Codex Destructive Guard v1.2.1

Fixes a false positive where the word clean inside a quoted commit message could be mistaken for the destructive Git subcommand. The guard now tokenizes shell commands and identifies the actual Git subcommand while retaining protection across global options, environment assignments, command chains, subshells, wrappers, nested shells, and command substitutions. Includes the exact reported regression test and a safe commit check in a disposable repository.

Codex Destructive Guard v1.1.1

Codex Destructive Guard v1.1.1

This release resolves all blockers and hardening findings from the two
2026-07-16 pre-ship audits.

What changed

• Defines the real enforcement boundary: protection applies only when Codex
  routes a visible call through the installed, enabled, and trusted hook.
• Adds common destructive aliases across files, Git, Windows, Node.js,
  databases, cloud CLIs, infrastructure tools, and MCP operation fields.
• Replaces raw mass-UPDATE matching with multiline SQL scanning that ignores
  strings, comments, dollar quotes, and nested subquery predicates.
• Allows safe staging-only git restore --staged while retaining working-tree
  restore protection.
• Makes fallback install/update/uninstall ownership-aware, collision-safe,
  metadata-preserving, backup-first, and transactional with rollback.
• Adds the complete upstream MIT notice and correct derived/adapted provenance.
• Pins CI actions to immutable commits and adds a pinned Codex CLI plugin
  discovery/install/synthetic allow-deny integration job.
• Adds release-version, optimized-Python validator, checksum, ownership,
  rollback, and cross-platform regression tests.

Enforcement note

This is defense in depth, not a sandbox or backup system. It cannot protect an
action that Codex does not route through the active hook. Full Access does not
override a denial from a hook that runs, but it also does not make the hook a
system-wide enforcement boundary. Read the README and SECURITY.md limitations
before relying on it.

Verification

• Release commit: 17fd93918d41fe0cfe1f1fd55493c8276aac6195
• Signed annotated tag: v1.1.1 (SSH signature)
• Guard SHA-256: 6b60a7897f592241db5667eb684283856746baa9f7ac6219115dfaf8cb4fa81b
• Cross-platform CI: Windows, macOS, and Linux; Python 3.9 and 3.14
• Codex integration: @openai/codex@0.144.5

Recommended installation:

codex plugin marketplace add nuuxcode/codex-destructive-guard --ref v1.1.1
codex plugin add codex-destructive-guard@codex-destructive-guard

Then open /hooks, inspect the command, and explicitly trust the hook.

v1.0.1 and the unreleased v1.1.0 tag are superseded. Their tags were not
moved or rewritten.

Codex Destructive Guard v1.0.1

Warning

Superseded by v1.1.1.
Do not newly install or recommend v1.0.1. It has known command/MCP/SQL
coverage gaps, an ownership-unsafe fallback installer, incomplete upstream
license notice, and public claims broader than Codex's actual hook boundary.
The original tag remains unchanged for auditability.

Move repository ownership and all public installation, badge, clone, homepage,
and repository references from nuuxcode-arkx to the personal nuuxcode account.
The guard policy is unchanged from v1.0.0.

Codex Destructive Guard v1.0.0

Warning

Superseded by v1.1.1.
Do not newly install or recommend v1.0.0. Its broad fail-closed description
overstates the Codex hook boundary, and later audits found coverage,
installer-ownership, and license-notice issues corrected in v1.1.1. The
original tag remains unchanged for auditability.

Initial public release of a dependency-free Codex PreToolUse guard. Blocks a
set of common destructive file, Git, disk, database, infrastructure, cloud,
patch, and MCP operations when Codex routes the visible call through the
trusted hook. Includes GitHub marketplace installation, a fallback installer,
15 unit tests, cross-platform CI, security documentation, and uninstall
instructions.