openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-13 11:47:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

codex: log admin-required full access justifications

Browse Source 
Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
Charles Cunningham
2026-03-25 11:24:02 -07:00
parent c5f320733e
commit 77cebdcb15
2 changed files with 66 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
codex-rs/otel/src/events/session_telemetry.rs
View File

@@ -363,7 +363,9 @@ impl SessionTelemetry {
remember_choice: bool,
) {
let justification_to_log = match justification {
Some(justification) if self.metadata.log_user_prompts => justification,
Some(justification) if justification_required || self.metadata.log_user_prompts => {
justification
}
Some(_) => "[REDACTED]",
None => "",
};

64
codex-rs/otel/tests/suite/otel_export_routing_policy.rs
View File

@@ -235,7 +235,7 @@ fn otel_export_routing_policy_routes_full_access_mode_enabled_events() {
Some("engineer@example.com".to_string()),
Some(TelemetryAuthMode::ApiKey),
"codex_exec".to_string(),
true,
false,
"tty".to_string(),
SessionSource::Cli,
);
@@ -297,6 +297,68 @@ fn otel_export_routing_policy_routes_full_access_mode_enabled_events() {
);
}
#[test]
fn otel_export_routing_policy_redacts_optional_full_access_justification_when_prompt_logging_disabled()
{
let log_exporter = InMemoryLogExporter::default();
let logger_provider = SdkLoggerProvider::builder()
.with_simple_exporter(log_exporter.clone())
.build();
let span_exporter = InMemorySpanExporter::default();
let tracer_provider = SdkTracerProvider::builder()
.with_simple_exporter(span_exporter)
.build();
let tracer = tracer_provider.tracer("sink-split-test");
let subscriber = tracing_subscriber::registry()
.with(
opentelemetry_appender_tracing::layer::OpenTelemetryTracingBridge::new(
&logger_provider,
)
.with_filter(filter_fn(OtelProvider::log_export_filter)),
)
.with(
tracing_opentelemetry::layer()
.with_tracer(tracer)
.with_filter(filter_fn(OtelProvider::trace_export_filter)),
);
tracing::subscriber::with_default(subscriber, || {
tracing::callsite::rebuild_interest_cache();
let manager = SessionTelemetry::new(
ThreadId::new(),
"gpt-5.1",
"gpt-5.1",
Some("account-id".to_string()),
Some("engineer@example.com".to_string()),
Some(TelemetryAuthMode::ApiKey),
"codex_exec".to_string(),
false,
"tty".to_string(),
SessionSource::Cli,
);
let root_span = tracing::info_span!("root");
let _root_guard = root_span.enter();
manager.full_access_mode_enabled(
/*justification_required*/ false,
Some("Need to inspect repo-local secrets handling"),
/*remember_choice*/ false,
);
});
logger_provider.force_flush().expect("flush logs");
let logs = log_exporter.get_emitted_logs().expect("log export");
let full_access_log = find_log_by_event_name(&logs, "codex.full_access_mode_enabled");
let full_access_log_attrs = log_attributes(&full_access_log.record);
assert_eq!(
full_access_log_attrs
.get("justification")
.map(String::as_str),
Some("[REDACTED]")
);
}
#[test]
fn otel_export_routing_policy_routes_tool_result_log_and_trace_events() {
let log_exporter = InMemoryLogExporter::default();