Windows: Codex hook trust detector ignores single-quoted TOML state keys

What happened?

After approving all project-level Entire hooks in Codex on Windows, Codex reports every hook as trusted and enabled, but entire doctor still reports:

Codex hook trust: REVIEW NEEDED
  4 hook(s) declared in .codex/hooks.json have no trusted_hash entry yet:
    - session_start
    - user_prompt_submit
    - stop
    - post_tool_use

The hooks are operational; this is a false positive in Entire's structural trust check.

Steps to reproduce

1. On Windows, enable the Codex integration: entire agent add codex.

2. Approve the generated hooks using Codex's hook approval flow.

3. Confirm Codex reports the hooks as trusted.

4. Inspect %USERPROFILE%\.codex\config.toml. Current Codex writes state tables using TOML literal-quoted keys:

   [hooks.state.'C:\repo\.codex\hooks.json:session_start:0:0']
   trusted_hash = "sha256:..."
   

5. Run entire doctor.

6. Observe that every declared hook is still reported as needing review.

Entire CLI version

Entire CLI 0.8.42
Go version: go1.26.4
OS/Arch: windows/arm64

OS and architecture

Windows arm64

Agent

OpenAI Codex CLI 0.144.4 / Codex desktop app

Terminal

PowerShell / Codex desktop app

Logs / debug output

Codex hook trust: REVIEW NEEDED
  4 hook(s) declared in .codex/hooks.json have no trusted_hash entry yet:
    - session_start
    - user_prompt_submit
    - stop
    - post_tool_use

Additional context

The cause appears to be the regex in cmd/entire/cli/agent/codex/trust.go:

var codexTrustStateHeaderRegex = regexp.MustCompile(`(?m)^\[hooks\.state\."([^"]+)"\]`)

It only recognizes basic-string (double-quoted) TOML keys. Codex currently emits literal-string (single-quoted) keys. Literal strings are particularly natural for Windows paths because backslashes do not require escaping.

Even accepting double quotes in the regex would remain fragile on Windows because a valid double-quoted TOML key contains escaped backslashes, and the captured value would need TOML unescaping before comparison with filepath.Join(...).

Suggested fix: parse config.toml structurally and enumerate keys under hooks.state, rather than extracting table headers with a regex. Regression coverage should include single-quoted Windows paths, double-quoted/escaped Windows paths, the existing POSIX case, and unrelated state entries.

I can send a focused PR with the implementation and tests if this approach is acceptable.

Start in cmd/entire/cli/agent/codex/trust.go and inspect how config.toml state headers are matched during entire doctor. Reproduce the Windows case, then run the existing trust-check tests if present. Done means trusted_hash entries are recognized for single-quoted Windows paths, escaped double-quoted Windows paths, POSIX paths, and unrelated state entries.