Support agent status hooks over SSH (#1865)

Co-authored-by: Orca <help@stably.ai>

src/main/codex/config-toml-trust.ts

@@ -190,16 +190,26 @@ export function upsertHookTrustEntries(
   entries: readonly CodexTrustEntry[]
 ): void {
   const existing = existsSync(configPath) ? readTomlFile(configPath) : ''
-  let updated = existing
-  for (const entry of entries) {
-    updated = upsertTrustBlock(updated, computeTrustKey(entry), computeTrustedHash(entry))
-  }
+  const updated = upsertHookTrustEntriesInContent(existing, entries)
   if (updated === existing) {
     return
   }
   writeConfigAtomically(configPath, updated)
 }
 
+export function upsertHookTrustEntriesInContent(
+  existingContent: string,
+  entries: readonly CodexTrustEntry[]
+): string {
+  const existing =
+    existingContent.charCodeAt(0) === 0xfeff ? existingContent.slice(1) : existingContent
+  let updated = existing
+  for (const entry of entries) {
+    updated = upsertTrustBlock(updated, computeTrustKey(entry), computeTrustedHash(entry))
+  }
+  return updated
+}
+
 // Why: build the canonical block we own. The two field names mirror what
 // Codex itself writes when the user approves via /hooks (HookStateToml
 // fields). `enabled` is plumbed through so an existing user-set

src/main/codex/hook-service.ts

@@ -1,6 +1,7 @@
 /* eslint-disable max-lines -- Why: getStatus + install + remove all share the managed-command and trust-key derivation. Splitting would hide that the three operations must agree on group index, event label, and command bytes. */
 import { homedir } from 'os'
 import { join } from 'path'
+import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import {
   createManagedCommandMatcher,
@@ -12,12 +13,20 @@ import {
   writeManagedScript,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import {
+  readHooksJsonRemote,
+  readTextFileRemote,
+  writeHooksJsonRemote,
+  writeManagedScriptRemote,
+  writeTextFileRemoteAtomic
+} from '../agent-hooks/installer-utils-remote'
 import {
   computeTrustKey,
   computeTrustedHash,
   parseTrustKey,
   readHookTrustEntries,
   removeHookTrustEntries,
+  upsertHookTrustEntriesInContent,
   upsertHookTrustEntries,
   type CodexEventLabel,
   type CodexHookTrustState,
@@ -71,8 +80,8 @@ function getManagedCommand(scriptPath: string): string {
   return process.platform === 'win32' ? scriptPath : wrapPosixHookCommand(scriptPath)
 }
 
-function getManagedScript(): string {
-  if (process.platform === 'win32') {
+function getManagedScript(target: 'local' | 'posix' = 'local'): string {
+  if (target === 'local' && process.platform === 'win32') {
     return [
       '@echo off',
       'setlocal',
@@ -329,6 +338,99 @@ export class CodexHookService {
     return this.getStatus()
   }
 
+  async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
+    const remoteConfigPath = `${remoteHome.replace(/\/$/, '')}/.codex/hooks.json`
+    const remoteTomlPath = `${remoteHome.replace(/\/$/, '')}/.codex/config.toml`
+    const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/codex-hook.sh`
+    try {
+      const config = await readHooksJsonRemote(sftp, remoteConfigPath)
+      if (!config) {
+        return {
+          agent: 'codex',
+          state: 'error',
+          configPath: remoteConfigPath,
+          managedHooksPresent: false,
+          detail: 'Could not parse remote Codex hooks.json'
+        }
+      }
+
+      const command = wrapPosixHookCommand(remoteScriptPath)
+      const nextHooks = { ...config.hooks }
+      const managedEvents = new Set<string>(CODEX_EVENTS)
+      const isManagedCommand = createManagedCommandMatcher('codex-hook.sh')
+
+      for (const [eventName, definitions] of Object.entries(nextHooks)) {
+        if (managedEvents.has(eventName) || !Array.isArray(definitions)) {
+          continue
+        }
+        const cleaned = removeManagedCommands(definitions, isManagedCommand)
+        if (cleaned.length === 0) {
+          delete nextHooks[eventName]
+        } else {
+          nextHooks[eventName] = cleaned
+        }
+      }
+
+      const trustEntries: CodexTrustEntry[] = []
+      for (const eventName of CODEX_EVENTS) {
+        const current = Array.isArray(nextHooks[eventName]) ? nextHooks[eventName] : []
+        const cleaned = removeManagedCommands(current, isManagedCommand)
+        const definition: HookDefinition = {
+          hooks: [{ type: 'command', command }]
+        }
+        nextHooks[eventName] = [...cleaned, definition]
+        trustEntries.push({
+          sourcePath: remoteConfigPath,
+          eventLabel: CODEX_EVENT_LABEL[eventName],
+          groupIndex: cleaned.length,
+          handlerIndex: 0,
+          command
+        })
+      }
+
+      config.hooks = nextHooks
+      // Why: script/settings first, trust TOML last. A partial trust write
+      // leaves Codex asking for approval rather than executing a missing script.
+      // Why: SSH remotes use POSIX `.sh` hook paths even when Orca itself is
+      // running on Windows; never derive remote script syntax from local OS.
+      await writeManagedScriptRemote(sftp, remoteScriptPath, getManagedScript('posix'))
+      await writeHooksJsonRemote(sftp, remoteConfigPath, config)
+      try {
+        const existingToml = (await readTextFileRemote(sftp, remoteTomlPath)) ?? ''
+        const updatedToml = upsertHookTrustEntriesInContent(existingToml, trustEntries)
+        if (updatedToml !== existingToml) {
+          await writeTextFileRemoteAtomic(sftp, remoteTomlPath, updatedToml)
+        }
+      } catch (error) {
+        return {
+          agent: 'codex',
+          state: 'error',
+          configPath: remoteConfigPath,
+          managedHooksPresent: true,
+          detail: `Hooks installed but trust entries could not be written: ${
+            error instanceof Error ? error.message : String(error)
+          }. Run /hooks in Codex on the remote host to approve.`
+        }
+      }
+
+      return {
+        agent: 'codex',
+        state: 'installed',
+        configPath: remoteConfigPath,
+        managedHooksPresent: true,
+        detail: null
+      }
+    } catch (err) {
+      return {
+        agent: 'codex',
+        state: 'error',
+        configPath: remoteConfigPath,
+        managedHooksPresent: false,
+        detail: err instanceof Error ? err.message : String(err)
+      }
+    }
+  }
+
   remove(): AgentHookInstallStatus {
     const configPath = getConfigPath()
     const config = readHooksJson(configPath)