fix(agentic-ai): complete Codex hook deployment - #71
Merged
Merged
Conversation
Single content conflict in agentic-ai/Claude/validate.sh: branch added the Codex hook registration section, upstream (#72/#73) added skills and output-styles checks at the same insertion point. Both are disjoint intents; kept both, Codex registration first to stay adjacent to the Hooks section. install.sh and README.md auto-merged cleanly: upstream's skills/output-styles deployment coexists with the branch's Codex hooks.json registration; re-read both for prose contradictions and found none.
Codex only creates hooks.json once the user configures hooks, so on a
machine that has never done so, jq aborted install.sh (set -e) before hook
registration and the final settings.json redeploy. Seed an empty object
first; the existing jq program already handles {} correctly.
Found by running the merged install.sh + validate.sh end to end: validate
reported all five Codex hook symlinks present but hooks.json missing.
Railguard's self-integrity check reads $HOME/.codex/hooks.json and denies every call when that file has hooks but no railguard entry — exactly the state install.sh leaves on a machine where railguard skipped Codex registration. The benchmark then failed 2 cases for reasons unrelated to the code under test. Run railguard with HOME pointed at a bench-local home carrying a minimal railguard-registered hooks.json.
On a HOME that has never run Claude Code, cp aborted install.sh at the first deploy step. Found by exercising install.sh in a disposable fake HOME.
Live end-to-end testing showed registered hooks are silently skipped by codex exec until Codex records per-hook trust in config.toml (granted interactively). Document the caveat and the --dangerously-bypass-hook-trust escape hatch for non-interactive verification of self-authored hooks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Testing
Benchmark & repo checks
hook --client); installed railguard 0.5.1 predates the flag, so its 4 Railguard cases fail until railguard#43 merges — the 7 custom-hook cases pass either wayFresh-install matrix (disposable fake HOMEs, 23/23)
Live end-to-end (real codex-cli 0.150.1 sessions, isolated CODEX_HOME, --dangerously-bypass-hook-trust)
git add -Ain-session with reason surfaced to the modelKnown behavior gate: without persisted per-hook trust (or the bypass flag), codex exec runs registered hooks not at all — documented in README.