Support PreToolUse updatedInput rewrites by abhinav-oai · Pull Request #20527 · openai/codex

abhinav-oai · 2026-04-30T23:35:11Z

Why

PreToolUse already exposes updatedInput in its hook output schema, but Codex currently rejects it instead of applying the rewrite. That leaves hook authors unable to make the documented pre-execution adjustment to a tool call before it runs.

What

Accept updatedInput from PreToolUse hooks when paired with permissionDecision: "allow".
Apply the rewritten input before dispatch so the tool executes the updated payload, not the original one.
Preserve the stable hook-facing compatibility shapes that participating tool handlers expose:
- Bash-like tools (shell, container.exec, local_shell, shell_command, exec_command) use { "command": ... }.
- apply_patch exposes its patch body through the same command-shaped hook contract.
- MCP tools expose their JSON argument object directly.
Keep each participating tool handler responsible for translating hook-facing updatedInput back into its concrete invocation shape.

Verification

Direct Bash-like rewrite coverage:

pre_tool_use_rewrites_shell_before_execution
pre_tool_use_rewrites_container_exec_before_execution
pre_tool_use_rewrites_local_shell_before_execution
pre_tool_use_rewrites_shell_command_before_execution
pre_tool_use_rewrites_exec_command_before_execution

These cases assert that each supported Bash-like surface runs only the rewritten command while the hook still observes the original { "command": ... } input.

pre_tool_use_rewrites_apply_patch_before_execution

Model emits one patch.
Hook swaps in a different patch.
Asserts only the rewritten file is created, and the hook saw the original patch.

pre_tool_use_rewrites_code_mode_nested_exec_command_before_execution

Model runs one nested shell command from code mode.
Hook rewrites it.
Asserts only the rewritten command runs, and the hook saw the original nested input.

pre_tool_use_rewrites_mcp_tool_before_execution

Model calls the RMCP echo tool.
Hook rewrites the MCP arguments.
Asserts the MCP server receives and returns the rewritten message, not the original one.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 61724ae083

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

# Conflicts: # codex-rs/core/src/tools/handlers/unified_exec.rs

abhinav-oai · 2026-05-06T18:49:39Z

@codex review

abhinav-oai · 2026-05-06T19:53:02Z

@codex review

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/hooks/src/events/pre_tool_use.rs

Lines 103 to 106 in 04ae865

    
           let results = dispatcher::execute_handlers( 
        
               shell, 
        
               matched, 
        
               input_json,

Re-run policy hooks against rewritten input

All matched PreToolUse hooks are launched with the single input_json serialized from the original request, and only after they finish is one updated_input selected. This lets one hook rewrite a command after other PreToolUse policy hooks have inspected only the old command, so the executed input can bypass blockers that would have denied the rewritten payload.

codex/codex-rs/core/src/tools/registry.rs

Lines 297 to 298 in 04ae865

    
           let payload_for_response = invocation.payload.clone(); 
        
           let log_payload = payload_for_response.log_payload();

Log the rewritten tool payload

log_payload is captured before PreToolUse can replace invocation.payload, but the later telemetry call logs this stale payload while the rewritten invocation is executed. Audit/telemetry records can therefore show a harmless original command even when hooks caused a different command or patch to run.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

abhinav-oai · 2026-05-06T20:02:04Z

codex/codex-rs/hooks/src/events/pre_tool_use.rs

Lines 103 to 106 in 04ae865

let results = dispatcher::execute_handlers(

shell,

matched,

input_json,

Re-run policy hooks against rewritten input

I think this is working as intended under the trust model for hooks

updatedInput is only produced by hooks the user has explicitly trusted and opted into
so permissionDecision: "allow" with an updatedInput is the hook author saying "allow this call, but execute the rewritten payload instead."

Re-running the same trusted PreToolUse hook set against that rewritten payload would add another pass, but it would not strengthen the boundary we are relying on here as the rewrite itself came from trusted hook code.

abhinav-oai · 2026-05-06T20:05:55Z

        let call_id_owned = invocation.call_id.clone();
        let otel = invocation.turn.session_telemetry.clone();
-        let payload_for_response = invocation.payload.clone();
-        let log_payload = payload_for_response.log_payload();


shifted this down so we log the rewritten tool payload

abhinav-oai · 2026-05-06T20:06:08Z

@codex review

chatgpt-codex-connector · 2026-05-06T20:10:05Z

Codex Review: Didn't find any major issues. Chef's kiss.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

abhinav-oai · 2026-05-06T21:28:26Z

@codex review

chatgpt-codex-connector · 2026-05-06T21:34:39Z

Codex Review: Didn't find any major issues. Delightful!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

eternal-openai

hmm, one substantial concern and two minor ones:

so an MCP tool like mcp__foo__exec_command has name = "exec_command" -> since we only switch on the name, we could mistake this MCP tool as being the real builtin one
hooks spec says that when multiple PreToolUse hooks rewrite input, the last one to finish wins, with nondeterministic ordering because the hooks run in parallel. This implementation instead makes the last configured hook always win, which is a spec mismatch
since the PR description says we only support updatedInput paired with "allow", bare "allow" should still be rejected until the actual allow semantics are implemented

…-input # Conflicts: # codex-rs/core/src/tools/handlers/apply_patch.rs # codex-rs/core/src/tools/handlers/apply_patch_tests.rs # codex-rs/core/src/tools/handlers/mcp.rs # codex-rs/core/src/tools/registry.rs

addressed feedback

support hook input rewrites

61724ae

abhinav-oai requested a review from a team as a code owner April 30, 2026 23:35

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread codex-rs/core/src/tools/events.rs Outdated

Comment thread codex-rs/core/src/tools/orchestrator.rs Outdated

Comment thread codex-rs/core/src/tools/network_approval.rs Outdated

abhinav-oai added 9 commits April 30, 2026 16:51

address hook rewrite review feedback

bcccc6c

simplify hook input rewrites

7932199

simplify hook rewrite helpers

b1ea712

merge main into hooks-updated-input

607d254

Merge remote-tracking branch 'origin/main' into HEAD

f2888ed

# Conflicts: # codex-rs/core/src/tools/handlers/unified_exec.rs

Merge branch 'main' into abhinav/hooks-updated-input

26651a0

Trust hook fixtures in rewrite tests

a417679

Split out PermissionRequest rewrites

2f423b1

Use the PR merge base for the split

c92387f

abhinav-oai changed the title ~~Support updatedInput hook rewrites~~ Support PreToolUse updatedInput rewrites May 6, 2026

abhinav-oai mentioned this pull request May 6, 2026

Support PermissionRequest updatedInput rewrites #21391

Closed

abhinav-oai added 3 commits May 6, 2026 11:25

Merge origin/main into hooks-updated-input pretool base

f8dbb08

Document hook input inversions

afa8cb9

Keep base handler result ordering unchanged

bbfa80c

This comment was marked as resolved.

Sign in to view

abhinav-oai added 2 commits May 6, 2026 12:11

Merge branch 'main' into abhinav/hooks-updated-input

108ecb0

support rewrites for legacy shell handlers

04ae865

chatgpt-codex-connector Bot reviewed May 6, 2026

View reviewed changes

Log rewritten tool payloads

786882a

abhinav-oai commented May 6, 2026

View reviewed changes

abhinav-oai added 2 commits May 6, 2026 13:20

Test code mode PreToolUse rewrites

173156b

Centralize pre-hook tool compatibility

1cd3e86

abhinav-oai added 2 commits May 6, 2026 14:24

Merge origin/main into abhinav/hooks-updated-input

ca7a4f3

Polish hook compatibility cleanup

be8d719

Move tool hook compatibility under hook runtime

5ecbcf6

eternal-openai previously requested changes May 8, 2026

View reviewed changes

Address updatedInput review feedback

240213a

abhinav-oai commented May 8, 2026

View reviewed changes

Comment thread codex-rs/core/src/hook_runtime/tool_compat.rs Outdated

Clarify non-MCP hook payload fallback

8cb4c6f

abhinav-oai requested a review from eternal-openai May 8, 2026 18:37

abhinav-oai added 5 commits May 8, 2026 14:41

Merge origin/main into abhinav/hooks-updated-input

1caf245

Merge remote-tracking branch 'origin/main' into abhinav/hooks-updated…

fba306e

…-input # Conflicts: # codex-rs/core/src/tools/handlers/apply_patch.rs # codex-rs/core/src/tools/handlers/apply_patch_tests.rs # codex-rs/core/src/tools/handlers/mcp.rs # codex-rs/core/src/tools/registry.rs

Move hook input rewrites back to handlers

1e479e0

Merge remote-tracking branch 'origin/main' into abhinav/hooks-updated…

8201584

…-input # Conflicts: # codex-rs/core/src/tools/handlers/apply_patch.rs # codex-rs/core/src/tools/handlers/apply_patch_tests.rs # codex-rs/core/src/tools/handlers/mcp.rs # codex-rs/core/src/tools/registry.rs

Trim updatedInput merge churn

ebbcdbd

github-actions Bot mentioned this pull request May 12, 2026

📊 AI CLI 工具社区动态日报 2026-05-12 gsscsd/big_model_radar#331

Open

pakrym-oai approved these changes May 12, 2026

View reviewed changes

Cover Bash-like updatedInput rewrites

7dcba7d

abhinav-oai enabled auto-merge (squash) May 12, 2026 02:14

abhinav-oai merged commit d08906a into main May 12, 2026
27 checks passed

abhinav-oai deleted the abhinav/hooks-updated-input branch May 12, 2026 02:27

github-actions Bot locked and limited conversation to collaborators May 12, 2026

	let results = dispatcher::execute_handlers(
	shell,
	matched,
	input_json,

	let payload_for_response = invocation.payload.clone();
	let log_payload = payload_for_response.log_payload();

Conversation

abhinav-oai commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Verification

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

abhinav-oai commented May 6, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

abhinav-oai commented May 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

abhinav-oai commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

abhinav-oai May 6, 2026

Choose a reason for hiding this comment

Uh oh!

abhinav-oai commented May 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 6, 2026

Uh oh!

abhinav-oai commented May 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 6, 2026

Uh oh!

eternal-openai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

abhinav-oai commented Apr 30, 2026 •

edited

Loading

abhinav-oai commented May 6, 2026 •

edited

Loading