fix(codex): align permissions and hook setup #158
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/codex-permissions-hooks"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
Codex custom agents inherit their parent's permissions, but the validator
required sandbox fields that cannot override them. Adoption and upgrade
instructions also need to account for Codex's separate hook trust review.
What changed
Remove ineffective sandbox fields and their validation requirements,
retain the reviewers' read-only instructions, and explain inherited
permissions. Consolidate regression coverage in the initialized-state
acceptance test. Add one hook setup procedure, linked from adoption and
upgrades, with activation on other workstations after they receive the
upgrade.
How to verify
Run
bash tests/agent-config/initialized-state.sh: configuration withoutCodex sandbox fields must pass. The same acceptance assertion fails on
the base validator with diagnostics for all seven roles.
Follow README's Codex hook setup in the local CLI and check that both
project hooks are enabled and trusted in
/hooks.All Maintenance checks passed: 261 configuration tests, 46 work-folder
tests, ShellCheck on 53 scripts, Prettier, static configuration validation,
and
git diff --check main. Change, security, and documentation reviewspassed after their findings were resolved.
Considerations
Reviewers retain instruction-based read-only behavior under the parent's
permissions. Interactive hook activation and behavioral evals were not run;
the eval runner is outside this change's scope.