[seonghobae]

Codex graph hooks currently discard the event JSON and choose a repository from inherited process cwd. When the launcher cwd differs from the event checkout, they can update the wrong graph.

Add hook-update and hook-status commands that resolve the repository from a literal absolute payload cwd. Missing, malformed, relative, nonexistent, and non-repository paths do not trigger updates. Generated hooks forward JSON and propagate failures when the executable exists. Status delegates to the existing console command, preserving its output and failures.

Validation:

• Focused owner suite: 22 passed, 194 deselected; syntax compilation passed. Full suite and formatting/lint were not verified.
• Coordinator independently ran hook regressions: 5 passed, 1 skipped before the status follow-up. The builder dependency test was skipped in that environment; a separate installed-package spy verified exact downstream update arguments without executing a graph build.
• Final status path was exercised against the real installed console command: an empty GraphStore produced normal zero-count status and exit 0; a missing graph emitted its diagnostic and propagated exit 1.

The package must be upgraded to support these new commands before regenerating hooks. No installed hook configuration was changed. Payload provenance relies on the agent hook channel; filesystem/Git validation is not a separate repository trust allowlist.

[seonghobae]

Ready for maintainer review of e4b1d7e. GitHub rejected my RequestReviewsByLogin attempt because this fork contributor lacks permission. Please review the payload cwd boundary and run the repository-required checks through the normal fork-PR path. Validation limits and the package-before-hook-regeneration requirement are recorded in the description.

[tirth8205]

Thank you for this PR. I merged it with the latest staging. Then I tested the Codex hooks, install, uninstall, ruff and the tests.

Before I can merge it, please fix these:

1. Please change the PR base from main to staging.
2. Each install adds another copy of the Codex hooks. Please add the new commands to _GENERATED_HOOK_COMMAND_RE in skills.py. These tests fail: tests/test_skills.py::TestInstallCodexHooks::test_idempotent_by_command and tests/test_platform_lifecycle.py::test_step2_second_install_is_byte_identical[codex].
3. uninstall no longer removes the v2.3.9 Codex hooks. Put them in ~/.codex/hooks.json and run uninstall. Both hooks stay. Please add the old commands to _legacy_codex_hook_commands in uninstall.py.
4. hook-status fails in a repo with no graph (hook_update.py:67). It prints a traceback and exits 1. The old hook exited 0.
5. hook-update hides update errors (hook_update.py:57). It ignores the result of build_or_update_graph. A failed update prints nothing and exits 0.
6. ruff check fails at hook_update.py:3, skills.py:1101, skills.py:1114, tests/test_hook_update.py:5,24,105 and tests/test_skills.py:582,583.

After you push the fix, I will test it again.

[Copilot]

🟡 Changes recommended

Previously generated cwd-based Codex hooks survive regeneration and uninstall, so stale handlers can still update the launcher's repository.

2 open issues

• Upgrade leaves old cwd-based Codex hooks active · New
• Uninstall misses prior Codex hook command variants · New

What changed in this PR

This PR scopes Codex graph hooks to the repository identified by the event payload’s cwd, rather than the launcher’s working directory.

Changes:

• Adds hook-update and hook-status commands with payload-based repository validation.
• Updates generated Codex hooks to forward JSON input and preserve command failures.
• Adds regression coverage for repository selection, invalid payloads, status output, and failure handling.

File	Description
tests/​test_skills.py	Updates expectations for generated Codex commands.
tests/​test_hook_update.py	Adds payload-scoping and command-failure regressions.
code_review_graph/​skills.py	Generates hooks that forward payloads to the new commands.
code_review_graph/​hook_update.py	Resolves payload repositories and runs updates or status.
code_review_graph/​cli.py	Registers and dispatches the two hook commands.

_{Review effort: Balanced}