token-harness 0.1.24 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "token-harness",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Quota-aware efficiency layer for Claude Code and Codex subscription limits.",
   "license": "Apache-2.0",
   "type": "module",

package/sbom.json

@@ -1,14 +1,14 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:dae606f9-46c6-3383-876b-2c09bda8c296",
+  "serialNumber": "urn:uuid:98c77e0b-85a6-4ff8-8659-17f04e51ef5f",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "bom-ref": "token-harness",
       "name": "token-harness",
-      "version": "0.1.24",
+      "version": "0.1.25",
       "description": "Quota-aware efficiency layer for Claude Code and Codex subscription limits.",
       "licenses": [
         {
@@ -20,7 +20,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dae606f946c63383876b2c09bda8c296da1816849916f5d1774d2f1d84384c47"
+          "content": "98c77e0b85a64ff8865917f04e51ef5fa489bcbc4bdd473f712a1cec2e025cac"
         }
       ]
     },

package/token-harness.mjs

@@ -4675,35 +4675,36 @@ function detectUnownedEntries(input) {
     });
   }
   for (const config of input.configs) {
-    for (const point of config.interceptionPoints) {
-      for (const matcher of config.matchers) {
-        for (const [key, resolved] of exclusiveOwners) {
-          if (resolved.scope.harness !== config.harnessId)
-            continue;
-          if (resolved.scope.interceptionPoint !== point)
-            continue;
-          if (resolved.scope.toolFamily !== matcher)
-            continue;
-          for (const command of config.commands) {
-            const belongsTo = input.identify(command);
-            if (belongsTo === resolved.owner)
-              continue;
-            findings.push({
-              code: "unowned-entry-on-exclusive-scope",
-              scope: key,
-              expectedOwner: resolved.owner,
-              configPath: config.configPath,
-              matcher,
-              command,
-              detail: [
-                `${key} is an exclusive scope owned by ${resolved.owner}`,
-                belongsTo === null ? "An entry here invokes a command Token Harness does not recognise" : `An entry here invokes ${belongsTo}`,
-                "The harness runs every matching hook rather than only the first, so both would transform the same payload and the saving would be counted twice"
-              ],
-              remediation: "Remove the competing entry, or assign the scope to it explicitly with `profile: custom`. Token Harness will not remove a third party\u2019s entry."
-            });
-          }
-        }
+    const observedHooks = config.hookCommands === void 0 ? config.interceptionPoints.flatMap((interceptionPoint) => config.matchers.flatMap((toolFamily) => config.commands.map((command) => ({
+      interceptionPoint,
+      toolFamilies: [toolFamily],
+      command
+    })))) : config.hookCommands;
+    for (const hook of observedHooks) {
+      for (const [key, resolved] of exclusiveOwners) {
+        if (resolved.scope.harness !== config.harnessId)
+          continue;
+        if (resolved.scope.interceptionPoint !== hook.interceptionPoint)
+          continue;
+        if (!hook.toolFamilies.includes(resolved.scope.toolFamily))
+          continue;
+        const belongsTo = input.identify(hook.command);
+        if (belongsTo === resolved.owner)
+          continue;
+        findings.push({
+          code: "unowned-entry-on-exclusive-scope",
+          scope: key,
+          expectedOwner: resolved.owner,
+          configPath: config.configPath,
+          matcher: resolved.scope.toolFamily,
+          command: hook.command,
+          detail: [
+            `${key} is an exclusive scope owned by ${resolved.owner}`,
+            belongsTo === null ? "An entry here invokes a command Token Harness does not recognise" : `An entry here invokes ${belongsTo}`,
+            "The harness runs every matching hook rather than only the first, so both would transform the same payload and the saving would be counted twice"
+          ],
+          remediation: "Remove the competing entry, or assign the scope to it explicitly with `profile: custom`. Token Harness will not remove a third party\u2019s entry."
+        });
       }
     }
   }
@@ -9861,7 +9862,7 @@ var TOOL_VERSION;
 var init_version2 = __esm({
   "apps/cli/dist/src/version.js"() {
     "use strict";
-    TOOL_VERSION = "0.1.24";
+    TOOL_VERSION = "0.1.25";
   }
 });
 
@@ -14215,7 +14216,9 @@ function readHooks(document2) {
         return [
           {
             eventName: point.eventName,
+            interceptionPoint: point.scopeId,
             matcher: typeof matcher === "string" ? matcher : null,
+            toolFamilies: typeof matcher !== "string" ? MANIFEST.toolFamilies.map((family) => family.id) : MANIFEST.toolFamilies.filter((family) => matcherCoversFamily(matcher, family.id)).map((family) => family.id),
             command: hook["command"],
             entryPointer,
             commandPointer: `${entryPointer}.hooks.${String(hookIndex)}.command`
@@ -14960,7 +14963,7 @@ var init_codex_hooks = __esm({
 function isRecord3(value3) {
   return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
 }
-function readHooks2(document2) {
+function readHooks2(document2, os) {
   if (!isRecord3(document2) || !isRecord3(document2["hooks"]))
     return { points: [], matchers: [], commands: [], hookCommands: [] };
   const hooks = document2["hooks"];
@@ -14981,15 +14984,21 @@ function readHooks2(document2) {
         matchers.push(matcher);
       if (Array.isArray(entry["hooks"])) {
         for (const [hookIndex, hook] of entry["hooks"].entries()) {
-          if (isRecord3(hook) && typeof hook["command"] === "string") {
-            commands.push(hook["command"]);
+          if (!isRecord3(hook))
+            continue;
+          const commandKey = os === "windows" && typeof hook["commandWindows"] === "string" ? "commandWindows" : "command";
+          const command = hook[commandKey];
+          if (typeof command === "string") {
+            commands.push(command);
             const entryPointer = `hooks.${point.eventName}.${String(entryIndex)}`;
             hookCommands.push({
               eventName: point.eventName,
+              interceptionPoint: point.scopeId,
               matcher,
-              command: hook["command"],
+              toolFamilies: matcher === null ? MANIFEST2.toolFamilies.map((family) => family.id) : MANIFEST2.toolFamilies.filter((family) => matcherCoversFamily(matcher, family.id)).map((family) => family.id),
+              command,
               entryPointer,
-              commandPointer: `${entryPointer}.hooks.${String(hookIndex)}.command`
+              commandPointer: `${entryPointer}.hooks.${String(hookIndex)}.${commandKey}`
             });
             carries = true;
           }
@@ -15034,7 +15043,7 @@ async function resolveConfig2(declaration, context) {
     };
   }
   try {
-    const hooks = readHooks2(JSON.parse(text3));
+    const hooks = readHooks2(JSON.parse(text3), context.facts.os);
     return {
       declaration,
       path,
@@ -18349,7 +18358,7 @@ function installAction(context, manifest) {
     packageName: channel.packageId ?? "rtk",
     // The managed Codex hook first exists in this RTK release. Pinning makes a fresh setup's
     // promised surface deterministic instead of installing an older prompt-only build.
-    version: "0.50.0"
+    version: "0.51.0"
   };
 }
 function buildRtkPlan(input) {
@@ -18528,9 +18537,15 @@ async function readHarnessActivity(context, harness) {
     failure: null
   };
 }
+function supportsCodexHook(version3) {
+  if (version3 === null)
+    return false;
+  const parsed = parseSemanticVersion(version3);
+  const minimum = parseSemanticVersion(RTK_CODEX_HOOK_MINIMUM_VERSION);
+  return parsed !== null && minimum !== null && compareVersions(parsed, minimum) >= 0;
+}
 function hasAttributionHook(context, harness) {
-  const command = new RegExp(`^token-harness __internal-rtk-hook ${harness}(?: --restore-rtk)?$`, "i");
-  return context.harnessConfigs.some((config) => config.harnessId === harness && config.commands.some((entry) => command.test(entry.trim())));
+  return context.harnessConfigs.some((config) => config.harnessId === harness && config.commands.some((entry) => tokenHarnessRtkHookHarness(entry) === harness));
 }
 async function detect7(context) {
   const evidenceItems = [];
@@ -18554,7 +18569,7 @@ async function detect7(context) {
       remediation: "Check the release notes for analytics or hook changes before applying a plan"
     }));
   }
-  const codexHookSupported = version3.version === RTK_CODEX_HOOK_VERSION;
+  const codexHookSupported = supportsCodexHook(version3.version);
   const codexConfiguredWithoutHookSupport = configured.includes(CODEX4) && !codexHookSupported;
   if (codexConfiguredWithoutHookSupport) {
     warnings.push(diagnostic({
@@ -18562,7 +18577,7 @@ async function detect7(context) {
       code: "rtk-codex-hook-unsupported",
       subject: CODEX4,
       message: `RTK ${String(version3.version)} does not provide the Codex hook; its configuration entry cannot capture commands`,
-      remediation: `Upgrade RTK to ${RTK_CODEX_HOOK_VERSION}, then refresh and apply the attribution plan`
+      remediation: `Upgrade RTK to ${RTK_CODEX_HOOK_MINIMUM_VERSION}, then refresh and apply the attribution plan`
     }));
   }
   const state = version3.version === null ? configured.length > 0 ? "broken" : "absent" : codexConfiguredWithoutHookSupport && configured.length === 1 ? "broken" : configured.length > 0 ? "configured" : "installed";
@@ -18628,14 +18643,14 @@ async function verify7(context) {
     remediation: version3.version === null ? "Install RTK, or add it to PATH" : null
   });
   const configured = harnessesWiredToRtk(context.harnessConfigs);
-  const configuredSupported = configured.filter((harness) => harness === CLAUDE5 || harness === CODEX4 && version3.version === RTK_CODEX_HOOK_VERSION);
+  const configuredSupported = configured.filter((harness) => harness === CLAUDE5 || harness === CODEX4 && supportsCodexHook(version3.version));
   checks.push({
     id: "hook-registered",
     status: configuredSupported.length > 0 ? "pass" : configured.length > 0 ? "fail" : "not-exercised",
     summary: configuredSupported.length > 0 ? `wired to ${configuredSupported.join(", ")}` : configured.length > 0 ? `RTK ${String(version3.version)} cannot run its Codex hook` : "no harness configuration names rtk",
     achievedTier: configuredSupported.length > 0 ? "config-only" : null,
     evidence: [],
-    remediation: configured.length > 0 && configuredSupported.length === 0 ? `Upgrade RTK to ${RTK_CODEX_HOOK_VERSION} for Codex hook support` : null
+    remediation: configured.length > 0 && configuredSupported.length === 0 ? `Upgrade RTK to ${RTK_CODEX_HOOK_MINIMUM_VERSION} for Codex hook support` : null
   });
   let receipt = null;
   let bestReceiptTime = Number.NEGATIVE_INFINITY;
@@ -18643,7 +18658,7 @@ async function verify7(context) {
     if (!configured.includes(harness))
       continue;
     const label = harness === CLAUDE5 ? "Claude Code" : "Codex";
-    const supported = harness !== CODEX4 || version3.version === RTK_CODEX_HOOK_VERSION;
+    const supported = harness !== CODEX4 || supportsCodexHook(version3.version);
     if (!supported) {
       checks.push({
         id: `rtk-attribution-${harness}`,
@@ -18651,7 +18666,7 @@ async function verify7(context) {
         summary: `RTK ${String(version3.version)} does not provide an active ${label} hook`,
         achievedTier: null,
         evidence: [],
-        remediation: `Upgrade RTK to ${RTK_CODEX_HOOK_VERSION}, then refresh and apply the tracking update`
+        remediation: `Upgrade RTK to ${RTK_CODEX_HOOK_MINIMUM_VERSION}, then refresh and apply the tracking update`
       });
       continue;
     }
@@ -19046,7 +19061,20 @@ async function importHistorySource(context, store, path, attributedHarness) {
   };
 }
 function identifiesCommand2(command) {
-  return HOOK_COMMAND_PATTERN2.test(command) || PLUGIN_MODULE_PATTERN3.test(command) || /(^|[\\/\s"'])token-harness(?:\.cmd|\.exe)?\s+__internal-rtk-hook(?:\s|$)/i.test(command);
+  return HOOK_COMMAND_PATTERN2.test(command) || PLUGIN_MODULE_PATTERN3.test(command) || tokenHarnessRtkHookHarness(command) !== null;
+}
+function tokenHarnessRtkHookHarness(command) {
+  const match = /^\s*(?:"([^"]+)"|'([^']+)'|(\S+))\s+__internal-rtk-hook\s+(claude|codex)(?:\s+--restore-rtk)?\s*$/i.exec(command);
+  if (match === null)
+    return null;
+  const executable = match[1] ?? match[2] ?? match[3];
+  if (executable === void 0)
+    return null;
+  const basename = executable.split(/[\\/]/).at(-1);
+  if (basename === void 0 || !/^token-harness(?:\.cmd|\.exe)?$/i.test(basename)) {
+    return null;
+  }
+  return harnessId((match[4] ?? "").toLowerCase());
 }
 async function plan2(context, request) {
   const version3 = await readVersion(context);
@@ -19070,7 +19098,7 @@ async function plan2(context, request) {
     hookProxyAvailable
   });
 }
-var RTK2, CLAUDE5, CODEX4, OPENCODE3, TRACKED_HARNESSES, RTK_CODEX_HOOK_VERSION, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, HARNESS_ACTIVITY_QUERY, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
+var RTK2, CLAUDE5, CODEX4, OPENCODE3, TRACKED_HARNESSES, RTK_CODEX_HOOK_MINIMUM_VERSION, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, HARNESS_ACTIVITY_QUERY, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
 var init_rtk = __esm({
   "packages/adapters/dist/src/providers/rtk.js"() {
     "use strict";
@@ -19081,7 +19109,7 @@ var init_rtk = __esm({
     CODEX4 = harnessId("codex");
     OPENCODE3 = harnessId("opencode");
     TRACKED_HARNESSES = [CLAUDE5, CODEX4];
-    RTK_CODEX_HOOK_VERSION = "0.50.0";
+    RTK_CODEX_HOOK_MINIMUM_VERSION = "0.50.0";
     MANIFEST7 = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
       id: RTK2,
@@ -19261,7 +19289,7 @@ var init_rtk = __esm({
       },
       delegatedInstallReviews: null
     };
-    TESTED_VERSIONS2 = { minimum: "0.44.0", maximum: "0.50.0" };
+    TESTED_VERSIONS2 = { minimum: "0.44.0", maximum: "0.51.0" };
     VERSION_PATTERN7 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
     HOOK_COMMAND_PATTERN2 = /(^|[\\/\s"'])rtk(\.exe)?([\s"']|$)/i;
     PLUGIN_MODULE_PATTERN3 = /(^|[\\/])rtk\.(ts|js|mjs|cjs|mts|cts)$/i;
@@ -21941,7 +21969,7 @@ var init_version_compatibility = __esm({
     GITNEXUS2 = providerId("gitnexus");
     HEADROOM3 = providerId("headroom");
     PACKAGE_UPDATE_BASELINES = /* @__PURE__ */ new Map([
-      [RTK3, { minimum: "0.44.0", maximum: "0.50.0" }],
+      [RTK3, { minimum: "0.44.0", maximum: "0.51.0" }],
       [HARNESSTRIM3, { minimum: "0.0.5", maximum: "0.3.1" }],
       [
         MCPTOON2,
@@ -26821,6 +26849,14 @@ async function computePlan(context) {
     ],
     remediation: "Give each provider a distinct marker pair, or disable one of the providers for this instruction region"
   }));
+  if (providerAdapters.length === 0 && context.provider !== providerId("none") && actions.length === 0) {
+    diagnostics.push(diagnostic({
+      severity: "info",
+      code: "no-providers-registered",
+      message: "No optimization provider is available for this operation",
+      remediation: null
+    }));
+  }
   const conflicts = [...resolution.conflicts, ...markerConflicts];
   const report = {
     // RFC 0006 §Plan persistence: "a digest over the plan's normalized content, so identical
@@ -26869,14 +26905,6 @@ async function computePlan(context) {
       remediation: null
     }));
   }
-  if (providerAdapters.length === 0) {
-    diagnostics.push(diagnostic({
-      severity: "info",
-      code: "no-providers-registered",
-      message: "No provider adapters are registered in this build, so no plan has actions",
-      remediation: null
-    }));
-  }
   if (resolution.ownership.length > 0 && actions.length === 0 && blocked.length === 0) {
     diagnostics.push(diagnostic({
       severity: "info",
@@ -35474,7 +35502,7 @@ function guideSetupTargets(report, harness) {
   return GUIDE_MANAGED_PROVIDERS.map((provider) => guideSetupTarget(report, harness, provider));
 }
 function explainGuideIssue(diagnostics, fallback) {
-  const known = diagnostics.find((entry) => ISSUE_COPY[entry.code] !== void 0);
+  const known = diagnostics.find((entry) => entry.severity === "error" && ISSUE_COPY[entry.code] !== void 0) ?? diagnostics.find((entry) => entry.severity === "warning" && ISSUE_COPY[entry.code] !== void 0) ?? diagnostics.find((entry) => entry.severity === "info" && ISSUE_COPY[entry.code] !== void 0);
   if (known !== void 0)
     return ISSUE_COPY[known.code];
   const blocked = diagnostics.find((entry) => /compatibility|unsupported|unreviewed|no-row/.test(entry.code));
@@ -35824,6 +35852,13 @@ var init_guided = __esm({
       "codex-native-policy-unavailable": "Codex did not expose a writable, versioned user setting. No change is proposed.",
       "codex-native-policy-shadowed": "A project or profile overrides this Codex setting. That setting belongs to you and will not be replaced.",
       "no-providers-registered": "No optimization provider was selected for this operation.",
+      "prompt-routing-target-unavailable": "Token Harness could not locate a supported user-level prompt-hook settings file for this agent.",
+      "prompt-routing-version-unverified": "Automatic routing is not available for this agent version until its prompt-hook format has been verified.",
+      "prompt-routing-runtime-unavailable": "The Token Harness hook command could not run from this dashboard environment. Make Token Harness available on PATH, then review routing again.",
+      "prompt-routing-target-not-file": "A non-file occupies the agent hook settings path, so Token Harness left it unchanged.",
+      "prompt-routing-settings-unmergeable": "The current hook settings cannot be merged safely. Repair the JSON or review the hook manually.",
+      "prompt-routing-already-configured": "Automatic routing hooks are already present. Nothing needs to be changed.",
+      "prompt-routing-existing-hook-conflict": "An existing Token Harness routing hook was changed or only partly installed. It was left untouched for review.",
       "already-in-desired-state": "The supported integration is already configured. Nothing needs to be changed.",
       "delegated-install-snapshot-too-large": "The optimizer setup found too much unrelated data inside its rollback boundary. Nothing was changed. Update Token Harness or use a narrower project directory before retrying.",
       "delegated-install-failed": "The optimizer installer itself did not complete successfully. Nothing was kept from the failed transaction.",
@@ -36862,22 +36897,51 @@ var init_guided = __esm({
           const messages = [];
           const results = [];
           let ok = true;
+          let healthyAtDeclaredTier = true;
           const inventory = await this.call(["doctor"]);
           const present = (inventory.data?.harnesses ?? []).filter((item) => item.state !== "absent" && ["claude", "codex"].includes(item.harnessId));
+          if (inventory.data === null) {
+            ok = false;
+            healthyAtDeclaredTier = false;
+            messages.push("The installed-agent inventory could not be read. Refresh and check the local installation.");
+          }
           if (present.length === 0) {
             ok = false;
-            messages.push("No supported installed agent could be checked. Refresh after installing or signing in.");
+            healthyAtDeclaredTier = false;
+            messages.push("No supported installed agent was detected, so no integration was checked.");
           }
           for (const agent of present) {
             const harness = agent.harnessId;
             this.record(`Checking ${name(harness)} configuration and available execution evidence. No settings changed.`, "working");
             const result6 = await this.call(["verify", "--harness", harness]);
             const healthy = result6.data?.healthyAtDeclaredTier === true;
-            if (!healthy)
+            const versionWarnings = result6.diagnostics.filter((entry) => entry.severity === "warning" && (entry.code === "harness-version-unknown-newer" || entry.code === "provider-version-unknown-newer"));
+            const failed = result6.data === null || result6.exitCode !== 0 || result6.diagnostics.some((entry) => entry.severity === "error" || entry.severity === "warning" && !versionWarnings.includes(entry)) || result6.data.results.some((entry) => entry.status === "degraded" || entry.status === "failed");
+            if (failed)
               ok = false;
+            if (!healthy)
+              healthyAtDeclaredTier = false;
             if (result6.data !== null)
               results.push(...result6.data.results);
-            messages.push(`${name(harness)}: ${healthy ? "the available integration checks passed. This is not proof that every command was reduced." : explainGuideIssue(result6.diagnostics, "execution could not be fully confirmed. The agent may be absent, an integration may not be enabled, or runtime evidence may be unavailable.")}`);
+            const prefix = `${name(harness)}: `;
+            if (result6.data === null) {
+              messages.push(prefix + "the verification report could not be read. Refresh and check the local installation.");
+            } else if (healthy) {
+              messages.push(prefix + "the available integration checks passed. This is not proof that every command was reduced.");
+            } else if (failed) {
+              messages.push(prefix + "a known integration check failed. Review the specific check before changing setup.");
+            } else if (result6.data.results.length === 0) {
+              messages.push(prefix + "the agent is detected, but no managed optimizer connection is present to verify. Review setup only if you want to connect one.");
+            } else {
+              const pendingProviders = [
+                ...new Set(result6.data.results.filter((entry) => entry.status === "not-applicable").map((entry) => name(entry.providerId)))
+              ];
+              const subject = pendingProviders.length > 0 ? pendingProviders.join(" and ") : "Some integrations";
+              messages.push(`${prefix}${subject} have not produced enough attributable runtime evidence for ${name(harness)} yet. This is an evidence gap, not a finding that the setup is broken. If you do not use this agent on this machine, no action is required.`);
+            }
+            if (versionWarnings.length > 0) {
+              messages.push(prefix + "the installed version is newer than Token Harness\u2019s recorded compatibility sample; read-only checks can continue, but review the version before changing its integration.");
+            }
           }
           if (inventory.data !== null) {
             const fingerprint = stackFingerprint(inventory.data);
@@ -36887,7 +36951,7 @@ var init_guided = __esm({
                 receiptId: null,
                 appliedAt: null,
                 results,
-                healthyAtDeclaredTier: ok
+                healthyAtDeclaredTier: healthyAtDeclaredTier && present.length > 0
               }
             };
             this.stackBase = {
@@ -36903,7 +36967,13 @@ var init_guided = __esm({
           if (this.cached !== null)
             this.cached.value = { ...this.cached.value, stack };
           this.record("Integration checks completed. No settings changed.", ok ? "success" : "attention");
-          return { ok, title: "Integration checks", messages, appliedPlans: 0, stack };
+          return {
+            ok,
+            title: ok ? healthyAtDeclaredTier ? "Integration checks passed" : "Configuration checks complete; runtime evidence pending" : "Integration checks need attention",
+            messages,
+            appliedPlans: 0,
+            stack
+          };
         });
       }
     };
@@ -39552,7 +39622,7 @@ var init_guided_product_client = __esm({
         if (!(data.changes || []).length)
           $('modal-content').append(messageBox('No change proposed', (data.notices || []).join(' ') || 'The current routing state or ownership evidence does not support a safe change.'));
         for (const notice of data.notices || []) $('modal-content').append(node('p', notice, 'notice-row'));
-        $('modal-content').append(messageBox(
+        if (data.ticket) $('modal-content').append(messageBox(
           agentId === 'codex' ? 'Codex trust step' : 'When it takes effect',
           agentId === 'codex'
             ? 'After Apply, review and trust the UserPromptSubmit hook in Codex using /hooks. Until a callback is observed, the dashboard will show it as configured but not runtime verified.'