feat: add managed hooks lockdown

This commit is contained in:
viyatb-oai
2026-04-07 14:48:50 -07:00
parent fa5270abef
commit b04edb1685
18 changed files with 260 additions and 4 deletions
+9
View File
@@ -36,6 +36,15 @@ Codex can run a notification hook when the agent finishes a turn. See the config
When Codex knows which client started the turn, the legacy notify JSON payload also includes a top-level `client` field. The TUI reports `codex-tui`, and the app server reports the `clientInfo.name` value from `initialize`.
## Lifecycle hooks
Lifecycle hooks run arbitrary shell commands outside the sandbox. When hooks are configured,
Codex emits a startup warning that lists the loaded `hooks.json` files so you can review
changes before continuing.
Admins can set `allow_managed_hooks_only = true` in `requirements.toml` to ignore user and
project hook files while still allowing managed hooks.
## JSON Schema
The generated JSON Schema for `config.toml` lives at `codex-rs/core/config.schema.json`.