harness-wingman 0.3.0 → 0.4.1

package/apps/cli/dist/main.js

@@ -48,6 +48,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/core/dist/feedback-url.js
+var init_feedback_url = __esm({
+  "packages/core/dist/feedback-url.js"() {
+    "use strict";
+  }
+});
+
 // packages/core/dist/refscan.js
 function scanReferences(sources, name) {
   if (name.length === 0)
@@ -228,6 +235,7 @@ var SLOT_IDS, HARNESS_IDS, ACTION_KINDS, SOURCES_BY_HARNESS, CONFIG_KEYS, ITEM_K
 var init_dist = __esm({
   "packages/core/dist/index.js"() {
     "use strict";
+    init_feedback_url();
     init_refscan();
     SLOT_IDS = ["base", "rules", "skills", "tools", "gates", "history"];
     HARNESS_IDS = ["cc", "codex", "dsh"];
@@ -1185,10 +1193,10 @@ function readState(homeDir) {
   }
   return rec;
 }
-function writeState(homeDir, state2) {
+function writeState(homeDir, state) {
   const file = statePath(homeDir);
   mkdirSync3(dirname5(file), { recursive: true });
-  writeFileSync4(file, `${JSON.stringify(state2, null, 2)}
+  writeFileSync4(file, `${JSON.stringify(state, null, 2)}
 `);
 }
 function makeBackupDir(homeDir) {
@@ -1347,7 +1355,7 @@ async function installHooksCc(port, options) {
 async function uninstallHooksCc(options) {
   const homeDir = options?.homeDir ?? homedir6();
   const target = targetPath(homeDir);
-  const state2 = readState(homeDir);
+  const state = readState(homeDir);
   if (!existsSync5(target)) {
     rmSync2(statePath(homeDir), { force: true });
     return;
@@ -1361,14 +1369,14 @@ async function uninstallHooksCc(options) {
   const backupDir = makeBackupDir(homeDir);
   if (bytes !== null)
     writeFileSync4(join9(backupDir, "settings.json"), bytes);
-  if (state2 && state2.original !== null) {
-    const originalParsed = asRecord3(JSON.parse(state2.original));
+  if (state && state.original !== null) {
+    const originalParsed = asRecord3(JSON.parse(state.original));
     if (originalParsed && deepEqual2(normalizeForCompare(settings), normalizeForCompare(originalParsed))) {
-      writeFileSync4(target, state2.original);
+      writeFileSync4(target, state.original);
       rmSync2(statePath(homeDir), { force: true });
       return;
     }
-  } else if (state2 && state2.original === null) {
+  } else if (state && state.original === null) {
     if (deepEqual2(normalizeForCompare(settings), {})) {
       rmSync2(target, { force: true });
       rmSync2(statePath(homeDir), { force: true });
@@ -1631,33 +1639,33 @@ function parseString(ctx) {
   }
   let parsed = "";
   let sliceStart = ctx.p;
-  let state2 = 0;
+  let state = 0;
   for (; ctx.p < ctx.s.length; ctx.p++) {
     c = ctx.s.charCodeAt(ctx.p);
     if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) {
-      state2 = state2 && 3;
+      state = state && 3;
     } else if (c < 32 && c !== 9 || c === 127) {
       throw new TomlError("control characters are not allowed in strings", {
         toml: ctx.s,
         ptr: ctx.p
       });
-    } else if ((!state2 || state2 === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+    } else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
       if (isMultiline) {
         if (ctx.s.charCodeAt(ctx.p + 3) === first)
           ctx.p++;
         if (ctx.s.charCodeAt(ctx.p + 3) === first)
           ctx.p++;
       }
-      if (!state2)
+      if (!state)
         parsed += ctx.s.slice(sliceStart, ctx.p);
       ctx.p += isMultiline ? 3 : 1;
       return parsed;
-    } else if (!state2) {
+    } else if (!state) {
       if (!isLiteral && c === 92) {
         parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
-        state2 = 1;
+        state = 1;
       }
-    } else if (state2 === 1) {
+    } else if (state === 1) {
       if (c === 120 || c === 117 || c === 85) {
         let value = 0;
         let len = c === 120 ? 2 : c === 117 ? 4 : 8;
@@ -1682,9 +1690,9 @@ function parseString(ctx) {
         }
         parsed += String.fromCodePoint(value);
         sliceStart = ctx.p + 1;
-        state2 = 0;
+        state = 0;
       } else if (c === 32 || c === 9) {
-        state2 = 2;
+        state = 2;
       } else {
         if (c === 98)
           parsed += "\b";
@@ -1705,16 +1713,16 @@ function parseString(ctx) {
         else
           throw new TomlError("unrecognized escape sequence", { toml: ctx.s, ptr: ctx.p });
         sliceStart = ctx.p + 1;
-        state2 = 0;
+        state = 0;
       }
     } else if (c !== 32 && c !== 9) {
-      if (state2 === 2) {
+      if (state === 2) {
         throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
           toml: ctx.s,
           ptr: sliceStart
         });
       }
-      state2 = !isLiteral && c === 92 ? 1 : 0;
+      state = !isLiteral && c === 92 ? 1 : 0;
       sliceStart = ctx.p;
     }
   }
@@ -1977,15 +1985,15 @@ function peekTable(key, table, meta, type) {
   let m = meta;
   let k;
   let hasOwn = false;
-  let state2;
+  let state;
   for (let i = 0; i < key.length; i++) {
     if (i) {
       t = hasOwn ? t[k] : t[k] = {};
-      m = (state2 = m[k]).c;
-      if (type === 0 && (state2.t === 1 || state2.t === 2)) {
+      m = (state = m[k]).c;
+      if (type === 0 && (state.t === 1 || state.t === 2)) {
         return null;
       }
-      if (state2.t === 2) {
+      if (state.t === 2) {
         let l = t.length - 1;
         t = t[l];
         m = m[l].c;
@@ -2008,28 +2016,28 @@ function peekTable(key, table, meta, type) {
       };
     }
   }
-  state2 = m[k];
-  if (state2.t !== type && !(type === 1 && state2.t === 3)) {
+  state = m[k];
+  if (state.t !== type && !(type === 1 && state.t === 3)) {
     return null;
   }
   if (type === 2) {
-    if (!state2.d) {
-      state2.d = true;
+    if (!state.d) {
+      state.d = true;
       t[k] = [];
     }
     t[k].push(t = {});
-    state2.c[state2.i++] = state2 = { t: 1, d: false, i: 0, c: {} };
+    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
   }
-  if (state2.d) {
+  if (state.d) {
     return null;
   }
-  state2.d = true;
+  state.d = true;
   if (type === 1) {
     t = hasOwn ? t[k] : t[k] = {};
   } else if (type === 0 && hasOwn) {
     return null;
   }
-  return [k, t, state2.c];
+  return [k, t, state.c];
 }
 function parse2(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
   let ctx = { s: toml, p: 0, d: maxDepth };
@@ -2846,16 +2854,30 @@ async function installHooks(port, options) {
   const raw = existsSync7(configPath) ? readFileSync8(configPath) : void 0;
   const text = raw?.toString("utf8") ?? "";
   const { remainder, block } = splitManagedBlock(text, configPath);
-  const newBlock = buildManagedBlock(scriptPath, port);
+  const newBlock = buildManagedBlock(scriptPath);
+  if (block !== void 0 && !isKnownManagedBlock(block, scriptPath)) {
+    throw new Error(`Wingman Codex hook \u53D7\u7BA1\u5757\u5DF2\u88AB\u4FEE\u6539\u6216\u6B8B\u7F3A(${configPath}),\u62D2\u7EDD\u8C0E\u62A5\u63A5\u7EBF\u6210\u529F;\u8BF7\u5148\u4ECE <wingman\u6839>/backups/ \u6062\u590D\u5B8C\u6574\u5757,\u6216\u4EBA\u5DE5\u6838\u5BF9\u540E\u79FB\u9664\u8BE5\u53D7\u7BA1\u5757\u518D\u91CD\u65B0\u5B89\u88C5\u5E76\u4FE1\u4EFB`);
+  }
   mkdirSync5(root, { recursive: true });
   writeFileSync6(scriptPath, FORWARD_SCRIPT);
-  if (block === newBlock)
+  const statePath2 = hooksStatePath(root);
+  const prior = readState2(statePath2);
+  if (block !== void 0) {
+    if (prior?.port !== port || prior.configPath !== configPath || prior.forwardScriptPath !== scriptPath) {
+      writeState2(statePath2, {
+        ...prior,
+        version: 1,
+        port,
+        configPath,
+        forwardScriptPath: scriptPath,
+        installedAt: prior?.installedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
     return;
+  }
   assertWritable(remainder, configPath);
   const backupDir = raw === void 0 ? void 0 : backupFile(root, configPath, raw);
-  const statePath2 = hooksStatePath(root);
-  const prior = readState2(statePath2);
-  const original = prior?.original ?? (block === void 0 ? raw === void 0 ? { existed: false } : { existed: true, base64: raw.toString("base64") } : void 0);
+  const original = prior?.original ?? (raw === void 0 ? { existed: false } : { existed: true, base64: raw.toString("base64") });
   writeState2(statePath2, {
     version: 1,
     port,
@@ -2877,14 +2899,17 @@ async function uninstallHooks(options) {
   const scriptPath = join12(root, FORWARD_SCRIPT_NAME);
   const statePath2 = hooksStatePath(root);
   const configPath = join12(paths.codexHome, "config.toml");
-  const state2 = readState2(statePath2);
+  const state = readState2(statePath2);
   const raw = existsSync7(configPath) ? readFileSync8(configPath) : void 0;
   if (raw !== void 0) {
     const text = raw.toString("utf8");
     const { remainder, block } = splitManagedBlock(text, configPath);
     if (block !== void 0) {
+      if (!isKnownManagedBlock(block, scriptPath)) {
+        throw new Error(`Wingman Codex hook \u53D7\u7BA1\u5757\u5DF2\u88AB\u4FEE\u6539\u6216\u6B8B\u7F3A(${configPath}),\u62D2\u7EDD\u81EA\u52A8\u5220\u9664;\u8BF7\u5148\u4ECE <wingman\u6839>/backups/ \u6062\u590D\u5B8C\u6574\u5757,\u6216\u4EBA\u5DE5\u6838\u5BF9\u540E\u79FB\u9664\u8BE5\u53D7\u7BA1\u5757`);
+      }
       backupFile(root, configPath, raw);
-      const restored = restoreTarget(remainder, state2);
+      const restored = restoreTarget(remainder, state);
       if (restored === null)
         rmSync3(configPath);
       else
@@ -2898,10 +2923,15 @@ function hasManagedHooks(paths) {
   const configPath = join12(paths.codexHome, "config.toml");
   if (!existsSync7(configPath))
     return false;
-  return readFileSync8(configPath, "utf8").includes(MANAGED_BLOCK_START);
+  try {
+    const { block } = splitManagedBlock(readFileSync8(configPath, "utf8"), configPath);
+    return block !== void 0 && isKnownManagedBlock(block, join12(wingmanStateRoot(paths), FORWARD_SCRIPT_NAME));
+  } catch {
+    return false;
+  }
 }
-function restoreTarget(remainder, state2) {
-  const original = state2?.original;
+function restoreTarget(remainder, state) {
+  const original = state?.original;
   if (original === void 0)
     return remainder;
   if (!original.existed) {
@@ -2915,8 +2945,11 @@ function restoreTarget(remainder, state2) {
   }
   return remainder;
 }
-function buildManagedBlock(scriptPath, port) {
-  const command = tomlBasicString(`node "${scriptPath}" ${port}`);
+function buildManagedBlock(scriptPath) {
+  return buildManagedBlockForCommand(`node "${scriptPath}"`);
+}
+function buildManagedBlockForCommand(rawCommand) {
+  const command = tomlBasicString(rawCommand);
   const handler = `[{ hooks = [{ type = "command", command = ${command} }] }]`;
   const lines = [MANAGED_BLOCK_START, "[hooks]"];
   for (const event of HOOK_EVENTS)
@@ -2925,6 +2958,38 @@ function buildManagedBlock(scriptPath, port) {
   return `${lines.join("\n")}
 `;
 }
+function isKnownManagedBlock(block, scriptPath) {
+  if (block === buildManagedBlock(scriptPath))
+    return true;
+  let table;
+  try {
+    table = parse2(block);
+  } catch {
+    return false;
+  }
+  const hooks = table.hooks;
+  if (!isTable(hooks))
+    return false;
+  const first = hooks[HOOK_EVENTS[0]];
+  if (!Array.isArray(first) || first.length !== 1 || !isTable(first[0]))
+    return false;
+  const handlers = first[0].hooks;
+  if (!Array.isArray(handlers) || handlers.length !== 1 || !isTable(handlers[0]))
+    return false;
+  const command = handlers[0].command;
+  if (typeof command !== "string")
+    return false;
+  const prefix = `node "${scriptPath}" `;
+  if (!command.startsWith(prefix))
+    return false;
+  const legacyPortText = command.slice(prefix.length);
+  if (!/^[1-9]\d{0,4}$/.test(legacyPortText))
+    return false;
+  const legacyPort = Number(legacyPortText);
+  if (legacyPort > 65535 || String(legacyPort) !== legacyPortText)
+    return false;
+  return block === buildManagedBlockForCommand(command);
+}
 function splitManagedBlock(text, configPath) {
   const start = text.indexOf(MANAGED_BLOCK_START);
   const endMark = text.indexOf(MANAGED_BLOCK_END);
@@ -2980,9 +3045,9 @@ function readState2(statePath2) {
     return void 0;
   }
 }
-function writeState2(statePath2, state2) {
+function writeState2(statePath2, state) {
   mkdirSync5(dirname7(statePath2), { recursive: true });
-  writeFileSync6(statePath2, `${JSON.stringify(state2, null, 2)}
+  writeFileSync6(statePath2, `${JSON.stringify(state, null, 2)}
 `);
 }
 function deepEqual3(a, b) {
@@ -3013,19 +3078,123 @@ var init_hooks2 = __esm({
     FORWARD_SCRIPT_NAME = "codex-forward.mjs";
     FORWARD_SCRIPT = `#!/usr/bin/env node
 // wingman codex hook \u8F6C\u53D1\u811A\u672C(\u81EA\u52A8\u751F\u6210,\`wingman hook uninstall codex\` \u65F6\u5220\u9664)\u3002
-// \u8BFB stdin \u5168\u91CF(codex hook \u7684 CC \u57FA\u51C6\u5F62\u72B6 JSON)\u2192 \u539F\u6837 POST \u672C\u673A wingman \u9762\u677F;
-// 3s \u8D85\u65F6,\u4EFB\u4F55\u5931\u8D25\u9759\u9ED8\u9000\u51FA 0,\u7EDD\u4E0D\u963B\u585E harness(payload \u4E0D\u6539\u5199,\u7EDF\u4E00\u5B9E\u51B5\u534F\u8BAE \xA72)\u3002
-const port = process.argv[2];
+// \u8BFB stdin \u5168\u91CF(codex hook \u7684 CC \u57FA\u51C6\u5F62\u72B6 JSON)\u2192 \u539F\u6837 POST \u672C\u673A wingman \u9762\u677F\u3002
+// \u53EA\u8BA4 serve \u5C31\u7EEA\u540E\u5199\u4E0B\u7684 v2 \u8FD0\u884C\u6001\uFF1B\u5148\u505A HMAC \u8EAB\u4EFD\u63A2\u6D4B\uFF0C\u9A8C\u8BC1\u901A\u8FC7\u624D\u53D1\u9001\u4F1A\u8BDD\u5185\u5BB9\u3002
+// \u5019\u9009\u6709\u754C,\u8EAB\u4EFD\u63A2\u6D4B\u5E76\u884C\u4E14\u5171\u4EAB\u603B\u7F51\u7EDC\u9884\u7B97;\u4EFB\u4F55\u5931\u8D25\u9759\u9ED8\u9000\u51FA 0,\u7EDD\u4E0D\u963B\u585E harness\u3002
+import { readdir, readFile } from 'node:fs/promises';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(fileURLToPath(import.meta.url));
+const stateRoot = join(root, 'state');
+const stateName = /^serve-(\\d+)-(\\d+)-[A-Za-z0-9_-]+\\.json$/;
+const maxCandidates = 5;
+const probeTimeoutMs = 1000;
+const postTimeoutMs = 3000;
+const totalNetworkBudgetMs = 4500;
+
+function validPort(value) {
+  return Number.isInteger(value) && value > 0 && value <= 65535;
+}
+
+function validToken(value) {
+  return typeof value === 'string' && /^[A-Za-z0-9_-]{32,128}$/.test(value);
+}
+
+async function candidates() {
+  try {
+    const dir = join(stateRoot, 'serve');
+    const names = await readdir(dir);
+    const selected = names
+      .flatMap((name) => {
+        const match = stateName.exec(name);
+        return match === null ? [] : [{ name, startedAtMs: Number(match[1]) }];
+      })
+      .filter((entry) => Number.isSafeInteger(entry.startedAtMs) && entry.startedAtMs >= 0)
+      .sort((a, b) => b.startedAtMs - a.startedAtMs)
+      .slice(0, maxCandidates);
+    const states = await Promise.all(
+      selected.map(async ({ name }) => {
+        try {
+          const state = JSON.parse(await readFile(join(dir, name), 'utf8'));
+          return state.version === 2 && validPort(state.port) && validToken(state.token)
+            ? { port: state.port, token: state.token }
+            : undefined;
+        } catch {
+          return undefined;
+        }
+      }),
+    );
+    return states.filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+function sameProof(expected, actual) {
+  if (typeof actual !== 'string') return false;
+  const left = Buffer.from(expected);
+  const right = Buffer.from(actual);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+async function verified(candidate) {
+  const nonce = randomBytes(18).toString('base64url');
+  const expected = createHmac('sha256', candidate.token).update(nonce).digest('base64url');
+  try {
+    const response = await fetch(
+      \`http://127.0.0.1:\${candidate.port}/api/hook-target?nonce=\${nonce}\`,
+      // \u51B7\u542F\u52A8\u6216\u9AD8\u8D1F\u8F7D\u673A\u5668\u4E0A Node/SEA \u53EF\u80FD\u6570\u767E\u6BEB\u79D2\u624D\u8C03\u5EA6\u5230\u672C\u673A\u54CD\u5E94\uFF1B
+      // \u4ECD\u7ED9\u6BCF\u4E2A\u5019\u9009\u72EC\u7ACB\u4E0A\u9650\uFF0C\u4F46\u4E0D\u8981\u56E0 400ms \u8FC7\u7D27\u800C\u8BEF\u4E22\u771F\u5B9E hook\u3002
+      // \u7981\u6B62\u8DDF\u968F\u91CD\u5B9A\u5411\uFF1A\u5426\u5219\u590D\u7528\u7AEF\u53E3\u53EF\u628A\u63A2\u6D4B\u8F6C\u53D1\u7ED9\u771F\u6B63 Wingman\u3001\u518D\u9A97\u53D6\u6B63\u6587\u3002
+      { signal: AbortSignal.timeout(probeTimeoutMs), redirect: 'error' },
+    );
+    return response.status === 204 && sameProof(expected, response.headers.get('x-wingman-hook-proof'));
+  } catch {
+    return false;
+  }
+}
+
 const chunks = [];
 process.stdin.on('data', (chunk) => chunks.push(chunk));
 process.stdin.on('end', async () => {
   try {
-    await fetch(\`http://127.0.0.1:\${port}/hook?harness=codex\`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: Buffer.concat(chunks),
-      signal: AbortSignal.timeout(3000),
+    const body = Buffer.concat(chunks);
+    const networkStartedAt = performance.now();
+    const available = await candidates();
+    // \u8EAB\u4EFD\u63A2\u6D4B\u4E0D\u542B\u6B63\u6587\uFF0C\u53EF\u5B89\u5168\u5E76\u884C\uFF1B\u5171\u4EAB deadline \u907F\u514D\u5E95\u5C42 fetch
+    // \u5BF9\u591A\u4E2A\u6302\u8D77 socket \u9010\u4E2A\u5EF6\u8FDF\u8D85\u65F6\u3002\u53EA\u8BB0\u5F55 deadline \u524D\u5DF2\u5B8C\u6210\u9A8C\u8BC1\u7684\u5019\u9009\u3002
+    const checks = Array(available.length);
+    const probes = available.map(async (candidate, index) => {
+      if (await verified(candidate)) checks[index] = candidate;
     });
+    let deadline;
+    await Promise.race([
+      Promise.all(probes),
+      new Promise((resolve) => {
+        deadline = setTimeout(resolve, probeTimeoutMs + 250);
+      }),
+    ]);
+    clearTimeout(deadline);
+    for (const candidate of checks.filter(Boolean)) {
+      const remainingMs = totalNetworkBudgetMs - (performance.now() - networkStartedAt);
+      if (remainingMs <= 0) break;
+      try {
+        const response = await fetch(\`http://127.0.0.1:\${candidate.port}/hook?harness=codex\`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'x-wingman-hook-token': candidate.token,
+          },
+          body,
+          // \u5DF2\u9A8C\u8BC1\u4E3A\u672C\u5B9E\u4F8B\u540E\u7ED9\u6B63\u6587\u63A5\u6536\u7559\u8DB3\u65F6\u95F4\uFF1B\u5927 payload/\u6162\u78C1\u76D8\u4E0D\u5E94\u88AB 1s \u8BEF\u6740\u3002
+          signal: AbortSignal.timeout(Math.max(1, Math.min(postTimeoutMs, Math.ceil(remainingMs)))),
+          redirect: 'error',
+        });
+        if (response.ok) break;
+      } catch {}
+    }
   } catch {}
   process.exit(0);
 });
@@ -9134,11 +9303,11 @@ var require_lexer = __commonJS({
       hasChars(n) {
         return this.pos + n <= this.buffer.length;
       }
-      setNext(state2) {
+      setNext(state) {
         this.buffer = this.buffer.substring(this.pos);
         this.pos = 0;
         this.lineEndPos = null;
-        this.next = state2;
+        this.next = state;
         return null;
       }
       peek(n) {
@@ -11028,14 +11197,14 @@ async function readState3(paths) {
   const buffer = await readIfExists(paths.stateFile);
   if (buffer === void 0)
     return void 0;
-  const state2 = JSON.parse(buffer.toString("utf8"));
-  if (state2.version !== 1)
-    throw new Error(`\u672A\u77E5\u7684\u63A5\u7EBF\u72B6\u6001\u7248\u672C:${String(state2.version)},\u4E0D\u731C`);
-  return state2;
+  const state = JSON.parse(buffer.toString("utf8"));
+  if (state.version !== 1)
+    throw new Error(`\u672A\u77E5\u7684\u63A5\u7EBF\u72B6\u6001\u7248\u672C:${String(state.version)},\u4E0D\u731C`);
+  return state;
 }
-async function writeState3(paths, state2) {
+async function writeState3(paths, state) {
   await mkdir(dirname9(paths.stateFile), { recursive: true });
-  await writeFile(paths.stateFile, `${JSON.stringify(state2, void 0, 2)}
+  await writeFile(paths.stateFile, `${JSON.stringify(state, void 0, 2)}
 `, "utf8");
 }
 async function backupPatchFile(paths, bytes) {
@@ -11101,13 +11270,13 @@ async function installDshHooks(port, options) {
 }
 async function uninstallDshHooks(options) {
   const paths = resolveDshHookPaths(options);
-  const state2 = await readState3(paths);
+  const state = await readState3(paths);
   const currentBuffer = await readIfExists(paths.patchFile);
   if (currentBuffer !== void 0) {
     const currentText = decodeUtf8Strict(currentBuffer, paths.patchFile);
     if (currentText.includes(HOOKS_MARKER_BEGIN_PREFIX)) {
       const surgical = stripLiveHooksBlocks(currentText, paths.patchFile);
-      const restored = resolveRestoredText(surgical, state2, paths);
+      const restored = resolveRestoredText(surgical, state, paths);
       if (restored !== currentText) {
         await backupPatchFile(paths, currentBuffer);
         if (restored === void 0)
@@ -11121,9 +11290,9 @@ async function uninstallDshHooks(options) {
   await rm(paths.forwarderFile, { force: true });
   await rm(paths.stateFile, { force: true });
 }
-function resolveRestoredText(surgical, state2, paths) {
-  if (state2?.original.existed === true) {
-    const originalText = Buffer3.from(state2.original.bytesBase64, "base64").toString("utf8");
+function resolveRestoredText(surgical, state, paths) {
+  if (state?.original.existed === true) {
+    const originalText = Buffer3.from(state.original.bytesBase64, "base64").toString("utf8");
     const surgicalEntries = tryParsePatchEntries(surgical, paths.patchFile);
     const originalEntries = tryParsePatchEntries(originalText, paths.patchFile);
     if (surgicalEntries !== void 0 && originalEntries !== void 0 && JSON.stringify(surgicalEntries) === JSON.stringify(originalEntries)) {
@@ -11716,7 +11885,7 @@ var init_dist5 = __esm({
 init_dist();
 import { readFileSync as readFileSync12 } from "node:fs";
 import { dirname as dirname12, resolve as resolve6 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/fixtures/dist/index.js
 import { dirname, join } from "node:path";
@@ -11767,7 +11936,7 @@ function createReceiver(options = {}) {
       }
       accept({ harness, received_at: (/* @__PURE__ */ new Date()).toISOString(), payload: parsed });
       sendText(res, 200, "ok");
-    }, () => sendText(res, 400, "\u8BFB\u53D6\u8BF7\u6C42\u4F53\u5931\u8D25"));
+    }, (error) => sendText(res, 400, error instanceof Error ? error.message : "\u8BFB\u53D6\u8BF7\u6C42\u4F53\u5931\u8D25"));
   }
   function handleEvents(req, res) {
     if (req.method !== "GET") {
@@ -11824,10 +11993,20 @@ function isHookPayload(value) {
   const name = value.hook_event_name;
   return typeof name === "string" && name.length > 0;
 }
+var HOOK_BODY_LIMIT = 1024 * 1024;
 function readBody(req) {
   return new Promise((resolve7, reject) => {
     const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
+    let size = 0;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > HOOK_BODY_LIMIT) {
+        reject(new Error("body \u8D85\u8FC7 1MB \u4E0A\u9650"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
     req.on("end", () => resolve7(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
@@ -11886,7 +12065,7 @@ function verifyEntitlement(raw, now, publicKeyPem) {
   let claims;
   try {
     const decoded = JSON.parse(Buffer.from(parsed.token, "base64url").toString("utf8"));
-    if (typeof decoded.sub !== "string" || typeof decoded.plan !== "string" || typeof decoded.iat !== "string" || typeof decoded.exp !== "string" || Number.isNaN(Date.parse(decoded.exp))) {
+    if (typeof decoded.sub !== "string" || decoded.plan !== "trial" && decoded.plan !== "subscription" || typeof decoded.iat !== "string" || typeof decoded.exp !== "string" || Number.isNaN(Date.parse(decoded.exp))) {
       return { state: "invalid", detail: "license \u8F7D\u8377\u5B57\u6BB5\u4E0D\u5B8C\u6574" };
     }
     claims = { sub: decoded.sub, plan: decoded.plan, iat: decoded.iat, exp: decoded.exp };
@@ -11894,10 +12073,22 @@ function verifyEntitlement(raw, now, publicKeyPem) {
     return { state: "invalid", detail: "license \u8F7D\u8377\u65E0\u6CD5\u89E3\u7801" };
   }
   const exp = Date.parse(claims.exp);
-  const graceEnd = exp + OFFLINE_GRACE_DAYS * 24 * 60 * 60 * 1e3;
+  const isTrial = claims.plan === "trial";
   if (now.getTime() < exp) {
-    return { state: "active", detail: `\u8BA2\u9605\u6709\u6548\u81F3 ${claims.exp}`, claims };
+    return {
+      state: "active",
+      detail: `${isTrial ? "\u8BD5\u7528" : "\u8BA2\u9605"}\u6709\u6548\u81F3 ${claims.exp}`,
+      claims
+    };
   }
+  if (isTrial) {
+    return {
+      state: "expired",
+      detail: `\u8BD5\u7528\u5DF2\u4E8E ${claims.exp} \u5230\u671F,\u5199\u52A8\u4F5C\u5DF2\u9501;\u8BA2\u9605\u540E\u5728\u9762\u677F\u70B9\u300C\u5237\u65B0\u6388\u6743\u300D\u5373\u53EF\u6062\u590D`,
+      claims
+    };
+  }
+  const graceEnd = exp + OFFLINE_GRACE_DAYS * 24 * 60 * 60 * 1e3;
   if (now.getTime() < graceEnd) {
     return {
       state: "grace",
@@ -11955,7 +12146,8 @@ async function refreshLicense(options = {}) {
   } catch {
     return {
       ok: false,
-      message: `\u672A\u627E\u5230 ${licensePath}\u2014\u2014\u5148\u8BA2\u9605,\u4ECE\u4ED8\u6B3E\u540E\u7684\u6FC0\u6D3B\u9875\u4E0B\u8F7D license.json \u653E\u8FDB\u53BB`
+      message: `\u672A\u627E\u5230 ${licensePath}\u2014\u2014\u5148\u8BA2\u9605,\u4ECE\u4ED8\u6B3E\u540E\u7684\u6FC0\u6D3B\u9875\u4E0B\u8F7D license.json \u653E\u8FDB\u53BB`,
+      reason: "missing"
     };
   }
   let response;
@@ -11967,43 +12159,91 @@ async function refreshLicense(options = {}) {
       signal: AbortSignal.timeout(15e3)
     });
   } catch {
-    return { ok: false, message: "\u8054\u7F51\u5931\u8D25,\u7A0D\u540E\u518D\u8BD5(\u79BB\u7EBF\u5BBD\u9650\u671F\u5185\u4E0D\u5F71\u54CD\u4F7F\u7528)" };
+    return {
+      ok: false,
+      message: "\u8054\u7F51\u5931\u8D25,\u7A0D\u540E\u518D\u8BD5;\u5F53\u524D\u6388\u6743\u72B6\u6001\u4FDD\u6301\u4E0D\u53D8",
+      reason: "network"
+    };
   }
   if (!response.ok) {
     let detail = `\u7B7E\u53D1\u7AEF\u8FD4\u56DE HTTP ${response.status}`;
+    let inactive = false;
     try {
       const body = await response.json();
       if (typeof body.error === "string")
         detail = body.error;
+      inactive = body.reason === "inactive";
     } catch {
     }
-    return { ok: false, message: `\u7EED\u671F\u88AB\u62D2:${detail}` };
+    return {
+      ok: false,
+      message: `\u7EED\u671F\u88AB\u62D2:${detail}`,
+      reason: inactive ? "inactive" : "server"
+    };
   }
   let entitlement;
   try {
     entitlement = await response.json();
   } catch {
-    return { ok: false, message: "\u7B7E\u53D1\u7AEF\u8FD4\u56DE\u7684\u4E0D\u662F\u5408\u6CD5 JSON;\u539F license \u672A\u52A8" };
+    return {
+      ok: false,
+      message: "\u7B7E\u53D1\u7AEF\u8FD4\u56DE\u7684\u4E0D\u662F\u5408\u6CD5 JSON;\u539F license \u672A\u52A8",
+      reason: "invalid-response"
+    };
   }
   if (typeof entitlement.token !== "string" || typeof entitlement.signature !== "string") {
-    return { ok: false, message: "\u7B7E\u53D1\u7AEF\u8FD4\u56DE\u7F3A token/signature;\u539F license \u672A\u52A8" };
+    return {
+      ok: false,
+      message: "\u7B7E\u53D1\u7AEF\u8FD4\u56DE\u7F3A token/signature;\u539F license \u672A\u52A8",
+      reason: "invalid-response"
+    };
   }
   const next = `${JSON.stringify({ token: entitlement.token, signature: entitlement.signature })}
 `;
+  const publicKeyPem = options.publicKeyPem ?? PROD_PUBLIC_KEY_PEM;
+  if (publicKeyPem !== "") {
+    const status = verifyEntitlement(next, options.now ?? /* @__PURE__ */ new Date(), publicKeyPem);
+    if (status.state !== "active" && status.state !== "grace") {
+      return {
+        ok: false,
+        message: `\u7B7E\u53D1\u7AEF\u8FD4\u56DE\u7684 license \u65E0\u6548:${status.detail};\u539F license \u672A\u52A8`,
+        reason: "invalid-response"
+      };
+    }
+  }
+  try {
+    if (readFileSync2(licensePath, "utf8") !== raw) {
+      return {
+        ok: false,
+        message: "\u5237\u65B0\u671F\u95F4\u672C\u673A\u6388\u6743\u5DF2\u88AB\u66F4\u6362;\u5DF2\u4FDD\u7559\u8F83\u65B0\u7684\u6587\u4EF6,\u8BF7\u518D\u70B9\u4E00\u6B21\u5237\u65B0",
+        reason: "changed"
+      };
+    }
+  } catch {
+    return {
+      ok: false,
+      message: "\u5237\u65B0\u671F\u95F4\u672C\u673A\u6388\u6743\u5DF2\u88AB\u66F4\u6362;\u5F53\u524D\u6587\u4EF6\u672A\u88AB\u8986\u76D6",
+      reason: "changed"
+    };
+  }
   const tmpPath = join3(dirname2(licensePath), `.license.json.tmp-${process.pid}`);
   try {
     writeFileSync2(tmpPath, next);
     renameSync2(tmpPath, licensePath);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { ok: false, message: `\u5199\u5165 ${licensePath} \u5931\u8D25:${message}` };
+    return { ok: false, message: `\u5199\u5165 ${licensePath} \u5931\u8D25:${message}`, reason: "write" };
   }
   return { ok: true, message: `license \u5DF2\u7EED\u671F${expSuffix(entitlement.token)}` };
 }
 function expSuffix(token) {
   try {
     const claims = JSON.parse(Buffer.from(token, "base64url").toString("utf8"));
-    return typeof claims.exp === "string" ? `,\u8BA2\u9605\u6709\u6548\u81F3 ${claims.exp}` : "";
+    if (typeof claims.exp !== "string")
+      return "";
+    if (claims.plan !== "trial" && claims.plan !== "subscription")
+      return "";
+    return `,${claims.plan === "trial" ? "\u8BD5\u7528" : "\u8BA2\u9605"}\u6709\u6548\u81F3 ${claims.exp}`;
   } catch {
     return "";
   }
@@ -12104,6 +12344,246 @@ function isInProgressAt(entry, ts) {
   return entry.spans.some((span) => span.status === "in_progress" && span.from !== void 0 && span.from <= ts && (span.to === void 0 || ts < span.to));
 }
 
+// packages/narrative/dist/codex.js
+function parseCodexRolloutLine(line) {
+  const trimmed = line.trim();
+  if (trimmed === "")
+    return { kind: "unknown", reason: "\u7A7A\u884C", rawText: line };
+  let value;
+  try {
+    value = JSON.parse(trimmed);
+  } catch {
+    return { kind: "unknown", reason: "JSON \u89E3\u6790\u5931\u8D25", rawText: line };
+  }
+  if (!isRecord2(value))
+    return { kind: "unknown", reason: "\u884C\u4E0D\u662F JSON \u5BF9\u8C61", rawText: line };
+  if (typeof value.type !== "string") {
+    return { kind: "unknown", reason: "\u7F3A type \u5B57\u6BB5\u6216\u975E\u5B57\u7B26\u4E32", rawText: line };
+  }
+  const timestamp = optionalString(value.timestamp);
+  const payload = isRecord2(value.payload) ? value.payload : void 0;
+  if (value.type === "session_meta")
+    return parseSessionMeta(payload, timestamp);
+  if (value.type === "turn_context")
+    return parseTurnContext(payload, timestamp);
+  if (value.type === "event_msg")
+    return parseEventMessage(payload, timestamp);
+  if (value.type === "response_item")
+    return parseResponseItem(payload, timestamp);
+  return otherLine(value.type, payload, timestamp);
+}
+function parseSessionMeta(payload, timestamp) {
+  const line = { kind: "session_meta" };
+  assignString(line, "timestamp", timestamp ?? optionalString(payload?.timestamp));
+  assignString(line, "threadId", optionalString(payload?.id));
+  assignString(line, "sessionId", optionalString(payload?.session_id));
+  assignString(line, "parentThreadId", optionalString(payload?.parent_thread_id));
+  assignString(line, "cwd", optionalString(payload?.cwd));
+  assignString(line, "cliVersion", optionalString(payload?.cli_version));
+  assignString(line, "modelProvider", optionalString(payload?.model_provider));
+  return line;
+}
+function parseTurnContext(payload, timestamp) {
+  const line = { kind: "turn_context" };
+  assignString(line, "timestamp", timestamp);
+  assignString(line, "turnId", optionalString(payload?.turn_id));
+  assignString(line, "model", optionalString(payload?.model));
+  assignString(line, "cwd", optionalString(payload?.cwd));
+  return line;
+}
+function parseEventMessage(payload, timestamp) {
+  const payloadType = optionalString(payload?.type);
+  if (payloadType === "user_message") {
+    const line = { kind: "user" };
+    assignString(line, "timestamp", timestamp);
+    assignString(line, "text", optionalString(payload?.message));
+    return line;
+  }
+  if (payloadType === "agent_message") {
+    const line = { kind: "assistant", source: "event_msg" };
+    assignString(line, "timestamp", timestamp);
+    assignString(line, "text", optionalString(payload?.message));
+    assignString(line, "phase", optionalString(payload?.phase));
+    return line;
+  }
+  if (payloadType === "task_started") {
+    const line = { kind: "task_started" };
+    assignString(line, "timestamp", timestamp);
+    assignString(line, "turnId", optionalString(payload?.turn_id));
+    return line;
+  }
+  if (payloadType === "task_complete") {
+    const line = { kind: "task_complete" };
+    assignString(line, "timestamp", timestamp);
+    assignString(line, "turnId", optionalString(payload?.turn_id));
+    return line;
+  }
+  if (payloadType === "turn_aborted") {
+    const line = { kind: "turn_aborted" };
+    assignString(line, "timestamp", timestamp);
+    assignString(line, "turnId", optionalString(payload?.turn_id));
+    return line;
+  }
+  if (payloadType === "token_count" && payload !== void 0) {
+    return parseTokenCount(payload, timestamp);
+  }
+  return otherLine("event_msg", payload, timestamp);
+}
+function parseResponseItem(payload, timestamp) {
+  const payloadType = optionalString(payload?.type);
+  if (payloadType === "message" && payload?.role === "assistant") {
+    const line = { kind: "assistant", source: "response_item" };
+    assignString(line, "timestamp", timestamp);
+    assignString(line, "text", extractText(payload.content, "output_text"));
+    assignString(line, "phase", optionalString(payload.phase));
+    assignString(line, "messageId", optionalString(payload.id));
+    assignString(line, "turnId", extractTurnId(payload));
+    return line;
+  }
+  if (payload !== void 0 && (payloadType === "function_call" || payloadType === "custom_tool_call")) {
+    const call = { kind: "tool_call", callType: payloadType };
+    assignString(call, "timestamp", timestamp);
+    assignString(call, "callId", optionalString(payload.call_id));
+    assignString(call, "itemId", optionalString(payload.id));
+    assignString(call, "name", optionalString(payload.name));
+    assignString(call, "namespace", optionalString(payload.namespace));
+    assignString(call, "status", optionalString(payload.status));
+    assignString(call, "turnId", extractTurnId(payload));
+    const input = payloadType === "function_call" ? parseJsonString(payload.arguments) : payload.input;
+    if (input !== void 0)
+      call.input = input;
+    return call;
+  }
+  if (payload !== void 0 && (payloadType === "function_call_output" || payloadType === "custom_tool_call_output")) {
+    const result = { kind: "tool_result", resultType: payloadType };
+    assignString(result, "timestamp", timestamp);
+    assignString(result, "callId", optionalString(payload.call_id));
+    assignString(result, "itemId", optionalString(payload.id));
+    assignString(result, "turnId", extractTurnId(payload));
+    if (payload.output !== void 0) {
+      result.output = payload.output;
+      if (codexToolResultIsError(payload.output))
+        result.isError = true;
+    }
+    return result;
+  }
+  return otherLine("response_item", payload, timestamp);
+}
+function parseTokenCount(payload, timestamp) {
+  const line = { kind: "token_count" };
+  assignString(line, "timestamp", timestamp);
+  const info = isRecord2(payload.info) ? payload.info : void 0;
+  const lastRaw = isRecord2(info?.last_token_usage) ? info.last_token_usage : void 0;
+  const totalRaw = isRecord2(info?.total_token_usage) ? info.total_token_usage : void 0;
+  const lastUsage = parseCodexTokenUsage(lastRaw);
+  const totalUsage = parseCodexTokenUsage(totalRaw);
+  if (lastUsage !== void 0)
+    line.lastUsage = lastUsage;
+  if (totalUsage !== void 0)
+    line.totalUsage = totalUsage;
+  const modelContextWindow = tokenInteger(info?.model_context_window);
+  if (modelContextWindow !== void 0)
+    line.modelContextWindow = modelContextWindow;
+  return line;
+}
+function parseCodexTokenUsage(value) {
+  if (value === void 0)
+    return void 0;
+  const usage = { kind: "exact" };
+  assignToken(usage, "inputTokens", value.input_tokens);
+  assignToken(usage, "cachedInputTokens", value.cached_input_tokens);
+  if (value.cache_write_input_tokens === void 0)
+    usage.cacheWriteInputTokens = 0;
+  else
+    assignToken(usage, "cacheWriteInputTokens", value.cache_write_input_tokens);
+  assignToken(usage, "outputTokens", value.output_tokens);
+  assignToken(usage, "reasoningOutputTokens", value.reasoning_output_tokens);
+  assignToken(usage, "totalTokens", value.total_tokens);
+  return Object.keys(usage).length > 1 ? usage : void 0;
+}
+function codexToolResultIsError(output) {
+  return explicitResultFailure(output, 0);
+}
+function explicitResultFailure(value, depth) {
+  if (depth > 2)
+    return false;
+  if (typeof value === "string") {
+    try {
+      return explicitResultFailure(JSON.parse(value), depth + 1);
+    } catch {
+      return false;
+    }
+  }
+  if (Array.isArray(value)) {
+    return value.some((block) => {
+      if (!isRecord2(block))
+        return false;
+      if (block.isError === true || block.is_error === true)
+        return true;
+      return (block.type === "text" || block.type === "input_text") && typeof block.text === "string" ? explicitResultFailure(block.text, depth + 1) : false;
+    });
+  }
+  if (!isRecord2(value))
+    return false;
+  if (value.isError === true || value.is_error === true)
+    return true;
+  if (explicitExitFailure(value.exit_code))
+    return true;
+  const metadata = isRecord2(value.metadata) ? value.metadata : void 0;
+  return explicitExitFailure(metadata?.exit_code);
+}
+function explicitExitFailure(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value !== 0;
+}
+function otherLine(type, payload, timestamp) {
+  const line = { kind: "other", type };
+  assignString(line, "timestamp", timestamp);
+  assignString(line, "payloadType", optionalString(payload?.type));
+  return line;
+}
+function extractText(value, blockType) {
+  if (!Array.isArray(value))
+    return void 0;
+  const texts = [];
+  for (const block of value) {
+    if (!isRecord2(block) || block.type !== blockType || typeof block.text !== "string")
+      continue;
+    texts.push(block.text);
+  }
+  return texts.length > 0 ? texts.join("\n") : void 0;
+}
+function extractTurnId(payload) {
+  const metadata = isRecord2(payload.internal_chat_message_metadata_passthrough) ? payload.internal_chat_message_metadata_passthrough : void 0;
+  return optionalString(metadata?.turn_id);
+}
+function parseJsonString(value) {
+  if (typeof value !== "string")
+    return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function tokenInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function optionalString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function assignString(target, key, value) {
+  if (value !== void 0)
+    target[key] = value;
+}
+function assignToken(usage, key, value) {
+  const parsed = tokenInteger(value);
+  if (parsed !== void 0)
+    usage[key] = parsed;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // packages/narrative/dist/parse.js
 function parseTranscriptLine(line) {
   const trimmed = line.trim();
@@ -12115,7 +12595,7 @@ function parseTranscriptLine(line) {
   } catch {
     return { kind: "unknown", reason: "JSON \u89E3\u6790\u5931\u8D25", rawText: line };
   }
-  if (!isRecord2(value))
+  if (!isRecord3(value))
     return { kind: "unknown", reason: "\u884C\u4E0D\u662F JSON \u5BF9\u8C61", rawText: line };
   const type = value.type;
   if (typeof type !== "string") {
@@ -12130,7 +12610,7 @@ function parseTranscriptLine(line) {
     const attachment = {
       kind: "attachment",
       ...common,
-      attachment: isRecord2(value.attachment) ? value.attachment : {}
+      attachment: isRecord3(value.attachment) ? value.attachment : {}
     };
     return attachment;
   }
@@ -12154,14 +12634,14 @@ function extractCommon(raw) {
 }
 function parseUser(raw, common) {
   const line = { kind: "user", ...common, toolResults: [] };
-  const message = isRecord2(raw.message) ? raw.message : void 0;
+  const message = isRecord3(raw.message) ? raw.message : void 0;
   const content = message?.content;
   if (typeof content === "string") {
     line.text = content;
   } else if (Array.isArray(content)) {
     const texts = [];
     for (const block of content) {
-      if (!isRecord2(block))
+      if (!isRecord3(block))
         continue;
       if (block.type === "tool_result" && typeof block.tool_use_id === "string") {
         const result = {
@@ -12184,20 +12664,20 @@ function parseUser(raw, common) {
 }
 function parseAssistant(raw, common) {
   const line = { kind: "assistant", ...common, blocks: [] };
-  const message = isRecord2(raw.message) ? raw.message : void 0;
+  const message = isRecord3(raw.message) ? raw.message : void 0;
   if (message === void 0)
     return line;
   if (typeof message.model === "string")
     line.model = message.model;
   if (typeof message.id === "string")
     line.messageId = message.id;
-  if (isRecord2(message.usage))
+  if (isRecord3(message.usage))
     line.usage = message.usage;
   const content = message.content;
   if (!Array.isArray(content))
     return line;
   for (const block of content) {
-    if (!isRecord2(block))
+    if (!isRecord3(block))
       continue;
     line.blocks.push(parseAssistantBlock(block));
   }
@@ -12215,7 +12695,7 @@ function parseAssistantBlock(block) {
       kind: "tool_use",
       id: block.id,
       name: block.name,
-      input: isRecord2(block.input) ? block.input : {}
+      input: isRecord3(block.input) ? block.input : {}
     };
   }
   return {
@@ -12224,7 +12704,7 @@ function parseAssistantBlock(block) {
     raw: block
   };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -12409,7 +12889,7 @@ function buildTaskCreateResultIndex(lines) {
     if (line.kind !== "user")
       continue;
     const result = line.toolUseResult;
-    if (!isRecord2(result) || !isRecord2(result.task) || typeof result.task.id !== "string")
+    if (!isRecord3(result) || !isRecord3(result.task) || typeof result.task.id !== "string")
       continue;
     for (const toolResult of line.toolResults)
       index.set(toolResult.toolUseId, result.task.id);
@@ -12422,7 +12902,7 @@ function applyTodoWrite(input, tasks) {
     return false;
   tasks.clear();
   for (const raw of todos) {
-    if (!isRecord2(raw) || typeof raw.content !== "string" || !isTodoStatus(raw.status))
+    if (!isRecord3(raw) || typeof raw.content !== "string" || !isTodoStatus(raw.status))
       continue;
     const item = { id: raw.content, content: raw.content, status: raw.status };
     if (typeof raw.activeForm === "string")
@@ -12528,7 +13008,7 @@ function turnUsage(line) {
     }
   };
   const breakdown = usage.cache_creation;
-  if (isRecord2(breakdown)) {
+  if (isRecord3(breakdown)) {
     const fiveMinute = finiteNumber(breakdown.ephemeral_5m_input_tokens);
     const oneHour = finiteNumber(breakdown.ephemeral_1h_input_tokens);
     if (fiveMinute !== void 0)
@@ -12577,7 +13057,33 @@ function createNarrativeService(options = {}) {
   const intervalMs = options.intervalMs ?? 500;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const harnesses = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  const pendingNotifications = /* @__PURE__ */ new Set();
+  let notificationQueued = false;
   let closed = false;
+  function notify(harness) {
+    pendingNotifications.add(harness);
+    if (notificationQueued)
+      return;
+    notificationQueued = true;
+    queueMicrotask(() => {
+      notificationQueued = false;
+      if (closed) {
+        pendingNotifications.clear();
+        return;
+      }
+      const harnesses2 = [...pendingNotifications];
+      pendingNotifications.clear();
+      for (const changed of harnesses2) {
+        for (const listener of listeners) {
+          try {
+            listener(changed);
+          } catch {
+          }
+        }
+      }
+    });
+  }
   function sessionsOf(harness) {
     let sessions = harnesses.get(harness);
     if (sessions === void 0) {
@@ -12590,6 +13096,7 @@ function createNarrativeService(options = {}) {
     return {
       id,
       lines: [],
+      codexLines: [],
       follows: /* @__PURE__ */ new Map(),
       hookIntervals: [],
       waiting: null,
@@ -12640,20 +13147,27 @@ function createNarrativeService(options = {}) {
   function resetTranscript(session, path) {
     closeSession(session);
     session.lines = [];
+    session.codexLines = [];
     session.hookIntervals = [];
+    session.hookPrompt = void 0;
+    session.hookPromptAt = void 0;
     session.mockNote = void 0;
     session.transcriptPath = path;
     session.dirty = true;
   }
-  function startFollowing(session, path) {
+  function startFollowing(harness, session, path) {
     if (closed || session.follows.has(path))
       return;
     session.follows.set(path, followTranscript(path, (line) => {
-      session.lines.push(parseTranscriptLine(line));
+      if (harness === "codex")
+        session.codexLines.push(parseCodexRolloutLine(line));
+      else
+        session.lines.push(parseTranscriptLine(line));
       session.dirty = true;
+      notify(harness);
     }, { intervalMs }));
   }
-  function startSubagentDiscovery(session, transcriptPath) {
+  function startSubagentDiscovery(harness, session, transcriptPath) {
     const sessionDir = transcriptPath.replace(/\.jsonl$/, "");
     if (sessionDir === transcriptPath)
       return;
@@ -12662,8 +13176,9 @@ function createNarrativeService(options = {}) {
       try {
         const entries = await readdir(subagentsDir);
         for (const entry of entries) {
-          if (/^agent-.*\.jsonl$/.test(entry))
-            startFollowing(session, join4(subagentsDir, entry));
+          if (/^agent-.*\.jsonl$/.test(entry)) {
+            startFollowing(harness, session, join4(subagentsDir, entry));
+          }
         }
       } catch {
       }
@@ -12690,8 +13205,17 @@ function createNarrativeService(options = {}) {
     if (follow && transcriptPath !== void 0) {
       if (session.transcriptPath !== transcriptPath) {
         resetTranscript(session, transcriptPath);
-        startFollowing(session, transcriptPath);
-        startSubagentDiscovery(session, transcriptPath);
+        startFollowing(event.harness, session, transcriptPath);
+        if (event.harness === "cc") {
+          startSubagentDiscovery(event.harness, session, transcriptPath);
+        }
+      }
+    }
+    if (name === "UserPromptSubmit" && typeof payload.prompt === "string") {
+      const prompt = payload.prompt.trim();
+      if (prompt !== "") {
+        session.hookPrompt = truncate(prompt, DETAIL_LIMIT);
+        session.hookPromptAt = event.received_at;
       }
     }
     if (name === "SubagentStart") {
@@ -12743,13 +13267,34 @@ function createNarrativeService(options = {}) {
     }
     session.lastEvent = { name, at: event.received_at };
     session.dirty = true;
+    notify(event.harness);
   }
   function seedFixture(harness, rawLines, mockNote) {
-    const lines = rawLines.filter((l) => l.trim() !== "").map((l) => parseTranscriptLine(l));
+    const sourceLines = rawLines.filter((line) => line.trim() !== "");
+    if (harness === "codex") {
+      const codexLines = sourceLines.map((line) => parseCodexRolloutLine(line));
+      const meta = codexLines.find((line) => line.kind === "session_meta");
+      const id2 = meta?.threadId ?? meta?.sessionId ?? "__fixture__";
+      const session2 = sessionOf(harness, id2);
+      session2.lines = [];
+      session2.codexLines = codexLines;
+      session2.mockNote = mockNote;
+      const cwd = meta?.cwd ?? codexLines.find((line) => line.kind === "turn_context")?.cwd;
+      if (cwd !== void 0) {
+        const base = pathBasename(cwd);
+        if (base !== "")
+          session2.label = base;
+      }
+      session2.dirty = true;
+      notify(harness);
+      return;
+    }
+    const lines = sourceLines.map((line) => parseTranscriptLine(line));
     const sessionLine = lines.find((l) => l.kind !== "unknown" && typeof l.sessionId === "string");
     const id = sessionLine?.sessionId ?? "__fixture__";
     const session = sessionOf(harness, id);
     session.lines = lines;
+    session.codexLines = [];
     session.mockNote = mockNote;
     for (const line of lines) {
       if (line.kind === "unknown")
@@ -12763,6 +13308,7 @@ function createNarrativeService(options = {}) {
       }
     }
     session.dirty = true;
+    notify(harness);
   }
   function deriveCached(harness, session) {
     if (!session.dirty && session.cached !== void 0)
@@ -12790,9 +13336,9 @@ function createNarrativeService(options = {}) {
     const overview = getOverview(harness);
     const first = overview.sessions[0];
     if (first !== void 0) {
-      const state2 = overview.states[first.id];
-      if (state2 !== void 0)
-        return state2;
+      const state = overview.states[first.id];
+      if (state !== void 0)
+        return state;
     }
     return emptyState(harness, now().toISOString());
   }
@@ -12802,8 +13348,17 @@ function createNarrativeService(options = {}) {
       for (const session of sessions.values())
         closeSession(session);
     }
+    pendingNotifications.clear();
+    listeners.clear();
+  }
+  function subscribe(listener) {
+    if (closed)
+      return () => {
+      };
+    listeners.add(listener);
+    return () => listeners.delete(listener);
   }
-  return { handleEvent, getState, getOverview, seedFixture, close };
+  return { handleEvent, getState, getOverview, seedFixture, subscribe, close };
 }
 function lastActivityOf(session) {
   if (session.lastActivity !== void 0)
@@ -12816,6 +13371,13 @@ function lastActivityOf(session) {
     if (ts !== void 0 && ts > latest)
       latest = ts;
   }
+  for (const line of session.codexLines) {
+    if (line.kind === "unknown")
+      continue;
+    const ts = line.timestamp;
+    if (ts !== void 0 && ts > latest)
+      latest = ts;
+  }
   return latest;
 }
 function isEnded(session, nowIso) {
@@ -12861,7 +13423,8 @@ function waitingMessage(payload, fallback) {
   return fallback;
 }
 function derive(harness, session, nowIso) {
-  const lines = sortedByTimestamp(session.lines);
+  const codexLines = sortedCodexByTimestamp(session.codexLines);
+  const lines = harness === "codex" ? adaptCodexNarrativeLines(codexLines) : sortedByTimestamp(session.lines);
   const timeline = deriveTodoTimeline(extractTodoSnapshots(lines));
   const allSteps = extractSteps(lines);
   const steps = allSteps.filter((s) => !TODO_TOOLS.has(s.toolName));
@@ -12954,11 +13517,12 @@ function derive(harness, session, nowIso) {
     todos,
     ...textTodos !== void 0 && textTodos.length > 0 ? { textTodos } : {},
     traces,
-    turnUsages: deriveTurnUsages(lines),
+    turnUsages: harness === "codex" ? deriveCodexTurnUsages(codexLines) : deriveTurnUsages(lines),
     currentAction: deriveCurrentAction(steps, session.lastEvent, session.pendingHookTool),
     waiting: session.waiting,
     agentQuote: deriveAgentQuote(lines),
-    lastPrompt: deriveLastPrompt(lines),
+    // transcript 是会话事实源；hook prompt 只在 tail 尚未读到/格式暂不可读时兜底。
+    lastPrompt: deriveLastPrompt(lines, session.hookPrompt, session.hookPromptAt),
     updatedAt: nowIso
   };
 }
@@ -13005,6 +13569,109 @@ function sortedByTimestamp(lines) {
     return ta < tb ? -1 : ta > tb ? 1 : 0;
   });
 }
+function sortedCodexByTimestamp(lines) {
+  return [...lines].sort((a, b) => {
+    const ta = a.kind === "unknown" ? void 0 : a.timestamp;
+    const tb = b.kind === "unknown" ? void 0 : b.timestamp;
+    if (ta === void 0 || tb === void 0)
+      return 0;
+    return ta < tb ? -1 : ta > tb ? 1 : 0;
+  });
+}
+function adaptCodexNarrativeLines(lines) {
+  const responseTexts = new Set(lines.flatMap((line) => line.kind === "assistant" && line.source === "response_item" && line.text !== void 0 ? [line.text] : []));
+  const modelByTurn = /* @__PURE__ */ new Map();
+  for (const line of lines) {
+    if (line.kind === "turn_context" && line.turnId !== void 0 && line.model !== void 0) {
+      modelByTurn.set(line.turnId, line.model);
+    }
+  }
+  const adapted = [];
+  let activeTurnId;
+  for (const line of lines) {
+    if (line.kind === "task_started") {
+      activeTurnId = line.turnId;
+      continue;
+    }
+    if (line.kind === "task_complete" || line.kind === "turn_aborted") {
+      if (line.turnId === void 0 || line.turnId === activeTurnId)
+        activeTurnId = void 0;
+      continue;
+    }
+    if (line.kind === "turn_context" && line.turnId !== void 0) {
+      activeTurnId = line.turnId;
+      continue;
+    }
+    if (line.kind === "user") {
+      adapted.push({
+        kind: "user",
+        ...line.timestamp !== void 0 ? { timestamp: line.timestamp } : {},
+        ...line.text !== void 0 ? { text: line.text } : {},
+        toolResults: [],
+        raw: { source: "codex-rollout" }
+      });
+      continue;
+    }
+    if (line.kind === "assistant") {
+      if (line.text === void 0 || line.source === "event_msg" && responseTexts.has(line.text)) {
+        continue;
+      }
+      const turnId = line.turnId ?? activeTurnId;
+      const model = turnId === void 0 ? void 0 : modelByTurn.get(turnId);
+      adapted.push({
+        kind: "assistant",
+        ...line.timestamp !== void 0 ? { timestamp: line.timestamp } : {},
+        ...line.messageId !== void 0 ? { messageId: line.messageId } : {},
+        ...model !== void 0 ? { model } : {},
+        blocks: [{ kind: "text", text: line.text }],
+        raw: { source: "codex-rollout" }
+      });
+      continue;
+    }
+    if (line.kind === "tool_call") {
+      if (line.callId === void 0 || line.name === void 0)
+        continue;
+      const turnId = line.turnId ?? activeTurnId;
+      const model = turnId === void 0 ? void 0 : modelByTurn.get(turnId);
+      adapted.push({
+        kind: "assistant",
+        ...line.timestamp !== void 0 ? { timestamp: line.timestamp } : {},
+        ...model !== void 0 ? { model } : {},
+        blocks: [
+          {
+            kind: "tool_use",
+            id: line.callId,
+            name: line.name,
+            input: codexToolInput(line.input)
+          }
+        ],
+        raw: { source: "codex-rollout" }
+      });
+      continue;
+    }
+    if (line.kind === "tool_result" && line.callId !== void 0) {
+      adapted.push({
+        kind: "user",
+        ...line.timestamp !== void 0 ? { timestamp: line.timestamp } : {},
+        toolResults: [
+          {
+            toolUseId: line.callId,
+            isError: line.isError === true,
+            content: line.output
+          }
+        ],
+        raw: { source: "codex-rollout" }
+      });
+    }
+  }
+  return sortedByTimestamp(adapted);
+}
+function codexToolInput(value) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  return value === void 0 ? {} : { input: value };
+}
 function collectResults(lines) {
   const results = /* @__PURE__ */ new Map();
   for (const line of lines) {
@@ -13071,7 +13738,15 @@ function nodeEstTokens(steps, results) {
   }
   return counted ? { estTokens: sum } : {};
 }
-var DETAIL_KEYS = ["command", "file_path", "description", "subject", "pattern", "prompt"];
+var DETAIL_KEYS = [
+  "command",
+  "file_path",
+  "description",
+  "subject",
+  "pattern",
+  "prompt",
+  "input"
+];
 function inputDetail(input) {
   for (const key of DETAIL_KEYS) {
     const value = input[key];
@@ -13120,6 +13795,131 @@ function deriveTurnUsages(lines) {
   }
   return [...byMessage.values()];
 }
+var ZERO_CODEX_USAGE = {
+  inputTokens: 0,
+  cachedInputTokens: 0,
+  cacheWriteInputTokens: 0,
+  outputTokens: 0,
+  reasoningOutputTokens: 0,
+  totalTokens: 0
+};
+function deriveCodexTurnUsages(lines) {
+  const modelByTurn = /* @__PURE__ */ new Map();
+  for (const line of lines) {
+    if (line.kind === "turn_context" && line.turnId !== void 0 && line.model !== void 0) {
+      modelByTurn.set(line.turnId, line.model);
+    }
+  }
+  const turns = [];
+  let latestTotal;
+  let active;
+  function finishActive() {
+    const current = active;
+    if (current?.terminal === void 0)
+      return;
+    active = void 0;
+    const delta = current.latest === void 0 ? void 0 : subtractCodexUsage(current.latest, current.baseline);
+    if (delta === void 0)
+      return;
+    if (delta.inputTokens === 0 && delta.outputTokens === 0 && (delta.totalTokens ?? 0) === 0) {
+      return;
+    }
+    const inputTokens = delta.inputTokens - delta.cachedInputTokens - delta.cacheWriteInputTokens;
+    if (inputTokens < 0)
+      return;
+    const model = current.turnId === void 0 ? void 0 : modelByTurn.get(current.turnId);
+    const view = {
+      ...current.turnId !== void 0 ? { messageId: current.turnId } : {},
+      ...model !== void 0 ? { model } : {},
+      inputTokens,
+      cacheCreationInputTokens: delta.cacheWriteInputTokens,
+      cacheReadInputTokens: delta.cachedInputTokens,
+      outputTokens: delta.outputTokens,
+      inputTotalTokens: delta.inputTokens,
+      ...current.terminal === "aborted" ? { status: "aborted" } : current.terminal === "incomplete" ? { status: "incomplete" } : {},
+      ...current.startedAt !== void 0 ? { ts: current.startedAt } : {}
+    };
+    if (delta.reasoningOutputTokens !== void 0 && delta.reasoningOutputTokens <= delta.outputTokens) {
+      view.reasoningOutputTokens = delta.reasoningOutputTokens;
+    }
+    if (delta.totalTokens !== void 0)
+      view.totalTokens = delta.totalTokens;
+    turns.push(view);
+  }
+  for (const line of lines) {
+    if (line.kind === "task_started") {
+      if (active !== void 0 && active.terminal === void 0)
+        active.terminal = "incomplete";
+      finishActive();
+      active = {
+        ...line.turnId !== void 0 ? { turnId: line.turnId } : {},
+        ...line.timestamp !== void 0 ? { startedAt: line.timestamp } : {},
+        baseline: latestTotal ?? ZERO_CODEX_USAGE
+      };
+      continue;
+    }
+    if (line.kind === "token_count") {
+      const snapshot = codexUsageSnapshot(line.totalUsage);
+      if (snapshot === void 0)
+        continue;
+      latestTotal = snapshot;
+      if (active !== void 0) {
+        active.latest = snapshot;
+        if (active.terminal !== void 0)
+          finishActive();
+      }
+      continue;
+    }
+    if (line.kind !== "task_complete" && line.kind !== "turn_aborted" || active === void 0) {
+      continue;
+    }
+    if (line.turnId !== void 0 && active.turnId !== void 0 && line.turnId !== active.turnId) {
+      continue;
+    }
+    active.terminal = line.kind === "turn_aborted" ? "aborted" : "complete";
+  }
+  if (active !== void 0 && active.terminal === void 0)
+    active.terminal = "incomplete";
+  finishActive();
+  return turns;
+}
+function codexUsageSnapshot(usage) {
+  if (usage?.inputTokens === void 0 || usage.cachedInputTokens === void 0 || usage.cacheWriteInputTokens === void 0 || usage.outputTokens === void 0) {
+    return void 0;
+  }
+  return {
+    inputTokens: usage.inputTokens,
+    cachedInputTokens: usage.cachedInputTokens,
+    cacheWriteInputTokens: usage.cacheWriteInputTokens,
+    outputTokens: usage.outputTokens,
+    ...usage.reasoningOutputTokens !== void 0 ? { reasoningOutputTokens: usage.reasoningOutputTokens } : {},
+    ...usage.totalTokens !== void 0 ? { totalTokens: usage.totalTokens } : {}
+  };
+}
+function subtractCodexUsage(current, baseline) {
+  const inputTokens = current.inputTokens - baseline.inputTokens;
+  const cachedInputTokens = current.cachedInputTokens - baseline.cachedInputTokens;
+  const cacheWriteInputTokens = current.cacheWriteInputTokens - baseline.cacheWriteInputTokens;
+  const outputTokens = current.outputTokens - baseline.outputTokens;
+  if (inputTokens < 0 || cachedInputTokens < 0 || cacheWriteInputTokens < 0 || outputTokens < 0) {
+    return void 0;
+  }
+  const reasoningOutputTokens = optionalUsageDelta(current.reasoningOutputTokens, baseline.reasoningOutputTokens);
+  const totalTokens = optionalUsageDelta(current.totalTokens, baseline.totalTokens);
+  return {
+    inputTokens,
+    cachedInputTokens,
+    cacheWriteInputTokens,
+    outputTokens,
+    ...reasoningOutputTokens !== void 0 ? { reasoningOutputTokens } : {},
+    ...totalTokens !== void 0 ? { totalTokens } : {}
+  };
+}
+function optionalUsageDelta(current, baseline) {
+  if (current === void 0 || baseline === void 0 || current < baseline)
+    return void 0;
+  return current - baseline;
+}
 function deriveCurrentAction(steps, lastEvent, pendingHookTool) {
   const open2 = [...steps].reverse().find((s) => s.endTs === void 0);
   if (open2) {
@@ -13154,7 +13954,7 @@ function deriveAgentQuote(lines) {
   }
   return null;
 }
-function deriveLastPrompt(lines) {
+function deriveLastPrompt(lines, hookPrompt, hookPromptAt) {
   for (let i = lines.length - 1; i >= 0; i--) {
     const line = lines[i];
     if (line === void 0 || line.kind !== "user" || line.agentId !== void 0)
@@ -13163,9 +13963,12 @@ function deriveLastPrompt(lines) {
       continue;
     if (line.text === void 0 || line.text.trim() === "")
       continue;
+    if (hookPrompt !== void 0 && hookPromptAt !== void 0 && line.timestamp !== void 0 && hookPromptAt > line.timestamp) {
+      return hookPrompt;
+    }
     return truncate(line.text.trim(), DETAIL_LIMIT);
   }
-  return null;
+  return hookPrompt ?? null;
 }
 function truncate(text, limit) {
   return text.length <= limit ? text : `${text.slice(0, limit - 1)}\u2026`;
@@ -13227,96 +14030,65 @@ async function loadHarness(harness, mode) {
   };
 }
 
-// apps/cli/dist/scan.js
-init_dist();
-
-// apps/cli/dist/telemetry.js
-import { readFileSync as readFileSync11 } from "node:fs";
+// apps/cli/dist/runtime-state.js
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { closeSync, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync11, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { dirname as dirname11, join as join17 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var DEFAULT_TELEMETRY_SERVER = "https://api.getwingman.dev";
-var SEND_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var SEND_TIMEOUT_MS = 3e3;
-var MAX_ERROR_TYPES = 10;
-function emptyState2() {
-  return {
-    scans: 0,
-    toggleApplies: 0,
-    detected: { cc: false, codex: false, dsh: false },
-    liveWired: { cc: false, codex: false, dsh: false },
-    errorTypes: /* @__PURE__ */ new Set()
-  };
-}
-var state = emptyState2();
-function recordDetect(harness, installed) {
-  state.detected[harness] = installed;
-}
-function recordScan(config) {
-  state.scans += 1;
-  state.detected[config.harness] = true;
-  state.liveWired[config.harness] = config.capabilities.live !== "none";
+function createHookToken() {
+  return randomBytes2(32).toString("base64url");
 }
-function recordHookInstall(harness) {
-  state.liveWired[harness] = true;
-}
-function recordApply() {
-  state.toggleApplies += 1;
-}
-function recordError(error) {
-  if (state.errorTypes.size >= MAX_ERROR_TYPES)
-    return;
-  state.errorTypes.add(error instanceof Error ? error.constructor.name : typeof error);
-}
-function buildPayload(options) {
-  return {
-    app_version: options.version,
-    platform: process.platform,
-    arch: process.arch,
-    harnesses: { ...state.detected },
-    counts: {
-      scans: state.scans,
-      live_wired: Object.values(state.liveWired).filter(Boolean).length,
-      toggle_applies: state.toggleApplies
-    },
-    license_state: options.licenseState,
-    error_types: [...state.errorTypes].sort()
-  };
-}
-function appVersion() {
-  if (typeof __WINGMAN_VERSION__ === "string")
-    return __WINGMAN_VERSION__;
+function writeServeRuntimeState(port, token, options = {}) {
+  const warn = options.warn ?? (() => {
+  });
+  const startedAtMs = (options.now ?? Date.now)();
+  const pid = options.pid ?? process.pid;
+  const suffix = randomBytes2(8).toString("base64url");
+  const owner = `serve-${startedAtMs}-${pid}-${suffix}`;
+  const path = join17(options.homeDir ?? homedir9(), ".wingman", "state", "serve", `${owner}.json`);
+  const tempPath = join17(dirname11(path), `.${owner}.tmp`);
+  const contents = Buffer.from(`${JSON.stringify({ version: 2, owner, pid, port, startedAtMs, token })}
+`, "utf8");
+  let fd;
   try {
-    const pkgPath = join17(dirname11(fileURLToPath2(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : "unknown";
-  } catch {
-    return "unknown";
+    mkdirSync6(dirname11(path), { recursive: true, mode: 448 });
+    fd = openSync(tempPath, "wx", 384);
+    writeFileSync7(fd, contents);
+    closeSync(fd);
+    fd = void 0;
+    renameSync3(tempPath, path);
+    return { path, contents };
+  } catch (error) {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      rmSync4(tempPath, { force: true });
+    } catch {
+    }
+    warn(`Codex hook \u8FD0\u884C\u6001\u5199\u5165\u5931\u8D25,\u9762\u677F\u7EE7\u7EED\u8FD0\u884C:${errorMessage(error)}`);
+    return void 0;
   }
 }
-async function sendMetrics(payload, baseUrl) {
-  const base = baseUrl ?? process.env.WINGMAN_TELEMETRY_SERVER ?? DEFAULT_TELEMETRY_SERVER;
+function removeServeRuntimeState(registration) {
+  if (registration === void 0)
+    return;
   try {
-    await fetch(`${base}/metrics`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(SEND_TIMEOUT_MS)
-    });
+    const current = readFileSync11(registration.path);
+    if (current.equals(registration.contents))
+      rmSync4(registration.path, { force: true });
   } catch {
   }
 }
-function startTelemetry(options = {}) {
-  const send = () => {
-    const licenseState = licenseStatus(options.homeDir === void 0 ? {} : { homeDir: options.homeDir }).state;
-    void sendMetrics(buildPayload({ version: appVersion(), licenseState }), options.baseUrl);
-  };
-  send();
-  const timer = setInterval(send, options.intervalMs ?? SEND_INTERVAL_MS);
-  timer.unref();
-  return () => clearInterval(timer);
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
 }
 
 // apps/cli/dist/scan.js
+init_dist();
 async function scanValidated(adapter, options) {
   const config = await adapter.scan(options);
   const errors = validateUnifiedConfig(config);
@@ -13324,12 +14096,12 @@ async function scanValidated(adapter, options) {
     throw new Error(`${adapter.harness} \u7684 scan \u8F93\u51FA\u4E0D\u7B26\u5408 UnifiedConfig \u5408\u540C:
 - ${errors.join("\n- ")}`);
   }
-  recordScan(config);
   return config;
 }
 
 // apps/cli/dist/server.js
 init_dist();
+import { createHmac, timingSafeEqual } from "node:crypto";
 import { readFile as readFile3 } from "node:fs/promises";
 import { createServer } from "node:http";
 import { extname, resolve as resolve5, sep as sep2 } from "node:path";
@@ -13382,9 +14154,9 @@ function residentTotal(config) {
   }
   return counted ? { kind, value: sum } : void 0;
 }
-function stepToolNames(state2) {
+function stepToolNames(state) {
   const names = [];
-  for (const trace of state2.traces) {
+  for (const trace of state.traces) {
     for (const node of trace.nodes) {
       for (const step of node.steps)
         names.push(step.toolName);
@@ -13392,23 +14164,23 @@ function stepToolNames(state2) {
   }
   return names;
 }
-function deriveSuggestions(state2, config, nowMs) {
+function deriveSuggestions(state, config, nowMs) {
   const suggestions = [];
-  if (state2.waiting !== null) {
-    const sinceMs = Date.parse(state2.waiting.since);
+  if (state.waiting !== null) {
+    const sinceMs = Date.parse(state.waiting.since);
     if (Number.isFinite(sinceMs) && nowMs - sinceMs > WAITING_TIMEOUT_MS) {
       suggestions.push({
         id: "waiting-timeout",
         rule: "waiting-timeout",
-        text: `\u5DF2\u7B49\u5F85 ${fmtDuration(nowMs - sinceMs)}:${state2.waiting.message}`,
-        source: `\u6765\u6E90:${state2.waiting.kind === "permission" ? "PermissionRequest" : "Notification"} \u4E8B\u4EF6,${state2.waiting.since} \u8D77\u672A\u51B3;\u9608\u503C 60s`
+        text: `\u5DF2\u7B49\u5F85 ${fmtDuration(nowMs - sinceMs)}:${state.waiting.message}`,
+        source: `\u6765\u6E90:${state.waiting.kind === "permission" ? "PermissionRequest" : "Notification"} \u4E8B\u4EF6,${state.waiting.since} \u8D77\u672A\u51B3;\u9608\u503C 60s`
       });
     }
   }
   if (config !== void 0) {
     const refSources = [
-      ...state2.lastPrompt !== null ? [{ file: "\u7528\u6237\u63D0\u793A", text: state2.lastPrompt }] : [],
-      ...state2.agentQuote !== null ? [{ file: "agent \u81EA\u8FF0", text: state2.agentQuote }] : []
+      ...state.lastPrompt !== null ? [{ file: "\u7528\u6237\u63D0\u793A", text: state.lastPrompt }] : [],
+      ...state.agentQuote !== null ? [{ file: "agent \u81EA\u8FF0", text: state.agentQuote }] : []
     ];
     if (refSources.length > 0) {
       for (const items of Object.values(config.slots)) {
@@ -13430,8 +14202,9 @@ function deriveSuggestions(state2, config, nowMs) {
         }
       }
     }
-    const toolNames = stepToolNames(state2);
-    if (toolNames.length > 0 && state2.turnUsages.length > 0) {
+    const toolNames = stepToolNames(state);
+    const hasCompletedTurn = state.turnUsages.some((turn) => turn.status === void 0);
+    if (toolNames.length > 0 && hasCompletedTurn) {
       for (const item of config.slots.tools) {
         if (!item.enabled || !item.toggleable)
           continue;
@@ -13455,9 +14228,9 @@ function deriveSuggestions(state2, config, nowMs) {
         });
       }
     }
-    const lastTurn = state2.turnUsages[state2.turnUsages.length - 1];
+    const lastTurn = state.turnUsages[state.turnUsages.length - 1];
     const resident = residentTotal(config);
-    if (lastTurn !== void 0 && resident !== void 0) {
+    if (lastTurn?.contextTotal !== void 0 && resident !== void 0) {
       const ctx = lastTurn.contextTotal.value;
       const history = ctx - resident.value;
       if (ctx >= HISTORY_BLOAT_MIN_CONTEXT && history / ctx > HISTORY_BLOAT_RATIO) {
@@ -13490,13 +14263,16 @@ var CONTENT_TYPES = {
   ".woff2": "font/woff2"
 };
 var ANATOMY_CACHE_TTL_MS = 3e4;
+var HOOK_IDENTITY_PATH = "/api/hook-target";
+var HOOK_TOKEN_HEADER = "x-wingman-hook-token";
+var HOOK_PROOF_HEADER = "x-wingman-hook-proof";
+var PANEL_ACTION_HEADER = "x-wingman-panel-action";
 function createWingmanServer(options) {
   const warn = options.warn ?? ((message) => console.error(message));
   const runtime = { anatomy: null };
   return createServer((req, res) => {
     handle(req, res, options, warn, runtime).catch((error) => {
-      recordError(error);
-      warn(`[wingman] \u8BF7\u6C42\u5904\u7406\u5931\u8D25:${errorMessage(error)}`);
+      warn(`[wingman] \u8BF7\u6C42\u5904\u7406\u5931\u8D25:${errorMessage2(error)}`);
       if (!res.headersSent)
         sendText2(res, 500, "internal error");
       else
@@ -13515,7 +14291,35 @@ function listen(server, port) {
 }
 async function handle(req, res, options, warn, runtime) {
   const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (req.method !== "GET") {
+    const origin = req.headers.origin;
+    if (typeof origin === "string" && origin !== "" && !/^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?$/.test(origin)) {
+      sendJson(res, 403, { error: `\u62D2\u7EDD\u5F02\u6E90\u5199\u8BF7\u6C42(Origin: ${origin})` });
+      return;
+    }
+  }
+  if (options.hookToken && url.pathname === HOOK_IDENTITY_PATH) {
+    if (req.method !== "GET") {
+      sendText2(res, 405, `method not allowed:${HOOK_IDENTITY_PATH} \u53EA\u63A5\u53D7 GET`);
+      return;
+    }
+    const nonce = url.searchParams.get("nonce");
+    if (nonce === null || !/^[A-Za-z0-9_-]{16,128}$/.test(nonce)) {
+      sendText2(res, 400, "nonce \u9700\u8981 16-128 \u4F4D base64url \u5B57\u7B26");
+      return;
+    }
+    res.writeHead(204, {
+      [HOOK_PROOF_HEADER]: hookProof(options.hookToken, nonce),
+      "cache-control": "no-store"
+    });
+    res.end();
+    return;
+  }
   if (options.receiver && url.pathname === "/hook") {
+    if (url.searchParams.get("harness") === "codex" && options.hookToken !== void 0 && !sameToken(options.hookToken, req.headers[HOOK_TOKEN_HEADER])) {
+      sendText2(res, 403, "Codex hook token \u65E0\u6548");
+      return;
+    }
     options.receiver.handleHook(req, res);
     return;
   }
@@ -13523,6 +14327,14 @@ async function handle(req, res, options, warn, runtime) {
     options.receiver.handleEvents(req, res);
     return;
   }
+  if (options.narrative && url.pathname === "/api/narrative/events") {
+    if (req.method !== "GET") {
+      sendText2(res, 405, "method not allowed:/api/narrative/events \u53EA\u63A5\u53D7 GET");
+      return;
+    }
+    handleNarrativeEvents(req, res, options.narrative);
+    return;
+  }
   if (url.pathname === "/api/action/plan" && req.method === "POST") {
     await handleActionPlan(req, res, options);
     return;
@@ -13535,13 +14347,24 @@ async function handle(req, res, options, warn, runtime) {
     await handleLicenseInstall(req, res, options);
     return;
   }
+  if (url.pathname === "/api/license/refresh") {
+    if (req.method !== "POST") {
+      sendText2(res, 405, "method not allowed:/api/license/refresh \u53EA\u63A5\u53D7 POST");
+      return;
+    }
+    if (req.headers[PANEL_ACTION_HEADER] !== "refresh-license") {
+      sendJson(res, 403, { error: "\u5237\u65B0\u6388\u6743\u5FC5\u987B\u7531 Wingman \u9762\u677F\u4E2D\u7684\u6309\u94AE\u89E6\u53D1" });
+      return;
+    }
+    await handleLicenseRefresh(res, options);
+    return;
+  }
   if (req.method !== "GET") {
     sendText2(res, 405, "method not allowed");
     return;
   }
   if (url.pathname === "/api/license") {
-    const { state: state2, detail } = licenseStatus(options.licenseOptions);
-    sendJson(res, 200, { state: state2, detail });
+    sendJson(res, 200, publicLicenseStatus(licenseStatus(options.licenseOptions)));
     return;
   }
   if (url.pathname === "/api/narrative") {
@@ -13561,9 +14384,9 @@ async function handle(req, res, options, warn, runtime) {
       const config = (await cachedAnatomy(options, warn, runtime)).find((c) => c.harness === harness);
       const nowMs = Date.now();
       const states = {};
-      for (const [id, state2] of Object.entries(overview.states)) {
-        const suggestions = deriveSuggestions(state2, config, nowMs);
-        states[id] = suggestions.length > 0 ? { ...state2, suggestions } : state2;
+      for (const [id, state] of Object.entries(overview.states)) {
+        const suggestions = deriveSuggestions(state, config, nowMs);
+        states[id] = suggestions.length > 0 ? { ...state, suggestions } : state;
       }
       overview.states = states;
     }
@@ -13582,6 +14405,40 @@ async function handle(req, res, options, warn, runtime) {
   }
   await serveStatic(url.pathname, res, options.panelDistDir);
 }
+function hookProof(token, nonce) {
+  return createHmac("sha256", token).update(nonce).digest("base64url");
+}
+function sameToken(expected, actual) {
+  if (typeof actual !== "string")
+    return false;
+  const left = Buffer.from(expected, "utf8");
+  const right = Buffer.from(actual, "utf8");
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function handleNarrativeEvents(_req, res, narrative) {
+  res.writeHead(200, {
+    "content-type": "text/event-stream",
+    "cache-control": "no-cache",
+    connection: "keep-alive"
+  });
+  res.on("error", () => {
+  });
+  res.write(": connected\n\n");
+  const unsubscribe = narrative.subscribe((harness) => {
+    if (!res.destroyed)
+      res.write(`data: ${JSON.stringify({ harness })}
+
+`);
+  });
+  const heartbeat = setInterval(() => {
+    if (!res.destroyed)
+      res.write(": heartbeat\n\n");
+  }, 15e3);
+  res.once("close", () => {
+    clearInterval(heartbeat);
+    unsubscribe();
+  });
+}
 async function cachedAnatomy(options, warn, runtime) {
   const nowMs = Date.now();
   if (runtime.anatomy !== null && nowMs - runtime.anatomy.at < ANATOMY_CACHE_TTL_MS) {
@@ -13597,11 +14454,9 @@ async function scanAll(harnesses, warn) {
     let installed;
     try {
       const detected = await adapter.detect(scanOptions);
-      recordDetect(harness, detected.installed);
       installed = detected.installed;
     } catch (error) {
-      recordError(error);
-      warn(`[wingman] ${harness} detect \u5931\u8D25,\u5DF2\u8DF3\u8FC7:${errorMessage(error)}`);
+      warn(`[wingman] ${harness} detect \u5931\u8D25,\u5DF2\u8DF3\u8FC7:${errorMessage2(error)}`);
       continue;
     }
     if (!installed)
@@ -13609,8 +14464,7 @@ async function scanAll(harnesses, warn) {
     try {
       configs.push(await scanValidated(adapter, scanOptions));
     } catch (error) {
-      recordError(error);
-      warn(`[wingman] ${harness} \u626B\u63CF\u5931\u8D25,\u964D\u7EA7\u663E\u793A:${errorMessage(error)}`);
+      warn(`[wingman] ${harness} \u626B\u63CF\u5931\u8D25,\u964D\u7EA7\u663E\u793A:${errorMessage2(error)}`);
       configs.push(degradedScanConfig(harness, error));
     }
   }
@@ -13647,7 +14501,7 @@ function degradedScanConfig(harness, error) {
   };
 }
 function errorSummary(error) {
-  const first = errorMessage(error).split("\n", 1)[0] ?? "";
+  const first = errorMessage2(error).split("\n", 1)[0] ?? "";
   const scrubbed = first.replace(/(?:[A-Za-z]:)?[\\/][^\s'"()|,;]+/g, "\u2026").trim();
   return scrubbed.length <= 120 ? scrubbed : `${scrubbed.slice(0, 119)}\u2026`;
 }
@@ -13671,7 +14525,7 @@ async function handleActionPlan(req, res, options) {
     const plan = await loaded.adapter.planAction(action, loaded.scanOptions);
     sendJson(res, 200, plan);
   } catch (error) {
-    sendJson(res, 400, { error: errorMessage(error) });
+    sendJson(res, 400, { error: errorMessage2(error) });
   }
 }
 async function handleActionApply(req, res, options, runtime) {
@@ -13701,13 +14555,11 @@ async function handleActionApply(req, res, options, runtime) {
   try {
     const result = await loaded.adapter.applyAction(plan, loaded.scanOptions);
     if (result.ok) {
-      recordApply();
       runtime.anatomy = null;
     }
     sendJson(res, 200, result);
   } catch (error) {
-    recordError(error);
-    sendJson(res, 400, { error: errorMessage(error) });
+    sendJson(res, 400, { error: errorMessage2(error) });
   }
 }
 var LICENSE_BODY_LIMIT = 64 * 1024;
@@ -13722,7 +14574,44 @@ async function handleLicenseInstall(req, res, options) {
     sendJson(res, 400, { error: result.error });
     return;
   }
-  sendJson(res, 200, { state: result.status.state, detail: result.status.detail });
+  sendJson(res, 200, publicLicenseStatus(result.status));
+}
+async function handleLicenseRefresh(res, options) {
+  const homeDir = options.licenseRefreshOptions?.homeDir ?? options.licenseOptions?.homeDir;
+  const publicKeyPem = options.licenseRefreshOptions?.publicKeyPem ?? options.licenseOptions?.publicKeyPem;
+  const now = options.licenseRefreshOptions?.now ?? options.licenseOptions?.now;
+  const refreshOptions = {
+    ...options.licenseRefreshOptions,
+    ...homeDir === void 0 ? {} : { homeDir },
+    ...publicKeyPem === void 0 ? {} : { publicKeyPem },
+    ...now === void 0 ? {} : { now }
+  };
+  const result = await refreshLicense(refreshOptions);
+  if (!result.ok) {
+    sendJson(res, 400, {
+      error: result.message,
+      canSubscribe: result.reason === "inactive"
+    });
+    return;
+  }
+  const statusOptions = {
+    ...options.licenseOptions,
+    ...homeDir === void 0 ? {} : { homeDir },
+    ...publicKeyPem === void 0 ? {} : { publicKeyPem },
+    ...now === void 0 ? {} : { now }
+  };
+  sendJson(res, 200, {
+    ...publicLicenseStatus(licenseStatus(statusOptions)),
+    message: result.message
+  });
+}
+function publicLicenseStatus(status) {
+  const body = { state: status.state, detail: status.detail };
+  if (status.claims) {
+    body.plan = status.claims.plan;
+    body.exp = status.claims.exp;
+  }
+  return body;
 }
 function readTextBody(req, maxBytes) {
   return new Promise((resolveBody) => {
@@ -13813,7 +14702,7 @@ function sendText2(res, status, body) {
   res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
   res.end(body);
 }
-function errorMessage(error) {
+function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -13897,6 +14786,7 @@ ${counts}
 }
 async function runServe(args) {
   const { port, fixtures, panelDist } = parseServeArgs(args);
+  const hookToken = createHookToken();
   const harnesses = [];
   for (const id of HARNESS_IDS) {
     try {
@@ -13907,7 +14797,7 @@ async function runServe(args) {
 `);
     }
   }
-  const panelDistDir = panelDist === void 0 ? resolve6(dirname12(fileURLToPath3(import.meta.url)), "../../panel/dist") : resolve6(panelDist);
+  const panelDistDir = panelDist === void 0 ? resolve6(dirname12(fileURLToPath2(import.meta.url)), "../../panel/dist") : resolve6(panelDist);
   const narrative = createNarrativeService({ followTranscripts: !fixtures });
   if (fixtures) {
     try {
@@ -13924,13 +14814,28 @@ async function runServe(args) {
     panelDistDir,
     receiver: createReceiver({ onEvent: narrative.handleEvent }),
     readonlyActions: fixtures,
-    narrative
+    narrative,
+    hookToken
   });
   const actualPort = await listen(server, port);
-  startTelemetry();
+  const runtimeRegistration = fixtures ? void 0 : writeServeRuntimeState(actualPort, hookToken, {
+    warn: (message) => process.stderr.write(`[wingman] ${message}
+`)
+  });
+  const cleanupRuntime = () => removeServeRuntimeState(runtimeRegistration);
+  server.once("close", cleanupRuntime);
+  process.once("exit", cleanupRuntime);
+  process.once("SIGINT", () => {
+    cleanupRuntime();
+    process.exit(130);
+  });
+  process.once("SIGTERM", () => {
+    cleanupRuntime();
+    process.exit(143);
+  });
   const mode = fixtures ? "(fixtures \u6A21\u5F0F:\u6570\u636E\u6765\u81EA @wingman/fixtures \u6837\u4F8B,\u975E\u672C\u673A\u914D\u7F6E)" : "";
   process.stdout.write(`Wingman \u9762\u677F:http://127.0.0.1:${actualPort}${mode}
-\u53EA\u7ED1 127.0.0.1,\u9762\u677F\u4E0E\u6570\u636E\u90FD\u5728\u672C\u673A;\u533F\u540D\u4F7F\u7528\u7EDF\u8BA1\u4E0D\u542B\u5185\u5BB9\u4E0E\u8DEF\u5F84,\u660E\u7EC6 getwingman.dev/data\u3002Ctrl+C \u9000\u51FA\u3002
+\u53EA\u7ED1 127.0.0.1,\u9762\u677F\u4E0E\u6570\u636E\u90FD\u5728\u672C\u673A;\u96F6\u9065\u6D4B\u2014\u2014\u552F\u4E00\u51FA\u95E8\u7684\u6570\u636E\u662F\u4F60\u5728\u9762\u677F\u9010\u6B21\u4E3B\u52A8\u5206\u4EAB\u7684\u6837\u672C,\u53E3\u5F84 getwingman.dev/data\u3002Ctrl+C \u9000\u51FA\u3002
 `);
   return 0;
 }
@@ -13958,10 +14863,13 @@ async function runHook(args) {
   const { adapter } = await loadHarness(harness, { fixtures: false });
   if (action === "install") {
     await adapter.installHooks(port);
-    recordHookInstall(harness);
-    process.stdout.write(`wingman:${harness} \u5B9E\u51B5\u63A5\u7EBF\u5B8C\u6210(POST http://127.0.0.1:${port}/hook?harness=${harness})\u3002
+    if (harness === "codex") {
+      process.stdout.write("wingman:codex \u914D\u7F6E\u5B8C\u6210\uFF1B\u9996\u6B21\u63A5\u7EBF\u8BF7\u5728 Codex \u8F93\u5165 /hooks\uFF0C\u5C06 Wingman hooks \u8BBE\u4E3A Trusted + Enabled\u3002\u6388\u6743\u540E\u65B0\u4E8B\u4EF6\u5E94\u8FDB\u5165 Wingman\uFF1B\u82E5\u5F53\u524D\u4EFB\u52A1\u4ECD\u65E0\u4E8B\u4EF6\uFF0C\u8BF7\u5B8C\u6574\u9000\u51FA\u91CD\u5F00\u540E\u7528\u65B0\u4EFB\u52A1\u9A8C\u8BC1\u3002\n\u5347\u7EA7\u65F6\u53EA\u8981\u53D7\u7BA1 command \u4FDD\u6301\u4E0D\u53D8\uFF0C\u65E0\u9700\u91CD\u590D\u4FE1\u4EFB\uFF1Bcommand \u53D8\u5316\u6216\u53D7\u7BA1\u5757\u6B8B\u7F3A/\u88AB\u4FEE\u6539\u65F6\u4F8B\u5916\u3002\n\u5199\u524D\u5DF2\u5907\u4EFD;\u91CD\u590D\u6267\u884C\u5E42\u7B49;\u89E3\u7EBF:wingman hook uninstall codex\n");
+    } else {
+      process.stdout.write(`wingman:${harness} \u5B9E\u51B5\u63A5\u7EBF\u5B8C\u6210(POST http://127.0.0.1:${port}/hook?harness=${harness})\u3002
 \u5199\u524D\u5DF2\u5907\u4EFD;\u91CD\u590D\u6267\u884C\u5E42\u7B49;\u89E3\u7EBF:wingman hook uninstall ${harness}
 `);
+    }
   } else {
     await adapter.uninstallHooks();
     process.stdout.write(`wingman:${harness} \u5DF2\u89E3\u7EBF,\u914D\u7F6E\u5DF2\u6062\u590D\u3002