fix: make Codex hooks transactional

src/plugins/codex-installation.ts

@@ -0,0 +1,69 @@
+import type { InstallConfig } from './base.js';
+import {
+  AGENT_KEY,
+  AUDIT_SCRIPT,
+  GUARD_SCRIPT,
+  type RenderedDocument,
+} from './codex-contract.js';
+import {
+  commitManagedInstallation,
+  managedRuntimePaths,
+  preflightManagedInstallation,
+  prepareManagedInstallation,
+  type ManagedRuntimePaths,
+  type PreparedManagedInstallation,
+  type RenameFile,
+} from './managed-installation.js';
+
+const DISPLAY_NAME = 'Codex';
+const HOOKS_DIRECTORY_LABEL = 'Codex hooks directory';
+const HOOKS_LABEL = 'Codex user hooks';
+
+export type CodexRuntimePaths = ManagedRuntimePaths;
+export type PreparedCodexInstallation = PreparedManagedInstallation;
+export type { RenameFile };
+
+export function codexRuntimePaths(config: InstallConfig): CodexRuntimePaths {
+  return managedRuntimePaths(config, AGENT_KEY, GUARD_SCRIPT, AUDIT_SCRIPT);
+}
+
+export async function preflightCodexInstallation(
+  config: InstallConfig,
+  hooksPath: string,
+): Promise<CodexRuntimePaths> {
+  return preflightManagedInstallation({
+    agentKey: AGENT_KEY,
+    hooksDirectoryLabel: HOOKS_DIRECTORY_LABEL,
+    hooksPath,
+    config,
+  }, GUARD_SCRIPT, AUDIT_SCRIPT);
+}
+
+export async function prepareCodexInstallation(
+  config: InstallConfig,
+  rendered: RenderedDocument,
+): Promise<PreparedCodexInstallation> {
+  if (!rendered.changed && rendered.document.raw === undefined) {
+    throw new Error('Codex hook installation did not produce a configuration document');
+  }
+  const hooksSource = rendered.next ?? rendered.document.raw;
+  if (hooksSource === undefined) throw new Error('Codex hook configuration is missing');
+  return prepareManagedInstallation({
+    agentKey: AGENT_KEY,
+    displayName: DISPLAY_NAME,
+    hooksDirectoryLabel: HOOKS_DIRECTORY_LABEL,
+    hooksLabel: HOOKS_LABEL,
+    hooksPath: rendered.document.filePath,
+    expectedHooksSource: rendered.document.raw,
+    hooksSource,
+    config,
+    auditOptions: { nativePayload: true },
+  }, GUARD_SCRIPT, AUDIT_SCRIPT);
+}
+
+export async function commitCodexInstallation(
+  prepared: PreparedCodexInstallation,
+  renameFile?: RenameFile,
+): Promise<void> {
+  await commitManagedInstallation(prepared, renameFile);
+}