1371,10 @@ function savedConnection(): {
   } catch {
     org = undefined;
   }
-  return { url, token, org, machineLabel: cloud?.machineLabel };
+  return {
+    url, token, org, machineLabel: cloud?.machineLabel,
+    ...(cloud && ingest && cloud.token !== ingest.key ? { splitKeys: true } : {}),
+  };
 }
 
 /**
@@ -1480,10 +1516,14 @@ function failClosedPacks(): Array<{ id: string | null }> {
  */
 export function doneLines(
   kit: ReturnType<typeof screenKit>,
-  state: { elapsedMs: number; done: string[]; cwd: string; agents: number; connected: boolean },
+  state: { elapsedMs: number; done: string[]; cwd: string; agents: number; connected: boolean; codexTrust?: CodexHookTrust },
 ): string[] {
   const lines = [kit.head("Done", `in ${(state.elapsedMs / 1000).toFixed(1)}s`), ...state.done];
-  const on = `${state.agents} ${state.agents === 1 ? "agent" : "agents"}`;
+  // Codex with untrusted hooks runs none of them: it is not an agent anything
+  // enforces on, whatever was written.
+  const codexSkips = state.codexTrust?.kind === "untrusted";
+  const agents = codexSkips ? Math.max(0, state.agents - 1) : state.agents;
+  const on = `${agents} ${agents === 1 ? "agent" : "agents"}`;
   if (notEnforcingReason(state.cwd)) {
     lines.push(
       kit.caution("Policies are not enforcing yet."),
@@ -1491,7 +1531,9 @@ export function doneLines(
     );
   } else {
     const { count, custom } = enforcingPolicyCount(state.cwd);
-    if (count > 0 || custom) {
+    // Codex was the only agent, and it runs none of the hooks: nothing enforces anywhere.
+    const nowhere = codexSkips && agents === 0;
+    if ((count > 0 || custom) && !nowhere) {
       lines.push(
         kit.ok(
           count === 0
@@ -1516,10 +1558,11 @@ export function doneLines(
           first.id ? `failproofai policies remove ${first.id}` : "failproofai policies",
         ),
       );
-    } else if (count === 0 && !custom) {
+    } else if (count === 0 && !custom && !nowhere) {
       lines.push(kit.ok(`Policies are enforcing on ${on}.`));
     }
   }
+  if (codexSkips) lines.push(...kit.notice("caution", CODEX_UNTRUSTED_NOTICE));
   if (!state.connected) lines.push(`  Connect to cloud any time:  ${kit.cmd("failproofai config")}`);
   for (const warning of describeCustomPolicies(state.cwd).warnings) {
     lines.push(kit.caution(warning.replace(/^! /, "")));

package/src/hooks/credential-recovery.ts

@@ -0,0 +1,36 @@
+/**
+ * Redrive authentication refusals only after a verified ingest-key replacement.
+ * Queues from a different (or unconfirmed) org are retained, never sent.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, renameSync } from "node:fs";
+import { join } from "node:path";
+import { writeJsonAtomically } from "../../lib/atomic-write";
+import { failedDir, stateDir } from "./fp-home";
+import { flushRequestPath } from "./flush-cli";
+
+export function previousOrgDirectory(id?: string): string {
+  const safe = id && /^[A-Za-z0-9_-]{1,128}$/.test(id)
+    ? id
+    : id ? createHash("sha256").update(id).digest("hex") : "unknown";
+  return join(stateDir(), "previous-org", safe);
+}
+
+export function recoverCredentialRefusals(sameOrg: boolean, oldOrgId?: string): number {
+  const dir = failedDir();
+  if (!existsSync(dir)) return 0;
+  let recovered = 0;
+  for (const name of readdirSync(dir)) {
+    if (!/\.c(401|403)\.jsonl$/.test(name) || name.startsWith(".")) continue;
+    const targetDir = sameOrg ? dir : join(previousOrgDirectory(oldOrgId), "failed");
+    mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+    const targetName = sameOrg ? name.replace(/\.c(401|403)(?=\.jsonl$)/, "") : name;
+    const target = join(targetDir, targetName);
+    // Never overwrite the only copy of another undelivered batch.
+    if (existsSync(target)) continue;
+    renameSync(join(dir, name), target);
+    recovered++;
+  }
+  if (sameOrg && recovered > 0) writeJsonAtomically(flushRequestPath(), { requestedAtMs: Date.now() });
+  return recovered;
+}

package/src/hooks/daemon-service.ts

@@ -548,7 +548,7 @@ export function canElevate(): boolean {
  * cannot elevate silently gets a clear reason and the manual commands
  * instead — it keeps working exactly as it did, on the in-process path.
  */
-function runPrivileged(command: string, args: string[]): void {
+export function runPrivileged(command: string, args: string[]): void {
   const root = typeof process.getuid === "function" && process.getuid() === 0;
   const [cmd, argv] = root ? [command, args] : ["sudo", ["-n", command, ...args]];
   execFileSync(cmd, argv, { stdio: "ignore", timeout: SERVICE_CMD_TIMEOUT_MS });
@@ -559,7 +559,7 @@ function runPrivileged(command: string, args: string[]): void {
  * caller is not root and cannot write there directly. `install -m` sets the
  * mode in the same step, so the file is never briefly world-writable.
  */
-function writePrivilegedFile(destination: string, contents: string, mode = "0644"): void {
+export function writePrivilegedFile(destination: string, contents: string, mode = "0644"): void {
   // mkdtempSync, not a name built from pid + timestamp in the shared tmpdir.
   // That name is guessable, and `writeFileSync` follows a symlink already
   // sitting at the path — so on a multi-user box another local user could

package/src/hooks/delivery-health.ts

@@ -28,6 +28,7 @@ import { existsSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import { failedDir } from "./fp-home";
+import { readCredentials } from "./fp-config";
 
 /**
  * Mirrors `POISON_SUFFIX` in `crates/fpai-collect/src/uploader.rs`. Kept as its
@@ -122,7 +123,11 @@ const EMPTY: DeliveryHealth = {
  * A missing directory is the healthy case on a machine that has never had a
  * batch refused, not an error — the collector creates it lazily.
  */
-export function deliveryHealth(home?: string, now: number = Date.now()): DeliveryHealth {
+export function deliveryHealth(
+  home?: string,
+  now: number = Date.now(),
+  connectedAt: number | undefined = home ? undefined : readCredentials().connectedAt,
+): DeliveryHealth {
   const dir = failedDir(home);
   if (!existsSync(dir)) return EMPTY;
 
@@ -144,21 +149,27 @@ export function deliveryHealth(home?: string, now: number = Date.now()): Deliver
   for (const name of entries) {
     // `.tmp` files are half-written renames, not parked batches.
     if (!name.includes(".jsonl")) continue;
-    total += 1;
-
     const parsed = parseParkedName(name);
+    let mtime: number;
+    try {
+      mtime = statSync(join(dir, name)).mtimeMs;
+    } catch {
+      continue; // Delivered or renamed during the scan.
+    }
+    if (
+      connectedAt !== undefined &&
+      parsed.clientStatus !== undefined &&
+      CREDENTIAL_STATUSES.has(parsed.clientStatus) &&
+      mtime < connectedAt
+    ) continue;
+    total += 1;
     if (parsed.clientStatus !== undefined) {
       rejected += 1;
       byStatus[parsed.clientStatus] = (byStatus[parsed.clientStatus] ?? 0) + 1;
       if (CREDENTIAL_STATUSES.has(parsed.clientStatus)) credentialRejected += 1;
     }
 
-    try {
-      const mtime = statSync(join(dir, name)).mtimeMs;
-      if (oldestMtime === undefined || mtime < oldestMtime) oldestMtime = mtime;
-    } catch {
-      // Vanished mid-scan — the collector just drained or renamed it.
-    }
+    if (oldestMtime === undefined || mtime < oldestMtime) oldestMtime = mtime;
   }
 
   return {

package/src/hooks/fp-config.ts

@@ -36,6 +36,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname } from "node:path";
+import { writeJsonAtomically } from "../../lib/atomic-write";
 import { version as cliVersion } from "../../package.json";
 import {
   LAYOUT_VERSION,
@@ -842,6 +843,8 @@ export function isAgentTraced(id: string, config: FpConfig = readConfig()): bool
 // ── credentials.json ─────────────────────────────────────────────────────────
 
 export interface FpCredentials {
+  /** Successful connection time, epoch milliseconds; resets stale refusal status. */
+  connectedAt?: number;
   cloud?: { url: string; machineId: string; token: string; machineLabel?: string };
   /**
    * Which organisation this machine's credentials report into, as the server
@@ -858,7 +861,7 @@ export interface FpCredentials {
    * the one a key pasted from the wrong org gets silently wrong. Absent against
    * a server predating introspect, and in files written by an older CLI.
    */
-  org?: { id?: string; slug?: string; name?: string };
+  org?: { id?: string; slug?: string; name?: string; since?: number };
   ingest?: { url: string; key: string };
   auth?: { baseUrl?: string; sessionToken?: string; expiresAt?: number; email?: string };
   /**
@@ -894,6 +897,7 @@ export interface JevCloudCredential {
  * only local answer to "where does this machine's data go?".
  */
 const OWNED_CREDENTIAL_KEYS: readonly (readonly string[])[] = [
+  ["connectedAt"],
   ["cloud", "url"],
   ["cloud", "machine_id"],
   ["cloud", "machine_label"],
@@ -901,6 +905,7 @@ const OWNED_CREDENTIAL_KEYS: readonly (readonly string[])[] = [
   ["org", "id"],
   ["org", "slug"],
   ["org", "name"],
+  ["org", "since"],
   ["ingest", "url"],
   ["ingest", "key"],
   ["jev", "url"],
@@ -950,6 +955,9 @@ export function projectCredentials(parsed: Record<string, unknown>): FpCredentia
     const ingest = parsed.ingest as Record<string, unknown> | undefined;
     const auth = parsed.auth as Record<string, unknown> | undefined;
     const out: FpCredentials = {};
+    if (typeof parsed.connectedAt === "number" && Number.isSafeInteger(parsed.connectedAt) && parsed.connectedAt >= 0) {
+      out.connectedAt = parsed.connectedAt;
+    }
     if (
       cloud &&
       typeof cloud.url === "string" &&
@@ -967,8 +975,10 @@ export function projectCredentials(parsed: Record<string, unknown>): FpCredentia
       // Every field independently optional: a server may send fewer than three,
       // and a partial org record is still better than none for `--status`.
       const pick = (v: unknown) => (typeof v === "string" && v ? v : undefined);
-      const built = { id: pick(org.id), slug: pick(org.slug), name: pick(org.name) };
-      if (built.id || built.slug || built.name) out.org = built;
+      const since = typeof org.since === "number" && Number.isSafeInteger(org.since) && org.since >= 0
+        ? org.since : undefined;
+      const built = { id: pick(org.id), slug: pick(org.slug), name: pick(org.name), ...(since !== undefined ? { since } : {}) };
+      if (built.id || built.slug || built.name || since !== undefined) out.org = built;
     }
     if (ingest && typeof ingest.url === "string" && typeof ingest.key === "string" && ingest.url && ingest.key) {
       out.ingest = { url: ingest.url, key: ingest.key };
@@ -997,6 +1007,7 @@ export function projectCredentials(parsed: Record<string, unknown>): FpCredentia
  */
 export function writeCredentials(creds: FpCredentials, raw?: Record<string, unknown>): void {
   const out: Record<string, unknown> = {};
+  if (creds.connectedAt !== undefined) out.connectedAt = creds.connectedAt;
   if (creds.cloud) {
     out.cloud = {
       url: creds.cloud.url,
@@ -1011,11 +1022,12 @@ export function writeCredentials(creds: FpCredentials, raw?: Record<string, unkn
   if (creds.jev) {
     out.jev = { url: creds.jev.url, key: creds.jev.key };
   }
-  if (creds.org && (creds.org.id || creds.org.slug || creds.org.name)) {
+  if (creds.org && (creds.org.id || creds.org.slug || creds.org.name || creds.org.since !== undefined)) {
     out.org = {
       ...(creds.org.id ? { id: creds.org.id } : {}),
       ...(creds.org.slug ? { slug: creds.org.slug } : {}),
       ...(creds.org.name ? { name: creds.org.name } : {}),
+      ...(creds.org.since !== undefined ? { since: creds.org.since } : {}),
     };
   }
   if (creds.auth && (creds.auth.sessionToken || creds.auth.email)) {
@@ -1041,7 +1053,7 @@ export function writeCredentials(creds: FpCredentials, raw?: Record<string, unkn
   } catch {
     // Not fatal: the file's own 0600 is the primary protection.
   }
-  writeFileSync(credentialsFile(), `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
+  writeJsonAtomically(credentialsFile(), merged);
   try {
     chmodSync(credentialsFile(), 0o600);
   } catch {

package/src/hooks/fp-home.ts

@@ -141,7 +141,7 @@ export const configFile = (home?: string) => atHome(home, "config.json");
 
 export const otelAgentStateDir = (home?: string) => atHome(home, "state", "otel-agents");
 export const otelAgentStateFile = (agent: string) => {
-  if (!["claude", "codex", "gemini", "copilot"].includes(agent)) throw new Error("Unknown OTEL agent.");
+  if (!["claude", "codex", "copilot"].includes(agent)) throw new Error("Unknown OTEL agent.");
   return resolve(otelAgentStateDir(), `${agent}.json`);
 };
 export const otlpSpoolDir = (home?: string) => atHome(home, "state", "spool-otlp");

package/src/hooks/integrations.ts

@@ -26,6 +26,7 @@ import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { parseDocument, type Document } from "yaml";
 import { writeConfigFileAtomic } from "./safe-config-write";
+import { codexSystemHooksPresent, type CodexSystemHookEntry } from "./codex-system-hooks";
 import { listHermesProfiles, hermesRoot } from "../../lib/hermes-profiles";
 import { listOpenClawProfiles } from "../../lib/openclaw-profiles";
 import {
@@ -527,6 +528,9 @@ export const codex: Integration = {
   },
 
   hooksInstalledInSettings(scope, cwd) {
+    // User scope may live in Codex's system config instead (see
+    // ./codex-system-hooks): Codex runs hooks from there without trust.
+    if (scope === "user" && codexSystemHooksPresent()) return true;
     const settingsPath = this.getSettingsPath(scope, cwd);
     if (!existsSync(settingsPath)) return false;
     try {
@@ -550,6 +554,18 @@ export const codex: Integration = {
   },
 };
 
+/**
+ * failproofai's user-scope Codex hooks, as the system config holds them: the
+ * same events, commands and timeouts `codex.buildHookEntry` writes to
+ * `~/.codex/hooks.json`.
+ */
+export function codexSystemHookEntries(binaryPath: string): CodexSystemHookEntry[] {
+  return CODEX_HOOK_EVENT_TYPES.map((eventType) => {
+    const entry = codex.buildHookEntry(binaryPath, eventType, "user") as { command: string; timeout: number };
+    return { event: CODEX_EVENT_MAP[eventType as CodexHookEventType], command: entry.command, timeout: entry.timeout };
+  });
+}
+
 // ── GitHub Copilot CLI integration ──────────────────────────────────────────
 //
 // Copilot CLI accepts two hook payload formats: a camelCase native form and a

package/src/hooks/manager.ts

@@ -14,7 +14,14 @@ import { INTEGRATION_TYPES,
   type HookScope,
   type IntegrationType,
 } from "./types";
-import { claudeCode, getIntegration, settingsPathsFor, type Integration } from "./integrations";
+import { claudeCode, codexSystemHookEntries, getIntegration, settingsPathsFor, type Integration } from "./integrations";
+import {
+  CODEX_UNTRUSTED_NOTICE,
+  codexHookTrust,
+  installCodexSystemHooks,
+  removeCodexSystemHooks,
+  type CodexSystemInstall,
+} from "./codex-system-hooks";
 import { configuredCustomPolicyPaths, readMergedHooksConfig, readScopedHooksConfig, writeScopedHooksConfig, syncConventionPolicies, findProjectConfigDir } from "./hooks-config";
 import type { HooksConfig, ConventionPolicyRecord } from "./policy-types";
 import { BUILTIN_POLICIES } from "./builtin-policies";
@@ -815,8 +822,24 @@ async function installHooksImpl(
 
   // Write hooks for each selected CLI
   const writtenSettingsPaths: { cli: IntegrationType; path: string }[] = [];
+  // Why Codex's user-scope hooks went to hooks.json rather than its system config.
+  let codexFallback: CodexSystemInstall | null = null;
   for (const cliId of selectedClis) {
     const integration = getIntegration(cliId);
+    // Codex runs a hooks.json hook only once a person has trusted it, so a
+    // headless `codex exec` skips every one of ours. Its system config is
+    // trusted as managed: put user-scope hooks there whenever root allows, and
+    // take them out of hooks.json so a trusted copy does not run them twice.
+    if (cliId === "codex" && scope === "user") {
+      const placed = installCodexSystemHooks(codexSystemHookEntries(binaryPath));
+      if (placed.ok) {
+        const userPath = integration.getSettingsPath("user", cwd);
+        if (existsSync(userPath)) integration.removeHooksFromFile(userPath);
+        writtenSettingsPaths.push({ cli: cliId, path: placed.path });
+        continue;
+      }
+      codexFallback = placed;
+    }
     // Usually one path; Hermes returns one per profile (each is a separate home
     // dir with its own config.yaml, and a missed one runs unhooked in silence).
     const settingsPaths = settingsPathsFor(integration, scope, cwd);
@@ -907,6 +930,17 @@ async function installHooksImpl(
   }
   if (scope === "project") console.log(`${INDENT}This file can be committed to git: it has no machine-specific paths.`);
 
+  // Codex on hooks.json: say so when Codex will not run them yet.
+  if (codexFallback && !codexFallback.ok) {
+    if (codexFallback.reason === "conflict" || codexFallback.reason === "unreadable" || codexFallback.reason === "write-failed") {
+      console.log(
+        kit.caution(`Couldn't add the Codex hooks to ${codexFallback.path}: ${codexFallback.detail ?? codexFallback.reason}.`),
+      );
+    }
+    const trust = codexHookTrust();
+    if (trust.kind === "untrusted") for (const line of kit.notice("caution", CODEX_UNTRUSTED_NOTICE)) console.log(line);
+  }
+
   // Warn about duplicate-scope installations (Claude Code only — uses HOOK_SCOPES)
   const otherScopes = deduplicateScopes(HOOK_SCOPES, cwd).filter((s) => s !== scope);
   const duplicates = otherScopes.filter((s) => hooksInstalledInSettings(s, cwd));
@@ -1060,6 +1094,30 @@ export async function removeHooks(policyNames?: string[], scope: HookScope | "al
           : [];
 
     for (const s of scopesToRemove) {
+      // Codex's user-scope hooks may be in its system config (see
+      // ./codex-system-hooks). Taken out first: a machine with no hooks.json
+      // still has them there.
+      let removedFromSystem = 0;
+      if (cliId === "codex" && s === "user") {
+        const system = removeCodexSystemHooks();
+        if (system.status === "removed") {
+          removedFromSystem = system.hooks;
+          if (scope !== "all") {
+            say(screenKit(optsFor(process.stdout)).ok(`Removed ${system.hooks} failproofai ${system.hooks === 1 ? "hook" : "hooks"} from Codex's system config.`));
+            for (const line of screenKit(optsFor(process.stdout)).kv([["settings", system.path]])) say(line);
+          }
+        } else if (system.status === "failed") {
+          // Non-interactive by design (this also runs from the dashboard), so
+          // the fix is to prime sudo and come back.
+          for (const line of screenKit(optsFor(process.stdout)).notice(
+            "caution",
+            `failproofai's Codex hooks are still in ${system.path}: ${system.reason}.\n` +
+              "Run  `sudo -v`,  then this command again.",
+          )) {
+            say(line);
+          }
+        }
+      }
       // Usually one path; Hermes returns one per profile.
       const settingsPaths = settingsPathsFor(integration, s, cwd);
       // A Hermes install copies its managed plugin before updating config.yaml.
@@ -1069,6 +1127,8 @@ export async function removeHooks(policyNames?: string[], scope: HookScope | "al
         cliId === "hermes" ? settingsPaths : settingsPaths.filter((p) => existsSync(p));
 
       if (existing.length === 0) {
+        totalRemoved += removedFromSystem;
+        if (removedFromSystem > 0) continue;
         if (scope !== "all" && selectedClis.length === 1) {
           say(screenKit(optsFor(process.stdout)).ok("No settings file found, so there is nothing to remove."));
           nothingToReport = true;
@@ -1076,7 +1136,7 @@ export async function removeHooks(policyNames?: string[], scope: HookScope | "al
         continue;
       }
 
-      let removedHere = 0;
+      let removedHere = removedFromSystem;
       for (const settingsPath of existing) {
         const removed = integration.removeHooksFromFile(settingsPath);
         removedHere += removed;