vibe-coding-master 0.2.13 → 0.3.1

package/README.md

@@ -11,6 +11,8 @@ VCM is designed for long-running coding work where one Claude Code conversation
 
 Each role runs as a real Claude Code process inside an embedded terminal. The GUI lets the user start, stop, resume, restart, switch, observe, and manually intervene in those sessions without juggling separate terminal windows.
 
+When Codex Review Gates are enabled for a task, or when a Codex Reviewer session already exists, the workspace can also show a fifth `Codex Reviewer` terminal role. It runs Codex CLI from `.ai/codex` with Codex model and effort selectors, receives gate prompts in the same long-lived terminal session, reports hook state back to VCM, and stays outside the normal Claude Code PM routing flow.
+
 ## Current Capabilities
 
 - GUI-first task workspace.
@@ -19,6 +21,7 @@ Each role runs as a real Claude Code process inside an embedded terminal. The GU
 - Connected repository status for the base repo, including branch, upstream status, commit hash, dirty state, and fast-forward-only pull.
 - Embedded Claude Code terminals powered by `node-pty` and `xterm.js`.
 - One Claude Code session per role, with role tabs in the task header.
+- Optional Codex Reviewer terminal role when any Codex Review Gate is enabled.
 - Role session recovery through persisted Claude session ids and `claude --resume`.
 - Permission mode selection before start, resume, or restart:
   - `default`
@@ -26,7 +29,7 @@ Each role runs as a real Claude Code process inside an embedded terminal. The GU
 - PM-mediated role messaging through VCM-dispatched route files.
 - Manual and automatic orchestration modes.
 - Two-stage VCM harness setup: deterministic fixed install plus AI-assisted bootstrap.
-- VCM-managed root rules, four role agents, repo-local VCM skills, Claude Code hooks, generated-context tools, and PR template.
+- VCM-managed root rules, four role agents, repo-local VCM skills, Claude Code hooks, Codex Reviewer hooks, generated-context tools, and PR template.
 - Rust generated context for module indexing and crate-external public surface indexing.
 - Translation panel powered by an OpenAI-compatible low-cost model.
 - Mobile Gateway through Tencent iLink Bot API / Weixin DM, for talking to PM and managing tasks from Weixin.
@@ -233,7 +236,7 @@ the base repo has uncommitted changes, when the current branch has no upstream,
 or when the active task is an inline task using the base repo directly. It does
 not stash, merge, or mutate task worktrees.
 
-When VCM is connected to an active task, the bottom of the sidebar shows a task status dock. It stays outside the collapsible groups and shows the active VCM Session title, task status, start time, total elapsed time, total Round count, and Claude Code active runtime. If a Round is currently running, the dock also shows the Current Round start time, total elapsed time, Claude Code active runtime, and Turn count.
+When VCM is connected to an active task, the bottom of the sidebar shows a task status dock. It stays outside the collapsible groups and shows the active VCM Session title, task status, start time, total elapsed time, total Round count, and role active runtime. If a Round is currently running, the dock also shows the Current Round start time, total elapsed time, role active runtime, and Turn count.
 
 ## Mobile Gateway
 
@@ -356,7 +359,7 @@ Typical mobile flow:
 
 `/pull-current` only pulls the connected base repository. It does not pull task worktrees, stash local changes, merge divergent branches, or run arbitrary shell commands.
 
-`/create-task` uses the saved launch template from the desktop settings. The template controls permission mode, model, auto orchestration, and translation defaults for the four role sessions.
+`/create-task` uses the saved launch template from the desktop settings. The template controls permission mode, model, effort, auto orchestration, and translation defaults for the four role sessions.
 
 `/close-task` is destructive. It stops VCM-managed role sessions and removes task-owned worktree/branch state according to the same cleanup behavior as the desktop `Close Task` action.
 
@@ -478,7 +481,7 @@ For `.gitignore`, VCM uses a gitignore-native managed block:
 
 `.ai/vcm/` is the active VCM local control area, and `.claude/worktrees/` is the Claude-compatible task worktree area. VCM keeps the task index in app-local project state under `~/.vcm/projects/`; each task runtime repo keeps its own session, message, orchestration, and translation state.
 
-VCM also JSON-merges `.claude/settings.json` to install Claude Code `PreToolUse`, `UserPromptSubmit`, `Stop`, and `PermissionRequest` hooks plus a managed `env.BASH_DEFAULT_TIMEOUT_MS` so foreground watch windows fit inside the Bash tool timeout. The hooks post directly to the local VCM backend, so roles do not need a VCM CLI command to confirm delivery or report turn completion. The `Stop` hook forwards the backend response to Claude Code, which lets VCM block turn-end while a validation job is still running.
+VCM also JSON-merges `.claude/settings.json` to install Claude Code `PreToolUse`, `UserPromptSubmit`, `Stop`, and `PermissionRequest` hooks plus a managed `env.BASH_DEFAULT_TIMEOUT_MS` so foreground watch windows fit inside the Bash tool timeout. The hooks post directly to the local VCM backend, so roles do not need a VCM CLI command to confirm delivery or report turn completion. The `Stop` hook forwards the backend response to Claude Code, which lets VCM block turn-end while a validation job is still running. When Codex Review Gates are installed, VCM also writes `.ai/codex/.codex/config.toml` and `.ai/codex/.codex/hooks.json` so the embedded Codex Reviewer terminal can POST `UserPromptSubmit` and `Stop` events back to VCM.
 
 Bootstrap is AI-assisted. VCM starts a visible temporary Claude Code session in the connected repository and asks it to use the `vcm-harness-bootstrap` skill. Bootstrap fills project-specific content and generated context:
 
@@ -565,7 +568,7 @@ When it is on, VCM is in auto mode:
 - When the target role later reaches `Stop`, VCM scans again and may deliver the next pending route file.
 - If auto orchestration gets stuck after a manual copy/paste recovery, `Mark All Done` clears pending route files. It does not mutate message history.
 
-VCM Harness injects Claude Code `UserPromptSubmit` and `Stop` hooks into `.claude/settings.json`. Role tabs become `running` when Claude Code accepts a prompt and `idle` after `Stop`; VCM also marks a role `running` immediately after it writes a message to that embedded terminal. The terminal process status is still tracked separately. The injected role rules require a role to end its turn after writing or updating a message route file, rather than polling, looping, or waiting for another role inside the same Claude Code turn.
+VCM Harness injects Claude Code `UserPromptSubmit` and `Stop` hooks into `.claude/settings.json`, and Codex Reviewer hooks into `.ai/codex/.codex/hooks.json`. Role tabs become `running` when Claude Code or Codex accepts a prompt and `idle` after `Stop`; VCM also marks a role `running` immediately after it writes a message to that embedded terminal. The terminal process status is still tracked separately. Claude role rules require a role to end its turn after writing or updating a message route file, rather than polling, looping, or waiting for another role inside the same Claude Code turn; Codex Reviewer does not dispatch route files.
 
 The implementation keeps only the active manual/auto orchestration mode. It does not expose pause/resume, stage/approve/reject, or a separate agent-facing message CLI.
 
@@ -579,7 +582,7 @@ The normal path is timer-driven: `Stop` starts a backend timer, and `UserPromptS
 
 When `Flow pause alert` is enabled, the frontend polls the task Round state and deduplicates each stopped Round so the same stopped state does not alert on every poll. Flow duration is measured from the first `UserPromptSubmit` to `stoppedAt`, falling back to the last `Stop` when needed. If the flow lasted less than 2 minutes, it plays the local chime 3 times at 1.4 second intervals. If the flow lasted 2 minutes or longer, it shows a modal alert and repeats the local chime until the user clicks `Confirm`. A stopped Round can mean normal completion, user decision needed, dispatch failure, or another workflow interruption; the point is to get the user to look with the right amount of urgency.
 
-The Current Round dock separates wall-clock Round duration from Claude Code active runtime. `Total` is `now - Round.startedAt`; `CC runtime` is only the accumulated time between each Turn's `UserPromptSubmit` and `Stop`; `Turn count` is the number of accepted prompts inside the current Round.
+The Current Round dock separates wall-clock Round duration from role active runtime. `Total` is `now - Round.startedAt`; `Role runtime` is only the accumulated time between each Turn's `UserPromptSubmit` and `Stop`; `Turn count` is the number of accepted prompts inside the current Round.
 
 ## Resume Behavior
 

package/dist/backend/adapters/claude-adapter.js

@@ -17,12 +17,15 @@ export function createClaudeAdapter(runner) {
             }
             return result.stdout.trim();
         },
-        buildRoleStartCommand(role, command = "claude", permissionMode = "default", claudeSessionId, resume = false, model = "default") {
+        buildRoleStartCommand(role, command = "claude", permissionMode = "default", claudeSessionId, resume = false, model = "default", effort = "default") {
             const args = ["--agent", role];
             if (claudeSessionId) {
                 args.push(resume ? "--resume" : "--session-id", claudeSessionId);
             }
             args.push("--model", model);
+            if (effort !== "default") {
+                args.push("--effort", effort);
+            }
             if (permissionMode === "bypassPermissions") {
                 args.push("--permission-mode", "bypassPermissions");
             }

package/dist/backend/api/codex-hook-routes.js

@@ -0,0 +1,9 @@
+export function registerCodexHookRoutes(app, deps) {
+    app.post("/api/hooks/codex-reviewer", async (request) => {
+        return deps.codexHookService.handleHook(request.body);
+    });
+    app.post("/api/hooks/codex-reviewer/stop", async (request) => {
+        await deps.codexHookService.handleStopHook(request.body);
+        return {};
+    });
+}

package/dist/backend/api/codex-review-routes.js

@@ -0,0 +1,58 @@
+import { VcmError } from "../errors.js";
+import { isCodexReviewGate } from "../services/codex-review-service.js";
+export function registerCodexReviewRoutes(app, deps) {
+    app.get("/api/tasks/:taskSlug/codex-review", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        return deps.codexReviewService.getState(project.repoRoot, request.params.taskSlug);
+    });
+    app.put("/api/tasks/:taskSlug/codex-review/settings", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        return deps.codexReviewService.updateSettings(project.repoRoot, request.params.taskSlug, request.body);
+    });
+    app.post("/api/tasks/:taskSlug/codex-review/:gate/request", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        const gate = parseGate(request.params.gate);
+        return deps.codexReviewService.requestReviewGate(project.repoRoot, request.params.taskSlug, gate);
+    });
+    app.post("/api/tasks/:taskSlug/codex-review/:gate/retry", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        const gate = parseGate(request.params.gate);
+        return deps.codexReviewService.retryReviewGate(project.repoRoot, request.params.taskSlug, gate);
+    });
+    app.post("/api/tasks/:taskSlug/codex-review/:gate/skip", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        const gate = parseGate(request.params.gate);
+        return deps.codexReviewService.skipReviewGate(project.repoRoot, request.params.taskSlug, gate, request.body);
+    });
+    app.post("/api/tasks/:taskSlug/codex-review/:gate/override", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        const gate = parseGate(request.params.gate);
+        return deps.codexReviewService.overrideReviewGate(project.repoRoot, request.params.taskSlug, gate, request.body);
+    });
+    app.get("/api/tasks/:taskSlug/codex-review/:gate/report", async (request) => {
+        const project = await requireCurrentProject(deps.projectService);
+        const gate = parseGate(request.params.gate);
+        return deps.codexReviewService.readReport(project.repoRoot, request.params.taskSlug, gate);
+    });
+}
+function parseGate(gate) {
+    if (!isCodexReviewGate(gate)) {
+        throw new VcmError({
+            code: "UNKNOWN_CODEX_REVIEW_GATE",
+            message: `Unknown Codex review gate: ${gate}`,
+            statusCode: 400
+        });
+    }
+    return gate;
+}
+async function requireCurrentProject(projectService) {
+    const project = await projectService.getCurrentProject();
+    if (!project) {
+        throw new VcmError({
+            code: "PROJECT_NOT_CONNECTED",
+            message: "Connect a repository first.",
+            statusCode: 409
+        });
+    }
+    return project;
+}

package/dist/backend/api/translation-routes.js

@@ -1,4 +1,4 @@
-import { isRoleName } from "../../shared/constants.js";
+import { isVcmRoleName } from "../../shared/constants.js";
 import { VcmError } from "../errors.js";
 import { getTaskRuntimeRepoRoot } from "../services/task-service.js";
 export function registerTranslationRoutes(app, deps) {
@@ -74,7 +74,7 @@ export function registerTranslationRoutes(app, deps) {
     });
 }
 function parseRole(role) {
-    if (!isRoleName(role)) {
+    if (!isVcmRoleName(role)) {
         throw new VcmError({
             code: "UNKNOWN_ROLE",
             message: `Unknown role: ${role}`,

package/dist/backend/cli/install-vcm-harness.js

@@ -6,6 +6,7 @@ import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { renderArchitectHarnessRules } from "../templates/harness/architect-agent.js";
 import { renderCoderHarnessRules } from "../templates/harness/coder-agent.js";
+import { renderCodexAgentsHarnessRules, renderCodexArchitecturePlanPrompt, renderCodexCliConfigHarnessRules, renderCodexConfigHarnessRules, renderCodexFinalDiffPrompt, renderCodexHooksHarnessRules, renderCodexReviewResultSchema, renderCodexValidationAdequacyPrompt, renderRequestCodexReviewTool, renderVcmCodexReviewGateSkillRules } from "../templates/harness/codex-review.js";
 import { renderRootClaudeHarnessRules } from "../templates/harness/claude-root.js";
 import { renderGitignoreHarnessRules } from "../templates/harness/gitignore.js";
 import { renderProjectManagerHarnessRules } from "../templates/harness/project-manager-agent.js";
@@ -101,6 +102,13 @@ const MANAGED_FILES = [
         commentStyle: "html",
         category: "pull-request-template",
         content: renderPullRequestTemplateHarnessRules()
+    },
+    {
+        path: ".ai/codex/AGENTS.md",
+        title: "VCM Codex Reviewer",
+        commentStyle: "html",
+        category: "codex-reviewer-agent",
+        content: renderCodexAgentsHarnessRules()
     }
 ];
 const DURABLE_DOC_TEMPLATES = [
@@ -154,6 +162,60 @@ const WHOLE_FILES = [
         mode: 0o644,
         content: renderSkillFile("VCM Route Message Skill", "vcm-route-message", "Use when a VCM role needs to hand off work, ask a question, report a result, report a blocker, or raise a finding to another VCM role.", renderVcmRouteMessageSkillRules())
     },
+    {
+        path: ".claude/skills/vcm-codex-review-gate/SKILL.md",
+        category: "skill",
+        mode: 0o644,
+        content: renderSkillFile("VCM Codex Review Gate Skill", "vcm-codex-review-gate", "Use when project-manager reaches a Codex Review Gate or receives a VCM Codex Review callback.", renderVcmCodexReviewGateSkillRules())
+    },
+    {
+        path: ".ai/codex/config.toml",
+        category: "codex-review-config",
+        mode: 0o644,
+        content: renderCodexConfigHarnessRules()
+    },
+    {
+        path: ".ai/codex/.codex/config.toml",
+        category: "codex-review-hooks",
+        mode: 0o644,
+        content: renderCodexCliConfigHarnessRules()
+    },
+    {
+        path: ".ai/codex/.codex/hooks.json",
+        category: "codex-review-hooks",
+        mode: 0o644,
+        content: renderCodexHooksHarnessRules()
+    },
+    {
+        path: ".ai/codex/prompts/architecture-plan-gate.md",
+        category: "codex-review-prompt",
+        mode: 0o644,
+        content: renderCodexArchitecturePlanPrompt()
+    },
+    {
+        path: ".ai/codex/prompts/validation-adequacy-gate.md",
+        category: "codex-review-prompt",
+        mode: 0o644,
+        content: renderCodexValidationAdequacyPrompt()
+    },
+    {
+        path: ".ai/codex/prompts/final-diff-gate.md",
+        category: "codex-review-prompt",
+        mode: 0o644,
+        content: renderCodexFinalDiffPrompt()
+    },
+    {
+        path: ".ai/codex/schemas/codex-review-result.schema.json",
+        category: "codex-review-schema",
+        mode: 0o644,
+        content: renderCodexReviewResultSchema()
+    },
+    {
+        path: ".ai/tools/request-codex-review",
+        category: "runtime-tool",
+        mode: 0o755,
+        content: renderRequestCodexReviewTool()
+    },
     {
         path: ".ai/tools/run-long-check",
         category: "runtime-tool",
@@ -365,6 +427,12 @@ function fixedDirectories() {
         ".claude/skills/vcm-harness-bootstrap/",
         ".claude/skills/vcm-long-running-validation/",
         ".claude/skills/vcm-route-message/",
+        ".claude/skills/vcm-codex-review-gate/",
+        ".ai/codex/",
+        ".ai/codex/.codex/",
+        ".ai/codex/prompts/",
+        ".ai/codex/schemas/",
+        ".ai/vcm/codex-reviews/",
         ".ai/tools/",
         ".ai/generated/"
     ];

package/dist/backend/gateway/gateway-service.js

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { ROLE_DEFINITIONS } from "../../shared/constants.js";
+import { VCM_ROLE_DEFINITIONS } from "../../shared/constants.js";
 import { VcmError } from "../errors.js";
 import { submitTerminalInput } from "../runtime/terminal-submit.js";
 import { getTaskRuntimeRepoRoot } from "../services/task-service.js";
@@ -396,14 +396,15 @@ export function createGatewayService(deps) {
             mode: template.autoOrchestration ? "auto" : "manual"
         });
         const startedRoles = [];
-        for (const definition of ROLE_DEFINITIONS) {
+        for (const definition of VCM_ROLE_DEFINITIONS) {
             const roleTemplate = template.roles[definition.name];
             try {
                 await deps.sessionService.startRoleSession(project.repoRoot, task.taskSlug, definition.name, {
                     cols: 100,
                     rows: 28,
                     permissionMode: roleTemplate.permissionMode,
-                    model: roleTemplate.model
+                    model: roleTemplate.model,
+                    effort: roleTemplate.effort
                 });
                 startedRoles.push(definition.name);
             }

package/dist/backend/server.js

@@ -7,9 +7,11 @@ import { createClaudeAdapter } from "./adapters/claude-adapter.js";
 import { createCommandRunner } from "./adapters/command-runner.js";
 import { createCommandDispatcher } from "./services/command-dispatcher.js";
 import { createClaudeHookService } from "./services/claude-hook-service.js";
+import { createCodexHookService } from "./services/codex-hook-service.js";
 import { createGitAdapter } from "./adapters/git-adapter.js";
 import { createAppSettingsService } from "./services/app-settings-service.js";
 import { createClaudeTranscriptService } from "./services/claude-transcript-service.js";
+import { createCodexReviewService } from "./services/codex-review-service.js";
 import { createHarnessService, createScriptFixedHarnessInstaller } from "./services/harness-service.js";
 import { createNodeFileSystemAdapter } from "./adapters/filesystem.js";
 import { createNodePtyTerminalRuntime } from "./runtime/node-pty-runtime.js";
@@ -31,6 +33,8 @@ import { createTranslationService } from "./services/translation-service.js";
 import { registerAppSettingsRoutes } from "./api/app-settings-routes.js";
 import { registerArtifactRoutes } from "./api/artifact-routes.js";
 import { registerClaudeHookRoutes } from "./api/claude-hook-routes.js";
+import { registerCodexHookRoutes } from "./api/codex-hook-routes.js";
+import { registerCodexReviewRoutes } from "./api/codex-review-routes.js";
 import { registerHarnessRoutes } from "./api/harness-routes.js";
 import { registerMessageRoutes } from "./api/message-routes.js";
 import { registerProjectRoutes } from "./api/project-routes.js";
@@ -56,6 +60,11 @@ export async function createServer(deps, options = {}) {
     });
     registerAppSettingsRoutes(app, { appSettings: deps.appSettings });
     registerClaudeHookRoutes(app, { claudeHookService: deps.claudeHookService });
+    registerCodexHookRoutes(app, { codexHookService: deps.codexHookService });
+    registerCodexReviewRoutes(app, {
+        projectService: deps.projectService,
+        codexReviewService: deps.codexReviewService
+    });
     registerProjectRoutes(app, { projectService: deps.projectService });
     registerHarnessRoutes(app, {
         projectService: deps.projectService,
@@ -175,6 +184,14 @@ export function createDefaultServerDeps(options = {}) {
         sessionService,
         taskService
     });
+    const codexReviewService = createCodexReviewService({
+        fs,
+        runner,
+        runtime,
+        projectService,
+        taskService,
+        sessionService
+    });
     const roundService = createRoundService({
         fs,
         onSessionStatusChange: async ({ repoRoot, taskSlug, status }) => {
@@ -222,6 +239,12 @@ export function createDefaultServerDeps(options = {}) {
         gatewayService,
         jobGuard: createJobGuardService()
     });
+    const codexHookService = createCodexHookService({
+        projectService,
+        taskService,
+        sessionService,
+        roundService
+    });
     return {
         appSettings,
         projectService,
@@ -231,7 +254,9 @@ export function createDefaultServerDeps(options = {}) {
         harnessService,
         commandDispatcher,
         claudeHookService,
+        codexHookService,
         messageService,
+        codexReviewService,
         roundService,
         statusService,
         translationService,

package/dist/backend/services/app-settings-service.js

@@ -1,9 +1,9 @@
 import path from "node:path";
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
-import { ROLE_NAMES } from "../../shared/constants.js";
+import { VCM_ROLE_NAMES } from "../../shared/constants.js";
 import { createDefaultLaunchTemplate } from "../../shared/types/app-settings.js";
-import { CLAUDE_MODEL_OPTIONS } from "../../shared/types/session.js";
+import { CLAUDE_MODEL_OPTIONS, SESSION_EFFORT_OPTIONS } from "../../shared/types/session.js";
 const MAX_RECENT_REPOSITORIES = 5;
 export function createAppSettingsService(deps) {
     const settingsPath = deps.settingsPath ?? path.join(homedir(), ".vcm", "settings.json");
@@ -211,7 +211,7 @@ function normalizeLaunchTemplate(input) {
     }
     const rawRoles = isObject(input.roles) ? input.roles : {};
     const roles = {};
-    for (const role of ROLE_NAMES) {
+    for (const role of VCM_ROLE_NAMES) {
         roles[role] = normalizeRoleLaunchTemplateEntry(rawRoles[role], defaults.roles[role]);
     }
     return {
@@ -225,7 +225,8 @@ function normalizeRoleLaunchTemplateEntry(input, fallback) {
     const candidate = isObject(input) ? input : {};
     return {
         permissionMode: normalizeClaudePermissionMode(candidate.permissionMode, fallback.permissionMode),
-        model: normalizeClaudeModel(candidate.model, fallback.model)
+        model: normalizeClaudeModel(candidate.model, fallback.model),
+        effort: normalizeSessionEffort(candidate.effort, fallback.effort)
     };
 }
 function normalizeClaudePermissionMode(input, fallback) {
@@ -241,6 +242,13 @@ function normalizeClaudeModel(input, fallback) {
     const model = CLAUDE_MODEL_OPTIONS.find((option) => option.value === input);
     return model?.value ?? fallback;
 }
+function normalizeSessionEffort(input, fallback) {
+    if (typeof input !== "string") {
+        return fallback;
+    }
+    const effort = SESSION_EFFORT_OPTIONS.find((option) => option.value === input);
+    return effort?.value ?? fallback;
+}
 function normalizeTranslationConfig(input) {
     if (!input || typeof input !== "object") {
         return undefined;

package/dist/backend/services/artifact-service.js

@@ -41,7 +41,8 @@ export function createArtifactService(fs) {
                     "project-manager": path.posix.join(logsDir, "project-manager.log"),
                     architect: path.posix.join(logsDir, "architect.log"),
                     coder: path.posix.join(logsDir, "coder.log"),
-                    reviewer: path.posix.join(logsDir, "reviewer.log")
+                    reviewer: path.posix.join(logsDir, "reviewer.log"),
+                    "codex-reviewer": path.posix.join(logsDir, "codex-reviewer.log")
                 },
                 messageRoutePaths: getDefaultMessageRoutePaths(messagesDir),
                 architecturePlanPath: path.posix.join(handoffDir, "architecture-plan.md"),

package/dist/backend/services/claude-hook-service.js

@@ -1,9 +1,9 @@
-import { isRoleName } from "../../shared/constants.js";
+import { isVcmRoleName } from "../../shared/constants.js";
 import { VcmError } from "../errors.js";
 import { getTaskRuntimeRepoRoot } from "./task-service.js";
 export function createClaudeHookService(deps) {
     async function getHookContext(input) {
-        if (!isRoleName(input.role)) {
+        if (!isVcmRoleName(input.role)) {
             throw new VcmError({
                 code: "HOOK_ROLE_INVALID",
                 message: `Unknown hook role: ${input.role}`,
@@ -185,7 +185,7 @@ export function createClaudeHookService(deps) {
         };
     }
     async function handlePermissionRequestHook(input) {
-        if (!isRoleName(input.role)) {
+        if (!isVcmRoleName(input.role)) {
             throw new VcmError({
                 code: "HOOK_ROLE_INVALID",
                 message: `Unknown hook role: ${input.role}`,

package/dist/backend/services/codex-hook-service.js

@@ -0,0 +1,87 @@
+import { VcmError } from "../errors.js";
+import { getTaskRuntimeRepoRoot } from "./task-service.js";
+const CODEX_REVIEWER_ROLE = "codex-reviewer";
+export function createCodexHookService(deps) {
+    async function getHookContext(input) {
+        if (input.role !== CODEX_REVIEWER_ROLE) {
+            throw new VcmError({
+                code: "CODEX_HOOK_ROLE_INVALID",
+                message: `Unknown Codex hook role: ${input.role}`,
+                statusCode: 400
+            });
+        }
+        const project = await deps.projectService.getCurrentProject();
+        if (!project) {
+            throw new VcmError({
+                code: "PROJECT_NOT_CONNECTED",
+                message: "Connect a repository before accepting Codex Reviewer hooks.",
+                statusCode: 409
+            });
+        }
+        const config = await deps.projectService.loadConfig(project.repoRoot);
+        const task = await deps.taskService.loadTask(project.repoRoot, input.taskSlug);
+        const taskRepoRoot = getTaskRuntimeRepoRoot(task);
+        return {
+            project,
+            config,
+            taskRepoRoot
+        };
+    }
+    async function processHook(input, expectedEventName) {
+        const eventName = parseHookEvent(input.event.hook_event_name);
+        if (eventName !== expectedEventName) {
+            throw new VcmError({
+                code: "CODEX_HOOK_EVENT_UNSUPPORTED",
+                message: `Unsupported Codex Reviewer hook event for this endpoint: ${eventName}`,
+                statusCode: 400
+            });
+        }
+        const context = await getHookContext(input);
+        const session = await deps.sessionService.recordRoleHookEvent(context.project.repoRoot, {
+            taskSlug: input.taskSlug,
+            role: CODEX_REVIEWER_ROLE,
+            eventName,
+            sessionId: stringOrUndefined(input.event.session_id),
+            transcriptPath: stringOrUndefined(input.event.transcript_path),
+            cwd: stringOrUndefined(input.event.cwd),
+            allowSessionMismatch: true
+        });
+        await deps.roundService.recordRoleTurnEvent({
+            repoRoot: context.project.repoRoot,
+            stateRepoRoot: context.taskRepoRoot,
+            stateRoot: context.config.stateRoot,
+            taskSlug: input.taskSlug,
+            role: CODEX_REVIEWER_ROLE,
+            eventName
+        });
+        return {
+            ok: true,
+            eventName,
+            taskSlug: input.taskSlug,
+            role: CODEX_REVIEWER_ROLE,
+            sessionUpdated: Boolean(session)
+        };
+    }
+    return {
+        handleHook(input) {
+            return processHook(input, "UserPromptSubmit");
+        },
+        handleStopHook(input) {
+            return processHook(input, "Stop");
+        }
+    };
+}
+function parseHookEvent(value) {
+    if (value === "UserPromptSubmit" || value === "Stop") {
+        return value;
+    }
+    throw new VcmError({
+        code: "CODEX_HOOK_EVENT_UNSUPPORTED",
+        message: `Unsupported Codex Reviewer hook event: ${String(value)}`,
+        statusCode: 400,
+        hint: "VCM accepts Codex Reviewer UserPromptSubmit and Stop hooks only."
+    });
+}
+function stringOrUndefined(value) {
+    return typeof value === "string" ? value : undefined;
+}