waku-memory 0.1.0 → 0.3.0

package/dist/capture.js

@@ -13,63 +13,138 @@
 // "y" before anything else happens, including asking for a key.
 //
 // Zero dependencies, per the shim's package.json: only node:fs, node:path
-// and node:util (all built in) below.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+// and node:util (all built in) below, one constant from hook.ts -- the
+// process budget the SessionEnd entry installs, which hook.ts's own network
+// budget has to fit under -- and, since task 13, the bootstrap module (spec
+// 011 §8): the third question's scan/render/parse (task 12) and send (task
+// 13) all live in bootstrap.ts, so enable() below only orchestrates them.
+// hook.ts imports nothing from here in return; bootstrap.ts imports from
+// hook.ts (the watermark rule) but nothing from this file either.
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
-// The marker every hook command this tool writes contains, and the only
-// thing removeHookSettings uses to tell "ours" from a foreign hook on the
-// same event. Deliberately just the tail of the real command (not the full
-// "npx -y waku-memory hook" string) so a hand-edited variant --
-// different flags, a pinned version -- is still recognized as ours.
-export const WAKU_HOOK_MARKER = 'waku-memory hook';
-// No separate script file to install, version, or leave stale (spec 005):
-// every event runs the shim package itself via npx. `-y` skips npm's
-// install-confirmation prompt, which would otherwise hang a hook that has
-// no terminal to answer it.
-const WAKU_HOOK_COMMAND = `npx -y ${WAKU_HOOK_MARKER}`;
-// Must match hook.ts's own (unexported) CONFIG_FILE_NAME -- the two files
-// agree on this only by convention, not by import, because hook.ts is
-// deliberately dependency-free of this file (it is the piece that runs
-// unattended on every turn; this is the piece a human runs once).
-const CONFIG_FILE_NAME = 'config.json';
+import { LIVE_WINDOW_MS, parseBootstrapAnswer, renderBootstrapList, runBootstrap, scanAll, } from "./bootstrap.js";
+import { CONFIG_FILE_NAME, SESSION_END_HOOK_TIMEOUT_S } from "./hook.js";
+// Task 9's Codex writers (spec 012 §4.2, §4.3, §4.6), consumed here rather
+// than re-implemented: codex-config.ts already decided *what* the TOML
+// table, the hooks.json entries and the marketplace entry should look like,
+// as pure functions over strings and objects -- enable()/disable()/status()
+// below only decide *when* to call them and what to do with a real
+// filesystem. codex-config.ts's own import from this file (HookCommandEntry,
+// HookGroup) is `import type`, erased at compile time, so this is not a
+// runtime import cycle: loading capture.ts still only ever requires
+// node:fs/node:path/node:util, harnesses.ts (via codex-config.ts) and
+// bootstrap.ts, the same dependency shape the file header above describes.
+import { codexPluginPresent, isOwnCodexEntry, mergeCodexHooks, mergeCodexToml, mergeMarketplaceEntry, removeCodexHooks, removeCodexToml, } from "./codex-config.js";
+// CONFIG_FILE_NAME and SESSION_END_HOOK_TIMEOUT_S are imported from hook.ts
+// above rather than re-declared: two copies of a name the hook reads and
+// this command writes would drift the first time one moved. The dependency
+// runs one way only -- hook.ts (the piece that runs unattended on every
+// turn) imports nothing from this file (the piece a human runs once).
+// Fix round 2 (re-review finding #1, controller ruling R9, spec 012 §4.2):
+// the single source of truth for "given one URL a person typed, what is the
+// ingest base and what is the MCP endpoint". Round 1 got this only half
+// right -- it derived ingestUrl from mcpUrl by stripping a trailing "/mcp",
+// but cli.ts's usage text documents "--url <ingest-base>" (an *ingest*-shaped
+// value), and dispatch() never computed a "/mcp"-suffixed mcpUrl from that
+// shape at all: an ingest-shaped --url with no "/mcp" to strip left
+// mcpUrl === ingestUrl, reproducing the exact defect (the ingest base
+// reaching the Codex TOML) for anyone who follows the tool's own documented
+// flag contract instead of guessing the MCP-shaped alternative.
+//
+// This function inverts the direction: always derive the *ingest* base first
+// (strip trailing slashes, then one trailing "/mcp" if present), then always
+// build mcpUrl by appending "/mcp" to that -- so every shape a person could
+// reasonably type ("https://x.test", "https://x.test/", "https://x.test/mcp")
+// converges on the same correct pair, rather than only working when the
+// input happens to already be MCP-shaped. Exported so both dispatch()
+// (cli.ts, computing the pair from --url) and disable() below (recovering
+// the pair enable() used, from what it stored in config.json) share the one
+// rule -- capture.ts is the natural home since cli.ts already imports from
+// it and the reverse would be a cycle.
+export function urlPair(given) {
+    let ingestUrl = given.replace(/\/+$/, '');
+    if (ingestUrl.endsWith('/mcp'))
+        ingestUrl = ingestUrl.slice(0, -'/mcp'.length).replace(/\/+$/, '');
+    return { ingestUrl, mcpUrl: `${ingestUrl}/mcp` };
+}
 // `Stop` is where captured content is actually sent -- "async": true so it
 // runs in the background without blocking the turn (600s default budget,
-// research doc §2). `SessionStart` posts the liveness heartbeat on the same
-// fire-and-forget basis. `SessionEnd` is the flush: all SessionEnd hooks
-// share a 1.5s-by-default exit budget (raisable only to 60s) and cannot
-// block Claude Code's own exit -- hook.ts's SESSION_END_TIMEOUT_MS comment
-// has the measured detail -- so it carries a `timeout` instead of `async`.
-// `async` only affects whether a hook keeps running after Claude Code moves
-// on; for an event that already cannot block exit, that distinction does
-// not apply, so it is left off rather than set to a value the harness
-// ignores anyway (pinned by the given test's `sessionEnd.async === undefined`).
-const HOOK_EVENTS = {
-    Stop: { type: 'command', command: WAKU_HOOK_COMMAND, async: true },
-    SessionStart: { type: 'command', command: WAKU_HOOK_COMMAND, async: true },
-    SessionEnd: { type: 'command', command: WAKU_HOOK_COMMAND, timeout: 10 },
-};
+// research doc §2). `SessionStart` is synchronous instead, with a 5s
+// timeout and a matcher naming the five events worth a brief: its stdout is
+// printed straight into the session as context (spec 011 §6, task 9), which
+// is exactly why it can no longer be fire-and-forget the way 0.1.x had it.
+// `SessionEnd` is the flush: all SessionEnd hooks share a 1.5s-by-default
+// exit budget and cannot block Claude Code's own exit, so it carries a
+// `timeout` instead of `async` -- raised to SESSION_END_HOOK_TIMEOUT_S
+// seconds, the process budget hook.ts's own network budget is derived from
+// (its SESSION_END_TIMEOUT_MS comment has the measured detail). `async`
+// only affects whether a hook keeps running after Claude Code moves on; for
+// an event that already cannot block exit, that distinction does not
+// apply, so it is left off rather than set to a value the harness ignores
+// anyway (pinned by the given test's `sessionEnd.async === undefined`).
+const SESSION_START_MATCHER = 'startup|resume|clear|compact|fork';
+function hookEvents(run) {
+    const base = run.args
+        ? { type: 'command', command: run.command, args: run.args }
+        : { type: 'command', command: run.command };
+    return {
+        Stop: { hooks: [{ ...base, async: true }] },
+        SessionStart: { matcher: SESSION_START_MATCHER, hooks: [{ ...base, timeout: 5 }] },
+        SessionEnd: { hooks: [{ ...base, timeout: SESSION_END_HOOK_TIMEOUT_S }] },
+    };
+}
+// Ours in either form: a shell command that names the package and ends
+// with the subcommand (0.1.x), or an exec-form entry whose last argument is
+// `hook` and whose script lives under a `.waku-memory/hook/` directory.
+// Deliberately not a single marker constant checked against one field
+// anymore -- the exec form has no one field that both names the package and
+// the subcommand the way the 0.1.x shell string did, so recognising it
+// needs its own arm.
+export function isOwnEntry(entry) {
+    // settings.json is only validated as a top-level plain object
+    // (readClaudeSettings's own comment) -- anything inside `hooks` is
+    // whatever some other tool wrote there, so `command` and `args` are
+    // `unknown` in practice despite what HookCommandEntry claims at compile
+    // time. An entry this cannot prove is shaped the way ours would be is
+    // never ours: false, not a thrown TypeError (final review M1 -- a real
+    // exec-form entry with a non-string argument used to throw out of here,
+    // reaching mergeHookSettings, reaching enable() *after* config.json is
+    // already written).
+    if (typeof entry.command !== 'string')
+        return false;
+    if (entry.args !== undefined) {
+        if (!Array.isArray(entry.args) || entry.args.some((a) => typeof a !== 'string'))
+            return false;
+        const args = entry.args;
+        return args[args.length - 1] === 'hook' && args.some((a) => a.replace(/\\/g, '/').includes('/.waku-memory/hook/'));
+    }
+    return entry.command.includes('waku-memory') && entry.command.trimEnd().endsWith(' hook');
+}
 // A group is "ours" only if every hook inside it is ours -- mergeHookSettings
 // only ever writes single-hook groups, so in practice this means exactly
-// one hook whose command carries the marker, but the "every" check (rather
-// than "some") is what makes removeHookSettings's contract exact: it must
-// never delete a group that also carries someone else's hook.
+// one hook isOwnEntry recognises, but the "every" check (rather than
+// "some") is what makes removeHookSettings's contract exact: it must never
+// delete a group that also carries someone else's hook.
 function isOwnGroup(group) {
-    return group.hooks.length > 0 && group.hooks.every((h) => h.command.includes(WAKU_HOOK_MARKER));
-}
-// Appends one group per event in HOOK_EVENTS, skipping any event that
-// already carries one of ours -- running `enable` twice must not duplicate
-// entries (pinned by the brief's idempotence test and this file's "running
-// twice" orchestration test). A foreign group already on the same event is
-// never inspected beyond isOwnGroup's check and is never reordered or
-// rewritten -- only ours is ever added.
-export function mergeHookSettings(existing) {
+    return group.hooks.length > 0 && group.hooks.every(isOwnEntry);
+}
+// Ours if any group under any event is entirely ours -- status() (below)
+// needs exactly this yes/no, not the merge/remove machinery.
+function hasOwnHooks(settings) {
+    if (!settings.hooks)
+        return false;
+    return Object.values(settings.hooks).some((groups) => groups.some(isOwnGroup));
+}
+// Replaces any group of ours on each event -- an older version's entry, in
+// either form -- with one built from `run`, and keeps every foreign group
+// untouched. Idempotent: merging the same invocation twice yields the same
+// settings (pinned below), which is what makes running `enable` again, on
+// the same version, safe.
+export function mergeHookSettings(existing, run) {
     const hooks = { ...(existing.hooks ?? {}) };
-    for (const [event, entry] of Object.entries(HOOK_EVENTS)) {
-        const groups = hooks[event] ?? [];
-        if (!groups.some(isOwnGroup)) {
-            hooks[event] = [...groups, { hooks: [entry] }];
-        }
+    for (const [event, group] of Object.entries(hookEvents(run))) {
+        hooks[event] = [...(hooks[event] ?? []).filter((g) => !isOwnGroup(g)), group];
     }
     return { ...existing, hooks };
 }
@@ -94,14 +169,96 @@ export function removeHookSettings(existing) {
     }
     return { ...existing, hooks };
 }
-// The exact two sentences spec 005's "Disclosure" section requires, shown
-// at the moment that discharges status.md item 9's obligation for capture:
-// "before anyone outside the three of us is invited, and no later than the
-// day a worker is deployed, they need to be told the environment can lose
-// their data and that importing [or capturing] sends its contents to
-// Anthropic." Both facts, two sentences, nothing softened.
+// Copies the shim's own compiled dist/*.js, next to a one-line ESM
+// package.json, into a version-numbered directory under configDir --
+// installed rather than run via npx (2.5s per hook, measured, on top of
+// SessionStart now being synchronous and printing: spec 011 §6) and
+// versioned rather than a single fixed path so an in-flight hook from the
+// previous version is never overwritten mid-run by the next `enable`
+// (pruneHookCopies below cleans up once settings.json has moved on).
+// A no-op when sourceDir already *is* the copy -- enable() re-run from
+// inside an already-installed copy has nothing left to do.
+export function installHookCopy(sourceDir, configDir, version) {
+    const target = join(configDir, 'hook', version);
+    const indexPath = join(target, 'index.js').replace(/\\/g, '/'); // Claude Code spawns this directly -- see hookInvocation
+    if (resolve(sourceDir) === resolve(target))
+        return indexPath;
+    mkdirSync(target, { recursive: true });
+    for (const name of readdirSync(sourceDir)) {
+        if (name.endsWith('.js'))
+            copyFileSync(join(sourceDir, name), join(target, name));
+    }
+    writeFileSync(join(target, 'package.json'), '{"type":"module"}\n', 'utf8'); // dist/*.js is ESM
+    return indexPath;
+}
+// After settings.json points only at `keep`, every other copy under
+// configDir/hook is stale disk. A directory Windows refuses to delete
+// (EBUSY: an old hook process still running) is reported and left for the
+// next enable to retry -- the entries already point elsewhere, so a copy
+// left behind here is wasted space, never a wrong hook running.
+export function pruneHookCopies(configDir, keep) {
+    const root = join(configDir, 'hook');
+    let names;
+    try {
+        names = readdirSync(root);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (name === keep)
+            continue;
+        try {
+            rmSync(join(root, name), { recursive: true, force: true });
+        }
+        catch (err) {
+            console.error(`Could not remove the old hook copy ${join(root, name)} -- ${err.message}. ` +
+                `It will be removed by the next "capture enable".`);
+        }
+    }
+}
+// Exec form (spec 011 §6): Claude Code spawns command/args directly, no
+// shell. The command is the Node that ran `enable`, by absolute path, not
+// the bare word "node" -- Claude Code ships no Node of its own and a
+// launcher's PATH is not guaranteed to have one on it either.
+export function hookInvocation(execPath, indexPath) {
+    return { command: execPath.replace(/\\/g, '/'), args: [indexPath, 'hook'] };
+}
+// The first two sentences are spec 005's "Disclosure" section, shown at the
+// moment that discharges status.md item 9's obligation for capture: "before
+// anyone outside the three of us is invited, and no later than the day a
+// worker is deployed, they need to be told the environment can lose their
+// data and that importing [or capturing] sends its contents to Anthropic."
+// Both facts, two sentences, nothing softened.
+//
+// The next three sentences are spec 011 §9 (A15, task 14), added because
+// "captured content is sent" on its own reads as "everything on this
+// machine is sent" -- not true, and the gap matters enough to name: typed
+// text, replies and tool names go; the files an agent reads and the
+// commands it runs stay local *unless the agent's own reply quotes them
+// back* (the one path by which their content can still leave, so the
+// carve-out has to say so rather than imply a cleaner boundary than the
+// hook actually draws); reasoning is never sent, full stop. The next
+// sentence previews enable()'s own third question (task 13, spec 011 §8):
+// "the next question" is literal, not rhetorical -- renderBootstrapList
+// (bootstrap.ts) is the list it points at, printed immediately after this
+// disclosure and the "y" it gates, before that question is ever asked.
+//
+// The sixth sentence, appended by task 14 (spec 012 §9): everything above
+// was written back when this shim only ran under Claude Code, and reads as
+// a Claude-Code-only account of what "captured content" even is on a
+// machine where `capture enable` now also wires up Codex (task 10, spec 012
+// §4.6). Named rather than implied, because a person enabling capture on a
+// Codex-only machine has no other way to learn that the same three hooks
+// exist there too, or that installing the Waku plugin instead is the other
+// route to the same events (codexPluginPresent, this file's own enable()).
 export const DISCLOSURE = 'Captured content is sent to our servers and to Anthropic for extraction. ' +
-    'This is an alpha whose data can be lost.';
+    'This is an alpha whose data can be lost. ' +
+    'What you type, what the agent replies, and the names of the tools it uses are sent; ' +
+    'the files it reads and the commands it runs are not, except where the agent quotes them in its reply, ' +
+    'and its reasoning is never sent. ' +
+    'Enabling can also import the memory and history Claude Code already keeps here; the next question lists exactly what. ' +
+    'On Codex the same three hooks read ~/.codex/sessions, or the Waku plugin sends each turn as you go.';
 // Exported so cli.ts's usage text can point at the same URL without a
 // second copy of it drifting out of sync.
 //
@@ -113,6 +270,15 @@ export const DISCLOSURE = 'Captured content is sent to our servers and to Anthro
 // free to move now. tech.md calls the Vercel host an earlier one, kept and
 // not retired; this is the product's own address.
 export const KEYS_PAGE_URL = 'https://www.waku.one/account/keys';
+// Shared by disable() and, since task 13, enable()'s own verify-fail
+// refusal (controller ruling R14): both places are telling the user the
+// exact same true thing -- a real credential is on disk even though this
+// command did not finish -- so this is the one string, not two copies of it
+// drifting apart the way the Codex refusal messages already warn against
+// (see codexTomlRefusalMessage above).
+function stillSavedMessage(configPath) {
+    return `Your API key is still saved at ${configPath}. Revoke it at ${KEYS_PAGE_URL} if you want to fully remove access.`;
+}
 // Reads settings.json the same way applyToHarness (cli.ts) reads a harness
 // config: missing or blank is a blank slate (undefined here would wrongly
 // refuse the single most common first run -- no settings.json yet at all);
@@ -140,44 +306,486 @@ function readClaudeSettings(settingsPath) {
         return undefined;
     }
 }
+// Reads ~/.codex/hooks.json the same way readClaudeSettings above reads
+// settings.json: missing or blank is a blank slate (a fresh machine, or one
+// where Codex itself has no hooks.json yet); anything non-blank that fails
+// to parse, or does not parse to a plain object, is real corruption and
+// returns undefined so enable() refuses rather than risks merging into --
+// and overwriting -- a file it could not understand.
+function readCodexHooksFile(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return {};
+    }
+    if (raw.trim() === '')
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Reads ~/.agents/plugins/marketplace.json. Missing or blank is `undefined`
+// -- not `{}` -- because mergeMarketplaceEntry(undefined) is what builds the
+// fresh personal marketplace (name, interface, our one plugin); passing `{}`
+// instead would be merged into as if it were an existing, but nameless,
+// file. Real corruption is its own 'invalid' outcome, distinct from
+// undefined, so enable() can refuse on it without also refusing the far
+// more common "nothing here yet" case.
+function readMarketplaceFile(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    if (raw.trim() === '')
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return 'invalid';
+        return parsed;
+    }
+    catch {
+        return 'invalid';
+    }
+}
+// Ours if any group under any event is entirely ours -- mirrors isOwnGroup
+// above, but over CodexHooksFile/isOwnCodexEntry: status() (below) needs to
+// answer "did we write this file" without codex-config.ts having to export
+// its own private isOwnCodexGroup.
+function hasOwnCodexHooks(file) {
+    if (!file.hooks)
+        return false;
+    return Object.values(file.hooks).some((groups) => groups.some((g) => g.hooks.length > 0 && g.hooks.every(isOwnCodexEntry)));
+}
+// The one place that writes config.json -- enable() below (a pasted key)
+// and, since task 12, login.ts (a minted one) both funnel through here so
+// the file's shape and its permissions never drift between the two paths.
+// {mode: 0o600} is a request, not a guarantee: Windows has no POSIX
+// owner-only bit for writeFileSync to set, so this line is best-effort
+// there and fully effective on Unix. Correct to pass on every platform
+// regardless -- harmless where it cannot apply, the right thing where it
+// can. Not routed through atomicWriteJson: that writer has no mode
+// parameter, and this file is small, freshly created, and not something
+// Claude Code itself reads concurrently the way settings.json is -- the
+// atomic temp-file-plus-rename technique earns its complexity there, not
+// here.
+export function writeConfigJson(configDir, config) {
+    mkdirSync(configDir, { recursive: true }); // first run: ~/.waku-memory may not exist yet
+    const configPath = join(configDir, CONFIG_FILE_NAME);
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+}
+// Only printable ASCII can be part of a bearer key. Non-printable
+// characters at either *end* came from the terminal, not the person: on
+// 2026-09-04 a Windows console delivered Ctrl+V's own control code (0x16)
+// ahead of the key, `.trim()` left it in place, and every hook call then
+// failed with an opaque "fetch failed" (undici refusing the Authorization
+// header). Whitespace and non-ASCII (an IME's full-width space, say) are
+// stripped from the ends for the same reason.
+//
+// Anything non-printable left *inside* is a different thing: the paste
+// held more than the key ("Bearer mem_sk_..."), and stripping it would
+// glue two tokens into one wrong key that looks right -- the 0.1.1 review
+// reproduced exactly that, with the next hook's 401 landing in a
+// background process nobody watches. So the interior count is returned,
+// not repaired, and askForKey refuses on it.
+export function sanitizeKey(raw) {
+    const printable = (c) => {
+        const code = c.charCodeAt(0);
+        return code >= 0x21 && code <= 0x7e;
+    };
+    const chars = [...raw];
+    let start = 0;
+    let end = chars.length;
+    while (start < end && !printable(chars[start]))
+        start++;
+    while (end > start && !printable(chars[end - 1]))
+        end--;
+    const kept = chars.slice(start, end);
+    return {
+        key: kept.join(''),
+        removed: chars.length - kept.length,
+        interior: kept.filter((c) => !printable(c)).length,
+    };
+}
+const KEY_ATTEMPTS = 3;
+// What every key minted at KEYS_PAGE_URL starts with (api_key_repository.py:
+// PREFIX + token_urlsafe(32)). A key without it is warned about, not
+// refused: the server's opinion is the only one that counts, and a refusal
+// here would make a future prefix change strand every user on this shim.
+const KEY_PREFIX = 'mem_sk_';
+// The sanitizeKey checks and their messages, factored out of askForKey so
+// resolveCredential's `--key` path (fix round 1, finding 3) can apply the
+// exact same rules to a key that arrived on the command line instead of
+// through a prompt: a flag is not "typed", but it crosses a shell boundary
+// the same way a paste crosses a terminal one, and it is exactly as capable
+// of carrying a leading Ctrl+V byte or a "Bearer " prefix pasted by
+// mistake -- a flag used to skip these checks entirely (finding 3's bug).
+// `printEmptyHint` exists only to match askForKey's own choice to suppress
+// the "paste it again" hint on its last attempt (no more attempts are
+// coming); every one-shot caller (the `--key` path) passes false for the
+// same reason -- there is no re-ask to hint toward. No branch below ever
+// prints the key or any part of it -- counts and a prefix only.
+function checkPastedKey(raw, printEmptyHint) {
+    const { key, removed, interior } = sanitizeKey(raw);
+    if (interior > 0) {
+        console.log(`The pasted text has ${interior} character(s) inside it that cannot be part of a key -- ` +
+            `more than the key was pasted. Paste the key itself, nothing else.`);
+        return null;
+    }
+    if (key === '') {
+        if (printEmptyHint) {
+            console.log('That did not contain a usable key -- paste the key itself, nothing else.');
+        }
+        return null;
+    }
+    if (removed > 0) {
+        console.log(`Removed ${removed} non-printable character(s) from the ends of the pasted key -- ` +
+            `a terminal can add Ctrl+V's own code ahead of what it pastes.`);
+    }
+    if (!key.startsWith(KEY_PREFIX)) {
+        console.log(`Note: the key does not start with ${KEY_PREFIX}, which every key minted at ${KEYS_PAGE_URL} does. ` +
+            `Saving it as pasted; if the hook reports 401, run this command again with a fresh key.`);
+    }
+    return key;
+}
+// Asks up to KEY_ATTEMPTS times. null means the person never pasted anything
+// usable, and enable() then ends with the same "nothing was written"
+// guarantee that declining the disclosure carries.
+async function askForKey(deps) {
+    for (let attempt = 1; attempt <= KEY_ATTEMPTS; attempt++) {
+        const raw = await deps.prompt(`Paste an API key from ${KEYS_PAGE_URL} (it is shown once, at mint time): `);
+        const key = checkPastedKey(raw, attempt < KEY_ATTEMPTS);
+        if (key !== null)
+            return key;
+    }
+    return null;
+}
+// The Sign-in choice (spec 012 §7, controller ruling R13): the first thing
+// enable() asks once the disclosure gate is past, whenever `credential` is
+// { kind: 'ask' } and config.json holds no usable key yet (readStoredKey
+// below). Verbatim -- capture.test.mjs and cli.test.mjs's usage text both
+// depend on this exact string, so a wording change here is a break of that
+// contract, not a cosmetic edit.
+export const SIGN_IN_QUESTION = 'Sign in [1] in the browser (recommended) [2] by pasting a key: ';
+// Same "stop pestering the person" budget askForKey's own KEY_ATTEMPTS
+// gives a pasted key -- an answer that is neither "1" nor "2" three times
+// running is treated the same as declining outright.
+const SIGN_IN_ATTEMPTS = 3;
+// Reads just the `key` field out of config.json, the way hook.ts's own
+// readConfig reads {url, key} for the hook's real network calls: a
+// non-empty string or nothing usable at all (missing file, malformed JSON,
+// a `key` that is absent, empty, or not a string) -- R13's "already holds a
+// usable key" test, and runLogin's own read-back of what deps.login() just
+// wrote. Never prints what it finds.
+function readStoredKey(configDir) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(configDir, CONFIG_FILE_NAME), 'utf8'));
+        if (parsed !== null && typeof parsed === 'object') {
+            const key = parsed.key;
+            if (typeof key === 'string' && key.length > 0)
+                return key;
+        }
+    }
+    catch {
+        // Missing, unreadable, or not valid JSON -- no stored key.
+    }
+    return null;
+}
+// deps.login() is login.ts's login(): it already wrote config.json itself
+// by the time it returns 'signed-in' (writeConfigJson, sanitizeKey -- both
+// this file's own), so the key is read back here rather than threaded
+// across the deps boundary a second way. A non-'signed-in' result
+// ('timeout' or 'refused') means login() never reached that write --
+// nothing is on disk, and the one sentence R14 gives verbatim is accurate.
+// A 'signed-in' result whose key cannot be read back -- config.json is
+// missing, unreadable, malformed, or its `key` field is empty or not a
+// string; see readStoredKey -- is a refusal, not a silent empty-key
+// continue: fix round 1 finding 2 found the old code here (`key: key ??
+// ''`) letting enable() sail on through installHookCopy/verifyHook/
+// writeSettingsJson with no working credential on disk and nothing printed.
+async function runLogin(deps) {
+    const result = await deps.login();
+    if (result !== 'signed-in') {
+        console.log('Capture not enabled -- sign-in did not complete; nothing was written.');
+        return 'declined';
+    }
+    const key = readStoredKey(deps.configDir);
+    if (key === null) {
+        const configPath = join(deps.configDir, CONFIG_FILE_NAME);
+        console.error(`Signed in, but the key could not be read back from ${configPath} -- nothing else was written.`);
+        return 'refused';
+    }
+    return { key, skipWriteConfig: true };
+}
+// The credential decision itself (controller rulings R13/R14). `credential`
+// is enable()'s own third parameter, not a CaptureDeps field -- see
+// Credential's own comment for why -- and is `undefined` only for the
+// legacy call shape every enable() call predating task 13 used (a bare
+// `enable(url, deps)`, still exactly what every test written before this
+// task passes): that path is untouched, byte for byte, from what askForKey
+// alone did before this function existed, which is what keeps those tests
+// green without editing a single one of them.
+//   - undefined: ask for a pasted key directly (askForKey, unchanged).
+//   - { kind: 'key' }: nothing is asked, but the value still goes through
+//     checkPastedKey (fix round 1, finding 3) -- a flag is not typed, but it
+//     is exactly as capable of carrying a stray leading byte or an empty
+//     string as a paste is, and it used to skip validation entirely.
+//   - { kind: 'login' }: deps.login() runs immediately -- nothing is asked.
+//   - { kind: 'ask' }: a stored, usable key short-circuits everything with
+//     one line and no question (R13); otherwise the Sign-in choice is
+//     asked, up to SIGN_IN_ATTEMPTS times, and "1"/"2" branch into
+//     login()/askForKey() respectively. A third invalid answer declines,
+//     the same shape askForKey's own attempts loop already has.
+async function resolveCredential(deps, credential) {
+    if (credential === undefined) {
+        const key = await askForKey(deps);
+        if (key === null) {
+            console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+            return 'declined';
+        }
+        return { key, skipWriteConfig: false };
+    }
+    if (credential.kind === 'key') {
+        // No re-ask: a flag is not interactive, so a bad --key declines
+        // outright (printEmptyHint: false) instead of prompting for another one.
+        const key = checkPastedKey(credential.key, false);
+        if (key === null) {
+            console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+            return 'declined';
+        }
+        return { key, skipWriteConfig: false };
+    }
+    if (credential.kind === 'login') {
+        return runLogin(deps);
+    }
+    // credential.kind === 'ask'
+    const stored = readStoredKey(deps.configDir);
+    if (stored !== null) {
+        console.log(`Using the key already stored in ${deps.configDir}/${CONFIG_FILE_NAME}.`);
+        return { key: stored, skipWriteConfig: false };
+    }
+    for (let attempt = 1; attempt <= SIGN_IN_ATTEMPTS; attempt++) {
+        const answer = (await deps.prompt(SIGN_IN_QUESTION)).trim();
+        if (answer === '1')
+            return runLogin(deps);
+        if (answer === '2') {
+            const key = await askForKey(deps);
+            if (key === null) {
+                console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+                return 'declined';
+            }
+            return { key, skipWriteConfig: false };
+        }
+        if (attempt < SIGN_IN_ATTEMPTS)
+            console.log('Enter 1 or 2.');
+    }
+    console.log('Capture not enabled -- no valid answer was given; nothing was written.');
+    return 'declined';
+}
+// A parsed BootstrapAnswer still carries `invalid`; runBootstrap's own
+// BootstrapSelection does not (its three real outcomes are `all`, `skip` and
+// `exclude`) -- askBootstrapSelection's own re-ask loop below is where a
+// still-invalid second answer becomes `skip`, so by the time this is called
+// that case has already been decided; this is a plain, total mapping, never
+// itself a decision point.
+function toSelection(answer) {
+    if (answer.kind === 'exclude')
+        return { kind: 'exclude', numbers: answer.numbers };
+    if (answer.kind === 'all')
+        return { kind: 'all' };
+    return { kind: 'skip' }; // 'skip', or a still-invalid second answer
+}
+// The third question, spec 011 §8: asks '> ' once, and on an invalid answer
+// prints the one-line hint and asks once more -- a second invalid answer is
+// treated as skip rather than asked a third time, the same "stop pestering
+// the person" reasoning A12's own parseBootstrapAnswer comment gives for
+// only ever re-asking once.
+async function askBootstrapSelection(projectCount, prompt) {
+    let answer = parseBootstrapAnswer(await prompt('> '), projectCount);
+    if (answer.kind === 'invalid') {
+        console.log('Enter, numbers, or n.');
+        answer = parseBootstrapAnswer(await prompt('> '), projectCount);
+    }
+    return toSelection(answer);
+}
+// The Codex TOML refusal, worded the same way harnesses.ts's mergeMcpConfig
+// refuses a conflicting Claude Code entry (its own comment there: "someone
+// configured this by hand ... silently replacing it would undo a deliberate
+// choice with no trace"). mergeCodexToml's 'refused' result does not carry
+// the conflicting url back (only the unchanged text), so this cannot name it
+// the way mergeMcpConfig's thrown message does -- naming the table and the
+// file it lives in is the closest equivalent.
+function codexTomlRefusalMessage(codexConfigPath) {
+    return (`[mcp_servers.waku] in ${codexConfigPath} is already configured with a different URL. ` +
+        `Remove it or edit the file by hand.`);
+}
 // The one gesture that turns capture on. Order is deliberate and each step
 // depends on the one before it having succeeded:
-//   1. refuse if Claude Code itself is not on this machine -- the directory
-//      is the evidence, the shim's own edit-don't-create rule adapted from
-//      cli.ts's harness handling;
-//   2. refuse if the existing settings.json cannot be safely read -- checked
-//      here, before the disclosure, so a machine this can never work on
-//      fails fast instead of making the user type through a consent flow
-//      first only to hit a wall at the end;
-//   3. print the disclosure and demand a typed "y" -- before anything else,
+//   1. refuse if neither harness is on this machine -- Claude Code's
+//      directory or Codex's config.toml is the evidence, the shim's own
+//      edit-don't-create rule adapted from cli.ts's harness handling. Widened
+//      from "Claude Code only" (spec 012 §4/§4.6, task 10): a Codex-only
+//      machine is now a real target, not a refusal.
+//   2. when claudeDir exists, refuse if the existing settings.json cannot be
+//      safely read -- checked here, before the disclosure, so a machine this
+//      can never work on fails fast instead of making the user type through
+//      a consent flow first only to hit a wall at the end. Skipped
+//      altogether on a Codex-only machine: there is no settings.json to
+//      protect.
+//   3. when codexConfigPath exists, detect the plugin (codexPluginPresent).
+//      If it is not there, compute the TOML merge (mergeCodexToml) and read
+//      hooks.json and marketplace.json -- all before the disclosure, for the
+//      same reason as step 2: a refusal (a foreign [mcp_servers.waku] table,
+//      or either file unreadable) must cost the user nothing and write
+//      nothing, exactly like a Claude Code refusal. If the plugin *is*
+//      there, none of this runs: it already carries the hooks and the MCP
+//      server, so writing our own beside it would be redundant at best and a
+//      second, conflicting route to the same events at worst -- the plugin
+//      wins, and step 8 below prints that instead of touching either file;
+//   4. print the disclosure and demand a typed "y" -- before anything else,
 //      including asking for the key, so declining costs the user nothing
 //      and asks for nothing;
-//   4. only then ask for the key;
-//   5. write config.json, then merge and write settings.json. Everything
-//      before this point (refusing, declining) writes nothing at all --
-//      that guarantee is real. This step itself is not atomic across the
-//      two files, though: config.json is committed to disk first, so a
-//      failure on the settings.json write right after -- disk full, a
-//      permission error -- does leave a real credential saved with no
-//      hook actually installed, i.e. capture silently not active despite
-//      config.json existing. Accepted rather than guarded against (no
-//      rollback, no pre-write dry run): the failure still propagates out
-//      of enable() to cli.ts's runCaptureCommand, which reports it and
-//      sets a nonzero exit code, so it is not silent; it fails toward
-//      "capture not enabled" rather than a consent bypass; and re-running
-//      `enable` repairs it, since writing config.json again is a plain
-//      overwrite (capture.test.mjs's "running twice" test).
-export async function enable(url, deps) {
-    if (!existsSync(deps.claudeDir)) {
-        console.error(`Claude Code not found at ${deps.claudeDir} -- install Claude Code first, then run ` +
-            `"npx waku-memory capture enable" again.`);
+//   5. only then resolve the credential -- the Sign-in question, deps.login(),
+//      askForKey, or the already-known --key value, decided by `credential`
+//      (task 13, spec 012 §7, resolveCredential's own comment has the full
+//      decision table);
+//   6. install a local copy of the shim under configDir/hook/<version> and
+//      run it for real -- verifyHook -- before anything is wired into
+//      settings.json. A copy that does not even start (a corrupted copy, a
+//      Node too old for it, ...) must never become the thing Claude Code
+//      calls on every turn, so a failed verification removes the copy this
+//      call made under configDir/hook/<version> (and configDir/hook itself,
+//      if that copy was the only thing under it) and refuses right here,
+//      before config.json or settings.json is ever touched. A refusal
+//      removes only a copy this call made, though: installHookCopy is a
+//      no-op when hookSourceDir already *is* configDir/hook/<version> --
+//      enable running from inside the copy already installed there, which
+//      is what hookSourceDir (derived from the running cli.js's own
+//      import.meta.url) gives once a copy is in place -- and then this call
+//      installed nothing, so a failed verification leaves that directory
+//      alone: it may be the very copy settings.json still points at from an
+//      earlier, successful enable, and it is not this call's to delete.
+//      installHookCopy's mkdirSync(..., { recursive: true }) creates every
+//      ancestor directory on the way down, though, so the one thing a
+//      first-ever run can still leave behind after refusing here is an
+//      empty configDir -- not removed, since it is the config directory
+//      itself, not anything this step wrote into it;
+//   7. write config.json, then (when claudeDir exists) merge and write
+//      settings.json with the now-verified invocation. Everything before
+//      this point (refusing, declining, a failed verification) writes
+//      nothing new to disk -- step 6's own cleanup is what makes that true
+//      when a failed verification follows a real copy, down to the
+//      empty-configDir exception described there; when installHookCopy was
+//      instead a no-op, this call had nothing of its own to remove, and the
+//      pre-existing copy it leaves in place was never new. This step itself
+//      is not atomic across the two files, though: config.json is committed
+//      to disk first, so a failure on the settings.json write right after --
+//      disk full, a permission error -- does leave a real credential saved
+//      with no hook actually installed, i.e. capture silently not active
+//      despite config.json existing. Accepted rather than guarded against
+//      (no rollback, no pre-write dry run): the failure still propagates out
+//      of enable() to cli.ts's runCaptureCommand, which reports it and sets
+//      a nonzero exit code, so it is not silent; it fails toward "capture
+//      not enabled" rather than a consent bypass; and re-running `enable`
+//      repairs it, since writing config.json again is a plain overwrite
+//      (capture.test.mjs's "running twice" test);
+//   8. when codexConfigPath exists: print the plugin sentence and touch
+//      neither Codex file if the plugin is present; otherwise write the TOML
+//      table (only when step 3's merge actually changed it -- 'unchanged'
+//      writes nothing), merge and write hooks.json unconditionally (the same
+//      idempotent replace-ours-keep-foreign write settings.json always gets),
+//      and write the marketplace file only when mergeMarketplaceEntry says
+//      it changed;
+//   9. prune every other hook/<version> copy now that settings.json (and, on
+//      Codex, hooks.json) point only at this one (pruneHookCopies) --
+//      best-effort, never fatal, and only after both writes so a prune
+//      failure can never leave either file pointing at a copy this step just
+//      deleted.
+//   10. when deps.bootstrap.enabled (task 13, spec 011 §8): scan the machine
+//      for Claude Code's own memory files and transcripts (scanClaudeCode) --
+//      skipped, with an empty scan standing in, when claudeDir does not
+//      exist (task 11 replaces this with a scan over both harnesses; this
+//      task only has to keep a Codex-only machine from crashing on a scan
+//      path that is not there) -- and, only if that scan found something,
+//      print the one numbered list and ask the third and last question. This
+//      runs after the hooks are wired in and verified, deliberately:
+//      bootstrap is additional value once capture itself is real, not a
+//      precondition for it, and its own failure (a bad answer, a network
+//      error inside runBootstrap) must never undo a successful enable -- so
+//      nothing below this point can turn 'enabled' into anything else. An
+//      empty scan (nothing found, no user CLAUDE.md) says so and asks
+//      nothing at all: the person who has nothing to import should not be
+//      asked whether to skip importing it.
+//   11. the trust line, last, only when this run actually wrote Codex's
+//      hooks.json (step 8's non-plugin branch): Codex will not run a hook it
+//      has not seen a person approve, so a run that wired the entries in but
+//      never said so would read as done when one more step remains.
+export async function enable(url, deps, credential) {
+    const claudeDirExists = existsSync(deps.claudeDir);
+    const codexConfigExists = existsSync(deps.codexConfigPath);
+    if (!claudeDirExists && !codexConfigExists) {
+        console.error(`Neither Claude Code (${deps.claudeDir}) nor Codex (${deps.codexConfigPath}) was found on this machine -- ` +
+            `install one of them first, then run "npx waku-memory capture enable" again.`);
         return 'refused';
     }
-    const existingSettings = readClaudeSettings(deps.settingsPath);
-    if (existingSettings === undefined) {
-        console.error(`${deps.settingsPath}'s content is not something this tool can safely merge into -- ` +
-            `leaving it untouched. Nothing was written.`);
-        return 'refused';
+    let existingSettings = {};
+    if (claudeDirExists) {
+        const read = readClaudeSettings(deps.settingsPath);
+        if (read === undefined) {
+            console.error(`${deps.settingsPath}'s content is not something this tool can safely merge into -- ` +
+                `leaving it untouched. Nothing was written.`);
+            return 'refused';
+        }
+        existingSettings = read;
+    }
+    // Step 3: everything Codex needs decided and checked before the
+    // disclosure -- see this function's own comment above for why. Left at
+    // their blank-slate defaults (false / undefined / {}) when codexConfigPath
+    // does not exist or the plugin is already present; step 8 below only reads
+    // codexTomlMerge/codexHooksFile/codexMarketplaceFile inside the branch
+    // where they were actually computed.
+    let codexPluginPresentHere = false;
+    let codexTomlMerge;
+    let codexHooksFile = {};
+    let codexMarketplaceFile;
+    if (codexConfigExists) {
+        const tomlText = readFileSync(deps.codexConfigPath, 'utf8');
+        codexPluginPresentHere = codexPluginPresent(tomlText, deps.codexPluginsCacheDir);
+        if (!codexPluginPresentHere) {
+            // deps.mcpUrl, not `url`: `url` is the ingest base (config.json's own
+            // value in real use), and the TOML's [mcp_servers.waku] table needs
+            // the MCP endpoint instead (spec 012 §4.2) -- see CaptureDeps.mcpUrl.
+            codexTomlMerge = mergeCodexToml(tomlText, deps.mcpUrl);
+            if (codexTomlMerge.result === 'refused') {
+                console.error(codexTomlRefusalMessage(deps.codexConfigPath));
+                return 'refused';
+            }
+            const readHooks = readCodexHooksFile(deps.codexHooksPath);
+            if (readHooks === undefined) {
+                console.error(`${deps.codexHooksPath}'s content is not something this tool can safely merge into -- ` +
+                    `leaving it untouched. Nothing was written.`);
+                return 'refused';
+            }
+            codexHooksFile = readHooks;
+            const readMarketplace = readMarketplaceFile(deps.marketplacePath);
+            if (readMarketplace === 'invalid') {
+                console.error(`${deps.marketplacePath}'s content is not something this tool can safely merge into -- ` +
+                    `leaving it untouched. Nothing was written.`);
+                return 'refused';
+            }
+            codexMarketplaceFile = readMarketplace;
+        }
     }
     console.log(DISCLOSURE);
     console.log('');
@@ -186,46 +794,281 @@ export async function enable(url, deps) {
         console.log('Capture not enabled -- nothing was written.');
         return 'declined';
     }
-    const key = (await deps.prompt(`Paste an API key from ${KEYS_PAGE_URL} (it is shown once, at mint time): `)).trim();
-    mkdirSync(deps.configDir, { recursive: true }); // first run: ~/.waku-memory may not exist yet
+    const credentialResult = await resolveCredential(deps, credential);
+    if (credentialResult === 'declined')
+        return 'declined';
+    // Fix round 1, finding 2: signed-in but config.json came back unreadable
+    // -- a bug, not "the person declined" -- so this is refused before ever
+    // reaching installHookCopy, exactly like every other pre-flight refusal
+    // above in this function.
+    if (credentialResult === 'refused')
+        return 'refused';
+    const { key, skipWriteConfig } = credentialResult;
     const configPath = join(deps.configDir, CONFIG_FILE_NAME);
-    // {mode: 0o600} is a request, not a guarantee: Windows has no POSIX
-    // owner-only bit for writeFileSync to set, so this line is best-effort
-    // there and fully effective on Unix. Correct to pass on every platform
-    // regardless -- harmless where it cannot apply, the right thing where it
-    // can. Not routed through atomicWriteJson: that writer has no mode
-    // parameter, and this file is small, freshly created, and not something
-    // Claude Code itself reads concurrently the way settings.json is -- the
-    // atomic temp-file-plus-rename technique earns its complexity there, not
-    // here.
-    writeFileSync(configPath, JSON.stringify({ url, key }, null, 2) + '\n', { mode: 0o600 });
-    const merged = mergeHookSettings(existingSettings);
-    deps.writeSettingsJson(deps.settingsPath, merged);
+    const indexPath = installHookCopy(deps.hookSourceDir, deps.configDir, deps.version);
+    const run = hookInvocation(deps.execPath, indexPath);
+    if (!deps.verifyHook(run)) {
+        // Undo the copy this call just installed -- but only if it made one.
+        // installHookCopy no-ops when hookSourceDir already *is* the target
+        // directory (enable re-run from inside the installed copy); deleting
+        // the target in that case would remove a pre-existing directory this
+        // call never wrote, possibly the very copy settings.json still points
+        // at from an earlier, successful enable.
+        if (resolve(deps.hookSourceDir) !== resolve(dirname(indexPath))) {
+            rmSync(dirname(indexPath), { recursive: true, force: true });
+            const hookRoot = join(deps.configDir, 'hook');
+            try {
+                if (readdirSync(hookRoot).length === 0)
+                    rmSync(hookRoot, { recursive: true, force: true });
+            }
+            catch {
+                // hookRoot is already gone -- nothing left to prune
+            }
+        }
+        if (skipWriteConfig) {
+            // Controller ruling R14: the credential came from deps.login(), which
+            // already wrote config.json with a real, minted key before this run
+            // ever reached installHookCopy -- unlike every other credential path,
+            // where config.json is not written until after verifyHook succeeds
+            // (below). "nothing was written" would be false here, so this shares
+            // disable()'s own sentence (stillSavedMessage) instead of a second
+            // copy of it.
+            console.error(`The hook entry did not run (${run.command} ${(run.args ?? []).join(' ')}).`);
+            console.error(stillSavedMessage(configPath));
+        }
+        else {
+            console.error(`The hook entry did not run (${run.command} ${(run.args ?? []).join(' ')}) -- ` +
+                `nothing was written.`);
+        }
+        return 'refused';
+    }
+    if (!skipWriteConfig)
+        writeConfigJson(deps.configDir, { url, key });
+    if (claudeDirExists) {
+        const merged = mergeHookSettings(existingSettings, run);
+        deps.writeSettingsJson(deps.settingsPath, merged);
+    }
+    // Step 8: the Codex writes -- or, when the plugin already carries them,
+    // exactly one sentence and neither file touched. codexHooksWrittenThisRun
+    // gates the trust line (step 11): true whenever hooks.json was actually
+    // written this run, which -- unlike the TOML table and the marketplace
+    // entry, both conditioned on their own merge having changed anything -- is
+    // every time this branch runs at all (mergeCodexHooks's replace-ours
+    // semantics write the file even when the entries end up identical, the
+    // same way settings.json above always gets written).
+    let codexHooksWrittenThisRun = false;
+    if (codexConfigExists) {
+        if (codexPluginPresentHere) {
+            console.log('The Waku plugin carries the hooks and the MCP server for Codex; enable adds login and the history import');
+        }
+        else {
+            if (codexTomlMerge.result === 'wrote') {
+                deps.writeText(deps.codexConfigPath, codexTomlMerge.text);
+            }
+            const mergedHooks = mergeCodexHooks(codexHooksFile, indexPath);
+            deps.writeJsonFile(deps.codexHooksPath, mergedHooks);
+            codexHooksWrittenThisRun = true;
+            const marketplaceMerge = mergeMarketplaceEntry(codexMarketplaceFile);
+            if (marketplaceMerge.result === 'wrote') {
+                deps.writeJsonFile(deps.marketplacePath, marketplaceMerge.data);
+            }
+        }
+    }
+    pruneHookCopies(deps.configDir, deps.version);
     console.log('');
-    console.log(`Capture enabled -- wrote ${configPath} and merged hooks into ${deps.settingsPath}.`);
-    console.log('Start a new Claude Code session to pick up the hooks.');
+    const wrote = [configPath];
+    if (claudeDirExists)
+        wrote.push(deps.settingsPath);
+    if (codexConfigExists && !codexPluginPresentHere) {
+        if (codexTomlMerge.result === 'wrote')
+            wrote.push(deps.codexConfigPath);
+        wrote.push(deps.codexHooksPath);
+    }
+    console.log(`Capture enabled -- wrote ${wrote.join(', ')}.`);
+    if (claudeDirExists)
+        console.log('Start a new Claude Code session to pick up the hooks.');
+    if (deps.bootstrap.enabled) {
+        const { windowDays } = deps.bootstrap;
+        const stateDir = join(deps.configDir, 'state');
+        // task 11 (spec 012 §8): scanAll(null, ...) / scanAll(..., null) means
+        // "this harness is not on this machine" -- the same evidence
+        // (claudeDirExists / codexConfigExists) already used above to decide
+        // whether to touch each harness's own config at all.
+        const scan = scanAll(claudeDirExists ? deps.claudeDir : null, codexConfigExists ? dirname(deps.codexConfigPath) : null, stateDir, {
+            nowMs: Date.now(),
+            sinceMs: windowDays === null ? 0 : Date.now() - windowDays * 86_400_000,
+            liveWindowMs: LIVE_WINDOW_MS,
+            all: windowDays === null,
+        });
+        console.log('');
+        // renderBootstrapList already returns the one "nothing found" sentence
+        // for an empty scan (A12) -- reusing it here, rather than a second copy
+        // of that literal string, is what keeps the two from drifting apart.
+        // The question itself is skipped on exactly the same condition: a
+        // person with nothing to import should not be asked whether to skip it.
+        console.log(renderBootstrapList(scan, windowDays));
+        if (scan.projects.length > 0 || scan.userClaudeMd !== null) {
+            const selection = await askBootstrapSelection(scan.projects.length, deps.prompt);
+            const result = await runBootstrap(scan, selection, {
+                url,
+                key,
+                fetchImpl: deps.fetchImpl,
+                stateDir,
+                all: windowDays === null,
+            });
+            let line = `${result.memoryFiles} memory files queued, ${result.sessions} sessions queued in ${result.pieces} pieces`;
+            if (result.failed > 0)
+                line += `, ${result.failed} failed`;
+            console.log(line);
+        }
+    }
+    if (codexHooksWrittenThisRun) {
+        console.log('');
+        console.log("Codex runs new hooks only after you trust them: open /hooks in Codex and trust Waku's three entries.");
+    }
     return 'enabled';
 }
-// Removes exactly what enable() added and nothing else. Deliberately leaves
-// config.json in place: the key is the user's to revoke on the keys page,
-// not this tool's to delete -- disabling capture and revoking the
-// credential are two different decisions, and conflating them would make
-// "disable" destructive in a way its name does not promise.
+// disable() takes no --url flag (never has -- see disable()'s own comment),
+// so there is nothing on argv to derive the Codex MCP url from the way
+// dispatch() derives it for enable(). The one record of what enable()
+// actually used is config.json's own `url` field: whatever ingest base a
+// person passed to "capture enable --url ..." (or the default, if they
+// passed none) is exactly what got written there, and urlPair() rebuilds
+// the matching mcpUrl from it the same way dispatch() built it forwards
+// (fix round 2, re-review finding #2, controller ruling R9). Falling back to
+// deps.mcpUrl (the default) only when config.json is missing, unreadable, or
+// carries no usable url string -- a machine where the credential file was
+// hand-deleted, or never existed because enable() itself failed partway --
+// is a *best-effort* guess, not a promise: it can only be right when the
+// machine was enabled with the default url in the first place, but it is no
+// worse than fix round 1's own always-use-deps.mcpUrl behavior for that one
+// case, and strictly better for every other one.
+function resolveDisableMcpUrl(configDir, fallback) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(configDir, CONFIG_FILE_NAME), 'utf8'));
+        if (parsed !== null && typeof parsed === 'object') {
+            const storedUrl = parsed.url;
+            if (typeof storedUrl === 'string' && storedUrl.length > 0)
+                return urlPair(storedUrl).mcpUrl;
+        }
+    }
+    catch {
+        // Missing, unreadable, or not valid JSON -- fall back below.
+    }
+    return fallback;
+}
+// Removes exactly what enable() added and nothing else, from both harnesses
+// (ruling R6, task 10): Claude Code's hook entries when claudeDir exists
+// (unchanged from before this task), Codex's hooks.json entries and its
+// [mcp_servers.waku] TOML table when codexConfigPath exists. Deliberately
+// leaves config.json and the marketplace entry in place in every case: the
+// key is the user's to revoke on the keys page, not this tool's to delete --
+// disabling capture and revoking the credential are two different
+// decisions, and conflating them would make "disable" destructive in a way
+// its name does not promise; the marketplace entry only makes the plugin
+// *available*, the same reasoning applied one level further out.
 export async function disable(deps) {
+    const codexConfigExists = existsSync(deps.codexConfigPath);
     const existingSettings = readClaudeSettings(deps.settingsPath);
     if (existingSettings === undefined) {
         console.error(`${deps.settingsPath}'s content is not something this tool can safely modify -- leaving it untouched.`);
         return 'refused';
     }
-    const removed = removeHookSettings(existingSettings);
-    if (isDeepStrictEqual(removed, existingSettings)) {
+    let codexHooksFile = {};
+    if (codexConfigExists) {
+        const read = readCodexHooksFile(deps.codexHooksPath);
+        if (read === undefined) {
+            console.error(`${deps.codexHooksPath}'s content is not something this tool can safely modify -- leaving it untouched.`);
+            return 'refused';
+        }
+        codexHooksFile = read;
+    }
+    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
+    let changed = false;
+    const removedSettings = removeHookSettings(existingSettings);
+    if (!isDeepStrictEqual(removedSettings, existingSettings)) {
+        deps.writeSettingsJson(deps.settingsPath, removedSettings);
+        console.log(`Capture disabled -- removed the hook entries from ${deps.settingsPath}.`);
+        changed = true;
+    }
+    if (codexConfigExists) {
+        const removedHooks = removeCodexHooks(codexHooksFile);
+        const hooksChanged = !isDeepStrictEqual(removedHooks, codexHooksFile);
+        if (hooksChanged) {
+            deps.writeJsonFile(deps.codexHooksPath, removedHooks);
+        }
+        // removeCodexToml only removes the table when its url is ours --
+        // resolveDisableMcpUrl (fix round 2, spec 012 §4.2, re-review finding #2),
+        // not deps.mcpUrl directly: disable() has no --url flag, so deps.mcpUrl
+        // is always whatever default dispatch() filled in, regardless of what
+        // "capture enable --url ..." actually used on this machine. config.json
+        // is the record of that real value; see resolveDisableMcpUrl's own
+        // comment for the fallback this takes when that record is gone.
+        const tomlText = readFileSync(deps.codexConfigPath, 'utf8');
+        const mcpUrlForToml = resolveDisableMcpUrl(deps.configDir, deps.mcpUrl);
+        const removedToml = removeCodexToml(tomlText, mcpUrlForToml);
+        const tomlChanged = removedToml.result === 'removed';
+        if (tomlChanged) {
+            deps.writeText(deps.codexConfigPath, removedToml.text);
+        }
+        // One honest sentence per file actually touched (fix round 2, re-review
+        // finding #2): the old single message here always said "removed the
+        // Codex hook entries" whenever *either* file changed, which claimed the
+        // TOML table was gone even on the runs where only hooks.json changed and
+        // removeCodexToml's own url comparison left the table exactly where it
+        // was -- silently, since success was reported either way.
+        if (hooksChanged) {
+            console.log(`Capture disabled -- removed the Codex hook entries from ${deps.codexHooksPath}.`);
+            changed = true;
+        }
+        if (tomlChanged) {
+            console.log(`Capture disabled -- removed the Codex MCP server entry from ${deps.codexConfigPath}.`);
+            changed = true;
+        }
+    }
+    if (!changed) {
         console.log('Capture was not enabled here -- nothing to remove.');
         return 'nothing-to-disable';
     }
-    deps.writeSettingsJson(deps.settingsPath, removed);
-    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
-    console.log(`Capture disabled -- removed the hook entries from ${deps.settingsPath}.`);
-    console.log(`Your API key is still saved at ${configPath}. Revoke it at ${KEYS_PAGE_URL} if you want to ` +
-        `fully remove access.`);
+    console.log(stillSavedMessage(configPath));
     return 'disabled';
 }
+// Ruling R5 (task 10, spec 012 §4.6): one line per detected harness -- its
+// directory or config file exists -- naming whether our hooks are actually
+// installed there, as opposed to merely detected (setup()'s own "found but
+// nothing to change" language, harnesses.ts's getHarnesses()), then exactly
+// one line for the key. Reads files only, through the same helpers
+// enable()/disable() use to decide what is theirs; never writes, and never
+// prints the key itself, only whether one is stored.
+export async function status(deps) {
+    if (existsSync(deps.claudeDir)) {
+        const settings = readClaudeSettings(deps.settingsPath);
+        const installed = settings !== undefined && hasOwnHooks(settings);
+        console.log(installed ? `Claude Code: hooks installed (${deps.settingsPath})` : 'Claude Code: not configured');
+    }
+    if (existsSync(deps.codexConfigPath)) {
+        const tomlText = readFileSync(deps.codexConfigPath, 'utf8');
+        if (codexPluginPresent(tomlText, deps.codexPluginsCacheDir)) {
+            console.log('Codex: plugin route');
+        }
+        else {
+            const hooksFile = readCodexHooksFile(deps.codexHooksPath);
+            const installed = hooksFile !== undefined && hasOwnCodexHooks(hooksFile);
+            console.log(installed ? `Codex: hooks installed (${deps.codexHooksPath})` : 'Codex: not configured');
+        }
+    }
+    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
+    let keyStored = false;
+    try {
+        const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
+        keyStored =
+            parsed !== null &&
+                typeof parsed === 'object' &&
+                typeof parsed.key === 'string' &&
+                parsed.key.length > 0;
+    }
+    catch {
+        keyStored = false;
+    }
+    console.log(keyStored ? 'Key: stored' : 'Key: none');
+}