vexp-cli 3.2.5 → 3.3.0

package/dist/forget.js

@@ -16,8 +16,10 @@ import { canonicalWorkspaceRoot } from "./socket-path.js";
  */
 /** Everything a daemon or an index run leaves in `<workspace>/.vexp`.
  *  Config is absent on purpose (`vexp.toml`, `workspace.json`,
- *  `parent_workspace.json`, `.gitattributes`, `.gitignore`): forgetting a
- *  workspace removes what brings its daemon back, not what the user wrote.
+ *  `parent_workspace.json`, `.gitattributes`, `.gitignore`, and
+ *  `git-hooks.declined`, the user's "no" to vexp's git hooks): forgetting a
+ *  workspace removes what brings its daemon back, not what the user wrote
+ *  or answered.
  *  At the home directory the same `.vexp` is vexp's state dir, and this list
  *  is exactly what may go there — `config.toml`, the licence tokens,
  *  `daemons.json`, `mcp.pid`/`mcp.token`, `gpu-unusable`, models and plugins

package/dist/hook-template.js

@@ -384,13 +384,19 @@ process.stdin.on("end", () => {
  * FAIL-OPEN CONTRACT: every failure path (binary missing, daemon down,
  * timeout) exits 0 with no output = vanilla behavior, never a broken
  * prompt. Keep in lockstep with the VS Code extension copy.
- * The __VEXP_BIN__ placeholder is baked at install time.
+ * The __VEXP_BIN__ and __VEXP_AGENT__ placeholders are baked at install time.
+ *
+ * VEXP_HOOK_AGENT names the agent whose hook this is. The script is shared by
+ * Claude Code and Codex, and the daemon used to label every row of its
+ * activity ledger "claude-code". It lives here, never on the hook's command
+ * line: Codex hashes that line for its trust record, and a change there would
+ * make every user approve the hook again. Binaries that predate it ignore it.
  */
 export const VEXP_HINT_HOOK = `#!/bin/bash
 # vexp-hint: event-driven orientation hint (UserPromptSubmit). Fails open.
 VEXP_BIN="__VEXP_BIN__"
 [ -x "$VEXP_BIN" ] || exit 0
-"$VEXP_BIN" prompt-hint 2>/dev/null
+VEXP_HOOK_AGENT="__VEXP_AGENT__" "$VEXP_BIN" prompt-hint 2>/dev/null
 exit 0
 `;
 /**
@@ -510,33 +516,45 @@ export const VexpCompress = async () => ({
   },
 });
 `;
+/**
+ * `c:\...` -> `C:\...`. On Windows one folder reaches the two installers
+ * spelled two ways: VS Code hands the extension `x:\proj` (its URIs
+ * lower-case the drive letter), a terminal hands the CLI `X:\proj`. Every
+ * path baked into a hook registration or a hook script goes through this, in
+ * both twins, or `vexp setup` and the extension rewrite each other's
+ * .codex/hooks.json at every run (review of the 2026-09-24 fix, a project on
+ * a share mapped as X:). Twin: agent-auto-config.ts upperDriveLetter.
+ */
+export function upperDriveLetter(p) {
+    return p.replace(/^([a-z])(?=:[\\/])/, (d) => d.toUpperCase());
+}
 /** Bake the binary path into the opencode/Kilo compression plugin. */
 export function vexpOpencodeCompressPlugin(binaryPath) {
-    return VEXP_OPENCODE_COMPRESS.replace("__VEXP_BIN__", binaryPath.replace(/\\/g, "/"));
+    return VEXP_OPENCODE_COMPRESS.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\\/g, "/"));
 }
 /** Bake the binary path into the read-hint hook script. */
 export function bakeReadHintHook(binaryPath) {
-    return VEXP_READ_HINT_HOOK.replace("__VEXP_BIN__", binaryPath);
+    return VEXP_READ_HINT_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath));
 }
 /** Bake the binary path into the bash-cap hook script. */
 export function bakeBashCapHook(binaryPath) {
-    return VEXP_BASH_CAP_HOOK.replace("__VEXP_BIN__", binaryPath);
+    return VEXP_BASH_CAP_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath));
 }
 /** Bake the binary path into the edit-hint hook script. */
 export function bakeEditHintHook(binaryPath) {
-    return VEXP_EDIT_HINT_HOOK.replace("__VEXP_BIN__", binaryPath);
+    return VEXP_EDIT_HINT_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath));
 }
-/** Bake the binary path into the hint hook script. */
-export function vexpHintHookScript(binaryPath) {
-    return VEXP_HINT_HOOK.replace("__VEXP_BIN__", binaryPath.replace(/\\/g, "/"));
+/** Bake the binary path and the agent into the hint hook script. */
+export function vexpHintHookScript(binaryPath, agent = "claude-code") {
+    return VEXP_HINT_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\\/g, "/")).replace("__VEXP_AGENT__", agent);
 }
 /**
- * Windows twin of the hint hook. Codex runs a hook command through
- * `cmd.exe /C` (COMSPEC) on Windows, and cmd has no `bash`: a Windows user
- * with neither Git Bash nor WSL got "bash not found" on every prompt, so
- * orientation was inert and nothing said so. The logic is four lines and
+ * Windows twin of the hint hook, for Codex. A Windows user with neither Git
+ * Bash nor WSL has no `bash`, so `bash "..."` failed on every prompt and
+ * orientation was inert with nothing saying so. The logic is four lines and
  * none of it is shell-specific, so it translates exactly — and `exit /b 0`
- * on the last line keeps the same fail-open contract as the bash twin.
+ * on the last line keeps the same fail-open contract as the bash twin. Codex
+ * is the only agent that runs it, hence the agent name written in.
  *
  * CRLF on purpose: a batch file with bare LF endings is parsed
  * inconsistently by cmd, and this one has to run on the machines least
@@ -547,13 +565,38 @@ export const VEXP_HINT_HOOK_CMD = [
     "REM vexp-hint: event-driven orientation hint (UserPromptSubmit). Fails open.",
     'set "VEXP_BIN=__VEXP_BIN__"',
     'if not exist "%VEXP_BIN%" exit /b 0',
+    'set "VEXP_HOOK_AGENT=codex"',
     '"%VEXP_BIN%" prompt-hint 2>nul',
     "exit /b 0",
     "",
 ].join("\r\n");
 /** Bake the binary path into the Windows hint hook. Backslashes stay. */
 export function vexpHintHookCmdScript(binaryPath) {
-    return VEXP_HINT_HOOK_CMD.replace("__VEXP_BIN__", binaryPath.replace(/\//g, "\\"));
+    return VEXP_HINT_HOOK_CMD.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\//g, "\\"));
+}
+/**
+ * The line Codex runs on Windows (`commandWindows`), naming the batch twin.
+ *
+ * Wrapped in `cmd /d /c call` because Codex does NOT run hooks through cmd.exe by
+ * default: it runs them through the session shell, PowerShell
+ * (`powershell -NoProfile -Command <line>`, codex-rs core/src/session/mod.rs
+ * build_hooks_config + shell-command shell_detect default_user_shell), and
+ * falls back to `%COMSPEC% /C "<line>"` only when there is no local shell.
+ * A bare quoted path is a string literal to PowerShell: it printed the path,
+ * exited 0, and Codex injected that path as the context of every prompt while
+ * the script never ran. `cmd /d /c call "<path>"` runs the script under
+ * both shells, and the prompt JSON still reaches it on stdin (checked on
+ * PowerShell 5.1 and cmd with a replica of Codex's build_command). /d skips
+ * cmd's AutoRun, as a hook should.
+ *
+ * `call` is what keeps a project path with a cmd special character working:
+ * without it cmd /c strips the outer quotes of `"<path>"` and splits a path
+ * such as `...\R&D (x)\...` or `OneDrive - Smith & Co` at the `&`, so the hook
+ * failed on every prompt. With it, only an `&` with no space around it,
+ * under PowerShell, still fails (doctor's probe reports that as a failed run).
+ */
+export function codexWindowsHookCommand(cmdPath) {
+    return `cmd /d /c call "${cmdPath}"`;
 }
 /**
  * v4 M1: the search answer (PreToolUse on Bash).
@@ -577,7 +620,7 @@ exit 0
 `;
 /** Bake the binary path into the search hook script. */
 export function vexpSearchHookScript(binaryPath) {
-    return VEXP_SEARCH_HOOK.replace("__VEXP_BIN__", binaryPath.replace(/\\/g, "/"));
+    return VEXP_SEARCH_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\\/g, "/"));
 }
 /**
  * Horizon F2a: Stop-hook verification gate (Claude Code). All logic lives
@@ -595,7 +638,7 @@ exit 0
 `;
 /** Bake the binary path into the stop-gate hook script. */
 export function vexpStopGateHookScript(binaryPath) {
-    return VEXP_STOP_GATE_HOOK.replace("__VEXP_BIN__", binaryPath.replace(/\\/g, "/"));
+    return VEXP_STOP_GATE_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\\/g, "/"));
 }
 /**
  * v3 context lifecycle: SessionStart hook (Claude Code). Fires on every
@@ -613,7 +656,7 @@ exit 0
 `;
 /** Bake the binary path into the session-context hook script. */
 export function vexpSessionContextHookScript(binaryPath) {
-    return VEXP_SESSION_CONTEXT_HOOK.replace("__VEXP_BIN__", binaryPath.replace(/\\/g, "/"));
+    return VEXP_SESSION_CONTEXT_HOOK.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\\/g, "/"));
 }
 /**
  * opencode/Kilo per-prompt hint plugin (2.4.0). The plugin API's
@@ -627,6 +670,7 @@ export function vexpSessionContextHookScript(binaryPath) {
  */
 export const VEXP_OPENCODE_HINT = `// vexp-hint: per-prompt orientation + idle verification (fail-open). Managed by vexp.
 const VEXP_BIN = "__VEXP_BIN__";
+const VEXP_AGENT = "__VEXP_AGENT__";
 export const VexpHint = async ({ directory, client }) => {
   const fs = await import("node:fs");
   const path = await import("node:path");
@@ -697,10 +741,13 @@ export const VexpHint = async ({ directory, client }) => {
             fs.writeFileSync(tf, text);
           }
         } catch (e) { /* fail open */ }
+        // hook_event_name: prompt-hint counts a call without one as a manual
+        // probe and keeps it out of the activity ledger, which is where every
+        // opencode and Kilo prompt went. VEXP_HOOK_AGENT labels the rows.
         const out = await runVexp(["prompt-hint"], {
-          input: JSON.stringify({ prompt: text, session_id: sid }),
+          input: JSON.stringify({ prompt: text, session_id: sid, hook_event_name: "UserPromptSubmit" }),
           timeout: 4000,
-          env: { ...process.env, CLAUDE_PROJECT_DIR: directory },
+          env: { ...process.env, CLAUDE_PROJECT_DIR: directory, VEXP_HOOK_AGENT: VEXP_AGENT },
         });
         if (!out || !out.trim()) return;
         const hint = JSON.parse(out).hookSpecificOutput?.additionalContext;
@@ -732,9 +779,13 @@ export const VexpHint = async ({ directory, client }) => {
         if (fs.existsSync(marker)) return;
         const tf = taskFileFor(sid);
         if (!fs.existsSync(tf)) return;
+        // VEXP_RULES_CHECK=0: a hook neither writes the index nor waits on
+        // it. Under a rule change verify would reconcile first, and a large
+        // one outlives the 15 s budget, killed and restarted at every idle.
         const out = await runVexp(["verify", "--json", "--task-file", tf], {
           timeout: 15000,
           cwd: directory,
+          env: { ...process.env, VEXP_RULES_CHECK: "0" },
         });
         if (!out || !out.trim()) return;
         const rep = JSON.parse(out);
@@ -773,7 +824,11 @@ export const VexpHint = async ({ directory, client }) => {
   };
 };
 `;
-/** Bake the binary path into the opencode hint plugin. */
-export function vexpOpencodeHintPlugin(binaryPath) {
-    return VEXP_OPENCODE_HINT.replace("__VEXP_BIN__", binaryPath.replace(/\\/g, "/"));
+/** Bake the binary path and the agent (one plugin serves opencode and Kilo) into the hint plugin. */
+export function vexpOpencodeHintPlugin(binaryPath, agent = "opencode") {
+    return VEXP_OPENCODE_HINT.replace("__VEXP_BIN__", upperDriveLetter(binaryPath).replace(/\\/g, "/")).replace("__VEXP_AGENT__", agent);
+}
+/** The agent a hint plugin directory belongs to: `.kilo/plugin` is Kilo's, anything else opencode's. */
+export function opencodeFamilyAgent(pluginDir) {
+    return /^\.kilo[\\/]/.test(pluginDir) ? "kilo" : "opencode";
 }

package/dist/license-activate.js

@@ -0,0 +1,90 @@
+import chalk from "chalk";
+import { ACCOUNT_URL, activateAndRegister, formatCheckIn, lastCheckIn, registrationLine, registrationState, registrationStateLine, } from "./license.js";
+/**
+ * What the CLI prints for a plan. AppSumo lifetime tiers print as "Lifetime ·
+ * Tier N": the raw internal string ("tier3") next to a date one month out read
+ * as a monthly deadline to a buyer who then re-activated by hand every month.
+ */
+export function planLabel(plan) {
+    return /^tier[1-4]$/.test(plan) ? `Lifetime · Tier ${plan.slice(4)}` : plan;
+}
+export function isLifetimePlan(plan) {
+    return /^tier[1-4]$/.test(plan);
+}
+/** "Last check-in: <date>" / "never", for `vexp license` and the menu. */
+export function lastCheckInText() {
+    const at = lastCheckIn();
+    return at ? formatCheckIn(at) : "never";
+}
+/** Print the registration line in the colour its meaning deserves, and its
+ *  cause on a second line when there is one. */
+export function printRegistration(outcome, indent, log = console.log) {
+    const { ok, text, hint } = registrationLine(outcome);
+    log(`${indent}${ok ? chalk.green(text) : chalk.yellow(text)}`);
+    if (hint)
+        log(`${indent}${chalk.dim(hint)}`);
+}
+/**
+ * `vexp license` and the menu's status: the last check-in date, then what
+ * this run's check-in came to, or, when none was due, what the files on disk
+ * say (the stamp alone would call a revoked or refused machine checked in).
+ */
+export function printCheckInStatus(outcome, indent, log = console.log) {
+    if (outcome.kind === "no_license")
+        return;
+    log(`${indent}Last check-in: ${lastCheckInText()}`);
+    if (outcome.kind === "throttled") {
+        const state = registrationState();
+        // The blocked marker has its own paragraph in both callers.
+        if (state.state === "blocked")
+            return;
+        const { ok, text } = registrationStateLine(state);
+        log(`${indent}${ok ? chalk.green(text) : chalk.yellow(text)}`);
+        return;
+    }
+    printRegistration(outcome, indent, log);
+}
+/**
+ * Activate a key and register this device, then say both: the single path
+ * behind `vexp activate` and the interactive menu (License > activate). The
+ * menu used to write the key and stop there, so a buyer who activated from it
+ * and then worked only through an agent never appeared on the dashboard.
+ * Never throws; `ok` is false when the key was refused.
+ */
+export async function runActivation(key, opts = {}) {
+    const indent = opts.indent ?? "  ";
+    const log = opts.log ?? console.log;
+    const error = opts.error ?? console.error;
+    let result;
+    try {
+        result = await activateAndRegister(key);
+    }
+    catch (err) {
+        error(chalk.red(`${indent}✗ ${err instanceof Error ? err.message : String(err)}`));
+        return { ok: false };
+    }
+    const { claims, outcome, renewed } = result;
+    if (outcome.kind === "revoked" || outcome.kind === "deactivated") {
+        // A refunded or revoked key still verifies until its 30-day token runs
+        // out; "activated!" would read as all is well to someone who then loses
+        // the plan within the month.
+        log(chalk.yellow(`\n${indent}! License installed, but vexp.dev reports it ${outcome.kind}: it stops working on ${new Date(claims.exp * 1000).toLocaleDateString()}. Get your current key from ${ACCOUNT_URL}`));
+        log(`${indent}  Plan:    ${planLabel(claims.plan)}`);
+        log(`${indent}  Email:   ${claims.sub}`);
+        return { ok: true, claims, outcome };
+    }
+    log(chalk.green(`\n${indent}✓ License activated!`));
+    log(`${indent}  Plan:    ${planLabel(claims.plan)}`);
+    log(`${indent}  Email:   ${claims.sub}`);
+    if (isLifetimePlan(claims.plan)) {
+        log(`${indent}  Renewal: none - lifetime licence (the local token auto-renews on check-in)`);
+    }
+    else if (!renewed) {
+        log(`${indent}  Expires: ${new Date(claims.exp * 1000).toLocaleDateString()}`);
+    }
+    if (renewed) {
+        log(chalk.dim(`${indent}  The key had expired; vexp.dev renewed it for this machine.`));
+    }
+    printRegistration(outcome, indent, log);
+    return { ok: true, claims, outcome };
+}