From 84f259737e5cbf34c0bfe6f63a33962367f4e22a Mon Sep 17 00:00:00 2001
From: Abhinav Vedmala <abhinav@openai.com>
Date: Tue, 16 Jun 2026 20:58:00 +0000
Subject: [PATCH] Simplify shell policy schema validation

---
 codex-rs/config/src/schema.rs                 | 35 ++-----------------
 codex-rs/core/config.schema.json              | 18 ----------
 .../core/src/config/config_loader_tests.rs    |  2 +-
 codex-rs/core/src/config/schema_tests.rs      | 29 ---------------
 4 files changed, 3 insertions(+), 81 deletions(-)

diff --git a/codex-rs/config/src/schema.rs b/codex-rs/config/src/schema.rs
index fec33cbeb3..c641f1703d 100644
--- a/codex-rs/config/src/schema.rs
+++ b/codex-rs/config/src/schema.rs
@@ -117,43 +117,12 @@ pub fn mcp_servers_schema(schema_gen: &mut SchemaGenerator) -> Schema {
 
 /// Build the config schema for `config.toml`.
 pub fn config_schema() -> RootSchema {
-    let mut schema = SchemaSettings::draft07()
+    SchemaSettings::draft07()
         .with(|settings| {
             settings.option_add_null_type = false;
         })
         .into_generator()
-        .into_root_schema_for::<ConfigToml>();
-    add_shell_environment_policy_constraints(&mut schema);
-    schema
-}
-
-// Mirror the custom deserializer's mixed-form rejection in the generated schema.
-fn add_shell_environment_policy_constraints(schema: &mut RootSchema) {
-    let Some(Schema::Object(policy)) = schema.definitions.get_mut("ShellEnvironmentPolicyToml")
-    else {
-        return;
-    };
-    let all_of = policy
-        .subschemas
-        .get_or_insert_default()
-        .all_of
-        .get_or_insert_default();
-    for fields in [["exclude", "filters"], ["filters", "include_only"]] {
-        let forbidden_fields = Schema::Object(SchemaObject {
-            object: Some(Box::new(ObjectValidation {
-                required: fields.into_iter().map(str::to_string).collect(),
-                ..Default::default()
-            })),
-            ..Default::default()
-        });
-        all_of.push(Schema::Object(SchemaObject {
-            subschemas: Some(Box::new(SubschemaValidation {
-                not: Some(Box::new(forbidden_fields)),
-                ..Default::default()
-            })),
-            ..Default::default()
-        }));
-    }
+        .into_root_schema_for::<ConfigToml>()
 }
 
 /// Canonicalize a JSON value by sorting its keys.
diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index cdd6eb2271..0bbcbea131 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -2630,24 +2630,6 @@
     },
     "ShellEnvironmentPolicyToml": {
       "additionalProperties": false,
-      "allOf": [
-        {
-          "not": {
-            "required": [
-              "exclude",
-              "filters"
-            ]
-          }
-        },
-        {
-          "not": {
-            "required": [
-              "filters",
-              "include_only"
-            ]
-          }
-        }
-      ],
       "description": "Policy for building the `env` when spawning a process via shell-like tools.",
       "properties": {
         "exclude": {
diff --git a/codex-rs/core/src/config/config_loader_tests.rs b/codex-rs/core/src/config/config_loader_tests.rs
index cdef5c42ee..9b514f8d9e 100644
--- a/codex-rs/core/src/config/config_loader_tests.rs
+++ b/codex-rs/core/src/config/config_loader_tests.rs
@@ -489,7 +489,7 @@ exclude = ["SECRET_*", 17]
         (
             r#"
 [shell_environment_policy.filters]
-"SECRET_*" = "exlude"
+"SECRET_*" = "keep"
 "#,
             vec![(
                 "shell_environment_policy.exclude".to_string(),
diff --git a/codex-rs/core/src/config/schema_tests.rs b/codex-rs/core/src/config/schema_tests.rs
index 479f7f318c..dd67ead898 100644
--- a/codex-rs/core/src/config/schema_tests.rs
+++ b/codex-rs/core/src/config/schema_tests.rs
@@ -73,32 +73,3 @@ fn config_schema_hides_unsupported_inline_mcp_bearer_token() {
         (false, true),
     );
 }
-
-#[test]
-fn shell_environment_policy_schema_rejects_mixed_filter_representations() {
-    let schema_json = config_schema_json().expect("serialize config schema");
-    let schema_value: serde_json::Value =
-        serde_json::from_slice(&schema_json).expect("decode schema json");
-    let constraints = schema_value
-        .pointer("/definitions/ShellEnvironmentPolicyToml/allOf")
-        .expect("shell environment policy constraints should exist")
-        .as_array()
-        .expect("shell environment policy constraints should be an array");
-    let required_pairs = constraints
-        .iter()
-        .map(|constraint| {
-            constraint
-                .pointer("/not/required")
-                .expect("constraint should prohibit a required-field pair")
-                .clone()
-        })
-        .collect::<Vec<_>>();
-
-    assert_eq!(
-        required_pairs,
-        vec![
-            serde_json::json!(["exclude", "filters"]),
-            serde_json::json!(["filters", "include_only"]),
-        ]
-    );
-}