Codex hooks generator

Run in a terminal. The scripts need jq.

mkdir -p ~/.codex/hooks
# save each script below into that folder, then:
chmod +x ~/.codex/hooks/guard-shell.sh ~/.codex/hooks/protect-env.sh ~/.codex/hooks/notify.sh
command -v jq >/dev/null || echo 'Install jq first: brew install jq (macOS) or apt install jq'
# then start codex and run /hooks to review and trust the new hooks

Save as ~/.codex/hooks.json. Then open /hooks in Codex and trust the new hooks.

{
  "description": "Made with taskhold.com/tools/codex-hooks",
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "^Bash$",
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.codex/hooks/guard-shell.sh",
            "timeout": 10,
            "statusMessage": "Checking command"
          }
        ]
      },
      {
        "matcher": "^(Bash|apply_patch)$",
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.codex/hooks/protect-env.sh",
            "timeout": 10,
            "statusMessage": "Checking for secrets files"
          }
        ]
      }
    ],
    "PermissionRequest": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.codex/hooks/notify.sh",
            "timeout": 10
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.codex/hooks/notify.sh",
            "timeout": 10
          }
        ]
      }
    ]
  }
}

Save as ~/.codex/hooks/guard-shell.sh

#!/bin/bash
# guard-shell.sh: Codex PreToolUse (Bash) hook. Made with taskhold.com/tools/codex-hooks.
# Reads the hook's JSON from stdin; needs jq.
# Blocks: git push --force / -f, git reset --hard, rm -rf / or ~.
input=$(cat)
cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty')
if printf '%s' "$cmd" | grep -qE '(git push.*(--force|-f( |$)))|(git reset --hard)|(rm -[a-z]*r[a-z]*f?[a-z]* +(/|~)( |$))'; then
  jq -cn '{hookSpecificOutput: {hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "This command is blocked by a hook. Use a safer alternative or ask me to run it."}}'
fi
exit 0

Save as ~/.codex/hooks/protect-env.sh

#!/bin/bash
# protect-env.sh: Codex PreToolUse (Bash, apply_patch) hook. Made with taskhold.com/tools/codex-hooks.
# Reads the hook's JSON from stdin; needs jq.
# Denies commands and patches that name a secrets file. A guardrail, not a sandbox:
# a command that reaches a file without naming it gets through.
input=$(cat)
text=$(printf '%s' "$input" | jq -r '.tool_input.command // empty')
hit=$(printf '%s' "$text" | tr -s ' \t\n"=<>;|&()`'"'" '\n' | while IFS= read -r word || [ -n "$word" ]; do
  name=${word##*/}
  case "$name" in
    (.env.example|.env.sample|.env.template) ;;
    (.env|.env.*|*.pem|*.key|id_rsa|id_ed25519) printf '%s' "$word"; break ;;
  esac
done)
if [ -n "$hit" ]; then
  jq -cn --arg p "$hit" '{hookSpecificOutput: {hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: ("Kept away from the agent by a hook: " + $p + ". Ask me if you need a value from it.")}}'
fi
exit 0

Save as ~/.codex/hooks/notify.sh

#!/bin/bash
# notify.sh: Codex Stop and PermissionRequest hook. Made with taskhold.com/tools/codex-hooks.
# Reads the hook's JSON from stdin; needs jq.
input=$(cat)
event=$(printf '%s' "$input" | jq -r '.hook_event_name // empty')
if [ "$event" = "PermissionRequest" ]; then
  tool=$(printf '%s' "$input" | jq -r '.tool_name // "a tool"')
  msg="Waiting for your approval ($tool)"
else
  last=$(printf '%s' "$input" | jq -r '.last_assistant_message // empty' | tr '\n' ' ' | cut -c1-120)
  msg=${last:-"Codex finished a turn"}
fi
{
  osascript -e 'on run argv' -e 'display notification (item 2 of argv) with title (item 1 of argv)' -e 'end run' "Codex" "$msg" 2>/dev/null
  { afplay /System/Library/Sounds/Glass.aiff || paplay /usr/share/sounds/freedesktop/stereo/complete.oga; } >/dev/null 2>&1 &
} || true
# Stop needs JSON on stdout; PermissionRequest prints nothing so the normal approval prompt shows.
[ "$event" = "Stop" ] && echo '{}'
exit 0