Add an emergency recovery fuse when a trusted PreToolUse hook blocks every tool in YOLO mode

[jyongchul]

What version of Codex CLI is running?

codex-cli 0.150.1

What subscription do you have?

ChatGPT-authenticated paid Codex CLI sessions. Billing/account identifiers are intentionally omitted from this public issue; a separate OpenAI Support request is being prepared.

Which model were you using?

gpt-5.6-sol

What platform is your computer?

Linux x86_64 (Ubuntu hosts accessed through Windows Terminal + SSH + tmux). The same operational failure was observed across multiple independently launched CLI sessions.

What issue are you seeing?

A trusted third-party plugin provides a PreToolUse hook whose auxiliary policy/router executable may become unavailable after a runtime update. Its emergency fallback returns a valid structured denial:

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "deny",
    "permissionDecisionReason": "Multi Server Sync Hook Router was not found; operation is not in the sealed local continuity allowlist"
  }
}

Codex correctly enforces that hook decision, but the result is an unrecoverable live TUI session: every shell/tool call needed to diagnose or repair the missing router is denied by the same hook. The UI repeatedly renders PreToolUse hook (blocked), and the agent cannot run even harmless commands such as pwd or git status.

The sessions were launched with both:

--dangerously-bypass-approvals-and-sandbox
--dangerously-bypass-hook-trust

The startup panel displays permissions: YOLO mode, but there is no obvious indication that YOLO does not override an already trusted hook's explicit deny decision. Users can therefore reasonably believe the session is unrestricted while a plugin hook can still make it completely unusable.

The supported restart workaround --disable hooks restores usability, but it requires knowing that flag and force-restarting/recreating each affected TUI/tmux session from outside the blocked session. In this incident, many paid CLI sessions were unusable for nearly a week before that escape path was identified.

The third-party plugin's fail-closed fallback is the direct root cause and is being fixed separately. This report asks for a Codex-side recovery fuse so one broken trusted hook cannot permanently brick a live session.

What steps can reproduce the bug?

1. Enable hooks and trust a PreToolUse hook.
2. Have that hook return the structured permissionDecision: "deny" response above for every tool call when an auxiliary file/process is missing.
3. Launch Codex TUI with:

   codex --dangerously-bypass-approvals-and-sandbox --dangerously-bypass-hook-trust
   

4. Ask Codex to run pwd, inspect a file, or repair the missing hook dependency.
5. Observe that every attempted recovery tool is denied and the live session has no visible emergency hook-disable action.

Minimal hook command:

python3 - <<'PY'
import json
print(json.dumps({
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "deny",
    "permissionDecisionReason": "probe: auxiliary router missing"
  }
}))
PY

What is the expected behavior?

Please provide at least one robust recovery path:

• an in-TUI command such as /hooks disable-for-session that remains available even when all tools are denied;
• a circuit breaker after repeated identical infrastructure-style hook denials, offering a restart with hooks disabled;
• a clear startup warning that YOLO bypasses approval/sandbox and hook trust review, but does not override trusted hook deny decisions;
• include the exact recovery command codex --disable hooks ... in repeated-block diagnostics.

A hook's deliberate deny should remain authoritative during normal operation. The request is specifically for an operator escape hatch when the hook itself is broken and prevents its own repair.

Additional information

Related reports/workarounds:

• --dangerously-bypass-hook-trust is ignored in TUI mode (codex 0.131.0–0.133.0): "Hooks need review" prompt still blocks startup #24093 documents --disable hooks as a startup workaround.
• Codex CLI 0.146.1: PyCharm terminal + macOS Documents + subagents can lose permissions and fail with invalid cwd (EPERM) #37229 reports successful recovery after setting [features] hooks = false.

No credentials, customer data, billing identifiers, private paths, or hook source have been included. Because the outage affected paid access for nearly a week, the account owner is separately requesting OpenAI Support to review a refund or service credit.