From 7bc1c3610ef3d2f0a7640a9d5e78faf1981b222a Mon Sep 17 00:00:00 2001
From: Abhinav Vedmala <abhinav@openai.com>
Date: Mon, 4 May 2026 11:22:38 -0700
Subject: [PATCH] Honor PreToolUse ask after network denials

---
 codex-rs/core/src/tools/network_approval.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/codex-rs/core/src/tools/network_approval.rs b/codex-rs/core/src/tools/network_approval.rs
index b198cd16c5..ccbde8c207 100644
--- a/codex-rs/core/src/tools/network_approval.rs
+++ b/codex-rs/core/src/tools/network_approval.rs
@@ -417,7 +417,7 @@ impl NetworkApprovalService {
 
         {
             let denied_hosts = self.session_denied_hosts.lock().await;
-            if denied_hosts.contains(&key) {
+            if denied_hosts.contains(&key) && !pre_tool_use_asks_user {
                 return NetworkDecision::deny(REASON_NOT_ALLOWED);
             }
         }