waku-memory 0.2.0 → 0.3.0

package/dist/capture.js

@@ -23,8 +23,51 @@
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
-import { LIVE_WINDOW_MS, parseBootstrapAnswer, renderBootstrapList, runBootstrap, scanClaudeCode, } from "./bootstrap.js";
+import { LIVE_WINDOW_MS, parseBootstrapAnswer, renderBootstrapList, runBootstrap, scanAll, } from "./bootstrap.js";
 import { CONFIG_FILE_NAME, SESSION_END_HOOK_TIMEOUT_S } from "./hook.js";
+// Task 9's Codex writers (spec 012 §4.2, §4.3, §4.6), consumed here rather
+// than re-implemented: codex-config.ts already decided *what* the TOML
+// table, the hooks.json entries and the marketplace entry should look like,
+// as pure functions over strings and objects -- enable()/disable()/status()
+// below only decide *when* to call them and what to do with a real
+// filesystem. codex-config.ts's own import from this file (HookCommandEntry,
+// HookGroup) is `import type`, erased at compile time, so this is not a
+// runtime import cycle: loading capture.ts still only ever requires
+// node:fs/node:path/node:util, harnesses.ts (via codex-config.ts) and
+// bootstrap.ts, the same dependency shape the file header above describes.
+import { codexPluginPresent, isOwnCodexEntry, mergeCodexHooks, mergeCodexToml, mergeMarketplaceEntry, removeCodexHooks, removeCodexToml, } from "./codex-config.js";
+// CONFIG_FILE_NAME and SESSION_END_HOOK_TIMEOUT_S are imported from hook.ts
+// above rather than re-declared: two copies of a name the hook reads and
+// this command writes would drift the first time one moved. The dependency
+// runs one way only -- hook.ts (the piece that runs unattended on every
+// turn) imports nothing from this file (the piece a human runs once).
+// Fix round 2 (re-review finding #1, controller ruling R9, spec 012 §4.2):
+// the single source of truth for "given one URL a person typed, what is the
+// ingest base and what is the MCP endpoint". Round 1 got this only half
+// right -- it derived ingestUrl from mcpUrl by stripping a trailing "/mcp",
+// but cli.ts's usage text documents "--url <ingest-base>" (an *ingest*-shaped
+// value), and dispatch() never computed a "/mcp"-suffixed mcpUrl from that
+// shape at all: an ingest-shaped --url with no "/mcp" to strip left
+// mcpUrl === ingestUrl, reproducing the exact defect (the ingest base
+// reaching the Codex TOML) for anyone who follows the tool's own documented
+// flag contract instead of guessing the MCP-shaped alternative.
+//
+// This function inverts the direction: always derive the *ingest* base first
+// (strip trailing slashes, then one trailing "/mcp" if present), then always
+// build mcpUrl by appending "/mcp" to that -- so every shape a person could
+// reasonably type ("https://x.test", "https://x.test/", "https://x.test/mcp")
+// converges on the same correct pair, rather than only working when the
+// input happens to already be MCP-shaped. Exported so both dispatch()
+// (cli.ts, computing the pair from --url) and disable() below (recovering
+// the pair enable() used, from what it stored in config.json) share the one
+// rule -- capture.ts is the natural home since cli.ts already imports from
+// it and the reverse would be a cycle.
+export function urlPair(given) {
+    let ingestUrl = given.replace(/\/+$/, '');
+    if (ingestUrl.endsWith('/mcp'))
+        ingestUrl = ingestUrl.slice(0, -'/mcp'.length).replace(/\/+$/, '');
+    return { ingestUrl, mcpUrl: `${ingestUrl}/mcp` };
+}
 // `Stop` is where captured content is actually sent -- "async": true so it
 // runs in the background without blocking the turn (600s default budget,
 // research doc §2). `SessionStart` is synchronous instead, with a 5s
@@ -86,6 +129,13 @@ export function isOwnEntry(entry) {
 function isOwnGroup(group) {
     return group.hooks.length > 0 && group.hooks.every(isOwnEntry);
 }
+// Ours if any group under any event is entirely ours -- status() (below)
+// needs exactly this yes/no, not the merge/remove machinery.
+function hasOwnHooks(settings) {
+    if (!settings.hooks)
+        return false;
+    return Object.values(settings.hooks).some((groups) => groups.some(isOwnGroup));
+}
 // Replaces any group of ours on each event -- an older version's entry, in
 // either form -- with one built from `run`, and keeps every foreign group
 // untouched. Idempotent: merging the same invocation twice yields the same
@@ -188,17 +238,27 @@ export function hookInvocation(execPath, indexPath) {
 // commands it runs stay local *unless the agent's own reply quotes them
 // back* (the one path by which their content can still leave, so the
 // carve-out has to say so rather than imply a cleaner boundary than the
-// hook actually draws); reasoning is never sent, full stop. The last
+// hook actually draws); reasoning is never sent, full stop. The next
 // sentence previews enable()'s own third question (task 13, spec 011 §8):
 // "the next question" is literal, not rhetorical -- renderBootstrapList
 // (bootstrap.ts) is the list it points at, printed immediately after this
 // disclosure and the "y" it gates, before that question is ever asked.
+//
+// The sixth sentence, appended by task 14 (spec 012 §9): everything above
+// was written back when this shim only ran under Claude Code, and reads as
+// a Claude-Code-only account of what "captured content" even is on a
+// machine where `capture enable` now also wires up Codex (task 10, spec 012
+// §4.6). Named rather than implied, because a person enabling capture on a
+// Codex-only machine has no other way to learn that the same three hooks
+// exist there too, or that installing the Waku plugin instead is the other
+// route to the same events (codexPluginPresent, this file's own enable()).
 export const DISCLOSURE = 'Captured content is sent to our servers and to Anthropic for extraction. ' +
     'This is an alpha whose data can be lost. ' +
     'What you type, what the agent replies, and the names of the tools it uses are sent; ' +
     'the files it reads and the commands it runs are not, except where the agent quotes them in its reply, ' +
     'and its reasoning is never sent. ' +
-    'Enabling can also import the memory and history Claude Code already keeps here; the next question lists exactly what.';
+    'Enabling can also import the memory and history Claude Code already keeps here; the next question lists exactly what. ' +
+    'On Codex the same three hooks read ~/.codex/sessions, or the Waku plugin sends each turn as you go.';
 // Exported so cli.ts's usage text can point at the same URL without a
 // second copy of it drifting out of sync.
 //
@@ -210,6 +270,15 @@ export const DISCLOSURE = 'Captured content is sent to our servers and to Anthro
 // free to move now. tech.md calls the Vercel host an earlier one, kept and
 // not retired; this is the product's own address.
 export const KEYS_PAGE_URL = 'https://www.waku.one/account/keys';
+// Shared by disable() and, since task 13, enable()'s own verify-fail
+// refusal (controller ruling R14): both places are telling the user the
+// exact same true thing -- a real credential is on disk even though this
+// command did not finish -- so this is the one string, not two copies of it
+// drifting apart the way the Codex refusal messages already warn against
+// (see codexTomlRefusalMessage above).
+function stillSavedMessage(configPath) {
+    return `Your API key is still saved at ${configPath}. Revoke it at ${KEYS_PAGE_URL} if you want to fully remove access.`;
+}
 // Reads settings.json the same way applyToHarness (cli.ts) reads a harness
 // config: missing or blank is a blank slate (undefined here would wrongly
 // refuse the single most common first run -- no settings.json yet at all);
@@ -237,6 +306,85 @@ function readClaudeSettings(settingsPath) {
         return undefined;
     }
 }
+// Reads ~/.codex/hooks.json the same way readClaudeSettings above reads
+// settings.json: missing or blank is a blank slate (a fresh machine, or one
+// where Codex itself has no hooks.json yet); anything non-blank that fails
+// to parse, or does not parse to a plain object, is real corruption and
+// returns undefined so enable() refuses rather than risks merging into --
+// and overwriting -- a file it could not understand.
+function readCodexHooksFile(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return {};
+    }
+    if (raw.trim() === '')
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Reads ~/.agents/plugins/marketplace.json. Missing or blank is `undefined`
+// -- not `{}` -- because mergeMarketplaceEntry(undefined) is what builds the
+// fresh personal marketplace (name, interface, our one plugin); passing `{}`
+// instead would be merged into as if it were an existing, but nameless,
+// file. Real corruption is its own 'invalid' outcome, distinct from
+// undefined, so enable() can refuse on it without also refusing the far
+// more common "nothing here yet" case.
+function readMarketplaceFile(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    if (raw.trim() === '')
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return 'invalid';
+        return parsed;
+    }
+    catch {
+        return 'invalid';
+    }
+}
+// Ours if any group under any event is entirely ours -- mirrors isOwnGroup
+// above, but over CodexHooksFile/isOwnCodexEntry: status() (below) needs to
+// answer "did we write this file" without codex-config.ts having to export
+// its own private isOwnCodexGroup.
+function hasOwnCodexHooks(file) {
+    if (!file.hooks)
+        return false;
+    return Object.values(file.hooks).some((groups) => groups.some((g) => g.hooks.length > 0 && g.hooks.every(isOwnCodexEntry)));
+}
+// The one place that writes config.json -- enable() below (a pasted key)
+// and, since task 12, login.ts (a minted one) both funnel through here so
+// the file's shape and its permissions never drift between the two paths.
+// {mode: 0o600} is a request, not a guarantee: Windows has no POSIX
+// owner-only bit for writeFileSync to set, so this line is best-effort
+// there and fully effective on Unix. Correct to pass on every platform
+// regardless -- harmless where it cannot apply, the right thing where it
+// can. Not routed through atomicWriteJson: that writer has no mode
+// parameter, and this file is small, freshly created, and not something
+// Claude Code itself reads concurrently the way settings.json is -- the
+// atomic temp-file-plus-rename technique earns its complexity there, not
+// here.
+export function writeConfigJson(configDir, config) {
+    mkdirSync(configDir, { recursive: true }); // first run: ~/.waku-memory may not exist yet
+    const configPath = join(configDir, CONFIG_FILE_NAME);
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+}
 // Only printable ASCII can be part of a bearer key. Non-printable
 // characters at either *end* came from the terminal, not the person: on
 // 2026-09-04 a Windows console delivered Ctrl+V's own control code (0x16)
@@ -276,36 +424,174 @@ const KEY_ATTEMPTS = 3;
 // refused: the server's opinion is the only one that counts, and a refusal
 // here would make a future prefix change strand every user on this shim.
 const KEY_PREFIX = 'mem_sk_';
+// The sanitizeKey checks and their messages, factored out of askForKey so
+// resolveCredential's `--key` path (fix round 1, finding 3) can apply the
+// exact same rules to a key that arrived on the command line instead of
+// through a prompt: a flag is not "typed", but it crosses a shell boundary
+// the same way a paste crosses a terminal one, and it is exactly as capable
+// of carrying a leading Ctrl+V byte or a "Bearer " prefix pasted by
+// mistake -- a flag used to skip these checks entirely (finding 3's bug).
+// `printEmptyHint` exists only to match askForKey's own choice to suppress
+// the "paste it again" hint on its last attempt (no more attempts are
+// coming); every one-shot caller (the `--key` path) passes false for the
+// same reason -- there is no re-ask to hint toward. No branch below ever
+// prints the key or any part of it -- counts and a prefix only.
+function checkPastedKey(raw, printEmptyHint) {
+    const { key, removed, interior } = sanitizeKey(raw);
+    if (interior > 0) {
+        console.log(`The pasted text has ${interior} character(s) inside it that cannot be part of a key -- ` +
+            `more than the key was pasted. Paste the key itself, nothing else.`);
+        return null;
+    }
+    if (key === '') {
+        if (printEmptyHint) {
+            console.log('That did not contain a usable key -- paste the key itself, nothing else.');
+        }
+        return null;
+    }
+    if (removed > 0) {
+        console.log(`Removed ${removed} non-printable character(s) from the ends of the pasted key -- ` +
+            `a terminal can add Ctrl+V's own code ahead of what it pastes.`);
+    }
+    if (!key.startsWith(KEY_PREFIX)) {
+        console.log(`Note: the key does not start with ${KEY_PREFIX}, which every key minted at ${KEYS_PAGE_URL} does. ` +
+            `Saving it as pasted; if the hook reports 401, run this command again with a fresh key.`);
+    }
+    return key;
+}
 // Asks up to KEY_ATTEMPTS times. null means the person never pasted anything
 // usable, and enable() then ends with the same "nothing was written"
-// guarantee that declining the disclosure carries. No branch below ever
-// prints the key or any part of it -- counts and a prefix only.
+// guarantee that declining the disclosure carries.
 async function askForKey(deps) {
     for (let attempt = 1; attempt <= KEY_ATTEMPTS; attempt++) {
         const raw = await deps.prompt(`Paste an API key from ${KEYS_PAGE_URL} (it is shown once, at mint time): `);
-        const { key, removed, interior } = sanitizeKey(raw);
-        if (interior > 0) {
-            console.log(`The pasted text has ${interior} character(s) inside it that cannot be part of a key -- ` +
-                `more than the key was pasted. Paste the key itself, nothing else.`);
-            continue;
+        const key = checkPastedKey(raw, attempt < KEY_ATTEMPTS);
+        if (key !== null)
+            return key;
+    }
+    return null;
+}
+// The Sign-in choice (spec 012 §7, controller ruling R13): the first thing
+// enable() asks once the disclosure gate is past, whenever `credential` is
+// { kind: 'ask' } and config.json holds no usable key yet (readStoredKey
+// below). Verbatim -- capture.test.mjs and cli.test.mjs's usage text both
+// depend on this exact string, so a wording change here is a break of that
+// contract, not a cosmetic edit.
+export const SIGN_IN_QUESTION = 'Sign in [1] in the browser (recommended) [2] by pasting a key: ';
+// Same "stop pestering the person" budget askForKey's own KEY_ATTEMPTS
+// gives a pasted key -- an answer that is neither "1" nor "2" three times
+// running is treated the same as declining outright.
+const SIGN_IN_ATTEMPTS = 3;
+// Reads just the `key` field out of config.json, the way hook.ts's own
+// readConfig reads {url, key} for the hook's real network calls: a
+// non-empty string or nothing usable at all (missing file, malformed JSON,
+// a `key` that is absent, empty, or not a string) -- R13's "already holds a
+// usable key" test, and runLogin's own read-back of what deps.login() just
+// wrote. Never prints what it finds.
+function readStoredKey(configDir) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(configDir, CONFIG_FILE_NAME), 'utf8'));
+        if (parsed !== null && typeof parsed === 'object') {
+            const key = parsed.key;
+            if (typeof key === 'string' && key.length > 0)
+                return key;
         }
-        if (key === '') {
-            if (attempt < KEY_ATTEMPTS) {
-                console.log('That did not contain a usable key -- paste the key itself, nothing else.');
-            }
-            continue;
+    }
+    catch {
+        // Missing, unreadable, or not valid JSON -- no stored key.
+    }
+    return null;
+}
+// deps.login() is login.ts's login(): it already wrote config.json itself
+// by the time it returns 'signed-in' (writeConfigJson, sanitizeKey -- both
+// this file's own), so the key is read back here rather than threaded
+// across the deps boundary a second way. A non-'signed-in' result
+// ('timeout' or 'refused') means login() never reached that write --
+// nothing is on disk, and the one sentence R14 gives verbatim is accurate.
+// A 'signed-in' result whose key cannot be read back -- config.json is
+// missing, unreadable, malformed, or its `key` field is empty or not a
+// string; see readStoredKey -- is a refusal, not a silent empty-key
+// continue: fix round 1 finding 2 found the old code here (`key: key ??
+// ''`) letting enable() sail on through installHookCopy/verifyHook/
+// writeSettingsJson with no working credential on disk and nothing printed.
+async function runLogin(deps) {
+    const result = await deps.login();
+    if (result !== 'signed-in') {
+        console.log('Capture not enabled -- sign-in did not complete; nothing was written.');
+        return 'declined';
+    }
+    const key = readStoredKey(deps.configDir);
+    if (key === null) {
+        const configPath = join(deps.configDir, CONFIG_FILE_NAME);
+        console.error(`Signed in, but the key could not be read back from ${configPath} -- nothing else was written.`);
+        return 'refused';
+    }
+    return { key, skipWriteConfig: true };
+}
+// The credential decision itself (controller rulings R13/R14). `credential`
+// is enable()'s own third parameter, not a CaptureDeps field -- see
+// Credential's own comment for why -- and is `undefined` only for the
+// legacy call shape every enable() call predating task 13 used (a bare
+// `enable(url, deps)`, still exactly what every test written before this
+// task passes): that path is untouched, byte for byte, from what askForKey
+// alone did before this function existed, which is what keeps those tests
+// green without editing a single one of them.
+//   - undefined: ask for a pasted key directly (askForKey, unchanged).
+//   - { kind: 'key' }: nothing is asked, but the value still goes through
+//     checkPastedKey (fix round 1, finding 3) -- a flag is not typed, but it
+//     is exactly as capable of carrying a stray leading byte or an empty
+//     string as a paste is, and it used to skip validation entirely.
+//   - { kind: 'login' }: deps.login() runs immediately -- nothing is asked.
+//   - { kind: 'ask' }: a stored, usable key short-circuits everything with
+//     one line and no question (R13); otherwise the Sign-in choice is
+//     asked, up to SIGN_IN_ATTEMPTS times, and "1"/"2" branch into
+//     login()/askForKey() respectively. A third invalid answer declines,
+//     the same shape askForKey's own attempts loop already has.
+async function resolveCredential(deps, credential) {
+    if (credential === undefined) {
+        const key = await askForKey(deps);
+        if (key === null) {
+            console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+            return 'declined';
         }
-        if (removed > 0) {
-            console.log(`Removed ${removed} non-printable character(s) from the ends of the pasted key -- ` +
-                `a terminal can add Ctrl+V's own code ahead of what it pastes.`);
+        return { key, skipWriteConfig: false };
+    }
+    if (credential.kind === 'key') {
+        // No re-ask: a flag is not interactive, so a bad --key declines
+        // outright (printEmptyHint: false) instead of prompting for another one.
+        const key = checkPastedKey(credential.key, false);
+        if (key === null) {
+            console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+            return 'declined';
         }
-        if (!key.startsWith(KEY_PREFIX)) {
-            console.log(`Note: the key does not start with ${KEY_PREFIX}, which every key minted at ${KEYS_PAGE_URL} does. ` +
-                `Saving it as pasted; if the hook reports 401, run this command again with a fresh key.`);
+        return { key, skipWriteConfig: false };
+    }
+    if (credential.kind === 'login') {
+        return runLogin(deps);
+    }
+    // credential.kind === 'ask'
+    const stored = readStoredKey(deps.configDir);
+    if (stored !== null) {
+        console.log(`Using the key already stored in ${deps.configDir}/${CONFIG_FILE_NAME}.`);
+        return { key: stored, skipWriteConfig: false };
+    }
+    for (let attempt = 1; attempt <= SIGN_IN_ATTEMPTS; attempt++) {
+        const answer = (await deps.prompt(SIGN_IN_QUESTION)).trim();
+        if (answer === '1')
+            return runLogin(deps);
+        if (answer === '2') {
+            const key = await askForKey(deps);
+            if (key === null) {
+                console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+                return 'declined';
+            }
+            return { key, skipWriteConfig: false };
         }
-        return key;
+        if (attempt < SIGN_IN_ATTEMPTS)
+            console.log('Enter 1 or 2.');
     }
-    return null;
+    console.log('Capture not enabled -- no valid answer was given; nothing was written.');
+    return 'declined';
 }
 // A parsed BootstrapAnswer still carries `invalid`; runBootstrap's own
 // BootstrapSelection does not (its three real outcomes are `all`, `skip` and
@@ -333,20 +619,48 @@ async function askBootstrapSelection(projectCount, prompt) {
     }
     return toSelection(answer);
 }
+// The Codex TOML refusal, worded the same way harnesses.ts's mergeMcpConfig
+// refuses a conflicting Claude Code entry (its own comment there: "someone
+// configured this by hand ... silently replacing it would undo a deliberate
+// choice with no trace"). mergeCodexToml's 'refused' result does not carry
+// the conflicting url back (only the unchanged text), so this cannot name it
+// the way mergeMcpConfig's thrown message does -- naming the table and the
+// file it lives in is the closest equivalent.
+function codexTomlRefusalMessage(codexConfigPath) {
+    return (`[mcp_servers.waku] in ${codexConfigPath} is already configured with a different URL. ` +
+        `Remove it or edit the file by hand.`);
+}
 // The one gesture that turns capture on. Order is deliberate and each step
 // depends on the one before it having succeeded:
-//   1. refuse if Claude Code itself is not on this machine -- the directory
-//      is the evidence, the shim's own edit-don't-create rule adapted from
-//      cli.ts's harness handling;
-//   2. refuse if the existing settings.json cannot be safely read -- checked
-//      here, before the disclosure, so a machine this can never work on
-//      fails fast instead of making the user type through a consent flow
-//      first only to hit a wall at the end;
-//   3. print the disclosure and demand a typed "y" -- before anything else,
+//   1. refuse if neither harness is on this machine -- Claude Code's
+//      directory or Codex's config.toml is the evidence, the shim's own
+//      edit-don't-create rule adapted from cli.ts's harness handling. Widened
+//      from "Claude Code only" (spec 012 §4/§4.6, task 10): a Codex-only
+//      machine is now a real target, not a refusal.
+//   2. when claudeDir exists, refuse if the existing settings.json cannot be
+//      safely read -- checked here, before the disclosure, so a machine this
+//      can never work on fails fast instead of making the user type through
+//      a consent flow first only to hit a wall at the end. Skipped
+//      altogether on a Codex-only machine: there is no settings.json to
+//      protect.
+//   3. when codexConfigPath exists, detect the plugin (codexPluginPresent).
+//      If it is not there, compute the TOML merge (mergeCodexToml) and read
+//      hooks.json and marketplace.json -- all before the disclosure, for the
+//      same reason as step 2: a refusal (a foreign [mcp_servers.waku] table,
+//      or either file unreadable) must cost the user nothing and write
+//      nothing, exactly like a Claude Code refusal. If the plugin *is*
+//      there, none of this runs: it already carries the hooks and the MCP
+//      server, so writing our own beside it would be redundant at best and a
+//      second, conflicting route to the same events at worst -- the plugin
+//      wins, and step 8 below prints that instead of touching either file;
+//   4. print the disclosure and demand a typed "y" -- before anything else,
 //      including asking for the key, so declining costs the user nothing
 //      and asks for nothing;
-//   4. only then ask for the key;
-//   5. install a local copy of the shim under configDir/hook/<version> and
+//   5. only then resolve the credential -- the Sign-in question, deps.login(),
+//      askForKey, or the already-known --key value, decided by `credential`
+//      (task 13, spec 012 §7, resolveCredential's own comment has the full
+//      decision table);
+//   6. install a local copy of the shim under configDir/hook/<version> and
 //      run it for real -- verifyHook -- before anything is wired into
 //      settings.json. A copy that does not even start (a corrupted copy, a
 //      Node too old for it, ...) must never become the thing Claude Code
@@ -367,52 +681,111 @@ async function askBootstrapSelection(projectCount, prompt) {
 //      first-ever run can still leave behind after refusing here is an
 //      empty configDir -- not removed, since it is the config directory
 //      itself, not anything this step wrote into it;
-//   6. write config.json, then merge and write settings.json with the
-//      now-verified invocation. Everything before this point (refusing,
-//      declining, a failed verification) writes nothing new to disk -- step
-//      5's own cleanup is what makes that true when a failed verification
-//      follows a real copy, down to the empty-configDir exception described
-//      there; when installHookCopy was instead a no-op, this call had
-//      nothing of its own to remove, and the pre-existing copy it leaves in
-//      place was never new. This step
-//      itself is not atomic across the two files, though: config.json is
-//      committed to disk first, so a
-//      failure on the settings.json write right after -- disk full, a
-//      permission error -- does leave a real credential saved with no
-//      hook actually installed, i.e. capture silently not active despite
-//      config.json existing. Accepted rather than guarded against (no
-//      rollback, no pre-write dry run): the failure still propagates out
-//      of enable() to cli.ts's runCaptureCommand, which reports it and
-//      sets a nonzero exit code, so it is not silent; it fails toward
-//      "capture not enabled" rather than a consent bypass; and re-running
-//      `enable` repairs it, since writing config.json again is a plain
-//      overwrite (capture.test.mjs's "running twice" test);
-//   7. prune every other hook/<version> copy now that settings.json points
-//      only at this one (pruneHookCopies) -- best-effort, never fatal, and
-//      only after the settings write so a prune failure can never leave
-//      settings.json pointing at a copy this step just deleted.
-//   8. when deps.bootstrap.enabled (task 13, spec 011 §8): scan the machine
-//      for Claude Code's own memory files and transcripts (scanClaudeCode)
-//      and, only if that scan found something, print the one numbered list
-//      and ask the third and last question. This runs after the hooks are
-//      wired in and verified, deliberately: bootstrap is additional value
-//      once capture itself is real, not a precondition for it, and its own
-//      failure (a bad answer, a network error inside runBootstrap) must
-//      never undo a successful enable -- so nothing below this point can
-//      turn 'enabled' into anything else. An empty scan (nothing found, no
-//      user CLAUDE.md) says so and asks nothing at all: the person who has
-//      nothing to import should not be asked whether to skip importing it.
-export async function enable(url, deps) {
-    if (!existsSync(deps.claudeDir)) {
-        console.error(`Claude Code not found at ${deps.claudeDir} -- install Claude Code first, then run ` +
-            `"npx waku-memory capture enable" again.`);
+//   7. write config.json, then (when claudeDir exists) merge and write
+//      settings.json with the now-verified invocation. Everything before
+//      this point (refusing, declining, a failed verification) writes
+//      nothing new to disk -- step 6's own cleanup is what makes that true
+//      when a failed verification follows a real copy, down to the
+//      empty-configDir exception described there; when installHookCopy was
+//      instead a no-op, this call had nothing of its own to remove, and the
+//      pre-existing copy it leaves in place was never new. This step itself
+//      is not atomic across the two files, though: config.json is committed
+//      to disk first, so a failure on the settings.json write right after --
+//      disk full, a permission error -- does leave a real credential saved
+//      with no hook actually installed, i.e. capture silently not active
+//      despite config.json existing. Accepted rather than guarded against
+//      (no rollback, no pre-write dry run): the failure still propagates out
+//      of enable() to cli.ts's runCaptureCommand, which reports it and sets
+//      a nonzero exit code, so it is not silent; it fails toward "capture
+//      not enabled" rather than a consent bypass; and re-running `enable`
+//      repairs it, since writing config.json again is a plain overwrite
+//      (capture.test.mjs's "running twice" test);
+//   8. when codexConfigPath exists: print the plugin sentence and touch
+//      neither Codex file if the plugin is present; otherwise write the TOML
+//      table (only when step 3's merge actually changed it -- 'unchanged'
+//      writes nothing), merge and write hooks.json unconditionally (the same
+//      idempotent replace-ours-keep-foreign write settings.json always gets),
+//      and write the marketplace file only when mergeMarketplaceEntry says
+//      it changed;
+//   9. prune every other hook/<version> copy now that settings.json (and, on
+//      Codex, hooks.json) point only at this one (pruneHookCopies) --
+//      best-effort, never fatal, and only after both writes so a prune
+//      failure can never leave either file pointing at a copy this step just
+//      deleted.
+//   10. when deps.bootstrap.enabled (task 13, spec 011 §8): scan the machine
+//      for Claude Code's own memory files and transcripts (scanClaudeCode) --
+//      skipped, with an empty scan standing in, when claudeDir does not
+//      exist (task 11 replaces this with a scan over both harnesses; this
+//      task only has to keep a Codex-only machine from crashing on a scan
+//      path that is not there) -- and, only if that scan found something,
+//      print the one numbered list and ask the third and last question. This
+//      runs after the hooks are wired in and verified, deliberately:
+//      bootstrap is additional value once capture itself is real, not a
+//      precondition for it, and its own failure (a bad answer, a network
+//      error inside runBootstrap) must never undo a successful enable -- so
+//      nothing below this point can turn 'enabled' into anything else. An
+//      empty scan (nothing found, no user CLAUDE.md) says so and asks
+//      nothing at all: the person who has nothing to import should not be
+//      asked whether to skip importing it.
+//   11. the trust line, last, only when this run actually wrote Codex's
+//      hooks.json (step 8's non-plugin branch): Codex will not run a hook it
+//      has not seen a person approve, so a run that wired the entries in but
+//      never said so would read as done when one more step remains.
+export async function enable(url, deps, credential) {
+    const claudeDirExists = existsSync(deps.claudeDir);
+    const codexConfigExists = existsSync(deps.codexConfigPath);
+    if (!claudeDirExists && !codexConfigExists) {
+        console.error(`Neither Claude Code (${deps.claudeDir}) nor Codex (${deps.codexConfigPath}) was found on this machine -- ` +
+            `install one of them first, then run "npx waku-memory capture enable" again.`);
         return 'refused';
     }
-    const existingSettings = readClaudeSettings(deps.settingsPath);
-    if (existingSettings === undefined) {
-        console.error(`${deps.settingsPath}'s content is not something this tool can safely merge into -- ` +
-            `leaving it untouched. Nothing was written.`);
-        return 'refused';
+    let existingSettings = {};
+    if (claudeDirExists) {
+        const read = readClaudeSettings(deps.settingsPath);
+        if (read === undefined) {
+            console.error(`${deps.settingsPath}'s content is not something this tool can safely merge into -- ` +
+                `leaving it untouched. Nothing was written.`);
+            return 'refused';
+        }
+        existingSettings = read;
+    }
+    // Step 3: everything Codex needs decided and checked before the
+    // disclosure -- see this function's own comment above for why. Left at
+    // their blank-slate defaults (false / undefined / {}) when codexConfigPath
+    // does not exist or the plugin is already present; step 8 below only reads
+    // codexTomlMerge/codexHooksFile/codexMarketplaceFile inside the branch
+    // where they were actually computed.
+    let codexPluginPresentHere = false;
+    let codexTomlMerge;
+    let codexHooksFile = {};
+    let codexMarketplaceFile;
+    if (codexConfigExists) {
+        const tomlText = readFileSync(deps.codexConfigPath, 'utf8');
+        codexPluginPresentHere = codexPluginPresent(tomlText, deps.codexPluginsCacheDir);
+        if (!codexPluginPresentHere) {
+            // deps.mcpUrl, not `url`: `url` is the ingest base (config.json's own
+            // value in real use), and the TOML's [mcp_servers.waku] table needs
+            // the MCP endpoint instead (spec 012 §4.2) -- see CaptureDeps.mcpUrl.
+            codexTomlMerge = mergeCodexToml(tomlText, deps.mcpUrl);
+            if (codexTomlMerge.result === 'refused') {
+                console.error(codexTomlRefusalMessage(deps.codexConfigPath));
+                return 'refused';
+            }
+            const readHooks = readCodexHooksFile(deps.codexHooksPath);
+            if (readHooks === undefined) {
+                console.error(`${deps.codexHooksPath}'s content is not something this tool can safely merge into -- ` +
+                    `leaving it untouched. Nothing was written.`);
+                return 'refused';
+            }
+            codexHooksFile = readHooks;
+            const readMarketplace = readMarketplaceFile(deps.marketplacePath);
+            if (readMarketplace === 'invalid') {
+                console.error(`${deps.marketplacePath}'s content is not something this tool can safely merge into -- ` +
+                    `leaving it untouched. Nothing was written.`);
+                return 'refused';
+            }
+            codexMarketplaceFile = readMarketplace;
+        }
     }
     console.log(DISCLOSURE);
     console.log('');
@@ -421,11 +794,17 @@ export async function enable(url, deps) {
         console.log('Capture not enabled -- nothing was written.');
         return 'declined';
     }
-    const key = await askForKey(deps);
-    if (key === null) {
-        console.log('Capture not enabled -- no usable key was entered; nothing was written.');
+    const credentialResult = await resolveCredential(deps, credential);
+    if (credentialResult === 'declined')
         return 'declined';
-    }
+    // Fix round 1, finding 2: signed-in but config.json came back unreadable
+    // -- a bug, not "the person declined" -- so this is refused before ever
+    // reaching installHookCopy, exactly like every other pre-flight refusal
+    // above in this function.
+    if (credentialResult === 'refused')
+        return 'refused';
+    const { key, skipWriteConfig } = credentialResult;
+    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
     const indexPath = installHookCopy(deps.hookSourceDir, deps.configDir, deps.version);
     const run = hookInvocation(deps.execPath, indexPath);
     if (!deps.verifyHook(run)) {
@@ -446,32 +825,76 @@ export async function enable(url, deps) {
                 // hookRoot is already gone -- nothing left to prune
             }
         }
-        console.error(`The hook entry did not run (${run.command} ${(run.args ?? []).join(' ')}) -- ` +
-            `nothing was written.`);
+        if (skipWriteConfig) {
+            // Controller ruling R14: the credential came from deps.login(), which
+            // already wrote config.json with a real, minted key before this run
+            // ever reached installHookCopy -- unlike every other credential path,
+            // where config.json is not written until after verifyHook succeeds
+            // (below). "nothing was written" would be false here, so this shares
+            // disable()'s own sentence (stillSavedMessage) instead of a second
+            // copy of it.
+            console.error(`The hook entry did not run (${run.command} ${(run.args ?? []).join(' ')}).`);
+            console.error(stillSavedMessage(configPath));
+        }
+        else {
+            console.error(`The hook entry did not run (${run.command} ${(run.args ?? []).join(' ')}) -- ` +
+                `nothing was written.`);
+        }
         return 'refused';
     }
-    mkdirSync(deps.configDir, { recursive: true }); // first run: ~/.waku-memory may not exist yet
-    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
-    // {mode: 0o600} is a request, not a guarantee: Windows has no POSIX
-    // owner-only bit for writeFileSync to set, so this line is best-effort
-    // there and fully effective on Unix. Correct to pass on every platform
-    // regardless -- harmless where it cannot apply, the right thing where it
-    // can. Not routed through atomicWriteJson: that writer has no mode
-    // parameter, and this file is small, freshly created, and not something
-    // Claude Code itself reads concurrently the way settings.json is -- the
-    // atomic temp-file-plus-rename technique earns its complexity there, not
-    // here.
-    writeFileSync(configPath, JSON.stringify({ url, key }, null, 2) + '\n', { mode: 0o600 });
-    const merged = mergeHookSettings(existingSettings, run);
-    deps.writeSettingsJson(deps.settingsPath, merged);
+    if (!skipWriteConfig)
+        writeConfigJson(deps.configDir, { url, key });
+    if (claudeDirExists) {
+        const merged = mergeHookSettings(existingSettings, run);
+        deps.writeSettingsJson(deps.settingsPath, merged);
+    }
+    // Step 8: the Codex writes -- or, when the plugin already carries them,
+    // exactly one sentence and neither file touched. codexHooksWrittenThisRun
+    // gates the trust line (step 11): true whenever hooks.json was actually
+    // written this run, which -- unlike the TOML table and the marketplace
+    // entry, both conditioned on their own merge having changed anything -- is
+    // every time this branch runs at all (mergeCodexHooks's replace-ours
+    // semantics write the file even when the entries end up identical, the
+    // same way settings.json above always gets written).
+    let codexHooksWrittenThisRun = false;
+    if (codexConfigExists) {
+        if (codexPluginPresentHere) {
+            console.log('The Waku plugin carries the hooks and the MCP server for Codex; enable adds login and the history import');
+        }
+        else {
+            if (codexTomlMerge.result === 'wrote') {
+                deps.writeText(deps.codexConfigPath, codexTomlMerge.text);
+            }
+            const mergedHooks = mergeCodexHooks(codexHooksFile, indexPath);
+            deps.writeJsonFile(deps.codexHooksPath, mergedHooks);
+            codexHooksWrittenThisRun = true;
+            const marketplaceMerge = mergeMarketplaceEntry(codexMarketplaceFile);
+            if (marketplaceMerge.result === 'wrote') {
+                deps.writeJsonFile(deps.marketplacePath, marketplaceMerge.data);
+            }
+        }
+    }
     pruneHookCopies(deps.configDir, deps.version);
     console.log('');
-    console.log(`Capture enabled -- wrote ${configPath} and merged hooks into ${deps.settingsPath}.`);
-    console.log('Start a new Claude Code session to pick up the hooks.');
+    const wrote = [configPath];
+    if (claudeDirExists)
+        wrote.push(deps.settingsPath);
+    if (codexConfigExists && !codexPluginPresentHere) {
+        if (codexTomlMerge.result === 'wrote')
+            wrote.push(deps.codexConfigPath);
+        wrote.push(deps.codexHooksPath);
+    }
+    console.log(`Capture enabled -- wrote ${wrote.join(', ')}.`);
+    if (claudeDirExists)
+        console.log('Start a new Claude Code session to pick up the hooks.');
     if (deps.bootstrap.enabled) {
         const { windowDays } = deps.bootstrap;
         const stateDir = join(deps.configDir, 'state');
-        const scan = scanClaudeCode(deps.claudeDir, stateDir, {
+        // task 11 (spec 012 §8): scanAll(null, ...) / scanAll(..., null) means
+        // "this harness is not on this machine" -- the same evidence
+        // (claudeDirExists / codexConfigExists) already used above to decide
+        // whether to touch each harness's own config at all.
+        const scan = scanAll(claudeDirExists ? deps.claudeDir : null, codexConfigExists ? dirname(deps.codexConfigPath) : null, stateDir, {
             nowMs: Date.now(),
             sinceMs: windowDays === null ? 0 : Date.now() - windowDays * 86_400_000,
             liveWindowMs: LIVE_WINDOW_MS,
@@ -499,28 +922,153 @@ export async function enable(url, deps) {
             console.log(line);
         }
     }
+    if (codexHooksWrittenThisRun) {
+        console.log('');
+        console.log("Codex runs new hooks only after you trust them: open /hooks in Codex and trust Waku's three entries.");
+    }
     return 'enabled';
 }
-// Removes exactly what enable() added and nothing else. Deliberately leaves
-// config.json in place: the key is the user's to revoke on the keys page,
-// not this tool's to delete -- disabling capture and revoking the
-// credential are two different decisions, and conflating them would make
-// "disable" destructive in a way its name does not promise.
+// disable() takes no --url flag (never has -- see disable()'s own comment),
+// so there is nothing on argv to derive the Codex MCP url from the way
+// dispatch() derives it for enable(). The one record of what enable()
+// actually used is config.json's own `url` field: whatever ingest base a
+// person passed to "capture enable --url ..." (or the default, if they
+// passed none) is exactly what got written there, and urlPair() rebuilds
+// the matching mcpUrl from it the same way dispatch() built it forwards
+// (fix round 2, re-review finding #2, controller ruling R9). Falling back to
+// deps.mcpUrl (the default) only when config.json is missing, unreadable, or
+// carries no usable url string -- a machine where the credential file was
+// hand-deleted, or never existed because enable() itself failed partway --
+// is a *best-effort* guess, not a promise: it can only be right when the
+// machine was enabled with the default url in the first place, but it is no
+// worse than fix round 1's own always-use-deps.mcpUrl behavior for that one
+// case, and strictly better for every other one.
+function resolveDisableMcpUrl(configDir, fallback) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(configDir, CONFIG_FILE_NAME), 'utf8'));
+        if (parsed !== null && typeof parsed === 'object') {
+            const storedUrl = parsed.url;
+            if (typeof storedUrl === 'string' && storedUrl.length > 0)
+                return urlPair(storedUrl).mcpUrl;
+        }
+    }
+    catch {
+        // Missing, unreadable, or not valid JSON -- fall back below.
+    }
+    return fallback;
+}
+// Removes exactly what enable() added and nothing else, from both harnesses
+// (ruling R6, task 10): Claude Code's hook entries when claudeDir exists
+// (unchanged from before this task), Codex's hooks.json entries and its
+// [mcp_servers.waku] TOML table when codexConfigPath exists. Deliberately
+// leaves config.json and the marketplace entry in place in every case: the
+// key is the user's to revoke on the keys page, not this tool's to delete --
+// disabling capture and revoking the credential are two different
+// decisions, and conflating them would make "disable" destructive in a way
+// its name does not promise; the marketplace entry only makes the plugin
+// *available*, the same reasoning applied one level further out.
 export async function disable(deps) {
+    const codexConfigExists = existsSync(deps.codexConfigPath);
     const existingSettings = readClaudeSettings(deps.settingsPath);
     if (existingSettings === undefined) {
         console.error(`${deps.settingsPath}'s content is not something this tool can safely modify -- leaving it untouched.`);
         return 'refused';
     }
-    const removed = removeHookSettings(existingSettings);
-    if (isDeepStrictEqual(removed, existingSettings)) {
+    let codexHooksFile = {};
+    if (codexConfigExists) {
+        const read = readCodexHooksFile(deps.codexHooksPath);
+        if (read === undefined) {
+            console.error(`${deps.codexHooksPath}'s content is not something this tool can safely modify -- leaving it untouched.`);
+            return 'refused';
+        }
+        codexHooksFile = read;
+    }
+    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
+    let changed = false;
+    const removedSettings = removeHookSettings(existingSettings);
+    if (!isDeepStrictEqual(removedSettings, existingSettings)) {
+        deps.writeSettingsJson(deps.settingsPath, removedSettings);
+        console.log(`Capture disabled -- removed the hook entries from ${deps.settingsPath}.`);
+        changed = true;
+    }
+    if (codexConfigExists) {
+        const removedHooks = removeCodexHooks(codexHooksFile);
+        const hooksChanged = !isDeepStrictEqual(removedHooks, codexHooksFile);
+        if (hooksChanged) {
+            deps.writeJsonFile(deps.codexHooksPath, removedHooks);
+        }
+        // removeCodexToml only removes the table when its url is ours --
+        // resolveDisableMcpUrl (fix round 2, spec 012 §4.2, re-review finding #2),
+        // not deps.mcpUrl directly: disable() has no --url flag, so deps.mcpUrl
+        // is always whatever default dispatch() filled in, regardless of what
+        // "capture enable --url ..." actually used on this machine. config.json
+        // is the record of that real value; see resolveDisableMcpUrl's own
+        // comment for the fallback this takes when that record is gone.
+        const tomlText = readFileSync(deps.codexConfigPath, 'utf8');
+        const mcpUrlForToml = resolveDisableMcpUrl(deps.configDir, deps.mcpUrl);
+        const removedToml = removeCodexToml(tomlText, mcpUrlForToml);
+        const tomlChanged = removedToml.result === 'removed';
+        if (tomlChanged) {
+            deps.writeText(deps.codexConfigPath, removedToml.text);
+        }
+        // One honest sentence per file actually touched (fix round 2, re-review
+        // finding #2): the old single message here always said "removed the
+        // Codex hook entries" whenever *either* file changed, which claimed the
+        // TOML table was gone even on the runs where only hooks.json changed and
+        // removeCodexToml's own url comparison left the table exactly where it
+        // was -- silently, since success was reported either way.
+        if (hooksChanged) {
+            console.log(`Capture disabled -- removed the Codex hook entries from ${deps.codexHooksPath}.`);
+            changed = true;
+        }
+        if (tomlChanged) {
+            console.log(`Capture disabled -- removed the Codex MCP server entry from ${deps.codexConfigPath}.`);
+            changed = true;
+        }
+    }
+    if (!changed) {
         console.log('Capture was not enabled here -- nothing to remove.');
         return 'nothing-to-disable';
     }
-    deps.writeSettingsJson(deps.settingsPath, removed);
-    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
-    console.log(`Capture disabled -- removed the hook entries from ${deps.settingsPath}.`);
-    console.log(`Your API key is still saved at ${configPath}. Revoke it at ${KEYS_PAGE_URL} if you want to ` +
-        `fully remove access.`);
+    console.log(stillSavedMessage(configPath));
     return 'disabled';
 }
+// Ruling R5 (task 10, spec 012 §4.6): one line per detected harness -- its
+// directory or config file exists -- naming whether our hooks are actually
+// installed there, as opposed to merely detected (setup()'s own "found but
+// nothing to change" language, harnesses.ts's getHarnesses()), then exactly
+// one line for the key. Reads files only, through the same helpers
+// enable()/disable() use to decide what is theirs; never writes, and never
+// prints the key itself, only whether one is stored.
+export async function status(deps) {
+    if (existsSync(deps.claudeDir)) {
+        const settings = readClaudeSettings(deps.settingsPath);
+        const installed = settings !== undefined && hasOwnHooks(settings);
+        console.log(installed ? `Claude Code: hooks installed (${deps.settingsPath})` : 'Claude Code: not configured');
+    }
+    if (existsSync(deps.codexConfigPath)) {
+        const tomlText = readFileSync(deps.codexConfigPath, 'utf8');
+        if (codexPluginPresent(tomlText, deps.codexPluginsCacheDir)) {
+            console.log('Codex: plugin route');
+        }
+        else {
+            const hooksFile = readCodexHooksFile(deps.codexHooksPath);
+            const installed = hooksFile !== undefined && hasOwnCodexHooks(hooksFile);
+            console.log(installed ? `Codex: hooks installed (${deps.codexHooksPath})` : 'Codex: not configured');
+        }
+    }
+    const configPath = join(deps.configDir, CONFIG_FILE_NAME);
+    let keyStored = false;
+    try {
+        const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
+        keyStored =
+            parsed !== null &&
+                typeof parsed === 'object' &&
+                typeof parsed.key === 'string' &&
+                parsed.key.length > 0;
+    }
+    catch {
+        keyStored = false;
+    }
+    console.log(keyStored ? 'Key: stored' : 'Key: none');
+}