Hook trust is not persisted across new interactive Codex sessions on Windows

Summary

Hook trust selected in the interactive TUI is not persisted across new interactive Codex sessions on Windows when Codex runs under an Orca-managed CODEX_HOME.

Environment

• Codex CLI: 0.149.0
• OS: Windows 11
• Launch context: Orca-managed terminal with a per-account CODEX_HOME

Reproduction

1. Configure two user command hooks: one PreToolUse hook and one PostToolUse hook.
2. Start a new interactive Codex session.
3. Open the hook review screen and trust each modified hook.
4. Confirm that the current session reports both hooks as Trusted.
5. Close that session and start a completely new interactive session.

Expected

Trusted hooks remain trusted across the new session.

Actual

The next session again displays 2 hooks are new or changed. Both hooks are reported as modified since the last trust decision.

During investigation, the active account config.toml and hook-trust provenance file received updated timestamps after the trust action, but their trust-state contents did not change. In the same process the hooks showed as trusted; only a fresh process reintroduced the review prompt.

Related

• #22847: hook trust persistence/write failure
• #32491: persisted hook trust ignored on a Windows execution path

Reproduce the issue on Windows with an Orca-managed CODEX_HOME, then inspect config.toml and the hook-trust provenance file after trusting both hooks. Compare their trust-state contents before and after the action and verify behavior in a fresh interactive process. Done means trusted hooks remain trusted without the next session reporting them as new or changed.