codex-auto-approve 0.1.1

package/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "codex-auto-approve",
+  "interface": {
+    "displayName": "Codex Auto Approve"
+  },
+  "plugins": [
+    {
+      "name": "auto-approve",
+      "source": {
+        "source": "local",
+        "path": "./plugins/auto-approve"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 fuliucansheng
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,248 @@
+# Codex Auto Approve
+
+A small Codex plugin that can automatically allow supported permission
+requests. The switch is explicit, persistent, and **disabled by default**.
+
+> [!WARNING]
+> Enabling Auto Approve lets Codex proceed without asking you for every
+> supported permission request. Review the plugin and only enable it in an
+> environment you trust. Disable it as soon as you no longer need it.
+
+## Requirements
+
+- A recent version of Codex with plugin and hook support
+- Node.js 22 or newer, with `node` on `PATH`
+
+## Install the Codex plugin
+
+Add this repository as a Codex plugin marketplace, then install the plugin:
+
+```sh
+codex plugin marketplace add fuliucansheng/codex-auto-approve
+codex plugin add auto-approve@codex-auto-approve
+```
+
+The marketplace ships the prebuilt `scripts/auto_approve.js` controller inside
+the plugin. Installation needs only Node.js: no `npm install`, build step,
+`tsx`, or `ts-node` is needed. The plugin has no production dependencies, and
+its local `package.json` keeps the JavaScript runnable regardless of a parent
+package's module type.
+
+Start a new Codex conversation after installation so the skill and hook are
+loaded. You can inspect the installed hook with `/hooks`.
+
+## npm CLI
+
+Once the package is published to npm, install the command globally:
+
+```sh
+npm install -g codex-auto-approve
+codex-auto-approve status
+codex-auto-approve enable
+codex-auto-approve disable
+```
+
+Or run without a global installation:
+
+```sh
+npx --yes codex-auto-approve status
+npx --yes codex-auto-approve enable
+npx --yes codex-auto-approve disable
+```
+
+Node.js 22 or newer is required. The npm package includes prebuilt JavaScript
+and has no production dependencies or consumer build step. Installing the CLI
+alone **does not register Codex hooks or skills**; use the marketplace
+installation above for integration with Codex. Both interfaces control the
+same local switch. The tarball also preserves the root
+`.agents/plugins/marketplace.json` descriptor and the complete
+`plugins/auto-approve` directory layout for marketplace use.
+
+## Use
+
+Invoke the bundled skill in Codex:
+
+```text
+$auto-approve status
+$auto-approve enable
+$auto-approve disable
+```
+
+Type `$` in the composer to select the skill, or find it through `/skills`.
+`$auto-approve` is a plugin skill mention, not a built-in slash command.
+
+The actions are:
+
+- `status`: show whether automatic approval is enabled.
+- `enable`: automatically allow all supported `PermissionRequest` events.
+- `disable`: return to the normal Codex approval flow.
+
+The skill runs the bundled Node.js controller. `status` exits with code 0 when
+enabled and 1 when disabled. Successful `enable` and `disable` actions exit 0;
+invalid arguments exit 2 and write usage to stderr. Filesystem errors during
+enable or disable exit 1 and write an error to stderr.
+
+## Update
+
+```sh
+codex plugin marketplace upgrade codex-auto-approve
+codex plugin add auto-approve@codex-auto-approve
+```
+
+Start a new Codex conversation after updating.
+
+## Uninstall
+
+Disable Auto Approve first, then remove the plugin and marketplace:
+
+```text
+$auto-approve disable
+```
+
+```sh
+codex plugin remove auto-approve@codex-auto-approve
+codex plugin marketplace remove codex-auto-approve
+```
+
+## How it works
+
+The controller stores the enabled state at:
+
+```text
+~/.local/state/codex-auto-approve/enabled.json
+```
+
+Only an object containing `"enabled": true` enables the bundled
+`PermissionRequest` hook, which returns an `allow` decision. Existing
+`enabled.json` files remain compatible. Missing, unreadable, malformed, or
+non-object state fails closed, as do other enabled values such as `"true"` or
+`1`. Invalid hook input silently does nothing. Status and hook calls never
+create or repair state; only an explicit enable action writes the switch.
+
+On filesystems supporting POSIX modes, newly created state directories use
+`0700` and the state file uses `0600`. Disable removes only `enabled.json` and
+is safe to repeat.
+
+The hook only covers permission requests exposed to Codex lifecycle hooks,
+including supported shell, file-edit, and MCP tool requests. Some Computer Use
+and app-level confirmations are always shown directly to the user and cannot
+be auto-approved by this plugin. Managed workspace policy can also limit what
+the plugin is allowed to approve.
+
+## Local development
+
+[src/auto_approve.ts](src/auto_approve.ts) is the canonical source. `tsc`
+compiles it to the checked-in
+[plugins/auto-approve/scripts/auto_approve.js](plugins/auto-approve/scripts/auto_approve.js).
+Include the regenerated JavaScript with every source change so marketplace
+copies remain ready to run. The root development dependencies are only the
+TypeScript compiler and Node type definitions.
+
+```sh
+npm ci
+npm run build
+npm run typecheck
+npm test
+git diff --check
+```
+
+Tests use Node's built-in test/assert modules and execute the compiled CLI in
+child processes, including a standalone copy of the plugin in a path with
+spaces. The test runner and every controller invocation use isolated temporary
+`HOME` and `USERPROFILE` directories. Build before testing source changes;
+`npm test` checks the shipped JavaScript and runs real `npm pack`, offline
+installation into a separate temporary global prefix, executable CLI and
+standalone plugin smoke tests, and credential-free `npm publish --dry-run`.
+Package tests check exact tarball contents, metadata, executable mode, version
+parity, and absence of source, developer scripts, and runtime dependencies.
+Only `prepack` rebuilds (`npm run build`); it never runs tests, avoiding recursion.
+Package tests use empty temporary npm configs and a separate cache as well as
+an isolated home. Release validator behavior tests cover matching versions,
+mismatches, malformed tags, and rejection of prereleases.
+
+CI runs these checks on Node.js 22 and 24 on Linux and macOS and rejects drift
+between the source and checked-in JavaScript. POSIX mode checks skip on
+Windows; permission-denial checks also skip when run as root.
+
+## npm releases
+
+Publishing requires a maintainer with permission to publish the npm package
+and manage this repository's GitHub Actions settings. Configure trusted
+publishing or the first-publication bootstrap described below before releasing.
+The npm installation commands above require a successful publication first.
+
+The [publish workflow](.github/workflows/publish-npm.yml) runs **only** when a
+GitHub release is published. It skips releases marked as prereleases and
+requires a stable, canonical `vX.Y.Z` tag. Prerelease versions and build metadata
+do not publish, even if the GitHub release is incorrectly marked stable. PRs
+and ordinary branch pushes never trigger npm publication.
+
+Keep these versions identical when preparing a release (currently `0.1.1`):
+
+- Root `package.json`
+- `package-lock.json`: top-level `version` and `packages[""].version`
+- `plugins/auto-approve/package.json`
+- `plugins/auto-approve/.codex-plugin/plugin.json`
+
+After updating the manifests, refresh the lockfile with
+`npm install --package-lock-only`, then run:
+
+```sh
+npm ci
+npm run build
+npm run typecheck
+npm test
+npm run validate:release -- v0.1.1
+git diff --exit-code -- plugins/auto-approve/scripts/auto_approve.js
+git diff --check
+```
+
+Use the intended version in the validation command for future releases.
+Include regenerated JavaScript with source changes. After reviewing and merging
+the release changes, tag that exact commit with the matching `vX.Y.Z` and
+publish a stable GitHub release for that tag. npm versions are immutable;
+fixes after publication require a new version and tag.
+
+The workflow checks out the exact release tag, verifies all version fields,
+installs dependencies, builds, typechecks, tests, and rejects generated artifact
+drift. Tests retain their installed and inspected archive using
+`NPM_TEST_PACK_DESTINATION`; the publish step sends that same tarball with
+`--access public --provenance`. Release publish jobs are serialized.
+
+### Trusted publishing and first-publication bootstrap
+
+Publishing uses a GitHub-hosted Ubuntu runner with Node.js 24 and explicitly
+pinned npm 11.6.2. npm trusted publishing requires npm **11.5.1 or newer** and
+Node.js **22.14.0 or newer**; this is separate from the CLI's Node.js 22 runtime
+minimum. The workflow grants only `contents: read` and `id-token: write`.
+
+Once the package exists, open its npm settings and add a **GitHub Actions**
+Trusted Publisher with these exact fields:
+
+| Field | Value |
+| --- | --- |
+| Organization or user | `fuliucansheng` |
+| Repository | `codex-auto-approve` |
+| Workflow filename | `publish-npm.yml` |
+| Environment | Leave blank (the workflow has no environment) |
+| Allowed actions (if shown) | Allow direct publishing with `npm publish` |
+
+No npm token is needed after that mapping is configured. The workflow uses npm
+OIDC automatically when `secrets.NPM_TOKEN` is absent. As recommended by the
+[npm trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/),
+the release workflow does not restore or save dependency caches.
+
+For the first publication, the package does not yet have settings for a trusted
+publisher. An authorized maintainer can create a short-lived granular npm token
+with permission to create/publish this package (and bypass 2FA for automation),
+then add it as the repository Actions secret **`NPM_TOKEN`**. The same workflow
+uses it only in the publish step as an optional bootstrap fallback. After the
+first successful stable release, configure the Trusted Publisher mapping,
+remove the repository secret, and revoke the bootstrap token. Subsequent
+releases use OIDC. Do not put tokens in repository files. These setup steps
+must be performed by a maintainer; a dry run verifies packaging, not registry
+authorization or successful publication.
+
+## License
+
+[MIT](LICENSE)

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "codex-auto-approve",
+  "version": "0.1.1",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "node scripts/test.mjs",
+    "prepack": "npm run build",
+    "validate:release": "node scripts/validate-release-version.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^22.18.0",
+    "typescript": "~5.9.3"
+  },
+  "description": "Explicitly toggle automatic approval for supported Codex permission requests.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fuliucansheng/codex-auto-approve.git"
+  },
+  "homepage": "https://github.com/fuliucansheng/codex-auto-approve#readme",
+  "keywords": [
+    "codex",
+    "plugin",
+    "permissions",
+    "automation"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "bin": {
+    "codex-auto-approve": "plugins/auto-approve/scripts/auto_approve.js"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    ".agents/plugins/marketplace.json",
+    "plugins/auto-approve/README.md",
+    "plugins/auto-approve/package.json",
+    "plugins/auto-approve/.codex-plugin/plugin.json",
+    "plugins/auto-approve/hooks/hooks.json",
+    "plugins/auto-approve/skills/",
+    "plugins/auto-approve/scripts/auto_approve.js"
+  ]
+}

package/plugins/auto-approve/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "auto-approve",
+  "version": "0.1.1",
+  "description": "Explicitly toggle automatic approval for supported Codex permission requests.",
+  "author": {
+    "name": "fuliucansheng",
+    "email": "fuliucansheng@gmail.com",
+    "url": "https://github.com/fuliucansheng"
+  },
+  "homepage": "https://github.com/fuliucansheng/codex-auto-approve#readme",
+  "repository": "https://github.com/fuliucansheng/codex-auto-approve",
+  "license": "MIT",
+  "keywords": [
+    "codex",
+    "plugin",
+    "permissions",
+    "automation"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Auto Approve",
+    "shortDescription": "Toggle automatic approvals from Codex.",
+    "longDescription": "Auto Approve allows supported Codex PermissionRequest events only while its explicit local switch is enabled. Control it inside Codex with the bundled $auto-approve skill.",
+    "developerName": "fuliucansheng",
+    "category": "Productivity",
+    "capabilities": [
+      "Approve"
+    ],
+    "websiteURL": "https://github.com/fuliucansheng/codex-auto-approve",
+    "defaultPrompt": [
+      "Use $auto-approve status to show the current automatic approval status."
+    ]
+  }
+}

package/plugins/auto-approve/README.md

@@ -0,0 +1,63 @@
+# Auto Approve
+
+Auto Approve is a Codex plugin that automatically allows supported permission
+requests only while you have explicitly enabled it. It is disabled by default.
+
+## Requirements
+
+- A recent version of Codex with plugin and hook support
+- Node.js 22 or newer, with `node` on `PATH`
+
+## Install
+
+```sh
+codex plugin marketplace add fuliucansheng/codex-auto-approve
+codex plugin add auto-approve@codex-auto-approve
+```
+
+The plugin includes the prebuilt `scripts/auto_approve.js` controller and has
+no production dependencies. Marketplace installations run directly with
+Node.js; no `npm install`, build step, `tsx`, or `ts-node` is needed. Keep the
+entire plugin directory, including its local `package.json`, so it also works
+under a parent package configured as an ES module.
+
+Start a new Codex conversation after installation and inspect the bundled
+`PermissionRequest` hook with `/hooks`.
+
+## Use inside Codex
+
+```text
+$auto-approve status
+$auto-approve enable
+$auto-approve disable
+```
+
+Type `$` to select the skill, or select it through `/skills`. This is a plugin
+skill rather than a new built-in slash command.
+
+> [!WARNING]
+> While enabled, all supported permission requests are allowed without the
+> normal confirmation prompt. Only enable it in an environment you trust.
+
+The hook covers permission requests exposed to Codex lifecycle hooks,
+including supported shell, file-edit, and MCP tool requests. Some Computer Use
+and app-level confirmations cannot be auto-approved by this plugin.
+
+The switch remains at `~/.local/state/codex-auto-approve/enabled.json` and is
+compatible with existing state files. Only the boolean `true` in an object's
+`enabled` field enables approval. Missing, unreadable, malformed, or non-object
+state fails closed; malformed or non-object hook input silently does nothing.
+Only explicit enable writes state, and disable is safe to repeat. On POSIX
+filesystems, new state directories use `0700` and the file uses `0600`.
+
+`status` exits 0 when enabled and 1 when disabled. Successful enable/disable
+actions exit 0, filesystem write failures exit 1, and invalid arguments exit 2.
+
+## Development
+
+In a repository clone, edit `src/auto_approve.ts`, then run `npm ci`,
+`npm run build`, `npm run typecheck`, and `npm test` from the repository root.
+Include the regenerated `plugins/auto-approve/scripts/auto_approve.js` with
+source changes. Tests execute the compiled controller with isolated temporary
+`HOME` and `USERPROFILE` directories. CI checks Node.js 22/24 on Linux/macOS
+and verifies that the checked-in JavaScript matches the TypeScript source.

package/plugins/auto-approve/hooks/hooks.json

@@ -0,0 +1,16 @@
+{
+  "description": "Allow permission requests only while the user-controlled switch is enabled.",
+  "hooks": {
+    "PermissionRequest": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/scripts/auto_approve.js\" hook",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/auto-approve/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "codex-plugin-auto-approve",
+  "version": "0.1.1",
+  "private": true,
+  "type": "commonjs",
+  "engines": {
+    "node": ">=22"
+  }
+}

package/plugins/auto-approve/scripts/auto_approve.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+"use strict";
+// Source: src/auto_approve.ts. Rebuild with npm run build; do not edit the JS.
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+const stateDirectory = (0, node_path_1.join)((0, node_os_1.homedir)(), '.local', 'state', 'codex-auto-approve');
+const stateFile = (0, node_path_1.join)(stateDirectory, 'enabled.json');
+// Reject invalid UTF-8 and preserve a BOM so JSON.parse rejects it too.
+const decoder = new node_util_1.TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+function readObject(source) {
+    try {
+        const payload = JSON.parse(decoder.decode((0, node_fs_1.readFileSync)(source)));
+        if (typeof payload === 'object' && payload !== null && !Array.isArray(payload)) {
+            return payload;
+        }
+    }
+    catch {
+        // Missing, unreadable, and malformed input must never authorize anything.
+    }
+    return undefined;
+}
+function isEnabled() {
+    return readObject(stateFile)?.enabled === true;
+}
+function enable() {
+    (0, node_fs_1.mkdirSync)(stateDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.writeFileSync)(stateFile, '{"enabled":true}\n', { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(stateFile, 0o600);
+    console.log('Auto Approve: enabled (all supported permission requests are allowed).');
+}
+function disable() {
+    try {
+        (0, node_fs_1.unlinkSync)(stateFile);
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+            throw error;
+        }
+    }
+    console.log('Auto Approve: disabled (Codex will request approval normally).');
+}
+function status() {
+    const enabled = isEnabled();
+    console.log(`Auto Approve: ${enabled ? 'enabled' : 'disabled'}`);
+    return enabled ? 0 : 1;
+}
+function runHook() {
+    const event = readObject(0);
+    if (event?.hook_event_name !== 'PermissionRequest' || !isEnabled()) {
+        return 0;
+    }
+    try {
+        (0, node_fs_1.writeFileSync)(1, JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PermissionRequest',
+                decision: { behavior: 'allow' },
+            },
+        }) + '\n');
+    }
+    catch {
+        // A closed or unwritable output stream must also leave the hook silent.
+    }
+    return 0;
+}
+function usage() {
+    console.error('Usage: auto_approve.js {enable|disable|status}');
+    return 2;
+}
+function main() {
+    if (process.argv.length !== 3)
+        return usage();
+    const command = process.argv[2];
+    try {
+        switch (command) {
+            case 'enable':
+                enable();
+                return 0;
+            case 'disable':
+                disable();
+                return 0;
+            case 'status':
+                return status();
+            case 'hook':
+                return runHook();
+            default:
+                return usage();
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`Auto Approve: ${command} failed: ${message}`);
+        return 1;
+    }
+}
+process.exitCode = main();

package/plugins/auto-approve/skills/auto-approve/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: auto-approve
+description: Control the installed Auto Approve plugin by enabling, disabling, or inspecting automatic approval of supported Codex permission requests. Use when the user explicitly invokes $auto-approve with enable, disable, or status.
+---
+
+# Auto Approve Control
+
+Control the plugin's persistent local switch with its bundled controller.
+Requires Node.js 22 or newer on `PATH`. The JavaScript controller is prebuilt;
+no dependency installation or build step is needed.
+
+1. Read the requested action immediately following the skill mention. Accept only `enable`, `disable`, or `status`. If no action is present, use `status`.
+2. Resolve `../../scripts/auto_approve.js` from the directory containing this `SKILL.md`; do not resolve it from the session working directory.
+3. Run `node "<resolved-controller-path>" <action>` once.
+4. Report the controller's output exactly and briefly explain the resulting state.
+
+Treat an explicit `$auto-approve enable` invocation as authorization to enable the switch without an additional confirmation. Never infer `enable` from vague wording, never substitute it for `status`, and never edit the state file directly. If the action is unsupported, do not run the controller; show the accepted syntax instead.

package/plugins/auto-approve/skills/auto-approve/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Auto Approve"
+  short_description: "Toggle automatic Codex permission approvals"
+  default_prompt: "Use $auto-approve to show or change automatic approval status."
+policy:
+  allow_implicit_invocation: false