Validate Codex/agents manifests in CI; close #47 hooks investigation - #48
Merged
Conversation
…gation .codex-plugin/plugin.json and .agents/plugins/marketplace.json shipped with zero CI coverage since PR #46 - extend the existing jq manifest validation (local-ci custom check + GHA) to cover both, plus a version-agreement check between .claude-plugin/plugin.json and .codex-plugin/plugin.json (independently hand-maintained, nothing else keeps them in sync). Issue #47 (Codex automatic-capture hooks) investigated empirically via a live throwaway probe hook under real `codex exec` - findings posted to the issue. Decision: not wiring hooks. Discovery is solved (explicit "hooks" key in plugin.json, not convention) and double-registration is ruled out for the recommended pattern, but hooks require a persisted-trust grant with no verified non-interactive path - `codex exec` silently no-ops without --dangerously-bypass-hook-trust, which the CLI itself scopes to "automation that already vets hook sources," not a shipped plugin default. Wiring it now would look automatic while silently not firing for most real usage. No hooks.json changes; keeping the skills-only framing with evidence instead of an inconclusive prior attempt. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS
/review-pr on PR #48 found the local-ci form and the GHA form diverged when both plugin.json files are missing: bash -c without -e let the failed jq command substitutions silently produce empty strings that compared equal (false pass), while GHA's default `bash -e` aborted correctly. Prefixing with `set -e;` restores exit-on-failure semantics, matching GHA - verified both the normal-pass and now-fails-fast-on-missing-file cases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/ci.yml) andlocal-ci(.local-ci.json) manifest validation to cover.codex-plugin/plugin.jsonand.agents/plugins/marketplace.json, which shipped with zero validation coverage since PR feat: Codex CLI plugin as a 4th delivery format #46..claude-plugin/plugin.jsonand.codex-plugin/plugin.json— nothing previously kept these independently-hand-maintained version strings in sync.codex exec— see the issue for findings. Decision: not wiring hooks. Discovery is solved and double-registration is ruled out for the recommended pattern, but hooks require an interactive trust grant with no verified non-interactive path, so wiring it now would look automatic while silently not firing for most real usage (headless/CI needs a dangerous bypass flag; interactive needs an unverified manual step per install). Nohooks.jsonchanges — skills-only framing stands, now with evidence.Test plan
/local-ci— 167/167 hook tests pass, shellcheck clean, all manifest/version-agreement checks passcodex plugin marketplace add dynamic/throughline→add→ all 4 skills (handoff,onboard,consolidate,consolidate-memory) confirmed loading in a realcodex execsession~/.codex/skills/{consolidate,handoff,onboard}symlink bridge now that the marketplace path is verified workingsession.idlere-stamp behavior confirmed, not duplicated)🤖 Generated with Claude Code
https://claude.ai/code/session_013cG9PVNGundwPjNB4Yz5AS