Uh oh!
There was an error while loading. Please reload this page.
Document unsupported Codex hook-trust workaround - #53
Merged
Conversation
Issue #47 closed "not wiring" hooks because headless codex exec has no verified non-interactive trust path. Live testing after that close found more: an interactive session (codex -p <profile>, answering the ordinary directory-trust prompt) grants hook trust as a side effect, persisted as a portable content-hash under [hooks.state] in whichever config layer was active. Copying that block into the base ~/.codex/config.toml (plus plugin_hooks=true) made Codex Desktop fire hooks too - confirmed live in two real projects. Upstream research (openai/codex#21615, #37362) confirms this is a known gap, not something fragile we invented - a wrapper-tool maintainer independently describes the same trusted_hash-copying technique as "the practical alternative for integrators today." Filed #52 to track whether this becomes a documented default step, and commented on openai/codex#21615 with our corroborating data point. Documents the verified-working manual setup as an explicit advanced/unsupported step, version-pinned to Codex v0.149.0 - hook discovery/trust changed between v0.118.0 and v0.149.0 already per that release's own changelog, so this isn't stable footing to build a default on. Not wiring anything in the shipped manifest; this is user-facing documentation only. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS
/review-pr on PR #53 found: - The bare-`codex` (base config) path was presented as confirmed working, but #52 actually records the opposite: several already-trusted base-config projects show zero hook review ever bundled in. Only the named-profile path is confirmed. This would have sent a reader without profiles down a broken procedure (step 2 copying a [hooks.state] table that never got created). Scoped the claim correctly and gave an explicit fallback. - A bare `[#37362]` openai/codex issue link collided with the bare-`#` shorthand this README already uses for throughline's own issues - qualified both references as `openai/codex#37362`. - The "skills only" intro two sections above wasn't updated alongside the paragraph it summarizes, and "see below for why" now points at a section explaining how to get automatic capture - softened to "by default" and added the pointer. - Minor precision fixes: named the concrete `codex --profile <profile> exec` invocation instead of "under that same profile"; hedged "a content hash of hooks/hooks.json" to "believed to be" (stronger than the evidence supports); named v0.149.0 explicitly where "that version's changelog" was ambiguous after mentioning two versions. - Added the discovery-mechanism gap the reviewer flagged: the shipped plugin.json declares no `hooks` key at all, yet trust review still finds hooks/hooks.json to grant trust to - noted as unresolved rather than silently glossed over. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS
Uh oh!
There was an error while loading. Please reload this page.
2 tasks
jsirish added a commit
that referenced
this pull request
Aug 26, 2026
Follow-up to #53, based on live testing in a real Codex session. The in-TUI /hooks command is a genuine, sanctioned status view showing each hook's Source/Command/Mode/Timeout/Trust - resolves the discovery-mechanism question the previous doc pass left open (Codex resolves each hook's command straight from the installed plugin's cache path, no plugin.json "hooks" key needed). /review-pr found and fixed: a line-initial hyphen that broke the intro paragraph into a stray bullet list under GFM (verified via GitHub's own markdown API before/after), and an overclaimed "confirmed" epistemic label where "observed" better matches what the evidence actually establishes.
This was referenced Aug 26, 2026
jsirish added a commit
that referenced
this pull request
Aug 26, 2026
Corrects the README, promo site, and CHANGELOG to reflect actual current Codex behavior, confirmed live from a genuinely reverted, out-of-the-box config: Codex CLI shows a native "Hooks need review" dialog on first use (choose "Trust all and continue"); Codex Desktop grants trust silently. Both platforms get full automatic capture, same as Claude Code, gated only by that one-time step. No code changed - this was always true of the shipped plugin. Replaces the "Advanced: enabling automatic capture (unsupported)" section from #53/#54 (obsolete) and corrects v0.13.0's CHANGELOG entry, which asserted "skills only, not automatic capture" about the currently-shipped release - via an [Unreleased] correction and bracketed inline notes, without rewriting released history. /review-pr found and fixed: the CHANGELOG contradiction above, a paragraph narrating investigation history rather than stating current behavior (violates a writing-style rule added this session), an overclaimed "isn't asked again" permanence statement, and a missing jq requirement note on both the README and promo site's Codex sections. Closes#52.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an "Advanced: enabling automatic capture (unsupported, verified against v0.149.0)" subsection to the Codex CLI Plugin README section, documenting the manual
[hooks.state]copy technique confirmed working live this session (issue #47's investigation, extended and tracked in #52).codex), and copying the resulting[hooks.state]block into the base config to cover Codex Desktop too./hookscommand first (untested here, may be cleaner than raw config editing per #37362's discussion).Closes no issues (this is docs against an already-closed#47; #52 stays open tracking whether this becomes a real default setup path).
Test plan
/local-ci— 167/167 pass, all manifest checks pass🤖 Generated with Claude Code
https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS