Hooks: require mediated web search without silent hosted-tool fallback

Version and scope

Codex CLI 0.154.0, Linux. Local deterministic Responses fixtures exercised provider request construction and hook dispatch in direct and code-mode sessions. No real hosted search or model inference was performed.

Gap

Provider-hosted tools, specifically hosted web search, have no synchronous local PreToolUse checkpoint before provider execution. The documented hook coverage excludes hosted tools. This is a request for an enforceable mediation option for policy-controlled sessions, not a claim that current documented behavior is accidentally different.

A local callback emitted after a hosted result cannot prevent the provider-side action. Likewise, a contract entry that denies a tool is ineffective if the local adapter is never invoked.

Reproducible evidence

• Mediation probe report
• Probe harness
• Original native/code-mode hook matrix

From that Guardrail revision, with Codex 0.154.0 installed:

go build -o /tmp/guardrail-codex ./cmd/guardrail
python3 test/smoke/codex_probe.py /tmp/guardrail-codex --mediation
python3 test/smoke/codex_probe.py /tmp/guardrail-codex --mediation --code-mode
python3 test/smoke/codex_probe.py /tmp/guardrail-codex --mediation --restricted
python3 test/smoke/codex_probe.py /tmp/guardrail-codex --mediation --restricted --code-mode

Baseline provider requests contain hosted web_search; restricted requests with web_search="disabled" omit it. Hooked patches continue to work. Artifacts include outgoing tool schemas and hook logs. The harness explicitly reports hosted_execution_tested: false: this establishes the availability/removal boundary, not a remote execution denial experiment. The absence of a local pre-execution hook is documented by the hook contract.

Requested enforcement contract

An opt-in policy that requires mediation before effectful search should either:

1. Use a locally dispatched search tool whose hook decision runs before the search HTTP request, and omit hosted search if that executor is unavailable; or
2. Provide a provider-side enforcement handshake capable of denying the action before execution.

Failing over from a mediated local executor to unhooked hosted search must not silently weaken an explicitly requested policy. Search being unavailable is preferable in that opt-in mode. Ordinary default behavior need not change. This request does not presume the client can mediate arbitrary hosted provider tools by itself.

Upstream source at 7498521d288b9b3b96ffba4eedf089d8d6e06a84 already includes a standalone local web.run extension, but tool planning deliberately retains hosted fallback when the executor cannot be registered. We have a local opt-in no-hosted-fallback patch under validation. Tests deny direct and code-mode searches before any search-endpoint request and cover missing executors/namespace collisions. This is web-search-specific, requires trusted/enabled hooks, and is not an offline search implementation or a shipped fix.

Audit measurement and limitations

At 2026-09-18 05:16:14 UTC our normal Guardrail audit file contained 60,925 valid records and zero Codex-tagged records / zero Codex unknown-native-tool hits, spanning 2026-09-04 03:04:16 UTC through 2026-09-18 05:09:27 UTC. This motivates registered-versus-observed enforcement checks. It does not prove hosted calls occurred, identify why records are absent, or establish mediation. The linked fixture evidence and documented host/client boundary are deliberately separated from that measurement.

Related: #18491 (broader hook coverage). #43284, an owner-controlled hosted-domain deny request, was closed as not planned; this report instead requests an explicit no unmediated fallback mode using the existing local-dispatch seam. Our downstream delegation policy remains denied pending runtime evidence of full child-call mediation.

Start by tracing the standalone local web.run extension and the tool-planning path at upstream source 7498521d288b9b3b96ffba4eedf089d8d6e06a84, especially where hosted fallback is retained. Review test/smoke/codex_probe.py and the mediation probe report for the direct and code-mode cases. Done means an opt-in policy cannot silently fall back to hosted web search, with missing executors and namespace collisions covered by tests.