Codex mutation-scope integration

.codex/hooks.json

@@ -1,5 +1,15 @@
 {
   "hooks": {
+    "Interrupt": [
+      {
+        "hooks": [
+          {
+            "command": "root=\"$(git rev-parse --show-toplevel 2>/dev/null)\" || exit 0; exec bash \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" sce hooks codex-mutation-scope",
+            "type": "command"
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "hooks": [
@@ -9,6 +19,15 @@
           }
         ],
         "matcher": "apply_patch"
+      },
+      {
+        "hooks": [
+          {
+            "command": "root=\"$(git rev-parse --show-toplevel 2>/dev/null)\" || exit 0; exec bash \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" sce hooks codex-mutation-scope",
+            "type": "command"
+          }
+        ],
+        "matcher": "^(Bash|apply_patch)$"
       }
     ],
     "PreToolUse": [
@@ -20,6 +39,25 @@
           }
         ],
         "matcher": "Bash"
+      },
+      {
+        "hooks": [
+          {
+            "command": "sce_deny(){ printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"SCE could not establish mutation attribution for this tool execution.\"}}'; exit 0; }; root=\"$(git rev-parse --show-toplevel 2>/dev/null)\" || sce_deny; test -r \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" || sce_deny; SCE_CODEX_PRE_TOOL_USE_FAIL_CLOSED=1 exec bash \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" sce hooks codex-mutation-scope",
+            "type": "command"
+          }
+        ],
+        "matcher": "^(Bash|apply_patch)$"
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "command": "root=\"$(git rev-parse --show-toplevel 2>/dev/null)\" || exit 0; exec bash \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" sce hooks codex-mutation-scope",
+            "type": "command"
+          }
+        ]
       }
     ],
     "Stop": [
@@ -30,6 +68,24 @@
             "type": "command"
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "command": "root=\"$(git rev-parse --show-toplevel 2>/dev/null)\" || exit 0; exec bash \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" sce hooks codex-mutation-scope",
+            "type": "command"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "command": "root=\"$(git rev-parse --show-toplevel 2>/dev/null)\" || exit 0; exec bash \"$root/.codex/hooks/run-sce-or-show-install-guidance.sh\" sce hooks codex-mutation-scope",
+            "type": "command"
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

.codex/hooks/run-sce-or-show-install-guidance.sh

@@ -1,6 +1,25 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+sce_pre_tool_use_deny() {
+  printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"SCE could not establish mutation attribution for this tool execution."}}'
+}
+
+if [ "${SCE_CODEX_PRE_TOOL_USE_FAIL_CLOSED:-0}" = "1" ]; then
+  if ! command -v sce >/dev/null 2>&1; then
+    echo "sce CLI not found. Install it from https://sce.crocoder.dev/docs/getting-started#install-cli" >&2
+    sce_pre_tool_use_deny
+    exit 0
+  fi
+  if ! adapter_output="$("$@")"; then
+    echo "SCE mutation-scope adapter failed; denying the tracked tool to preserve fail-closed PreToolUse." >&2
+    sce_pre_tool_use_deny
+    exit 0
+  fi
+  printf '%s' "$adapter_output"
+  exit 0
+fi
+
 if ! command -v sce >/dev/null 2>&1; then
   echo "sce CLI not found. Install it from https://sce.crocoder.dev/docs/getting-started#install-cli" >&2
   exit 0

cli/src/cli_schema.rs

@@ -329,6 +329,12 @@ pub enum HooksSubcommand {
         hide = true
     )]
     ClaudeMutationScope,
+
+    #[command(
+        about = "Run the Codex mutation-scope adapter (reads JSON payload from STDIN)",
+        hide = true
+    )]
+    CodexMutationScope,
 }
 
 #[derive(Subcommand, Debug, Clone, PartialEq, Eq)]