Allow UserPromptSubmit hooks to fail closed before model requests

Start with the UserPromptSubmit coverage in codex-hooks and the configRequirements/read path for Desktop and app-server consumers. Run the listed schema-generation and targeted package tests first. Done means the opt-in failure mode is represented in config and generated artifacts, trust hashing changes when it changes, and failed hooks prevent model requests without exposing sensitive prompt data.

What variant of Codex are you using?

Codex Desktop/App, app-server, and CLI. The motivating reproduction was on Windows with Codex 0.144.5; the proposed behavior was also implemented and validated against current main.

What feature would you like to see?

Add an opt-in fail-closed policy for UserPromptSubmit command hooks so a detector or policy hook can prevent prompt transmission when the hook itself fails.

Today, a UserPromptSubmit hook can reject a prompt through a valid blocking result, but Codex continues submission when the hook process crashes, times out, cannot be executed, or emits malformed output. That makes the hook unsuitable for local secret-paste prevention or similar pre-transmission policy checks: detector failure must not silently become permission to send the prompt.

A narrow configuration shape would be:

{
  "hooks": {
    "UserPromptSubmit": [
      {
        "matcher": "",
        "failureMode": "block",
        "hooks": [
          {
            "type": "command",
            "command": "path/to/local-detector"
          }
        ]
      }
    ]
  }
}

Proposed semantics:

• failureMode accepts continue or block.
• Omitted or continue preserves the existing fail-open behavior.
• block applies only to UserPromptSubmit; other events warn and remain fail-open.
• Nonzero exit, timeout, missing executable, malformed output, and event-serialization failure produce a redacted blocking diagnostic and no model request.
• The policy participates in hook trust hashing so changing it requires re-trust.
• Desktop/app-server config reads expose the effective value so UI and runtime state remain consistent.

This is the concrete blocking-policy part of the broader cross-surface hook goals tracked in #21753.

Additional information

I prepared a validated candidate implementation because external code contributions are invitation-only:

• Branch: https://github.com/AleZworks/codex/tree/codex/user-prompt-submit-fail-closed
• Compare: https://github.com/openai/codex/compare/main...AleZworks:codex/user-prompt-submit-fail-closed
• Commit: https://github.com/AleZworks/codex/commit/11c13c7

The candidate:

• implements the opt-in policy in config and the hook engine;
• carries it through configRequirements/read for Desktop/app-server consumers;
• regenerates config, JSON Schema, and TypeScript artifacts;
• adds unit and RPC coverage;
• adds a Linux core integration test that asserts a failed fail-closed UserPromptSubmit hook results in zero model requests.

Local validation completed:

• just write-config-schema
• just write-app-server-schema
• just test -p codex-app-server-protocol (262 passed)
• just test -p codex-config (205 passed)
• just test -p codex-hooks -E 'test(user_prompt_submit)' (8 passed)
• just test -p codex-hooks -E 'test(failure_mode_changes_hook_trust_hash)' (1 passed)
• just test -p codex-app-server -E 'test(config_requirements_read_includes_hook_failure_mode)' (1 passed)
• targeted just fix across affected crates
• cargo fmt --all

The core hooks integration suite is cfg-disabled on Windows and is intended to run in Linux CI.