Repository navigation
fix(agents): approve Menew's Codex hooks so the ChatGPT app reaches the notch - #26
Merged
Merged
Conversation
…he notch Codex only runs hooks.json entries that have a matching trusted_hash in ~/.codex/config.toml. The CLI asks for it, but the ChatGPT app (which runs Codex inside) skips unapproved hooks silently, so its sessions never showed up. Turning on Codex now also writes the approval for Menew's own commands in a managed block, using Codex's hash (SHA-256 of the normalized event and hook), and shows Codex as outdated until it is there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
Sessions from the ChatGPT app (Work mode, which runs Codex inside through
codex app-server) never showed up in the notch, even with Codex notifications turned on.Cause: Codex only runs a
hooks.jsonentry when~/.codex/config.tomlhas an approval for it,[hooks.state."<hooks.json>:<event>:<group>:<handler>"]with atrusted_hash. The CLI asks for it on startup, but the ChatGPT app skips unapproved hooks without asking, so Menew's hooks never fired.Fix:
CodexHookTrust(inAgentHub.swift) computes Codex's own hash, taken fromcodex-rs/hooks/src/engine/discovery.rs(hook_hash+version_for_toml): SHA-256 of the compact JSON, with sorted keys, of{event_name, hooks: [normalized handler]}. The default timeout is 600 s, or 1 s forSessionEnd.# >>> menew hooksblock inconfig.toml, after saving a.menew-backup. A key Codex already wrote elsewhere is left alone, because repeating the table would break the TOML. Turning Codex off removes the block.AgentHooks.status(.codex)reports.outdatedwhile the approvals are missing, so existing users see Outdated → Update once.For reviewers:
hooks.json. If another tool adds or removes hook groups before Menew's, the approval goes stale and the row shows Outdated again until Update is pressed.Screenshots
No visual change beyond the existing Outdated/Update state and the confirmation text.
Checklist
./build.sh. I checked that Codex runs the hooks with the approvals in place: a realcodex execwith an isolatedCODEX_HOMEdelivered SessionStart, UserPromptSubmit and SessionEnd to Menew; without the approvals, none arrived.swift testpasses (113 tests). New tests check the hash against hashes Codex itself wrote, plus block insertion, removal and dedupe.L("…")with en, de, es and zh (check-l10n.pypasses).CHANGELOG.mdhas a line under## Unreleased.CryptoKitis a system framework.🤖 Generated with Claude Code