Merge branch 'rhan/approval-source' into rhan/escalations-approvals-sandbox

# Conflicts:
#	codex-rs/core/src/codex.rs
#	codex-rs/core/src/codex_tests.rs
#	codex-rs/core/src/state/turn.rs

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -5,6 +5,15 @@
       "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
       "type": "string"
     },
+    "ApprovalSourceMetadata": {
+      "enum": [
+        "guardian",
+        "user",
+        "policy",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "ApprovalsReviewer": {
       "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
       "enum": [
@@ -2024,6 +2033,16 @@
     },
     "ResponseItemMetadata": {
       "properties": {
+        "approval_source": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ApprovalSourceMetadata"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "is_tool_call_escalated": {
           "type": [
             "boolean",

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -5296,6 +5296,15 @@
       "AppToolsConfig": {
         "type": "object"
       },
+      "ApprovalSourceMetadata": {
+        "enum": [
+          "guardian",
+          "user",
+          "policy",
+          "unknown"
+        ],
+        "type": "string"
+      },
       "ApprovalsReviewer": {
         "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
         "enum": [
@@ -10747,6 +10756,16 @@
       },
       "ResponseItemMetadata": {
         "properties": {
+          "approval_source": {
+            "anyOf": [
+              {
+                "$ref": "#/definitions/v2/ApprovalSourceMetadata"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "is_tool_call_escalated": {
             "type": [
               "boolean",

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -536,6 +536,15 @@
     "AppToolsConfig": {
       "type": "object"
     },
+    "ApprovalSourceMetadata": {
+      "enum": [
+        "guardian",
+        "user",
+        "policy",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "ApprovalsReviewer": {
       "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
       "enum": [
@@ -7515,6 +7524,16 @@
     },
     "ResponseItemMetadata": {
       "properties": {
+        "approval_source": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ApprovalSourceMetadata"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "is_tool_call_escalated": {
           "type": [
             "boolean",

codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json

@@ -1,6 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
+    "ApprovalSourceMetadata": {
+      "enum": [
+        "guardian",
+        "user",
+        "policy",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "ContentItem": {
       "oneOf": [
         {
@@ -872,6 +881,16 @@
     },
     "ResponseItemMetadata": {
       "properties": {
+        "approval_source": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ApprovalSourceMetadata"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "is_tool_call_escalated": {
           "type": [
             "boolean",

codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json

@@ -1,6 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
+    "ApprovalSourceMetadata": {
+      "enum": [
+        "guardian",
+        "user",
+        "policy",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "ApprovalsReviewer": {
       "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
       "enum": [
@@ -938,6 +947,16 @@
     },
     "ResponseItemMetadata": {
       "properties": {
+        "approval_source": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ApprovalSourceMetadata"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "is_tool_call_escalated": {
           "type": [
             "boolean",

codex-rs/app-server-protocol/schema/typescript/ApprovalSourceMetadata.ts

@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ApprovalSourceMetadata = "guardian" | "user" | "policy" | "unknown";

codex-rs/app-server-protocol/schema/typescript/ResponseItemMetadata.ts

@@ -1,6 +1,7 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ApprovalSourceMetadata } from "./ApprovalSourceMetadata";
 import type { ReviewDecisionMetadata } from "./ReviewDecisionMetadata";
 import type { SandboxPolicyMetadata } from "./SandboxPolicyMetadata";
 import type { UserMessageType } from "./UserMessageType";
@@ -9,4 +10,4 @@ export type ResponseItemMetadata = { user_message_type?: UserMessageType,
 /**
  * Client-visible UUID generated by Codex for this item.
  */
-uuid?: string, sandbox_policy?: SandboxPolicyMetadata, is_tool_call_escalated?: boolean, review_decision?: ReviewDecisionMetadata, };
+uuid?: string, sandbox_policy?: SandboxPolicyMetadata, is_tool_call_escalated?: boolean, review_decision?: ReviewDecisionMetadata, approval_source?: ApprovalSourceMetadata, };

codex-rs/app-server-protocol/schema/typescript/index.ts

@@ -3,6 +3,7 @@
 export type { AbsolutePathBuf } from "./AbsolutePathBuf";
 export type { ApplyPatchApprovalParams } from "./ApplyPatchApprovalParams";
 export type { ApplyPatchApprovalResponse } from "./ApplyPatchApprovalResponse";
+export type { ApprovalSourceMetadata } from "./ApprovalSourceMetadata";
 export type { AuthMode } from "./AuthMode";
 export type { ClientInfo } from "./ClientInfo";
 export type { ClientNotification } from "./ClientNotification";