javi-forge 1.35.1 → 1.36.0

package/assets/claude-hooks/javi-forge-skillguard-pre-tool-use.mjs

@@ -10,6 +10,22 @@ export const INPUT_LIMIT_BYTES = 1_048_576;
 export const SUPPORTED_TOOLS = Object.freeze(["Bash", "PowerShell", "Read", "Write", "Edit"]);
 export const POLICY_REGISTRY = Object.freeze({ schemaVersion: 1, policyVersion: 1, diagnosticsMaxBytes: 240 });
 const PROJECT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+// Per-agent adapter config (S0 core-extraction): every agent-specific input the guard needs
+// (the isManaged protected-path set, the project-dir source, the managed marker) is resolved by
+// the --agent selector instead of a baked-in literal. The pure evaluate*/utility engine stays
+// agent-independent. Claude's entry holds today's EXACT values so its observable behavior is
+// byte-identical; codex is defined so the map is agent-generic but wired end-to-end only in a later slice.
+const CLAUDE_MANAGED_SET = Object.freeze({ exact: Object.freeze([".claude/settings.json", ".claude/settings.local.json", ".claude/CLAUDE.md", "CLAUDE.md", ".javi-forge/ci.yaml"]), prefixes: Object.freeze([".claude/hooks/", ".claude/agents/", ".claude/skills/"]), caseFoldExact: Object.freeze(["claude.md", ".claude/claude.md"]) });
+const CODEX_MANAGED_SET = Object.freeze({ exact: Object.freeze([".codex/hooks.json", ".claude/settings.json", ".claude/settings.local.json", ".claude/CLAUDE.md", "CLAUDE.md", ".javi-forge/ci.yaml"]), prefixes: Object.freeze([".claude/hooks/", ".claude/agents/", ".claude/skills/"]), caseFoldExact: Object.freeze(["claude.md", ".claude/claude.md"]) });
+export const AGENT_CONFIGS = Object.freeze({ claude: Object.freeze({ id: "claude", managedSet: CLAUDE_MANAGED_SET, projectDir: Object.freeze({ envVar: "CLAUDE_PROJECT_DIR", fallback: "asset-root" }), marker: MANAGED_MARKER }), codex: Object.freeze({ id: "codex", managedSet: CODEX_MANAGED_SET, projectDir: Object.freeze({ envVar: null, fallback: "cwd" }), marker: "// javi-forge-managed: codex-pretooluse v1" }) });
+// Fail-closed agent selector: a missing/unknown --agent means we cannot know what to protect, so refuse.
+function resolveAgentConfig(argv) { const arg = argv.find((value) => typeof value === "string" && value.startsWith("--agent=")); const id = arg === undefined ? undefined : arg.slice("--agent=".length); const config = id === undefined ? undefined : AGENT_CONFIGS[id]; if (!config) fail("invalid-config"); return config; }
+// Project root per agent: the env var when set (Claude = CLAUDE_PROJECT_DIR); otherwise the per-agent
+// fallback decides. "asset-root" anchors to the asset-relative PROJECT_ROOT so Claude is byte-identical
+// to the pre-extraction guard whether the env var is set OR unset (closing the cwd-divergence gap);
+// "cwd" uses the envelope cwd (codex, whose user-global asset has no asset-relative project root and no
+// env var). Fail-safe: an unknown/missing fallback anchors to the stricter PROJECT_ROOT, never looser.
+function resolveProjectRoot(config, cwd) { const envVar = config.projectDir.envVar; if (envVar) { const value = process.env[envVar]; if (typeof value === "string" && value.length > 0) return value; } if (config.projectDir.fallback === "cwd") return cwd ?? PROJECT_ROOT; return PROJECT_ROOT; }
 const POSIX_ABSOLUTE = /^\//;
 const WINDOWS_DRIVE = /^[a-zA-Z]:[\\/]/;
 const WINDOWS_UNC = /^\\\\[^\\]+\\[^\\]+/;
@@ -59,9 +75,8 @@ function nativeRealpath(input) {
 		fail("path-resolution-failed");
 	}
 }
-export function canonicalizePolicyPath(input, options = {}) {
+export function lexicalizePolicyPath(input, options = {}) {
 	if (typeof input !== "string" || input.includes("\0")) fail("invalid-event");
-	const platform = options.platform ?? process.platform;
 	let expanded = input;
 	if (options.base) {
 		expanded = expanded.replace(/^\$\{CLAUDE_PROJECT_DIR\}|^\$CLAUDE_PROJECT_DIR/, options.projectRoot ?? PROJECT_ROOT);
@@ -70,6 +85,11 @@ export function canonicalizePolicyPath(input, options = {}) {
 			expanded = path.resolve(options.base, expanded);
 		}
 	}
+	return expanded;
+}
+export function canonicalizePolicyPath(input, options = {}) {
+	const platform = options.platform ?? process.platform;
+	let expanded = lexicalizePolicyPath(input, options);
 	// Strip Windows device aliases (\??\, \\?\, \\.\) BEFORE native realpath:
 	// on a real win32 host nativeRealpath resolves an unstripped \??\ against the
 	// current drive (D:\??\C:\...), so the alias must be canonicalized first or a
@@ -114,21 +134,21 @@ export function isSensitivePolicyKey(key, platform = process.platform) {
 	if (SENSITIVE_DIRECTORY_SUFFIXES.some((directory) => key.endsWith(directory) || key.includes(`${directory}/`))) return true;
 	return platform === "win32" || platform === "darwin" ? basename.toLowerCase() === "serviceaccountkey.json" : basename === "serviceAccountKey.json";
 }
-function isManaged(key) {
-	const project = canonicalizePolicyPath(PROJECT_ROOT);
+function isManaged(key, managedSet = CLAUDE_MANAGED_SET, projectRoot = PROJECT_ROOT) {
+	const project = canonicalizePolicyPath(projectRoot);
 	if (!key.startsWith(`${project}/`) && key !== project) return false;
 	const relative = key.slice(project.length + 1);
 	// On case-insensitive platforms lexicalNormalize folds the key to lowercase,
 	// so the mixed-case CLAUDE.md literals must be matched case-insensitively too
 	// (the other literals are already lowercase). Otherwise CLAUDE.md and
 	// .claude/CLAUDE.md lose managed-config protection on macOS/Windows.
-	const foldedClaudeMd = (process.platform === "win32" || process.platform === "darwin") && (relative === "claude.md" || relative === ".claude/claude.md");
-	return foldedClaudeMd || relative === ".claude/settings.json" || relative === ".claude/settings.local.json" || relative === ".claude/CLAUDE.md" || relative === "CLAUDE.md" || relative === ".javi-forge/ci.yaml" || relative.startsWith(".claude/hooks/") || relative.startsWith(".claude/agents/") || relative.startsWith(".claude/skills/");
+	const foldedClaudeMd = (process.platform === "win32" || process.platform === "darwin") && managedSet.caseFoldExact.includes(relative);
+	return foldedClaudeMd || managedSet.exact.includes(relative) || managedSet.prefixes.some((prefix) => relative.startsWith(prefix));
 }
-function evaluateFile(toolName, filePath) {
+function evaluateFile(toolName, filePath, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT) {
 	const keys = policyPathKeys(filePath);
 	if (keys.some((key) => isSensitivePolicyKey(key))) return { allowed: false, ruleId: "path.sensitive" };
-	if (toolName !== "Read" && keys.some(isManaged)) return { allowed: false, ruleId: "path.managed-config" };
+	if (toolName !== "Read" && keys.some((key) => isManaged(key, config.managedSet, projectRoot))) return { allowed: false, ruleId: "path.managed-config" };
 	return { allowed: true };
 }
 function lex(command, powershell = false) {
@@ -628,21 +648,21 @@ function reduceWrappers(input, powershell = false) {
 	}
 	return { tokens };
 }
-function hasSensitiveLiteral(tokens, cwd) {
+function hasSensitiveLiteral(tokens, cwd, projectRoot = PROJECT_ROOT) {
 	return tokens.some((token) => {
 		if ((token.startsWith("-") && !/^-(?:LiteralPath|Path):/i.test(token)) || !/[\\/.~$]/.test(token)) return false;
 		try {
-			return isSensitivePolicyKey(canonicalizePolicyPath(token.replace(/^(?:-LiteralPath:|-Path:)/i, "").replace(/[;,]$/, ""), { base: cwd, projectRoot: PROJECT_ROOT }));
+			return isSensitivePolicyKey(canonicalizePolicyPath(token.replace(/^(?:-LiteralPath:|-Path:)/i, "").replace(/[;,]$/, ""), { base: cwd, projectRoot }));
 		} catch {
 			return false;
 		}
 	});
 }
-function hasManagedLiteral(tokens, cwd) {
+function hasManagedLiteral(tokens, cwd, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT) {
 	return tokens.some((token) => {
 		if ((token.startsWith("-") && !/^-(?:LiteralPath|Path):/i.test(token)) || !/[\\/.]/.test(token)) return false;
 		try {
-			return isManaged(canonicalizePolicyPath(token.replace(/^(?:-LiteralPath:|-Path:)/i, "").replace(/[;,]$/, ""), { base: cwd, projectRoot: PROJECT_ROOT }));
+			return isManaged(canonicalizePolicyPath(token.replace(/^(?:-LiteralPath:|-Path:)/i, "").replace(/[;,]$/, ""), { base: cwd, projectRoot }), config.managedSet, projectRoot);
 		} catch {
 			return false;
 		}
@@ -681,9 +701,9 @@ function bashSubstitutions(command) {
 	}
 	return bodies;
 }
-function evaluateBash(command, cwd, depth = 0) {
+function evaluateBash(command, cwd, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT, depth = 0) {
 	if (depth > 4) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
-	try { for (const body of bashSubstitutions(command)) { const nested = evaluateBash(body, cwd, depth + 1); if (!nested.allowed) return nested; } } catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
+	try { for (const body of bashSubstitutions(command)) { const nested = evaluateBash(body, cwd, config, projectRoot, depth + 1); if (!nested.allowed) return nested; } } catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
 	if (/^\s*:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:\s*$/.test(command)) return { allowed: false, ruleId: "shell.destructive-root" };
 	let parsed;
 	try { parsed = lex(command); } catch { return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; }
@@ -712,20 +732,20 @@ function evaluateBash(command, cwd, depth = 0) {
 				if (decision) return decision;
 			} else if (/^(?:curl|wget)$/.test(executable) && shellSink) return { allowed: false, ruleId: "shell.pipe-to-shell" };
 		}
-		if (["cat", "less", "more", "head", "tail", "bat", "grep", "rg", "sed", "awk", "source", ".", "cp", "install"].includes(executable) && hasSensitiveLiteral(tokens.slice(1), cwd)) return { allowed: false, ruleId: "shell.sensitive-read" };
-		if (tokens.some((token) => token === "<") && hasSensitiveLiteral(tokens, cwd)) return { allowed: false, ruleId: "shell.sensitive-read" };
+		if (["cat", "less", "more", "head", "tail", "bat", "grep", "rg", "sed", "awk", "source", ".", "cp", "install"].includes(executable) && hasSensitiveLiteral(tokens.slice(1), cwd, projectRoot)) return { allowed: false, ruleId: "shell.sensitive-read" };
+		if (tokens.some((token) => token === "<") && hasSensitiveLiteral(tokens, cwd, projectRoot)) return { allowed: false, ruleId: "shell.sensitive-read" };
 		if (executable === "git" && tokens[1]?.toLowerCase() === "push" && tokens.some((token) => ["-f", "--force", "--force-with-lease"].includes(token.toLowerCase()))) return { allowed: false, ruleId: "shell.force-push" };
-		if (["rm", "mv", "cp", "install", "truncate", "touch", "chmod", "chown", "tee"].includes(executable) && hasManagedLiteral(tokens.slice(1), cwd)) return { allowed: false, ruleId: "shell.managed-config-tamper" };
-		if ((/^(?:sed|perl)$/.test(executable) && tokens.some((token) => token.startsWith("-i")) && hasManagedLiteral(tokens, cwd)) || (tokens.includes(">") && hasManagedLiteral(tokens, cwd))) return { allowed: false, ruleId: "shell.managed-config-tamper" };
+		if (["rm", "mv", "cp", "install", "truncate", "touch", "chmod", "chown", "tee"].includes(executable) && hasManagedLiteral(tokens.slice(1), cwd, config, projectRoot)) return { allowed: false, ruleId: "shell.managed-config-tamper" };
+		if ((/^(?:sed|perl)$/.test(executable) && tokens.some((token) => token.startsWith("-i")) && hasManagedLiteral(tokens, cwd, config, projectRoot)) || (tokens.includes(">") && hasManagedLiteral(tokens, cwd, config, projectRoot))) return { allowed: false, ruleId: "shell.managed-config-tamper" };
 		if (/^(?:powershell|pwsh)(?:\.exe)?$/i.test(executable) && tokens.some((token) => /^-(?:enc|encodedcommand)$/i.test(token))) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
 		if (/^(?:bash|sh|zsh|dash|ksh)$/.test(executable)) {
 			const flag = tokens.findIndex((token) => /^-[^-]*c[^-]*$/.test(token));
-			if (flag >= 0) { const body = tokens[flag + 1]; if (!body || /\$(?!\()/.test(body)) return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; const nested = evaluateBash(body, cwd, depth + 1); if (!nested.allowed) return nested; }
+			if (flag >= 0) { const body = tokens[flag + 1]; if (!body || /\$(?!\()/.test(body)) return { allowed: false, ruleId: "shell.obfuscated-interpreter" }; const nested = evaluateBash(body, cwd, config, projectRoot, depth + 1); if (!nested.allowed) return nested; }
 		}
 	}
 	return { allowed: true };
 }
-function evaluatePowerShell(command, cwd) {
+function evaluatePowerShell(command, cwd, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT) {
 	const parsed = lex(command, true);
 	for (let index = 0; index < parsed.commands.length; index++) {
 		const reduced = reduceWrappers(parsed.commands[index], true);
@@ -734,23 +754,69 @@ function evaluatePowerShell(command, cwd) {
 		const executable = (tokens[0] ?? "").toLowerCase();
 		if ((["remove-item", "rm", "del", "erase", "rmdir", "rd"].includes(executable) && tokens.some((token) => /^-(?:r|recurse)$/i.test(token)) && tokens.some((token) => /^-(?:fo|force)$/i.test(token)) && tokens.some((token) => /^(?:[a-z]:\\?|[/~]|\$HOME)$/i.test(token))) || ["format-volume", "clear-disk", "initialize-disk"].includes(executable)) return { allowed: false, ruleId: "powershell.destructive-root" };
 		if (parsed.separators[index] === "|" && /^(?:invoke-webrequest|iwr|curl|wget|invoke-restmethod|irm)$/.test(executable) && /^(?:invoke-expression|iex)$/.test(((reduceWrappers(parsed.commands[index + 1] ?? [], true).tokens ?? [])[0] ?? "").toLowerCase())) return { allowed: false, ruleId: "powershell.pipe-to-shell" };
-		if (["get-content", "gc", "cat", "type", "select-string", "copy-item", "cp", "copy"].includes(executable) && hasSensitiveLiteral(tokens.slice(1), cwd)) return { allowed: false, ruleId: "powershell.sensitive-read" };
+		if (["get-content", "gc", "cat", "type", "select-string", "copy-item", "cp", "copy"].includes(executable) && hasSensitiveLiteral(tokens.slice(1), cwd, projectRoot)) return { allowed: false, ruleId: "powershell.sensitive-read" };
 		if (executable === "git" && tokens[1]?.toLowerCase() === "push" && tokens.some((token) => ["-f", "--force", "--force-with-lease"].includes(token.toLowerCase()))) return { allowed: false, ruleId: "powershell.force-push" };
-		if (["set-content", "add-content", "out-file", "clear-content", "remove-item", "move-item", "copy-item", "rename-item", "new-item"].includes(executable) && hasManagedLiteral(tokens.slice(1), cwd)) return { allowed: false, ruleId: "powershell.managed-config-tamper" };
-		if (tokens.includes(">") && hasManagedLiteral(tokens, cwd)) return { allowed: false, ruleId: "powershell.managed-config-tamper" };
+		if (["set-content", "add-content", "out-file", "clear-content", "remove-item", "move-item", "copy-item", "rename-item", "new-item"].includes(executable) && hasManagedLiteral(tokens.slice(1), cwd, config, projectRoot)) return { allowed: false, ruleId: "powershell.managed-config-tamper" };
+		if (tokens.includes(">") && hasManagedLiteral(tokens, cwd, config, projectRoot)) return { allowed: false, ruleId: "powershell.managed-config-tamper" };
 		if (/^(?:powershell|pwsh)(?:\.exe)?$/i.test(executable) && tokens.some((token) => /^-(?:enc|encodedcommand)$/i.test(token))) return { allowed: false, ruleId: "powershell.obfuscated-interpreter" };
 	}
 	return { allowed: true };
 }
-export function evaluateEvent(input) {
-	if (!isObject(input) || input.hook_event_name !== "PreToolUse" || !SUPPORTED_TOOLS.includes(input.tool_name) || !isObject(input.tool_input)) fail("invalid-event");
+// Codex file-write shim (S1, security-critical): Codex delivers file writes as
+// tool_name:"apply_patch" with the target path(s) inside the tool_input.command patch
+// text and NO file_path field, so evaluateFile's managed-config protection cannot fire
+// without first parsing the header paths out of the patch. This is a WRITE-class surface:
+// a parse miss = a managed-config file-write bypass, so every unresolved shape fails
+// closed (throw -> main() catch -> denyAndExit, exit 2). Grammar VERIFIED against a REAL
+// captured codex-cli 0.147.0 envelope (2026-08-18): first line is `*** Begin Patch`,
+// closed by `*** End Patch`, with `*** Add File:` / `*** Update File:` / `*** Delete File:`
+// headers AND `*** Move to:` for a rename target -- the last one CONFIRMED emitted (a
+// rename can retarget a benign source onto a managed path, so its destination is checked too).
+export function parseApplyPatchPaths(command) {
+	if (typeof command !== "string" || command.includes("\0")) fail("invalid-event");
+	const lines = command.split(/\r?\n/);
+	if ((lines[0] ?? "").trim() !== "*** Begin Patch") fail("invalid-event"); // header-less patch -> cannot prove safe
+	let seenEnd = false;
+	const paths = [];
+	for (let index = 1; index < lines.length; index++) {
+		const line = lines[index];
+		if (line.trim() === "*** End Patch") { seenEnd = true; break; }
+		const file = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(line);
+		if (file) { paths.push(file[1].trim()); continue; }
+		const move = /^\*\*\* Move to: (.+)$/.exec(line); // rename target (verified present)
+		if (move) { paths.push(move[1].trim()); continue; }
+		// body lines (+/-/space/@@/index) carry no header path and are ignored
+	}
+	if (!seenEnd) fail("invalid-event");             // truncated patch could hide a managed write
+	if (paths.length === 0) fail("invalid-event");   // zero extractable paths -> fail closed
+	for (const target of paths) if (target.length === 0 || target.includes("\0")) fail("invalid-event");
+	return paths;
+}
+export function evaluateEvent(input, config = AGENT_CONFIGS.claude) {
+	if (!isObject(input) || input.hook_event_name !== "PreToolUse" || !isObject(input.tool_input)) fail("invalid-event");
+	const applyPatch = input.tool_name === "apply_patch";
+	if (!applyPatch && !SUPPORTED_TOOLS.includes(input.tool_name)) fail("invalid-event");
+	const cwd = typeof input.cwd === "string" && isAbsolutePolicyPath(input.cwd) ? input.cwd : PROJECT_ROOT;
+	const projectRoot = resolveProjectRoot(config, cwd);
+	if (applyPatch) {
+		if (typeof input.tool_input.command !== "string") fail("invalid-event");
+		// apply_patch is a WRITE tool (not "Read"), so the managed-config rule fires. Each header
+		// path is made absolute LEXICALLY (no realpath) vs the envelope cwd and handed to evaluateFile
+		// exactly like Write/Edit's raw file_path, so policyPathKeys owns the dual lexical+realpath
+		// canonicalization. Realpath-ing here first would collapse a symlinked managed dir onto its
+		// target and drop the protective lexical key -> managed-config write bypass.
+		for (const target of parseApplyPatchPaths(input.tool_input.command)) {
+			const decision = evaluateFile("apply_patch", lexicalizePolicyPath(target, { base: cwd, projectRoot }), config, projectRoot);
+			if (!decision.allowed) return decision;
+		}
+		return { allowed: true };
+	}
 	if (input.tool_name === "Bash" || input.tool_name === "PowerShell") {
 		if (typeof input.tool_input.command !== "string") fail("invalid-event");
-		const cwd = typeof input.cwd === "string" && isAbsolutePolicyPath(input.cwd) ? input.cwd : PROJECT_ROOT;
-		return input.tool_name === "Bash" ? evaluateBash(input.tool_input.command, cwd) : evaluatePowerShell(input.tool_input.command, cwd);
+		return input.tool_name === "Bash" ? evaluateBash(input.tool_input.command, cwd, config, projectRoot) : evaluatePowerShell(input.tool_input.command, cwd, config, projectRoot);
 	}
 	if (typeof input.tool_input.file_path !== "string" || !isAbsolutePolicyPath(input.tool_input.file_path)) fail("invalid-event");
-	return evaluateFile(input.tool_name, input.tool_input.file_path);
+	return evaluateFile(input.tool_name, input.tool_input.file_path, config, projectRoot);
 }
 export function parseAndEvaluateInput(input) {
 	if (!Buffer.isBuffer(input) || input.length === 0) fail("invalid-json");
@@ -769,6 +835,7 @@ function diagnostic(error) {
 	const messages = {
 		"invalid-json": "input is not a valid JSON object",
 		"invalid-event": "input does not match the supported event schema",
+		"invalid-config": "missing or unknown --agent selector (expected --agent=<id>)",
 		"oversized-input": "stdin exceeds 1048576 bytes",
 		"missing-policy": "embedded policy registry is unavailable",
 		"internal-error": "policy evaluation could not complete",
@@ -830,6 +897,7 @@ export function readBoundedStdin(stream = process.stdin) {
 }
 export async function main() {
 	try {
+		const config = resolveAgentConfig(process.argv);
 		const fault = process.argv.find((arg) => arg.startsWith("--javi-forge-test-fault="))?.split("=")[1];
 		if (fault === "missing-policy") throw new Error("missing-policy");
 		if (POLICY_REGISTRY.schemaVersion !== 1 || POLICY_REGISTRY.policyVersion !== 1) throw new Error("missing-policy");
@@ -841,7 +909,7 @@ export async function main() {
 			throw new Error("invalid-json");
 		}
 		if (fault === "evaluator-throw") throw new Error("internal-error");
-		const decision = evaluateEvent(parsed);
+		const decision = evaluateEvent(parsed, config);
 		if (!decision.allowed) denyAndExit(denialDiagnostic(parsed.tool_name, decision));
 		process.exitCode = 0;
 	} catch (error) {

package/assets/claude-hooks/manifest.json

@@ -1 +1 @@
-{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"5dc2a5c31131f4ac7d8657c78b950de52776aad6eaefe78ea0d764a9963c4425","historical":["78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc"]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}
+{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"9a565cec31d9e091e3fb9420b86685f824733bc1ebe479f086b2b955aba6ef3e","historical":["78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc","5dc2a5c31131f4ac7d8657c78b950de52776aad6eaefe78ea0d764a9963c4425","0c9aa8fa26b389f4892782f83104f0792c2b71ebca39c18c02706e2185e22b40","3581862f0567cce75a58b693c9ade80d39ee7d58add11537a34a8461c47c1ed4","54a270f28b068450b79547a88ec6f2d4854514392fd5f38ed1d6174ea093d7aa"]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"b1341803cd076091edfcb473494514df1a23bd33372374ca1de6b75258e52e06"},"historical":[{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"}]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}

package/dist/cli/dispatch/hooks.d.ts

@@ -6,9 +6,16 @@
  *
  * Subcommands:
  *   - `hooks run <pre-commit|pre-push>` → runHook, exits with its code.
- *   - `hooks <install|doctor|repair> claude [--force]` → runClaudeHookCommand,
- *     exits with its code (wrong/missing target → usage + exit 1).
+ *   - `hooks <install|doctor|repair> <claude|codex> [--force]` → the matching
+ *     agent command, exits with its code (unknown/missing agent → usage + exit 1).
  * Any other subcommand or a missing name → usage + exit 1.
+ *
+ * The valid agent target set is decided by `isAgentId` (backed by the
+ * `AGENT_ADAPTERS` registry — the single source of agent truth). Each id maps to
+ * a lazy loader for its console command runner; the map is typed
+ * `Record<AgentId, …>`, so a new registry agent cannot be silently dropped
+ * (omitting its loader is a compile error). Lazy imports keep cold-start minimal
+ * on the commit/push hot path.
  */
 import type { CLI } from "./types.js";
 export declare function handleHooks(cli: CLI): Promise<void>;

package/dist/cli/dispatch/hooks.js

@@ -6,11 +6,24 @@
  *
  * Subcommands:
  *   - `hooks run <pre-commit|pre-push>` → runHook, exits with its code.
- *   - `hooks <install|doctor|repair> claude [--force]` → runClaudeHookCommand,
- *     exits with its code (wrong/missing target → usage + exit 1).
+ *   - `hooks <install|doctor|repair> <claude|codex> [--force]` → the matching
+ *     agent command, exits with its code (unknown/missing agent → usage + exit 1).
  * Any other subcommand or a missing name → usage + exit 1.
+ *
+ * The valid agent target set is decided by `isAgentId` (backed by the
+ * `AGENT_ADAPTERS` registry — the single source of agent truth). Each id maps to
+ * a lazy loader for its console command runner; the map is typed
+ * `Record<AgentId, …>`, so a new registry agent cannot be silently dropped
+ * (omitting its loader is a compile error). Lazy imports keep cold-start minimal
+ * on the commit/push hot path.
  */
+import { isAgentId } from "../../lib/agent-adapter.js";
 import { HOOKS_HELP_TEXT } from "../help.js";
+/** Agent registry: id → lazy loader for its console command runner. */
+const AGENT_COMMAND_LOADERS = {
+    claude: async () => (await import("../../commands/claude-hooks.js")).runClaudeHookCommand,
+    codex: async () => (await import("../../commands/codex-hooks.js")).runCodexHookCommand,
+};
 export async function handleHooks(cli) {
     if (cli.flags.help === true) {
         console.log(HOOKS_HELP_TEXT);
@@ -28,14 +41,15 @@ export async function handleHooks(cli) {
     }
     const sub = cli.input[1];
     if (sub === "install" || sub === "doctor" || sub === "repair") {
-        if (cli.input[2] !== "claude") {
-            console.error(`Usage: javi-forge hooks ${sub} claude`);
+        const agent = cli.input[2];
+        // Validity is decided by the agent registry (isAgentId), the single source
+        // of truth; the loader map is exhaustive over AgentId by type.
+        if (!isAgentId(agent)) {
+            console.error(`Usage: javi-forge hooks ${sub} <claude|codex>`);
             process.exit(1);
         }
-        const { runClaudeHookCommand } = await import("../../commands/claude-hooks.js");
-        process.exit(await runClaudeHookCommand(sub, process.cwd(), {
-            force: cli.flags.force === true,
-        }));
+        const run = await AGENT_COMMAND_LOADERS[agent]();
+        process.exit(await run(sub, process.cwd(), { force: cli.flags.force === true }));
     }
     // No subcommand → show usage (exit 0). An unknown subcommand is a typo →
     // show usage but exit 1 rather than run nothing silently.

package/dist/commands/codex-hooks.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `javi-forge hooks <install|doctor|repair> codex` — console-only renderer for
+ * the Codex PreToolUse guard library (agent-agnostic slice 2). It wires the
+ * install/doctor/repair lib fns to human output + exit codes; it adds NO new
+ * security logic and never touches `runTransaction`/secure-fs directly.
+ *
+ * Doctor exit code follows the effective-execution verdict (runnable → 0,
+ * blocked → 1, inconclusive → 2), independent of any component health — the same
+ * honest-execution contract as the Claude renderer. The UNTRUSTED state is a
+ * `blocked` verdict (an untrusted Codex hook is silently skipped), so a fresh
+ * install correctly reports blocked until the user grants trust.
+ */
+import { doctorCodexPreToolUse, installCodexPreToolUse, repairCodexPreToolUse } from "../lib/codex-hook-manager.js";
+export type CodexHookSub = "install" | "doctor" | "repair";
+export interface CodexHookCmdDeps {
+    install?: typeof installCodexPreToolUse;
+    doctor?: typeof doctorCodexPreToolUse;
+    repair?: typeof repairCodexPreToolUse;
+    homeDir?: string;
+    log?: (msg: string) => void;
+    logError?: (msg: string) => void;
+}
+export declare function runCodexHookCommand(sub: CodexHookSub, _cwd: string, opts: {
+    force?: boolean;
+}, deps?: CodexHookCmdDeps): Promise<number>;
+//# sourceMappingURL=codex-hooks.d.ts.map

package/dist/commands/codex-hooks.js

@@ -0,0 +1,104 @@
+/**
+ * `javi-forge hooks <install|doctor|repair> codex` — console-only renderer for
+ * the Codex PreToolUse guard library (agent-agnostic slice 2). It wires the
+ * install/doctor/repair lib fns to human output + exit codes; it adds NO new
+ * security logic and never touches `runTransaction`/secure-fs directly.
+ *
+ * Doctor exit code follows the effective-execution verdict (runnable → 0,
+ * blocked → 1, inconclusive → 2), independent of any component health — the same
+ * honest-execution contract as the Claude renderer. The UNTRUSTED state is a
+ * `blocked` verdict (an untrusted Codex hook is silently skipped), so a fresh
+ * install correctly reports blocked until the user grants trust.
+ */
+import { doctorCodexPreToolUse, installCodexPreToolUse, repairCodexPreToolUse, } from "../lib/codex-hook-manager.js";
+function renderWarnings(warnings, log) {
+    if (warnings.length === 0)
+        return;
+    log("warnings:");
+    for (const w of warnings)
+        log(`  ${w}`);
+}
+function renderMutation(verb, result, log, logError) {
+    if (result.ok) {
+        log(`${verb} codex: ok`);
+        if (result.changed.length > 0) {
+            log("changed:");
+            for (const p of result.changed)
+                log(`  ${p}`);
+        }
+        else {
+            log("changed: nothing (already up to date)");
+        }
+        log(`trust: ${result.report.trust.state}`);
+        if (result.report.trust.state === "untrusted") {
+            log(`  → ${result.report.trust.grantCommand}`);
+        }
+        renderWarnings(result.warnings, log);
+        return 0;
+    }
+    logError(`${verb} codex: refused`);
+    for (const e of result.errors)
+        logError(`  ${e}`);
+    renderWarnings(result.warnings, log);
+    return 1;
+}
+function renderDoctor(report, log) {
+    log(`doctor codex: ${report.healthy ? "healthy" : "unhealthy"}`);
+    log(`  hooks.json: ${report.hooksJson.state}`);
+    log(`  config:    [features] hooks=${report.config.featuresHooks} (readable: ${report.config.readable})`);
+    log(`  trust:     ${report.trust.state}`);
+    log(`  asset:     ${report.asset.state}`);
+    log(`  node:      ${report.node.version ?? "unavailable"} (min-satisfied: ${report.node.satisfiesMinimum})`);
+    const onPath = report.nodeOnPath;
+    const onPathDetail = onPath.status === "resolved"
+        ? ` ${onPath.version}`
+        : onPath.status === "unknown"
+            ? ` — ${onPath.detail}`
+            : "";
+    log(`  node-on-PATH: ${onPath.status}${onPathDetail} (heuristic: this process' PATH)`);
+    log(`  execution: ${report.execution.status}`);
+    if (report.execution.blockers.length > 0) {
+        log("  blockers:");
+        for (const b of report.execution.blockers)
+            log(`    - ${b}`);
+    }
+    if (report.execution.unknownSources.length > 0) {
+        log("  unknown-sources:");
+        for (const u of report.execution.unknownSources)
+            log(`    - ${u}`);
+    }
+    if (report.execution.residual.length > 0) {
+        log("  execution-residual:");
+        for (const r of report.execution.residual)
+            log(`    - ${r}`);
+    }
+    if (report.remediation.length > 0) {
+        log("  remediation:");
+        for (const r of report.remediation)
+            log(`    - ${r}`);
+    }
+    if (report.execution.status === "blocked")
+        return 1;
+    if (report.execution.status === "inconclusive")
+        return 2;
+    return 0;
+}
+export async function runCodexHookCommand(sub, _cwd, opts, deps = {}) {
+    const log = deps.log ?? ((m) => console.log(m));
+    const logError = deps.logError ?? ((m) => console.error(m));
+    const install = deps.install ?? installCodexPreToolUse;
+    const doctor = deps.doctor ?? doctorCodexPreToolUse;
+    const repair = deps.repair ?? repairCodexPreToolUse;
+    // Codex config is user-global (~/.codex). `cwd` is accepted for CLI symmetry
+    // with the Claude command; the home dir is what the manager operates on.
+    const home = deps.homeDir;
+    if (sub === "install") {
+        return renderMutation("install", await install(home), log, logError);
+    }
+    if (sub === "repair") {
+        const result = await repair(home, { force: opts.force === true });
+        return renderMutation("repair", result, log, logError);
+    }
+    return renderDoctor(await doctor(home), log);
+}
+//# sourceMappingURL=codex-hooks.js.map

package/dist/lib/__fixtures__/claude-hook-ownership.d.ts

@@ -24,6 +24,12 @@ export declare const LEGACY_FILE_SHA256 = "b4638222ecddc2daac6ec3339596d853a6269
 export declare const MANAGED_MATCHER = "Bash|PowerShell|Read|Write|Edit";
 /** Single project-local MJS argument, kept as a literal placeholder path. */
 export declare const MANAGED_ASSET_ARG = "${CLAUDE_PROJECT_DIR}/.claude/hooks/javi-forge-skillguard-pre-tool-use.mjs";
+/**
+ * The agent selector the install writer appends after the asset path. The runtime
+ * fails closed without it (no agent config = cannot know what to protect), so it is
+ * part of the managed command shape and the canonical settings identity.
+ */
+export declare const MANAGED_AGENT_ARG = "--agent=claude";
 /** Exact asset filename under `.claude/hooks/`. */
 export declare const ASSET_NAME = "javi-forge-skillguard-pre-tool-use.mjs";
 /** Exact first-line comment marking the managed asset. */

package/dist/lib/__fixtures__/claude-hook-ownership.js

@@ -25,6 +25,12 @@ export const LEGACY_FILE_SHA256 = "b4638222ecddc2daac6ec3339596d853a626906bbd123
 export const MANAGED_MATCHER = "Bash|PowerShell|Read|Write|Edit";
 /** Single project-local MJS argument, kept as a literal placeholder path. */
 export const MANAGED_ASSET_ARG = "${CLAUDE_PROJECT_DIR}/.claude/hooks/javi-forge-skillguard-pre-tool-use.mjs";
+/**
+ * The agent selector the install writer appends after the asset path. The runtime
+ * fails closed without it (no agent config = cannot know what to protect), so it is
+ * part of the managed command shape and the canonical settings identity.
+ */
+export const MANAGED_AGENT_ARG = "--agent=claude";
 /** Exact asset filename under `.claude/hooks/`. */
 export const ASSET_NAME = "javi-forge-skillguard-pre-tool-use.mjs";
 /** Exact first-line comment marking the managed asset. */
@@ -44,7 +50,7 @@ export function managedHandler(assetSha = SAMPLE_ASSET_SHA256) {
     return {
         type: "command",
         command: "node",
-        args: [MANAGED_ASSET_ARG],
+        args: [MANAGED_ASSET_ARG, MANAGED_AGENT_ARG],
         timeout: 30,
         statusMessage: managedStatusMessage(assetSha),
     };

package/dist/lib/agent-adapter.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Agent adapter registry (agent-agnostic slice 2). One descriptor per host
+ * (`claude`, `codex`) capturing the per-agent facts the SkillGuard installer and
+ * doctor need: config paths, the protected managed set, the project-root source,
+ * the settings-schema validator (SHARED — both hosts use the identical hooks
+ * schema), the managed marker, the deny protocol, and the trust model.
+ *
+ * This descriptor is additive: Codex is routed through it, while Claude keeps its
+ * existing, byte-identical runtime path (the descriptor only DESCRIBES Claude; it
+ * does not change how the Claude command executes). The CLI dispatch decides the
+ * valid `hooks <sub> <agent>` target set through `isAgentId` (backed by the
+ * `AGENT_ADAPTERS` keys) — this registry is the single source of agent truth, and
+ * a new agent added here cannot be silently dropped: the dispatch's command-loader
+ * map is typed `Record<AgentId, …>`, so omitting a loader is a compile error.
+ */
+import { validateSettingsShape } from "./claude-hook-settings.js";
+export type AgentId = "claude" | "codex";
+export type TrustState = "trusted" | "untrusted" | "unknown";
+export interface TrustDescriptor {
+    /** Detect whether the installed hook is TRUSTED from the host config text. */
+    detect(configText: string, hooksFile: string): TrustState;
+    /** The exact step a human runs to grant trust (no non-interactive path exists). */
+    grantCommand(hooksFile: string): string;
+}
+export interface AgentAdapter {
+    id: AgentId;
+    /** Resolve the two host config files from a base dir (project root or home). */
+    configPaths(baseDir: string): {
+        hooksFile: string;
+        settingsFile: string;
+    };
+    /** Relative protected paths the guard refuses writes to (from AGENT_CONFIGS). */
+    managedSet: readonly string[];
+    /** Project-root source: an env var, or null → the envelope `cwd` (Codex). */
+    projectDir: {
+        envVar: string | null;
+    };
+    /** SHARED settings-schema validator — the hooks container shape is identical. */
+    settingsSchema: typeof validateSettingsShape;
+    /** The managed asset marker for this host. */
+    marker: string;
+    /** Deny protocol emitted by the shared `.mjs` — the same on both hosts. */
+    emitDeny: "exit2+stderr";
+    /** Hook-trust model, or null when the host has none (Claude). */
+    trust: TrustDescriptor | null;
+}
+export declare const claudeAdapter: AgentAdapter;
+export declare const codexAdapter: AgentAdapter;
+export declare const AGENT_ADAPTERS: Record<AgentId, AgentAdapter>;
+/**
+ * Whether a raw CLI token names a known agent adapter. Backed by the
+ * `AGENT_ADAPTERS` registry so there is ONE source deciding valid targets: adding
+ * an adapter to the registry automatically widens the accepted CLI set.
+ */
+export declare function isAgentId(value: unknown): value is AgentId;
+//# sourceMappingURL=agent-adapter.d.ts.map

package/dist/lib/agent-adapter.js

@@ -0,0 +1,88 @@
+/**
+ * Agent adapter registry (agent-agnostic slice 2). One descriptor per host
+ * (`claude`, `codex`) capturing the per-agent facts the SkillGuard installer and
+ * doctor need: config paths, the protected managed set, the project-root source,
+ * the settings-schema validator (SHARED — both hosts use the identical hooks
+ * schema), the managed marker, the deny protocol, and the trust model.
+ *
+ * This descriptor is additive: Codex is routed through it, while Claude keeps its
+ * existing, byte-identical runtime path (the descriptor only DESCRIBES Claude; it
+ * does not change how the Claude command executes). The CLI dispatch decides the
+ * valid `hooks <sub> <agent>` target set through `isAgentId` (backed by the
+ * `AGENT_ADAPTERS` keys) — this registry is the single source of agent truth, and
+ * a new agent added here cannot be silently dropped: the dispatch's command-loader
+ * map is typed `Record<AgentId, …>`, so omitting a loader is a compile error.
+ */
+import path from "node:path";
+import { ASSET_NAME } from "./__fixtures__/claude-hook-ownership.js";
+import { validateSettingsShape } from "./claude-hook-settings.js";
+import { codexConfigPaths, codexTrustGrantCommand, hasCodexTrustEntry, } from "./codex-hook-manager.js";
+const CLAUDE_MANAGED_SET = [
+    ".claude/settings.json",
+    ".claude/settings.local.json",
+    ".claude/CLAUDE.md",
+    "CLAUDE.md",
+    ".javi-forge/ci.yaml",
+    ".claude/hooks/",
+    ".claude/agents/",
+    ".claude/skills/",
+];
+const CODEX_MANAGED_SET = [
+    ".codex/hooks.json",
+    ".claude/settings.json",
+    ".claude/settings.local.json",
+    ".claude/CLAUDE.md",
+    "CLAUDE.md",
+    ".javi-forge/ci.yaml",
+    ".claude/hooks/",
+    ".claude/agents/",
+    ".claude/skills/",
+];
+export const claudeAdapter = {
+    id: "claude",
+    configPaths(projectDir) {
+        return {
+            hooksFile: path.join(projectDir, ".claude", "hooks", ASSET_NAME),
+            settingsFile: path.join(projectDir, ".claude", "settings.json"),
+        };
+    },
+    managedSet: CLAUDE_MANAGED_SET,
+    projectDir: { envVar: "CLAUDE_PROJECT_DIR" },
+    settingsSchema: validateSettingsShape,
+    marker: "// javi-forge-managed: claude-pretooluse v1",
+    emitDeny: "exit2+stderr",
+    trust: null,
+};
+export const codexAdapter = {
+    id: "codex",
+    configPaths(homeDir) {
+        const paths = codexConfigPaths(homeDir);
+        return { hooksFile: paths.hooksFile, settingsFile: paths.configFile };
+    },
+    managedSet: CODEX_MANAGED_SET,
+    projectDir: { envVar: null },
+    settingsSchema: validateSettingsShape,
+    marker: "// javi-forge-managed: codex-pretooluse v1",
+    emitDeny: "exit2+stderr",
+    trust: {
+        detect(configText, hooksFile) {
+            return hasCodexTrustEntry(configText, hooksFile)
+                ? "trusted"
+                : "untrusted";
+        },
+        grantCommand: codexTrustGrantCommand,
+    },
+};
+export const AGENT_ADAPTERS = {
+    claude: claudeAdapter,
+    codex: codexAdapter,
+};
+/**
+ * Whether a raw CLI token names a known agent adapter. Backed by the
+ * `AGENT_ADAPTERS` registry so there is ONE source deciding valid targets: adding
+ * an adapter to the registry automatically widens the accepted CLI set.
+ */
+export function isAgentId(value) {
+    return typeof value === "string" && Object.hasOwn(AGENT_ADAPTERS, value);
+}
+//# sourceMappingURL=agent-adapter.js.map