ohmyjev 0.6.0 → 0.7.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Novacon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -13,14 +13,14 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
 ```
 
 <p align="center">
-  Guardrails for Claude Code, pi and omp, decided by <a href="https://typesafe.ai">Jev</a>.<br>
+  Guardrails for Claude Code, Codex, pi and omp, decided by <a href="https://typesafe.ai">Jev</a>.<br>
   One mod that stops irreversible and data-leaking commands, even in bypass mode, and runs them when you say yes. It also flags prompt injection, pushes back on an unverified "done" and routes effort per turn.
 </p>
 
 <p align="center">
   <img alt="Claude Code 2.1.287+" src="https://img.shields.io/badge/Claude_Code-2.1.287%2B-d97757">
   <img alt="Decided by Jev" src="https://img.shields.io/badge/decided_by-Jev-101315">
-  <img alt="pi and omp" src="https://img.shields.io/badge/also_for-pi_·_omp-86a893">
+  <img alt="Codex, pi and omp" src="https://img.shields.io/badge/also_for-Codex_·_pi_·_omp-86a893">
   <a href="https://www.npmjs.com/package/ohmyjev"><img alt="npm" src="https://img.shields.io/npm/v/ohmyjev?color=de6145"></a>
   <img alt="MIT license" src="https://img.shields.io/badge/license-MIT-798186">
 </p>
@@ -30,7 +30,7 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
   <a href="#quick-start">Quick start</a> ·
   <a href="#what-you-get">What you get</a> ·
   <a href="#install">Install</a> ·
-  <a href="#pi-and-omp">pi and omp</a> ·
+  <a href="#codex-pi-and-omp">Codex, pi and omp</a> ·
   <a href="#using-it">Using it</a> ·
   <a href="#settings">Settings</a> ·
   <a href="#privacy">Privacy</a> ·
@@ -144,11 +144,29 @@ key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0
 If it says `key: none`, ohmyjev can't see a key. In that case every gate stays open, the router falls back to Claude
 Code's built-in classifier (up only), and the status under the prompt shows `jev ⚠ no key`.
 
-## pi and omp
+## Codex, pi and omp
 
-The same checks run in [pi](https://pi.dev) and [omp](https://github.com/can1357/oh-my-pi) as a native extension.
-They share the decision logic and the key lookup (`TYPESAFE_API_KEY`, then `OPENROUTER_API_KEY`) with the Claude Code
-plugin, and write to the same `~/.ohmyjev` logs, so `/omj` and the statusline segment work the same way.
+The same checks run in [Codex](https://developers.openai.com/codex) as a plugin with hooks, and in [pi](https://pi.dev)
+and [omp](https://github.com/can1357/oh-my-pi) as a native extension. They share the decision logic and the key lookup
+(`TYPESAFE_API_KEY`, then `OPENROUTER_API_KEY`) with the Claude Code plugin, and write to the same `~/.ohmyjev` logs, so
+`/omj stats` in any of them shows every session.
+
+### Codex
+
+```bash
+codex plugin marketplace add Novacon/ohmyjev
+codex plugin add ohmyjev@ohmyjev
+```
+
+Then start Codex and run `/hooks` once: Codex skips a plugin's hooks until you trust them. ohmyjev needs Node on your
+`PATH` and the key in the shell that starts Codex. It gates `Bash`, `apply_patch` edits and MCP calls, screens their
+output, and runs the done-check. Saying yes after a block works the same way. Codex hooks can't change the model or add
+a tool, so there is no router, no `ask_jev` and no `/omj` command. Put settings in `~/.codex/ohmyjev.json`, using the
+names in [Settings](#settings):
+
+```json
+{ "requested": 0.9, "policies": "never touch the prod cluster" }
+```
 
 ### omp
 
@@ -184,18 +202,19 @@ pi has no settings screen for extensions, so put yours under an `ohmyjev` key in
 
 ### What differs
 
-| | Claude Code | omp | pi |
-|---|---|---|---|
-| Bash gate | Bash | `bash`, `eval`, and `github` pushes and PRs | `bash`, `powershell` |
-| Write gate | Write, Edit, NotebookEdit | `write`, `edit` (patches and renames included), `ast_edit` | `write`, `edit` |
-| Exfil gate | WebFetch, MCP tools | `read` of a URL, MCP tools | MCP tools (pi has no fetch tool; `curl` goes through the bash gate) |
-| Injection screen | Bash, WebFetch, MCP, Reads outside the repo | `bash`, `github`, URL reads, MCP, reads outside the repo | `bash`, `powershell`, MCP, reads outside the repo |
-| Done-check | ✓ | ✓ | ✓ |
-| Router effort | ✓ | ✓ (left alone while you're on `auto`) | ✓ |
-| Router subagent model | general-purpose subagents | subagents on the default `task` role | none: pi has no subagents |
-| Router without a key | Claude Code's built-in classifier, up only | off: omp has no separate classifier call for extensions | the cheapest model you've set up, up only |
-| Decision lines | in the transcript | notifications | notifications |
-| Status | under the prompt | in the footer | in the footer |
+| | Claude Code | Codex | omp | pi |
+|---|---|---|---|---|
+| Bash gate | Bash | Bash | `bash`, `eval`, and `github` pushes and PRs | `bash`, `powershell` |
+| Write gate | Write, Edit, NotebookEdit | `apply_patch` | `write`, `edit` (patches and renames included), `ast_edit` | `write`, `edit` |
+| Exfil gate | WebFetch, MCP tools | MCP tools | `read` of a URL, MCP tools | MCP tools (pi has no fetch tool; `curl` goes through the bash gate) |
+| Injection screen | Bash, WebFetch, MCP, Reads outside the repo | Bash, MCP | `bash`, `github`, URL reads, MCP, reads outside the repo | `bash`, `powershell`, MCP, reads outside the repo |
+| Done-check | ✓ | ✓ | ✓ | ✓ |
+| Router effort | ✓ | none: hooks can't set it | ✓ (left alone while you're on `auto`) | ✓ |
+| Router subagent model | general-purpose subagents | none | subagents on the default `task` role | none: pi has no subagents |
+| Router without a key | Claude Code's built-in classifier, up only | none | off: omp has no separate classifier call for extensions | the cheapest model you've set up, up only |
+| `/omj`, `ask_jev` | ✓ | none: hooks can't add commands or tools | ✓ | ✓ |
+| Decision lines | in the transcript | the log only | notifications | notifications |
+| Status | under the prompt | none | in the footer | in the footer |
 
 ## Using it
 
@@ -379,6 +398,9 @@ have set up, through pi's own provider. Logs and session files stay in `~/.ohmyj
 claude plugin update ohmyjev@ohmyjev      # then restart Claude Code
 claude plugin uninstall ohmyjev@ohmyjev
 
+codex plugin marketplace upgrade ohmyjev  # Codex; then trust the changed hooks in /hooks
+codex plugin remove ohmyjev@ohmyjev
+
 omp plugin upgrade ohmyjev                # omp; restart the session
 omp plugin uninstall ohmyjev
 

package/adapters/codex.ts

@@ -0,0 +1,163 @@
+/**
+ * ohmyjev for Codex: one command hook, run once per event (codex/hooks.json). Each run is a fresh process, so what
+ * must outlive it (the user's latest request, the call blocked last turn, this turn's tools) sits in
+ * ~/.ohmyjev/codex/<session>.json. Same decisions as the other hosts (hooks/policy.ts); every failure prints nothing,
+ * and nothing lets the call through. Codex hooks can't change the model or add tools, so there is no router or ask_jev.
+ * Built to codex/ohmyjev.mjs with `bun run build:codex`, since Codex runs it with plain node.
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import {
+  BASH_Q, EXFIL_Q, SCREEN_Q, STOP_Q, WRITE_Q, applyPatchPaths, callSummary, clip, denyText, gateBash, gateExfil, gateWrite,
+  judgeStop, pathDenyText, plainRead, readConfig, sanitizeSid, screen, withPolicies, withPolicyQ, type Config,
+} from '../hooks/policy.ts'
+import { Session, keyOf, pathAllowed, repoRoot, type Env, type Fetch } from './shared.ts'
+
+const CLIP = 16000
+type Tool = { tool: string; input: string; outcome: 'ok' | 'failed' }
+type State = { request: string; previous: string[]; count: number; blockedBefore: string; lastBlocked: string; tools: Tool[]; pushedBackAt: number }
+const EMPTY: State = { request: '', previous: [], count: 0, blockedBefore: '', lastBlocked: '', tools: [], pushedBackAt: -1 }
+type Input = Record<string, unknown>
+const str = (o: Input, k: string): string => (typeof o[k] === 'string' ? (o[k] as string) : '')
+const obj = (v: unknown): Input => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Input) : {})
+
+/** Settings: ~/.codex/ohmyjev.json, a flat object of the setting names in the README. */
+async function config(env: Env): Promise<Config> {
+  const text = await readFile(`${env.HOME ?? ''}/.codex/ohmyjev.json`, 'utf8').catch(() => '{}')
+  try {
+    return readConfig(obj(JSON.parse(text)))
+  } catch {
+    return readConfig({})
+  }
+}
+
+const statePath = (env: Env, sid: string) => `${env.HOME ?? ''}/.ohmyjev/codex/${sanitizeSid(sid)}.json`
+async function load(env: Env, sid: string): Promise<State> {
+  const text = await readFile(statePath(env, sid), 'utf8').catch(() => '')
+  try {
+    return { ...EMPTY, ...(JSON.parse(text) as Partial<State>) }
+  } catch {
+    return { ...EMPTY }
+  }
+}
+// ponytail: last write wins; two hooks finishing at once can drop one tool from this turn's list (done-check input only)
+async function save(env: Env, sid: string, st: State): Promise<void> {
+  await mkdir(`${env.HOME ?? ''}/.ohmyjev/codex`, { recursive: true, mode: 0o700 }).catch(() => undefined)
+  await writeFile(statePath(env, sid), JSON.stringify(st), { mode: 0o600 }).catch(() => undefined)
+}
+
+const deny = (reason: string) => ({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } })
+
+/** One hook event in, Codex's JSON answer out; undefined means no opinion. */
+export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise<object | undefined> {
+  const c = await config(env)
+  const event = str(input, 'hook_event_name')
+  const sid = str(input, 'session_id') || 'codex'
+  const cwd = str(input, 'cwd') || process.cwd()
+  if (!c.enabled) return undefined
+
+  if (event === 'SessionStart')
+    return keyOf(c, env) ? undefined : { systemMessage: 'ohmyjev: no Jev key, so every call passes through. Set TYPESAFE_API_KEY in the shell that starts Codex.' }
+
+  const st = await load(env, sid)
+  if (event === 'UserPromptSubmit') {
+    const prompt = str(input, 'prompt')
+    if (!prompt.trim() || /^\/\S+\s*$/.test(prompt.trim())) return undefined
+    if (st.request) st.previous = [...st.previous, clip(st.request, 200)].slice(-5)
+    Object.assign(st, { request: prompt, count: st.count + 1, blockedBefore: st.lastBlocked, lastBlocked: '', tools: [] })
+    await save(env, sid, st)
+    return undefined
+  }
+
+  const x = new Session(c, env, sid, undefined, fetchImpl)
+  const tool = str(input, 'tool_name')
+  const toolInput = obj(input.tool_input)
+
+  if (event === 'PreToolUse') {
+    const blocked = async (j: { verdict: unknown; reason: string }) => {
+      if (j.verdict !== 'deny') return undefined
+      st.lastBlocked = callSummary(tool, toolInput)
+      await save(env, sid, st)
+      return deny(denyText(j.reason))
+    }
+    if (tool === 'Bash' && c.bashGate) {
+      const command = str(toolInput, 'command')
+      if (plainRead(command, c)) return undefined
+      const state = withPolicies({ command: clip(command, CLIP), cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, st.request, st.blockedBefore)
+      const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c, st.request))
+      if (!d) return undefined
+      const j = gateBash(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      return blocked(j)
+    }
+    if (tool === 'apply_patch' && c.writeGate) {
+      const patch = str(toolInput, 'command')
+      const root = await repoRoot(cwd)
+      for (const path of applyPatchPaths(patch))
+        if (!(await pathAllowed(path, cwd, root, c, env))) {
+          x.denyByCode(tool, `${path} is outside the repo and allowPaths`)
+          return deny(pathDenyText(path))
+        }
+      const state = withPolicies({ path: applyPatchPaths(patch).join('; '), content: clip(patch, CLIP) }, c, st.request, st.blockedBefore)
+      const d = await x.decide('tool.call', tool, state, withPolicyQ(WRITE_Q, c, st.request))
+      if (!d) return undefined
+      const j = gateWrite(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      return blocked(j)
+    }
+    if (tool.startsWith('mcp__') && c.exfilGate) {
+      const state = withPolicies({ tool, input: clip(JSON.stringify(toolInput), 4000) }, c, st.request, st.blockedBefore)
+      const d = await x.decide('tool.call', tool, state, withPolicyQ(EXFIL_Q, c, st.request))
+      if (!d) return undefined
+      const j = gateExfil(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      return blocked(j)
+    }
+    return undefined
+  }
+
+  if (event === 'PostToolUse') {
+    const response = input.tool_response
+    const code = obj(response).exit_code ?? obj(response).exitCode
+    st.tools = [...st.tools, { tool, input: clip(JSON.stringify(toolInput), 200), outcome: typeof code === 'number' && code !== 0 ? 'failed' : 'ok' } as Tool].slice(-20)
+    await save(env, sid, st)
+    if (!c.injectionScreen || !(tool === 'Bash' || tool.startsWith('mcp__'))) return undefined
+    const text = typeof response === 'string' ? response : JSON.stringify(response ?? '')
+    if (!text.trim()) return undefined
+    const d = await x.decide('tool.result', tool, { tool, content: clip(text, 6000) }, SCREEN_Q)
+    if (!d) return undefined
+    const s = screen(d.answers, c)
+    x.record(d, s.flagged ? 'flag' : null, s.reason)
+    return s.flagged ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: s.note } } : undefined
+  }
+
+  if (event === 'Stop') {
+    if (!c.doneCheck || input.stop_hook_active === true || st.pushedBackAt === st.count) return undefined
+    const state = {
+      current_request: clip(st.request, 600),
+      previous_requests: st.previous,
+      tools_this_turn: st.tools,
+      last_assistant_message: clip(str(input, 'last_assistant_message'), 1500),
+    }
+    const d = await x.decide('Stop', '', state, STOP_Q)
+    if (!d) return undefined
+    const j = judgeStop(d.answers, c, st.tools.length > 0)
+    x.record(d, j.block ? 'block' : null, j.block ?? 'stop ok')
+    if (!j.block) return undefined
+    st.pushedBackAt = st.count
+    await save(env, sid, st)
+    return { decision: 'block', reason: j.block }
+  }
+  return undefined
+}
+
+/** The hook command: one JSON event on stdin, the answer on stdout. Any failure prints nothing, so Codex goes on. */
+export async function main(): Promise<void> {
+  try {
+    let text = ''
+    for await (const chunk of process.stdin) text += chunk
+    const out = await handle(obj(JSON.parse(text)), process.env)
+    if (out) process.stdout.write(JSON.stringify(out))
+  } catch {
+    // ohmyjev's own bug: no opinion
+  }
+}

package/adapters/omp.ts

@@ -4,7 +4,7 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, DEFAULTS, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand,
+  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand, applyPatchPaths,
   OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, modelOf, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
@@ -150,15 +150,6 @@ const exfilTool = (tool: string, input: RecordOfUnknown): boolean => urlRead(too
 const githubWrite = (tool: string, input: RecordOfUnknown): boolean =>
   tool === 'github' && GITHUB_READONLY_OPS[string(input, 'op')] !== true
 
-function applyPatchPaths(patch: string): string[] {
-  const paths: string[] = []
-  for (const line of patch.split('\n')) {
-    const match = /^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/.exec(line.trim())
-    if (match?.[1]) paths.push(match[1])
-  }
-  return paths
-}
-
 function writePaths(tool: string, input: RecordOfUnknown): string[] {
   const paths = Array.isArray(input.paths) ? input.paths.filter((p): p is string => typeof p === 'string' && p !== '') : []
   for (const key of ['path', 'file_path', 'notebook_path']) {

package/hooks/policy.ts

@@ -480,6 +480,16 @@ export function hostPath(p: string): string | null {
 export const parseWorktrees = (porcelain: string): string[] =>
   porcelain.split('\n').filter(l => l.startsWith('worktree ')).map(l => l.slice('worktree '.length).trim()).filter(Boolean)
 
+/** Every file an apply_patch patch adds, updates, deletes or moves to (omp and Codex edits). */
+export function applyPatchPaths(patch: string): string[] {
+  const paths: string[] = []
+  for (const line of patch.split('\n')) {
+    const match = /^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/.exec(line.trim())
+    if (match?.[1]) paths.push(match[1])
+  }
+  return paths
+}
+
 export const isUnder = (target: string, root: string): boolean =>
   target === root || target.startsWith(root.replace(/\/+$/, '') + '/')
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohmyjev",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Guardrails for coding agents, decided by TypeSafe's Jev: blocks destructive commands, catches prompt injection, pushes back on an unverified done and routes effort per turn. For Claude Code, pi and omp.",
   "type": "module",
   "license": "MIT",
@@ -14,8 +14,18 @@
     "omp",
     "pi",
     "claude-code",
+    "claude-code-plugin",
+    "codex",
+    "codex-plugin",
     "jev",
-    "guardrails"
+    "guardrails",
+    "ai-agent",
+    "ai-safety",
+    "llm-security",
+    "prompt-injection",
+    "coding-agent",
+    "agent-guardrails",
+    "bypass-permissions"
   ],
   "files": [
     "adapters/*.ts",
@@ -235,7 +245,8 @@
   },
   "scripts": {
     "test": "bun test adapters && claude plugin test .",
-    "typecheck": "tsc -p . && tsc -p tsconfig.adapters.json"
+    "typecheck": "tsc -p . && tsc -p tsconfig.adapters.json",
+    "build:codex": "bun build codex/main.ts --target=node --format=esm --outfile=codex/ohmyjev.mjs"
   },
   "devDependencies": {
     "@types/bun": "^1.4.2",