feat: install codex self-serve hooks

[tumberger]

Summary

• Install and remove Codex self-serve hooks in ~/.codex/hooks.json.
• Install only Codex-supported event keys from this stack and use Stop as turn-scoped telemetry.
• Skip backup/write work when rerunning setup leaves the canonical Codex hooks file unchanged.

Review notes

• Codex command hooks do not use async: true; current Codex behavior skips async handlers rather than running them in the background.
• Codex hooks are enabled by default in current Codex releases; /hooks trust review remains the user action setup needs to call out.

Verification

• go test ./...

[tumberger]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat: support codex permission requests #321
• feat: install codex self-serve hooks #320 👈 (View in Graphite)
• feat: add codex agent adapter #319
• refactor: introduce agent hook installer #318
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR adds Codex hook management to self-serve setup. The main changes are:

• Installs Codex hooks into ~/.codex/hooks.json.
• Removes Codex managed hooks during uninstall.
• Shares JSON hook-file helpers between Claude and Codex hook management.
• Adds Codex setup, uninstall, idempotency, and validation tests.
• Updates setup messaging for supported local agents.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the latest changed code.
• The Codex malformed-file paths now fail earlier during setup and no longer stop later uninstall cleanup.

Important Files Changed

Filename	Overview
internal/setup/setup.go	Adds Codex hook preflight and install flow to setup.
internal/setup/uninstall.go	Adds Codex hook cleanup while allowing later uninstall cleanup to continue after Codex hook errors.
internal/codexmanaged/hooks.go	Adds Codex hook templates, validation, merge, removal, and managed-command detection.
internal/agenthooks/jsonfile.go	Adds shared JSON read, write, backup, and shell quoting helpers for hook files.

_{Reviews (3): Last reviewed commit: "feat: install codex self-serve hooks" | Re-trigger Greptile}

[tumberger]

@greptile check again

[hasandemirkiran]

Most of my comments land here; the headline is the Codex event set, flagged inline on SupportedEvents.

[hasandemirkiran]

Good call pointing them at /hooks to trust the hooks. The gap: Codex hooks are still experimental and off by default — they only run with [features] codex_hooks = true in ~/.codex/config.toml. As written, we install them and tell the user to trust them, but if that flag is not set, nothing fires and we silently do not observe Codex at all. Could we detect the flag and warn, or at least name it in this note?

[tumberger]

Resolved in #320 PR notes: current Codex hooks are enabled by default, and codex_hooks is now a deprecated alias for disabling/enabling hooks behavior. The setup note remains focused on the action users still need after install: open /hooks and trust the Kontext hooks.

[hasandemirkiran]

Thanks for digging in on this! One thing still nags me on the default — the OpenAI hook docs read as opt-in to me: codex_hooks is deprecated in favor of [features].hooks, but hooks seem to be off by default and silent until that key is set (https://developers.openai.com/codex/hooks). If that holds, someone who runs setup and trusts the hooks via /hooks but never sets [features].hooks = true would silently go unobserved. Are you seeing them on by default in the Codex version we target? If it's still opt-in, might be worth naming [features].hooks in the note so folks aren't left uncovered without realizing it.

[tumberger]

@greptile review given all changes and updates and review