codex exec skips persisted trusted project hooks unless --dangerously-bypass-hook-trust is passed

Summary

On Codex CLI 0.144.1, noninteractive codex exec does not dispatch a project UserPromptSubmit hook that Codex app-server hooks/list reports as enabled and trusted. The same hook runs when --dangerously-bypass-hook-trust is supplied.

Reproduction

A repository has .codex/hooks.json with a UserPromptSubmit command hook that returns a blocking response. Persist trust for that project hook, then verify through app-server hooks/list:

• enabled: true
• trustStatus: trusted
• current hash matches the manifest
• no warnings/errors

From both repository root and a nested directory:

1. Run codex exec without --dangerously-bypass-hook-trust, using an invalid model slug so provider traffic is easy to distinguish.
2. The hook is skipped and the request reaches provider/model validation (HTTP 400).
3. Repeat with --dangerously-bypass-hook-trust.
4. The hook dispatches and blocks before provider traffic; the turn completes with zero input/output tokens.

Nested manifest discovery itself works: hooks/list returns the same trusted project hook key/hash from root and nested cwd.

Expected

A project hook reported as persisted rusted runs in codex exec without a dangerous trust-bypass flag. The bypass flag should remain an explicit override, not the only way to activate already-trusted hooks.

Actual

Persisted trust is ignored by noninteractive exec; the hook runs only with --dangerously-bypass-hook-trust.

Environment

• codex-cli 0.144.1
• Windows 11 / PowerShell
• Project UserPromptSubmit command hook

A privacy-preserving downstream reproduction is tracked at https://github.com/anthony-chaudhary/fak/issues/3939.