tickmarkr 1.71.0 → 1.73.0

package/dist/adapters/codex.js

@@ -80,6 +80,15 @@ export function readCodexModelsCache(path) {
 // P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the pane shell at the
 // worktree cwd; in a plain repo it resolves to ./.git (already writable, harmless).
 const GITDIR_WRITABLE = `-c "sandbox_workspace_write.writable_roots=[\\"$(git rev-parse --path-format=absolute --git-common-dir)\\"]"`;
+// OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
+// from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
+// untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
+// (run-20260722/23 incidents). This flag runs the operator's OWN already-trusted hooks — including the
+// ~/.codex/hooks.json herdr-agent-state hook herdr relies on for agent detection, so the hooks can't
+// just be disabled — WITHOUT requiring persisted per-path trust for this invocation. It KEEPS the
+// -s/--sandbox workspace-write sandbox (deliberately NOT --dangerously-bypass-approvals-and-sandbox,
+// which would drop the sandbox). Listed by `codex --help` and `codex exec --help` (verified 2026-07-23).
+const CODEX_HOOK_TRUST = "--dangerously-bypass-hook-trust";
 // v1.22 T5 / OBS-16: codex keys trust on absolute path under [projects."<root>"] trust_level="trusted"
 // in ~/.codex/config.toml (CODEX_HOME relocates the dir). Worktrees inherit parent-project trust when
 // the REPO ROOT is trusted — seed the root once, cover every future worktree. Idempotent: a second
@@ -171,14 +180,15 @@ export const codex = {
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builders below hardcode (incl. codexMcpSuppressionFlags' -c/
     // --disable and GITDIR_WRITABLE's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
-    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-a", "-s", "-c", "--disable"] },
+    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-a", "-s", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
-    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    // CODEX_HOOK_TRUST (OBS-125) clears the per-worktree "Hooks need review" gate while keeping the sandbox.
+    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
     // TUI uses expanded -a never -s workspace-write (exec-only flags do not apply)
     // (--help 2026-07-09: valid approval policies are untrusted|on-request|never; the previously
     // used `on-failure` is invalid and made codex exit 2 pre-inference)
-    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/cli/commands/approve.js

@@ -1,5 +1,6 @@
 import { userInfo } from "node:os";
-import { ATTEMPT_CAP_RELEASE, Journal } from "../../run/journal.js";
+import { GATE_NAMES } from "../../graph/schema.js";
+import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal } from "../../run/journal.js";
 // GATE-08 (v1.12): approve a parked human gate so the next `tickmarkr resume <runId>` dispatches it.
 //
 // The approval is a JOURNAL EVENT (task-approved) carrying who and when — it touches ONLY the
@@ -31,15 +32,32 @@ export async function approve(argv, cwd = process.cwd()) {
     }
     // OBS-18: only the most recent task-human for this task decides whether this approval grants a
     // fresh attempt budget. The closed daemon-issued kind, never a human prose string, controls release.
-    const lastHuman = journal.read().filter((e) => e.event === "task-human" && e.taskId === taskId).at(-1);
+    const events = journal.read();
+    let lastHumanIndex = -1;
+    for (let i = events.length - 1; i >= 0; i--) {
+        if (events[i].event === "task-human" && events[i].taskId === taskId) {
+            lastHumanIndex = i;
+            break;
+        }
+    }
+    const lastHuman = events[lastHumanIndex];
     const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
+    const gateFailPark = lastHuman?.data.kind === "gate-fail";
+    const failedGate = gateFailPark
+        ? events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
+            && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate
+        : undefined;
+    if (gateFailPark && !failedGate) {
+        throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result — refusing to infer one`);
+    }
     journal.append("task-approved", taskId, {
         by,
         ...(reason ? { reason } : {}),
         via: "cli",
         ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
+        ...(failedGate ? { release: GATE_SATISFIED_RELEASE, gate: failedGate } : {}),
     });
-    return `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to dispatch it`;
+    return `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to ${failedGate ? "continue past the approved gate" : "dispatch it"}`;
 }
 // hand-parsed argv — no CLI framework (house style). Flags --by <name> and --reason <text>; positionals
 // are runId then taskId. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).

package/dist/cli/commands/fleet.d.ts

@@ -12,6 +12,8 @@ export type FleetOutput = {
 export type FleetIO = {
     input?: FleetInput;
     output?: FleetOutput;
+    debug?: boolean;
+    reloadGuard?: (bytes: string) => string | null;
 };
 export declare function fleet(argv: string[], cwd?: string, adapters?: WorkerAdapter[], io?: FleetIO): Promise<string | {
     out: string;