Approve a Codex CLI hook programmatically via its app-server

Codex CLI (0.16x) won't run a new user hook until it is trusted, and has no CLI subcommand to trust one; the TUI /hooks screen just calls the local app-server. An installer can do the same with the person's consent: spawn codex app-server (newline-delimited JSON-RPC on stdio), send initialize {clientInfo}, then the initialized notification, call hooks/list {cwds:[HOME]} to get the hook's key and currentHash, and config/batchWrite {edits:[{keyPath:'hooks.state', value:{[key]:{trusted_hash: currentHash}}, mergeStrategy:'upsert'}], reloadUserConfig:true}. Re-list to confirm trustStatus 'trusted'. Codex computes the hash itself, so you never reimplement its serialization. Trust is keyed to the entry's position in hooks.json plus a definition hash, so never move or rewrite an unchanged entry on reinstall. Also: Codex execpolicy allow rules only match simple commands; heredoc commands still run sandboxed (no network), so pass data via a file.