{"title":"Can Codex Hook Policies See the Tool Calls They Claim to Govern?","description":"The checked source supports a bounded finding: hooks cover most enumerated static built-in handler types, but selective exclusions and hosted paths mean they are not a complete action-governance boundary.","dataset_id":"spd:can-codex-hook-policies-see-the-tool-calls-they-claim-to-govern-8a8262f1","canonical_url":"https://superpowerdaily.com/research/can-codex-hook-policies-see-the-tool-calls-they-claim-to-govern-8a8262f1","version_url":"https://superpowerdaily.com/research/can-codex-hook-policies-see-the-tool-calls-they-claim-to-govern-8a8262f1","version":"v1","snapshot_hash":"d455d419790e82f2b5879927458406d9cf1812837b9c0e48ac98c1b762c1cd33","date_created":"2026-09-20T15:40:31.734Z","date_modified":"2026-09-20T15:40:31.734Z","license":{"name":"Superpower Daily data reuse terms","url":"https://superpowerdaily.com/terms"},"license_url":"https://superpowerdaily.com/terms","temporal_coverage":"2026-09-20","coverage_note":"The matrix is a handler-type capability audit, not a measure of tools enabled in one deployment, successful hook execution in every product surface, or end-to-end policy effectiveness. V1 and V2 agent handlers are mutually exclusive at runtime.","measurement_technique":["Evidence matrix plan: use the source-defined inventory of static built-in CoreToolRuntime handler types as the denominator; exclude external MCP tools, dynamic tools, extension tools, and hosted WebSearch specifications.","Classify each handler by source-level capability to emit PreToolUse, emit PostToolUse, and accept pre-hook argument rewriting.","Separate local registry-dispatched function tools from specialized control surfaces and hosted tool specifications.","Preserve the September 20, 2026 cutoff and treat the recovered main-branch snapshot as a bounded source review, not a new collection or execution.","Compare the implementation boundary with official hooks documentation, while keeping Desktop- or plugin-owned paths distinct from registry-path capability."],"methodology":["Evidence matrix plan: use the source-defined inventory of static built-in CoreToolRuntime handler types as the denominator; exclude external MCP tools, dynamic tools, extension tools, and hosted WebSearch specifications.","Classify each handler by source-level capability to emit PreToolUse, emit PostToolUse, and accept pre-hook argument rewriting.","Separate local registry-dispatched function tools from specialized control surfaces and hosted tool specifications.","Preserve the September 20, 2026 cutoff and treat the recovered main-branch snapshot as a bounded source review, not a new collection or execution.","Compare the implementation boundary with official hooks documentation, while keeping Desktop- or plugin-owned paths distinct from registry-path capability."],"metrics":[{"label":"Verified observations","value":"4","detail":"4 measured fields"},{"label":"Supported claims","value":"8","detail":"8 material findings"},{"label":"Cited sources","value":"7","detail":"6 primary or authoritative"},{"label":"Research score","value":"85","detail":"Automated topic and evidence score"}],"columns":[{"key":"entity","label":"Entity"},{"key":"metric","label":"Metric"},{"key":"value","label":"Value"},{"key":"unit","label":"Unit"},{"key":"observed","label":"Observed"},{"key":"source","label":"Source"},{"key":"transform","label":"Transform"}],"data":[{"unit":"percent","value":"30 of 34 (88.2%)","entity":"Codex static built-in CoreToolRuntime types","metric":"both_pre_and_post_hook_capable","source":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/registry.rs","observed":"2026-09-20","transform":"Counted handlers capable of emitting both payloads; divided 30 by 34 and multiplied by 100."},{"unit":"handler_types","value":"34","entity":"Codex static built-in CoreToolRuntime types","metric":"handlers_enumerated","source":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/spec_plan.rs","observed":"2026-09-20","transform":"Counted unique static built-in handler types registered by spec_plan.rs, including both V1 and V2 orchestration variants and excluding external MCP, dynamic, extension and hosted tools."},{"unit":"percent","value":"31 of 34 (91.2%)","entity":"Codex static built-in CoreToolRuntime types","metric":"post_tool_hook_capable","source":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/registry.rs","observed":"2026-09-20","transform":"(34 total handlers - 3 handlers without PostToolUse payloads) / 34 * 100."},{"unit":"percent","value":"30 of 34 (88.2%)","entity":"Codex static built-in CoreToolRuntime types","metric":"pre_tool_hook_capable","source":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/registry.rs","observed":"2026-09-20","transform":"(34 total handlers - 4 handlers without PreToolUse payloads) / 34 * 100."}],"sources":[{"url":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/code_mode/execute_handler.rs","name":"OpenAI","title":"codex/codex-rs/core/src/tools/code_mode/execute_handler.rs at main · openai/codex","records":0},{"url":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/code_mode/wait_handler.rs","name":"OpenAI","title":"codex/codex-rs/core/src/tools/code_mode/wait_handler.rs at main · openai/codex","records":0},{"url":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs","name":"OpenAI","title":"codex/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs at main · openai/codex","records":0},{"url":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/registry.rs","name":"OpenAI","title":"codex/codex-rs/core/src/tools/registry.rs at main · openai/codex","records":3},{"url":"https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/spec_plan.rs","name":"OpenAI","title":"codex/codex-rs/core/src/tools/spec_plan.rs at main · openai/codex","records":1},{"url":"https://developers.openai.com/codex/hooks","name":"OpenAI","title":"Hooks | ChatGPT Learn","records":0},{"url":"https://github.com/openai/codex/issues/44707","name":"GitHub user report in OpenAI repository","title":"[Windows Desktop] create_thread bypasses disabled_tools and trusted PreToolUse hook, freezes UI, and hides the child task · Issue #44707 · openai/codex","records":0}],"provenance":{"publisher":"Superpower Daily","source_count":7,"source_urls":["https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/code_mode/execute_handler.rs","https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/code_mode/wait_handler.rs","https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs","https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/registry.rs","https://github.com/openai/codex/blob/main/codex-rs/core/src/tools/spec_plan.rs","https://developers.openai.com/codex/hooks","https://github.com/openai/codex/issues/44707"],"methodology":["Evidence matrix plan: use the source-defined inventory of static built-in CoreToolRuntime handler types as the denominator; exclude external MCP tools, dynamic tools, extension tools, and hosted WebSearch specifications.","Classify each handler by source-level capability to emit PreToolUse, emit PostToolUse, and accept pre-hook argument rewriting.","Separate local registry-dispatched function tools from specialized control surfaces and hosted tool specifications.","Preserve the September 20, 2026 cutoff and treat the recovered main-branch snapshot as a bounded source review, not a new collection or execution.","Compare the implementation boundary with official hooks documentation, while keeping Desktop- or plugin-owned paths distinct from registry-path capability."],"snapshot_hash":"d455d419790e82f2b5879927458406d9cf1812837b9c0e48ac98c1b762c1cd33"},"distributions":{"csv":"https://superpowerdaily.com/api/research/can-codex-hook-policies-see-the-tool-calls-they-claim-to-govern-8a8262f1?format=csv","json":"https://superpowerdaily.com/api/research/can-codex-hook-policies-see-the-tool-calls-they-claim-to-govern-8a8262f1?format=json"}}