Repository navigation
Second harness adapter: verify hook contracts for Gemini CLI, Codex, OpenCode, and Cursor #75
Description
Why
The incident reports are cross-vendor (Codex, Cline, and Gemini CLI as well as Claude Code), so a Claude Code-only hook caps who Nomos can protect. The parser and decision pipeline in internal/agenthook are harness-neutral; only the input and output contract differs.
Scope
- Verify from primary sources (the harness's own repository or documentation, with file path and quote) whether each candidate exposes a pre-tool hook that can return allow / deny / ask, how it is registered, the exact stdin and stdout shape, and whether it still blocks in auto-approve modes.
- Pick the first target by: a blocking pre-tool hook exists, it blocks in auto modes, install base, and contract similarity to Claude Code.
- Implement
nomos hook <harness>reusinginternal/agenthook, with contract tests and an adversarial review like the Claude Code hook had (docs/claude-code-hook.mddescribes the bar).
How to help
If you use one of these harnesses, post the verified contract details (link to the file in the harness repository, not a blog post). Marked UNVERIFIED items are not enough to build on.
Roadmap: milestone 4 in docs/roadmap.md.
Activity
safe-agentic-world commentedon Sep 26, 2026
Shipped in v0.16.0 (PR #81):
nomos hook codex, a CodexPreToolUseandPermissionRequesthook that reuses the shell parser, profiles, decision pipeline, and hash-chained audit of the Claude Code hook. Codex was chosen from the primary-source comparison of Gemini CLI, Codex, OpenCode, and Cursor because its hooks are Claude-shaped, on by default, and fire with approvals disabled.The contract was verified from
openai/codexate72da2b5and then reviewed adversarially against the same source; the review's fifteen findings and the re-verification's two remaining asks are closed on the PR. The adapter fails closed where Codex cannot ask (an ask is a deny by default, with the reason), never answers an approval prompt with allow (Codex routes retries outside the sandbox through the same prompt shape), and matches patch headers the way Codex's parser does.docs/codex-hook.mdhas the modes, the audit fields, and the limits.Still open, and stated in the guide: a live end-to-end run against a Codex binary like the Claude Code one in
docs/validation-claude-code-hook.md.On the other agents, from the same comparison: Gemini CLI has a blocking
BeforeToolhook that also fires in YOLO mode, so it is the natural next adapter (different tool names and output keys, a 60 second default timeout, and no permission-mode field). OpenCode would need a JavaScript plugin shim, because its pre-tool hook is an in-process plugin function rather than a command. Cursor'sbeforeShellExecutionhook exists, but its deny and ask values and its behavior in auto-run mode could not be verified from reachable primary sources.Edited: an earlier version of this comment said Gemini CLI, OpenCode, and Cursor lacked a blocking pre-tool decision. That was wrong for Gemini CLI, and the paragraph above replaces it.
Generated by Claude Code