From 53a97c4b0095604c342d08a032fdd541245c423a Mon Sep 17 00:00:00 2001 From: Michael Bolin Date: Tue, 24 Jun 2025 22:04:59 -0700 Subject: [PATCH 1/2] chore: rename unless-allow-listed to untrusted --- codex-rs/common/src/approval_mode_cli_arg.rs | 12 ++++++------ codex-rs/config.md | 9 +++++++-- codex-rs/core/src/config.rs | 2 +- codex-rs/core/src/protocol.rs | 12 ++++-------- codex-rs/core/src/safety.rs | 2 +- codex-rs/mcp-server/src/codex_tool_config.rs | 2 -- 6 files changed, 19 insertions(+), 20 deletions(-) diff --git a/codex-rs/common/src/approval_mode_cli_arg.rs b/codex-rs/common/src/approval_mode_cli_arg.rs index 94bd8e8927..66717cd224 100644 --- a/codex-rs/common/src/approval_mode_cli_arg.rs +++ b/codex-rs/common/src/approval_mode_cli_arg.rs @@ -8,16 +8,16 @@ use codex_core::protocol::AskForApproval; #[derive(Clone, Copy, Debug, ValueEnum)] #[value(rename_all = "kebab-case")] pub enum ApprovalModeCliArg { + /// Only run "trusted" commands (e.g. ls, cat, sed) without asking for user + /// approval. Will escalate to the user if the model proposes a command that + /// is not in the "trusted" set. + Untrusted, + /// Run all commands without asking for user approval. /// Only asks for approval if a command fails to execute, in which case it /// will escalate to the user to ask for un-sandboxed execution. OnFailure, - /// Only run "known safe" commands (e.g. ls, cat, sed) without - /// asking for user approval. Will escalate to the user if the model - /// proposes a command that is not allow-listed. - UnlessAllowListed, - /// Never ask for user approval /// Execution failures are immediately returned to the model. Never, @@ -26,8 +26,8 @@ pub enum ApprovalModeCliArg { impl From for AskForApproval { fn from(value: ApprovalModeCliArg) -> Self { match value { + ApprovalModeCliArg::Untrusted => AskForApproval::UnlessAllowListed, ApprovalModeCliArg::OnFailure => AskForApproval::OnFailure, - ApprovalModeCliArg::UnlessAllowListed => AskForApproval::UnlessAllowListed, ApprovalModeCliArg::Never => AskForApproval::Never, } } diff --git a/codex-rs/config.md b/codex-rs/config.md index 0da42b9af2..14d5fd2252 100644 --- a/codex-rs/config.md +++ b/codex-rs/config.md @@ -80,8 +80,13 @@ wire_api = "chat" Determines when the user should be prompted to approve whether Codex can execute a command: ```toml -# This is analogous to --suggest in the TypeScript Codex CLI -approval_policy = "unless-allow-listed" +# Codex has hardcoded logic that defines a set of "trusted" commands. +# Setting the approval_policy to `untrusted` means that Codex will prompt the +# user before running a command not in the "trusted" set. +# +# See https://github.com/openai/codex/issues/1260 for the plan to enable +# end-users to define their own trusted commands. +approval_policy = "untrusted" ``` ```toml diff --git a/codex-rs/core/src/config.rs b/codex-rs/core/src/config.rs index bea37e90d2..d960417c78 100644 --- a/codex-rs/core/src/config.rs +++ b/codex-rs/core/src/config.rs @@ -586,7 +586,7 @@ writable_roots = [ fn create_test_fixture() -> std::io::Result { let toml = r#" model = "o3" -approval_policy = "unless-allow-listed" +approval_policy = "untrusted" disable_response_storage = false # Can be used to determine which profile to use if not specified by diff --git a/codex-rs/core/src/protocol.rs b/codex-rs/core/src/protocol.rs index 42cf92996f..7533ddf879 100644 --- a/codex-rs/core/src/protocol.rs +++ b/codex-rs/core/src/protocol.rs @@ -110,22 +110,18 @@ pub enum Op { GetHistoryEntryRequest { offset: usize, log_id: u64 }, } -/// Determines how liberally commands are auto‑approved by the system. +/// Determines the conditions under which the user is consulted to approve +/// running the command proposed by Codex. #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)] #[serde(rename_all = "kebab-case")] pub enum AskForApproval { - /// Under this policy, only “known safe” commands—as determined by + /// Under this policy, only "known safe" commands—as determined by /// `is_safe_command()`—that **only read files** are auto‑approved. /// Everything else will ask the user to approve. #[default] + #[serde(rename = "untrusted")] UnlessAllowListed, - /// In addition to everything allowed by **`Suggest`**, commands that - /// *write* to files **within the user’s approved list of writable paths** - /// are also auto‑approved. - /// TODO(ragona): fix - AutoEdit, - /// *All* commands are auto‑approved, but they are expected to run inside a /// sandbox where network access is disabled and writes are confined to a /// specific set of paths. If the command fails, it will be escalated to diff --git a/codex-rs/core/src/safety.rs b/codex-rs/core/src/safety.rs index 8417bf0c5d..a93316e3ba 100644 --- a/codex-rs/core/src/safety.rs +++ b/codex-rs/core/src/safety.rs @@ -31,7 +31,7 @@ pub fn assess_patch_safety( } match policy { - AskForApproval::OnFailure | AskForApproval::AutoEdit | AskForApproval::Never => { + AskForApproval::OnFailure | AskForApproval::Never => { // Continue to see if this can be auto-approved. } // TODO(ragona): I'm not sure this is actually correct? I believe in this case diff --git a/codex-rs/mcp-server/src/codex_tool_config.rs b/codex-rs/mcp-server/src/codex_tool_config.rs index 0afefc15ca..330ee65f73 100644 --- a/codex-rs/mcp-server/src/codex_tool_config.rs +++ b/codex-rs/mcp-server/src/codex_tool_config.rs @@ -47,7 +47,6 @@ pub(crate) struct CodexToolCallParam { #[derive(Debug, Clone, Deserialize, JsonSchema)] #[serde(rename_all = "kebab-case")] pub(crate) enum CodexToolCallApprovalPolicy { - AutoEdit, UnlessAllowListed, OnFailure, Never, @@ -56,7 +55,6 @@ pub(crate) enum CodexToolCallApprovalPolicy { impl From for AskForApproval { fn from(value: CodexToolCallApprovalPolicy) -> Self { match value { - CodexToolCallApprovalPolicy::AutoEdit => AskForApproval::AutoEdit, CodexToolCallApprovalPolicy::UnlessAllowListed => AskForApproval::UnlessAllowListed, CodexToolCallApprovalPolicy::OnFailure => AskForApproval::OnFailure, CodexToolCallApprovalPolicy::Never => AskForApproval::Never, From 989afe9e7ab004eba9d240b7723ba0adce945209 Mon Sep 17 00:00:00 2001 From: Michael Bolin Date: Tue, 24 Jun 2025 22:11:03 -0700 Subject: [PATCH 2/2] chore: improve docstring for --full-auto --- codex-rs/exec/src/cli.rs | 2 +- codex-rs/tui/src/cli.rs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/codex-rs/exec/src/cli.rs b/codex-rs/exec/src/cli.rs index f14b28e702..7f3563370a 100644 --- a/codex-rs/exec/src/cli.rs +++ b/codex-rs/exec/src/cli.rs @@ -18,7 +18,7 @@ pub struct Cli { #[arg(long = "profile", short = 'p')] pub config_profile: Option, - /// Convenience alias for low-friction sandboxed automatic execution (network-disabled sandbox that can write to cwd and TMPDIR) + /// Convenience alias for low-friction sandboxed automatic execution (-a on-failure, -c sandbox.mode=workspace-write). #[arg(long = "full-auto", default_value_t = false)] pub full_auto: bool, diff --git a/codex-rs/tui/src/cli.rs b/codex-rs/tui/src/cli.rs index e4ee752ba9..7e5a8175e9 100644 --- a/codex-rs/tui/src/cli.rs +++ b/codex-rs/tui/src/cli.rs @@ -25,7 +25,7 @@ pub struct Cli { #[arg(long = "ask-for-approval", short = 'a')] pub approval_policy: Option, - /// Convenience alias for low-friction sandboxed automatic execution (-a on-failure, network-disabled sandbox that can write to cwd and TMPDIR) + /// Convenience alias for low-friction sandboxed automatic execution (-a on-failure, -c sandbox.mode=workspace-write). #[arg(long = "full-auto", default_value_t = false)] pub full_auto: bool,