Codex apply_patch bypasses block-secrets-write for protected secret-file paths

[HimanshuDeshbhratar]

Description

block-secrets-write currently matches the canonical Write tool only.

For Codex, apply_patch is canonicalized to Edit, so the block-secrets-write policy is not selected when a Codex agent uses apply_patch to create or modify a protected secret-file path such as .ssh/id_rsa.

There is also a related input-shape issue: Codex provides the patch through tool_input.command, while blockSecretsWrite() currently obtains the file path from file_path. Therefore, adding Edit to the policy matcher alone would not be sufficient to cover the real Codex apply_patch payload.

I reproduced this locally using a fake test value.

Steps to Reproduce

1. Enable the block-secrets-write policy.
2. Send a Codex PreToolUse payload using the actual apply_patch shape:
   {
   "tool_name": "apply_patch",
   "tool_input": {
   "command": "*** Begin Patch\n*** Add File: .ssh/id_rsa\n+FAKESECRET_test_only\n*** End Patch"
   }
   }
3. Process the payload through the Codex hook/evaluation path.
4. Observe the canonicalized tool name and policy result.

Current result:

toolName: Edit
result: allow

failproofai/block-secrets-write is not included in the matched policies.

For comparison, a Write operation targeting .ssh/id_rsa is denied by block-secrets-write.

Expected Behavior

A Codex apply_patch operation that creates or modifies a protected secret-file path should be evaluated by block-secrets-write if the policy is intended to protect these paths across supported file-writing/editing tools.

For example, the equivalent operation targeting:

.ssh/id_rsa

should result in a policy denial rather than being allowed without the secrets-write policy being evaluated.

Failproof AI Version

1.0.7-beta.0

Node.js / Bun Version

Node 22

Operating System

Windows (WSL)

Additional Context

The relevant current flow appears to be:

Codex apply_patch
↓
canonicalizeToolName()
↓
Edit
↓
getPoliciesForEvent("PreToolUse", "Edit")
↓
block-secrets-write is not selected

The policy catalog currently registers block-secrets-write for:

events: ["PreToolUse"]
toolNames: ["Write"]

Additionally, the Codex apply_patch payload contains the patch in:

tool_input.command

rather than a direct:

tool_input.file_path

The existing tests cover protected paths through the Write tool and separately cover apply_patch → Edit canonicalization, but I could not find an integration/e2e test covering the combination of:

Codex + apply_patch + protected secret-file path + block-secrets-write

A complete fix may therefore need to address both the matcher (Write vs Edit) and extraction of affected file paths from the Codex patch command.

The reproduction used only a fake test value; no real credentials or secrets were used.

No product source changes were made while reproducing the issue.