fix(hooks): speak Codex 0.155's hook protocol

[KageBinary]

Why

Checked against Codex 0.155.1 (the binary, and openai/codex at rust-v0.155.1):

• Context only reached the user. pre_tool_use.py returned its context as systemMessage. In hooks/src/events/*.rs parse_completed, systemMessage only becomes a UI warning; hookSpecificOutput.additionalContext is what reaches the model. The output structs also reject unknown fields.
• Most edits weren't seen. Codex edits files with apply_patch (core/src/tools/hook_names.rs), but the hooks only matched Bash.
• The installer wrote an obsolete flag. codex_hooks is a deprecated alias of hooks (features/src/legacy.rs), which has been stable and on by default since 0.124 (Mark codex_hooks stable openai/codex#19012).
• Hooks ran in a login shell. hooks.json used /bin/sh -lc, which sources the user's login profile on every hook. On the machine this was built on, the profile has a syntax error under sh, so no hook could run at all. Codex itself runs hooks with <shell> -c (session/mod.rs build_hooks_config).

What changes

• One model_context() helper builds every hook's output, so model context goes in hookSpecificOutput.additionalContext. Stop has no model channel and keeps {"continue": true}.
• apply_patch:
  • Pre and post hooks match Bash|apply_patch.
  • Files are read from the patch's Add/Update/Delete File and Move to headers, the same grammar as apply-patch/src/parser.rs. The patch arrives as tool_input.command.
  • The pre-edit warning runs ix impact on the first 3 files in parallel.
• The installer no longer writes config.toml. It only warns if hooks are turned off there. .codex/config.toml, the TOML editor and its tests are removed.
• Hooks run with /bin/sh -c.
• Trust: per hooks/src/engine/discovery.rs, hooks in ~/.codex/hooks.json are skipped until the user trusts them (trusted_hash). Changing hooks.json, as this PR does, means users must review them again. The installer now prints a notice. hooks.md explains what moving to plugin-bundled hooks would take; those need the same trust step.
• Version 2.4.3.

Tests

• unittest: 111 → 112 passing (1 Windows-only skip): 19 TOML tests removed, 20 added.
• The new tests/test_codex_hook_protocol.py checks hook output against Codex's own schemas, copied into tests/fixtures/codex-0.155.1/. Against the old hooks it gives 8 failures and 5 errors, including the old systemMessage shape.
• test-local.sh and the header check pass.
• Smoke run: a temp CODEX_HOME, a local mock Responses server (no real credentials) and a strict fake ix. With the hooks untrusted, codex exec skipped every one: the fake ix was never called. That confirms the trust step in practice. A positive run, with hook context actually reaching a model, wasn't done: it needs --dangerously-bypass-hook-trust or a real trust entry.

Notes

Not fixed here:

• On Windows, the "python" "launcher" name hook command likely fails under PowerShell (-NoProfile -Command). commandWindows with & would fix it, but it's untested.
• The SessionStart matcher startup|resume misses clear, compact and fork.
• A file written from a subdirectory reaches ix impact with a path relative to that subdirectory, not to the workspace root.

🤖 Generated with Claude Code