feat: block direct codex CLI calls via PreToolUse hook #139
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| #!/bin/bash | ||
| # PreToolUse hook: block direct "codex" CLI invocations and redirect to the plugin. | ||
|
|
||
| # jq is expected but not a hard dependency — pass through if unavailable. | ||
| command -v jq &>/dev/null || exit 0 | ||
|
|
||
| INPUT=$(cat) | ||
| COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty') | ||
|
|
||
| # Match "codex" at a command position: start of string (with optional leading | ||
| # whitespace) or after a shell separator. This avoids false positives when "codex" | ||
| # appears inside arguments like commit messages or strings. | ||
| if echo "$COMMAND" | grep -qE '(^[[:space:]]*|[;&|][[:space:]]*)codex([[:space:]]|$)'; then | ||
|
There was a problem hiding this comment.
The PreToolUse guard still allows direct Codex CLI calls when the command starts with shell variable assignments (for example, Useful? React with 👍 / 👎.
Author
There was a problem hiding this comment. Acknowledged but accepting this edge case. The broader word-boundary regex that would catch |
||
| echo "Do not call the codex CLI directly. Use the codex plugin instead: /codex:rescue for tasks, /codex:review for reviews, /codex:status for status, /codex:result for results." >&2 | ||
| exit 2 | ||
| fi | ||
|
|
||
| exit 0 | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The hook now depends on
jqto extract.tool_input.command, but ifjqis missing (not guaranteed by this repo’s documented requirements), this assignment fails and leavesCOMMANDempty, after which the script returns success at the end. In that environment, directcodexinvocations are silently not blocked, so the new protection does not work. Use a guaranteed runtime (e.g., Node) for parsing or explicitly error/block when parsing fails.Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added a jq availability check, but it exits 0 (allow) rather than exit 2 (block) when jq is missing. Fail-closed would block every Bash call on systems without jq, which is a worse outcome than missing the codex guard. jq is expected to be present on any system running Codex CLI and Node.js, but we don't want to introduce it as a hard dependency.