hooks.md Codex Docs, 2026-03-31 06:35 UTC → 2026-04-15 06:44 UTC

225 225 

226### PreToolUse226### PreToolUse

227 227 

228Work in progress

229 

228Currently `PreToolUse` only supports Bash tool interception. The model can230Currently `PreToolUse` only supports Bash tool interception. The model can

229still work around this by writing its own script to disk and then running that231still work around this by writing its own script to disk and then running that

230script with Bash, so treat this as a useful guardrail rather than a complete232script with Bash, so treat this as a useful guardrail rather than a complete

231enforcement boundary.233enforcement boundary

234 

235This doesn't intercept all shell calls yet, only the simple ones. The newer

236 `unified_exec` mechanism allows richer streaming stdin/stdout handling of

237shell, but interception is incomplete. Similarly, this doesn’t intercept MCP,

238Write, WebSearch, or other non-shell tool calls.

232 239 

233`matcher` is applied to `tool_name`, which currently always equals `Bash`.240`matcher` is applied to `tool_name`, which currently always equals `Bash`.

234 241 

273 280 

274### PostToolUse281### PostToolUse

275 282 

283Work in progress

284 

276Currently `PostToolUse` only supports Bash tool results. It is not limited to285Currently `PostToolUse` only supports Bash tool results. It is not limited to

277commands that exit successfully: non-interactive `exec_command` calls can still286commands that exit successfully: non-interactive `exec_command` calls can still

278trigger `PostToolUse` when Codex emits a Bash post-tool payload. It cannot undo287trigger `PostToolUse` when Codex emits a Bash post-tool payload. It cannot undo

279side effects from the command that already ran.288side effects from the command that already ran.

280 289 

290This doesn't intercept all shell calls yet, only the simple ones. The newer

291 `unified_exec` mechanism allows richer streaming stdin/stdout handling of

292shell, but interception is incomplete. Similarly, this doesn’t intercept MCP,

293Write, WebSearch, or other non-shell tool calls.

294 

281`matcher` is applied to `tool_name`, which currently always equals `Bash`.295`matcher` is applied to `tool_name`, which currently always equals `Bash`.

282 296 

283Fields in addition to [Common input fields](#common-input-fields):297Fields in addition to [Common input fields](#common-input-fields):