unbound-cli 1.16.21 → 1.16.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.21",
+  "version": "1.16.23",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/commands/doctor.js

@@ -130,7 +130,7 @@ Examples:
             const reasons = [];
             if (t.conflict) reasons.push('two modes installed');
             for (const c of t.checks) if (!c.ok) reasons.push(c.summary || c.name);
-            s = C.red(`✗ Tampered — ${reasons.join(', ')}`);
+            s = C.red(`✗ ${t.notEnforced ? 'Not enforced' : 'Tampered'} — ${reasons.join(', ')}`);
           } else s = C.dim('○ Not set up');
           console.log(`  ${labelOf(t).padEnd(W)}   ${s}`);
         }
@@ -153,6 +153,8 @@ Examples:
         const userNames = userTampered.map((t) => t.label).join(', ');
         const mdmNames = mdmTampered.map((t) => t.label).join(', ');
         const allFix = tampered.map((t) => t.key);
+        // A codex policy can live only in the user's cache, which a sudo re-detection may not see.
+        const mdmCmd = elevated(mdmTampered.some((t) => t.notEnforced) ? `unbound setup ${mdmFix.join(' ')}` : 'unbound doctor --fix');
         const anyInstalled = tools.some((t) => t.status !== 'not-installed');
 
         if (opts.fix) {
@@ -176,7 +178,7 @@ Examples:
           // tools only, and point at sudo for whatever's org-managed.
           if (!root && !userFix.length) {
             console.log(`${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
             console.log('');
             process.exitCode = 1;
             return;
@@ -186,7 +188,7 @@ Examples:
           output.info(`Reinstalling: ${fixDisplay}${root ? ' (org-wide, all users)' : ''}`);
           console.log('');
           const r = spawnSync(process.argv[0], [process.argv[1], 'setup', ...fixNow], { stdio: 'inherit' });
-          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+          if (!root && mdmFix.length) console.error(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
           process.exitCode = fixExitCode(r.status, root, mdmFix.length > 0) || ((configMismatch || blankConfigDir) ? 1 : 0);
           return;
         }
@@ -213,11 +215,11 @@ Examples:
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
           } else if (!userFix.length) {
             console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization.`);
-            console.log(`  Run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
+            console.log(`  Run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'}.`);
           } else {
             // Both: a user without sudo can still fix their own tools; sudo fixes everything.
             console.log(`  Run ${C.bold('unbound doctor --fix')} to repair ${userNames}.`);
-            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(elevated('unbound doctor --fix'))} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
+            console.log(`  ${mdmNames} ${mdmFix.length === 1 ? 'is' : 'are'} set up by your organization — run ${C.bold(mdmCmd)} to repair ${mdmFix.length === 1 ? 'it' : 'them'} too.`);
           }
         }
         if (key.state === 'invalid') {

package/src/lib/policy-ai-assist.js

@@ -12,13 +12,61 @@ const MAX_PROMPT_LEN = 1800;
 const TOOL_ACTIONS = ['AUDIT', 'BLOCK', 'WARN', 'REQUIRE_SLACK_APPROVAL'];
 
 const OUT_OF_SCOPE_KEYWORDS = Object.freeze([
-  'staging', 'production', 'prod', 'dev', 'qa', 'testing',
   'archived', 'archive',
   'business hour', 'after hour', 'outside hour', 'weekend',
-  'except', 'unless', 'but not',
+  'except', 'unless', 'but not', 'non-prod', 'non prod',
   'private repo', 'public repo', 'private project', 'public project',
 ]);
 
+// Terminal policies can scope by environment (cloud_*, database_* and
+// build_operation carry an `environment` field); MCP tool policies cannot.
+const MCP_OUT_OF_SCOPE_KEYWORDS = Object.freeze([
+  'staging', 'production', 'prod', 'dev', 'qa', 'testing',
+  ...OUT_OF_SCOPE_KEYWORDS,
+]);
+
+// Environment words checked against the prompt after the assist reply, whole
+// words only ("product-catalog" is not "prod"). Words that are also everyday
+// English ("npm test", "git stage", "live reload") count only before an
+// environment noun or after in/to/on/against/into ("in the test environment",
+// "deploy to live").
+// `pre-?prod` precedes bare `prod` so "pre-prod" reads as pre-production, not
+// as production; the regex alternates left to right.
+const ENVIRONMENT_WORDS = 'production|pre[-_ ]?prod(?:uction)?|preprod|prod|prd|staging|stg|uat|dev|development|sandbox|sbx|qa|mainnet';
+const CONTEXT_ENVIRONMENT_WORDS = 'test|testing|tst|live|stage|local|localhost';
+const ENVIRONMENT_NOUNS = 'environment|env|cluster|namespace|servers?|database|db|account|project|stack|deployment|instances?';
+// `\b` treats `_` as a word char and cannot see `prod_db`; the separator class
+// can. A negated word is dropped: "non-prod" asks for the opposite of `prod`.
+const ENVIRONMENT_WORD_RE = new RegExp(
+  `(?<!non[-_ ]?)(?<![a-z0-9])(${ENVIRONMENT_WORDS})(?![a-z0-9])`
+  + `|\\b(?:in|to|on|against|into)\\s+(?:the\\s+)?(${CONTEXT_ENVIRONMENT_WORDS})\\b`
+  + `|\\b(${CONTEXT_ENVIRONMENT_WORDS})\\s+(?:${ENVIRONMENT_NOUNS})\\b`,
+  'gi'
+);
+
+// Environment token -> label. Source of truth: the gateway's deterministic
+// classifier, src/services/classifier/deterministic/environmentTokens.ts.
+const ENVIRONMENT_LABELS = Object.freeze({
+  prod: 'production', production: 'production', prd: 'production', live: 'production', mainnet: 'production',
+  stg: 'staging', staging: 'staging', stage: 'staging', uat: 'staging', preprod: 'staging', preproduction: 'staging',
+  dev: 'dev', development: 'dev', sandbox: 'dev', sbx: 'dev',
+  test: 'test', testing: 'test', tst: 'test',
+  local: 'local', localhost: 'local', '127.0.0.1': 'local',
+});
+
+// Aliases holding a separator, which tokenising would break apart.
+const DOTTED_OR_HYPHENATED_ALIASES = Object.keys(ENVIRONMENT_LABELS).filter((k) => /[^a-z0-9]/.test(k));
+
+// Pre-production spelled with a separator. The label table holds only the
+// collapsed `preprod`, so these spellings are matched before tokenising.
+const SEPARATED_PREPROD_RE = /(?<![a-z0-9])pre[^a-z0-9]+prod(?:uction)?(?![a-z0-9])/g;
+
+// The label for a detected word, after collapsing separators so the spellings
+// the prompt regex accepts ("pre-prod", "pre prod") reach the same entry.
+function normaliseEnvironmentWord(word) {
+  return ENVIRONMENT_LABELS[word] ?? ENVIRONMENT_LABELS[String(word).replace(/[^a-z0-9]+/g, '')];
+}
+
 // Single source of truth for --action override validation. Used both early
 // (in runTerminalPromptCreate, to fail before the assist POST) and late
 // (in mergeAiAndFlags, when applying the override). Returns the normalized
@@ -44,13 +92,15 @@ async function loadPrivileges() {
   return _privilegesCache;
 }
 
-function validatePromptPreflight(opts) {
+function validatePromptPreflight(opts, keywords) {
   if (!opts || typeof opts.prompt !== 'string') {
     throw new Error('--prompt is required.');
   }
   const collapsed = opts.prompt
     .replace(/\n{2,}/g, '\n')
-    .replace(/[^\x20-\x7e\n\t]/g, '');
+    // A stripped run becomes a space: a non-breaking space (routine in pasted
+    // text) would otherwise glue the words it separated into one.
+    .replace(/[^\x20-\x7e\n\t]+/g, ' ');
   const sanitizedPrompt = collapsed.trim();
   if (sanitizedPrompt.length > MAX_PROMPT_LEN) {
     const e = new Error(`Input is too long (max ${MAX_PROMPT_LEN} characters).`);
@@ -59,12 +109,28 @@ function validatePromptPreflight(opts) {
   }
   const warnings = [];
   const lower = sanitizedPrompt.toLowerCase();
-  for (const token of OUT_OF_SCOPE_KEYWORDS) {
+  for (const token of keywords) {
     if (lower.includes(token)) warnings.push(token);
   }
   return { sanitizedPrompt, warnings };
 }
 
+function outOfScopeWarning(word, scopes) {
+  return `Your prompt mentions \`${word}\`. Tool policies cannot scope by ${scopes} clauses. The endpoint will ignore those parts.`;
+}
+
+// `conditions` is the full AND list; selected_field / field_value only mirror
+// conditions[0] for single-condition consumers.
+function configFromAssist(f) {
+  const conditions = Array.isArray(f.conditions) ? f.conditions.filter((c) => c && c.field) : [];
+  if (!conditions.length) {
+    return f.selected_field ? { [f.selected_field]: String(f.field_value || '').trim() } : {};
+  }
+  const config = {};
+  for (const c of conditions) config[c.field] = String(c.value ?? '').trim();
+  return config;
+}
+
 function mergeAiAndFlags(formUpdates, opts) {
   const f = formUpdates || {};
   const body = {
@@ -74,9 +140,7 @@ function mergeAiAndFlags(formUpdates, opts) {
   if (f.description) body.description = f.description;
   if (f.command_family) body.command_family = f.command_family;
 
-  const field = f.selected_field || '';
-  const value = f.field_value || '';
-  body.config = field ? { [field]: value } : {};
+  body.config = configFromAssist(f);
 
   body.action = (f.action ? String(f.action).toUpperCase() : 'AUDIT');
 
@@ -103,6 +167,63 @@ function mergeAiAndFlags(formUpdates, opts) {
   return body;
 }
 
+// True when a condition value already targets the environment `word`: one of
+// its tokens is the word (branch 'production', 'make release-prod') or an alias
+// of the same label (namespace '*prod*' or 'prod-*' for "production").
+// Whole tokens only, so 'product-catalog' does not target "prod".
+function targetsEnvironment(value, word) {
+  const label = normaliseEnvironmentWord(word);
+  const v = String(value).toLowerCase();
+  // An all-wildcard pattern matches every environment, so it targets this one.
+  if (/^\*+$/.test(v.trim())) return true;
+  // Tokens split on non-alphanumerics, so an alias holding one (`127.0.0.1`)
+  // never survives as a token and is matched on the whole value.
+  if (DOTTED_OR_HYPHENATED_ALIASES.some((a) => v.includes(a) && ENVIRONMENT_LABELS[a] === label)) {
+    return true;
+  }
+  // `pre-prod` is pre-production however it is spelled, so it is consumed before
+  // tokenising: the `prod` left behind would otherwise read as production.
+  let preprod = false;
+  const tokens = v.replace(SEPARATED_PREPROD_RE, () => { preprod = true; return ' '; }).split(/[^a-z0-9]+/);
+  if (preprod && label === ENVIRONMENT_LABELS.preprod) return true;
+  return tokens.some(
+    (token) => token === word || (label !== undefined && ENVIRONMENT_LABELS[token] === label)
+  );
+}
+
+// Only some families (cloud_*, database_*, build_operation) have an
+// `environment` field, so the resolved policy can silently drop or narrow an
+// environment the prompt named. A word some condition already targets was
+// applied, so it does not warn. Returns true when it warned.
+function warnEnvironmentScope(prompt, body) {
+  const environment = String(body.config.environment ?? '').trim();
+  // An `environment` condition decides scope on its own. Another field holding
+  // the word (`service: prod-api`) does not widen it, so it cannot vouch here.
+  // Present-but-blank still decides: a blank condition scopes to nothing.
+  const values = Object.prototype.hasOwnProperty.call(body.config, 'environment')
+    ? [environment]
+    : Object.values(body.config);
+  const words = new Set([...prompt.matchAll(ENVIRONMENT_WORD_RE)].map((m) => (m[1] || m[2] || m[3]).toLowerCase()));
+  let warned = environment ? warnUnrecognisedEnvironment(environment) : false;
+  for (const word of words) {
+    if (values.some((v) => targetsEnvironment(v, word))) continue;
+    const scope = environment
+      ? `this policy's environment condition is \`${environment}\`, so it does not apply in ${word}`
+      : `this ${body.command_family || 'terminal'} policy has no environment condition, so it applies in all environments`;
+    output.warn(`Your prompt mentions \`${word}\`, but ${scope}.`);
+    warned = true;
+  }
+  return warned;
+}
+
+function warnUnrecognisedEnvironment(environment) {
+  if (String(environment).replace(/\*/g, '').trim().toLowerCase() !== 'qa') return false;
+  const labels = [...new Set(Object.values(ENVIRONMENT_LABELS))];
+  const aliases = Object.keys(ENVIRONMENT_LABELS).filter((token) => ENVIRONMENT_LABELS[token] !== token);
+  output.warn(`\`qa\` is not a recognised environment label (recognised: ${labels.join(', ')}, and their aliases ${aliases.join(', ')}), so this policy may not match.`);
+  return true;
+}
+
 function colorAction(action) {
   const colors = output.colors;
   if (!action) return '(unspecified)';
@@ -117,10 +238,8 @@ function renderTerminalPreview(body, explanation) {
     ? `groups: ${body.scope_user_group_ids.join(', ')}`
     : '(org-wide)';
   const family = body.command_family || '(unspecified)';
-  const cfg = body.config || {};
-  const cfgKeys = Object.keys(cfg);
-  const fieldKey = cfgKeys[0] || '(unspecified)';
-  const pattern = cfgKeys.length ? String(cfg[cfgKeys[0]]) : '(unspecified)';
+  const cfgEntries = Object.entries(body.config || {});
+  const matches = cfgEntries.length ? cfgEntries : [['(unspecified)', '(unspecified)']];
 
   // Header goes to stdout (NOT output.info, which writes to stderr) so the
   // whole preview — header, keyValue rows, explanation — is captured by a
@@ -134,8 +253,11 @@ function renderTerminalPreview(body, explanation) {
   if (body.description) rows.push(['Description', body.description]);
   rows.push(['Type', body.policy_type]);
   rows.push(['Command family', family]);
-  rows.push(['Field', fieldKey]);
-  rows.push(['Pattern', pattern]);
+  if (matches.length > 1) rows.push(['Conditions', output.colors.dim('all must match (AND)')]);
+  for (const [key, value] of matches) {
+    rows.push(['Field', key]);
+    rows.push(['Pattern', String(value)]);
+  }
   rows.push(['Action', colorAction(body.action)]);
   if (body.custom_message) rows.push(['Custom message', body.custom_message]);
   rows.push(['Scope (groups)', scope]);
@@ -204,6 +326,10 @@ function confirmCreate() {
   return promptYesNo('Create policy? [Y/n] ', true);
 }
 
+function confirmCreateAnyway() {
+  return promptYesNo('Create policy anyway? [y/N] ', false);
+}
+
 function confirmContinue() {
   return promptYesNo('Continue anyway? The endpoint will ignore those parts. [y/N] ', false);
 }
@@ -237,9 +363,9 @@ async function runTerminalPromptCreate(opts) {
   // care about the throw side-effect; mergeAiAndFlags re-validates and applies.
   validateActionOverride(opts.action);
 
-  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts);
+  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts, OUT_OF_SCOPE_KEYWORDS);
   for (const w of warnings) {
-    output.warn(`Your prompt mentions \`${w}\`. Tool policies cannot scope by environment / project / time / exception clauses. The endpoint will ignore those parts.`);
+    output.warn(outOfScopeWarning(w, 'project / time / exception'));
   }
   if (warnings.length && !opts.yes && !opts.json) {
     const cont = await confirmContinue();
@@ -314,10 +440,11 @@ async function runTerminalPromptCreate(opts) {
   }
 
   if (!opts.json) renderTerminalPreview(body, response.explanation);
+  const warned = warnEnvironmentScope(sanitizedPrompt, body);
 
   let confirmed = true;
   if (!opts.yes && !opts.json) {
-    confirmed = await confirmCreate();
+    confirmed = await (warned ? confirmCreateAnyway() : confirmCreate());
   }
   return { body, confirmed, explanation: response.explanation };
 }
@@ -402,9 +529,9 @@ async function runMcpPromptCreate(opts) {
 
   validateActionOverride(opts.action);
 
-  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts);
+  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts, MCP_OUT_OF_SCOPE_KEYWORDS);
   for (const w of warnings) {
-    output.warn(`Your prompt mentions \`${w}\`. Tool policies cannot scope by environment / project / time / exception clauses. The endpoint will ignore those parts.`);
+    output.warn(outOfScopeWarning(w, 'environment / project / time / exception'));
   }
   if (warnings.length && !opts.yes && !opts.json) {
     const cont = await confirmContinue();
@@ -494,6 +621,7 @@ async function runMcpPromptCreate(opts) {
 module.exports = {
   MAX_PROMPT_LEN,
   OUT_OF_SCOPE_KEYWORDS,
+  MCP_OUT_OF_SCOPE_KEYWORDS,
   validatePromptPreflight,
   mergeAiAndFlags,
   renderTerminalPreview,

package/src/toolHealth.js

@@ -16,7 +16,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { spawnSync } = require('child_process');
+const { spawnSync, execFileSync } = require('child_process');
 const TOML = require('@iarna/toml');
 const claudePaths = require('./claudePaths');
 
@@ -238,7 +238,7 @@ function managedDir(family, platform = process.platform, env = process.env) {
   const dirs = {
     cursor: { darwin: `${mac}/Cursor`, linux: '/etc/cursor', win32: path.join(pd, 'Cursor') },
     'claude-code': { darwin: `${mac}/ClaudeCode`, linux: '/etc/claude-code', win32: path.join(pf, 'ClaudeCode') },
-    codex: { darwin: `${mac}/Codex`, linux: '/etc/codex', win32: path.join(pf, 'Codex') },
+    codex: { darwin: '/etc/codex', linux: '/etc/codex', win32: path.join(pf, 'Codex') },
     augment: { darwin: '/etc/augment', linux: '/etc/augment', win32: path.join(pd, 'Augment') },
   };
   if (!dirs[family]) return null;
@@ -371,7 +371,7 @@ function buildVariants(gatewayUrl, binaryPath) {
           const features = cfg.features;
           if (!features || typeof features !== 'object') return false;
           return features.hooks === undefined ? features.codex_hooks === true : features.hooks === true;
-        } }, { short: 'codex hooks not enabled' }),
+        } }, { short: 'codex hooks not enabled', kind: 'aux' }), // aux: an org install leaves it set with no user hook
         scriptCheck('Hook script', '~/.codex/hooks/unbound.py'),
         envKeyCheck('API key env', 'UNBOUND_CODEX_API_KEY'),
       ],
@@ -436,6 +436,23 @@ function detectVariant(variant) {
   return { key: variant.key, label: variant.label, family: variant.family, mode: variant.mode, status: statusOf(checks), checks };
 }
 
+// Where codex's requirements set allow_managed_hooks_only (codex then skips user-level hooks), or null.
+// Reads the host's real policy files, like mdmDetect reads its managed dirs; tests pass _codexManagedOnly.
+function codexManagedHooksOnly() {
+  const on = (text) => /^[ \t]*["']?allow_managed_hooks_only["']?[ \t]*=[ \t]*true\b/m.test((text || '').replace(/^\uFEFF/, ''));
+  const strings = (v) => (typeof v === 'string' ? [v] : v && typeof v === 'object' ? Object.values(v).flatMap(strings) : []);
+  const system = process.platform === 'win32' ? path.join(process.env.ProgramData || 'C:\\ProgramData', 'OpenAI', 'Codex', 'requirements.toml') : '/etc/codex/requirements.toml';
+  if (on(readText(system))) return system;
+  // The cloud cache is JSON; its TOML lives in string values.
+  const cache = path.join(process.env.CODEX_HOME || path.join(HOME, '.codex'), 'cloud-config-bundle-cache.json');
+  if (strings(readJson(cache)).some(on)) return cache;
+  const plist = '/Library/Managed Preferences/com.openai.codex.plist';
+  try {
+    const b64 = execFileSync('/usr/bin/plutil', ['-extract', 'requirements_toml_base64', 'raw', '-o', '-', plist], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    return on(Buffer.from(b64, 'base64').toString()) ? plist : null;
+  } catch { return null; }
+}
+
 // Collapse the per-(tool,mode) variants to one entry per product family. Picks
 // the installed/tampered mode if any; otherwise reports managed-by-mdm or
 // not-installed. This is what both `doctor` and `status` render.
@@ -443,7 +460,8 @@ function detectVariant(variant) {
 // org-managed scenarios can be exercised without writing under /Library or /etc.
 // `_binaryPath` (test-only) overrides the system hook-binary path so binary-mode
 // scenarios can be exercised without writing under /opt.
-function detectTools({ gatewayUrl, _mdmDirs, _binaryPath } = {}) {
+// `_codexManagedOnly` (test-only) replaces the codexManagedHooksOnly() result.
+function detectTools({ gatewayUrl, _mdmDirs, _binaryPath, _codexManagedOnly } = {}) {
   const variants = buildVariants(gatewayUrl, _binaryPath).map(detectVariant);
   const families = [];
   const seen = new Set();
@@ -472,6 +490,16 @@ function detectTools({ gatewayUrl, _mdmDirs, _binaryPath } = {}) {
       }
     }
   }
+  // A working org hook in codex's system folder runs regardless, so only a user-level install is at risk.
+  // Gateway mode proxies traffic and is unaffected; a dual-mode install already reports 'two modes installed'.
+  const codex = families.find((t) => t.key === 'codex-subscription' && t.status !== 'not-installed');
+  const atRisk = codex && mdmDetect('codex', _mdmDirs && _mdmDirs.codex, _binaryPath).status !== 'healthy';
+  const managedOnly = atRisk && (_codexManagedOnly !== undefined ? _codexManagedOnly : codexManagedHooksOnly());
+  if (managedOnly) {
+    codex.checks.push({ name: 'Managed hooks only', ok: false, kind: 'structural', summary: 'Codex only runs managed hooks',
+      detail: `allow_managed_hooks_only is set in ${managedOnly}` });
+    Object.assign(codex, { status: 'tampered', notEnforced: true, scope: 'mdm' });
+  }
   return families;
 }
 

package/test/codex-managed-hooks-only.test.js

@@ -0,0 +1,58 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function detectCodex({ userHook = true, mdmHook = false, managedOnly = null, cache, real = false } = {}) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'unbound-codex-'));
+  const write = (p, text) => { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, text); };
+  const saved = { HOME: process.env.HOME, KEY: process.env.UNBOUND_CODEX_API_KEY, CODEX_HOME: process.env.CODEX_HOME };
+  try {
+    process.env.HOME = home;
+    process.env.UNBOUND_CODEX_API_KEY = 'k';
+    process.env.CODEX_HOME = path.join(home, '.codex');
+    if (cache) write(path.join(home, '.codex', 'cloud-config-bundle-cache.json'), JSON.stringify(cache));
+    write(path.join(home, '.codex', 'config.toml'), '[features]\nhooks = true\n');
+    if (userHook) {
+      write(path.join(home, '.codex', 'hooks.json'), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'unbound.py' }] }] } }));
+      write(path.join(home, '.codex', 'hooks', 'unbound.py'), '');
+    }
+    const mdm = path.join(home, 'etc-codex');
+    if (mdmHook) {
+      write(path.join(mdm, 'hooks.json'), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'unbound.py' }] }] } }));
+      write(path.join(mdm, 'hooks', 'unbound.py'), '');
+    }
+    delete require.cache[require.resolve('../src/toolHealth')];
+    delete require.cache[require.resolve('../src/claudePaths')];
+    const { detectTools } = require('../src/toolHealth');
+    return detectTools({ _mdmDirs: { codex: mdm }, _codexManagedOnly: real ? undefined : managedOnly }).find((t) => t.family === 'codex');
+  } finally {
+    process.env.HOME = saved.HOME;
+    if (saved.CODEX_HOME === undefined) delete process.env.CODEX_HOME; else process.env.CODEX_HOME = saved.CODEX_HOME;
+    if (saved.KEY === undefined) delete process.env.UNBOUND_CODEX_API_KEY; else process.env.UNBOUND_CODEX_API_KEY = saved.KEY;
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+test('a user-level codex hook under allow_managed_hooks_only is not enforced and routed org-wide', () => {
+  const t = detectCodex({ managedOnly: '/etc/codex/requirements.toml' });
+  assert.equal(t.status, 'tampered');
+  assert.equal(t.notEnforced, true);
+  assert.equal(t.scope, 'mdm');
+});
+
+test('an org install that left the feature flag behind reads as managed, not tampered', () => {
+  const t = detectCodex({ userHook: false, mdmHook: true, managedOnly: '/etc/codex/requirements.toml' });
+  assert.equal(t.status, 'managed-by-mdm');
+});
+
+test('the setting on the first line of the cloud policy cache is detected', () => {
+  const t = detectCodex({ real: true, cache: { toml: 'allow_managed_hooks_only = true\n' } });
+  assert.equal(t.notEnforced, true);
+});
+
+test('a working org hook means the user install is not flagged', () => {
+  const t = detectCodex({ mdmHook: true, managedOnly: '/etc/codex/requirements.toml' });
+  assert.ok(!t.notEnforced);
+});

package/test/policy-ai-assist-preflight.test.js

@@ -4,6 +4,7 @@ const assert = require('node:assert/strict');
 const {
   validatePromptPreflight,
   OUT_OF_SCOPE_KEYWORDS,
+  MCP_OUT_OF_SCOPE_KEYWORDS,
   MAX_PROMPT_LEN,
 } = require('../src/lib/policy-ai-assist');
 
@@ -11,52 +12,85 @@ const {
 // with backend-equivalent wording.
 
 test('preflight: prompt of 1799 chars passes', () => {
-  const r = validatePromptPreflight({ prompt: 'a'.repeat(1799) });
+  const r = validatePromptPreflight({ prompt: 'a'.repeat(1799) }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.warnings.length, 0);
 });
 
 test('preflight: prompt of 1800 chars passes (boundary)', () => {
-  const r = validatePromptPreflight({ prompt: 'a'.repeat(MAX_PROMPT_LEN) });
+  const r = validatePromptPreflight({ prompt: 'a'.repeat(MAX_PROMPT_LEN) }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.warnings.length, 0);
 });
 
 test('preflight: prompt of 1801 chars rejects with verbatim wording', () => {
   assert.throws(
-    () => validatePromptPreflight({ prompt: 'a'.repeat(1801) }),
+    () => validatePromptPreflight({ prompt: 'a'.repeat(1801) }, OUT_OF_SCOPE_KEYWORDS),
     new RegExp(`^Error: Input is too long \\(max ${MAX_PROMPT_LEN} characters\\)\\.$`)
   );
 });
 
-// §6.2 step 4: parametrized over the keyword list — every token surfaces a warning.
+// §6.2 step 4: parametrized over the keyword lists — every token surfaces a warning.
 for (const token of OUT_OF_SCOPE_KEYWORDS) {
   test(`preflight: out-of-scope keyword "${token}" produces a warning`, () => {
-    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` });
+    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` }, OUT_OF_SCOPE_KEYWORDS);
     assert.ok(r.warnings.includes(token), `expected warning for ${token}, got ${JSON.stringify(r.warnings)}`);
   });
 }
 
+for (const token of MCP_OUT_OF_SCOPE_KEYWORDS) {
+  test(`preflight: MCP out-of-scope keyword "${token}" produces a warning`, () => {
+    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` }, MCP_OUT_OF_SCOPE_KEYWORDS);
+    assert.ok(r.warnings.includes(token), `expected warning for ${token}, got ${JSON.stringify(r.warnings)}`);
+  });
+}
+
+// Terminal policies can scope by environment, so these only warn for MCP.
+for (const token of ['staging', 'production', 'prod', 'dev', 'qa', 'testing']) {
+  test(`preflight: environment keyword "${token}" does not warn with the terminal list`, () => {
+    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` }, OUT_OF_SCOPE_KEYWORDS);
+    assert.deepEqual(r.warnings, []);
+  });
+}
+
 // §6.2 step 5: collapse runs of >=2 newlines to a single newline.
 test('preflight: collapses three consecutive newlines to one', () => {
-  const r = validatePromptPreflight({ prompt: 'line1\n\n\nline2' });
+  const r = validatePromptPreflight({ prompt: 'line1\n\n\nline2' }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.sanitizedPrompt, 'line1\nline2');
 });
 
 test('preflight: collapses two consecutive newlines to one', () => {
-  const r = validatePromptPreflight({ prompt: 'a\n\nb' });
+  const r = validatePromptPreflight({ prompt: 'a\n\nb' }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.sanitizedPrompt, 'a\nb');
 });
 
 test('preflight: a single newline is left alone', () => {
-  const r = validatePromptPreflight({ prompt: 'a\nb' });
+  const r = validatePromptPreflight({ prompt: 'a\nb' }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.sanitizedPrompt, 'a\nb');
 });
 
+// A stripped character must not join the words it separated: pasted text
+// carries non-breaking spaces, and "inproduction" names no environment.
+test('preflight: a non-breaking space becomes a space, not nothing', () => {
+  const r = validatePromptPreflight({ prompt: 'block terraform destroy in production' }, OUT_OF_SCOPE_KEYWORDS);
+  assert.equal(r.sanitizedPrompt, 'block terraform destroy in production');
+});
+
+// A negated environment is an exception clause, which policies cannot express.
+for (const prompt of ['block schema drops in non-prod', 'block schema drops in non production', 'block schema drops in non-production']) {
+  test(`preflight: "${prompt}" reports a negated environment as out of scope`, () => {
+    const r = validatePromptPreflight({ prompt }, OUT_OF_SCOPE_KEYWORDS);
+    assert.ok(r.warnings.some((w) => w.startsWith('non')), `expected a negation warning, got ${JSON.stringify(r.warnings)}`);
+  });
+}
+
+test('preflight: "non-interactive" is not a negated environment', () => {
+  const r = validatePromptPreflight({ prompt: 'audit non-interactive scripts' }, OUT_OF_SCOPE_KEYWORDS);
+  assert.deepEqual(r.warnings, []);
+});
+
 // §6.2: warning is informational only; under --yes the caller logs it and
 // continues. The helper itself never throws for warnings — it just reports.
 test('preflight: warnings do not throw', () => {
-  // Use a keyword that is NOT a substring of "production" (the keyword set
-  // contains "prod" which would also match): pick a non-overlapping one.
-  const r = validatePromptPreflight({ prompt: 'block weekend pushes' });
+  const r = validatePromptPreflight({ prompt: 'block weekend pushes' }, OUT_OF_SCOPE_KEYWORDS);
   assert.ok(r.warnings.includes('weekend'));
   // No throw — the function returned and we got here.
 });