install writes a machine-absolute binary path into repo-tracked .codex/hooks.json (breaks other machines; emit PATH-based command)

[yotamleo]

Summary

graphify install (0.9.50, Windows, uv tool install) writes a machine-absolute binary path into the repo-tracked Codex hooks file .codex/hooks.json:

{
  "hooks": [
    { "command": "C:/Users/<user>/.local/bin/graphify.EXE hook-check", "type": "command" }
  ],
  "matcher": "Bash"
}

Why this is a problem

.codex/hooks.json is a repo-tracked, shared file (unlike per-user config). Committing the installer's output therefore:

1. Breaks every other machine/collaborator — the absolute path (C:/Users/<user>/..., the uv tool shim location) does not exist elsewhere; on machines without graphify the hook errors on every Bash tool call in Codex sessions.
2. Churns the file per machine — each machine that runs graphify install rewrites the entry with its local path, producing endless diffs in a shared enforcement file.
3. There is no fail-open guard: the command is invoked directly, so a missing binary is a hard hook failure rather than a no-op.

Suggested fix

• Emit a PATH-based command (graphify hook-check) — the uv shim directory is on PATH in the environments where install succeeds — or make the command template configurable.
• Optionally wrap with an existence guard so machines without graphify fail open (skip) instead of erroring.

Environment

• graphify 0.9.50 (graphifyy from PyPI, uv tool install --with mcp)
• Windows 11, Codex CLI 0.149.1
• Observed after graphify install refreshed harness integration files (.codex/hooks.json, AGENTS.md, GEMINI.md)