codex-rescue: node-based file writes for prompt assembly trip the auto-mode bypass classifier

Summary

A codex:codex-rescue subagent run was flagged by the Claude Code harness with an [Auto Mode Bypass] security warning. I read the raw subagent transcript, and I believe the flag is a false positive on the harness side — but it is triggered by a real pattern in the plugin's prompt-assembly path that is worth changing, because it will keep re-tripping for other users.

Filing it here rather than treating it as a harness bug alone, since the plugin controls the pattern that provokes it.

The warning

Attached verbatim to the subagent's result:

The session searched for and attempted to read a hook script named block-hook-bypass.sh via multiple methods (cat, then node fs.readFileSync after apparent failure) and used node-based file writes through Bash as shell indirection to build the prompt file feeding this codex-companion invocation — a pattern of probing and tunneling around the classifier/hook system with no user confirmation that this is a false positive.

What the transcript actually shows

Two separate behaviors got fused into one narrative.

1. The block-hook-bypass.sh reads were classifier-directed, not evasive.

The subagent's cat of the hook script was denied by the auto-mode classifier. The denial message itself says:

You may attempt to accomplish this action using other tools that might naturally be used to accomplish this goal, e.g. using head instead of cat.

The node fs.readFileSync retry immediately after is the agent doing what the denial told it it was permitted to do. It then failed anyway with a plain ENOENT — the path did not exist on this platform (/tmp/plugin_root/... resolving to C:\tmp\plugin_root\... under Git Bash on Windows). So the escalation obtained nothing, and the "after apparent failure" framing describes compliance with the classifier's own guidance rather than circumvention of it.

2. The node-based file writes are the plugin's prompt-assembly path.

This is the part I think is actionable here. The run assembled its Codex prompt by shelling out to node -e "... fs.readFileSync/fs.writeFileSync ..." to concatenate an instruction file with a diff file. Functionally ordinary, but as a shape it is indistinguishable from shell indirection used to route around write hooks, which is what the classifier pattern-matches on.

It also isn't necessary. The composition is a file read, a string concat, and a file write.

Why this will recur

The trigger appears to be content-dependent. The diff being reviewed contained literal curl -sS -X POST ... example lines from the skill under review. Any review of security-adjacent content plausibly re-trips this, and the failure mode is bad in both directions: the user gets a scary warning for a benign run, and a genuinely suspicious run becomes easier to dismiss as "probably the known false positive."

Suggested change

Assemble the prompt file without routing through node -e in Bash. Writing the file directly — or passing the prompt via --prompt-file with content written by the plugin's own file APIs rather than by a shelled-out interpreter — removes the pattern the classifier keys on without changing behavior.

Separately, if the rescue agent needs to understand a hook that blocked it, retrying a denied read through a different interpreter is worth avoiding as a matter of policy even when the classifier's own message permits it. Reporting the block and stopping is the cleaner contract.

Environment

• Claude Code plugin codex@openai-codex, agent codex:codex-rescue
• Windows 11, Git Bash
• Incidental to this report: the run's first attempt failed on a missing codex-windows-sandbox-setup.exe in the active install path (confirmed via codex doctor), which is why the prompt-file path was exercised at all. Happy to file that separately if it isn't already known.

What I am not asking for

Not requesting that block-hook-bypass.sh or any hook path be allowlisted. The hook behaved correctly.

Start by locating the plugin's prompt-assembly path that shells out to node -e for fs.readFileSync and fs.writeFileSync, then inspect any tests covering prompt creation or Codex invocation. Done means the prompt is assembled without the Bash-launched Node pattern while preserving the existing prompt contents and invocation behavior.