fix: harden Codex hook finalization

This commit is contained in:
thanhnv
2026-07-24 13:06:23 +07:00
parent bfebfa9d39
commit 34a6b013c0
8 changed files with 79 additions and 24 deletions
@@ -164,13 +164,15 @@ echo "$CLAUDE_PRE" | grep -q '"permissionDecision": "allow"' && pass "Claude gen
CODEX_BEGIN=$(printf '%s' '{"session_id":"hybrid-codex","turn_id":"t2","prompt":"review this project","cwd":"'"$PROJ"'"}' |
CASAN_APP_ROOT="$PROJ" python3 "$PROJ/.casan/casan-hook.py" --client codex --event UserPromptSubmit)
echo "$CODEX_BEGIN" | grep -q '"continue": true' && pass "Codex generated hook opens admission" || fail "Codex generated hook failed ($CODEX_BEGIN)"
python3 - "$PROJ/.codex/hooks.json" <<'PY' && pass "Codex hook JSON matches the current nested command schema" || fail "Codex hook JSON schema is stale"
python3 - "$PROJ/.codex/hooks.json" <<'PY' && pass "Codex hooks use the current schema and project-relative bootstrap" || fail "Codex hook contract is stale"
import json,sys
d=json.load(open(sys.argv[1]))
handlers=[h for groups in d["hooks"].values() for group in groups for h in group["hooks"]]
assert handlers and all(h.get("type") == "command" for h in handlers)
assert all(isinstance(h.get("command"), str) for h in handlers)
assert all(isinstance(h.get("timeout"), int) and "timeout_ms" not in h for h in handlers)
assert all('python3 ".casan/casan-hook.py"' in h["command"] for h in handlers)
assert all("git rev-parse" not in h["command"] for h in handlers)
PY
echo "===== ③ version.lock pins the installed harness ====="