openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-10 21:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow hosts to restrict a thread's root-only capabilities (#58984)

Browse Source 
## Why

Hosts need to apply subagent-style capability restrictions without changing a thread's session attribution, agent lineage, or permission profile.

## What changed

Add the public `RestrictRootCapabilities` marker to thread startup extension data. Capture the restriction once at startup and apply it alongside the restrictions native subagents already receive. Hosts must supply the marker again when cold-resuming a restricted thread.

Use the restriction to gate user-input and plugin-install requests, async user messaging, legacy MCP tool approvals, and Full Access MCP form input. Exclude inherited user messages from Guardian's retained authorization context for restricted threads, including after cold resume.

## Testing

Add coverage for host-restricted tool registration, MCP approval rejection, Full Access form-input handling, and inherited instruction authorization after cold resume. Update handler tests to exercise the shared restriction flag.

GitOrigin-RevId: 4d6d7102a20dc747431c7511a74a204c773e8420
This commit is contained in:
rhan-oai
2026-11-02 21:09:37 +00:00
committed by copyberry
parent 6c984676b0
commit 40cf168567
24 changed files with 266 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/agent/host/mod.rs
+1
View File
@@ -20,6 +20,7 @@ pub(crate) use ownership::AgentRuntimeServices;
pub use types::HostThreadSpawnReservation;
pub use types::PreparedChildContext;
pub(crate) use types::PreparedChildInheritance;
pub use types::RestrictRootCapabilities;
pub use usage::AgentUsageAccounting;
pub use usage::AgentUsageReport;
pub use usage::UsageAccountingDecision;
codex-rs/core/src/agent/host/types.rs
+15 -1
View File
@@ -1,4 +1,4 @@
//! Prepared inputs and host reservations for native child startup.
//! Host inputs for child startup and root-only capability restrictions.
use super::admission::AgentTurnAdmission;
use super::usage::AgentUsageAccounting;
@@ -17,6 +17,20 @@ use codex_protocol::protocol::TurnEnvironmentRequest;
use codex_utils_absolute_path::AbsolutePathBuf;
use std::sync::Arc;
/// Restrict a thread's root-only capabilities as for a native subagent.
///
/// A trusted host supplies this marker in the thread's startup [`codex_extension_api::ExtensionDataInit`],
/// including when cold-resuming the thread. Core captures it once at startup.
/// Embeddings can read it during extension startup and MCP projection to apply their own
/// root-only restrictions. Session attribution, agent lineage and the thread's permission
/// profile come from their usual startup inputs. Native subagents are always restricted.
///
/// For agent forks, hosts must also supply history with native agent-fork provenance.
/// This marks copied messages as inherited and excludes the source's Guardian checkpoints.
/// Obtaining current root evidence for Guardian is a separate host responsibility.
#[derive(Clone, Copy, Debug)]
pub struct RestrictRootCapabilities;
/// A fresh child ID reserved in the host's tree.
/// The host commits membership, serializes startup attempts and deduplicates retries.
/// Core derives the parent, session and path from the invocation and child request.