openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-22 17:58:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use request originator for connector filtering

Browse Source
This commit is contained in:
Owen Lin
2026-05-19 15:24:11 -07:00
parent c240260487
commit 4e858f89db
12 changed files with 243 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/connectors.rs
+23 -13
View File
@@ -32,7 +32,6 @@ use codex_core_plugins::PluginsManager;
use codex_features::Feature;
use codex_login::AuthManager;
use codex_login::CodexAuth;
use codex_login::default_client::Originator;
use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
use codex_mcp::McpConnectionManager;
use codex_mcp::McpRuntimeEnvironment;
@@ -86,10 +85,13 @@ pub struct AccessibleConnectorsStatus {
pub async fn list_accessible_connectors_from_mcp_tools(
config: &Config,
originator_value: &str,
) -> anyhow::Result<Vec<AppInfo>> {
Ok(
list_accessible_connectors_from_mcp_tools_with_options_and_status(
config, /*force_refetch*/ false,
config,
/*force_refetch*/ false,
originator_value,
)
.await?
.connectors,
@@ -113,6 +115,7 @@ pub(crate) async fn list_tool_suggest_discoverable_tools_with_auth(
config: &Config,
auth: Option<&CodexAuth>,
accessible_connectors: &[AppInfo],
originator_value: &str,
) -> anyhow::Result<Vec<DiscoverableTool>> {
let connector_ids = tool_suggest_connector_ids(config).await;
let directory_connectors = codex_connectors::merge::merge_plugin_connectors(
@@ -124,7 +127,7 @@ pub(crate) async fn list_tool_suggest_discoverable_tools_with_auth(
directory_connectors,
accessible_connectors,
&connector_ids,
Originator::process_default().value(),
originator_value,
)
.into_iter()
.map(DiscoverableTool::from);
@@ -139,6 +142,7 @@ pub(crate) async fn list_tool_suggest_discoverable_tools_with_auth(
pub async fn list_cached_accessible_connectors_from_mcp_tools(
config: &Config,
originator_value: &str,
) -> Option<Vec<AppInfo>> {
let auth_manager =
AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ false).await;
@@ -151,10 +155,7 @@ pub async fn list_cached_accessible_connectors_from_mcp_tools(
}
let cache_key = accessible_connectors_cache_key(config, auth.as_ref());
read_cached_accessible_connectors(&cache_key).map(|connectors| {
codex_connectors::filter::filter_disallowed_connectors(
connectors,
Originator::process_default().value(),
)
codex_connectors::filter::filter_disallowed_connectors(connectors, originator_value)
})
}
@@ -162,6 +163,7 @@ pub(crate) fn refresh_accessible_connectors_cache_from_mcp_tools(
config: &Config,
auth: Option<&CodexAuth>,
mcp_tools: &[ToolInfo],
originator_value: &str,
) {
if !config.features.enabled(Feature::Apps) {
return;
@@ -170,7 +172,7 @@ pub(crate) fn refresh_accessible_connectors_cache_from_mcp_tools(
let cache_key = accessible_connectors_cache_key(config, auth);
let accessible_connectors = codex_connectors::filter::filter_disallowed_connectors(
accessible_connectors_from_mcp_tools(mcp_tools),
Originator::process_default().value(),
originator_value,
);
write_cached_accessible_connectors(cache_key, &accessible_connectors);
}
@@ -178,17 +180,23 @@ pub(crate) fn refresh_accessible_connectors_cache_from_mcp_tools(
pub async fn list_accessible_connectors_from_mcp_tools_with_options(
config: &Config,
force_refetch: bool,
originator_value: &str,
) -> anyhow::Result<Vec<AppInfo>> {
Ok(
list_accessible_connectors_from_mcp_tools_with_options_and_status(config, force_refetch)
.await?
.connectors,
list_accessible_connectors_from_mcp_tools_with_options_and_status(
config,
force_refetch,
originator_value,
)
.await?
.connectors,
)
}
pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
config: &Config,
force_refetch: bool,
originator_value: &str,
) -> anyhow::Result<AccessibleConnectorsStatus> {
// TODO: Wire callers that already own an EnvironmentManager into
// list_accessible_connectors_from_mcp_tools_with_environment_manager instead
@@ -203,6 +211,7 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
config,
force_refetch,
&environment_manager,
originator_value,
)
.await
}
@@ -211,6 +220,7 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_environment_manager(
config: &Config,
force_refetch: bool,
environment_manager: &EnvironmentManager,
originator_value: &str,
) -> anyhow::Result<AccessibleConnectorsStatus> {
let auth_manager =
AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ false).await;
@@ -232,7 +242,7 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_environment_manager(
{
let cached_connectors = codex_connectors::filter::filter_disallowed_connectors(
cached_connectors,
Originator::process_default().value(),
originator_value,
);
let cached_connectors = with_app_plugin_sources(cached_connectors, &tool_plugin_provenance);
return Ok(AccessibleConnectorsStatus {
@@ -341,7 +351,7 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_environment_manager(
let accessible_connectors = codex_connectors::filter::filter_disallowed_connectors(
accessible_connectors_from_mcp_tools(&tools),
Originator::process_default().value(),
originator_value,
);
if codex_apps_ready || !accessible_connectors.is_empty() {
write_cached_accessible_connectors(cache_key, &accessible_connectors);
codex-rs/core/src/connectors_tests.rs
+7 -2
View File
@@ -193,7 +193,12 @@ async fn refresh_accessible_connectors_cache_from_mcp_tools_writes_latest_instal
];
let cached = with_accessible_connectors_cache_cleared(|| {
refresh_accessible_connectors_cache_from_mcp_tools(&config, /*auth*/ None, &tools);
refresh_accessible_connectors_cache_from_mcp_tools(
&config,
/*auth*/ None,
&tools,
"codex_vscode",
);
read_cached_accessible_connectors(&cache_key).expect("cache should be populated")
});
@@ -1254,7 +1259,7 @@ discoverables = [
let auth = CodexAuth::create_dummy_chatgpt_auth_for_testing();
let discoverable_tools =
list_tool_suggest_discoverable_tools_with_auth(&config, Some(&auth), &[])
list_tool_suggest_discoverable_tools_with_auth(&config, Some(&auth), &[], "codex_vscode")
.await
.expect("discoverable tools should load");
codex-rs/core/src/mcp_tool_call.rs
+8 -5
View File
@@ -690,6 +690,7 @@ async fn refresh_codex_apps_after_connector_auth(sess: &Session, turn_context: &
&turn_context.config,
auth.as_ref(),
&mcp_tools,
turn_context.originator.value(),
);
}
Err(err) => {
@@ -1500,15 +1501,17 @@ pub(crate) async fn lookup_mcp_tool_metadata(
let connector_description = if server == CODEX_APPS_MCP_SERVER_NAME {
let connectors = match connectors::list_cached_accessible_connectors_from_mcp_tools(
turn_context.config.as_ref(),
turn_context.originator.value(),
)
.await
{
Some(connectors) => Some(connectors),
None => {
connectors::list_accessible_connectors_from_mcp_tools(turn_context.config.as_ref())
.await
.ok()
}
None => connectors::list_accessible_connectors_from_mcp_tools(
turn_context.config.as_ref(),
turn_context.originator.value(),
)
.await
.ok(),
};
connectors.and_then(|connectors| {
let connector_id = tool_info.connector_id.as_deref()?;
codex-rs/core/src/session/turn.rs
+1
View File
@@ -1097,6 +1097,7 @@ pub(crate) async fn built_tools(
&turn_context.config,
auth.as_ref(),
accessible_connectors.as_slice(),
turn_context.originator.value(),
)
.await
.map(|discoverable_tools| {
codex-rs/core/src/tools/handlers/request_plugin_install.rs
+2
View File
@@ -123,6 +123,7 @@ impl ToolExecutor<ToolInvocation> for RequestPluginInstallHandler {
&turn.config,
auth.as_ref(),
&accessible_connectors,
turn.originator.value(),
)
.await
.map(|discoverable_tools| {
@@ -334,6 +335,7 @@ async fn refresh_missing_requested_connectors(
&turn.config,
auth,
&mcp_tools,
turn.originator.value(),
);
Some(accessible_connectors)
}