tumwater 0.2.0 → 0.3.0

package/dist/src/doctor/doctor-claude-checks.js

@@ -0,0 +1,145 @@
+import os from "node:os";
+import { childEnv } from "../process/process.js";
+import { boundedProbe } from "./probe.js";
+import { claudeBackend, claudeConfigDir } from "../agent/claude/claude-backend.js";
+import { claudeEnv } from "../agent/claude/claude-env.js";
+import { claudeAuthUsesSubscription, parseClaudeAuthStatus } from "../agent/claude/claude-account.js";
+import { resolvedBackendConfig } from "../config/config-views.js";
+import { envPath } from "../files/files.js";
+import { belowNodeFloor } from "../version.js";
+import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, claudeSeamsInUse, loadConfigForCheck, seamedModels, } from "./doctor-model-checks.js";
+/** The doctor's claude credential and version readiness checks, split out of
+ * doctor-model-checks.ts (whose shared seam/model framework and the pi, tier-models and
+ * image-input checks stay there): checkClaudeAuth, checkAnthroApiKey and checkClaudeVersion.
+ * These are the doctor's only checks that spawn the `claude` binary and read its auth — a
+ * distinct concern from the filesystem/git checks, kept together so a change to how doctor
+ * spawns or scrubs claude does not touch the other model checks. The shared report contract
+ * (CheckOutcome) and the seam/model framework (loadConfigForCheck, claudeSeamsInUse,
+ * seamPairs, the AUTH_CHECK_* budgets) come from doctor-model-checks.ts and outcome.ts,
+ * exactly as the other doctor-* modules share them. */
+/** One bounded probe of the resolved `claude` binary under the scrubbed run environment a real
+ * run gets: resolve the binary through the claude adapter that would spawn it and run `args`
+ * with a short deadline. Null when the probe could not run, the child errored, or the deadline
+ * passed. The one home of the resolveBin + claudeEnv pairing the auth and version checks share,
+ * so neither probes a different binary or environment than the other. */
+function claudeProbe(config, args, pathEnv, timeoutMs) {
+    const resolved = claudeBackend.resolveBin(config);
+    // The configured team config dir must reach the probe's env the way a real run's does, or
+    // the auth/version rows would look in claude's default dir (usually ~/.claude) while a run
+    // with backends.claude.configDir writes and reads elsewhere — the very mismatch doctor exists
+    // to surface. Mirror backends.run's expansion: only claude accepts configDir, and unset leaves
+    // today's env byte-identical.
+    const configDir = resolvedBackendConfig(config, "claude").configDir;
+    const expandedConfigDir = configDir !== undefined ? claudeConfigDir(process.env, os.homedir(), configDir) : undefined;
+    const env = claudeEnv(childEnv({ PATH: pathEnv }), {
+        quietTimeoutSeconds: 0,
+        ...(expandedConfigDir !== undefined ? { configDir: expandedConfigDir } : {}),
+    });
+    return boundedProbe(resolved.bin, args, env, timeoutMs, AUTH_CHECK_MAX_OUTPUT_BYTES);
+}
+/** Run `claude auth status` under the same scrubbed environment a real run gets (claudeEnv),
+ * or null when the probe could not run or its reply was unreadable. */
+async function claudeAuthProbe(config, pathEnv, timeoutMs) {
+    const result = await claudeProbe(config, ["auth", "status"], pathEnv, timeoutMs);
+    if (result?.code !== 0)
+        return null;
+    return parseClaudeAuthStatus(result.stdout);
+}
+/** claude credential readiness (plans/agent-backends.md "Every seam, checked"): a claude seam
+ * whose login is gone fails every run before it can work, so doctor runs `claude auth status`
+ * under the scrubbed run environment and fails when it reports `loggedIn: false`. An ok detail
+ * names the billing the reply implies — the subscription type, or an API key — so an operator
+ * telling subscription spend from API spend does not have to run the command themselves. A
+ * probe that could not run or a reply this cannot read warns rather than guesses. Stands down
+ * (ok) when no seam routes to claude, so a pi-only team spawns nothing. */
+export async function checkClaudeAuth(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    if (!claudeSeamsInUse(config))
+        return okOutcome("no model jobs run on claude");
+    const auth = await claudeAuthProbe(config, pathEnv, timeoutMs);
+    if (auth === null)
+        return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+    if (!auth.loggedIn)
+        return failOutcome("claude reports logged in: false — run `claude auth login`");
+    const subscription = claudeAuthUsesSubscription(auth);
+    const billing = subscription
+        ? `subscription${auth.subscriptionType !== undefined ? ` (${auth.subscriptionType})` : ""}`
+        : "API key";
+    return okOutcome(`logged in — billing: ${billing}`);
+}
+/** The subscription-vs-API billing trap (plans/provider-concurrency.md §9 gap 6): an operator
+ * who exports `ANTHROPIC_API_KEY` for pi's `anthropic` provider will silently move every claude
+ * seam to API billing — claude prefers the key over a claude.ai login — and subscription seams
+ * stop counting as free. Doctor warns when the key is set, some seam routes to claude, and
+ * `claude auth status` reports a claude.ai login (the subscription the key would override). It
+ * stays silent (ok) when no seam runs on claude, when the key is unset, or when claude reports
+ * an API-key login (then there is no subscription to lose). `env` is injectable so the check
+ * stays hermetic; a probe that cannot run warns rather than guesses like checkClaudeAuth. */
+export async function checkAnthroApiKey(root, env = process.env, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    if (!claudeSeamsInUse(config))
+        return okOutcome("no model jobs run on claude");
+    const apiKey = env.ANTHROPIC_API_KEY;
+    if (apiKey === undefined || apiKey === "")
+        return okOutcome("no ANTHROPIC_API_KEY set");
+    const auth = await claudeAuthProbe(config, pathEnv, timeoutMs);
+    if (auth === null)
+        return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+    if (!auth.loggedIn || !claudeAuthUsesSubscription(auth))
+        return okOutcome("ANTHROPIC_API_KEY is set, but claude reports no claude.ai login");
+    return warnOutcome("ANTHROPIC_API_KEY is set while claude reports a claude.ai login — model jobs on claude will bill the API key, not the subscription; unset it or route every anthropic model job on pi explicitly");
+}
+/** The dotted version in `claude --version`'s output, or undefined when it names none. */
+function parseClaudeCliVersion(output) {
+    return /(\d+\.\d+\.\d+)/.exec(output)?.[1];
+}
+/** claude CLI-version readiness (plans/agent-backends.md finding 9): an installed CLI below a
+ * configured model's minimum fails or misprices that model, and team runs disable the
+ * auto-updater, so the version an operator has is the version agent runs use. Fails below the
+ * highest floor among the claude-routed models, naming which model needs it; an ok detail
+ * prints the installed version and the floor it satisfied (or no floor when none applies).
+ * The `off`/`minimal` thinking clamp is noted here too, since this check already has the
+ * claude seams in hand. Stands down when no seam routes to claude. */
+export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    const seams = seamedModels(config, "claude");
+    if (seams.length === 0)
+        return okOutcome("no model jobs run on claude");
+    // The floor each configured model needs; a model the adapter does not gate contributes none.
+    const floors = new Map();
+    for (const seam of seams) {
+        const min = claudeBackend.minVersion?.(seam.model);
+        if (min !== undefined)
+            floors.set(seam.model, min);
+    }
+    const result = await claudeProbe(config, ["--version"], pathEnv, timeoutMs);
+    const found = result !== null && result.code === 0 ? parseClaudeCliVersion(result.stdout) : undefined;
+    if (found === undefined)
+        return warnOutcome("could not check — `claude --version` did not run or its output was unreadable");
+    const clamped = seams.some((seam) => seam.thinking === "off" || seam.thinking === "minimal");
+    const clampNote = clamped
+        ? "; `off`/`minimal` thinking clamps to `--effort low` (claude has no lower setting)"
+        : "";
+    if (floors.size === 0)
+        return okOutcome(`claude ${found}${clampNote}`);
+    // The highest floor decides: whichever model needs the newest CLI. Below it, fail and name
+    // that model; at or above, print the version against the floor.
+    let required = "";
+    let neededBy = "";
+    for (const [model, min] of floors) {
+        if (required === "" || belowNodeFloor(required, `>=${min}`)) {
+            required = min;
+            neededBy = model;
+        }
+    }
+    if (belowNodeFloor(found, `>=${required}`))
+        return failOutcome(`claude ${found} is older than ${required} required by ${neededBy} — run \`claude update\``);
+    return okOutcome(`claude ${found} (>= ${required} for ${neededBy})${clampNote}`);
+}

package/dist/src/doctor/doctor-codex-checks.js

@@ -0,0 +1,279 @@
+import fs from "node:fs";
+import path from "node:path";
+import { childEnv } from "../process/process.js";
+import { boundedProbe } from "./probe.js";
+import { codexBackend, CODEX_MIN_VERSION } from "../agent/codex/codex-backend.js";
+import { codexEffort, EFFORT_BY_THINKING } from "../agent/codex/codex-args.js";
+import { codexEnv } from "../agent/codex/codex-env.js";
+import { codexHome, readCodexCatalog } from "../agent/codex/codex-catalog.js";
+import { codexHookTrust } from "../agent/codex/codex-hook-trust.js";
+import { parseCodexLoginStatus } from "../agent/codex/codex-account.js";
+import { codexWriteGuardDefinition } from "../agent/codex/codex-write-guard.js";
+import { resolvedBackendConfig } from "../config/config-views.js";
+import { envPath, isDirectory, readTextOrNull, statOrNull, treeBytes } from "../files/files.js";
+import { formatBytes, tokenWindowLabel } from "../text/format.js";
+import { errorMessage } from "../text/text.js";
+import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, codexSeamsInUse, loadConfigForCheck, minVersionOutcome, seamedModels, } from "./doctor-model-checks.js";
+/** The doctor's codex rows (part 9a/9, plans/codex-backend.md §4, §7, "Hand steps"): one
+ * exported check per row — install/version, login, home, models, account, leaks, sessions
+ * size and the write guard. These are the doctor's only checks that spawn the `codex` CLI and
+ * read the team's
+ * `CODEX_HOME` state (catalog, skills, hooks, sessions, rollouts) — a distinct concern from the
+ * filesystem/git checks, kept together so a change to how doctor reads codex does not touch the
+ * other model checks. Each returns null (omitting its row) when no seam routes to codex, so a
+ * pi-only team shows no codex row and spawns nothing and reads nothing. The shared
+ * report contract (CheckOutcome) and the seam/model framework (loadConfigForCheck,
+ * codexSeamsInUse, seamPairs, the AUTH_CHECK_* budgets) come from doctor-model-checks.ts and
+ * outcome.ts, as the other doctor-* modules share them. */
+/** The config and codex home a codex readiness row reads, or the warn outcome a broken
+ * `tumwater.json` earns, or null when no seam routes to codex (the row's stand-down). All
+ * eight rows repeat the same three-line guard and the same home lookup
+ * (`codexHome(resolvedBackendConfig(config, "codex"))`); this folds them so a change to how
+ * doctor reads codex's home touches one spot instead of seven. `home` is always the team's
+ * codex home, whether or not the row needs it. */
+function codexCheckBase(root) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    if (!codexSeamsInUse(config))
+        return null;
+    return { config, home: codexHome(resolvedBackendConfig(config, "codex")) };
+}
+/** One bounded probe of the resolved `codex` binary under the scrubbed run environment a real
+ * run gets: resolve the binary through the codex adapter that would spawn it, point it at the
+ * run's home (`CODEX_HOME`), and run `args` with a short deadline. Null when the probe could
+ * not run, the child errored, or the deadline passed. The one home of the resolveBin + codexEnv
+ * pairing the version and login rows share, so neither probes a different binary or environment
+ * than the other. */
+function codexProbe(config, args, pathEnv, timeoutMs) {
+    const resolved = codexBackend.resolveBin(config);
+    const home = codexHome(resolvedBackendConfig(config, "codex"));
+    const env = codexEnv(childEnv({ PATH: pathEnv }), { home });
+    return boundedProbe(resolved.bin, args, env, timeoutMs, AUTH_CHECK_MAX_OUTPUT_BYTES);
+}
+/** The dotted version in `codex --version`'s output, or undefined when it names none. */
+function parseCodexCliVersion(output) {
+    return /(\d+\.\d+\.\d+)/.exec(output)?.[1];
+}
+/** codex CLI-version readiness (plans/codex-backend.md "Hand steps", H1): the team targets
+ * `CODEX_MIN_VERSION` or later, the version H1 verified live. An installed CLI below that fails
+ * naming the floor and the upgrade; at or above it reads the version. Stands down when no seam
+ * routes to codex. */
+export async function checkCodexVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const result = await codexProbe(base.config, ["--version"], pathEnv, timeoutMs);
+    const found = result?.code === 0 ? parseCodexCliVersion(result.stdout) : undefined;
+    return minVersionOutcome("codex", found, CODEX_MIN_VERSION, "upgrade the codex CLI");
+}
+/** codex login readiness (plans/codex-backend.md §4, §7): a ChatGPT login is subscription
+ * billing and passes; an API-key login is refused (decision 5 — Codex reports no cost, so an
+ * API key would spend money the cap cannot see) with the startup gate's message; a logged-out
+ * home fails naming the login command under the run's `CODEX_HOME`. A probe that could not run
+ * or a reply this cannot read (neither a ChatGPT login, an API key, nor an explicit
+ * not-logged-in) warns rather than guesses. Stands down when no seam routes to codex. */
+export async function checkCodexAuth(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const { home } = base;
+    const result = await codexProbe(base.config, ["login", "status"], pathEnv, timeoutMs);
+    if (result?.code !== 0)
+        return warnOutcome("could not check — `codex login status` did not run or its output was unreadable");
+    const status = parseCodexLoginStatus(result.stdout);
+    if (status === "subscription")
+        return okOutcome("logged in using ChatGPT — billing: subscription");
+    if (status === "api")
+        return failOutcome(`Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run \`CODEX_HOME=${home} codex login --device-auth\``);
+    if (/Not logged in/i.test(result.stdout ?? ""))
+        return failOutcome(`codex is not logged in — run \`CODEX_HOME=${home} codex login --device-auth\``);
+    return warnOutcome("could not check — `codex login status` reply was unreadable");
+}
+/** codex home readiness (plans/codex-backend.md §4): unset `backends.codex.configDir` warns
+ * that team runs share the operator's `~/.codex` — the trust entries, team sessions in the
+ * `codex resume` picker, any skills and a global `AGENTS.md`. Set, it reads the team home.
+ * Stands down when no seam routes to codex. */
+export async function checkCodexHome(root) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const configDir = resolvedBackendConfig(base.config, "codex").configDir;
+    if (configDir === undefined)
+        return warnOutcome("backends.codex.configDir is unset — team runs share the user's ~/.codex (trust entries, team sessions in the resume picker, skills, a global AGENTS.md); set backends.codex.configDir to a home of the team's own");
+    return okOutcome(`team codex home: ${codexHome({ configDir })}`);
+}
+/** codex model readiness (plans/codex-backend.md §7): every codex-routed model must be in the
+ * home's catalog (`models_cache.json`) — a missing model warns that its thinking levels and
+ * window are unknown, and a thinking level the catalog does not list warns that it is dropped.
+ * The cataloged models are reported with their context window. Stands down when no seam routes
+ * to codex. */
+export async function checkCodexModels(root) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const { config, home } = base;
+    const catalog = readCodexCatalog(home);
+    const models = seamedModels(config, "codex");
+    const warns = [];
+    const notes = [];
+    for (const pair of models) {
+        const entry = catalog.get(pair.model);
+        if (entry === undefined) {
+            warns.push(`${pair.model} is not in the codex catalog (models_cache.json) — thinking levels and the window are unknown`);
+            continue;
+        }
+        const window = tokenWindowLabel(entry.contextWindow);
+        notes.push(`${pair.model} — ${window}`);
+        // A level is dropped when the run path would send no effort for it: `codexEffort` maps the
+        // thinking through EFFORT_BY_THINKING (off/minimal clamp to low) and yields undefined when
+        // the model's catalog does not list that effort (part 5/9's codexEffort). A thinking level
+        // with no mapping at all (e.g. ultra — never sent) is not a catalog gap, so it is not warned.
+        if (pair.thinking !== undefined &&
+            pair.thinking !== "" &&
+            Object.hasOwn(EFFORT_BY_THINKING, pair.thinking) &&
+            codexEffort(pair.thinking, entry.levels) === undefined) {
+            warns.push(`${pair.model} has no ${pair.thinking} thinking level in the catalog — that level is dropped`);
+        }
+    }
+    if (warns.length > 0) {
+        const extra = notes.length > 0 ? `; ${notes.join("; ")}` : "";
+        return warnOutcome(`${warns.join("; ")}${extra}`);
+    }
+    return okOutcome(notes.length > 0 ? `codex models ready — ${notes.join("; ")}` : "no codex-routed models declared");
+}
+/** A `has_credits` reading from the home's rollout captures, or null when none names it.
+ * `has_credits` travels in each run's `token_count.rate_limits.credits` (design §7), so the
+ * account row reads the captures a finished run left rather than a live probe — the same
+ * source the runtime account is fed from. The newest capture (by file mtime) wins,
+ * approximating the account's current state — readdir order is filesystem order, not
+ * chronological, so the captures are sorted by mtime first. A missing reading is the safe
+ * direction (nothing to warn about). */
+function codexSessionCredits(home) {
+    const sessions = path.join(home, "sessions");
+    if (!isDirectory(sessions))
+        return null;
+    const rollouts = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const p = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(p);
+            else if (entry.isFile() && /^rollout-.*\.jsonl$/.test(entry.name)) {
+                const st = statOrNull(p);
+                if (st !== null)
+                    rollouts.push({ file: p, mtimeMs: st.mtimeMs });
+            }
+        }
+    };
+    walk(sessions);
+    rollouts.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    for (const r of rollouts) {
+        const text = readTextOrNull(r.file);
+        if (text === null)
+            continue;
+        const m = /"has_credits"\s*:\s*(true|false)/.exec(text);
+        if (m !== null)
+            return m[1] === "true";
+    }
+    return null;
+}
+/** codex account readiness (plans/codex-backend.md §7 "Credits"): a Plus account can buy
+ * credits that run past the windows, and tumwater never spends them on purpose but cannot see
+ * the amount, so doctor warns when the runs' captures report `has_credits: true` — the run that
+ * crosses a limit may draw on them. Otherwise it reads ok with the safe direction. Stands down
+ * when no seam routes to codex. */
+export async function checkCodexAccount(root) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const { home } = base;
+    const hasCredits = codexSessionCredits(home);
+    if (hasCredits === true)
+        return warnOutcome("the codex account can buy credits (has_credits: true) — a run that crosses a limit may spend credits tumwater cannot count; clear the credit balance or accept the blind spend");
+    return okOutcome(hasCredits === false ? "no credits — runs stop at the subscription window" : "no credit reading yet — runs stop at the subscription window");
+}
+/** codex home leaks (plans/codex-backend.md §4): the operator's home `AGENTS.md`, any
+ * `skills/` entry beyond `.system`, any `hooks/` entry, and the target repo's
+ * `.codex/config.toml` MCP servers each still load into team runs, so each is named as one
+ * warning. Stands down when no seam routes to codex. */
+export async function checkCodexLeaks(root) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const { home } = base;
+    const warns = [];
+    const agentsMd = path.join(home, "AGENTS.md");
+    if (statOrNull(agentsMd)?.isFile() === true)
+        warns.push(`${agentsMd} still loads into team runs`);
+    const skills = path.join(home, "skills");
+    if (isDirectory(skills)) {
+        for (const entry of fs.readdirSync(skills)) {
+            if (entry === ".system")
+                continue;
+            warns.push(`${path.join(skills, entry)} — a skill beyond .system still loads into team runs`);
+        }
+    }
+    const hooks = path.join(home, "hooks");
+    if (isDirectory(hooks)) {
+        for (const entry of fs.readdirSync(hooks))
+            warns.push(`${path.join(hooks, entry)} — a hook still loads into team runs`);
+    }
+    // The target repo's own `.codex/config.toml` MCP servers (design §4): a repo-local config
+    // with an `[mcp_servers.NAME]` section loads those servers into every team run here.
+    const repoConfig = path.join(root, ".codex", "config.toml");
+    const text = readTextOrNull(repoConfig);
+    if (text !== null) {
+        const servers = [...text.matchAll(/^\s*\[mcp_servers\.([^\]]+)\]\s*$/gm)].map((m) => m[1]);
+        for (const server of servers)
+            warns.push(`${repoConfig} configures MCP server ${server}, which loads into team runs`);
+    }
+    if (warns.length === 0)
+        return okOutcome("no codex home leaks");
+    return warnOutcome(warns.join("; "));
+}
+/** The size of the home's `sessions/` (plans/codex-backend.md §4): the retention knob prunes
+ * expired sessions, and doctor reports how much the collection holds so the operator can size
+ * the knob. Stands down when no seam routes to codex. */
+export async function checkCodexSessions(root) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const { home } = base;
+    const sessions = path.join(home, "sessions");
+    const size = isDirectory(sessions) ? treeBytes(sessions) : null;
+    return okOutcome(size !== null ? `codex sessions: ${formatBytes(size)}` : "codex sessions: no sessions dir");
+}
+/** The bound on the codex write-guard row's trust lookup, matching the group's other calls. */
+const CODEX_HOOK_TRUST_TIMEOUT_MS = 10_000;
+/** codex write-guard readiness (plans/codex-write-guard.md "Visibility (parts 8–9)"): whether
+ * codex runs the trusted write-guard hook under this team's home, so the operator sees whether
+ * codex edits are guarded and why not when they are not. Asks codex's own `hooks/list` through
+ * codexHookTrust for the current build's definition, bounded like the group's other Codex calls;
+ * the cache file it writes is the one writable surface Doctor keeps. A trust reading gives the
+ * pass row naming the hash's first 12 hex; a failed lookup warns with its reason — codex then
+ * runs edits without the worktree check. Stands down when no seam routes to codex. */
+export async function checkCodexWriteGuard(root, pathEnv = envPath(), timeoutMs = CODEX_HOOK_TRUST_TIMEOUT_MS) {
+    const base = codexCheckBase(root);
+    if (base === null || "level" in base)
+        return base;
+    const resolved = codexBackend.resolveBin(base.config);
+    const { home } = base;
+    const env = codexEnv(childEnv({ PATH: pathEnv }), { home });
+    const definition = codexWriteGuardDefinition();
+    try {
+        const trust = await codexHookTrust(root, { bin: resolved.bin, env, cwd: root, definition, timeoutMs });
+        return okOutcome(`trusted (sha256:${trust.hash.replace(/^sha256:/, "").slice(0, 12)})`);
+    }
+    catch (error) {
+        return warnOutcome(`off: ${errorMessage(error)} — codex runs edit without the worktree check`);
+    }
+}