mirror of
https://github.com/openai/codex.git
synced 2026-10-20 08:19:50 +00:00
jif
2bf2bdf82c
## Why A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval. ## What changed - Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients. - Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change. - Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home. - Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks. ## Testing Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust. GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
44 lines
1.3 KiB
TOML
44 lines
1.3 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-hooks"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
doctest = false
|
|
name = "codex_hooks"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
codex-utils-process = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
async-channel = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-config = { workspace = true }
|
|
codex-plugin = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-output-truncation = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
futures = { workspace = true, features = ["alloc"] }
|
|
regex = { workspace = true }
|
|
schemars = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "io-util", "process", "sync", "time"] }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true, features = ["v4"] }
|
|
|
|
[dev-dependencies]
|
|
libc = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread", "time"] }
|
|
|
|
[target.'cfg(any(unix, windows))'.dependencies]
|
|
codex-utils-pty = { workspace = true }
|