remote-codex 0.1.4 → 0.1.6

package/apps/supervisor-api/dist/index.js

@@ -248,6 +248,49 @@ function mapMcpServer(record) {
     resourceTemplateCount: Array.isArray(record.resourceTemplates) ? record.resourceTemplates.length : 0
   };
 }
+function numberFromProtocolInteger(value, fallback = 0) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  if (typeof value === "bigint") {
+    return Number(value);
+  }
+  if (typeof value === "string") {
+    const numericValue = Number(value);
+    return Number.isFinite(numericValue) ? numericValue : fallback;
+  }
+  return fallback;
+}
+function mapHook(record) {
+  return {
+    key: record.key,
+    eventName: record.eventName,
+    handlerType: record.handlerType,
+    matcher: record.matcher ?? null,
+    command: record.command ?? null,
+    timeoutSec: numberFromProtocolInteger(record.timeoutSec ?? record.timeout_sec, 600),
+    statusMessage: record.statusMessage ?? record.status_message ?? null,
+    sourcePath: String(record.sourcePath ?? record.source_path ?? ""),
+    source: record.source ?? "unknown",
+    pluginId: record.pluginId ?? record.plugin_id ?? null,
+    displayOrder: numberFromProtocolInteger(record.displayOrder ?? record.display_order),
+    enabled: record.enabled === true,
+    isManaged: record.isManaged === true || record.is_managed === true,
+    currentHash: record.currentHash ?? record.current_hash ?? "",
+    trustStatus: record.trustStatus ?? record.trust_status ?? "untrusted"
+  };
+}
+function mapHooksListEntry(record) {
+  return {
+    cwd: record.cwd,
+    hooks: Array.isArray(record.hooks) ? record.hooks.map(mapHook) : [],
+    warnings: Array.isArray(record.warnings) ? record.warnings.map(String) : [],
+    errors: Array.isArray(record.errors) ? record.errors.map((error) => ({
+      path: String(error.path ?? ""),
+      message: String(error.message ?? "")
+    })) : []
+  };
+}
 function parseGoalTimestamp(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
     return value;
@@ -387,6 +430,31 @@ var CodexAppServerManager = class extends EventEmitter2 {
     } while (cursor);
     return servers;
   }
+  async listHooks(input = {}) {
+    await this.ensureReady();
+    const response = await this.client.request("hooks/list", {
+      ...input.cwds && input.cwds.length > 0 ? { cwds: input.cwds } : {}
+    });
+    return response.data.map(mapHooksListEntry);
+  }
+  async setHookTrust(input) {
+    await this.ensureReady();
+    await this.client.request("config/batchWrite", {
+      edits: [
+        {
+          keyPath: "hooks.state",
+          value: {
+            [input.key]: {
+              trusted_hash: input.trustedHash ?? "",
+              ...input.trustedHash ? { enabled: true } : {}
+            }
+          },
+          mergeStrategy: "upsert"
+        }
+      ],
+      reloadUserConfig: true
+    });
+  }
   async startThread(input) {
     await this.ensureReady();
     const response = await this.client.request("thread/start", {
@@ -5913,6 +5981,7 @@ __export(schema_exports, {
   threadActivityNotes: () => threadActivityNotes,
   threadForks: () => threadForks,
   threadGoals: () => threadGoals,
+  threadHistoryItems: () => threadHistoryItems,
   threadPendingSteers: () => threadPendingSteers,
   threadTurnMetadata: () => threadTurnMetadata,
   threads: () => threads,
@@ -6025,6 +6094,25 @@ var threadPendingSteers = sqliteTable("thread_pending_steers", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 });
+var threadHistoryItems = sqliteTable(
+  "thread_history_items",
+  {
+    id: text("id").primaryKey(),
+    threadId: text("thread_id").notNull(),
+    turnId: text("turn_id").notNull(),
+    itemId: text("item_id").notNull(),
+    itemJson: text("item_json").notNull(),
+    createdAt: text("created_at").notNull(),
+    updatedAt: text("updated_at").notNull()
+  },
+  (table) => ({
+    threadTurnItemUnique: uniqueIndex("thread_history_items_thread_turn_item_idx").on(
+      table.threadId,
+      table.turnId,
+      table.itemId
+    )
+  })
+);
 var threadActivityNotes = sqliteTable("thread_activity_notes", {
   id: text("id").primaryKey(),
   threadId: text("thread_id").notNull(),
@@ -6303,6 +6391,38 @@ function upsertThreadTurnMetadata(db, input) {
 function deleteThreadTurnMetadataByThreadId(db, threadId) {
   db.delete(threadTurnMetadata).where(eq(threadTurnMetadata.threadId, threadId)).run();
 }
+function listThreadHistoryItemRecordsByThreadId(db, threadId) {
+  return db.select().from(threadHistoryItems).where(eq(threadHistoryItems.threadId, threadId)).orderBy(threadHistoryItems.createdAt).all();
+}
+function upsertThreadHistoryItemRecord(db, input) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = db.select().from(threadHistoryItems).where(
+    and(
+      eq(threadHistoryItems.threadId, input.threadId),
+      eq(threadHistoryItems.turnId, input.turnId),
+      eq(threadHistoryItems.itemId, input.itemId)
+    )
+  ).get();
+  if (existing) {
+    db.update(threadHistoryItems).set({
+      itemJson: input.itemJson,
+      updatedAt: now
+    }).where(eq(threadHistoryItems.id, existing.id)).run();
+    return;
+  }
+  db.insert(threadHistoryItems).values({
+    id: randomUUID(),
+    threadId: input.threadId,
+    turnId: input.turnId,
+    itemId: input.itemId,
+    itemJson: input.itemJson,
+    createdAt: now,
+    updatedAt: now
+  }).run();
+}
+function deleteThreadHistoryItemRecordsByThreadId(db, threadId) {
+  db.delete(threadHistoryItems).where(eq(threadHistoryItems.threadId, threadId)).run();
+}
 function listThreadPendingSteerRecordsByThreadId(db, threadId) {
   return db.select().from(threadPendingSteers).where(eq(threadPendingSteers.threadId, threadId)).orderBy(threadPendingSteers.createdAt).all();
 }
@@ -8439,6 +8559,19 @@ var DEFERRED_TOOL_DETAIL_TITLE = "Tool Call Details";
 var CONTEXT_BASELINE_TOKENS = 12e3;
 var FAST_MODE_NOTE_ON = "Fast mode on";
 var FAST_MODE_NOTE_OFF = "Fast mode off";
+var HOOK_EVENT_JSON_KEYS = {
+  preToolUse: "PreToolUse",
+  permissionRequest: "PermissionRequest",
+  postToolUse: "PostToolUse",
+  preCompact: "PreCompact",
+  postCompact: "PostCompact",
+  sessionStart: "SessionStart",
+  userPromptSubmit: "UserPromptSubmit",
+  stop: "Stop"
+};
+var HOOK_EVENT_DTO_KEYS = Object.fromEntries(
+  Object.entries(HOOK_EVENT_JSON_KEYS).map(([dtoKey, jsonKey]) => [jsonKey, dtoKey])
+);
 var GOAL_FEATURE_DISABLED_MESSAGE = "Codex /goal is experimental. Enable it by adding `goals = true` under `[features]` in ~/.codex/config.toml, then restart the Codex app-server.";
 function toIsoFromEpoch(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
@@ -8606,6 +8739,14 @@ function isRemoteThreadBootstrapError(error) {
   }
   return error.message.includes("includeTurns is unavailable before first user message") || error.message.includes("is not materialized yet") || error.message.includes("no rollout found for thread id") || error.message.includes("failed to load rollout") || error.message.includes("rollout at") && error.message.includes("is empty");
 }
+function isUnsupportedHooksListError(error) {
+  if (!(error instanceof JsonRpcClientError) || error.code !== "remote_error") {
+    return false;
+  }
+  const remoteCode = error.details?.code;
+  const message = error.message.toLowerCase();
+  return remoteCode === -32601 || message.includes("endpoint not found") || message.includes("method not found") || message.includes("hooks/list") && message.includes("not found");
+}
 function parseTurnSteerRace(error) {
   if (!(error instanceof JsonRpcClientError) || error.code !== "remote_error") {
     return null;
@@ -8962,6 +9103,39 @@ function summarizeCommandText(text2) {
   const lines = normalizeTextLines(text2);
   return lines.find((line) => line.trim().length > 0) ?? lines[0] ?? "Command output";
 }
+function decodeXmlEntities(value) {
+  return value.replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&gt;/g, ">").replace(/&lt;/g, "<").replace(/&amp;/g, "&");
+}
+function textFromUnknown(value) {
+  if (typeof value === "string") {
+    return value.trim() ? value : null;
+  }
+  if (Array.isArray(value)) {
+    const parts = value.map((entry) => textFromUnknown(entry)).filter((entry) => Boolean(entry));
+    return parts.length > 0 ? parts.join(" ") : null;
+  }
+  return null;
+}
+function parseHookPromptText(text2) {
+  const match = text2.trim().match(/^<hook_prompt(?:\s+hook_run_id="([^"]+)")?>([\s\S]*)<\/hook_prompt>$/);
+  if (!match) {
+    return null;
+  }
+  const hookRunId = match[1] ? decodeXmlEntities(match[1]) : null;
+  const output = decodeXmlEntities(match[2] ?? "").trim();
+  const eventName = hookRunId?.split(":")[0] ?? "hook";
+  const eventLabel = hookEventLabel(eventName);
+  const sourcePath = hookRunId?.split(":").slice(2).join(":") || null;
+  const outputEntries = output ? [{ kind: "warning", text: output }] : [];
+  return {
+    hookRunId,
+    output,
+    outputEntries,
+    eventName,
+    eventLabel,
+    sourcePath
+  };
+}
 function safeJsonStringify(value) {
   try {
     const serialized = JSON.stringify(value, null, 2);
@@ -8989,6 +9163,32 @@ function deferCommandHistoryItem(item, deferredDetails) {
     hasDeferredDetail: true
   };
 }
+function formatCommandHistoryItem(item, deferredDetails) {
+  const nestedRecords = [
+    item,
+    isRecord(item.action) ? item.action : null,
+    isRecord(item.result) ? item.result : null
+  ].filter((candidate) => Boolean(candidate));
+  const commandText = textFromUnknown(valueFromNestedRecords(nestedRecords, ["command", "cmd", "argv"])) ?? stringOrNull(item.text) ?? "Command output";
+  const outputText = textFromUnknown(
+    valueFromNestedRecords(nestedRecords, [
+      "aggregatedOutput",
+      "aggregated_output",
+      "output",
+      "stdout",
+      "stderr",
+      "text"
+    ])
+  ) ?? null;
+  const detailText = [commandText, outputText].filter(Boolean).join("\n\n");
+  const historyItem = {
+    id: item.id,
+    kind: "commandExecution",
+    text: detailText,
+    status: item.status ?? null
+  };
+  return deferredDetails ? deferCommandHistoryItem(historyItem, deferredDetails) : historyItem;
+}
 function deferToolCallHistoryItem(item, deferredDetails) {
   const fullText = item.detailText?.trim() || item.text || "Tool call";
   deferredDetails.set(item.id, {
@@ -9102,6 +9302,129 @@ function deferLargeHistoryItemDetails(turn, deferredDetails) {
     )
   };
 }
+function shouldPersistLiveHistoryItem(item) {
+  return item.kind === "commandExecution" || item.kind === "fileChange" || item.kind === "hook" || item.kind === "toolCall" || item.kind === "webSearch";
+}
+function parseStoredHistoryItem(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object" && typeof parsed.id === "string" && typeof parsed.kind === "string" && typeof parsed.text === "string") {
+      return parsed;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function hasHistoryItemSequence(item) {
+  return typeof item.sequence === "number" && Number.isFinite(item.sequence);
+}
+function historyItemSequence(item) {
+  return hasHistoryItemSequence(item) ? item.sequence : Number.POSITIVE_INFINITY;
+}
+function sortHistoryItemsBySequence(items) {
+  if (!items.some(hasHistoryItemSequence)) {
+    return items;
+  }
+  return items.map((item, index) => ({ item, index })).sort((left, right) => {
+    const sequenceDelta = historyItemSequence(left.item) - historyItemSequence(right.item);
+    return sequenceDelta === 0 ? left.index - right.index : sequenceDelta;
+  }).map((entry) => entry.item);
+}
+function sortTurnItemsByRecordedSequence(items) {
+  const leadingItems = [];
+  let index = 0;
+  while (index < items.length && items[index]?.kind === "userMessage" && !hasHistoryItemSequence(items[index])) {
+    leadingItems.push(items[index]);
+    index += 1;
+  }
+  return [...leadingItems, ...sortHistoryItemsBySequence(items.slice(index))];
+}
+function mergeHistoryItemsBySequence(items, missingItems) {
+  if (missingItems.length === 0) {
+    return items;
+  }
+  if (!missingItems.some(hasHistoryItemSequence)) {
+    return [...items, ...missingItems];
+  }
+  const mergedItems = [...items];
+  const orderedMissingItems = sortHistoryItemsBySequence(missingItems);
+  for (const missingItem of orderedMissingItems) {
+    if (!hasHistoryItemSequence(missingItem)) {
+      mergedItems.push(missingItem);
+      continue;
+    }
+    const firstGreaterIndex = mergedItems.findIndex(
+      (item) => hasHistoryItemSequence(item) && historyItemSequence(item) > historyItemSequence(missingItem)
+    );
+    if (firstGreaterIndex >= 0) {
+      mergedItems.splice(firstGreaterIndex, 0, missingItem);
+      continue;
+    }
+    const lastLowerIndex = mergedItems.findLastIndex(
+      (item) => hasHistoryItemSequence(item) && historyItemSequence(item) < historyItemSequence(missingItem)
+    );
+    if (lastLowerIndex >= 0) {
+      mergedItems.splice(lastLowerIndex + 1, 0, missingItem);
+      continue;
+    }
+    mergedItems.push(missingItem);
+  }
+  return mergedItems;
+}
+function mergePersistedHistoryItemsIntoTurns(turns, persistedItemsByTurnId, deferredDetails) {
+  if (persistedItemsByTurnId.size === 0) {
+    return turns;
+  }
+  return turns.map((turn) => {
+    if (turn.status === "inProgress") {
+      return turn;
+    }
+    const persistedItems = persistedItemsByTurnId.get(turn.id);
+    if (!persistedItems || persistedItems.length === 0) {
+      return turn;
+    }
+    let changed = false;
+    const persistedItemsById = new Map(persistedItems.map((item) => [item.id, item]));
+    const nextItems = turn.items.map((item) => {
+      const persistedItem = persistedItemsById.get(item.id);
+      if (!persistedItem || item.kind !== persistedItem.kind || persistedItem.kind !== "commandExecution" && persistedItem.kind !== "toolCall") {
+        return item;
+      }
+      const existingText = item.detailText?.trim() || item.text.trim();
+      const persistedText = persistedItem.detailText?.trim() || persistedItem.text.trim();
+      if (persistedText.length <= existingText.length) {
+        return item;
+      }
+      changed = true;
+      persistedItemsById.delete(item.id);
+      return persistedItem.kind === "commandExecution" ? deferCommandHistoryItem(
+        persistedItem,
+        deferredDetails
+      ) : deferToolCallHistoryItem(
+        persistedItem,
+        deferredDetails
+      );
+    });
+    const existingItemIds = new Set(nextItems.map((item) => item.id));
+    const missingItems = [...persistedItemsById.values()].filter((item) => !existingItemIds.has(item.id)).map(
+      (item) => item.kind === "commandExecution" ? deferCommandHistoryItem(
+        item,
+        deferredDetails
+      ) : item.kind === "toolCall" ? deferToolCallHistoryItem(
+        item,
+        deferredDetails
+      ) : item
+    );
+    if (missingItems.length === 0 && !changed) {
+      return turn;
+    }
+    return {
+      ...turn,
+      items: mergeHistoryItemsBySequence(nextItems, missingItems)
+    };
+  });
+}
 function sanitizeAttachmentFileName(originalName) {
   const basename = path8.basename(originalName).trim() || "attachment";
   const extension = path8.extname(basename).replace(/[^a-zA-Z0-9.]/g, "");
@@ -9473,6 +9796,25 @@ function formatFileChangeHistoryItem(item) {
   };
 }
 function itemToHistoryItem(item, deferredDetails) {
+  const hookPrompt = parseHookPromptText(codexItemText(item));
+  if (hookPrompt) {
+    return {
+      id: `hook-prompt:${hookPrompt.hookRunId ?? item.id}`,
+      kind: "hook",
+      text: `${hookPrompt.eventLabel} hook`,
+      previewText: hookPrompt.output || `${hookPrompt.eventLabel} hook`,
+      detailText: hookPrompt.output || null,
+      status: "Completed",
+      hookEventName: hookPrompt.eventName,
+      hookEventLabel: hookPrompt.eventLabel,
+      hookHandlerType: "command",
+      hookScope: "turn",
+      hookSource: hookPrompt.sourcePath ? "project" : null,
+      hookSourcePath: hookPrompt.sourcePath,
+      hookStatusMessage: null,
+      hookOutputEntries: hookPrompt.outputEntries
+    };
+  }
   switch (item.type) {
     case "userMessage":
       return {
@@ -9508,20 +9850,7 @@ function itemToHistoryItem(item, deferredDetails) {
         text: [item.summary?.join("\n") ?? "", item.text ?? ""].filter(Boolean).join("\n\n")
       };
     case "commandExecution":
-      return deferredDetails ? deferCommandHistoryItem(
-        {
-          id: item.id,
-          kind: "commandExecution",
-          text: [item.command ?? "", item.aggregatedOutput ?? ""].filter(Boolean).join("\n\n"),
-          status: item.status ?? null
-        },
-        deferredDetails
-      ) : {
-        id: item.id,
-        kind: "commandExecution",
-        text: [item.command ?? "", item.aggregatedOutput ?? ""].filter(Boolean).join("\n\n"),
-        status: item.status ?? null
-      };
+      return formatCommandHistoryItem(item, deferredDetails);
     case "webSearch":
     case "web_search":
     case "webSearchCall":
@@ -9547,9 +9876,8 @@ function itemToHistoryItem(item, deferredDetails) {
   }
 }
 function liveCodexItemToHistoryItem(item, phase) {
-  const deferredDetails = /* @__PURE__ */ new Map();
-  const historyItem = itemToHistoryItem(item, deferredDetails);
-  if (historyItem.kind !== "commandExecution" && historyItem.kind !== "toolCall") {
+  const historyItem = itemToHistoryItem(item);
+  if (historyItem.kind !== "commandExecution" && historyItem.kind !== "toolCall" && historyItem.kind !== "fileChange" && historyItem.kind !== "webSearch") {
     return null;
   }
   return {
@@ -9557,6 +9885,373 @@ function liveCodexItemToHistoryItem(item, phase) {
     status: historyItem.status ?? (phase === "started" ? "running" : "completed")
   };
 }
+function hookEventLabel(value) {
+  switch (value) {
+    case "preToolUse":
+      return "PreToolUse";
+    case "permissionRequest":
+      return "PermissionRequest";
+    case "postToolUse":
+      return "PostToolUse";
+    case "preCompact":
+      return "PreCompact";
+    case "postCompact":
+      return "PostCompact";
+    case "sessionStart":
+      return "SessionStart";
+    case "userPromptSubmit":
+      return "UserPromptSubmit";
+    case "stop":
+      return "Stop";
+    default:
+      return value;
+  }
+}
+function hookStatusLabel(value) {
+  switch (value) {
+    case "running":
+      return "Running";
+    case "completed":
+      return "Completed";
+    case "failed":
+      return "Failed";
+    case "blocked":
+      return "Blocked";
+    case "stopped":
+      return "Stopped";
+    default:
+      return value;
+  }
+}
+function hookRunOutputEntryText(entry) {
+  if (!isRecord(entry)) {
+    return textFromUnknown(entry);
+  }
+  return textFromUnknown(entry.text) ?? textFromUnknown(entry.message) ?? textFromUnknown(entry.systemMessage) ?? textFromUnknown(entry.stopReason) ?? textFromUnknown(entry.reason) ?? textFromUnknown(entry.output) ?? textFromUnknown(entry.stdout) ?? textFromUnknown(entry.stderr);
+}
+function normalizeHookRunOutputEntries(run) {
+  const rawEntries = Array.isArray(run.entries) ? run.entries : Array.isArray(run.outputEntries) ? run.outputEntries : Array.isArray(run.output_entries) ? run.output_entries : [];
+  const entries = rawEntries.map((entry) => {
+    const text2 = hookRunOutputEntryText(entry)?.trim();
+    if (!text2) {
+      return null;
+    }
+    return {
+      kind: typeof entry.kind === "string" && entry.kind.trim() ? entry.kind : "context",
+      text: text2
+    };
+  }).filter((entry) => Boolean(entry));
+  const seenTexts = new Set(entries.map((entry) => entry.text));
+  for (const [kind, value] of [
+    ["context", run.output],
+    ["context", run.text],
+    ["warning", run.systemMessage],
+    ["warning", run.stopReason],
+    ["warning", run.reason],
+    ["context", run.stdout],
+    ["warning", run.stderr]
+  ]) {
+    const text2 = textFromUnknown(value)?.trim();
+    if (text2 && !seenTexts.has(text2)) {
+      entries.push({ kind, text: text2 });
+      seenTexts.add(text2);
+    }
+  }
+  return entries;
+}
+function hookRunToHistoryItem(run) {
+  const eventLabel = hookEventLabel(run.eventName);
+  const outputEntries = normalizeHookRunOutputEntries(run);
+  const entryPreview = outputEntries.map((entry) => entry.text.trim()).filter(Boolean).join("\n").trim();
+  const firstEntryLine = entryPreview.split("\n").find(Boolean) ?? null;
+  const detailLines = [
+    `Event: ${eventLabel}`,
+    `Status: ${hookStatusLabel(run.status)}`,
+    `Handler: ${run.handlerType}`,
+    `Scope: ${run.scope}`,
+    `Source: ${run.source}`,
+    `Path: ${run.sourcePath}`,
+    run.durationMs !== null ? `Duration: ${run.durationMs} ms` : null,
+    run.statusMessage ? `Message: ${run.statusMessage}` : null,
+    entryPreview ? `
+${entryPreview}` : null
+  ].filter((line) => Boolean(line));
+  return {
+    id: `hook:${run.id}`,
+    kind: "hook",
+    text: `${eventLabel} hook`,
+    previewText: run.statusMessage ?? firstEntryLine ?? `${eventLabel} hook`,
+    detailText: detailLines.join("\n"),
+    status: hookStatusLabel(run.status),
+    hookEventName: run.eventName,
+    hookEventLabel: eventLabel,
+    hookHandlerType: run.handlerType,
+    hookScope: run.scope,
+    hookSource: run.source,
+    hookSourcePath: run.sourcePath,
+    hookStatusMessage: run.statusMessage,
+    hookOutputEntries: outputEntries
+  };
+}
+function normalizeHooksJson(value) {
+  if (!isRecord(value) || !isRecord(value.hooks)) {
+    return { hooks: {} };
+  }
+  const hooks = {};
+  for (const [eventName, groups] of Object.entries(value.hooks)) {
+    hooks[eventName] = Array.isArray(groups) ? groups : [];
+  }
+  return { ...value, hooks };
+}
+function readJsonFileOrDefault(filePath) {
+  return fs8.readFile(filePath, "utf8").then((raw) => {
+    if (!raw.trim()) {
+      return { hooks: {} };
+    }
+    return normalizeHooksJson(JSON.parse(raw));
+  }).catch((error) => {
+    if (error.code === "ENOENT") {
+      return { hooks: {} };
+    }
+    throw error;
+  });
+}
+function validateHookInput(input) {
+  if (!HOOK_EVENT_JSON_KEYS[input.eventName]) {
+    throw new HttpError(400, {
+      code: "bad_request",
+      message: "Unsupported hook event."
+    });
+  }
+  if (input.scope !== "global" && input.scope !== "project") {
+    throw new HttpError(400, {
+      code: "bad_request",
+      message: "Hook scope must be global or project."
+    });
+  }
+  if (!input.command.trim()) {
+    throw new HttpError(400, {
+      code: "bad_request",
+      message: "Hook command cannot be empty."
+    });
+  }
+  if (input.timeoutSec !== void 0 && input.timeoutSec !== null && (!Number.isInteger(input.timeoutSec) || input.timeoutSec <= 0 || input.timeoutSec > 86400)) {
+    throw new HttpError(400, {
+      code: "bad_request",
+      message: "Hook timeout must be a positive number of seconds."
+    });
+  }
+}
+async function writeHookJsonEntry({
+  codexHome,
+  workspacePath,
+  input
+}) {
+  validateHookInput(input);
+  const hooksPath = input.scope === "global" ? path8.join(codexHome, "hooks.json") : path8.join(workspacePath, ".codex", "hooks.json");
+  const config = await readJsonFileOrDefault(hooksPath);
+  const eventKey = HOOK_EVENT_JSON_KEYS[input.eventName];
+  const matcher = input.matcher?.trim() || null;
+  const handler = {
+    type: "command",
+    command: input.command.trim()
+  };
+  if (input.timeoutSec !== void 0 && input.timeoutSec !== null) {
+    handler.timeout = input.timeoutSec;
+  }
+  if (input.statusMessage?.trim()) {
+    handler.statusMessage = input.statusMessage.trim();
+  }
+  const group = {
+    hooks: [handler]
+  };
+  if (matcher) {
+    group.matcher = matcher;
+  }
+  const currentGroups = Array.isArray(config.hooks[eventKey]) ? config.hooks[eventKey] : [];
+  config.hooks[eventKey] = [...currentGroups, group];
+  await fs8.mkdir(path8.dirname(hooksPath), { recursive: true });
+  await fs8.writeFile(hooksPath, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+function hookInputMatches(group, handler, input) {
+  if (!isRecord(group) || !isRecord(handler)) {
+    return false;
+  }
+  const matcher = typeof group.matcher === "string" ? group.matcher : null;
+  const handlerCommand = typeof handler.command === "string" ? handler.command : "";
+  const handlerTimeout = typeof handler.timeout === "number" && Number.isFinite(handler.timeout) ? handler.timeout : null;
+  const handlerStatusMessage = typeof handler.statusMessage === "string" ? handler.statusMessage : null;
+  return handler.type === "command" && (input.matcher?.trim() || null) === matcher && input.command.trim() === handlerCommand && (input.timeoutSec ?? null) === handlerTimeout && (input.statusMessage?.trim() || null) === handlerStatusMessage;
+}
+async function updateHookJsonEntry({
+  codexHome,
+  workspacePath,
+  input
+}) {
+  validateHookInput(input);
+  validateHookInput(input.target);
+  if (input.scope !== input.target.scope) {
+    throw new HttpError(400, {
+      code: "bad_request",
+      message: "Hook scope cannot be changed while editing."
+    });
+  }
+  const hooksPath = input.scope === "global" ? path8.join(codexHome, "hooks.json") : path8.join(workspacePath, ".codex", "hooks.json");
+  const config = await readJsonFileOrDefault(hooksPath);
+  const targetEventKey = HOOK_EVENT_JSON_KEYS[input.target.eventName];
+  const nextEventKey = HOOK_EVENT_JSON_KEYS[input.eventName];
+  const currentGroups = Array.isArray(config.hooks[targetEventKey]) ? config.hooks[targetEventKey] : [];
+  let replacementGroup = null;
+  config.hooks[targetEventKey] = currentGroups.map((group) => {
+    if (replacementGroup || !isRecord(group) || !Array.isArray(group.hooks)) {
+      return group;
+    }
+    const hookIndex = group.hooks.findIndex(
+      (handler2) => hookInputMatches(group, handler2, input.target)
+    );
+    if (hookIndex < 0) {
+      return group;
+    }
+    const handler = {
+      type: "command",
+      command: input.command.trim()
+    };
+    if (input.timeoutSec !== void 0 && input.timeoutSec !== null) {
+      handler.timeout = input.timeoutSec;
+    }
+    if (input.statusMessage?.trim()) {
+      handler.statusMessage = input.statusMessage.trim();
+    }
+    replacementGroup = {
+      hooks: [handler]
+    };
+    const matcher = input.matcher?.trim() || null;
+    if (matcher) {
+      replacementGroup.matcher = matcher;
+    }
+    if (targetEventKey !== nextEventKey) {
+      const remainingHooks = group.hooks.filter((_, index) => index !== hookIndex);
+      return {
+        ...group,
+        hooks: remainingHooks
+      };
+    }
+    return {
+      ...replacementGroup,
+      hooks: group.hooks.map(
+        (existing, index) => index === hookIndex ? replacementGroup.hooks[0] : existing
+      )
+    };
+  }).filter((group) => {
+    if (!isRecord(group) || !Array.isArray(group.hooks)) {
+      return true;
+    }
+    return group.hooks.length > 0;
+  });
+  if (!replacementGroup) {
+    throw new HttpError(404, {
+      code: "not_found",
+      message: "Hook was not found in hooks.json."
+    });
+  }
+  if (targetEventKey !== nextEventKey) {
+    if (config.hooks[targetEventKey]?.length === 0) {
+      delete config.hooks[targetEventKey];
+    }
+    const nextGroups = Array.isArray(config.hooks[nextEventKey]) ? config.hooks[nextEventKey] : [];
+    config.hooks[nextEventKey] = [...nextGroups, replacementGroup];
+  }
+  await fs8.mkdir(path8.dirname(hooksPath), { recursive: true });
+  await fs8.writeFile(hooksPath, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+async function readLocalHookDtos({
+  hooksPath,
+  source,
+  displayOffset
+}) {
+  const config = await readJsonFileOrDefault(hooksPath);
+  const hooks = [];
+  for (const [eventKey, groups] of Object.entries(config.hooks)) {
+    const eventName = HOOK_EVENT_DTO_KEYS[eventKey];
+    if (!eventName || !Array.isArray(groups)) {
+      continue;
+    }
+    groups.forEach((group, groupIndex) => {
+      if (!isRecord(group) || !Array.isArray(group.hooks)) {
+        return;
+      }
+      const matcher = typeof group.matcher === "string" ? group.matcher : null;
+      group.hooks.forEach((handler, handlerIndex) => {
+        if (!isRecord(handler) || handler.type !== "command") {
+          return;
+        }
+        const command = typeof handler.command === "string" ? handler.command : null;
+        if (!command) {
+          return;
+        }
+        const timeoutSec = typeof handler.timeout === "number" && Number.isFinite(handler.timeout) ? handler.timeout : 600;
+        const statusMessage = typeof handler.statusMessage === "string" ? handler.statusMessage : null;
+        const key = `${source}:${hooksPath}:${eventKey}:${groupIndex}:${handlerIndex}`;
+        hooks.push({
+          key,
+          eventName,
+          handlerType: "command",
+          matcher,
+          command,
+          timeoutSec,
+          statusMessage,
+          sourcePath: hooksPath,
+          source,
+          pluginId: null,
+          displayOrder: displayOffset + hooks.length,
+          enabled: true,
+          isManaged: false,
+          currentHash: "",
+          trustStatus: "untrusted"
+        });
+      });
+    });
+  }
+  return hooks;
+}
+function hookMatchesInput(hook, input) {
+  return hook.source === input.scope && hook.eventName === input.eventName && (hook.matcher ?? null) === (input.matcher ?? null) && hook.command === input.command && (input.timeoutSec == null || hook.timeoutSec === input.timeoutSec) && (hook.statusMessage ?? null) === (input.statusMessage ?? null);
+}
+async function findOfficialHookForInput(codexManager, workspacePath, input) {
+  const [entry] = await codexManager.listHooks({
+    cwds: [workspacePath]
+  });
+  const officialHooks = (entry?.hooks ?? []).map((hook) => ({
+    key: hook.key,
+    eventName: hook.eventName,
+    handlerType: hook.handlerType,
+    matcher: hook.matcher,
+    command: hook.command,
+    timeoutSec: hook.timeoutSec,
+    statusMessage: hook.statusMessage,
+    sourcePath: hook.sourcePath,
+    source: hook.source,
+    pluginId: hook.pluginId,
+    displayOrder: hook.displayOrder,
+    enabled: hook.enabled,
+    isManaged: hook.isManaged,
+    currentHash: hook.currentHash,
+    trustStatus: hook.trustStatus
+  }));
+  return officialHooks.find((hook) => hookMatchesInput(hook, input)) ?? null;
+}
+async function trustHookForInput(codexManager, workspacePath, input) {
+  const hook = await findOfficialHookForInput(codexManager, workspacePath, input);
+  if (!hook || !hook.key || !hook.currentHash || hook.isManaged) {
+    return;
+  }
+  await codexManager.setHookTrust({
+    key: hook.key,
+    trustedHash: hook.currentHash
+  });
+}
 function normalizeOptionLabelForApproval(value) {
   return value.replace(/\s*\(recommended\)\s*$/i, "").trim().toLowerCase();
 }
@@ -9566,7 +10261,7 @@ function isAllowOptionLabel(value) {
 }
 function isLikelyPositiveApprovalOption(value) {
   const normalized = normalizeOptionLabelForApproval(value);
-  return isAllowOptionLabel(value) || /^(yes|continue|proceed|trust|always|once|ok)\b/.test(normalized);
+  return isAllowOptionLabel(normalized) || /\b(allow|approve|yes|continue|proceed|trust)\b/.test(normalized);
 }
 function isLikelyApprovalPrompt(requestMethod, questions) {
   const methodText = requestMethod.toLowerCase();
@@ -9782,6 +10477,31 @@ function turnToDto(turn, deferredDetails) {
     items: turn.items.map((item) => itemToHistoryItem(item, deferredDetails))
   };
 }
+function applyRecordedTurnItemOrder(turn, turnItemOrder) {
+  const itemOrder = turnItemOrder.get(turn.id);
+  if (!itemOrder || itemOrder.size === 0) {
+    return turn;
+  }
+  let changed = false;
+  const items = turn.items.map((item) => {
+    const sequence = itemOrder.get(item.id);
+    if (sequence === void 0 || item.sequence === sequence) {
+      return item;
+    }
+    changed = true;
+    return {
+      ...item,
+      sequence
+    };
+  });
+  return changed ? { ...turn, items: sortTurnItemsByRecordedSequence(items) } : turn;
+}
+function applyRecordedTurnItemOrders(turns, turnItemOrder) {
+  if (turnItemOrder.size === 0) {
+    return turns;
+  }
+  return turns.map((turn) => applyRecordedTurnItemOrder(turn, turnItemOrder));
+}
 function buildTurnDto(turn, metadata) {
   const tokenUsage = parseThreadTurnTokenUsageJson(metadata?.tokenUsageJson);
   return {
@@ -9867,6 +10587,8 @@ var ThreadService = class {
   threadCumulativeTokenUsage = /* @__PURE__ */ new Map();
   threadLivePlans = /* @__PURE__ */ new Map();
   threadLiveItems = /* @__PURE__ */ new Map();
+  threadTurnItemOrder = /* @__PURE__ */ new Map();
+  threadNextTurnItemSequence = /* @__PURE__ */ new Map();
   answeredRequestNotes = /* @__PURE__ */ new Map();
   getLatestStoredThreadCumulativeTotal(localThreadId, options = {}) {
     const metadata = listThreadTurnMetadataByThreadId(this.db, localThreadId).filter((entry) => entry.turnId !== options.excludeTurnId).sort((left, right) => {
@@ -9923,6 +10645,30 @@ var ThreadService = class {
       emitEvent
     );
   }
+  listPersistedHistoryItemsByTurnId(localThreadId) {
+    const itemsByTurnId = /* @__PURE__ */ new Map();
+    for (const record of listThreadHistoryItemRecordsByThreadId(this.db, localThreadId)) {
+      const item = parseStoredHistoryItem(record.itemJson);
+      if (!item) {
+        continue;
+      }
+      const current = itemsByTurnId.get(record.turnId) ?? [];
+      current.push(item);
+      itemsByTurnId.set(record.turnId, current);
+    }
+    return itemsByTurnId;
+  }
+  persistLiveHistoryItem(localThreadId, turnId, item) {
+    if (!shouldPersistLiveHistoryItem(item)) {
+      return;
+    }
+    upsertThreadHistoryItemRecord(this.db, {
+      threadId: localThreadId,
+      turnId,
+      itemId: item.id,
+      itemJson: JSON.stringify(item)
+    });
+  }
   async buildThreadDetailCacheEntry(localThreadId, record, turnMetadataById) {
     const cached = this.getThreadDetailCache(localThreadId);
     if (cached) {
@@ -9939,7 +10685,15 @@ var ThreadService = class {
     if (!remoteThread) {
       const localSession = await this.localSessionStore.findSession(record.codexThreadId);
       const deferredDetails2 = /* @__PURE__ */ new Map();
-      const turns2 = (localSession?.turns ?? []).map(
+      const persistedItemsByTurnId2 = this.listPersistedHistoryItemsByTurnId(localThreadId);
+      const turns2 = mergePersistedHistoryItemsIntoTurns(
+        applyRecordedTurnItemOrders(
+          localSession?.turns ?? [],
+          this.turnItemOrderSnapshot(localThreadId)
+        ),
+        persistedItemsByTurnId2,
+        deferredDetails2
+      ).map(
         (turn) => buildTurnDto(
           deferLargeHistoryItemDetails(turn, deferredDetails2),
           turnMetadataById.get(turn.id)
@@ -9971,8 +10725,16 @@ var ThreadService = class {
     );
     this.reconcilePendingSteers(updated.id, remoteThread);
     const deferredDetails = /* @__PURE__ */ new Map();
-    const turns = remoteThread.turns.map(
-      (turn) => buildTurnDto(turnToDto(turn, deferredDetails), turnMetadataById.get(turn.id))
+    const persistedItemsByTurnId = this.listPersistedHistoryItemsByTurnId(localThreadId);
+    const turns = mergePersistedHistoryItemsIntoTurns(
+      applyRecordedTurnItemOrders(
+        remoteThread.turns.map((turn) => turnToDto(turn, deferredDetails)),
+        this.turnItemOrderSnapshot(localThreadId)
+      ),
+      persistedItemsByTurnId,
+      deferredDetails
+    ).map(
+      (turn) => buildTurnDto(turn, turnMetadataById.get(turn.id))
     );
     const entry = {
       turns,
@@ -11080,6 +11842,125 @@ var ThreadService = class {
       }))
     };
   }
+  async listThreadHooks(localThreadId) {
+    const record = getThreadRecordById(this.db, localThreadId);
+    if (!record) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Thread was not found."
+      });
+    }
+    const workspace = getWorkspaceRecordById(this.db, record.workspaceId);
+    if (!workspace) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Workspace was not found for this thread."
+      });
+    }
+    let entry;
+    let fallbackWarnings = [];
+    try {
+      [entry] = await this.codexManager.listHooks({
+        cwds: [workspace.absPath]
+      });
+    } catch (error) {
+      if (!isUnsupportedHooksListError(error)) {
+        throw error;
+      }
+      fallbackWarnings = [
+        "Codex app-server does not expose hooks/list yet; showing hooks parsed from hooks.json only."
+      ];
+    }
+    return this.toThreadHooksDto(workspace.absPath, entry, fallbackWarnings);
+  }
+  async createThreadHook(localThreadId, input) {
+    const record = getThreadRecordById(this.db, localThreadId);
+    if (!record) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Thread was not found."
+      });
+    }
+    const workspace = getWorkspaceRecordById(this.db, record.workspaceId);
+    if (!workspace) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Workspace was not found for this thread."
+      });
+    }
+    await writeHookJsonEntry({
+      codexHome: this.codexHome,
+      workspacePath: workspace.absPath,
+      input
+    });
+    await trustHookForInput(this.codexManager, workspace.absPath, input);
+    return this.listThreadHooks(localThreadId);
+  }
+  async updateThreadHook(localThreadId, input) {
+    const record = getThreadRecordById(this.db, localThreadId);
+    if (!record) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Thread was not found."
+      });
+    }
+    const workspace = getWorkspaceRecordById(this.db, record.workspaceId);
+    if (!workspace) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Workspace was not found for this thread."
+      });
+    }
+    await updateHookJsonEntry({
+      codexHome: this.codexHome,
+      workspacePath: workspace.absPath,
+      input
+    });
+    await trustHookForInput(this.codexManager, workspace.absPath, input);
+    return this.listThreadHooks(localThreadId);
+  }
+  async trustThreadHook(localThreadId, input) {
+    const record = getThreadRecordById(this.db, localThreadId);
+    if (!record) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Thread was not found."
+      });
+    }
+    const workspace = getWorkspaceRecordById(this.db, record.workspaceId);
+    if (!workspace) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Workspace was not found for this thread."
+      });
+    }
+    await this.codexManager.setHookTrust({
+      key: input.key,
+      trustedHash: input.currentHash
+    });
+    return this.listThreadHooks(localThreadId);
+  }
+  async untrustThreadHook(localThreadId, input) {
+    const record = getThreadRecordById(this.db, localThreadId);
+    if (!record) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Thread was not found."
+      });
+    }
+    const workspace = getWorkspaceRecordById(this.db, record.workspaceId);
+    if (!workspace) {
+      throw new HttpError(404, {
+        code: "not_found",
+        message: "Workspace was not found for this thread."
+      });
+    }
+    await this.codexManager.setHookTrust({
+      key: input.key,
+      trustedHash: null
+    });
+    return this.listThreadHooks(localThreadId);
+  }
   async interruptThread(localThreadId, requestedTurnId) {
     const record = getThreadRecordById(this.db, localThreadId);
     if (!record || !record.codexThreadId) {
@@ -11129,6 +12010,7 @@ var ThreadService = class {
     this.threadContextUsage.delete(localThreadId);
     this.threadLivePlans.delete(localThreadId);
     this.threadLiveItems.delete(localThreadId);
+    this.clearRecordedTurnItemOrders(localThreadId);
     this.answeredRequestNotes.delete(localThreadId);
     deleteViewerSessionsByThreadId(this.db, localThreadId);
     deleteNotificationsByThreadId(this.db, localThreadId);
@@ -11136,6 +12018,7 @@ var ThreadService = class {
     deleteThreadForkRecordsByForkedThreadId(this.db, localThreadId);
     deleteThreadActivityNotesByThreadId(this.db, localThreadId);
     deleteThreadGoalRecordsByThreadId(this.db, localThreadId);
+    deleteThreadHistoryItemRecordsByThreadId(this.db, localThreadId);
     deleteThreadPendingSteerRecordsByThreadId(this.db, localThreadId);
     deleteThreadTurnMetadataByThreadId(this.db, localThreadId);
     deleteThreadRecord(this.db, localThreadId);
@@ -11338,6 +12221,10 @@ var ThreadService = class {
           lastError: null,
           lastTurnStartedAt: (/* @__PURE__ */ new Date()).toISOString()
         });
+        this.resetRecordedTurnItemOrder(record.id, params.turn.id);
+        for (const item of params.turn.items) {
+          this.recordTurnItemOrder(record.id, params.turn.id, item.id);
+        }
         this.setLivePlan(record.id, null);
         this.setLiveItems(record.id, null);
         this.resetThreadContextUsage(record.id, true);
@@ -11365,6 +12252,33 @@ var ThreadService = class {
         });
         return;
       }
+      case "hook/started":
+      case "hook/completed": {
+        const params = event.params;
+        const record = getThreadRecordByCodexThreadId(this.db, params.threadId);
+        if (!record) {
+          return;
+        }
+        const turnId = params.turnId ?? record.codexTurnId;
+        if (!turnId) {
+          return;
+        }
+        const liveItem = {
+          ...hookRunToHistoryItem(params.run),
+          sequence: this.recordTurnItemOrder(record.id, turnId, `hook:${params.run.id}`)
+        };
+        this.persistLiveHistoryItem(record.id, turnId, liveItem);
+        this.upsertLiveItem(record.id, turnId, liveItem);
+        this.emitThreadEvent(
+          event.method === "hook/started" ? "thread.item.started" : "thread.item.completed",
+          record.id,
+          {
+            turnId,
+            item: liveItem
+          }
+        );
+        return;
+      }
       case "item/started":
       case "item/completed": {
         const params = event.params;
@@ -11372,6 +12286,11 @@ var ThreadService = class {
         if (!record || !params.item) {
           return;
         }
+        const sequence = this.recordTurnItemOrder(
+          record.id,
+          params.turnId,
+          params.item.id
+        );
         const liveItem = liveCodexItemToHistoryItem(
           params.item,
           event.method === "item/started" ? "started" : "completed"
@@ -11379,13 +12298,18 @@ var ThreadService = class {
         if (!liveItem) {
           return;
         }
-        this.upsertLiveItem(record.id, params.turnId, liveItem);
+        const orderedLiveItem = {
+          ...liveItem,
+          sequence
+        };
+        this.persistLiveHistoryItem(record.id, params.turnId, orderedLiveItem);
+        this.upsertLiveItem(record.id, params.turnId, orderedLiveItem);
         this.emitThreadEvent(
           event.method === "item/started" ? "thread.item.started" : "thread.item.completed",
           record.id,
           {
             turnId: params.turnId,
-            item: liveItem
+            item: orderedLiveItem
           }
         );
         return;
@@ -11415,6 +12339,7 @@ var ThreadService = class {
         if (!record) {
           return;
         }
+        this.recordTurnItemOrder(record.id, params.turnId, params.itemId);
         this.emitThreadEvent("thread.output.delta", record.id, {
           turnId: params.turnId,
           itemId: params.itemId,
@@ -11667,6 +12592,42 @@ var ThreadService = class {
     }
     this.threadLiveItems.delete(localThreadId);
   }
+  resetRecordedTurnItemOrder(localThreadId, turnId) {
+    this.threadTurnItemOrder.get(localThreadId)?.delete(turnId);
+    this.threadNextTurnItemSequence.get(localThreadId)?.delete(turnId);
+  }
+  clearRecordedTurnItemOrders(localThreadId) {
+    this.threadTurnItemOrder.delete(localThreadId);
+    this.threadNextTurnItemSequence.delete(localThreadId);
+  }
+  recordTurnItemOrder(localThreadId, turnId, itemId) {
+    let threadOrders = this.threadTurnItemOrder.get(localThreadId);
+    if (!threadOrders) {
+      threadOrders = /* @__PURE__ */ new Map();
+      this.threadTurnItemOrder.set(localThreadId, threadOrders);
+    }
+    let turnOrder = threadOrders.get(turnId);
+    if (!turnOrder) {
+      turnOrder = /* @__PURE__ */ new Map();
+      threadOrders.set(turnId, turnOrder);
+    }
+    const existing = turnOrder.get(itemId);
+    if (existing !== void 0) {
+      return existing;
+    }
+    let threadSequences = this.threadNextTurnItemSequence.get(localThreadId);
+    if (!threadSequences) {
+      threadSequences = /* @__PURE__ */ new Map();
+      this.threadNextTurnItemSequence.set(localThreadId, threadSequences);
+    }
+    const sequence = threadSequences.get(turnId) ?? 0;
+    threadSequences.set(turnId, sequence + 1);
+    turnOrder.set(itemId, sequence);
+    return sequence;
+  }
+  turnItemOrderSnapshot(localThreadId) {
+    return this.threadTurnItemOrder.get(localThreadId) ?? /* @__PURE__ */ new Map();
+  }
   getLiveItems(localThreadId, allTurns, visibleTurns = allTurns) {
     const current = this.threadLiveItems.get(localThreadId);
     if (!current) {
@@ -11688,10 +12649,65 @@ var ThreadService = class {
     ];
     this.setLiveItems(localThreadId, {
       turnId,
-      items: nextItems,
+      items: sortHistoryItemsBySequence(nextItems),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
+  async toThreadHooksDto(workspacePath, entry, fallbackWarnings = []) {
+    const globalHooksPath = path8.join(this.codexHome, "hooks.json");
+    const projectHooksPath = path8.join(workspacePath, ".codex", "hooks.json");
+    const officialHooks = (entry?.hooks ?? []).map((hook) => ({
+      key: hook.key,
+      eventName: hook.eventName,
+      handlerType: hook.handlerType,
+      matcher: hook.matcher,
+      command: hook.command,
+      timeoutSec: hook.timeoutSec,
+      statusMessage: hook.statusMessage,
+      sourcePath: hook.sourcePath,
+      source: hook.source,
+      pluginId: hook.pluginId,
+      displayOrder: hook.displayOrder,
+      enabled: hook.enabled,
+      isManaged: hook.isManaged,
+      currentHash: hook.currentHash,
+      trustStatus: hook.trustStatus
+    }));
+    const [globalHooks, projectHooks] = await Promise.all([
+      readLocalHookDtos({
+        hooksPath: globalHooksPath,
+        source: "user",
+        displayOffset: officialHooks.length
+      }),
+      readLocalHookDtos({
+        hooksPath: projectHooksPath,
+        source: "project",
+        displayOffset: officialHooks.length + 1e4
+      })
+    ]);
+    const hooksBySignature = /* @__PURE__ */ new Map();
+    for (const hook of [...globalHooks, ...projectHooks, ...officialHooks]) {
+      const signature = [
+        hook.sourcePath,
+        hook.eventName,
+        hook.matcher ?? "",
+        hook.command ?? "",
+        hook.timeoutSec,
+        hook.statusMessage ?? ""
+      ].join("\0");
+      hooksBySignature.set(signature, hook);
+    }
+    return {
+      cwd: entry?.cwd ?? workspacePath,
+      hooks: [...hooksBySignature.values()].sort(
+        (left, right) => left.displayOrder - right.displayOrder
+      ),
+      warnings: [...fallbackWarnings, ...entry?.warnings ?? []],
+      errors: entry?.errors ?? [],
+      globalHooksPath,
+      projectHooksPath
+    };
+  }
   reconcileLiveItems(localThreadId, turns) {
     const current = this.threadLiveItems.get(localThreadId);
     if (!current) {
@@ -12378,6 +13394,34 @@ var forkThreadSchema = z4.discriminatedUnion("mode", [
     turnId: z4.string().min(1)
   })
 ]);
+var hookEventNameSchema = z4.enum([
+  "preToolUse",
+  "permissionRequest",
+  "postToolUse",
+  "preCompact",
+  "postCompact",
+  "sessionStart",
+  "userPromptSubmit",
+  "stop"
+]);
+var createThreadHookSchema = z4.object({
+  scope: z4.enum(["global", "project"]),
+  eventName: hookEventNameSchema,
+  matcher: z4.string().nullable().optional(),
+  command: z4.string().trim().min(1),
+  timeoutSec: z4.number().int().positive().max(86400).nullable().optional(),
+  statusMessage: z4.string().nullable().optional()
+});
+var updateThreadHookSchema = createThreadHookSchema.extend({
+  target: createThreadHookSchema
+});
+var trustThreadHookSchema = z4.object({
+  key: z4.string().min(1),
+  currentHash: z4.string().min(1)
+});
+var untrustThreadHookSchema = z4.object({
+  key: z4.string().min(1)
+});
 var respondThreadRequestSchema = z4.object({
   answers: z4.record(z4.string(), z4.object({
     answers: z4.array(z4.string())
@@ -12749,6 +13793,54 @@ async function registerThreadRoutes(app2) {
     const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
     return app2.services.threadService.listThreadMcpServers(params.id);
   });
+  app2.get("/api/threads/:id/hooks", async (request) => {
+    const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
+    return app2.services.threadService.listThreadHooks(params.id);
+  });
+  app2.post("/api/threads/:id/hooks", async (request) => {
+    const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
+    const parsedBody = createThreadHookSchema.parse(request.body);
+    const body = {
+      scope: parsedBody.scope,
+      eventName: parsedBody.eventName,
+      command: parsedBody.command,
+      ...parsedBody.matcher !== void 0 ? { matcher: parsedBody.matcher } : {},
+      ...parsedBody.timeoutSec !== void 0 ? { timeoutSec: parsedBody.timeoutSec } : {},
+      ...parsedBody.statusMessage !== void 0 ? { statusMessage: parsedBody.statusMessage } : {}
+    };
+    return app2.services.threadService.createThreadHook(params.id, body);
+  });
+  app2.put("/api/threads/:id/hooks", async (request) => {
+    const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
+    const parsedBody = updateThreadHookSchema.parse(request.body);
+    const body = {
+      scope: parsedBody.scope,
+      eventName: parsedBody.eventName,
+      command: parsedBody.command,
+      target: {
+        scope: parsedBody.target.scope,
+        eventName: parsedBody.target.eventName,
+        command: parsedBody.target.command,
+        ...parsedBody.target.matcher !== void 0 ? { matcher: parsedBody.target.matcher } : {},
+        ...parsedBody.target.timeoutSec !== void 0 ? { timeoutSec: parsedBody.target.timeoutSec } : {},
+        ...parsedBody.target.statusMessage !== void 0 ? { statusMessage: parsedBody.target.statusMessage } : {}
+      },
+      ...parsedBody.matcher !== void 0 ? { matcher: parsedBody.matcher } : {},
+      ...parsedBody.timeoutSec !== void 0 ? { timeoutSec: parsedBody.timeoutSec } : {},
+      ...parsedBody.statusMessage !== void 0 ? { statusMessage: parsedBody.statusMessage } : {}
+    };
+    return app2.services.threadService.updateThreadHook(params.id, body);
+  });
+  app2.post("/api/threads/:id/hooks/trust", async (request) => {
+    const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
+    const body = trustThreadHookSchema.parse(request.body);
+    return app2.services.threadService.trustThreadHook(params.id, body);
+  });
+  app2.post("/api/threads/:id/hooks/untrust", async (request) => {
+    const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
+    const body = untrustThreadHookSchema.parse(request.body);
+    return app2.services.threadService.untrustThreadHook(params.id, body);
+  });
   app2.post("/api/threads/:id/resume", async (request) => {
     const params = z4.object({ id: z4.string().uuid() }).parse(request.params);
     const body = resumeThreadSchema.parse(request.body ?? {});