openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-02 19:43:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

user and guardian

Browse Source
This commit is contained in:
Roy Han
2026-03-23 10:53:59 -07:00
parent efc3615d07
commit 7e302048ff
12 changed files with 226 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server-protocol/schema/json/ClientRequest.json
+19
View File
@@ -5,6 +5,15 @@
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
"type": "string"
},
"ApprovalSourceMetadata": {
"enum": [
"guardian",
"user",
"policy",
"unknown"
],
"type": "string"
},
"ApprovalsReviewer": {
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
"enum": [
@@ -2024,6 +2033,16 @@
},
"ResponseItemMetadata": {
"properties": {
"approval_source": {
"anyOf": [
{
"$ref": "#/definitions/ApprovalSourceMetadata"
},
{
"type": "null"
}
]
},
"is_tool_call_escalated": {
"type": [
"boolean",
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+19
View File
@@ -5296,6 +5296,15 @@
"AppToolsConfig": {
"type": "object"
},
"ApprovalSourceMetadata": {
"enum": [
"guardian",
"user",
"policy",
"unknown"
],
"type": "string"
},
"ApprovalsReviewer": {
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
"enum": [
@@ -10747,6 +10756,16 @@
},
"ResponseItemMetadata": {
"properties": {
"approval_source": {
"anyOf": [
{
"$ref": "#/definitions/v2/ApprovalSourceMetadata"
},
{
"type": "null"
}
]
},
"is_tool_call_escalated": {
"type": [
"boolean",
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
+19
View File
@@ -536,6 +536,15 @@
"AppToolsConfig": {
"type": "object"
},
"ApprovalSourceMetadata": {
"enum": [
"guardian",
"user",
"policy",
"unknown"
],
"type": "string"
},
"ApprovalsReviewer": {
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
"enum": [
@@ -7515,6 +7524,16 @@
},
"ResponseItemMetadata": {
"properties": {
"approval_source": {
"anyOf": [
{
"$ref": "#/definitions/ApprovalSourceMetadata"
},
{
"type": "null"
}
]
},
"is_tool_call_escalated": {
"type": [
"boolean",
codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json
+19
View File
@@ -1,6 +1,15 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"ApprovalSourceMetadata": {
"enum": [
"guardian",
"user",
"policy",
"unknown"
],
"type": "string"
},
"ContentItem": {
"oneOf": [
{
@@ -872,6 +881,16 @@
},
"ResponseItemMetadata": {
"properties": {
"approval_source": {
"anyOf": [
{
"$ref": "#/definitions/ApprovalSourceMetadata"
},
{
"type": "null"
}
]
},
"is_tool_call_escalated": {
"type": [
"boolean",
codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
+19
View File
@@ -1,6 +1,15 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"ApprovalSourceMetadata": {
"enum": [
"guardian",
"user",
"policy",
"unknown"
],
"type": "string"
},
"ApprovalsReviewer": {
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
"enum": [
@@ -938,6 +947,16 @@
},
"ResponseItemMetadata": {
"properties": {
"approval_source": {
"anyOf": [
{
"$ref": "#/definitions/ApprovalSourceMetadata"
},
{
"type": "null"
}
]
},
"is_tool_call_escalated": {
"type": [
"boolean",
codex-rs/app-server-protocol/schema/typescript/ApprovalSourceMetadata.ts
+5
View File
@@ -0,0 +1,5 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type ApprovalSourceMetadata = "guardian" | "user" | "policy" | "unknown";
codex-rs/app-server-protocol/schema/typescript/ResponseItemMetadata.ts
+2 -1
View File
@@ -1,6 +1,7 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { ApprovalSourceMetadata } from "./ApprovalSourceMetadata";
import type { ReviewDecisionMetadata } from "./ReviewDecisionMetadata";
import type { SandboxPolicyMetadata } from "./SandboxPolicyMetadata";
import type { UserMessageType } from "./UserMessageType";
@@ -9,4 +10,4 @@ export type ResponseItemMetadata = { user_message_type?: UserMessageType,
/**
* Client-visible UUID generated by Codex for this item.
*/
uuid?: string, sandbox_policy?: SandboxPolicyMetadata, is_tool_call_escalated?: boolean, review_decision?: ReviewDecisionMetadata, };
uuid?: string, sandbox_policy?: SandboxPolicyMetadata, is_tool_call_escalated?: boolean, review_decision?: ReviewDecisionMetadata, approval_source?: ApprovalSourceMetadata, };
codex-rs/app-server-protocol/schema/typescript/index.ts
+1
View File
@@ -3,6 +3,7 @@
export type { AbsolutePathBuf } from "./AbsolutePathBuf";
export type { ApplyPatchApprovalParams } from "./ApplyPatchApprovalParams";
export type { ApplyPatchApprovalResponse } from "./ApplyPatchApprovalResponse";
export type { ApprovalSourceMetadata } from "./ApprovalSourceMetadata";
export type { AuthMode } from "./AuthMode";
export type { ClientInfo } from "./ClientInfo";
export type { ClientNotification } from "./ClientNotification";
codex-rs/core/src/codex.rs
+16 -1
View File
@@ -88,6 +88,7 @@ use codex_protocol::items::TurnItem;
use codex_protocol::items::UserMessageItem;
use codex_protocol::items::build_hook_prompt_message;
use codex_protocol::mcp::CallToolResult;
use codex_protocol::models::ApprovalSourceMetadata;
use codex_protocol::models::BaseInstructions;
use codex_protocol::models::PermissionProfile;
use codex_protocol::models::ResponseItemMessageMetadata;
@@ -209,6 +210,7 @@ use crate::file_watcher::FileWatcher;
use crate::file_watcher::FileWatcherEvent;
use crate::git_info::get_git_repo_root;
use crate::guardian::GuardianReviewSessionManager;
use crate::guardian::routes_approval_to_guardian;
use crate::hook_runtime::PendingInputHookDisposition;
use crate::hook_runtime::inspect_pending_input;
use crate::hook_runtime::record_additional_contexts;
@@ -1052,6 +1054,14 @@ fn user_message_metadata_patch(
}
}
fn approval_source_for_turn(turn_context: &TurnContext) -> ApprovalSourceMetadata {
if routes_approval_to_guardian(turn_context) {
ApprovalSourceMetadata::Guardian
} else {
ApprovalSourceMetadata::User
}
}
fn response_item_tool_call_id(item: &ResponseItem) -> Option<&str> {
match item {
ResponseItem::LocalShellCall {
@@ -1135,10 +1145,12 @@ fn stamp_tool_approval_metadata_with_snapshot(
Some(outcome) => {
metadata.is_tool_call_escalated = Some(true);
metadata.review_decision = outcome.review_decision;
metadata.approval_source = Some(outcome.approval_source);
}
None if !has_pending_approval => {
metadata.is_tool_call_escalated = Some(false);
metadata.review_decision = None;
metadata.approval_source = None;
}
None => {
return stamp_tool_metadata_on_response_item(response_item, metadata);
@@ -3017,6 +3029,7 @@ impl Session {
effective_approval_id.clone(),
PendingApprovalMetadata {
call_id: call_id.clone(),
approval_source: approval_source_for_turn(turn_context),
},
);
ts.insert_pending_approval(effective_approval_id.clone(), tx_approve)
@@ -3088,6 +3101,7 @@ impl Session {
approval_id.clone(),
PendingApprovalMetadata {
call_id: call_id.clone(),
approval_source: approval_source_for_turn(turn_context),
},
);
ts.insert_pending_approval(approval_id.clone(), tx_approve)
@@ -3385,12 +3399,13 @@ impl Session {
.remove_pending_approval_call_id(approval_id)
.unwrap_or_else(|| PendingApprovalMetadata {
call_id: approval_id.to_string(),
approval_source: ApprovalSourceMetadata::Unknown,
});
drop(ts);
drop(active);
self.record_call_approval_outcome(
pending_approval.call_id,
ApprovalOutcomeMetadata::reviewed(decision),
ApprovalOutcomeMetadata::reviewed(decision, pending_approval.approval_source),
)
.await;
}
codex-rs/core/src/codex_tests.rs
+81 -22
View File
@@ -4418,52 +4418,98 @@ async fn task_finish_emits_prompt_queued_metadata_for_injected_user_input_when_f
#[test]
fn review_decision_metadata_mapping_is_stable() {
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::Approved).review_decision,
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::Approved,
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::Approved)
);
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::Denied).review_decision,
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::Denied,
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::Denied)
);
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::Abort).review_decision,
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::Abort,
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::Abort)
);
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::ApprovedForSession).review_decision,
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::ApprovedForSession,
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::ApprovedForSession)
);
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::ApprovedExecpolicyAmendment {
proposed_execpolicy_amendment: codex_protocol::approvals::ExecPolicyAmendment::new(
vec!["echo".to_string(), "hi".to_string()],
),
})
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::ApprovedExecpolicyAmendment {
proposed_execpolicy_amendment: codex_protocol::approvals::ExecPolicyAmendment::new(
vec!["echo".to_string(), "hi".to_string()],
),
},
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::ApprovedWithAmendment)
);
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::NetworkPolicyAmendment {
network_policy_amendment: codex_protocol::approvals::NetworkPolicyAmendment {
host: "example.com".to_string(),
action: codex_protocol::protocol::NetworkPolicyRuleAction::Allow,
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::NetworkPolicyAmendment {
network_policy_amendment: codex_protocol::approvals::NetworkPolicyAmendment {
host: "example.com".to_string(),
action: codex_protocol::protocol::NetworkPolicyRuleAction::Allow,
},
},
})
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::ApprovedWithNetworkPolicyAllow)
);
assert_eq!(
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::NetworkPolicyAmendment {
network_policy_amendment: codex_protocol::approvals::NetworkPolicyAmendment {
host: "example.com".to_string(),
action: codex_protocol::protocol::NetworkPolicyRuleAction::Deny,
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::NetworkPolicyAmendment {
network_policy_amendment: codex_protocol::approvals::NetworkPolicyAmendment {
host: "example.com".to_string(),
action: codex_protocol::protocol::NetworkPolicyRuleAction::Deny,
},
},
})
codex_protocol::models::ApprovalSourceMetadata::User,
)
.review_decision,
Some(codex_protocol::models::ReviewDecisionMetadata::DeniedWithNetworkPolicyDeny)
);
}
#[tokio::test]
async fn approval_source_metadata_mapping_is_stable() {
let (_session, mut turn_context) = make_session_and_context().await;
assert_eq!(
approval_source_for_turn(&turn_context),
codex_protocol::models::ApprovalSourceMetadata::User
);
turn_context
.approval_policy
.set(crate::protocol::AskForApproval::OnRequest)
.expect("test setup should allow updating approval policy");
Arc::get_mut(&mut turn_context.config)
.expect("single turn config ref")
.approvals_reviewer = codex_protocol::config_types::ApprovalsReviewer::GuardianSubagent;
assert_eq!(
approval_source_for_turn(&turn_context),
codex_protocol::models::ApprovalSourceMetadata::Guardian
);
}
#[test]
fn sandbox_policy_metadata_mapping_is_stable() {
assert_eq!(
@@ -4527,6 +4573,7 @@ async fn assert_next_emitted_function_call_metadata(
expected_sandbox_policy: codex_protocol::models::SandboxPolicyMetadata,
expected_escalated: bool,
expected_review_decision: Option<codex_protocol::models::ReviewDecisionMetadata>,
expected_approval_source: Option<codex_protocol::models::ApprovalSourceMetadata>,
) {
let event = tokio::time::timeout(std::time::Duration::from_secs(2), rx.recv())
.await
@@ -4543,6 +4590,7 @@ async fn assert_next_emitted_function_call_metadata(
} if metadata.is_tool_call_escalated == Some(expected_escalated)
&& metadata.review_decision == expected_review_decision
&& metadata.sandbox_policy == Some(expected_sandbox_policy)
&& metadata.approval_source == expected_approval_source
)
));
}
@@ -4553,7 +4601,10 @@ async fn tool_call_metadata_stamps_escalated_review_decision_when_feature_enable
sess.record_call_approval_outcome(
"call-1".to_string(),
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::Denied),
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::Denied,
codex_protocol::models::ApprovalSourceMetadata::User,
),
)
.await;
sess.record_response_item_and_emit_turn_item(tc.as_ref(), function_call_item("call-1"))
@@ -4563,6 +4614,7 @@ async fn tool_call_metadata_stamps_escalated_review_decision_when_feature_enable
expected_sandbox_policy,
true,
Some(codex_protocol::models::ReviewDecisionMetadata::Denied),
Some(codex_protocol::models::ApprovalSourceMetadata::User),
)
.await;
}
@@ -4573,7 +4625,8 @@ async fn tool_call_metadata_stamps_non_escalated_false_when_feature_enabled() {
sess.record_response_item_and_emit_turn_item(tc.as_ref(), function_call_item("call-2"))
.await;
assert_next_emitted_function_call_metadata(&rx, expected_sandbox_policy, false, None).await;
assert_next_emitted_function_call_metadata(&rx, expected_sandbox_policy, false, None, None)
.await;
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -4630,6 +4683,7 @@ async fn handle_output_item_done_stamps_tool_call_metadata_when_feature_enabled(
&& metadata.is_tool_call_escalated == Some(false)
&& metadata.review_decision.is_none()
&& metadata.sandbox_policy == Some(expected_sandbox_policy.clone())
&& metadata.approval_source.is_none()
)
}));
}
@@ -4671,7 +4725,10 @@ async fn tool_call_metadata_can_be_restamped_after_approval_outcome() {
.await;
sess.record_call_approval_outcome(
"call-restamp-1".to_string(),
ApprovalOutcomeMetadata::reviewed(&ReviewDecision::Denied),
ApprovalOutcomeMetadata::reviewed(
&ReviewDecision::Denied,
codex_protocol::models::ApprovalSourceMetadata::User,
),
)
.await;
@@ -4702,6 +4759,8 @@ async fn tool_call_metadata_can_be_restamped_after_approval_outcome() {
&& metadata.review_decision
== Some(codex_protocol::models::ReviewDecisionMetadata::Denied)
&& metadata.sandbox_policy == Some(expected_sandbox_policy)
&& metadata.approval_source
== Some(codex_protocol::models::ApprovalSourceMetadata::User)
));
}
codex-rs/core/src/state/turn.rs
+9 -2
View File
@@ -10,6 +10,8 @@ use tokio_util::sync::CancellationToken;
use tokio_util::task::AbortOnDropHandle;
use codex_protocol::dynamic_tools::DynamicToolResponse;
use codex_protocol::models::ApprovalSourceMetadata;
use codex_protocol::models::PermissionProfile;
use codex_protocol::models::ResponseInputItem;
use codex_protocol::models::ReviewDecisionMetadata;
use codex_protocol::request_permissions::RequestPermissionsResponse;
@@ -23,7 +25,6 @@ use crate::protocol::ReviewDecision;
use crate::protocol::TokenUsage;
use crate::sandboxing::merge_permission_profiles;
use crate::tasks::SessionTask;
use codex_protocol::models::PermissionProfile;
/// Metadata about the currently running turn.
pub(crate) struct ActiveTurn {
@@ -61,15 +62,20 @@ pub(crate) struct RunningTask {
#[derive(Clone, Debug, PartialEq, Eq)]
pub(crate) struct PendingApprovalMetadata {
pub(crate) call_id: String,
pub(crate) approval_source: ApprovalSourceMetadata,
}
#[derive(Clone, Debug, PartialEq, Eq)]
pub(crate) struct ApprovalOutcomeMetadata {
pub(crate) review_decision: Option<ReviewDecisionMetadata>,
pub(crate) approval_source: ApprovalSourceMetadata,
}
impl ApprovalOutcomeMetadata {
pub(crate) fn reviewed(decision: &ReviewDecision) -> Self {
pub(crate) fn reviewed(
decision: &ReviewDecision,
approval_source: ApprovalSourceMetadata,
) -> Self {
let review_decision = match decision {
ReviewDecision::Approved => ReviewDecisionMetadata::Approved,
ReviewDecision::ApprovedExecpolicyAmendment { .. } => {
@@ -91,6 +97,7 @@ impl ApprovalOutcomeMetadata {
};
Self {
review_decision: Some(review_decision),
approval_source,
}
}
}
codex-rs/protocol/src/models.rs
+17
View File
@@ -291,6 +291,16 @@ pub enum SandboxPolicyMetadata {
FullAccess,
}
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, JsonSchema, TS)]
#[serde(rename_all = "snake_case")]
#[ts(rename_all = "snake_case")]
pub enum ApprovalSourceMetadata {
Guardian,
User,
Policy,
Unknown,
}
#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq, JsonSchema, TS)]
pub struct ResponseItemMetadata {
#[serde(default, skip_serializing_if = "Option::is_none")]
@@ -309,6 +319,9 @@ pub struct ResponseItemMetadata {
#[serde(default, skip_serializing_if = "Option::is_none")]
#[ts(optional)]
pub review_decision: Option<ReviewDecisionMetadata>,
#[serde(default, skip_serializing_if = "Option::is_none")]
#[ts(optional)]
pub approval_source: Option<ApprovalSourceMetadata>,
}
impl ResponseItemMetadata {
@@ -316,6 +329,7 @@ impl ResponseItemMetadata {
self.sandbox_policy.is_none()
&& self.is_tool_call_escalated.is_none()
&& self.review_decision.is_none()
&& self.approval_source.is_none()
}
pub fn merge_from(&mut self, other: Self) {
@@ -328,6 +342,9 @@ impl ResponseItemMetadata {
if other.review_decision.is_some() {
self.review_decision = other.review_decision;
}
if other.approval_source.is_some() {
self.approval_source = other.approval_source;
}
}
}