From 16d6eb7279e152f99a569d9b6def506a10c22d20 Mon Sep 17 00:00:00 2001 From: viyatb-oai Date: Tue, 10 Feb 2026 14:06:57 -0800 Subject: [PATCH] fix(otel): include sandbox policy metadata in telemetry --- codex-rs/core/src/codex.rs | 3 +- codex-rs/otel/src/lib.rs | 3 ++ codex-rs/otel/src/traces/otel_manager.rs | 66 ++++++++++++++++++++++++ codex-rs/tui/src/app.rs | 3 +- 4 files changed, 73 insertions(+), 2 deletions(-) diff --git a/codex-rs/core/src/codex.rs b/codex-rs/core/src/codex.rs index cd653793a6..bb62a40189 100644 --- a/codex-rs/core/src/codex.rs +++ b/codex-rs/core/src/codex.rs @@ -1021,7 +1021,8 @@ impl Session { config.otel.log_user_prompt, terminal::user_agent(), session_configuration.session_source.clone(), - ); + ) + .with_policy_metadata(config.approval_policy.value(), config.sandbox_policy.get()); config.features.emit_metrics(&otel_manager); otel_manager.counter( "codex.thread.started", diff --git a/codex-rs/otel/src/lib.rs b/codex-rs/otel/src/lib.rs index 8a6d1f04ff..294e17d2f0 100644 --- a/codex-rs/otel/src/lib.rs +++ b/codex-rs/otel/src/lib.rs @@ -48,6 +48,9 @@ pub struct OtelEventMetadata { pub(crate) session_source: String, pub(crate) model: String, pub(crate) slug: String, + pub(crate) approval_policy: Option, + pub(crate) sandbox_mode: Option, + pub(crate) sandbox_network_access: Option, pub(crate) log_user_prompts: bool, pub(crate) app_version: &'static str, pub(crate) terminal_type: String, diff --git a/codex-rs/otel/src/traces/otel_manager.rs b/codex-rs/otel/src/traces/otel_manager.rs index f50eb5dfac..6551fc2f6a 100644 --- a/codex-rs/otel/src/traces/otel_manager.rs +++ b/codex-rs/otel/src/traces/otel_manager.rs @@ -82,6 +82,9 @@ impl OtelManager { session_source: session_source.to_string(), model: model.to_owned(), slug: slug.to_owned(), + approval_policy: None, + sandbox_mode: None, + sandbox_network_access: None, log_user_prompts, app_version: env!("CARGO_PKG_VERSION"), terminal_type, @@ -91,6 +94,21 @@ impl OtelManager { } } + pub fn with_policy_metadata( + mut self, + approval_policy: AskForApproval, + sandbox_policy: &SandboxPolicy, + ) -> Self { + self.metadata.approval_policy = Some(approval_policy.to_string()); + self.metadata.sandbox_mode = Some(sandbox_mode_tag(sandbox_policy).to_string()); + self.metadata.sandbox_network_access = Some(if sandbox_policy.has_full_network_access() { + "enabled".to_string() + } else { + "restricted".to_string() + }); + self + } + pub fn apply_traceparent_parent(&self, span: &Span) { if let Some(context) = traceparent_context_from_env() { let _ = span.set_parent(context); @@ -143,6 +161,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, provider_name = %provider_name, reasoning_effort = reasoning_effort.map(|e| e.to_string()), reasoning_summary = %reasoning_summary, @@ -208,6 +229,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, duration_ms = %duration.as_millis(), http.response.status_code = status, error.message = error, @@ -240,6 +264,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, duration_ms = %duration.as_millis(), success = success_str, error.message = error, @@ -342,6 +369,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, duration_ms = %duration.as_millis(), success = success_str, error.message = error_message.as_deref(), @@ -420,6 +450,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, duration_ms = %duration.as_millis(), ); } @@ -454,6 +487,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, duration_ms = %duration.as_millis(), error.message = %error, ), @@ -470,6 +506,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, duration_ms = %duration.as_millis(), error.message = %error, ), @@ -494,6 +533,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, error.message = %error, ) } @@ -520,6 +562,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, input_token_count = %input_token_count, output_token_count = %output_token_count, cached_token_count = cached_token_count, @@ -556,6 +601,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, prompt_length = %prompt.chars().count(), prompt = %prompt_to_log, ); @@ -581,6 +629,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, tool_name = %tool_name, call_id = %call_id, decision = %decision.clone().to_string().to_lowercase(), @@ -637,6 +688,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, tool_name = %tool_name, duration_ms = %Duration::ZERO.as_millis(), success = %false, @@ -675,6 +729,9 @@ impl OtelManager { terminal.type = %self.metadata.terminal_type, model = %self.metadata.model, slug = %self.metadata.slug, + policy.approval = self.metadata.approval_policy, + policy.sandbox_mode = self.metadata.sandbox_mode, + policy.sandbox_network_access = self.metadata.sandbox_network_access, tool_name = %tool_name, call_id = %call_id, arguments = %arguments, @@ -771,6 +828,15 @@ impl OtelManager { } } +fn sandbox_mode_tag(policy: &SandboxPolicy) -> &'static str { + match policy { + SandboxPolicy::DangerFullAccess => "danger-full-access", + SandboxPolicy::ReadOnly => "read-only", + SandboxPolicy::ExternalSandbox { .. } => "external-sandbox", + SandboxPolicy::WorkspaceWrite { .. } => "workspace-write", + } +} + fn timestamp() -> String { Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true) } diff --git a/codex-rs/tui/src/app.rs b/codex-rs/tui/src/app.rs index 1ef3475e44..db20b41267 100644 --- a/codex-rs/tui/src/app.rs +++ b/codex-rs/tui/src/app.rs @@ -1008,7 +1008,8 @@ impl App { config.otel.log_user_prompt, codex_core::terminal::user_agent(), SessionSource::Cli, - ); + ) + .with_policy_metadata(config.approval_policy.value(), config.sandbox_policy.get()); if config .tui_status_line .as_ref()