From 458e4c0398136f82ac889e9662583092534d789c Mon Sep 17 00:00:00 2001 From: johnnyfish Date: Thu, 30 Jul 2026 13:51:41 -0700 Subject: [PATCH] fix(codex): shrink the SessionStart gateway banner to one line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex renders hook output verbatim in the thread and has no silent model-only channel (unlike Claude's additionalContext / systemMessage split), so the SessionStart gateway message is unavoidably user-visible. It was a 4-line briefing printed on every session start — intrusive. Collapse it to a single terse line that still does its two jobs: signal the gateway is active and cue the onecli-gateway skill (which the skill's own description says loads on this prompt). The detailed rules (no auth headers, curl-not-MCP, connect_url/blocked_by_policy/rate_limited error shapes) already live in that skill, so restating them in the transcript was pure duplication. Verified: npm run build + typecheck + full test suite green; the built hook now emits one line. --- plugins/codex/hooks/session-start.mjs | 6 +----- src/codex/session-start.mts | 19 +++++++++---------- 2 files changed, 10 insertions(+), 15 deletions(-) diff --git a/plugins/codex/hooks/session-start.mjs b/plugins/codex/hooks/session-start.mjs index cc331c2..df5aaf1 100755 --- a/plugins/codex/hooks/session-start.mjs +++ b/plugins/codex/hooks/session-start.mjs @@ -133,11 +133,7 @@ function printSetupRequired() { } function printActiveMessage() { process.stdout.write( - [ - "OneCLI Gateway active. Call external APIs directly (plain `curl`/`gh`); requests are routed through the gateway and credentials are injected automatically. Never add Authorization headers.", - "On errors: `connect_url` \u2192 show it to the user and retry after they connect; `blocked_by_policy` \u2192 report the rule, do not circumvent; `rate_limited` \u2192 wait `retry_after_secs`. Details: onecli-gateway skill.", - "" - ].join("\n") + "OneCLI Gateway active \u2014 call external APIs directly with plain curl/gh (no auth headers); load the onecli-gateway skill for details.\n" ); } async function main() { diff --git a/src/codex/session-start.mts b/src/codex/session-start.mts index aa62160..4388537 100644 --- a/src/codex/session-start.mts +++ b/src/codex/session-start.mts @@ -60,17 +60,16 @@ function printSetupRequired(): void { } function printActiveMessage(): void { - // Codex renders this context verbatim in the thread, so keep it terse. - // Detailed behavior (manual sourcing, error shapes) lives in the - // onecli-gateway skill. Do NOT suggest sourcing env.sh here: agents that - // prefix commands themselves bypass the PreToolUse auto-allow rewrite and - // trigger avoidable approval prompts. + // Codex renders hook output verbatim in the thread and has no silent + // model-only channel (unlike Claude's additionalContext), so this line is + // unavoidably user-visible. Keep it to ONE terse line: signal the gateway + // is active and point at the onecli-gateway skill, which carries the full + // rules (no auth headers, curl-not-MCP, error shapes) and is loaded on this + // cue. Do NOT restate those rules here or suggest sourcing env.sh (agents + // that prefix commands bypass the PreToolUse auto-allow and hit avoidable + // approval prompts). process.stdout.write( - [ - "OneCLI Gateway active. Call external APIs directly (plain `curl`/`gh`); requests are routed through the gateway and credentials are injected automatically. Never add Authorization headers.", - "On errors: `connect_url` → show it to the user and retry after they connect; `blocked_by_policy` → report the rule, do not circumvent; `rate_limited` → wait `retry_after_secs`. Details: onecli-gateway skill.", - "", - ].join("\n") + "OneCLI Gateway active — call external APIs directly with plain curl/gh (no auth headers); load the onecli-gateway skill for details.\n" ); }