This plugin executes local command hooks at session lifecycle events and before user turns. Codex requires users to review and trust non-managed hooks; do not bypass that review for an unverified checkout.

The hook is fail-open for detection and read errors: those failures never block the user's task and never authorize a model switch or configuration write. Separately, when valid host events confirm that the current route contract is missing or incompatible, initialization recovery may pause the first business tool until a local route receipt is established. That protocol recovery is not a detection error and does not make a capability judgment.

Supported security reports include unintended data collection, command injection, unsafe path handling, incorrect trust-status reporting, or a detection path that writes to Codex state. Report vulnerabilities privately through GitHub Security Advisories for this repository. Do not include real prompts, tokens, credentials, or private transcripts in a report.

本插件会在任务生命周期事件和每次用户提交前执行本地命令 Hook。Codex 会要求用户检查并信任非托管 Hook；对于未经核验的副本，不要绕过这一步。

Hook 对探测和读取错误采用开放失败：这些失败不会阻止用户任务，也不会因此获得切换模型或写入配置的权限。另一条独立边界是：当有效宿主事件确认当前路由合同缺失或不兼容时，初始化恢复可以暂停首个业务工具，直到建立本地路由回执；这属于协议恢复，不是读取错误，也不判断模型能力。

可报告的问题包括意外收集数据、命令注入、不安全的路径处理、错误标注真实性，或者任何会写入 Codex 状态的探测路径。请通过本仓库的 GitHub Security Advisories 私下报告漏洞。报告中不要附带真实提示词、令牌、凭据或私人转录。