Repository navigation
Hook rewrite is shown but not applied on codex and the Gemini CLI #367
Description
A hook's rewrite of a tool call is shown, but the original runs, on codex and the Gemini CLI
A tool_call hook can rewrite a call's input before it is approved, for example to remove a dangerous part of a shell command. On the Claude backend the rewritten input is what runs. On codex and the Gemini CLI, codeoid answers the approval with only yes or no, and the backend runs the input it originally asked about.
So the approval card (web UI) and codeoid approve show the rewritten, safe input. If you approve, the original input runs.
The behaviour predates this issue. It became more visible once codeoid approve started showing the input the approval gate received (#366).
Expected: a hook rewrite either applies, or the call is refused with a clear reason. A rewrite should never be shown and then silently dropped.
For agents
Session#makeCanUseToolFn(src/daemon/session.ts) setseffectiveInputfromhookResult.updatedInputand returns it asupdatedInput.#applyHookInputMutationupdates the displayed tool message, and#approvalInputsstores the rewrite.- ACP (
src/daemon/providers/acp/index.ts, permission handler around:499) answers with anoptionIdonly. Codex (src/daemon/providers/codex/index.tsaround:746and:782) answersapproved/acceptonly. Neither forwardsupdatedInput. - Suggested fix: add a provider capability such as
honorsUpdatedInput. When a hook mutates input on a backend without it, deny with "hook rewrite isn't supported on " and audit the denial. - Test: a mutating hook on a codex or ACP mock should produce a deny, not an approve with the original input.
Activity