File write operations do not fire PreToolUse/PostToolUse hooks

Summary

File write operations (e.g. apply_patch) do not trigger PreToolUse or PostToolUse hooks. File read operations correctly fire both hooks.

Observed behavior

Read (hooks fire correctly):

› read 1.json
• Running UserPromptSubmit hook
• Running PreToolUse hook      ← fires
  PreToolUse hook (completed)
• Running PostToolUse hook     ← fires
  PostToolUse hook (completed)
• Running Stop hook

Write (hooks do not fire):

› write 1.json
• Running UserPromptSubmit hook
• Added 1.json (+10 -0)
• Running Stop hook            ← no PreToolUse, no PostToolUse

When asked which tool was used: Codex confirmed it used functions.apply_patch.

Impact

This is critical for integrations that rely on PreToolUse hooks to enforce policies before file modifications (e.g. access control, skill enforcement, HITL approval flows). Reads being observable while writes are not is the inverse of what security tooling needs — writes are higher risk.

Expected behavior

PreToolUse and PostToolUse hooks should fire for all tool calls, including apply_patch and any other tool that writes to the filesystem.

Environment

• Tool: functions.apply_patch
• Hook events affected: PreToolUse, PostToolUse
• Hook events working: UserPromptSubmit, Stop