harness-everything 0.15.0 → 0.16.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.16.0](https://github.com/dyphn1/Harness-everything/compare/v0.15.0...v0.16.0) (2026-09-20)
+
+### Features
+
+* **codex:** add explicit hooks compatibility installer ([3fb622b](https://github.com/dyphn1/Harness-everything/commit/3fb622b57eef3a9ee5110529bcd2cdc8c81b6a75))
+* **codex:** expose explicit hook fallback CLI ([83e4cf1](https://github.com/dyphn1/Harness-everything/commit/83e4cf1eadd77585d4681bb73acbf360efd63509))
+
+### Bug Fixes
+
+* **codex:** contain compatibility runtime paths ([1ffcc0d](https://github.com/dyphn1/Harness-everything/commit/1ffcc0d984e7dbfd2dd987a03b189fb950e83de8))
+* **codex:** do not recreate removed hooks config ([ee62a1d](https://github.com/dyphn1/Harness-everything/commit/ee62a1d9f466a2e585e4737576a7289ae12087d5))
+* **codex:** fail closed on duplicate compat hooks ([29920d0](https://github.com/dyphn1/Harness-everything/commit/29920d07e76a73c84c35440b60453c3e0b648b29))
+* **codex:** harden compatibility hook ownership ([3ff5c14](https://github.com/dyphn1/Harness-everything/commit/3ff5c1456e6c44398ef661763057c93bcfcbb57c))
+* **codex:** record only inserted hook ownership ([90e0c9b](https://github.com/dyphn1/Harness-everything/commit/90e0c9bbfd4672955473d33f2e33832f760bf294))
+
 ## [0.15.0](https://github.com/dyphn1/Harness-everything/compare/v0.14.0...v0.15.0) (2026-09-20)
 
 ### Features

package/bin/cli.js

@@ -37,6 +37,9 @@ switch (command) {
   case 'verify-install':
     runInstallVerification(args.slice(1));
     break;
+  case 'codex-hooks':
+    runCodexHooksCompat(args.slice(1));
+    break;
   default:
     console.error(`[Error] Unknown command: "${command}"`);
     showHelp();
@@ -97,6 +100,10 @@ Commands:
                      work; hosts with UserPromptSubmit hooks receive it automatically.
   verify-install     Compare installed Harness manifests and skill trees with
                      this package source; stale versions or missing files fail.
+  codex-hooks        Explicit Codex user-hook compatibility fallback for hosts
+                     that fail to mount enabled plugin-bundled hooks.
+                     Usage: harness codex-hooks <install|status|uninstall>
+                     Does not trust hooks or modify Codex config.toml.
   verify             Run the pre-delivery verification gate (lint/test from the
                      nearest package.json). Exits non-zero if checks fail. This is
                      the explicit stand-in for a hard stop gate on platforms where
@@ -162,3 +169,13 @@ function runInstallVerification(verifyArgs) {
   const result = spawnSync('node', [script, ...verifyArgs], { stdio: 'inherit' });
   process.exit(result.status === null ? 1 : result.status);
 }
+
+function runCodexHooksCompat(compatArgs) {
+  const script = path.resolve(__dirname, '..', 'scripts', 'codex-hooks-compat.js');
+  if (!fs.existsSync(script)) {
+    console.error('[Error] Codex hooks compatibility script not found.');
+    process.exit(1);
+  }
+  const result = spawnSync('node', [script, ...compatArgs], { stdio: 'inherit' });
+  process.exit(result.status === null ? 1 : result.status);
+}

package/ci/mechanism-2al-codex-hooks-compat.test.js

@@ -0,0 +1,286 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const compat = require('../scripts/codex-hooks-compat');
+
+let failed = 0;
+function check(condition, message, detail = '') {
+  if (condition) console.log('  PASS ' + message);
+  else {
+    failed++;
+    console.error('  FAIL ' + message + (detail ? ' — ' + detail : ''));
+  }
+}
+
+function read(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function findHarnessEntries(config, runtimeDir) {
+  const out = [];
+  for (const [event, entries] of Object.entries(config.hooks || {})) {
+    for (const entry of entries || []) {
+      if (JSON.stringify(entry).toLowerCase().includes(path.resolve(runtimeDir).replace(/\\/g, '\\\\').toLowerCase()) ||
+          JSON.stringify(entry).replace(/\\\\/g, '/').toLowerCase().includes(path.resolve(runtimeDir).replace(/\\/g, '/').toLowerCase())) {
+        out.push({ event, entry });
+      }
+    }
+  }
+  return out;
+}
+
+console.log('\n[2al] Codex user-hook compatibility fallback (#122)...');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-codex-hooks-compat-'));
+const codexHome = path.join(root, '.codex');
+fs.mkdirSync(codexHome, { recursive: true });
+const hooksFile = path.join(codexHome, 'hooks.json');
+const configFile = path.join(codexHome, 'config.toml');
+const userHook = {
+  matcher: 'Bash',
+  hooks: [{
+    type: 'command',
+    command: 'node "/user/policy.js"',
+    timeout: 7,
+    statusMessage: 'User policy',
+  }],
+};
+const original = {
+  description: 'user-owned metadata',
+  hooks: {
+    PreToolUse: [userHook],
+    Stop: [{
+      hooks: [{ type: 'command', command: 'node "/user/stop.js"', timeout: 5 }],
+    }],
+  },
+};
+fs.writeFileSync(hooksFile, JSON.stringify(original, null, 4) + '\n', 'utf8');
+fs.writeFileSync(configFile, 'model = "test"\n# user trust/config state\n', 'utf8');
+const configBefore = fs.readFileSync(configFile, 'utf8');
+
+try {
+  const installed = compat.install({ codexHome });
+  check(installed.status === 'installed' && installed.entries > 0,
+    'explicit install materializes compatibility entries');
+  check(installed.trustChanged === false && fs.readFileSync(configFile, 'utf8') === configBefore,
+    'install never changes Codex trust/config.toml state');
+
+  const state = compat.status({ codexHome });
+  check(state.installed && state.healthy && state.exactEntriesPresent === state.expectedEntries,
+    'status verifies exact installed entry hashes and runtime tree');
+
+  const config = read(hooksFile);
+  check(config.description === original.description &&
+    JSON.stringify(config.hooks.PreToolUse[0]) === JSON.stringify(userHook) &&
+    config.hooks.Stop.some(entry => entry.hooks?.[0]?.command === 'node "/user/stop.js"'),
+    'existing unrelated user hooks and top-level metadata are preserved semantically');
+
+  const manifest = read(path.join(codexHome, 'harness-everything', 'compat-hooks', 'manifest.json'));
+  const harnessEntries = findHarnessEntries(config, manifest.runtimeDir);
+  check(harnessEntries.length === manifest.entries.length,
+    'every compatibility hook command resolves to the Harness-owned runtime copy');
+  check(!JSON.stringify(harnessEntries).includes('${PLUGIN_ROOT}') &&
+    !JSON.stringify(harnessEntries).includes('${CLAUDE_PLUGIN_ROOT}') &&
+    !JSON.stringify(harnessEntries).includes('%PLUGIN_ROOT%'),
+    'compatibility entries use literal absolute runtime paths without shell-specific plugin expansion');
+  check(fs.existsSync(path.join(manifest.runtimeDir, 'hooks', 'scripts', 'codex-action-gate-pre.js')) &&
+    fs.existsSync(path.join(manifest.runtimeDir, 'skills', 'harness-everything', 'scripts', 'kernel-router.js')),
+    'compatibility runtime is self-contained for hook and router dependencies');
+
+  const countsBefore = Object.fromEntries(Object.entries(config.hooks).map(([event, entries]) => [event, entries.length]));
+  const updated = compat.install({ codexHome });
+  const configAfterUpdate = read(hooksFile);
+  const countsAfter = Object.fromEntries(Object.entries(configAfterUpdate.hooks).map(([event, entries]) => [event, entries.length]));
+  check(updated.status === 'updated' && JSON.stringify(countsAfter) === JSON.stringify(countsBefore),
+    'reinstall/update is idempotent and does not duplicate hook entries');
+
+  configAfterUpdate.hooks.PostToolUse = configAfterUpdate.hooks.PostToolUse || [];
+  const addedUserHook = { hooks: [{ type: 'command', command: 'node "/user/later.js"', timeout: 3 }] };
+  configAfterUpdate.hooks.PostToolUse.unshift(addedUserHook);
+  fs.writeFileSync(hooksFile, JSON.stringify(configAfterUpdate, null, 2) + '\n', 'utf8');
+  compat.install({ codexHome });
+  check(read(hooksFile).hooks.PostToolUse.some(entry => entry.hooks?.[0]?.command === 'node "/user/later.js"'),
+    'update preserves user hooks added after the initial compatibility install');
+
+  const beforeTamper = fs.readFileSync(hooksFile, 'utf8');
+  const tampered = read(hooksFile);
+  const currentManifest = read(path.join(codexHome, 'harness-everything', 'compat-hooks', 'manifest.json'));
+  let changed = false;
+  for (const [event, entries] of Object.entries(tampered.hooks)) {
+    for (const entry of entries) {
+      if (!changed && JSON.stringify(entry).replace(/\\\\/g, '/').toLowerCase()
+          .includes(path.resolve(currentManifest.runtimeDir).replace(/\\/g, '/').toLowerCase())) {
+        entry.hooks[0].statusMessage = 'user modified this installed Harness hook';
+        changed = true;
+      }
+    }
+  }
+  fs.writeFileSync(hooksFile, JSON.stringify(tampered, null, 2) + '\n', 'utf8');
+  const tamperedBytes = fs.readFileSync(hooksFile, 'utf8');
+  let updateRefused = false;
+  try { compat.install({ codexHome }); } catch (error) { updateRefused = /modified/.test(error.message); }
+  check(updateRefused && fs.readFileSync(hooksFile, 'utf8') === tamperedBytes,
+    'modified Harness compatibility entry makes update fail closed without rewriting user config');
+
+  let uninstallRefused = false;
+  try { compat.uninstall({ codexHome }); } catch (error) { uninstallRefused = /modified/.test(error.message); }
+  check(uninstallRefused && fs.readFileSync(hooksFile, 'utf8') === tamperedBytes,
+    'modified Harness compatibility entry makes uninstall fail closed rather than deleting user edits');
+
+  // Restore the exact generated config by starting from the pre-tamper bytes.
+  fs.writeFileSync(hooksFile, beforeTamper, 'utf8');
+  compat.install({ codexHome });
+  const removed = compat.uninstall({ codexHome });
+  const finalConfig = read(hooksFile);
+  check(removed.status === 'uninstalled' && removed.removed > 0 && removed.trustChanged === false,
+    'explicit uninstall removes exact Harness-owned entries without changing trust state');
+  check(finalConfig.description === original.description &&
+    finalConfig.hooks.PreToolUse.some(entry => entry.hooks?.[0]?.command === 'node "/user/policy.js"') &&
+    finalConfig.hooks.Stop.some(entry => entry.hooks?.[0]?.command === 'node "/user/stop.js"') &&
+    finalConfig.hooks.PostToolUse.some(entry => entry.hooks?.[0]?.command === 'node "/user/later.js"'),
+    'uninstall preserves unrelated pre-existing and later-added user hooks');
+  check(fs.readFileSync(configFile, 'utf8') === configBefore,
+    'uninstall leaves config.toml/trust state byte-identical');
+  check(!fs.existsSync(path.join(codexHome, 'harness-everything', 'compat-hooks', 'manifest.json')),
+    'uninstall removes Harness compatibility ownership manifest');
+
+  const emptyHome = path.join(root, 'empty-codex');
+  fs.mkdirSync(emptyHome, { recursive: true });
+  compat.install({ codexHome: emptyHome });
+  check(fs.existsSync(path.join(emptyHome, 'hooks.json')),
+    'compatibility install can create a new hooks.json when none exists');
+  compat.uninstall({ codexHome: emptyHome });
+  check(!fs.existsSync(path.join(emptyHome, 'hooks.json')),
+    'uninstall removes hooks.json only when Harness created it and no user entries remain');
+
+  const duplicateHome = path.join(root, 'duplicate-codex');
+  fs.mkdirSync(duplicateHome, { recursive: true });
+  compat.install({ codexHome: duplicateHome });
+  const duplicateConfig = read(path.join(duplicateHome, 'hooks.json'));
+  duplicateConfig.hooks.PreToolUse.push(JSON.parse(JSON.stringify(duplicateConfig.hooks.PreToolUse[0])));
+  fs.writeFileSync(path.join(duplicateHome, 'hooks.json'), JSON.stringify(duplicateConfig, null, 2) + '\n', 'utf8');
+  const duplicateBytes = fs.readFileSync(path.join(duplicateHome, 'hooks.json'), 'utf8');
+  let duplicateRefused = false;
+  try { compat.uninstall({ codexHome: duplicateHome }); } catch (error) { duplicateRefused = /modified/.test(error.message); }
+  check(duplicateRefused && fs.readFileSync(path.join(duplicateHome, 'hooks.json'), 'utf8') === duplicateBytes,
+    'extra identical Harness hook is treated as user config drift, not silently deleted');
+
+  const removedConfigHome = path.join(root, 'removed-config-codex');
+  fs.mkdirSync(removedConfigHome, { recursive: true });
+  fs.writeFileSync(path.join(removedConfigHome, 'hooks.json'), JSON.stringify(original, null, 2) + '\n', 'utf8');
+  compat.install({ codexHome: removedConfigHome });
+  fs.rmSync(path.join(removedConfigHome, 'hooks.json'), { force: true });
+  const removedConfigResult = compat.uninstall({ codexHome: removedConfigHome });
+  check(removedConfigResult.status === 'uninstalled' && !fs.existsSync(path.join(removedConfigHome, 'hooks.json')),
+    'uninstall never recreates a user hooks.json that was removed after compatibility install');
+
+  const preexistingHome = path.join(root, 'preexisting-identical-codex');
+  fs.mkdirSync(preexistingHome, { recursive: true });
+  const sourceHash = compat.treeHash(compat.SOURCE_PLUGIN_ROOT);
+  const preexistingPaths = compat.pathsFor(preexistingHome, sourceHash);
+  const preexistingEntries = compat.sourceHookEntries(preexistingPaths.runtimeDir);
+  const preexistingHooks = {};
+  for (const record of preexistingEntries) {
+    preexistingHooks[record.event] = preexistingHooks[record.event] || [];
+    preexistingHooks[record.event].push(JSON.parse(JSON.stringify(record.entry)));
+  }
+  fs.writeFileSync(path.join(preexistingHome, 'hooks.json'),
+    JSON.stringify({ hooks: preexistingHooks }, null, 2) + '\n', 'utf8');
+  const preexistingBefore = fs.readFileSync(path.join(preexistingHome, 'hooks.json'), 'utf8');
+  const preexistingInstall = compat.install({ codexHome: preexistingHome });
+  const preexistingManifest = read(path.join(preexistingHome, 'harness-everything', 'compat-hooks', 'manifest.json'));
+  check(preexistingInstall.status === 'installed' && preexistingManifest.entries.length === 0,
+    'byte-identical pre-existing user hooks are reused but never recorded as Harness-owned');
+  const preexistingRemoved = compat.uninstall({ codexHome: preexistingHome });
+  check(preexistingRemoved.removed === 0 &&
+    fs.readFileSync(path.join(preexistingHome, 'hooks.json'), 'utf8') === preexistingBefore,
+    'uninstall preserves byte-identical hooks that predated compatibility install');
+
+  const forgedManifestHome = path.join(root, 'forged-manifest-codex');
+  fs.mkdirSync(forgedManifestHome, { recursive: true });
+  fs.writeFileSync(path.join(forgedManifestHome, 'hooks.json'),
+    JSON.stringify({ hooks: { PreToolUse: [userHook] } }, null, 2) + '\n', 'utf8');
+  compat.install({ codexHome: forgedManifestHome });
+  const forgedManifestPath = path.join(
+    forgedManifestHome, 'harness-everything', 'compat-hooks', 'manifest.json');
+  const forgedManifest = read(forgedManifestPath);
+  forgedManifest.entries.push({
+    event: 'PreToolUse',
+    hash: compat.entryHash(userHook),
+    entry: userHook,
+  });
+  fs.writeFileSync(forgedManifestPath, JSON.stringify(forgedManifest, null, 2) + '\n', 'utf8');
+  const forgedHooksBefore = fs.readFileSync(path.join(forgedManifestHome, 'hooks.json'), 'utf8');
+  let forgedManifestRefused = false;
+  try { compat.uninstall({ codexHome: forgedManifestHome }); }
+  catch (error) { forgedManifestRefused = /corrupt/.test(error.message); }
+  check(forgedManifestRefused &&
+    fs.readFileSync(path.join(forgedManifestHome, 'hooks.json'), 'utf8') === forgedHooksBefore,
+    'forged manifest ownership fails closed without deleting a user hook');
+
+  const failedInstallHome = path.join(root, 'failed-install-codex');
+  fs.mkdirSync(failedInstallHome, { recursive: true });
+  const failedInstallHooks = path.join(failedInstallHome, 'hooks.json');
+  fs.writeFileSync(failedInstallHooks,
+    JSON.stringify({ description: 'must survive', hooks: { PreToolUse: [userHook] } }, null, 4) + '\n',
+    'utf8');
+  const failedInstallBefore = fs.readFileSync(failedInstallHooks, 'utf8');
+  const failedManifestPath = path.join(
+    failedInstallHome, 'harness-everything', 'compat-hooks', 'manifest.json');
+  const realRenameSync = fs.renameSync;
+  let failedInstallRefused = false;
+  fs.renameSync = function injectedManifestFailure(source, destination) {
+    if (path.resolve(destination) === path.resolve(failedManifestPath)) {
+      throw new Error('injected manifest commit failure');
+    }
+    return realRenameSync(source, destination);
+  };
+  try { compat.install({ codexHome: failedInstallHome }); }
+  catch (error) { failedInstallRefused = /injected manifest commit failure/.test(error.message); }
+  finally { fs.renameSync = realRenameSync; }
+  check(failedInstallRefused &&
+    fs.readFileSync(failedInstallHooks, 'utf8') === failedInstallBefore &&
+    !fs.existsSync(failedManifestPath),
+    'failed manifest commit rolls hooks.json back byte-identically');
+
+  const linkedOwnerHome = path.join(root, 'linked-owner-codex');
+  const linkedOwnerOutside = path.join(root, 'linked-owner-outside');
+  fs.mkdirSync(path.join(linkedOwnerHome, 'harness-everything'), { recursive: true });
+  fs.mkdirSync(linkedOwnerOutside, { recursive: true });
+  fs.symlinkSync(
+    linkedOwnerOutside,
+    path.join(linkedOwnerHome, 'harness-everything', 'compat-hooks'),
+    process.platform === 'win32' ? 'junction' : 'dir'
+  );
+  let linkedOwnerRefused = false;
+  try { compat.install({ codexHome: linkedOwnerHome }); }
+  catch (error) { linkedOwnerRefused = /linked|outside/.test(error.message); }
+  check(linkedOwnerRefused && fs.readdirSync(linkedOwnerOutside).length === 0,
+    'linked compatibility owner path cannot redirect writes outside Codex home');
+
+  const malformedHome = path.join(root, 'malformed-codex');
+  fs.mkdirSync(malformedHome, { recursive: true });
+  const malformed = path.join(malformedHome, 'hooks.json');
+  fs.writeFileSync(malformed, '{ this is not json', 'utf8');
+  const malformedBefore = fs.readFileSync(malformed, 'utf8');
+  let malformedRefused = false;
+  try { compat.install({ codexHome: malformedHome }); } catch (_) { malformedRefused = true; }
+  check(malformedRefused && fs.readFileSync(malformed, 'utf8') === malformedBefore,
+    'malformed user hooks.json fails closed without replacement');
+
+  const source = read(path.join(compat.SOURCE_PLUGIN_ROOT, 'hooks', 'hooks.json'));
+  const sourceCount = Object.values(source.hooks).reduce((sum, entries) => sum + entries.length, 0);
+  check(sourceCount === installed.entries,
+    'fallback derives from the current packaged hook manifest instead of maintaining a second manual hook inventory');
+} finally {
+  fs.rmSync(root, { recursive: true, force: true });
+}
+
+console.log('\n' + (failed === 0 ? 'PASS' : 'FAIL') +
+  ': #122 Codex compatibility fallback (' + failed + ' failure' + (failed === 1 ? '' : 's') + ')');
+process.exit(failed === 0 ? 0 : 1);

package/docs/platform-capabilities.md

@@ -64,6 +64,22 @@ Codex has two paths that must not be collapsed:
 
 The package is tested at the mechanism layer and remains subject to the host’s hook review/trust flow. A fresh host session is still required before claiming that a particular ChatGPT/Codex installation loaded and fired the hooks or that the model followed read-before-skip.
 
+### Explicit Codex user-hook compatibility fallback
+
+Current Codex documentation supports plugin-bundled hooks, so native plugin mounting remains the preferred path. Some host/source combinations have nevertheless failed to expose enabled plugin hooks for review/entry attribution (#122 and upstream Codex reports). Harness therefore provides an **explicit compatibility fallback**, not an automatic replacement for native plugin hooks:
+
+```bash
+harness codex-hooks install
+harness codex-hooks status
+harness codex-hooks uninstall
+```
+
+The fallback copies the current packaged runtime into `$CODEX_HOME/harness-everything/compat-hooks/` and merges absolute-path entries into `$CODEX_HOME/hooks.json`. It does **not** modify `config.toml`, trust hashes, approval policy, or hook enablement. Codex must still show/review/trust the resulting non-managed hooks through its normal `/hooks` flow.
+
+Ownership is deliberately strict: update/uninstall removes only exact entries recorded in the Harness compatibility manifest. If an installed Harness entry was edited after installation, the operation fails closed rather than overwriting or deleting that user-modified entry. Unrelated pre-existing and later-added user hooks are preserved.
+
+This fallback solves only plugin-source discovery/mounting. It does not claim to repair a Codex carrier that fails to dispatch `PreToolUse` at all; those host-level execution-path limitations remain a live compatibility boundary.
+
 The public OpenAI Skills-only plugin is narrower again. Its ZIP contains the packaged `skills/` tree and referenced files, but not the local `.codex-plugin` lifecycle hooks. Public submission readiness is therefore a package/form contract, not evidence of public-directory approval or live hook execution.
 
 ## Install/uninstall ownership boundary

package/docs/platform-compatibility.json

@@ -1,6 +1,6 @@
 {
   "format": "harness-platform-compatibility-v1",
-  "last_reviewed": "2026-09-14",
+  "last_reviewed": "2026-09-19",
   "status_vocabulary": {
     "Supported": "An official or native mechanism exists and the Harness behavior is verified.",
     "Mechanism verified": "Harness package, adapter, or installer checks pass, but a real host run is not confirmed.",
@@ -109,13 +109,13 @@
         "standaloneSkills": {"status": "Supported", "paths": {"project": [".agents/skills"], "global": ["~/.agents/skills"]}},
         "pluginSupport": {"status": "Mechanism verified", "paths": {"manifest": ["plugin.json", ".codex-plugin/plugin.json"]}},
         "bundledSkills": {"status": "Mechanism verified", "notes": "The local package contains a root skills/ tree."},
-        "hooksLifecycle": {"status": "Mechanism verified", "notes": "Codex-supported SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, SubagentStart, SubagentStop, and Stop are covered by package checks; the plugin intentionally does not declare unsupported PostToolUseFailure. Non-managed hooks still require trust."},
+        "hooksLifecycle": {"status": "Mechanism verified", "notes": "Codex officially supports plugin-bundled hooks and the local package is mechanism-tested. The plugin intentionally does not declare unsupported PostToolUseFailure; Codex uses documented PostToolUse semantics instead. Harness also provides an explicit user-config compatibility fallback that copies the packaged runtime and merges exact-owned entries into $CODEX_HOME/hooks.json without changing trust/config.toml. Neither path is promoted to live verified until a real host exposes and executes the hooks."},
         "projectScope": {"status": "Mechanism verified", "paths": {"skills": [".agents/skills"], "instructions": ["AGENTS.md"]}},
         "globalScope": {"status": "Mechanism verified", "paths": {"skills": ["~/.agents/skills"]}},
-        "installUninstallSymmetry": {"status": "Mechanism verified", "notes": "Harness installer round-trip checks cover owned files and user-owned collisions."},
+        "installUninstallSymmetry": {"status": "Mechanism verified", "notes": "General Harness installer ownership is mechanism-tested. The optional codex-hooks compatibility fallback separately has exact-entry update/uninstall ownership tests and preserves unrelated user hooks; live Codex trust/dispatch still requires host evidence."},
         "assetsReferences": {"status": "Mechanism verified", "notes": "Packaged skill references are checked and remain inside the package."},
         "updateSync": {"status": "Unknown", "notes": "A real marketplace refresh has not been run in a Codex host."},
-        "liveHostVerification": {"status": "Unknown", "notes": "No preserved Codex plugin/session artifact is committed."}
+        "liveHostVerification": {"status": "Unknown", "notes": "No preserved Codex plugin/session artifact proves current bundled-hook entry. Native plugin mounting is preferred; the explicit user-hook fallback is mechanism-verified only and does not solve host carriers that bypass hook dispatch."}
       }
     },
     {

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -54,7 +54,9 @@
     "test:contract-integrity": "node ci/contract-integrity.test.js",
     "contract:integrity": "node contract-integrity/scripts/audit.js",
     "waza:check": "node scripts/waza-harness-check.js",
-    "test:waza:compat": "node ci/mechanism-2aj-waza-reference-adapter.test.js"
+    "test:waza:compat": "node ci/mechanism-2aj-waza-reference-adapter.test.js",
+    "codex:hooks": "node scripts/codex-hooks-compat.js",
+    "test:codex:hooks-compat": "node ci/mechanism-2al-codex-hooks-compat.test.js"
   },
   "engines": {
     "node": ">=22"

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/scripts/codex-hooks-compat.js

@@ -0,0 +1,521 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const PACKAGE_ROOT = path.resolve(__dirname, '..');
+const SOURCE_PLUGIN_ROOT = path.join(PACKAGE_ROOT, 'plugins', 'harness-everything');
+const PACKAGE_VERSION = require(path.join(PACKAGE_ROOT, 'package.json')).version;
+const MANIFEST_SCHEMA = 1;
+const MANIFEST_MODE = 'codex-user-hooks-compat';
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map(key => [key, stable(value[key])]));
+}
+
+function stableJson(value) {
+  return JSON.stringify(stable(value));
+}
+
+function sha256(value) {
+  return crypto.createHash('sha256').update(value).digest('hex');
+}
+
+function treeHash(root) {
+  if (fs.lstatSync(root).isSymbolicLink()) {
+    throw new Error('refusing linked compatibility runtime: ' + root);
+  }
+  const rows = [];
+  function walk(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = path.join(dir, entry.name);
+      const rel = path.relative(root, full).replace(/\\/g, '/');
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) rows.push(rel + ':' + sha256(fs.readFileSync(full)));
+      else if (entry.isSymbolicLink()) throw new Error('refusing linked compatibility runtime entry: ' + full);
+    }
+  }
+  walk(root);
+  return sha256(rows.join('\n'));
+}
+
+function entryHash(entry) {
+  return sha256(stableJson(entry));
+}
+
+function defaultCodexHome(env = process.env) {
+  return path.resolve(env.CODEX_HOME || path.join(os.homedir(), '.codex'));
+}
+
+function pathsFor(codexHome, sourceHash = null) {
+  const home = path.resolve(codexHome);
+  const ownerRoot = path.join(home, 'harness-everything', 'compat-hooks');
+  const runtimeId = sourceHash ? PACKAGE_VERSION + '-' + sourceHash.slice(0, 12) : null;
+  return {
+    codexHome: home,
+    hooksFile: path.join(home, 'hooks.json'),
+    configFile: path.join(home, 'config.toml'),
+    ownerRoot,
+    manifestFile: path.join(ownerRoot, 'manifest.json'),
+    runtimeRoot: path.join(ownerRoot, 'runtime'),
+    runtimeDir: runtimeId ? path.join(ownerRoot, 'runtime', runtimeId) : null,
+  };
+}
+
+function readJsonObject(file, fallback) {
+  if (!fs.existsSync(file)) return fallback;
+  const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(file + ' must contain a JSON object');
+  }
+  return parsed;
+}
+
+function readHooksFile(file) {
+  const data = readJsonObject(file, { hooks: {} });
+  if (data.hooks === undefined) data.hooks = {};
+  if (!data.hooks || typeof data.hooks !== 'object' || Array.isArray(data.hooks)) {
+    throw new Error(file + ' has invalid hooks object');
+  }
+  for (const [event, entries] of Object.entries(data.hooks)) {
+    if (!Array.isArray(entries)) throw new Error(file + ' hooks.' + event + ' must be an array');
+  }
+  return data;
+}
+
+function samePath(left, right) {
+  const normalize = value => {
+    const resolved = path.resolve(value);
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+  };
+  return normalize(left) === normalize(right);
+}
+
+function isPathInside(root, candidate) {
+  const relative = path.relative(path.resolve(root), path.resolve(candidate));
+  return relative !== '' && relative !== '..' && !relative.startsWith('..' + path.sep) && !path.isAbsolute(relative);
+}
+
+function assertOwnedPath(codexHome, target, label) {
+  const home = path.resolve(codexHome);
+  const resolvedTarget = path.resolve(target);
+  if (!samePath(home, resolvedTarget) && !isPathInside(home, resolvedTarget)) {
+    throw new Error('refusing outside Codex home ' + label + ': ' + target);
+  }
+  if (!fs.existsSync(home)) return;
+
+  const realpath = fs.realpathSync.native || fs.realpathSync;
+  const physicalHome = realpath(home);
+  const relative = path.relative(home, resolvedTarget);
+  let current = home;
+  for (const segment of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    if (!fs.existsSync(current)) break;
+    if (fs.lstatSync(current).isSymbolicLink()) {
+      throw new Error('refusing linked ' + label + ': ' + current);
+    }
+    const physical = realpath(current);
+    if (!samePath(physicalHome, physical) && !isPathInside(physicalHome, physical)) {
+      throw new Error('refusing outside Codex home ' + label + ': ' + current);
+    }
+  }
+}
+
+function assertCompatibilityPaths(paths) {
+  for (const [label, target] of [
+    ['hooks file', paths.hooksFile],
+    ['compatibility owner', paths.ownerRoot],
+    ['compatibility manifest', paths.manifestFile],
+    ['compatibility runtime root', paths.runtimeRoot],
+    ['compatibility runtime', paths.runtimeDir],
+  ]) {
+    if (target) assertOwnedPath(paths.codexHome, target, label);
+  }
+}
+
+function readManifest(file, expectedPaths = null) {
+  if (!fs.existsSync(file)) return null;
+  const data = readJsonObject(file, null);
+  if (data.schemaVersion !== MANIFEST_SCHEMA ||
+      data.package !== 'harness-everything' ||
+      data.mode !== MANIFEST_MODE ||
+      typeof data.packageVersion !== 'string' ||
+      !/^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$/.test(data.packageVersion) ||
+      typeof data.sourcePluginSha256 !== 'string' ||
+      !/^[0-9a-f]{64}$/.test(data.sourcePluginSha256) ||
+      typeof data.runtimeDir !== 'string' ||
+      typeof data.hooksFile !== 'string' ||
+      typeof data.createdHooksFile !== 'boolean' ||
+      !Array.isArray(data.entries)) {
+    throw new Error('refusing unknown/corrupt Harness compatibility manifest: ' + file);
+  }
+  if (!expectedPaths) return data;
+
+  const expectedRuntimeDir = path.join(
+    expectedPaths.runtimeRoot,
+    data.packageVersion + '-' + data.sourcePluginSha256.slice(0, 12)
+  );
+  assertOwnedPath(expectedPaths.codexHome, data.runtimeDir, 'manifest runtime');
+  if (!samePath(data.hooksFile, expectedPaths.hooksFile) ||
+      !isPathInside(expectedPaths.runtimeRoot, data.runtimeDir) ||
+      !samePath(data.runtimeDir, expectedRuntimeDir) ||
+      !fs.existsSync(data.runtimeDir) ||
+      treeHash(data.runtimeDir) !== data.sourcePluginSha256) {
+    throw new Error('refusing unknown/corrupt Harness compatibility manifest: ' + file);
+  }
+
+  const allowed = new Map();
+  for (const record of hookEntriesFrom(path.resolve(data.runtimeDir), path.resolve(data.runtimeDir))) {
+    const key = record.event + '\0' + record.hash;
+    if (!allowed.has(key)) allowed.set(key, []);
+    allowed.get(key).push(stableJson(record.entry));
+  }
+  for (const record of data.entries) {
+    if (!record || typeof record !== 'object' || Array.isArray(record) ||
+        typeof record.event !== 'string' || !record.event ||
+        typeof record.hash !== 'string' || !/^[0-9a-f]{64}$/.test(record.hash) ||
+        !record.entry || typeof record.entry !== 'object' || Array.isArray(record.entry) ||
+        entryHash(record.entry) !== record.hash) {
+      throw new Error('refusing unknown/corrupt Harness compatibility manifest: ' + file);
+    }
+    const key = record.event + '\0' + record.hash;
+    const candidates = allowed.get(key) || [];
+    const serialized = stableJson(record.entry);
+    const match = candidates.indexOf(serialized);
+    if (match === -1) {
+      throw new Error('refusing unknown/corrupt Harness compatibility manifest: ' + file);
+    }
+    candidates.splice(match, 1);
+  }
+  return data;
+}
+
+function atomicWriteFile(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const temp = file + '.' + process.pid + '.tmp';
+  try {
+    fs.writeFileSync(temp, value);
+    fs.renameSync(temp, file);
+  } finally {
+    try { if (fs.existsSync(temp)) fs.rmSync(temp, { force: true }); } catch (_) {}
+  }
+}
+
+function atomicWriteJson(file, value) {
+  atomicWriteFile(file, JSON.stringify(value, null, 2) + '\n');
+}
+
+function replacePluginRoot(value, runtimeDir, windowsForm) {
+  if (typeof value !== 'string') return value;
+  const root = windowsForm
+    ? runtimeDir.replace(/\//g, '\\')
+    : runtimeDir.replace(/\\/g, '/');
+  return value
+    .replace(/\$\{PLUGIN_ROOT\}/g, root)
+    .replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, root);
+}
+
+function transformEntry(entry, runtimeDir) {
+  function visit(value, key) {
+    if (Array.isArray(value)) return value.map(item => visit(item, key));
+    if (value && typeof value === 'object') {
+      return Object.fromEntries(Object.entries(value).map(([childKey, child]) => [childKey, visit(child, childKey)]));
+    }
+    if (typeof value === 'string') return replacePluginRoot(value, runtimeDir, key === 'commandWindows');
+    return value;
+  }
+  return visit(JSON.parse(JSON.stringify(entry)), null);
+}
+
+function containsPath(entry, target) {
+  const normalized = path.resolve(target).replace(/\\/g, '/').toLowerCase();
+  const text = JSON.stringify(entry).replace(/\\\\/g, '/').replace(/\\/g, '/').toLowerCase();
+  return text.includes(normalized);
+}
+
+function removePriorEntries(config, prior) {
+  const priorByEvent = new Map();
+  for (const record of prior.entries || []) {
+    if (!priorByEvent.has(record.event)) priorByEvent.set(record.event, new Map());
+    const counts = priorByEvent.get(record.event);
+    counts.set(record.hash, (counts.get(record.hash) || 0) + 1);
+  }
+
+  const drift = [];
+  const removed = [];
+  const nextHooks = { ...config.hooks };
+  for (const [event, expectedCounts] of priorByEvent) {
+    const remaining = new Map(expectedCounts);
+    const entries = Array.isArray(nextHooks[event]) ? nextHooks[event] : [];
+    const kept = [];
+    for (const entry of entries) {
+      const hash = entryHash(entry);
+      const count = remaining.get(hash) || 0;
+      if (count > 0) {
+        removed.push({ event, hash });
+        remaining.set(hash, count - 1);
+        continue;
+      }
+      if (prior.runtimeDir && containsPath(entry, prior.runtimeDir)) {
+        drift.push({
+          event,
+          hash,
+          reason: expectedCounts.has(hash)
+            ? 'unexpected duplicate Harness compatibility hook'
+            : 'Harness compatibility hook was modified after install',
+        });
+      }
+      kept.push(entry);
+    }
+    nextHooks[event] = kept;
+  }
+  return { config: { ...config, hooks: nextHooks }, drift, removed };
+}
+
+function hookEntriesFrom(pluginRoot, runtimeDir) {
+  const sourceFile = path.join(pluginRoot, 'hooks', 'hooks.json');
+  const source = readHooksFile(sourceFile);
+  const records = [];
+  for (const [event, entries] of Object.entries(source.hooks)) {
+    for (const entry of entries) {
+      const transformed = transformEntry(entry, runtimeDir);
+      records.push({ event, hash: entryHash(transformed), entry: transformed });
+    }
+  }
+  return records;
+}
+
+function sourceHookEntries(runtimeDir) {
+  return hookEntriesFrom(SOURCE_PLUGIN_ROOT, runtimeDir);
+}
+
+function ensureRuntime(runtimeDir, sourceHash) {
+  if (fs.existsSync(runtimeDir)) {
+    if (treeHash(runtimeDir) === sourceHash) return;
+    fs.rmSync(runtimeDir, { recursive: true, force: true });
+  }
+  fs.mkdirSync(path.dirname(runtimeDir), { recursive: true });
+  const temp = runtimeDir + '.tmp-' + process.pid;
+  try {
+    fs.rmSync(temp, { recursive: true, force: true });
+    fs.cpSync(SOURCE_PLUGIN_ROOT, temp, { recursive: true });
+    if (treeHash(temp) !== sourceHash) throw new Error('copied compatibility runtime hash mismatch');
+    fs.renameSync(temp, runtimeDir);
+  } finally {
+    try { if (fs.existsSync(temp)) fs.rmSync(temp, { recursive: true, force: true }); } catch (_) {}
+  }
+}
+
+function install(options = {}) {
+  const codexHome = path.resolve(options.codexHome || defaultCodexHome(options.env));
+  const sourceHash = treeHash(SOURCE_PLUGIN_ROOT);
+  const p = pathsFor(codexHome, sourceHash);
+  assertCompatibilityPaths(p);
+  const existedBefore = fs.existsSync(p.hooksFile);
+  const hooksBefore = existedBefore ? fs.readFileSync(p.hooksFile) : null;
+  const runtimeExistedBefore = fs.existsSync(p.runtimeDir);
+  const config = readHooksFile(p.hooksFile);
+  const prior = readManifest(p.manifestFile, p);
+
+  let base = config;
+  if (prior) {
+    const removal = removePriorEntries(config, prior);
+    if (removal.drift.length) {
+      throw new Error('refusing to update: installed Harness compatibility hooks were modified; restore or uninstall them manually first');
+    }
+    base = removal.config;
+  }
+
+  ensureRuntime(p.runtimeDir, sourceHash);
+  assertCompatibilityPaths(p);
+  const generated = sourceHookEntries(p.runtimeDir);
+  const ownedEntries = [];
+  const next = { ...base, hooks: { ...base.hooks } };
+  for (const record of generated) {
+    const list = Array.isArray(next.hooks[record.event]) ? [...next.hooks[record.event]] : [];
+    if (!list.some(entry => entryHash(entry) === record.hash)) {
+      list.push(record.entry);
+      ownedEntries.push(record);
+    }
+    next.hooks[record.event] = list;
+  }
+
+  const manifest = {
+    schemaVersion: MANIFEST_SCHEMA,
+    package: 'harness-everything',
+    mode: MANIFEST_MODE,
+    packageVersion: PACKAGE_VERSION,
+    sourcePluginSha256: sourceHash,
+    runtimeDir: p.runtimeDir,
+    hooksFile: p.hooksFile,
+    createdHooksFile: prior ? Boolean(prior.createdHooksFile) : !existedBefore,
+    installedAt: new Date().toISOString(),
+    entries: ownedEntries.map(({ event, hash, entry }) => ({ event, hash, entry })),
+  };
+  try {
+    assertCompatibilityPaths(p);
+    atomicWriteJson(p.hooksFile, next);
+    atomicWriteJson(p.manifestFile, manifest);
+  } catch (error) {
+    try {
+      if (hooksBefore === null) fs.rmSync(p.hooksFile, { force: true });
+      else atomicWriteFile(p.hooksFile, hooksBefore);
+    } catch (rollbackError) {
+      error.message += '; hooks.json rollback also failed: ' + rollbackError.message;
+    }
+    if (!runtimeExistedBefore) {
+      try { fs.rmSync(p.runtimeDir, { recursive: true, force: true }); } catch (_) {}
+    }
+    throw error;
+  }
+
+  if (prior && prior.runtimeDir && path.resolve(prior.runtimeDir) !== path.resolve(p.runtimeDir)) {
+    const ownedRoot = path.resolve(p.runtimeRoot) + path.sep;
+    const oldRuntime = path.resolve(prior.runtimeDir);
+    if (oldRuntime.startsWith(ownedRoot)) fs.rmSync(oldRuntime, { recursive: true, force: true });
+  }
+
+  return {
+    status: prior ? 'updated' : 'installed',
+    codexHome,
+    hooksFile: p.hooksFile,
+    runtimeDir: p.runtimeDir,
+    entries: generated.length,
+    trustChanged: false,
+  };
+}
+
+function uninstall(options = {}) {
+  const codexHome = path.resolve(options.codexHome || defaultCodexHome(options.env));
+  const p = pathsFor(codexHome);
+  assertCompatibilityPaths(p);
+  const prior = readManifest(p.manifestFile, p);
+  if (!prior) return { status: 'not-installed', codexHome, removed: 0, trustChanged: false };
+
+  const hooksFileExists = fs.existsSync(p.hooksFile);
+  const config = readHooksFile(p.hooksFile);
+  const removal = removePriorEntries(config, prior);
+  if (removal.drift.length) {
+    throw new Error('refusing to uninstall modified Harness compatibility hooks; no user config was changed');
+  }
+
+  const remainingHooks = Object.fromEntries(
+    Object.entries(removal.config.hooks)
+      .map(([event, entries]) => [event, entries])
+      .filter(([, entries]) => Array.isArray(entries) && entries.length > 0)
+  );
+  const next = { ...removal.config, hooks: remainingHooks };
+  const otherTopLevelKeys = Object.keys(next).filter(key => key !== 'hooks');
+
+  if (!hooksFileExists) {
+    // The user or host already removed the config. Uninstall must not recreate it.
+  } else if (prior.createdHooksFile && otherTopLevelKeys.length === 0 && Object.keys(remainingHooks).length === 0) {
+    fs.rmSync(p.hooksFile, { force: true });
+  } else {
+    atomicWriteJson(p.hooksFile, next);
+  }
+
+  if (prior.runtimeDir) {
+    const ownedRoot = path.resolve(p.runtimeRoot) + path.sep;
+    const runtime = path.resolve(prior.runtimeDir);
+    if (runtime.startsWith(ownedRoot)) fs.rmSync(runtime, { recursive: true, force: true });
+  }
+  fs.rmSync(p.manifestFile, { force: true });
+  try { fs.rmdirSync(p.runtimeRoot); } catch (_) {}
+  try { fs.rmdirSync(p.ownerRoot); } catch (_) {}
+  try { fs.rmdirSync(path.dirname(p.ownerRoot)); } catch (_) {}
+
+  return {
+    status: 'uninstalled',
+    codexHome,
+    removed: removal.removed.length,
+    trustChanged: false,
+  };
+}
+
+function status(options = {}) {
+  const codexHome = path.resolve(options.codexHome || defaultCodexHome(options.env));
+  const p = pathsFor(codexHome);
+  assertCompatibilityPaths(p);
+  const prior = readManifest(p.manifestFile, p);
+  if (!prior) return { installed: false, codexHome, hooksFile: p.hooksFile, trustChanged: false };
+  const config = readHooksFile(p.hooksFile);
+  const removal = removePriorEntries(config, prior);
+  const expected = prior.entries.length;
+  return {
+    installed: true,
+    codexHome,
+    hooksFile: p.hooksFile,
+    runtimeDir: prior.runtimeDir,
+    packageVersion: prior.packageVersion,
+    sourcePluginSha256: prior.sourcePluginSha256,
+    expectedEntries: expected,
+    exactEntriesPresent: removal.removed.length,
+    drift: removal.drift,
+    healthy: removal.removed.length === expected && removal.drift.length === 0 &&
+      fs.existsSync(prior.runtimeDir) && treeHash(prior.runtimeDir) === prior.sourcePluginSha256,
+    trustChanged: false,
+  };
+}
+
+function parseArgs(argv) {
+  const action = argv[0] || 'status';
+  if (!['install', 'uninstall', 'status'].includes(action)) {
+    throw new Error('Usage: harness codex-hooks <install|uninstall|status> [--codex-home <path>]');
+  }
+  let codexHome;
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--codex-home') codexHome = path.resolve(argv[++i]);
+    else throw new Error('unknown argument: ' + argv[i]);
+  }
+  return { action, codexHome };
+}
+
+function main(argv = process.argv.slice(2)) {
+  let args;
+  try { args = parseArgs(argv); }
+  catch (error) {
+    console.error('[Codex Hooks Compatibility] ' + error.message);
+    return 2;
+  }
+
+  try {
+    const result = args.action === 'install'
+      ? install({ codexHome: args.codexHome })
+      : args.action === 'uninstall'
+        ? uninstall({ codexHome: args.codexHome })
+        : status({ codexHome: args.codexHome });
+    process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+    if (args.action === 'status' && result.installed && !result.healthy) return 1;
+    return 0;
+  } catch (error) {
+    console.error('[Codex Hooks Compatibility] ' + error.message);
+    return 1;
+  }
+}
+
+if (require.main === module) process.exit(main());
+
+module.exports = {
+  MANIFEST_MODE,
+  MANIFEST_SCHEMA,
+  SOURCE_PLUGIN_ROOT,
+  defaultCodexHome,
+  entryHash,
+  install,
+  main,
+  pathsFor,
+  readHooksFile,
+  removePriorEntries,
+  sourceHookEntries,
+  stableJson,
+  status,
+  transformEntry,
+  treeHash,
+  uninstall,
+};