hook prompt for codex

opencode-hook.js

#!/usr/bin/env node
const fs = require('fs');

function main() {
    try {
        // Lecture du flux d'entrée standard (stdin) fourni par Codex
        const inputData = fs.readFileSync(0, 'utf-8');
        if (!inputData) {
            console.log(JSON.stringify({ continue: true }));
            process.exit(0);
        }

        const payload = JSON.parse(inputData);
        const tool_input = payload.tool_input || {};
        const commandRaw = tool_input.command || "";
        const commandClean = commandRaw.trim();

        // Dictionnaire des regex de blocage avec leurs motifs exigés
        const blacklist = [
            { regex: /\brm\s+-rf\s+\/\b/, reason: "Never delete the root filesystem." },
            { regex: /\brm\s+-rf\s+\/\*\b/, reason: "Never delete the contents of the root filesystem." },
            { regex: /\brm\s+-rf\s+~\b/, reason: "Never delete the entire home directory." },
            { regex: /\brm\s+-rf\s+\$HOME\b/, reason: "Never delete the entire home directory." },
            { regex: /\brm\s+-rf\s+\/Users\b/, reason: "Never delete all user directories." },
            { regex: /\brm\s+-rf\s+\/(System|bin|boot|etc|usr)\b/, reason: "Never delete operating system files or directories (e.g. macOS /System, Windows C:\\Windows, Linux /bin, /boot, /etc, /usr)." },
            { regex: /\bdiskutil\s+eraseDisk\b/, reason: "Never erase or repartition a disk." },
            { regex: /\bdiskutil\s+eraseVolume\b/, reason: "Never erase or repartition a disk." },
            { regex: /\bdiskutil\s+partitionDisk\b/, reason: "Never erase or repartition a disk." },
            { regex: /\bmkfs\b/, reason: "Never format a filesystem." }
        ];

        // Parcours de la blacklist
        for (const item of blacklist) {
            if (item.regex.test(commandClean)) {
                // Structure de refus PreToolUse standard Codex
                const denialOutput = {
                    hookSpecificOutput: {
                        hookEventName: "PreToolUse",
                        permissionDecision: "deny",
                        permissionDecisionReason: item.reason
                    }
                };
                console.log(JSON.stringify(denialOutput));
                process.exit(0);
            }
        }

        // Si la commande ne présente aucun danger
        console.log(JSON.stringify({ continue: true }));
        process.exit(0);

    } catch (error) {
        // En cas d'erreur de parsing ou autre, on laisse passer pour ne pas bloquer l'éditeur
        console.log(JSON.stringify({ continue: true }));
        process.exit(0);
    }
}

main();

opencode-hook.json

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "^Bash$",
        "hooks": [
          {
            "type": "command",
            "command": "node ~/.codex/hooks/destructive_commands.js",
            "statusMessage": "🛡️ Analyse de sécurité de la commande (JS)..."
          }
        ]
      }
    ]
  }
}

Security-hook-Codex.md

Set up these as real Codex lifecycle hooks by following the official documentation: https://learn.chatgpt.com/docs/hooks

Important: use ~/.codex/hooks.json and a PreToolUse command hook. Do not implement this only as a ~/.codex/rules/*.rules execution-policy file.

First inspect any existing hooks and preserve them. Then:

1. Create or merge ~/.codex/hooks.json with a PreToolUse matcher for Bash.
2. Create ~/.codex/hooks/destructive_commands.py.
3. The script must read the hook JSON payload from stdin and inspect tool_input.command.
4. Block these command prefixes with the listed reasons:

• rm -rf / — Never delete the root filesystem.
• rm -rf /* — Never delete the contents of the root filesystem.
• rm -rf ~ — Never delete the entire home directory.
• rm -rf $HOME — Never delete the entire home directory.
• rm -rf /Users — Never delete all user directories.
• rm -rf /System — Never delete operating system files or directories (e.g. macOS /System, Windows C:\Windows, Linux /bin, /boot, /etc, /usr).
• diskutil eraseDisk — Never erase or repartition a disk.
• diskutil eraseVolume — Never erase or repartition a disk.
• diskutil partitionDisk — Never erase or repartition a disk.
• mkfs — Never format a filesystem.

The hook should return Codex’s documented PreToolUse denial shape:

{ "hookSpecificOutput": { "hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "..." } }

Handle shell command segments such as echo ok; rm -rf /, while avoiding actual execution of any destructive command. Preserve existing hooks, use portable Python invocation, and do not modify unrelated configuration.

Validate the result by:

• parsing hooks.json;
• compiling the Python script;
• feeding synthetic JSON fixtures for every blocked command;
• feeding safe commands and confirming they are allowed;
• confirming the hook appears through Codex’s /hooks command.

Tell me exactly which files changed and remind me that I must review/trust the non-managed hook in /hooks.