Allow UserPromptSubmit hooks to fail closed before model requests

What variant of Codex are you using?

Codex Desktop/App, app-server, and CLI. The motivating reproduction was on Windows with Codex 0.144.5; the proposed behavior was also implemented and validated against current main.

What feature would you like to see?

Add an opt-in fail-closed policy for UserPromptSubmit command hooks so a detector or policy hook can prevent prompt transmission when the hook itself fails.

Today, a UserPromptSubmit hook can reject a prompt through a valid blocking result, but Codex continues submission when the hook process crashes, times out, cannot be executed, or emits malformed output. That makes the hook unsuitable for local secret-paste prevention or similar pre-transmission policy checks: detector failure must not silently become permission to send the prompt.

A narrow configuration shape would be:

{
  "hooks": {
    "UserPromptSubmit": [
      {
        "matcher": "",
        "failureMode": "block",
        "hooks": [
          {
            "type": "command",
            "command": "path/to/local-detector"
          }
        ]
      }
    ]
  }
}

Proposed semantics:

• failureMode accepts continue or block.
• Omitted or continue preserves the existing fail-open behavior.
• block applies only to UserPromptSubmit; other events warn and remain fail-open.
• Nonzero exit, timeout, missing executable, malformed output, and event-serialization failure produce a redacted blocking diagnostic and no model request.
• The policy participates in hook trust hashing so changing it requires re-trust.
• Desktop/app-server config reads expose the effective value so UI and runtime state remain consistent.

This is the concrete blocking-policy part of the broader cross-surface hook goals tracked in #21753.

Additional information

I prepared a validated candidate implementation because external code contributions are invitation-only:

• Branch: https://github.com/AleZworks/codex/tree/codex/user-prompt-submit-fail-closed
• Compare: https://github.com/openai/codex/compare/main...AleZworks:codex/user-prompt-submit-fail-closed
• Commit: https://github.com/AleZworks/codex/commit/11c13c7

The candidate:

• implements the opt-in policy in config and the hook engine;
• carries it through configRequirements/read for Desktop/app-server consumers;
• regenerates config, JSON Schema, and TypeScript artifacts;
• adds unit and RPC coverage;
• adds a Linux core integration test that asserts a failed fail-closed UserPromptSubmit hook results in zero model requests.

Local validation completed:

• just write-config-schema
• just write-app-server-schema
• just test -p codex-app-server-protocol (262 passed)
• just test -p codex-config (205 passed)
• just test -p codex-hooks -E 'test(user_prompt_submit)' (8 passed)
• just test -p codex-hooks -E 'test(failure_mode_changes_hook_trust_hash)' (1 passed)
• just test -p codex-app-server -E 'test(config_requirements_read_includes_hook_failure_mode)' (1 passed)
• targeted just fix across affected crates
• cargo fmt --all

The core hooks integration suite is cfg-disabled on Windows and is intended to run in Linux CI.