ruvnet-brain 4.7.18 → 4.7.19

package/README.md

@@ -9,7 +9,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 ### Discover the stack. Read the source. Build with confidence.
 
-[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.18-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
+[![RuvNet Brain version 4.6.2 — README updated 2026-10-10 EDT](https://img.shields.io/badge/version_4.7.19-updated_2026--10--10_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](plugin/.claude-plugin/plugin.json)
 
 **A source-grounded companion for Claude Code and Codex that helps you find and use Reuven Cohen's (rUv's) RuvNet ecosystem.**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.18",
+  "version": "4.7.19",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.7.18",
+  "version": "4.7.19",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.7.18",
+  "version": "4.7.19",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/commands/configure.md

@@ -1,7 +1,7 @@
 ---
-description: Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible.
-updated: 2026-10-10 06:00:22 EDT
-version: 1.0.2
+description: "Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible."
+updated: 2026-10-24 18:00:00 EDT
+version: 1.0.3
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,

package/plugin/scripts/nightly-scheduler.mjs

@@ -186,7 +186,8 @@ function verifyUpdateModules(modules) {
  * the allowlisted values from env; an object is kept verbatim; null omits the field (an older registration without it).
  */
 export function installNightlyRunner({ brainHome, source, nodePath = process.execPath,
-  identity = NIGHTLY_LABEL, packageTarget, bundleTarget, env = {}, environment, moduleSource, developerSuite = !NIGHTLY_PROOF_LABEL.test(identity), dryRun = false } = {}) {
+  identity = NIGHTLY_LABEL, packageTarget, bundleTarget, env = {}, environment, moduleSource, developerSuite = !NIGHTLY_PROOF_LABEL.test(identity), dryRun = false,
+  replacedUpdateModules = null } = {}) {
   validateIdentity(identity);
   if (!source || !fs.existsSync(source)) throw new Error(`nightly runner source is missing: ${source || '(unset)'}`);
   const bytes = fs.readFileSync(source);
@@ -204,7 +205,8 @@ export function installNightlyRunner({ brainHome, source, nodePath = process.exe
   const record = { updateModules: modules, ...(developerSuite ? { mode: 'developer-suite' } : {}), schemaVersion: 2, kind: 'ruvnet-brain-nightly-scheduler', identity,
     nodePath: path.resolve(nodePath), runnerPath, runnerSha256: digest, argv: [],
     ...(environment === null ? {} : { environment: environment ?? Object.fromEntries(NIGHTLY_ENV_ALLOWLIST.filter(key => env[key] !== undefined).map(key => [key, key === 'PATH' ? automaticPath({ nodePath, home: homeOf(env), env }) : String(env[key])])) }),
-    packageTarget: normalizePackageTarget(packageTarget), bundleTarget: normalizeBundleTarget(bundleTarget, identity) };
+    packageTarget: normalizePackageTarget(packageTarget), bundleTarget: normalizeBundleTarget(bundleTarget, identity),
+    ...(Array.isArray(replacedUpdateModules) && replacedUpdateModules.length ? { replacedUpdateModules } : {}) };
   const recordPath = path.join(dir, registrationName(identity));
   if (dryRun) return { ...record, recordPath };
   const tmp = `${recordPath}.tmp-${process.pid}`;
@@ -239,6 +241,12 @@ export function nightlyModuleCurrency({ brainHome, identity = NIGHTLY_LABEL, mod
  * and the LaunchAgent command stays exactly what it was; anything else is refused and left as it was.
  */
 export const SCHEDULER_VISIBLE_FIELDS = Object.freeze(['identity', 'nodePath', 'runnerPath', 'runnerSha256', 'argv', 'environment', 'packageTarget', 'bundleTarget', 'mode']);
+/** The replaced-module history after replacing `record.updateModules` now: newest first, last 48 h, at most 20. */
+export function nextReplacedSets(record, now = Date.now()) {
+  return [{ updateModules: record.updateModules, replacedAt: new Date(now).toISOString() },
+    ...(Array.isArray(record.replacedUpdateModules) ? record.replacedUpdateModules : [])]
+    .filter((entry) => now - Date.parse(entry?.replacedAt || '') <= 48 * 3_600_000).slice(0, 20);
+}
 export function refreshNightlyModules(options = {}) {
   const currency = nightlyModuleCurrency(options);
   if (currency.state !== 'stale') return currency;
@@ -250,7 +258,11 @@ export function refreshNightlyModules(options = {}) {
   const candidate = (options.build || ((p) => installNightlyRunner({ ...p, dryRun: true })))(plan);
   const differs = SCHEDULER_VISIBLE_FIELDS.filter((key) => JSON.stringify(candidate[key] ?? null) !== JSON.stringify(record[key] ?? null));
   if (differs.length) return { ...currency, state: 'refused', reason: `refresh would change ${differs.join(', ')}; registration left as it was`, fix: NIGHTLY_ENABLE_FIX };
-  const refreshed = installNightlyRunner(plan);
+  // Remember the module set this replaces: the receipt of the night that ran on it stays valid evidence until the next
+  // night (2026-10-24: doctor said "nightly refresh FAILED" all day after a session-start update re-pointed the modules).
+  // Newest first, every set replaced in the last 48 h (a receipt older than the 30 h health window is stale anyway), at
+  // most 20: any number of refreshes before the next night keeps the set that night ran on (reviews 2026-10-24).
+  const refreshed = installNightlyRunner({ ...plan, replacedUpdateModules: nextReplacedSets(record) });
   return { ...currency, state: 'refreshed', registered: registeredModuleDigest(refreshed), fix: undefined };
 }
 
@@ -329,10 +341,19 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   } catch (error) { return { state: 'failed', evidence: `Coordinated update receipt unreadable or refused: ${error.message}`, receipt: null }; }
   if (!receipt) return { state: 'never-ran', evidence: 'No coordinated update receipt exists yet.', receipt: null };
   const validDigest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
-  const bound = validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
-    && receipt.sourceSha256 === registration.updateModules?.['developer-update.mjs']?.sha256
-    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === registration.updateModules?.[name]?.sha256)
-    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || registration.updateModules?.[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === registration.updateModules?.[name]?.sha256);
+  const boundTo = modules => Boolean(modules) && validDigest(receipt.sourceSha256) && receipt.kind === 'nightly-suite-update' && receipt.schemaVersion === 1
+    && receipt.sourceSha256 === modules['developer-update.mjs']?.sha256
+    && Object.entries(receipt.sourceSnapshot || {}).every(([name, digest]) => validDigest(digest) && digest === modules[name]?.sha256)
+    && EXECUTION_MODULES.filter(name => name !== 'plugin-artifact-proof.mjs' || modules[name]).every(name => validDigest(receipt.sourceSnapshot?.[name]) && receipt.sourceSnapshot[name] === modules[name]?.sha256);
+  // A receipt from the module set an update just replaced is still the night's proof, but only one that FINISHED before
+  // the replacement: the next scheduled run must bind to the current set.
+  // Judged by LAUNCH time: a night's own knowledge step can install a release and re-point the modules before the run
+  // records finishedAt (cross-model review 2026-10-24). A run launched after its set was replaced must bind to the new one.
+  const launched = Date.parse(receipt.startedAt || receipt.finishedAt || '');
+  const ranOnPrevious = !boundTo(registration.updateModules) && Array.isArray(registration.replacedUpdateModules)
+    && registration.replacedUpdateModules.some((entry) => Number.isFinite(Date.parse(entry?.replacedAt || ''))
+      && launched <= Date.parse(entry.replacedAt) && boundTo(entry.updateModules));
+  const bound = boundTo(registration.updateModules) || ranOnPrevious;
   const ageHours = (now - Date.parse(receipt.finishedAt || receipt.startedAt || '')) / 3_600_000;
   const times = [receipt.startedAt, receipt.finishedAt].filter(value => value !== undefined).map(value => Date.parse(value));
   const timestampsValid = times.length > 0 && times.every(value => Number.isFinite(value) && value <= now)
@@ -349,7 +370,7 @@ export function developerRunHealth({ brainHome, registration, now = Date.now(),
   if (receipt.state !== 'completed') return { state: 'failed', ageHours, receipt, evidence: 'Coordinated update terminal state is unverified.' };
   if (ageHours > maxAgeHours) return { state: 'stale', ageHours, receipt, evidence: `Last coordinated update is ${ageHours.toFixed(1)}h old.` };
   const verification = { ok: bound && receipt.mode === 'apply' && receipt.schedulerIdentity === registration.identity && receipt.state === 'completed' && receipt.ok === true && ageHours >= 0 && ageHours <= maxAgeHours };
-  return { state: verification.ok ? 'ok' : 'failed', verification, ageHours, receipt, evidence: verification.ok ? `Coordinated updates completed ${ageHours.toFixed(1)}h ago; ${receipt.config?.scope || 'unknown'} scope.` : 'Coordinated update timestamp or terminal evidence is invalid.' };
+  return { state: verification.ok ? 'ok' : 'failed', verification, ageHours, receipt, evidence: verification.ok ? `Coordinated updates completed ${ageHours.toFixed(1)}h ago; ${receipt.config?.scope || 'unknown'} scope.${ranOnPrevious ? ' That run used the code an update replaced since; the next night runs the update.' : ''}` : 'Coordinated update timestamp or terminal evidence is invalid.' };
 }
 
 export function refreshRunHealth({ brainHome, identity = NIGHTLY_LABEL, now = Date.now(), maxAgeHours = 30,

package/scripts/codex-hook-trust-reconcile.mjs

@@ -5,7 +5,103 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
-import { codexHookIdentities } from './codex-hook-trust.mjs';
+import zlib from 'node:zlib';
+import { codexHookIdentities, codexPluginContentHash } from './codex-hook-trust.mjs';
+
+/**
+ * sha256 of every regular file under package/plugin/ in a verified npm tarball, read in memory (ustar with pax `path`
+ * records; nothing is extracted or written). Strict: a bad header checksum, a non-octal size, a body past the end, or
+ * any entry type other than file, directory or pax is refused rather than guessed (review 2026-10-24).
+ */
+export function publishedPluginFiles(archive) {
+  const tar = zlib.gunzipSync(archive);
+  const files = new Map();
+  const field = (b) => { const i = b.indexOf(0); return (i < 0 ? b : b.subarray(0, i)).toString('utf8'); };
+  const octal = (b, what) => { const t = field(b).trim(); if (!/^[0-7]+$/.test(t)) throw new Error(`Published archive has a non-octal ${what}`); return parseInt(t, 8); };
+  const paxRecords = (body) => {
+    const out = {}; let i = 0;
+    while (i < body.length) {
+      const space = body.indexOf(0x20, i);
+      if (space < 0) throw new Error('Published archive has a malformed pax record');
+      const len = Number(body.subarray(i, space).toString('ascii'));
+      if (!Number.isSafeInteger(len) || len <= space - i || i + len > body.length || body[i + len - 1] !== 0x0a) throw new Error('Published archive has a malformed pax record');
+      const rec = body.subarray(space + 1, i + len - 1).toString('utf8');
+      const eq = rec.indexOf('=');
+      if (eq < 1) throw new Error('Published archive has a malformed pax record');
+      out[rec.slice(0, eq)] = rec.slice(eq + 1);
+      i += len;
+    }
+    return out;
+  };
+  let pax = null; let off = 0;
+  for (; off + 512 <= tar.length;) {
+    const header = tar.subarray(off, off + 512);
+    if (header.every((b) => b === 0)) break;
+    const sum = header.reduce((n, b, i) => n + (i >= 148 && i < 156 ? 32 : b), 0);
+    if (octal(header.subarray(148, 156), 'checksum') !== sum) throw new Error('Published archive header checksum mismatch');
+    const size = octal(header.subarray(124, 136), 'size');
+    const type = header[156] === 0 ? '0' : String.fromCharCode(header[156]);
+    const prefix = field(header.subarray(345, 500));
+    const name = pax?.path ?? (prefix ? `${prefix}/${field(header.subarray(0, 100))}` : field(header.subarray(0, 100)));
+    if (off + 512 + size > tar.length) throw new Error('Published archive entry runs past the end');
+    const body = tar.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+    if (type === 'x') { pax = paxRecords(body); continue; }
+    if (type === 'g') { pax = null; continue; }
+    pax = null;
+    if (type === '5') continue;
+    if (type !== '0') throw new Error(`Published archive has an unsupported entry type ${JSON.stringify(type)}`);
+    if (name.startsWith('package/plugin/')) files.set(name.slice('package/plugin/'.length), digest(body));
+  }
+  if (!files.size) throw new Error('Published archive carries no plugin files');
+  return files;
+}
+
+// Codex writes this under the installed plugin itself: one SKILL.md per migrated slash command (openai/codex
+// rust-v0.164.0 codex-rs/core-plugins/src/command_migration.rs render_command_skill). It is not release bytes, so it is
+// accepted only when every byte is what that template renders from the release's own verified command file.
+const CODEX_GENERATED = 'migrated-command-skills';
+function commandParts(text) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/.exec(text);
+  if (!m) return null;
+  const d = /^description:\s*"((?:[^"\\]|\\.)*)"\s*$/m.exec(m[1]);
+  return d ? { description: JSON.parse(`"${d[1]}"`).trim(), body: m[2] } : null;
+}
+function expectedGeneratedSkill(skillName, sourceName, commandText) {
+  const parts = commandParts(commandText);
+  if (!parts || !parts.description) return null;
+  const body = parts.body.trim() || 'No command template body was found.';
+  return `---\nname: ${JSON.stringify(skillName)}\ndescription: ${JSON.stringify(parts.description)}\n---\n\n# ${skillName}\n\n`
+    + `Use this skill when the user asks to run the migrated source command \`${sourceName}\`.\n\n## Command Template\n\n${body}\n`;
+}
+
+/**
+ * ONE pass over the installed plugin: each file's bytes are checked against the verified release (or, for Codex's own
+ * generated skills, against the template rendered from the verified command file) and the SAME bytes feed the content
+ * fingerprint returned. Throws on any changed, extra or missing file, link, or generated file that is not exactly
+ * Codex's rendering.
+ */
+export function verifiedPluginContentHash(root, pluginFiles, { platform = process.platform } = {}) {
+  const seen = new Set(); const commands = new Map(); const generated = new Map();
+  const genPrefix = `.codex-plugin/${CODEX_GENERATED}/`;
+  const hash = codexPluginContentHash(root, { platform, onFile: (rel, bytes) => {
+    if (rel.startsWith(genPrefix)) { generated.set(rel.slice(genPrefix.length), bytes); return; }
+    if (pluginFiles.get(rel) !== digest(bytes)) throw new Error(`Installed plugin file differs from the verified release: ${rel}`);
+    seen.add(rel);
+    if (/^commands\/[^/]+\.md$/.test(rel)) commands.set(rel.slice('commands/'.length, -3), bytes.toString('utf8'));
+  } });
+  const missing = [...pluginFiles.keys()].filter((k) => !seen.has(k));
+  if (missing.length) throw new Error(`Installed plugin lacks ${missing.length} released file(s), e.g. ${missing[0]}`);
+  for (const [rel, bytes] of generated) {
+    const m = /^source-command-([a-z0-9-]+)\/SKILL\.md$/.exec(rel);
+    const source = m && commands.get(m[1]);
+    const expected = source && expectedGeneratedSkill(`source-command-${m[1]}`, m[1], source);
+    if (!expected || bytes.toString('utf8') !== expected) throw new Error(`Codex-generated file is not the rendering of a verified release command: ${rel}`);
+  }
+  return hash;
+}
+/** Kept for callers that only need the yes/no: the installed plugin is the verified release. */
+export function installedPluginMatchesRelease(root, pluginFiles) { verifiedPluginContentHash(root, pluginFiles); return true; }
 
 /** Authenticate exact published package bytes before reading one archive member. No extraction/install. */
 export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetcher = globalThis.fetch,
@@ -43,7 +139,9 @@ export async function obtainVerifiedPublishedHookIdentity({ version, fetch: fetc
       { input: archive, timeout: Math.min(remaining, 3000), maxBuffer: 256 * 1024 });
     if (result.error || result.status !== 0 || !result.stdout?.length) throw new Error('Platform tar cannot read exact published hooks entry');
     if (!codexHookIdentities(JSON.parse(result.stdout)).size) throw new Error('Published native hooks are invalid');
-    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout) },
+    let pluginFiles = null;
+    try { pluginFiles = publishedPluginFiles(archive); } catch { pluginFiles = null; /* content trust is then refused, never guessed */ }
+    return { state: 'verified', releaseIdentity: { version, integrity, hooksSha256: digest(result.stdout), pluginFiles },
       metadataUrl, tarballUrl, archiveBytes: archive.length };
   } catch (error) { return blocked(error.message); }
 }
@@ -142,9 +240,14 @@ const rowsFor = (response) => {
   if (!Array.isArray(response?.data)) throw new Error('Native hook registry unavailable');
   return response.data.flatMap((r) => r.hooks || []).filter((r) => r.pluginId === OWNER);
 };
-function assertRegistry(rows, identities) {
+// Codex <0.164: currentHash is the declaration hash. 0.164+: "<declaration hash>/<plugin content hash>" (discovery.rs).
+const splitHash = (current) => { const [declaration, content = null] = String(current || '').split('/'); return { declaration, content }; };
+function assertRegistry(rows, identities, contentHash = null) {
   if (rows.length !== identities.size || new Set(rows.map((r) => r.key)).size !== identities.size
-    || rows.some((row) => identities.get(row.key) !== row.currentHash)) throw new Error('Native registry differs from verified released artifact');
+    || rows.some((row) => identities.get(row.key) !== splitHash(row.currentHash).declaration)) throw new Error('Native registry differs from verified released artifact');
+  if (rows.some((row) => splitHash(row.currentHash).content !== null && splitHash(row.currentHash).content !== contentHash)) {
+    throw new Error('Native plugin content fingerprint differs from the verified installed plugin');
+  }
 }
 
 function otherSettings(config, keys) {
@@ -153,6 +256,7 @@ function otherSettings(config, keys) {
     const state = clone?.hooks?.state?.[key];
     if (state && typeof state === 'object') {
       delete state.trusted_hash;
+      delete state.trusted_content_hash;
       if (!Object.keys(state).length) delete clone.hooks.state[key];
     }
   }
@@ -170,7 +274,7 @@ function otherSettings(config, keys) {
 export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, installedVersion, hooksPath,
   configPath, nativeBinary, cwd = process.cwd(), backupDir = path.join(path.dirname(configPath || ''), 'backups'),
   rpc: suppliedRpc, timeoutMs = 10000 } = {}) {
-  let client; let wrote = false; let writeAttempted = false; let backupPath;
+  let client; let wrote = false; let writeAttempted = false; let backupPath; let contentRefusal = 'Verified release plugin files unavailable';
   try {
     if (!releaseIdentity || !/^\d+\.\d+\.\d+$/.test(releaseIdentity.version || '')
       || installedVersion !== releaseIdentity.version || !/^[a-f0-9]{64}$/.test(releaseIdentity.hooksSha256 || '')
@@ -181,9 +285,19 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     if (digest(bytes) !== releaseIdentity.hooksSha256) return blocked('Installed hooks differ from verified release');
     const identities = codexHookIdentities(JSON.parse(bytes));
     if (!identities.size) return blocked('Verified artifact has no native hooks');
+    // Codex 0.164+ also pins the installed plugin folder. Approve that fingerprint only for a folder that holds exactly
+    // the verified release's plugin/ bytes (Codex's own generated migrations aside); otherwise refuse, never guess.
+    const pluginRoot = path.dirname(path.dirname(hooksPath));
+    let contentHash = null;
+    if (releaseIdentity.pluginFiles instanceof Map) {
+      try { contentHash = verifiedPluginContentHash(pluginRoot, releaseIdentity.pluginFiles); }
+      catch (error) { contentHash = null; contentRefusal = error.message; }
+    }
     if (!suppliedRpc) client = await nativeClient(nativeBinary, cwd, Date.now() + Math.min(timeoutMs, 20000), configPath);
     const rpc = suppliedRpc || client.rpc;
-    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(before, identities);
+    const before = rowsFor(await rpc('hooks/list', { cwds: [cwd] }));
+    if (!contentHash && before.some((row) => splitHash(row.currentHash).content !== null)) return blocked(contentRefusal);
+    assertRegistry(before, identities, contentHash);
     const disabled = before.filter((r) => r.enabled === false).map((r) => r.key).sort();
     if (before.some((r) => !['trusted', 'modified', 'untrusted', 'managed'].includes(r.trustStatus))) return blocked('Unknown native trust state');
     const pending = before.filter((r) => r.enabled === true && ['modified', 'untrusted'].includes(r.trustStatus));
@@ -194,8 +308,11 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     // Config stays memory-only except the private backup. No logging of effective config values.
     const prior = fs.readFileSync(configPath);
     backupPath = privateBackup(configPath, prior, backupDir);
-    const edits = pending.map((r) => ({ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
-      value: identities.get(r.key), mergeStrategy: 'replace' }));
+    const edits = pending.flatMap((r) => [{ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_hash`,
+      value: identities.get(r.key), mergeStrategy: 'replace' },
+      // The second approval Codex 0.164 stores separately (plugin_trust.rs matches_hash).
+      ...(splitHash(r.currentHash).content !== null ? [{ keyPath: `hooks.state.${JSON.stringify(r.key)}.trusted_content_hash`,
+        value: contentHash, mergeStrategy: 'replace' }] : [])]);
     writeAttempted = true;
     await rpc('config/batchWrite', { filePath: configPath, expectedVersion: users[0].version, reloadUserConfig: true, edits });
     wrote = true;
@@ -203,7 +320,7 @@ export async function reconcileVerifiedCodexHookTrust({ releaseIdentity, install
     const afterUsers = (afterRead.layers || []).filter((r) => r.name?.type === 'user' && r.name.file === configPath);
     if (afterUsers.length !== 1 || otherSettings(users[0].config, pending.map((r) => r.key))
       !== otherSettings(afterUsers[0].config, pending.map((r) => r.key))) throw new Error('Unrelated config changed; no whole-file rollback attempted');
-    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities);
+    const after = rowsFor(await rpc('hooks/list', { cwds: [cwd] })); assertRegistry(after, identities, contentHash);
     if (JSON.stringify(after.filter((r) => r.enabled === false).map((r) => r.key).sort()) !== JSON.stringify(disabled)
       || after.some((r) => r.enabled === true && !['trusted', 'managed'].includes(r.trustStatus))) throw new Error('Native trust repair verification incomplete');
     return { state: 'registry-verified', changed: true, editedTrustHashes: edits.length,

package/scripts/codex-hook-trust.mjs

@@ -23,6 +23,7 @@
 // that one hook `modified`, the other ten still `trusted`. currentHash from `hooks/list` equals
 // codexHookHash() below for every hook (tests/unit/codex-hook-trust.test.mjs pins the real values).
 import crypto from 'node:crypto';
+import nodeFs from 'node:fs';
 
 const EVENT_LABEL = Object.freeze({
   PreToolUse: 'pre_tool_use', PermissionRequest: 'permission_request', PostToolUse: 'post_tool_use',
@@ -92,3 +93,47 @@ export function codexTrustChanges(prevHooksFile, nextHooksFile, keySource) {
 export const CODEX_TRUST_ACTION = 'Start Codex (interactive, in any project). At the "Hooks need review" prompt choose'
   + ' "Trust all and continue" — or type /hooks and trust each RuvNet Brain hook. Until then Codex skips them'
   + ' (codex exec never asks). Then re-run npx ruvnet-brain --doctor.';
+
+/**
+ * Codex's plugin bundle fingerprint, ported byte for byte from openai/codex rust-v0.164.0
+ * codex-rs/hooks/src/engine/plugin_fingerprint.rs plugin_content_hash(). Since 0.164 a plugin hook's
+ * `currentHash` is "<declaration hash>/<this hash>" and its approval stores the two separately
+ * (`trusted_hash` + `trusted_content_hash`, plugin_trust.rs matches_hash). Measured 2026-10-24: every Brain update
+ * left all 13 Codex hooks "modified" because the Brain wrote only the declaration hash.
+ * Walk: depth-first, entries sorted by file name (bytes), skipping __pycache__, .venv, *.pyc, *.egg-info; each entry
+ * hashes its root-relative path (u64 LE length + bytes), then "directory", or "file" + u64 LE size + contents.
+ * Anything that is neither (a symlink) throws, as it does in Codex.
+ */
+export function codexPluginContentHash(root, { fsImpl = null, onFile = null, platform = process.platform } = {}) {
+  const fs = fsImpl || nodeFs;
+  const u64 = (n) => { const b = Buffer.alloc(8); b.writeBigUInt64LE(BigInt(n)); return b; };
+  if (!fs.lstatSync(root).isDirectory()) throw new Error('plugin root is not a directory');
+  const hash = crypto.createHash('sha256').update('codex-plugin-bundle-v1');
+  // Rust hashes the OS-native relative path bytes: '\\' separators on Windows (review 2026-10-24).
+  const sep = platform === 'win32' ? '\\' : '/';
+  const pending = [''];
+  while (pending.length) {
+    const rel = pending.pop();
+    const base = rel.split('/').pop();
+    if (rel && (base === '__pycache__' || base === '.venv' || base.endsWith('.pyc') || base.endsWith('.egg-info'))) continue;
+    const name = Buffer.from(rel.split('/').join(sep));
+    hash.update(u64(name.length)).update(name);
+    const full = rel ? `${root}/${rel}` : root;
+    const st = fs.lstatSync(full);
+    if (st.isDirectory()) {
+      hash.update('directory');
+      const entries = fs.readdirSync(full).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+      for (const entry of entries.reverse()) pending.push(rel ? `${rel}/${entry}` : entry);
+    } else if (st.isFile()) {
+      const bytes = fs.readFileSync(full);
+      if (bytes.length !== st.size) throw new Error('plugin file changed while fingerprinting');
+      // The caller sees exactly the bytes that enter the fingerprint: one read, so nothing can change between a check
+      // and the hash it approves (review 2026-10-24: a separate verification pass was a swap window).
+      onFile?.(rel, bytes);
+      hash.update('file').update(u64(st.size)).update(bytes);
+    } else {
+      throw new Error(`unsupported plugin entry type: ${full}`);
+    }
+  }
+  return `sha256:${hash.digest('hex')}`;
+}