config: add cloud-managed layer provenance

codex-rs/tui/src/debug_config.rs

@@ -309,6 +309,7 @@ fn render_non_file_layer_details(layer: &ConfigLayerEntry) -> Vec<Line<'static>>
         ConfigLayerSource::SessionFlags => render_session_flag_details(&layer.config),
         ConfigLayerSource::Mdm { .. }
         | ConfigLayerSource::EnterpriseManaged { .. }
+        | ConfigLayerSource::CloudManaged { .. }
         | ConfigLayerSource::LegacyManagedConfigTomlFromMdm => render_non_file_layer_value(layer),
         ConfigLayerSource::System { .. }
         | ConfigLayerSource::User { .. }
@@ -373,6 +374,7 @@ fn non_file_layer_value_label(source: &ConfigLayerSource) -> &'static str {
             "MDM value"
         }
         ConfigLayerSource::EnterpriseManaged { .. } => "Enterprise-managed config value",
+        ConfigLayerSource::CloudManaged { .. } => "Cloud-managed config value",
         ConfigLayerSource::SessionFlags
         | ConfigLayerSource::System { .. }
         | ConfigLayerSource::User { .. }
@@ -557,6 +559,7 @@ mod tests {
     use super::session_all_proxy_url;
     use crate::legacy_core::config::Permissions;
     use codex_app_server_protocol::AskForApproval;
+    use codex_config::CloudManagedLayer;
     use codex_config::ConfigLayerEntry;
     use codex_config::ConfigLayerSource;
     use codex_config::ConfigLayerStack;
@@ -800,13 +803,23 @@ mod tests {
             absolute_path("/home/alice/.codex/config.toml")
         };
         let stack = ConfigLayerStack::new(
-            vec![ConfigLayerEntry::new(
-                ConfigLayerSource::User {
-                    file: user_file,
-                    profile: None,
-                },
-                empty_toml_table(),
-            )],
+            vec![
+                ConfigLayerEntry::new(
+                    ConfigLayerSource::CloudManaged {
+                        layer: CloudManagedLayer::Baseline,
+                        id: "policy-1".to_string(),
+                        name: "Baseline policy".to_string(),
+                    },
+                    TomlValue::Table(toml::toml! { model = "managed" }),
+                ),
+                ConfigLayerEntry::new(
+                    ConfigLayerSource::User {
+                        file: user_file,
+                        profile: None,
+                    },
+                    empty_toml_table(),
+                ),
+            ],
             requirements,
             requirements_toml,
         )

codex-rs/tui/src/snapshots/codex_tui__debug_config__tests__debug_config_requirement_sources.snap

@@ -5,7 +5,9 @@ expression: rendered.as_str()
 /debug-config
 
 Config layer stack (lowest precedence first):
-  1. user (/home/alice/.codex/config.toml) (enabled)
+  1. cloud-managed baseline (Baseline policy, policy-1) (enabled)
+     Cloud-managed config value: { model = "managed" }
+  2. user (/home/alice/.codex/config.toml) (enabled)
 
 Requirements:
   - allowed_approval_policies: on-request (source: MDM managed_config.toml (legacy))