[cabibbz]

The production log, surfaced by the diagnostics added in #31:

ERROR codex_core::tools::router: error=Tool call blocked by PreToolUse hook:
Only web search is available in this review.. Tool: webrun

That is this project's own refusal message. Codex names its web tool webrun. The hook's allowlist held web_search, web_search_preview, browser_search, search — none of which match. The gate written to permit search denied every search, for the entire life of the feature, twice in that run alone, and reported it in a log nobody had surfaced.

Every previous diagnosis in this chain was upstream of a block that was happening here.

Both gates now decide by behaviour, not by name

A researched run may use a tool that reads the web. Anything able to act is refused in both modes, whatever it is called.

	Researched	Packet-only
webrun, web_search, web_search_call, browser_search, web_fetch	allow	deny
shell, unified_exec, apply_patch, file_change, mcp_tool_call, read_file, list_dir	deny	deny
mcp__server__search_files	deny	deny
web_write	deny	deny

An MCP tool whose name contains "search" still cannot borrow the allowance, and a tool that reads and acts is refused.

The worker had the identical defect one layer down

Its search matcher was /web_search|web_fetch|browser_search/ — so the instant a webrun item appeared it would have terminated the run as a tool attempt. Fixing only the hook would have moved the failure, not removed it. Both now carry the same rule, and a test fails if they drift, because disagreement means a search is permitted then killed, or the reverse.

Security doc corrected

#30 added a claim that PreToolUse never sees web search, sourced from documentation. Your log disproves it — the hook saw webrun and refused it. Corrected, with the caveat that coverage varies by Codex version and the worker remains the control that makes a review hermetic.

Tests

tests/core/tool-gate.test.ts runs the real hook as a subprocess against the real tool names:

• webrun is permitted in a researched run — the test that would have caught this on day one
• Every acting tool is refused in both modes
• A packet-only run permits nothing, including search
• A refusal names the tool it refused
• The worker's guard agrees with the hook tool-for-tool
• Both files carry the same pattern, so neither can be relaxed alone

113 unit tests (112 pass / 1 Windows-only skip), mocked e2e, lint, build clean.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sol-review-gate	Building	Preview, Comment	Jul 27, 2026 2:42pm