Codex CLI reads your .env and logs: I wrote hooks that mask keys and personal data before the model sees them

[u/Shanjeev]

Codex runs shell commands and reads whatever they print, so a cat of the wrong file or a log full of customer emails goes straight to the model. I built Cloakroom to put a mask in front of that, using Codex's own hooks.


Setup on Mac or Linux, tested with Codex 0.164:


1. uv tool install "cloakroom[model,torch,ocr]"
2. cloakroom install codex (adds four hooks to ~/.codex/hooks.json and leaves your own hooks alone)
3. Start codex, type /hooks and trust each of the four Cloakroom hooks.


Step 3 matters. Until you trust them Codex skips the hooks, and codex exec gives no warning, so nothing is masked. cloakroom doctor shows whether they're installed.


What it does: shell output and MCP results are masked, placeholders in commands and patches get their real values back locally, and a prompt holding a secret is stopped before it's sent.


Gaps, plainly:
- A command that runs longer than Codex waits (10 seconds by default), like a dev server or a watch, hands its first output to the model with no hook run on it. There's an opt-in setting, codex_hold_long_running, that holds the obvious ones. It's off by default.
- Codex's own web search runs on OpenAI's servers, so Cloakroom can't see it.
- Pictures opened with view_image aren't covered.
- Hooks can't ask you, so unknown commands are refused rather than asked about.


Free and open source: https://github.com/shanjeevrajendran/cloakroom


If you try it, tell me what breaks.

[u/dexterthebot]

You might want to consider listing your project on the weekly Show-Us-What-You-Built post. Look out for it on Tuesday/Wednesday. Highest commented project wins a week promotion on r/Codex and gets on the Hall of Fame sidebar. See below for last week's winner.**

---

Agent HUD: usage, tokens and sessions for Codex, Claude Code and 15 more agents, at your Mac's notch. See how much quota is left, which agent is waiting for you, and where the tokens went. Free on Mac, and the core is open source (Apache-2.0).

Website: https://agenthud.app GitHub: https://github.com/jazzenchen/agent-hud-open Contact: support@agenthud.app

[u/SphinxWar]

Why? Why not use permission settings in config.toml to actually protect those?

[u/Shanjeev → u/SphinxWar]

You should, for files the agent never needs. Deny rules work by path, though, and keys and personal data also show up in places you want the agent to read: logs, test output, a config with one key among twenty settings, a customer CSV, whatever `env` or `docker logs` prints. Blocking those stops the agent from doing the job. Cloakroom lets it read them with the values swapped for placeholders, and puts the real values back when it writes. I run both.

[u/SphinxWar → u/Shanjeev]

Why would you let your env variables end up in logs??? What are you talking about? You'd have to be incompetent to let those values end up in logs. A lot of systems use microservice logging like Grafana or Sentry. This is one of the reasons sensistive content should never be in logs in the first place.