fix(codex): stop writing .codex/config.toml — hooks are on by default

[gtrrz-victor]

Summary

• entire enable --agent codex no longer writes or touches .codex/config.toml at all. The file only existed to set the hooks feature flag from when Codex hooks were experimental — hooks have been enabled by default since codex-cli 0.124.0 (Mark codex_hooks stable openai/codex#19012; the flag was renamed to hooks in 0.129.0 and now only exists as an opt-out). Not writing the file fixes entire enable --agent codex can create .codex/config.toml under ~/.codex/agents and trigger Codex warning #842 at the root: no TOML file is ever created inside Codex's reserved <CODEX_HOME>/agents tree, so Codex's agent-role scanner has nothing to reject.
• The CLI does not manage the file in any way — no flag write, no cleanup. A leftover .codex/config.toml written by an older entire version is harmless outside the reserved tree (the flag is a no-op) and must be removed manually inside it; the README documents this one-time rm.
• hooks.json keeps installing at the normal project-local path, unchanged.

This supersedes #1729 (scoped the flag into the global config under [projects."<repoRoot>".features] with locking and TOML-escaping — all unnecessary since the flag itself is obsolete, and its absolute-path scoping wouldn't survive a clone or move).

Verification

1. Default flip version: rust-v0.124.0 is the first codex release containing openai/codex@23afa173 ("Mark codex_hooks stable", default_enabled: true). Versions older than 0.124.0 only knew the codex_hooks key, so the hooks = true line main wrote was never recognized by them anyway — dropping the write loses nothing on any version.
2. Hooks fire with only hooks.json, no flag anywhere: verified live on codex-cli 0.144.4 in an isolated temp CODEX_HOME — codex exec logged hook: SessionStart … Completed and the hook's marker file was created.
3. Bug scenario end-to-end (isolated CODEX_HOME, real ~/.codex never written): repo under <CODEX_HOME>/agents with a leftover flag config.toml reproduces the malformed agent role definition warning; after entire enable from this branch (installs only hooks.json) and removing the leftover, the warning is gone.

Tests pin: fresh install creates hooks.json and no .codex/config.toml; an existing .codex/config.toml (user file or old-entire leftover) is left byte-identical.

• mise run fmt clean
• golangci-lint run — 0 issues
• mise run test:ci

Fixes #842

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bf89a54. Configure here.}

[Copilot]

Pull request overview

This PR updates the Codex agent hook installer to stop writing a project-local .codex/config.toml (the hooks feature flag is obsolete because Codex hooks are enabled by default), and adds a self-heal path to remove stale Entire-managed config files that can trigger Codex warnings when repos live under <CODEX_HOME>/agents.

Changes:

• Remove the feature-flag write path for .codex/config.toml during entire enable --agent codex.
• Add conservative cleanup that deletes .codex/config.toml only when it contains exclusively the legacy Entire-managed [features] + feature flag lines.
• Update/add regression tests to assert “no config.toml is created” and to cover stale-file cleanup and user-config preservation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
cmd/entire/cli/agent/codex/hooks.go	Stops writing .codex/config.toml and adds stale-config cleanup logic keyed to exact managed lines.
cmd/entire/cli/agent/codex/hooks_test.go	Updates assertions and adds tests for stale-file cleanup on fresh install and re-enable, while preserving user-authored configs.