fix(codex): $PLUGIN_ROOT SessionStart hook + multi-host audit remediation (0.21.0)#65
Merged
Conversation
…tion (0.21.0)
Codex SessionStart hook was broken for installed plugins: the manifest used a
session-cwd-relative path that can't resolve once installed, and the auto-
discovered package hooks/hooks.json carried Gemini ${extensionPath}${/} tokens
that bash can't expand (GH #64, flow-9qx). Also resolves package skill drift and
modernizes host configs against the June 2026 platform state.
Codex hooks
- New hooks/hooks-codex.json + updated .codex/hooks.json anchor to
${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-.}} with the bun||node||bash ladder and a
FLOW_HOST=codex signal so both installed and in-repo project layers emit the
correct hookSpecificOutput payload.
- sync-codex-package.py emits the Codex-native manifest over the package's
auto-discovered hooks/hooks.json (Gemini still installs from the repo root).
- session-start.{sh,ps1} detect Codex (PLUGIN_ROOT/CODEX_PLUGIN_ROOT) before
Claude and honor an explicit FLOW_HOST override.
- New validate_codex_hook_commands guard: rejects Gemini tokens, requires
$PLUGIN_ROOT in every Codex-consumed manifest.
Package drift
- Regenerate plugins/flow/ from source: tool skills removed (62 -> 17) to match
the prior relocation commit.
Modernization
- opencode agents migrate boolean tools map -> permission object; validate-skills
accepts the new schema.
- Add Antigravity CLI target (docs/antigravity.md) reusing the Gemini assets.
- Add docs/host-conformance-matrix.md; refresh multi-host-plugin-patterns.md.
Version: minor bump 0.20.5 -> 0.21.0 via make release; 8 manifests in sync.
Tests: 53 passing; make check green.
claude plugin validate emits Unicode (✔/❯/⚠) that Windows' default cp1252 codec cannot decode, crashing the subprocess reader thread (and the stdout write-back). Force UTF-8 with errors=replace on both the capture and the script's own stdout/stderr streams.
This was referenced Jun 6, 2026
…s a skill" guards, grill planning Beads gating (#53) - Add the "Beads mode" gate to every command/skill/agent prompt that invokes bd (18 previously-ungated sites: flow-revert/validate, revert/task/revise TOMLs, flow/SKILL.md, flow-execution/flow-setup/flow-sync-status SKILLs, and the flow reference docs). Disabling Beads via useBeads=false is now honored everywhere, not just in detect-env. - New tests/test_beads_gating.py guards against regressions (per-file grep). Flow is a skill, not a CLI - The SessionStart context (detect-env.{sh,ps1}) and every instruction surface (CLAUDE.md, AGENTS.md, GEMINI.md, flow + lifecycle SKILLs) now state plainly that there is no `flow` binary; never run `flow sync`/`flow prd` as shell commands — invoke the skill or use /flow:* slash commands. /flow:sync semantics - Make explicit that /flow:sync ALWAYS writes the reconciled markdown to disk (mandatory) for EVERY markdown file under .agents/specs/<flow_id>/ (spec.md, learnings.md, ...), not just spec.md, and that "sync"/"export" means reconciling markdown <-> Beads to identical reality — never `bd dolt`. Grill-style planning (adopted from mattpocock/skills, not copied) - flow-planning gains an "Interrogate Before Finalizing (Grill)" discipline: one question at a time with recommended answers, explore the repo instead of asking, challenge against patterns.md/knowledge domain language, and treat the finished worksheet as a handoff. Pointers added to flow-refine/plan/prd. make check green; 54 tests pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the Codex SessionStart hook (#64) and the
useBeadsgating gap (#53), and lands a full multi-host audit remediation verified against the June 2026 state of every host. Releases 0.21.0.Fixes #64
Fixes #53
What changed
Codex SessionStart hook (#64)
hooks/hooks-codex.json+.codex/hooks.jsonanchor the command to${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-.}}with thebun || node || bashladder and aFLOW_HOST=codexsignal — no more Gemini${extensionPath}${/}tokens (bad substitution). Works for both installed-plugin and in-repo project layers.sync-codex-package.pyemits the Codex-native manifest over the package's auto-discoveredhooks/hooks.json. Newvalidate_codex_hook_commandsguard + tests.Beads gating (#53)
bd(18 previously-ungated sites). Disabling Beads viauseBeads=falseis honored everywhere, not just indetect-env.tests/test_beads_gating.pyguards against regressions.Flow is a skill, not a CLI
flowbinary; never runflow sync/flow prdas shell commands — use the skill or/flow:*./flow:sync semantics
/flow:syncALWAYS writes the reconciled markdown to disk (mandatory) for every markdown file under.agents/specs/<flow_id>/, not justspec.md. "Sync"/"export" means markdown ↔ Beads identical reality — neverbd dolt.Grill-style planning (adopted from mattpocock/skills, not copied)
flow-planninggains an "Interrogate Before Finalizing (Grill)" discipline (one question at a time, recommended answers, explore-the-repo-first, challenge against domain language, handoff-ready output). Pointers in flow-refine/plan/prd.Package drift + modernization + CI
plugins/flow/(tool skills 62 → 17). opencode agents →permission:object. Antigravity target (docs/antigravity.md) +docs/host-conformance-matrix.md. Force UTF-8 invalidate-claude-manifest.pyfor Windows runners.Validation
make checkgreen on the full matrix (ubuntu + windows × py3.11/3.12).Issue status
bdcalls in commands/skills onuseBeadsuserConfig #53 — fixed here (closes on merge).setup-state.jsonlookup ignoresagentsDiruserConfig #55 (setup-state.jsonagentsDir) — already resolved onmain(fix: triage bundle — agentsDir lookup, Codex legacy README, useBeads gate #59); closed.monitorsmanifest key for Beads-state file watcher #48 (monitorsmanifest key) — deferred to a follow-up (Claude-only enhancement; not in scope here).