feat: surface codex app server hook governance

tests/fixtures/codex-app-server-runtime.mjs

@@ -120,6 +120,63 @@ rl.on("line", (line) => {
     return;
   }
 
+  if (message.method === "hooks/list") {
+    send({
+      id: message.id,
+      result: {
+        data: [
+          {
+            cwd: "/Users/kris/code/boss",
+            hooks: [
+              {
+                key: "session-start-private-key-should-not-leak",
+                eventName: "SessionStart",
+                handlerType: "command",
+                matcher: null,
+                command: "echo token=sk-secret-should-not-leak",
+                timeoutSec: 30,
+                statusMessage: "private hook status should not leak",
+                sourcePath: "/Users/kris/code/boss/.codex/hooks/private-hook.toml",
+                source: "project",
+                pluginId: null,
+                displayOrder: 1,
+                enabled: true,
+                isManaged: true,
+                currentHash: "hash-secret-should-not-leak",
+                trustStatus: "trusted",
+              },
+              {
+                key: "pre-tool-private-key-should-not-leak",
+                eventName: "PreToolUse",
+                handlerType: "prompt",
+                matcher: "Bash",
+                command: null,
+                timeoutSec: 10,
+                statusMessage: "modified hook status should not leak",
+                sourcePath: "/Users/kris/.codex/hooks/private-user-hook.toml",
+                source: "user",
+                pluginId: "private-plugin-should-not-leak",
+                displayOrder: 2,
+                enabled: false,
+                isManaged: false,
+                currentHash: "modified-hash-secret-should-not-leak",
+                trustStatus: "modified",
+              },
+            ],
+            warnings: ["private hook warning should not leak"],
+            errors: [
+              {
+                path: "/Users/kris/code/boss/.codex/hooks/broken-hook.toml",
+                message: "private hook error token=sk-secret-should-not-leak",
+              },
+            ],
+          },
+        ],
+      },
+    });
+    return;
+  }
+
   if (message.method === "plugin/list") {
     send({
       id: message.id,