The two Codex integrations are separate implementations. The reporter of #212
installed the Agent Skills route, but .codex/hooks.json is the one OpenAI's
hook documentation describes, and it carried the same defect: cwd relative
resolution, no absolute root binding, no ambiguity detection. Fixing only the
reported route would have left the bug live on the documented one.
Both Codex entry points now honour PWF_PLAN_ROOT, refuse an ambiguous cwd with
the same message, and emit the session refusal notice once per turn rather
than exiting silently. The Python adapter routes the shell helpers through the
pinned root so the resolver, the legacy task_plan.md fallback and the sessions
check all read the same place on POSIX and on Windows.
The Cursor hooks only ever supported a legacy root task_plan.md, so they
cannot hit the slug case, but they can hit the same shape when a root plan
sits above a nested project. They get the pin and the depth one check in both
the shell and PowerShell twins. Their warning names PWF_PLAN_ROOT only,
because that route implements no PLAN_ID hatch and naming one would be false
guidance.
Verified against the reporter's tree: before, the Codex hook injected the
parent's plan; after, it refuses with the ambiguity notice, and a pin injects
the nested plan. Legacy output is byte identical on both routes.
OthmanAdi