From 86282db6c10ba4941f5ac4c2d307e4428ed64add Mon Sep 17 00:00:00 2001 From: Abhinav Vedmala Date: Sun, 12 Apr 2026 13:46:36 -0700 Subject: [PATCH] Clarify permission request decision comment Co-authored-by: Codex --- codex-rs/hooks/src/events/permission_request.rs | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/codex-rs/hooks/src/events/permission_request.rs b/codex-rs/hooks/src/events/permission_request.rs index 248e6d11a1..2cf7d90536 100644 --- a/codex-rs/hooks/src/events/permission_request.rs +++ b/codex-rs/hooks/src/events/permission_request.rs @@ -153,14 +153,12 @@ pub(crate) async fn run( } } +/// Resolve matching hook decisions conservatively: any deny wins immediately; +/// otherwise keep the highest-precedence allow so more specific handlers +/// override broader ones. fn resolve_permission_request_decision<'a>( decisions: impl IntoIterator, ) -> Option { - // Hooks are discovered in increasing precedence order, so later handlers are - // more specific than earlier ones. Permission requests should stay - // conservative across layers: any matching deny wins immediately, while - // allows only take effect if no handler denied the request. When multiple - // allows match, use the highest-precedence one (the latest allow we saw). let mut resolved_allow = None; for decision in decisions { match decision {