mewkit 1.13.0 → 1.14.1

package/dist/migrate/hooks/codex-hook-wrapper.d.ts

@@ -2,9 +2,23 @@ import type { CodexCapabilities } from "../codex-capabilities.js";
 export interface WrapperGenerateResult {
     wrapperPath: string;
     originalPath: string;
+    /** Handler runtime type this wrapper was generated for. */
+    handlerType: "js" | "sh";
+    /** For sh handlers: the copied script under the wrapper tree (self-contained). */
+    copiedScriptPath?: string;
     success: boolean;
     error?: string;
 }
-export declare function generateCodexHookWrappers(originalPaths: string[], wrapperDir: string, capabilities: CodexCapabilities, timeoutsByPath?: Record<string, number>): WrapperGenerateResult[];
+/** Per-original wrapper generation input. */
+export interface WrapperGenerateInput {
+    originalPath: string;
+    handlerType: "js" | "sh";
+}
+/**
+ * Generate one wrapper per handler. Accepts either the legacy string[] form
+ * (all treated as `js`) or the richer WrapperGenerateInput[] form that carries
+ * each handler's runtime type so `.sh` handlers get the copy-script + sh wrapper.
+ */
+export declare function generateCodexHookWrappers(originals: string[] | WrapperGenerateInput[], wrapperDir: string, capabilities: CodexCapabilities, timeoutsByPath?: Record<string, number>): WrapperGenerateResult[];
 export declare function buildWrapperScript(originalPath: string, capabilities: CodexCapabilities, hookTimeoutMs?: number): string;
 //# sourceMappingURL=codex-hook-wrapper.d.ts.map

package/dist/migrate/hooks/codex-hook-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-wrapper.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-hook-wrapper.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,MAAM,WAAW,qBAAqB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,yBAAyB,CACxC,aAAa,EAAE,MAAM,EAAE,EACvB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,iBAAiB,EAC/B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,qBAAqB,EAAE,CAoCzB;AAOD,wBAAgB,kBAAkB,CACjC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,iBAAiB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,MAAM,CA0HR"}
+{"version":3,"file":"codex-hook-wrapper.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-hook-wrapper.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,MAAM,WAAW,qBAAqB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAiCD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,SAAS,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,EAC5C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,iBAAiB,EAC/B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,qBAAqB,EAAE,CAgEzB;AAgBD,wBAAgB,kBAAkB,CACjC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,iBAAiB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,MAAM,CA0HR"}

package/dist/migrate/hooks/codex-hook-wrapper.js

@@ -1,26 +1,61 @@
 // Vendored from claudekit-cli (MIT). Source: src/commands/portable/codex-hook-wrapper.ts
 // Generates per-hook .cjs wrapper that scrubs Claude-only fields from hook stdout
 // before re-emitting to Codex stdout. Wrapper is self-contained — no mewkit imports at runtime.
+//
+// `.sh` handlers additionally get their script COPIED under the wrapper tree
+// (`scripts/`) so the migrated hook has no dependency on the source `.claude/`
+// tree remaining in place (self-contained migration). See codex-sh-wrapper-script.ts.
 import { createHash } from "node:crypto";
-import { mkdirSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { chmodSync, copyFileSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join, resolve } from "node:path";
+import { buildShWrapperScript } from "./codex-sh-wrapper-script.js";
 import { isPathWithinBoundary } from "./codex-path-safety.js";
 function wrapperFilename(originalPath) {
     const abs = resolve(originalPath);
     const hash = createHash("sha256").update(abs).digest("hex").slice(0, 8);
     const base = abs.split(/[\\/]/).pop() ?? "hook.cjs";
+    // Shell handlers get a .cjs wrapper filename (the node wrapper), not .sh.
+    if (extname(base).toLowerCase() === ".sh") {
+        return `${hash}-${base.slice(0, -3)}.cjs`;
+    }
     return `${hash}-${base}`;
 }
-export function generateCodexHookWrappers(originalPaths, wrapperDir, capabilities, timeoutsByPath) {
+function copiedScriptFilename(originalPath) {
+    const abs = resolve(originalPath);
+    const hash = createHash("sha256").update(abs).digest("hex").slice(0, 8);
+    return `${hash}-${basename(abs)}`;
+}
+/** Build the delete/permission scrub rules table shared by js + sh wrappers. */
+function buildScrubRules(capabilities) {
+    const scrubRules = {};
+    for (const [event, caps] of Object.entries(capabilities.events)) {
+        const deleteFields = [];
+        if (!caps.supportsAdditionalContext)
+            deleteFields.push("additionalContext");
+        const allowedPermissionValues = caps.permissionDecisionValues ?? null;
+        if (deleteFields.length > 0 || allowedPermissionValues !== null) {
+            scrubRules[event] = { deleteFields, allowedPermissionValues };
+        }
+    }
+    return scrubRules;
+}
+/**
+ * Generate one wrapper per handler. Accepts either the legacy string[] form
+ * (all treated as `js`) or the richer WrapperGenerateInput[] form that carries
+ * each handler's runtime type so `.sh` handlers get the copy-script + sh wrapper.
+ */
+export function generateCodexHookWrappers(originals, wrapperDir, capabilities, timeoutsByPath) {
     const results = [];
     const resolvedWrapperDir = resolve(wrapperDir);
-    for (const originalPath of originalPaths) {
+    const inputs = normalizeInputs(originals);
+    for (const { originalPath, handlerType } of inputs) {
         const filename = wrapperFilename(originalPath);
         const wrapperPath = join(resolvedWrapperDir, filename);
         if (!isPathWithinBoundary(wrapperPath, resolvedWrapperDir)) {
             results.push({
                 wrapperPath,
                 originalPath,
+                handlerType,
                 success: false,
                 error: `Unsafe wrapper path: ${wrapperPath} escapes ${resolvedWrapperDir}`,
             });
@@ -30,14 +65,42 @@ export function generateCodexHookWrappers(originalPaths, wrapperDir, capabilitie
             mkdirSync(dirname(wrapperPath), { recursive: true });
             const resolvedPath = resolve(originalPath);
             const hookTimeoutMs = timeoutsByPath?.[resolvedPath] ?? timeoutsByPath?.[originalPath];
-            const content = buildWrapperScript(originalPath, capabilities, hookTimeoutMs);
-            writeFileSync(wrapperPath, content, { mode: 0o755 });
-            results.push({ wrapperPath, originalPath, success: true });
+            if (handlerType === "sh") {
+                const scriptsDir = join(resolvedWrapperDir, "scripts");
+                const copiedScriptPath = join(scriptsDir, copiedScriptFilename(originalPath));
+                if (!isPathWithinBoundary(copiedScriptPath, resolvedWrapperDir)) {
+                    throw new Error(`Unsafe copied-script path: ${copiedScriptPath} escapes ${resolvedWrapperDir}`);
+                }
+                mkdirSync(scriptsDir, { recursive: true });
+                copyFileSync(resolvedPath, copiedScriptPath);
+                try {
+                    // Preserve the original script's executable bits where present.
+                    const mode = statSync(resolvedPath).mode & 0o777;
+                    if (mode & 0o100)
+                        chmodSync(copiedScriptPath, mode);
+                }
+                catch {
+                    /* best-effort mode copy */
+                }
+                const content = buildShWrapperScript(originalPath, {
+                    copiedScriptPath,
+                    scrubRulesJson: JSON.stringify(buildScrubRules(capabilities)),
+                    timeoutMs: hookTimeoutMs ?? 30000,
+                });
+                writeFileSync(wrapperPath, content, { mode: 0o755 });
+                results.push({ wrapperPath, originalPath, handlerType, copiedScriptPath, success: true });
+            }
+            else {
+                const content = buildWrapperScript(originalPath, capabilities, hookTimeoutMs);
+                writeFileSync(wrapperPath, content, { mode: 0o755 });
+                results.push({ wrapperPath, originalPath, handlerType, success: true });
+            }
         }
         catch (err) {
             results.push({
                 wrapperPath,
                 originalPath,
+                handlerType,
                 success: false,
                 error: err instanceof Error ? err.message : String(err),
             });
@@ -45,6 +108,14 @@ export function generateCodexHookWrappers(originalPaths, wrapperDir, capabilitie
     }
     return results;
 }
+function normalizeInputs(originals) {
+    return originals.map((entry) => {
+        if (typeof entry === "string") {
+            return { originalPath: entry, handlerType: extname(entry).toLowerCase() === ".sh" ? "sh" : "js" };
+        }
+        return entry;
+    });
+}
 export function buildWrapperScript(originalPath, capabilities, hookTimeoutMs) {
     const scrubRules = {};
     for (const [event, caps] of Object.entries(capabilities.events)) {
@@ -60,7 +131,7 @@ export function buildWrapperScript(originalPath, capabilities, hookTimeoutMs) {
     const scrubRulesJson = JSON.stringify(scrubRules);
     const effectiveTimeout = hookTimeoutMs ?? 30000;
     return `#!/usr/bin/env node
-// AUTO-GENERATED by mewkit migrate — DO NOT EDIT
+// AUTO-GENERATED by the migration tooling — DO NOT EDIT
 // Codex hook compatibility wrapper for:
 //   ${originalPath}
 "use strict";

package/dist/migrate/hooks/codex-hook-wrapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hook-wrapper.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-hook-wrapper.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,kFAAkF;AAClF,gGAAgG;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,SAAS,eAAe,CAAC,YAAoB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IACpD,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,aAAuB,EACvB,UAAkB,EAClB,YAA+B,EAC/B,cAAuC;IAEvC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAEvD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACZ,WAAW;gBACX,YAAY;gBACZ,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB,WAAW,YAAY,kBAAkB,EAAE;aAC1E,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,IAAI,CAAC;YACJ,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC,YAAY,CAAC,IAAI,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC;YACvF,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;YAC9E,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC;gBACZ,WAAW;gBACX,YAAY;gBACZ,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAOD,MAAM,UAAU,kBAAkB,CACjC,YAAoB,EACpB,YAA+B,EAC/B,aAAsB;IAEtB,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAAE,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,uBAAuB,GAAG,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;QACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACjE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,uBAAuB,EAAE,CAAC;QAC/D,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,aAAa,IAAI,KAAK,CAAC;IAEhD,OAAO;;;OAGD,YAAY;;;;;wBAKK,mBAAmB;sBACrB,cAAc;0BACV,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgGzC,CAAC;AACF,CAAC"}
+{"version":3,"file":"codex-hook-wrapper.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-hook-wrapper.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,kFAAkF;AAClF,gGAAgG;AAChG,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,sFAAsF;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAmB9D,SAAS,eAAe,CAAC,YAAoB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IACpD,0EAA0E;IAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3C,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,YAA+B;IACvD,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAAE,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,uBAAuB,GAAG,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;QACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACjE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,uBAAuB,EAAE,CAAC;QAC/D,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,SAA4C,EAC5C,UAAkB,EAClB,YAA+B,EAC/B,cAAuC;IAEvC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,MAAM,GAA2B,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,KAAK,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAEvD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACZ,WAAW;gBACX,YAAY;gBACZ,WAAW;gBACX,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB,WAAW,YAAY,kBAAkB,EAAE;aAC1E,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,IAAI,CAAC;YACJ,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC,YAAY,CAAC,IAAI,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC;YAEvF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;gBACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC9E,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,KAAK,CAAC,8BAA8B,gBAAgB,YAAY,kBAAkB,EAAE,CAAC,CAAC;gBACjG,CAAC;gBACD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3C,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;gBAC7C,IAAI,CAAC;oBACJ,gEAAgE;oBAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;oBACjD,IAAI,IAAI,GAAG,KAAK;wBAAE,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACR,2BAA2B;gBAC5B,CAAC;gBACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,EAAE;oBAClD,gBAAgB;oBAChB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;oBAC7D,SAAS,EAAE,aAAa,IAAI,KAAK;iBACjC,CAAC,CAAC;gBACH,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;iBAAM,CAAC;gBACP,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;gBAC9E,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC;gBACZ,WAAW;gBACX,YAAY;gBACZ,WAAW;gBACX,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,SAA4C;IACpE,OAAQ,SAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,OAAO,KAA6B,CAAC;IACtC,CAAC,CAAC,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,kBAAkB,CACjC,YAAoB,EACpB,YAA+B,EAC/B,aAAsB;IAEtB,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAAE,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,uBAAuB,GAAG,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;QACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACjE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,uBAAuB,EAAE,CAAC;QAC/D,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,aAAa,IAAI,KAAK,CAAC;IAEhD,OAAO;;;OAGD,YAAY;;;;;wBAKK,mBAAmB;sBACrB,cAAc;0BACV,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgGzC,CAAC;AACF,CAAC"}

package/dist/migrate/hooks/codex-mcp-installer.d.ts

@@ -0,0 +1,9 @@
+export interface CodexMcpInstallResult {
+    success: boolean;
+    configPath: string;
+    error?: string;
+}
+export declare function installCodexMcpServers(mcpServersToml: string, options: {
+    global: boolean;
+}): Promise<CodexMcpInstallResult>;
+//# sourceMappingURL=codex-mcp-installer.d.ts.map

package/dist/migrate/hooks/codex-mcp-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-mcp-installer.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-mcp-installer.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AA+BD,wBAAsB,sBAAsB,CAC3C,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAsBhC"}

package/dist/migrate/hooks/codex-mcp-installer.js

@@ -0,0 +1,65 @@
+// Merges converted [mcp_servers] TOML into .codex/config.toml inside a
+// sentinel-managed block, so re-runs replace the block instead of duplicating
+// entries and user-authored config stays untouched.
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { getCodexGlobalBoundary, isCanonicalPathWithinBoundary, withCodexTargetLock } from "./codex-path-safety.js";
+const SENTINEL_START = "# --- managed-mcp-servers-start ---";
+const SENTINEL_END = "# --- managed-mcp-servers-end ---";
+async function atomicWrite(target, content) {
+    const dir = dirname(target);
+    if (!existsSync(dir))
+        await mkdir(dir, { recursive: true });
+    const tmp = `${target}.tmp-${process.pid}`;
+    try {
+        await writeFile(tmp, content, "utf-8");
+        await rename(tmp, target);
+    }
+    catch (err) {
+        try {
+            await unlink(tmp);
+        }
+        catch {
+            /* best-effort */
+        }
+        throw err;
+    }
+}
+function stripManagedBlock(content) {
+    const startIdx = content.indexOf(SENTINEL_START);
+    if (startIdx === -1)
+        return content;
+    const endIdx = content.indexOf(SENTINEL_END, startIdx);
+    if (endIdx === -1)
+        return content;
+    const blockEnd = endIdx + SENTINEL_END.length;
+    const after = content[blockEnd] === "\n" ? blockEnd + 1 : blockEnd;
+    let before = startIdx;
+    if (before > 0 && content[before - 1] === "\n")
+        before -= 1;
+    return content.slice(0, before) + content.slice(after);
+}
+export async function installCodexMcpServers(mcpServersToml, options) {
+    const codexRoot = options.global ? getCodexGlobalBoundary() : join(process.cwd(), ".codex");
+    const configPath = join(codexRoot, "config.toml");
+    if (!(await isCanonicalPathWithinBoundary(configPath, resolve(codexRoot)))) {
+        return { success: false, configPath, error: "Unsafe path: config.toml escapes the .codex boundary" };
+    }
+    return withCodexTargetLock(configPath, async () => {
+        try {
+            let existing = "";
+            if (existsSync(configPath))
+                existing = await readFile(configPath, "utf-8");
+            const stripped = stripManagedBlock(existing);
+            const block = `${SENTINEL_START}\n${mcpServersToml.trimEnd()}\n${SENTINEL_END}\n`;
+            const separator = stripped.length === 0 ? "" : stripped.endsWith("\n") ? "\n" : "\n\n";
+            await atomicWrite(configPath, `${stripped}${separator}${block}`);
+            return { success: true, configPath };
+        }
+        catch (err) {
+            return { success: false, configPath, error: err instanceof Error ? err.message : String(err) };
+        }
+    });
+}
+//# sourceMappingURL=codex-mcp-installer.js.map

package/dist/migrate/hooks/codex-mcp-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-mcp-installer.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-mcp-installer.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,oDAAoD;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEpH,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAQzD,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnE,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,cAAsB,EACtB,OAA4B;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAElD,IAAI,CAAC,CAAC,MAAM,6BAA6B,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACtG,CAAC;IAED,OAAO,mBAAmB,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QACjD,IAAI,CAAC;YACJ,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,UAAU,CAAC,UAAU,CAAC;gBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAE3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,GAAG,cAAc,KAAK,cAAc,CAAC,OAAO,EAAE,KAAK,YAAY,IAAI,CAAC;YAClF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACvF,MAAM,WAAW,CAAC,UAAU,EAAE,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAChG,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/migrate/hooks/codex-path-safety.d.ts

@@ -2,4 +2,33 @@ export declare function isPathWithinBoundary(targetPath: string, boundaryPath: s
 export declare function isCanonicalPathWithinBoundary(targetPath: string, boundaryPath: string): Promise<boolean>;
 export declare function withCodexTargetLock<T>(targetFilePath: string, operation: () => Promise<T>): Promise<T>;
 export declare function getCodexGlobalBoundary(): string;
+/**
+ * The single canonical Codex root for the given scope.
+ * - global: <home>/.codex
+ * - project: <cwd>/.codex
+ *
+ * Always absolute. This is the ONE place a Codex root is computed so no caller
+ * has to string-concatenate a project root onto a path — the source of the
+ * doubled-root bug (`node "/root//root/.codex/hooks/x.cjs"`) observed in real
+ * migrations, where a relative ".codex/hooks" path config was resolved against
+ * cwd in one place and prefixed with the project root again in another.
+ */
+export declare function getCodexRoot(options: {
+    global: boolean;
+}): string;
+/**
+ * Resolve a Codex target path to a single, absolute, non-doubled form.
+ *
+ * `target` may be:
+ * - already absolute (an installer computed it) → returned as-is (idempotent),
+ * - the literal ".codex/..." project-relative form from the provider registry,
+ * - or any other relative fragment → joined onto the scope's Codex root.
+ *
+ * Never derives the path from string content or interpolation — only from the
+ * literal path table and the computed root, so a project root can never be
+ * prepended twice.
+ */
+export declare function resolveCodexTargetPath(target: string, options: {
+    global: boolean;
+}): string;
 //# sourceMappingURL=codex-path-safety.d.ts.map

package/dist/migrate/hooks/codex-path-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-path-safety.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-path-safety.ts"],"names":[],"mappings":"AASA,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAItF;AAUD,wBAAsB,6BAA6B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI9G;AA2DD,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAa5G;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C"}
+{"version":3,"file":"codex-path-safety.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-path-safety.ts"],"names":[],"mappings":"AASA,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAItF;AAUD,wBAAsB,6BAA6B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI9G;AA2DD,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAa5G;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAQ3F"}

package/dist/migrate/hooks/codex-path-safety.js

@@ -3,7 +3,7 @@
 import { existsSync } from "node:fs";
 import { mkdir, readFile, realpath, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 const STALE_LOCK_MS = 60 * 1000;
 export function isPathWithinBoundary(targetPath, boundaryPath) {
     const resolvedTarget = resolve(targetPath);
@@ -98,4 +98,39 @@ export async function withCodexTargetLock(targetFilePath, operation) {
 export function getCodexGlobalBoundary() {
     return join(homedir(), ".codex");
 }
+/**
+ * The single canonical Codex root for the given scope.
+ * - global: <home>/.codex
+ * - project: <cwd>/.codex
+ *
+ * Always absolute. This is the ONE place a Codex root is computed so no caller
+ * has to string-concatenate a project root onto a path — the source of the
+ * doubled-root bug (`node "/root//root/.codex/hooks/x.cjs"`) observed in real
+ * migrations, where a relative ".codex/hooks" path config was resolved against
+ * cwd in one place and prefixed with the project root again in another.
+ */
+export function getCodexRoot(options) {
+    return options.global ? getCodexGlobalBoundary() : resolve(process.cwd(), ".codex");
+}
+/**
+ * Resolve a Codex target path to a single, absolute, non-doubled form.
+ *
+ * `target` may be:
+ * - already absolute (an installer computed it) → returned as-is (idempotent),
+ * - the literal ".codex/..." project-relative form from the provider registry,
+ * - or any other relative fragment → joined onto the scope's Codex root.
+ *
+ * Never derives the path from string content or interpolation — only from the
+ * literal path table and the computed root, so a project root can never be
+ * prepended twice.
+ */
+export function resolveCodexTargetPath(target, options) {
+    if (isAbsolute(target))
+        return resolve(target);
+    const codexRoot = getCodexRoot(options);
+    // Strip a leading ".codex/" (or ".codex") segment so we never nest
+    // ".codex/.codex/..." when the registry path already carries the prefix.
+    const normalized = target.replace(/^\.?[/\\]?\.codex[/\\]?/, "");
+    return normalized.length > 0 ? resolve(codexRoot, normalized) : codexRoot;
+}
 //# sourceMappingURL=codex-path-safety.js.map

package/dist/migrate/hooks/codex-path-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-path-safety.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-path-safety.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,mEAAmE;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhC,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,YAAoB;IAC5E,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,cAAc,KAAK,gBAAgB,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC;QACJ,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,UAAkB,EAAE,YAAoB;IAC3F,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,oBAAoB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAsB;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,OAAO;QACR,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;gBACtF,IAAI,CAAC;oBACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACR,UAAU;gBACX,CAAC;gBACD,SAAS;YACV,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,kCAAkC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,aAAa,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,cAAc;IACf,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,cAAsB,EAAE,SAA2B;IAC/F,MAAM,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACtD,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACV,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"codex-path-safety.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-path-safety.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,mEAAmE;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEpE,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhC,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,YAAoB;IAC5E,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,cAAc,KAAK,gBAAgB,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC;QACJ,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,UAAkB,EAAE,YAAoB;IAC3F,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,oBAAoB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAsB;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,OAAO;QACR,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;gBACtF,IAAI,CAAC;oBACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACR,UAAU;gBACX,CAAC;gBACD,SAAS;YACV,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,kCAAkC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,aAAa,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,cAAc;IACf,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,cAAsB,EAAE,SAA2B;IAC/F,MAAM,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACtD,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACV,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACxD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,OAA4B;IAClF,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/migrate/hooks/codex-sh-wrapper-script.d.ts

@@ -0,0 +1,8 @@
+interface ShWrapperOptions {
+    copiedScriptPath: string;
+    scrubRulesJson: string;
+    timeoutMs: number;
+}
+export declare function buildShWrapperScript(originalPath: string, options: ShWrapperOptions): string;
+export {};
+//# sourceMappingURL=codex-sh-wrapper-script.d.ts.map

package/dist/migrate/hooks/codex-sh-wrapper-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-sh-wrapper-script.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-sh-wrapper-script.ts"],"names":[],"mappings":"AAiBA,UAAU,gBAAgB;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAqG5F"}

package/dist/migrate/hooks/codex-sh-wrapper-script.js

@@ -0,0 +1,118 @@
+// Builds the body of a generated .cjs wrapper that executes a copied .sh hook
+// script. The wrapper is fully self-contained (no mewkit imports at runtime) and
+// points at a script copied under the Codex output tree, so deleting the source
+// .claude/ tree after migration does NOT break the migrated hook.
+//
+// Env rewrite: Claude Code exports $CLAUDE_PROJECT_DIR (and other $CLAUDE_* vars)
+// that Codex does not. The wrapper injects a computed project root for the common
+// vars from a LITERAL table (never content-derived interpolation), then execs the
+// copied script via /bin/sh with an argv ARRAY (execFile-style) so a project root
+// containing spaces or shell metacharacters is passed as one literal argument.
+//
+// Deny protocol (documented at https://developers.openai.com/codex/hooks):
+// a PreToolUse hook denies via exit code 2 + reason on stderr (direct parity with
+// Claude's exit-2 convention), or the {"decision":"block",...} shape. The wrapper
+// preserves the child's exit code and, for deny-capable events, converts exit 2
+// into the structured permissionDecision:"deny" payload Codex expects.
+export function buildShWrapperScript(originalPath, options) {
+    const escapedScriptPath = JSON.stringify(options.copiedScriptPath);
+    const escapedOriginal = JSON.stringify(originalPath);
+    return `#!/usr/bin/env node
+// AUTO-GENERATED by the migration tooling — DO NOT EDIT
+// Codex shell-hook compatibility wrapper for:
+//   ${originalPath}
+// Executes the copied script (self-contained under the Codex tree).
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+
+const COPIED_SCRIPT = ${escapedScriptPath};
+const ORIGINAL_HOOK = ${escapedOriginal};
+const SCRUB_RULES = ${options.scrubRulesJson};
+const HOOK_TIMEOUT_MS = ${options.timeoutMs};
+
+// Computed project root: the Codex tree is <root>/.codex/hooks/scripts/<file>,
+// so the project root is four levels up from the copied script. Derived from a
+// literal directory-depth table, never from string interpolation of user input.
+function computeProjectRoot() {
+  if (process.env.CODEX_PROJECT_DIR) return process.env.CODEX_PROJECT_DIR;
+  const scriptsDir = path.dirname(COPIED_SCRIPT);           // .codex/hooks/scripts
+  const hooksDir = path.dirname(scriptsDir);                // .codex/hooks
+  const codexDir = path.dirname(hooksDir);                  // .codex
+  return path.dirname(codexDir);                            // <project root>
+}
+
+function rewrittenEnv() {
+  const projectRoot = computeProjectRoot();
+  const env = Object.assign({}, process.env);
+  // Bridge the Claude-only vars a .sh hook may read to Codex-available values.
+  if (env.CLAUDE_PROJECT_DIR === undefined) env.CLAUDE_PROJECT_DIR = projectRoot;
+  if (env.CLAUDE_PLUGIN_DATA === undefined) env.CLAUDE_PLUGIN_DATA = path.join(projectRoot, ".codex");
+  return env;
+}
+
+function getEventFromStdin(stdinData) {
+  try {
+    const parsed = JSON.parse(stdinData);
+    return parsed.hook_event_name || parsed.event || null;
+  } catch {
+    return null;
+  }
+}
+
+function eventSupportsDeny(rules) {
+  if (!rules || rules.allowedPermissionValues === null || rules.allowedPermissionValues === undefined) return false;
+  return rules.allowedPermissionValues.indexOf("deny") !== -1;
+}
+
+function emitDeny(reason) {
+  process.stdout.write(JSON.stringify({
+    permissionDecision: "deny",
+    reason: reason && reason.length > 0 ? reason : "Hook blocked this operation",
+  }));
+  process.exit(0);
+}
+
+function main() {
+  const stdinChunks = [];
+  process.stdin.on("data", (chunk) => stdinChunks.push(chunk));
+  process.stdin.on("end", () => {
+    const stdinData = Buffer.concat(stdinChunks).toString("utf8");
+    const event = getEventFromStdin(stdinData);
+    const rules = event && SCRUB_RULES[event];
+
+    // argv ARRAY — the copied script path is one literal argument, so a project
+    // root containing spaces or shell metacharacters is never re-parsed by a shell.
+    const result = spawnSync("/bin/sh", [COPIED_SCRIPT], {
+      input: stdinData,
+      env: rewrittenEnv(),
+      encoding: "utf8",
+      timeout: HOOK_TIMEOUT_MS,
+    });
+
+    if (result.error) {
+      if (result.stderr) process.stderr.write(result.stderr);
+      process.exit(1);
+    }
+
+    const stderrText = (result.stderr || "").toString();
+    const rawOutput = (result.stdout || "").toString();
+    const exitCode = result.status == null ? 1 : result.status;
+    const isBlockSignal = exitCode === 2 && eventSupportsDeny(rules);
+
+    if (isBlockSignal) {
+      const reason = (rawOutput.trim() || stderrText.trim());
+      return emitDeny(reason);
+    }
+
+    if (stderrText) process.stderr.write(stderrText);
+    if (rawOutput) process.stdout.write(rawOutput);
+    process.exit(exitCode);
+  });
+}
+
+main();
+`;
+}
+//# sourceMappingURL=codex-sh-wrapper-script.js.map

package/dist/migrate/hooks/codex-sh-wrapper-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-sh-wrapper-script.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-sh-wrapper-script.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,kEAAkE;AAClE,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,uEAAuE;AAQvE,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,OAAyB;IACnF,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAErD,OAAO;;;OAGD,YAAY;;;;;;;wBAOK,iBAAiB;wBACjB,eAAe;sBACjB,OAAO,CAAC,cAAc;0BAClB,OAAO,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF1C,CAAC;AACF,CAAC"}

package/dist/migrate/hooks/codex-shell-env-installer.d.ts

@@ -0,0 +1,14 @@
+export interface CodexShellEnvInstallResult {
+    success: boolean;
+    configPath: string;
+    error?: string;
+}
+/**
+ * Install (or, when scaffold is empty, remove) the managed shell-env-policy block.
+ * An empty scaffold means there is nothing safe to write, so the block is stripped
+ * — keeping re-runs idempotent whether or not a `.claude/.env` exists.
+ */
+export declare function installCodexShellEnvPolicy(scaffoldToml: string, options: {
+    global: boolean;
+}): Promise<CodexShellEnvInstallResult>;
+//# sourceMappingURL=codex-shell-env-installer.d.ts.map

package/dist/migrate/hooks/codex-shell-env-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-shell-env-installer.d.ts","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-shell-env-installer.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AA+BD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAC1B,OAAO,CAAC,0BAA0B,CAAC,CA4BrC"}

package/dist/migrate/hooks/codex-shell-env-installer.js

@@ -0,0 +1,82 @@
+// Merges the generated [shell_environment_policy] scaffold into .codex/config.toml
+// inside a sentinel-managed block, so re-runs replace the block instead of
+// duplicating it and user-authored config stays untouched. Mirrors the
+// codex-mcp-installer sentinel pattern.
+//
+// SECURITY (injection-rules Rule 4/5): the scaffold text passed in contains ONLY
+// inert placeholder values and non-secret key NAMES (secret-like names are already
+// excluded upstream by emitShellEnvPolicyScaffold). No `.env` value ever reaches
+// this module.
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { getCodexGlobalBoundary, isCanonicalPathWithinBoundary, withCodexTargetLock } from "./codex-path-safety.js";
+const SENTINEL_START = "# --- managed-shell-env-policy-start ---";
+const SENTINEL_END = "# --- managed-shell-env-policy-end ---";
+async function atomicWrite(target, content) {
+    const dir = dirname(target);
+    if (!existsSync(dir))
+        await mkdir(dir, { recursive: true });
+    const tmp = `${target}.tmp-${process.pid}`;
+    try {
+        await writeFile(tmp, content, "utf-8");
+        await rename(tmp, target);
+    }
+    catch (err) {
+        try {
+            await unlink(tmp);
+        }
+        catch {
+            /* best-effort */
+        }
+        throw err;
+    }
+}
+function stripManagedBlock(content) {
+    const startIdx = content.indexOf(SENTINEL_START);
+    if (startIdx === -1)
+        return content;
+    const endIdx = content.indexOf(SENTINEL_END, startIdx);
+    if (endIdx === -1)
+        return content;
+    const blockEnd = endIdx + SENTINEL_END.length;
+    const after = content[blockEnd] === "\n" ? blockEnd + 1 : blockEnd;
+    let before = startIdx;
+    if (before > 0 && content[before - 1] === "\n")
+        before -= 1;
+    return content.slice(0, before) + content.slice(after);
+}
+/**
+ * Install (or, when scaffold is empty, remove) the managed shell-env-policy block.
+ * An empty scaffold means there is nothing safe to write, so the block is stripped
+ * — keeping re-runs idempotent whether or not a `.claude/.env` exists.
+ */
+export async function installCodexShellEnvPolicy(scaffoldToml, options) {
+    const codexRoot = options.global ? getCodexGlobalBoundary() : join(process.cwd(), ".codex");
+    const configPath = join(codexRoot, "config.toml");
+    if (!(await isCanonicalPathWithinBoundary(configPath, resolve(codexRoot)))) {
+        return { success: false, configPath, error: "Unsafe path: config.toml escapes the .codex boundary" };
+    }
+    return withCodexTargetLock(configPath, async () => {
+        try {
+            let existing = "";
+            if (existsSync(configPath))
+                existing = await readFile(configPath, "utf-8");
+            const stripped = stripManagedBlock(existing);
+            if (scaffoldToml.trim().length === 0) {
+                // Nothing to scaffold: only rewrite if we actually removed a stale block.
+                if (stripped !== existing)
+                    await atomicWrite(configPath, stripped);
+                return { success: true, configPath };
+            }
+            const block = `${SENTINEL_START}\n${scaffoldToml.trimEnd()}\n${SENTINEL_END}\n`;
+            const separator = stripped.length === 0 ? "" : stripped.endsWith("\n") ? "\n" : "\n\n";
+            await atomicWrite(configPath, `${stripped}${separator}${block}`);
+            return { success: true, configPath };
+        }
+        catch (err) {
+            return { success: false, configPath, error: err instanceof Error ? err.message : String(err) };
+        }
+    });
+}
+//# sourceMappingURL=codex-shell-env-installer.js.map

package/dist/migrate/hooks/codex-shell-env-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-shell-env-installer.js","sourceRoot":"","sources":["../../../src/migrate/hooks/codex-shell-env-installer.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,2EAA2E;AAC3E,uEAAuE;AACvE,wCAAwC;AACxC,EAAE;AACF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,eAAe;AAEf,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEpH,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAQ9D,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,MAAM,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnE,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,YAAoB,EACpB,OAA4B;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAElD,IAAI,CAAC,CAAC,MAAM,6BAA6B,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACtG,CAAC;IAED,OAAO,mBAAmB,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QACjD,IAAI,CAAC;YACJ,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,UAAU,CAAC,UAAU,CAAC;gBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAE3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,0EAA0E;gBAC1E,IAAI,QAAQ,KAAK,QAAQ;oBAAE,MAAM,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,cAAc,KAAK,YAAY,CAAC,OAAO,EAAE,KAAK,YAAY,IAAI,CAAC;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACvF,MAAM,WAAW,CAAC,UAAU,EAAE,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAChG,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC"}