feat(hooks): support ask reviews for PreToolUse

codex-rs/analytics/src/events.rs

@@ -257,6 +257,9 @@ pub enum GuardianReviewedAction {
         connector_name: Option<String>,
         tool_title: Option<String>,
     },
+    PreToolUse {
+        tool_name: String,
+    },
     RequestPermissions {},
 }
 
@@ -551,6 +554,7 @@ pub(crate) enum ReviewSubjectKind {
     CommandExecution,
     FileChange,
     McpToolCall,
+    ToolCall,
     Permissions,
     NetworkAccess,
 }

codex-rs/analytics/src/reducer.rs

@@ -1758,7 +1758,9 @@ fn item_review_summary_key(pending_review: &PendingReviewState) -> Option<ToolIt
             turn_id: pending_review.turn_id.clone(),
             item_id: pending_review.item_id.clone()?,
         }),
-        ReviewSubjectKind::Permissions | ReviewSubjectKind::NetworkAccess => None,
+        ReviewSubjectKind::ToolCall
+        | ReviewSubjectKind::Permissions
+        | ReviewSubjectKind::NetworkAccess => None,
     }
 }
 
@@ -2311,6 +2313,11 @@ fn guardian_review_subject_metadata(
             tool_name.clone(),
             ReviewTrigger::Initial,
         ),
+        GuardianApprovalReviewAction::PreToolUse { tool_name, .. } => (
+            ReviewSubjectKind::ToolCall,
+            tool_name.clone(),
+            ReviewTrigger::Initial,
+        ),
     }
 }
 
@@ -2324,7 +2331,8 @@ fn guardian_review_requested_additional_permissions(action: &GuardianApprovalRev
         }
         GuardianApprovalReviewAction::Command { .. }
         | GuardianApprovalReviewAction::Execve { .. }
-        | GuardianApprovalReviewAction::McpToolCall { .. } => false,
+        | GuardianApprovalReviewAction::McpToolCall { .. }
+        | GuardianApprovalReviewAction::PreToolUse { .. } => false,
     }
 }
 
@@ -2337,7 +2345,8 @@ fn guardian_review_requested_network_access(action: &GuardianApprovalReviewActio
         GuardianApprovalReviewAction::ApplyPatch { .. }
         | GuardianApprovalReviewAction::Command { .. }
         | GuardianApprovalReviewAction::Execve { .. }
-        | GuardianApprovalReviewAction::McpToolCall { .. } => false,
+        | GuardianApprovalReviewAction::McpToolCall { .. }
+        | GuardianApprovalReviewAction::PreToolUse { .. } => false,
     }
 }
 

codex-rs/app-server-protocol/src/protocol/item_builders.rs

@@ -248,6 +248,7 @@ pub fn build_item_from_guardian_event(
         GuardianAssessmentAction::ApplyPatch { .. }
         | GuardianAssessmentAction::NetworkAccess { .. }
         | GuardianAssessmentAction::McpToolCall { .. }
+        | GuardianAssessmentAction::PreToolUse { .. }
         | GuardianAssessmentAction::RequestPermissions { .. } => None,
     }
 }

codex-rs/app-server-protocol/src/protocol/v2/item.rs

@@ -653,6 +653,13 @@ pub enum GuardianApprovalReviewAction {
     },
     #[serde(rename_all = "camelCase")]
     #[ts(rename_all = "camelCase")]
+    PreToolUse {
+        tool_name: String,
+        tool_input: JsonValue,
+        reason: String,
+    },
+    #[serde(rename_all = "camelCase")]
+    #[ts(rename_all = "camelCase")]
     RequestPermissions {
         reason: Option<String>,
         permissions: RequestPermissionProfile,
@@ -709,6 +716,15 @@ impl From<CoreGuardianAssessmentAction> for GuardianApprovalReviewAction {
                 connector_name,
                 tool_title,
             },
+            CoreGuardianAssessmentAction::PreToolUse {
+                tool_name,
+                tool_input,
+                reason,
+            } => Self::PreToolUse {
+                tool_name,
+                tool_input,
+                reason,
+            },
             CoreGuardianAssessmentAction::RequestPermissions {
                 reason,
                 permissions,
@@ -772,6 +788,15 @@ impl TryFrom<GuardianApprovalReviewAction> for CoreGuardianAssessmentAction {
                 connector_name,
                 tool_title,
             },
+            GuardianApprovalReviewAction::PreToolUse {
+                tool_name,
+                tool_input,
+                reason,
+            } => Self::PreToolUse {
+                tool_name,
+                tool_input,
+                reason,
+            },
             GuardianApprovalReviewAction::RequestPermissions {
                 reason,
                 permissions,

codex-rs/app-server/README.md

@@ -1390,7 +1390,7 @@ All items emit shared lifecycle events:
 - `item/autoApprovalReview/started` — [UNSTABLE] temporary auto-review notification carrying `{threadId, turnId, targetItemId, review, action}` when approval auto-review begins. This shape is expected to change soon.
 - `item/autoApprovalReview/completed` — [UNSTABLE] temporary auto-review notification carrying `{threadId, turnId, targetItemId, review, action}` when approval auto-review resolves. This shape is expected to change soon.
 
-`review` is [UNSTABLE] and currently has `{status, riskLevel?, userAuthorization?, rationale?}`, where `status` is one of `inProgress`, `approved`, `denied`, or `aborted`. `riskLevel` is one of `"low"`, `"medium"`, `"high"`, or `"critical"` when present. `userAuthorization` is one of `"unknown"`, `"low"`, `"medium"`, or `"high"` when present. `action` is a tagged union with `type: "command" | "execve" | "applyPatch" | "networkAccess" | "mcpToolCall"`. Command-like actions include a `source` discriminator (`"shell"` or `"unifiedExec"`). These notifications are separate from the target item's own `item/completed` lifecycle and are intentionally temporary while the auto-review app protocol is still being designed.
+`review` is [UNSTABLE] and currently has `{status, riskLevel?, userAuthorization?, rationale?}`, where `status` is one of `inProgress`, `approved`, `denied`, or `aborted`. `riskLevel` is one of `"low"`, `"medium"`, `"high"`, or `"critical"` when present. `userAuthorization` is one of `"unknown"`, `"low"`, `"medium"`, or `"high"` when present. `action` is a tagged union with `type: "command" | "execve" | "applyPatch" | "networkAccess" | "mcpToolCall" | "preToolUse"`. Command-like actions include a `source` discriminator (`"shell"` or `"unifiedExec"`). A `preToolUse` action carries `{toolName, toolInput, reason}` and targets the tool call gated by the hook-requested review. These notifications are separate from the target item's own `item/completed` lifecycle and are intentionally temporary while the auto-review app protocol is still being designed.
 
 There are additional item-specific events: