From ad605dc791dff2becd54654a6d75f8ff780fd9ab Mon Sep 17 00:00:00 2001 From: Abhinav Vedmala Date: Sat, 2 May 2026 00:24:20 -0700 Subject: [PATCH] restore GuardianApprovalRequest name --- codex-rs/core/src/codex_delegate.rs | 6 +- .../core/src/guardian/approval_request.rs | 98 +++++++++---------- codex-rs/core/src/guardian/mod.rs | 2 +- codex-rs/core/src/guardian/prompt.rs | 6 +- codex-rs/core/src/guardian/review.rs | 12 +-- codex-rs/core/src/guardian/review_session.rs | 6 +- codex-rs/core/src/guardian/tests.rs | 52 +++++----- codex-rs/core/src/mcp_tool_call.rs | 8 +- codex-rs/core/src/mcp_tool_call_tests.rs | 8 +- codex-rs/core/src/session/mod.rs | 8 +- codex-rs/core/src/tools/network_approval.rs | 4 +- codex-rs/core/src/tools/orchestrator.rs | 2 +- .../core/src/tools/runtimes/apply_patch.rs | 8 +- .../src/tools/runtimes/apply_patch_tests.rs | 4 +- codex-rs/core/src/tools/runtimes/shell.rs | 8 +- .../tools/runtimes/shell/unix_escalation.rs | 4 +- .../core/src/tools/runtimes/unified_exec.rs | 11 ++- codex-rs/core/src/tools/sandboxing.rs | 8 +- 18 files changed, 131 insertions(+), 124 deletions(-) diff --git a/codex-rs/core/src/codex_delegate.rs b/codex-rs/core/src/codex_delegate.rs index ce66cbdd9e..e3c23ab859 100644 --- a/codex-rs/core/src/codex_delegate.rs +++ b/codex-rs/core/src/codex_delegate.rs @@ -31,7 +31,7 @@ use tokio_util::sync::CancellationToken; use crate::config::Config; use crate::environment_selection::ResolvedTurnEnvironments; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::is_mcp_tool_approval_question_id; use crate::guardian::new_guardian_review_id; use crate::guardian::routes_approval_to_guardian; @@ -450,7 +450,7 @@ async fn handle_exec_approval( .. } = event; let hook_command = shlex_join(&command); - let approval_request = ApprovalRequest::Shell { + let approval_request = GuardianApprovalRequest::Shell { id: call_id.clone(), command, hook_command, @@ -555,7 +555,7 @@ async fn handle_patch_approval( }) .collect::>() .join("\n"); - let approval_request = ApprovalRequest::ApplyPatch { + let approval_request = GuardianApprovalRequest::ApplyPatch { id: approval_id.clone(), cwd: parent_ctx.cwd.clone(), files: changes diff --git a/codex-rs/core/src/guardian/approval_request.rs b/codex-rs/core/src/guardian/approval_request.rs index d3c37b7296..4002dc91ea 100644 --- a/codex-rs/core/src/guardian/approval_request.rs +++ b/codex-rs/core/src/guardian/approval_request.rs @@ -37,7 +37,7 @@ use crate::tools::sandboxing::PermissionRequestPayload; /// guardian review, approval hooks, and user-prompt transports deriving their /// own projections from it. #[derive(Debug, Clone, PartialEq)] -pub(crate) enum ApprovalRequest { +pub(crate) enum GuardianApprovalRequest { Shell { id: String, command: Vec, @@ -140,7 +140,7 @@ pub(crate) const MCP_TOOL_APPROVAL_TOOL_DESCRIPTION_KEY: &str = "tool_descriptio pub(crate) const MCP_TOOL_APPROVAL_TOOL_PARAMS_KEY: &str = "tool_params"; pub(crate) const MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY: &str = "tool_params_display"; -impl ApprovalRequest { +impl GuardianApprovalRequest { pub(crate) fn permission_request_payload(&self) -> Option { match self { Self::Shell { @@ -838,10 +838,10 @@ pub(crate) struct FormattedGuardianAction { } pub(crate) fn guardian_approval_request_to_json( - action: &ApprovalRequest, + action: &GuardianApprovalRequest, ) -> serde_json::Result { match action { - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: _, command, cwd, @@ -858,7 +858,7 @@ pub(crate) fn guardian_approval_request_to_json( justification.as_ref(), /*tty*/ None, ), - ApprovalRequest::ExecCommand { + GuardianApprovalRequest::ExecCommand { id: _, command, cwd, @@ -877,7 +877,7 @@ pub(crate) fn guardian_approval_request_to_json( Some(*tty), ), #[cfg(unix)] - ApprovalRequest::Execve { + GuardianApprovalRequest::Execve { id: _, source, program, @@ -891,7 +891,7 @@ pub(crate) fn guardian_approval_request_to_json( cwd, additional_permissions: additional_permissions.as_ref(), }), - ApprovalRequest::ApplyPatch { + GuardianApprovalRequest::ApplyPatch { id: _, cwd, files, @@ -903,7 +903,7 @@ pub(crate) fn guardian_approval_request_to_json( "files": files, "patch": patch, })), - ApprovalRequest::NetworkAccess { + GuardianApprovalRequest::NetworkAccess { id: _, turn_id: _, target, @@ -920,7 +920,7 @@ pub(crate) fn guardian_approval_request_to_json( port: *port, trigger: trigger.as_ref(), }), - ApprovalRequest::McpToolCall { + GuardianApprovalRequest::McpToolCall { id: _, server, tool_name, @@ -944,7 +944,7 @@ pub(crate) fn guardian_approval_request_to_json( tool_description: tool_description.as_ref(), annotations: annotations.as_ref(), }), - ApprovalRequest::RequestPermissions { + GuardianApprovalRequest::RequestPermissions { id: _, turn_id, reason, @@ -959,16 +959,16 @@ pub(crate) fn guardian_approval_request_to_json( } } -pub(crate) fn guardian_assessment_action(action: &ApprovalRequest) -> GuardianAssessmentAction { +pub(crate) fn guardian_assessment_action(action: &GuardianApprovalRequest) -> GuardianAssessmentAction { match action { - ApprovalRequest::Shell { command, cwd, .. } => { + GuardianApprovalRequest::Shell { command, cwd, .. } => { command_assessment_action(GuardianCommandSource::Shell, command, cwd) } - ApprovalRequest::ExecCommand { command, cwd, .. } => { + GuardianApprovalRequest::ExecCommand { command, cwd, .. } => { command_assessment_action(GuardianCommandSource::UnifiedExec, command, cwd) } #[cfg(unix)] - ApprovalRequest::Execve { + GuardianApprovalRequest::Execve { source, program, argv, @@ -980,11 +980,11 @@ pub(crate) fn guardian_assessment_action(action: &ApprovalRequest) -> GuardianAs argv: argv.clone(), cwd: cwd.clone(), }, - ApprovalRequest::ApplyPatch { cwd, files, .. } => GuardianAssessmentAction::ApplyPatch { + GuardianApprovalRequest::ApplyPatch { cwd, files, .. } => GuardianAssessmentAction::ApplyPatch { cwd: cwd.clone(), files: files.clone(), }, - ApprovalRequest::NetworkAccess { + GuardianApprovalRequest::NetworkAccess { id: _id, turn_id: _turn_id, target, @@ -999,7 +999,7 @@ pub(crate) fn guardian_assessment_action(action: &ApprovalRequest) -> GuardianAs protocol: *protocol, port: *port, }, - ApprovalRequest::McpToolCall { + GuardianApprovalRequest::McpToolCall { server, tool_name, connector_id, @@ -1013,7 +1013,7 @@ pub(crate) fn guardian_assessment_action(action: &ApprovalRequest) -> GuardianAs connector_name: connector_name.clone(), tool_title: tool_title.clone(), }, - ApprovalRequest::RequestPermissions { + GuardianApprovalRequest::RequestPermissions { reason, permissions, .. @@ -1024,9 +1024,9 @@ pub(crate) fn guardian_assessment_action(action: &ApprovalRequest) -> GuardianAs } } -pub(crate) fn guardian_reviewed_action(request: &ApprovalRequest) -> GuardianReviewedAction { +pub(crate) fn guardian_reviewed_action(request: &GuardianApprovalRequest) -> GuardianReviewedAction { match request { - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { sandbox_permissions, additional_permissions, .. @@ -1034,7 +1034,7 @@ pub(crate) fn guardian_reviewed_action(request: &ApprovalRequest) -> GuardianRev sandbox_permissions: *sandbox_permissions, additional_permissions: additional_permissions.clone(), }, - ApprovalRequest::ExecCommand { + GuardianApprovalRequest::ExecCommand { sandbox_permissions, additional_permissions, tty, @@ -1045,7 +1045,7 @@ pub(crate) fn guardian_reviewed_action(request: &ApprovalRequest) -> GuardianRev tty: *tty, }, #[cfg(unix)] - ApprovalRequest::Execve { + GuardianApprovalRequest::Execve { source, program, additional_permissions, @@ -1055,14 +1055,14 @@ pub(crate) fn guardian_reviewed_action(request: &ApprovalRequest) -> GuardianRev program: program.clone(), additional_permissions: additional_permissions.clone(), }, - ApprovalRequest::ApplyPatch { .. } => GuardianReviewedAction::ApplyPatch {}, - ApprovalRequest::NetworkAccess { protocol, port, .. } => { + GuardianApprovalRequest::ApplyPatch { .. } => GuardianReviewedAction::ApplyPatch {}, + GuardianApprovalRequest::NetworkAccess { protocol, port, .. } => { GuardianReviewedAction::NetworkAccess { protocol: *protocol, port: *port, } } - ApprovalRequest::McpToolCall { + GuardianApprovalRequest::McpToolCall { server, tool_name, connector_id, @@ -1076,41 +1076,41 @@ pub(crate) fn guardian_reviewed_action(request: &ApprovalRequest) -> GuardianRev connector_name: connector_name.clone(), tool_title: tool_title.clone(), }, - ApprovalRequest::RequestPermissions { .. } => GuardianReviewedAction::RequestPermissions {}, + GuardianApprovalRequest::RequestPermissions { .. } => GuardianReviewedAction::RequestPermissions {}, } } -pub(crate) fn guardian_request_target_item_id(request: &ApprovalRequest) -> Option<&str> { +pub(crate) fn guardian_request_target_item_id(request: &GuardianApprovalRequest) -> Option<&str> { match request { - ApprovalRequest::Shell { id, .. } - | ApprovalRequest::ExecCommand { id, .. } - | ApprovalRequest::ApplyPatch { id, .. } - | ApprovalRequest::McpToolCall { id, .. } - | ApprovalRequest::RequestPermissions { id, .. } => Some(id), - ApprovalRequest::NetworkAccess { .. } => None, + GuardianApprovalRequest::Shell { id, .. } + | GuardianApprovalRequest::ExecCommand { id, .. } + | GuardianApprovalRequest::ApplyPatch { id, .. } + | GuardianApprovalRequest::McpToolCall { id, .. } + | GuardianApprovalRequest::RequestPermissions { id, .. } => Some(id), + GuardianApprovalRequest::NetworkAccess { .. } => None, #[cfg(unix)] - ApprovalRequest::Execve { id, .. } => Some(id), + GuardianApprovalRequest::Execve { id, .. } => Some(id), } } pub(crate) fn guardian_request_turn_id<'a>( - request: &'a ApprovalRequest, + request: &'a GuardianApprovalRequest, default_turn_id: &'a str, ) -> &'a str { match request { - ApprovalRequest::NetworkAccess { turn_id, .. } - | ApprovalRequest::RequestPermissions { turn_id, .. } => turn_id, - ApprovalRequest::Shell { .. } - | ApprovalRequest::ExecCommand { .. } - | ApprovalRequest::ApplyPatch { .. } - | ApprovalRequest::McpToolCall { .. } => default_turn_id, + GuardianApprovalRequest::NetworkAccess { turn_id, .. } + | GuardianApprovalRequest::RequestPermissions { turn_id, .. } => turn_id, + GuardianApprovalRequest::Shell { .. } + | GuardianApprovalRequest::ExecCommand { .. } + | GuardianApprovalRequest::ApplyPatch { .. } + | GuardianApprovalRequest::McpToolCall { .. } => default_turn_id, #[cfg(unix)] - ApprovalRequest::Execve { .. } => default_turn_id, + GuardianApprovalRequest::Execve { .. } => default_turn_id, } } pub(crate) fn format_guardian_action_pretty( - action: &ApprovalRequest, + action: &GuardianApprovalRequest, ) -> serde_json::Result { let value = guardian_approval_request_to_json(action)?; let (value, truncated) = truncate_guardian_action_value(value); @@ -1131,7 +1131,7 @@ mod tests { #[test] fn exec_approval_event_is_projected_from_shell_request() { - let request = ApprovalRequest::Shell { + let request = GuardianApprovalRequest::Shell { id: "call-1".to_string(), command: vec!["echo".to_string(), "hi".to_string()], hook_command: "echo hi".to_string(), @@ -1169,7 +1169,7 @@ mod tests { fn apply_patch_approval_event_is_projected_from_request() { let path = test_path_buf("/tmp/file.txt"); let abs_path = path.abs(); - let request = ApprovalRequest::ApplyPatch { + let request = GuardianApprovalRequest::ApplyPatch { id: "call-1".to_string(), cwd: test_path_buf("/tmp").abs(), files: vec![abs_path], @@ -1206,7 +1206,7 @@ mod tests { #[test] fn request_permissions_event_is_projected_from_request() { - let request = ApprovalRequest::RequestPermissions { + let request = GuardianApprovalRequest::RequestPermissions { id: "call-1".to_string(), turn_id: "turn-1".to_string(), reason: Some("need outbound network".to_string()), @@ -1240,7 +1240,7 @@ mod tests { #[test] fn network_exec_approval_event_is_projected_from_request() { - let request = ApprovalRequest::NetworkAccess { + let request = GuardianApprovalRequest::NetworkAccess { id: "network-1".to_string(), turn_id: "turn-1".to_string(), target: "https://example.com:443".to_string(), @@ -1299,7 +1299,7 @@ mod tests { #[test] fn mcp_tool_approval_compat_response_uses_session_label_when_present() { - let request = ApprovalRequest::McpToolCall { + let request = GuardianApprovalRequest::McpToolCall { id: "call-1".to_string(), server: "custom_server".to_string(), tool_name: "dangerous_tool".to_string(), @@ -1338,7 +1338,7 @@ mod tests { #[test] fn mcp_tool_approval_compat_response_uses_synthetic_decline_for_abort() { - let request = ApprovalRequest::McpToolCall { + let request = GuardianApprovalRequest::McpToolCall { id: "call-1".to_string(), server: "custom_server".to_string(), tool_name: "dangerous_tool".to_string(), diff --git a/codex-rs/core/src/guardian/mod.rs b/codex-rs/core/src/guardian/mod.rs index 0eb3a91b40..8bd2621546 100644 --- a/codex-rs/core/src/guardian/mod.rs +++ b/codex-rs/core/src/guardian/mod.rs @@ -23,7 +23,7 @@ use codex_protocol::protocol::GuardianAssessmentOutcome; use serde::Deserialize; use serde::Serialize; -pub(crate) use approval_request::ApprovalRequest; +pub(crate) use approval_request::GuardianApprovalRequest; pub(crate) use approval_request::GuardianMcpAnnotations; pub(crate) use approval_request::GuardianNetworkAccessTrigger; #[allow(unused_imports)] diff --git a/codex-rs/core/src/guardian/prompt.rs b/codex-rs/core/src/guardian/prompt.rs index 290cf04b9c..b1b132a984 100644 --- a/codex-rs/core/src/guardian/prompt.rs +++ b/codex-rs/core/src/guardian/prompt.rs @@ -15,12 +15,12 @@ use codex_utils_output_truncation::approx_token_count; use codex_utils_output_truncation::approx_tokens_from_byte_count; use super::AUTO_REVIEW_DENIED_ACTION_APPROVAL_DEVELOPER_PREFIX; -use super::ApprovalRequest; use super::GUARDIAN_MAX_MESSAGE_ENTRY_TOKENS; use super::GUARDIAN_MAX_MESSAGE_TRANSCRIPT_TOKENS; use super::GUARDIAN_MAX_TOOL_ENTRY_TOKENS; use super::GUARDIAN_MAX_TOOL_TRANSCRIPT_TOKENS; use super::GUARDIAN_RECENT_ENTRY_LIMIT; +use super::GuardianApprovalRequest; use super::GuardianAssessment; use super::TRUNCATION_TAG; use super::approval_request::format_guardian_action_pretty; @@ -89,7 +89,7 @@ pub(crate) enum GuardianPromptMode { pub(crate) async fn build_guardian_prompt_items( session: &Session, retry_reason: Option, - request: ApprovalRequest, + request: GuardianApprovalRequest, mode: GuardianPromptMode, ) -> serde_json::Result { let history = session.clone_history().await; @@ -173,7 +173,7 @@ pub(crate) async fn build_guardian_prompt_items( push_text(format!("\n{note}\n")); } match &request { - ApprovalRequest::NetworkAccess { trigger, .. } => { + GuardianApprovalRequest::NetworkAccess { trigger, .. } => { push_text(">>> APPROVAL REQUEST START\n".to_string()); push_text("Below is a proposed network access request under review.\n".to_string()); if trigger.is_some() { diff --git a/codex-rs/core/src/guardian/review.rs b/codex-rs/core/src/guardian/review.rs index 9528cafe14..850d84dd2a 100644 --- a/codex-rs/core/src/guardian/review.rs +++ b/codex-rs/core/src/guardian/review.rs @@ -24,9 +24,9 @@ use tokio_util::sync::CancellationToken; use crate::session::session::Session; use crate::session::turn_context::TurnContext; -use super::ApprovalRequest; use super::GUARDIAN_REVIEW_TIMEOUT; use super::GUARDIAN_REVIEWER_NAME; +use super::GuardianApprovalRequest; use super::GuardianAssessment; use super::GuardianAssessmentOutcome; use super::GuardianRejection; @@ -234,7 +234,7 @@ async fn run_guardian_review( session: Arc, turn: Arc, review_id: String, - request: ApprovalRequest, + request: GuardianApprovalRequest, retry_reason: Option, approval_request_source: GuardianApprovalRequestSource, external_cancel: Option, @@ -523,7 +523,7 @@ pub(crate) async fn review_approval_request( session: &Arc, turn: &Arc, review_id: String, - request: ApprovalRequest, + request: GuardianApprovalRequest, retry_reason: Option, ) -> ReviewDecision { // Box the delegated review future so callers do not inline the entire @@ -544,7 +544,7 @@ pub(crate) async fn review_approval_request_with_cancel( session: &Arc, turn: &Arc, review_id: String, - request: ApprovalRequest, + request: GuardianApprovalRequest, retry_reason: Option, approval_request_source: GuardianApprovalRequestSource, cancel_token: CancellationToken, @@ -565,7 +565,7 @@ pub(crate) fn spawn_approval_request_review( session: Arc, turn: Arc, review_id: String, - request: ApprovalRequest, + request: GuardianApprovalRequest, retry_reason: Option, approval_request_source: GuardianApprovalRequestSource, cancel_token: CancellationToken, @@ -610,7 +610,7 @@ pub(crate) fn spawn_approval_request_review( pub(super) async fn run_guardian_review_session( session: Arc, turn: Arc, - request: ApprovalRequest, + request: GuardianApprovalRequest, retry_reason: Option, schema: serde_json::Value, external_cancel: Option, diff --git a/codex-rs/core/src/guardian/review_session.rs b/codex-rs/core/src/guardian/review_session.rs index f5626d4f4f..a9d3aea48a 100644 --- a/codex-rs/core/src/guardian/review_session.rs +++ b/codex-rs/core/src/guardian/review_session.rs @@ -44,9 +44,9 @@ use codex_features::Feature; use codex_model_provider_info::ModelProviderInfo; use codex_utils_absolute_path::AbsolutePathBuf; -use super::ApprovalRequest; use super::GUARDIAN_REVIEW_TIMEOUT; use super::GUARDIAN_REVIEWER_NAME; +use super::GuardianApprovalRequest; use super::prompt::GuardianPromptMode; use super::prompt::GuardianTranscriptCursor; use super::prompt::build_guardian_prompt_items; @@ -67,7 +67,7 @@ pub(crate) struct GuardianReviewSessionParams { pub(crate) parent_session: Arc, pub(crate) parent_turn: Arc, pub(crate) spawn_config: Config, - pub(crate) request: ApprovalRequest, + pub(crate) request: GuardianApprovalRequest, pub(crate) retry_reason: Option, pub(crate) schema: Value, pub(crate) model: String, @@ -1101,7 +1101,7 @@ mod tests { parent_session: Arc::new(session), parent_turn: Arc::new(turn), spawn_config, - request: ApprovalRequest::Shell { + request: GuardianApprovalRequest::Shell { id: "shell-1".to_string(), command: vec!["git".to_string(), "status".to_string()], hook_command: "git status".to_string(), diff --git a/codex-rs/core/src/guardian/tests.rs b/codex-rs/core/src/guardian/tests.rs index 2b0d4e0de5..14e5a0ddf5 100644 --- a/codex-rs/core/src/guardian/tests.rs +++ b/codex-rs/core/src/guardian/tests.rs @@ -313,7 +313,7 @@ async fn build_guardian_prompt_full_mode_preserves_initial_review_format() -> an let prompt = build_guardian_prompt_items( session.as_ref(), Some("Sandbox denied outbound git push to github.com.".to_string()), - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-1".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -368,7 +368,7 @@ async fn build_guardian_prompt_delta_mode_preserves_original_numbering() -> anyh let prompt = build_guardian_prompt_items( session.as_ref(), /*retry_reason*/ None, - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-2".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -407,7 +407,7 @@ async fn build_guardian_prompt_delta_mode_handles_empty_delta() -> anyhow::Resul let prompt = build_guardian_prompt_items( session.as_ref(), /*retry_reason*/ None, - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-2".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -443,7 +443,7 @@ async fn build_guardian_prompt_stale_delta_cursor_falls_back_to_full_prompt() -> let prompt = build_guardian_prompt_items( session.as_ref(), /*retry_reason*/ None, - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-3".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -525,7 +525,7 @@ async fn build_guardian_prompt_stale_delta_version_falls_back_to_full_prompt() - let prompt = build_guardian_prompt_items( session.as_ref(), /*retry_reason*/ None, - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-4".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -690,7 +690,7 @@ fn guardian_truncate_text_keeps_prefix_suffix_and_xml_marker() { #[test] fn format_guardian_action_pretty_truncates_large_string_fields() -> serde_json::Result<()> { let patch = "line\n".repeat(100_000); - let action = ApprovalRequest::ApplyPatch { + let action = GuardianApprovalRequest::ApplyPatch { id: "patch-1".to_string(), cwd: test_path_buf("/tmp").abs(), files: Vec::new(), @@ -710,7 +710,7 @@ fn format_guardian_action_pretty_truncates_large_string_fields() -> serde_json:: #[test] fn format_guardian_action_pretty_reports_no_truncation_for_small_payload() -> serde_json::Result<()> { - let action = ApprovalRequest::ApplyPatch { + let action = GuardianApprovalRequest::ApplyPatch { id: "patch-1".to_string(), cwd: test_path_buf("/tmp").abs(), files: Vec::new(), @@ -727,7 +727,7 @@ fn format_guardian_action_pretty_reports_no_truncation_for_small_payload() -> se #[test] fn guardian_approval_request_to_json_renders_mcp_tool_call_shape() -> serde_json::Result<()> { - let action = ApprovalRequest::McpToolCall { + let action = GuardianApprovalRequest::McpToolCall { id: "call-1".to_string(), server: "mcp_server".to_string(), tool_name: "browser_navigate".to_string(), @@ -770,7 +770,7 @@ fn guardian_approval_request_to_json_renders_mcp_tool_call_shape() -> serde_json #[test] fn guardian_approval_request_to_json_renders_network_access_trigger() -> serde_json::Result<()> { let cwd = test_path_buf("/repo").abs(); - let action = ApprovalRequest::NetworkAccess { + let action = GuardianApprovalRequest::NetworkAccess { id: "network-1".to_string(), turn_id: "turn-1".to_string(), target: "https://example.com:443".to_string(), @@ -821,7 +821,7 @@ async fn build_guardian_prompt_items_explains_network_access_review_scope() -> a let prompt = build_guardian_prompt_items( session.as_ref(), Some("Network access to \"example.com\" is blocked by policy.".to_string()), - ApprovalRequest::NetworkAccess { + GuardianApprovalRequest::NetworkAccess { id: "network-1".to_string(), turn_id: "turn-1".to_string(), target: "https://example.com:443".to_string(), @@ -886,7 +886,7 @@ async fn build_guardian_prompt_items_explains_network_access_review_scope() -> a fn guardian_assessment_action_redacts_apply_patch_patch_text() { let cwd = test_path_buf("/tmp").abs(); let file = test_path_buf("/tmp/guardian.txt").abs(); - let action = ApprovalRequest::ApplyPatch { + let action = GuardianApprovalRequest::ApplyPatch { id: "patch-1".to_string(), cwd: cwd.clone(), files: vec![file.clone()], @@ -907,7 +907,7 @@ fn guardian_assessment_action_redacts_apply_patch_patch_text() { #[test] fn guardian_request_turn_id_prefers_network_access_owner_turn() { - let network_access = ApprovalRequest::NetworkAccess { + let network_access = GuardianApprovalRequest::NetworkAccess { id: "network-1".to_string(), turn_id: "owner-turn".to_string(), target: "https://example.com:443".to_string(), @@ -917,7 +917,7 @@ fn guardian_request_turn_id_prefers_network_access_owner_turn() { port: 443, trigger: None, }; - let apply_patch = ApprovalRequest::ApplyPatch { + let apply_patch = GuardianApprovalRequest::ApplyPatch { id: "patch-1".to_string(), cwd: test_path_buf("/tmp").abs(), files: vec![test_path_buf("/tmp/guardian.txt").abs()], @@ -938,7 +938,7 @@ fn guardian_request_turn_id_prefers_network_access_owner_turn() { #[test] fn guardian_request_target_item_id_omits_network_access_trigger_call_id() { - let network_access = ApprovalRequest::NetworkAccess { + let network_access = GuardianApprovalRequest::NetworkAccess { id: "network-1".to_string(), turn_id: "owner-turn".to_string(), target: "https://example.com:443".to_string(), @@ -971,7 +971,7 @@ async fn cancelled_guardian_review_emits_terminal_abort_without_warning() { &session, &turn, "review-cancelled-guardian".to_string(), - ApprovalRequest::ApplyPatch { + GuardianApprovalRequest::ApplyPatch { id: "patch-1".to_string(), cwd: test_path_buf("/tmp").abs(), files: vec![test_path_buf("/tmp/guardian.txt").abs()], @@ -1261,7 +1261,7 @@ async fn guardian_review_request_layout_matches_model_visible_request_snapshot() let turn = Arc::new(turn); seed_guardian_parent_history(&session, &turn).await; - let request = ApprovalRequest::Shell { + let request = GuardianApprovalRequest::Shell { id: "shell-1".to_string(), command: vec![ "git".to_string(), @@ -1372,7 +1372,7 @@ async fn build_guardian_prompt_items_includes_parent_session_id() -> anyhow::Res let prompt = build_guardian_prompt_items( &session, /*retry_reason*/ None, - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-1".to_string(), command: vec!["git".to_string(), "status".to_string()], hook_command: "git status".to_string(), @@ -1447,7 +1447,7 @@ async fn guardian_reuses_prompt_cache_key_and_appends_prior_reviews() -> anyhow: let (session, turn) = guardian_test_session_and_turn(&server).await; seed_guardian_parent_history(&session, &turn).await; - let first_request = ApprovalRequest::Shell { + let first_request = GuardianApprovalRequest::Shell { id: "shell-1".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -1488,7 +1488,7 @@ async fn guardian_reuses_prompt_cache_key_and_appends_prior_reviews() -> anyhow: turn.as_ref(), ) .await; - let second_request = ApprovalRequest::Shell { + let second_request = GuardianApprovalRequest::Shell { id: "shell-2".to_string(), command: vec![ "git".to_string(), @@ -1533,7 +1533,7 @@ async fn guardian_reuses_prompt_cache_key_and_appends_prior_reviews() -> anyhow: turn.as_ref(), ) .await; - let third_request = ApprovalRequest::Shell { + let third_request = GuardianApprovalRequest::Shell { id: "shell-3".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -1729,7 +1729,7 @@ async fn guardian_reused_trunk_ignores_stale_prior_turn_completion() -> anyhow:: let first_outcome = run_guardian_review_session_for_test( Arc::clone(&session), Arc::clone(&turn), - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-1".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -1772,7 +1772,7 @@ async fn guardian_reused_trunk_ignores_stale_prior_turn_completion() -> anyhow:: let second_outcome = run_guardian_review_session_for_test( Arc::clone(&session), Arc::clone(&turn), - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-2".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -1852,7 +1852,7 @@ async fn guardian_review_surfaces_responses_api_errors_in_rejection_reason() -> &session, &turn, "review-shell-guardian-error".to_string(), - ApprovalRequest::Shell { + GuardianApprovalRequest::Shell { id: "shell-guardian-error".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), @@ -1987,7 +1987,7 @@ async fn guardian_parallel_reviews_fork_from_last_committed_trunk_history() -> a let (session, turn) = guardian_test_session_and_turn_with_base_url(server.uri()).await; seed_guardian_parent_history(&session, &turn).await; - let initial_request = ApprovalRequest::Shell { + let initial_request = GuardianApprovalRequest::Shell { id: "shell-guardian-1".to_string(), command: vec!["git".to_string(), "status".to_string()], hook_command: "git status".to_string(), @@ -2031,7 +2031,7 @@ async fn guardian_parallel_reviews_fork_from_last_committed_trunk_history() -> a ) .await; - let second_request = ApprovalRequest::Shell { + let second_request = GuardianApprovalRequest::Shell { id: "shell-guardian-2".to_string(), command: vec!["git".to_string(), "diff".to_string()], hook_command: "git diff".to_string(), @@ -2040,7 +2040,7 @@ async fn guardian_parallel_reviews_fork_from_last_committed_trunk_history() -> a additional_permissions: None, justification: Some("Inspect pending changes before proceeding.".to_string()), }; - let third_request = ApprovalRequest::Shell { + let third_request = GuardianApprovalRequest::Shell { id: "shell-guardian-3".to_string(), command: vec!["git".to_string(), "push".to_string()], hook_command: "git push".to_string(), diff --git a/codex-rs/core/src/mcp_tool_call.rs b/codex-rs/core/src/mcp_tool_call.rs index ee14978676..a63051186c 100644 --- a/codex-rs/core/src/mcp_tool_call.rs +++ b/codex-rs/core/src/mcp_tool_call.rs @@ -17,7 +17,7 @@ use crate::config::edit::ConfigEdit; use crate::config::edit::ConfigEditsBuilder; use crate::config::load_global_mcp_servers; use crate::connectors; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::GuardianMcpAnnotations; use crate::guardian::MCP_TOOL_APPROVAL_ACCEPT; use crate::guardian::MCP_TOOL_APPROVAL_ACCEPT_AND_REMEMBER; @@ -884,7 +884,7 @@ fn with_mcp_tool_call_thread_id_meta( struct McpToolApprovalElicitationRequest<'a> { server: &'a str, - approval_request: &'a ApprovalRequest, + approval_request: &'a GuardianApprovalRequest, tool_params: Option<&'a serde_json::Value>, tool_params_display: Option<&'a [RenderedMcpToolApprovalParam]>, question: RequestUserInputQuestion, @@ -1155,8 +1155,8 @@ pub(crate) fn build_mcp_tool_approval_request( hook_tool_name: &str, invocation: &McpInvocation, metadata: Option<&McpToolApprovalMetadata>, -) -> ApprovalRequest { - ApprovalRequest::McpToolCall { +) -> GuardianApprovalRequest { + GuardianApprovalRequest::McpToolCall { id: call_id.to_string(), server: invocation.server.clone(), tool_name: invocation.tool.clone(), diff --git a/codex-rs/core/src/mcp_tool_call_tests.rs b/codex-rs/core/src/mcp_tool_call_tests.rs index eb1457b6ea..a48be0d030 100644 --- a/codex-rs/core/src/mcp_tool_call_tests.rs +++ b/codex-rs/core/src/mcp_tool_call_tests.rs @@ -1,6 +1,6 @@ use super::*; use crate::config::ConfigBuilder; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::GuardianMcpAnnotations; use crate::guardian::MCP_TOOL_APPROVAL_CANCEL; use crate::guardian::MCP_TOOL_APPROVAL_CONNECTOR_DESCRIPTION_KEY; @@ -123,7 +123,7 @@ fn approval_prompt_request( tool_name: &str, arguments: Option, metadata: Option<&McpToolApprovalMetadata>, -) -> ApprovalRequest { +) -> GuardianApprovalRequest { build_mcp_tool_approval_request( "call-1", tool_name, @@ -1257,7 +1257,7 @@ fn guardian_mcp_review_request_includes_invocation_metadata() { assert_eq!( request, - ApprovalRequest::McpToolCall { + GuardianApprovalRequest::McpToolCall { id: "call-1".to_string(), server: CODEX_APPS_MCP_SERVER_NAME.to_string(), tool_name: "browser_navigate".to_string(), @@ -1299,7 +1299,7 @@ fn guardian_mcp_review_request_includes_annotations_when_present() { assert_eq!( request, - ApprovalRequest::McpToolCall { + GuardianApprovalRequest::McpToolCall { id: "call-1".to_string(), server: "custom_server".to_string(), tool_name: "dangerous_tool".to_string(), diff --git a/codex-rs/core/src/session/mod.rs b/codex-rs/core/src/session/mod.rs index 9acad52989..57f5dab799 100644 --- a/codex-rs/core/src/session/mod.rs +++ b/codex-rs/core/src/session/mod.rs @@ -32,7 +32,7 @@ use crate::context::PersonalitySpecInstructions; use crate::default_skill_metadata_budget; use crate::environment_selection::ResolvedTurnEnvironments; use crate::exec_policy::ExecPolicyManager; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::installation_id::resolve_installation_id; use crate::parse_turn_item; use crate::path_utils::normalize_for_native_workdir; @@ -1845,7 +1845,7 @@ impl Session { pub async fn request_command_approval_for_request( &self, turn_context: &TurnContext, - approval_request: ApprovalRequest, + approval_request: GuardianApprovalRequest, approval_id: Option, reason: Option, network_approval_context: Option, @@ -1930,7 +1930,7 @@ impl Session { pub async fn request_patch_approval_for_request( &self, turn_context: &TurnContext, - approval_request: ApprovalRequest, + approval_request: GuardianApprovalRequest, reason: Option, grant_root: Option, ) -> oneshot::Receiver { @@ -2029,7 +2029,7 @@ impl Session { } let requested_permissions = args.permissions; - let approval_request = ApprovalRequest::RequestPermissions { + let approval_request = GuardianApprovalRequest::RequestPermissions { id: call_id.clone(), turn_id: turn_context.sub_id.clone(), reason: args.reason.clone(), diff --git a/codex-rs/core/src/tools/network_approval.rs b/codex-rs/core/src/tools/network_approval.rs index f1ff599c6a..31c6ecdb95 100644 --- a/codex-rs/core/src/tools/network_approval.rs +++ b/codex-rs/core/src/tools/network_approval.rs @@ -1,4 +1,4 @@ -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::GuardianNetworkAccessTrigger; use crate::guardian::guardian_rejection_message; use crate::guardian::guardian_timeout_message; @@ -463,7 +463,7 @@ impl NetworkApprovalService { || format!("network-access {target}"), |call| call.command.clone(), ); - let approval_request = ApprovalRequest::NetworkAccess { + let approval_request = GuardianApprovalRequest::NetworkAccess { id: guardian_approval_id.clone(), turn_id: owner_call .as_ref() diff --git a/codex-rs/core/src/tools/orchestrator.rs b/codex-rs/core/src/tools/orchestrator.rs index f04b5dedf8..54227006dc 100644 --- a/codex-rs/core/src/tools/orchestrator.rs +++ b/codex-rs/core/src/tools/orchestrator.rs @@ -398,7 +398,7 @@ impl ToolOrchestrator { if evaluate_permission_request_hooks && let Some(permission_request) = approval_request .as_ref() - .and_then(crate::guardian::ApprovalRequest::permission_request_payload) + .and_then(crate::guardian::GuardianApprovalRequest::permission_request_payload) { match run_permission_request_hooks( approval_ctx.session, diff --git a/codex-rs/core/src/tools/runtimes/apply_patch.rs b/codex-rs/core/src/tools/runtimes/apply_patch.rs index 165789db8e..35b5cfde45 100644 --- a/codex-rs/core/src/tools/runtimes/apply_patch.rs +++ b/codex-rs/core/src/tools/runtimes/apply_patch.rs @@ -4,7 +4,7 @@ //! selected turn environment filesystem for both local and remote turns, with //! sandboxing enforced by the explicit filesystem sandbox context. use crate::exec::is_likely_sandbox_denied; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::review_approval_request; use crate::tools::sandboxing::Approvable; use crate::tools::sandboxing::ApprovalCtx; @@ -51,8 +51,8 @@ impl ApplyPatchRuntime { Self } - fn build_approval_request(req: &ApplyPatchRequest, call_id: &str) -> ApprovalRequest { - ApprovalRequest::ApplyPatch { + fn build_approval_request(req: &ApplyPatchRequest, call_id: &str) -> GuardianApprovalRequest { + GuardianApprovalRequest::ApplyPatch { id: call_id.to_string(), cwd: req.action.cwd.clone(), files: req.file_paths.clone(), @@ -179,7 +179,7 @@ impl Approvable for ApplyPatchRuntime { &self, req: &ApplyPatchRequest, ctx: &ApprovalCtx<'_>, - ) -> Option { + ) -> Option { Some(Self::build_approval_request(req, ctx.call_id)) } } diff --git a/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs b/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs index 38ba6d39d1..fa908c7176 100644 --- a/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs +++ b/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs @@ -1,5 +1,5 @@ use super::*; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::tools::sandboxing::SandboxAttempt; use codex_protocol::config_types::WindowsSandboxLevel; use codex_protocol::models::AdditionalPermissionProfile; @@ -70,7 +70,7 @@ fn guardian_review_request_includes_patch_context() { assert_eq!( guardian_request, - ApprovalRequest::ApplyPatch { + GuardianApprovalRequest::ApplyPatch { id: "call-1".to_string(), cwd: expected_cwd, files: request.file_paths, diff --git a/codex-rs/core/src/tools/runtimes/shell.rs b/codex-rs/core/src/tools/runtimes/shell.rs index 4195383522..5d77c64d1f 100644 --- a/codex-rs/core/src/tools/runtimes/shell.rs +++ b/codex-rs/core/src/tools/runtimes/shell.rs @@ -10,7 +10,7 @@ pub(crate) mod zsh_fork_backend; use crate::command_canonicalization::canonicalize_command_for_approval; use crate::exec::ExecCapturePolicy; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::GuardianNetworkAccessTrigger; use crate::guardian::review_approval_request; use crate::sandboxing::ExecOptions; @@ -120,8 +120,8 @@ impl ShellRuntime { }) } - fn build_approval_request(req: &ShellRequest, call_id: String) -> ApprovalRequest { - ApprovalRequest::Shell { + fn build_approval_request(req: &ShellRequest, call_id: String) -> GuardianApprovalRequest { + GuardianApprovalRequest::Shell { id: call_id, command: req.command.clone(), hook_command: req.hook_command.clone(), @@ -206,7 +206,7 @@ impl Approvable for ShellRuntime { &self, req: &ShellRequest, ctx: &ApprovalCtx<'_>, - ) -> Option { + ) -> Option { Some(Self::build_approval_request(req, ctx.call_id.to_string())) } diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs index 5ce7c16257..f1ae85bec5 100644 --- a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs +++ b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs @@ -3,7 +3,7 @@ use crate::exec::ExecCapturePolicy; use crate::exec::ExecExpiration; use crate::exec::cancel_when_either; use crate::exec::is_likely_sandbox_denied; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::guardian_rejection_message; use crate::guardian::guardian_timeout_message; use crate::guardian::new_guardian_review_id; @@ -406,7 +406,7 @@ impl CoreShellActionProvider { .pause_for(async move { // 1) Run PermissionRequest hooks let effective_approval_id = approval_id.clone().unwrap_or_else(|| call_id.clone()); - let approval_request = ApprovalRequest::Execve { + let approval_request = GuardianApprovalRequest::Execve { id: call_id.clone(), source, program: program.to_string_lossy().into_owned(), diff --git a/codex-rs/core/src/tools/runtimes/unified_exec.rs b/codex-rs/core/src/tools/runtimes/unified_exec.rs index 1263b13986..55c64fd6d0 100644 --- a/codex-rs/core/src/tools/runtimes/unified_exec.rs +++ b/codex-rs/core/src/tools/runtimes/unified_exec.rs @@ -7,7 +7,7 @@ the process manager to spawn PTYs once an ExecRequest is prepared. use crate::command_canonicalization::canonicalize_command_for_approval; use crate::exec::ExecCapturePolicy; use crate::exec::ExecExpiration; -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::guardian::GuardianNetworkAccessTrigger; use crate::guardian::review_approval_request; use crate::sandboxing::ExecOptions; @@ -110,8 +110,11 @@ impl<'a> UnifiedExecRuntime<'a> { } } - fn build_approval_request(req: &UnifiedExecRequest, call_id: String) -> ApprovalRequest { - ApprovalRequest::ExecCommand { + fn build_approval_request( + req: &UnifiedExecRequest, + call_id: String, + ) -> GuardianApprovalRequest { + GuardianApprovalRequest::ExecCommand { id: call_id, command: req.command.clone(), hook_command: req.hook_command.clone(), @@ -202,7 +205,7 @@ impl Approvable for UnifiedExecRuntime<'_> { &self, req: &UnifiedExecRequest, ctx: &ApprovalCtx<'_>, - ) -> Option { + ) -> Option { Some(Self::build_approval_request(req, ctx.call_id.to_string())) } diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs index a30198cdf9..2ef5c8f2b7 100644 --- a/codex-rs/core/src/tools/sandboxing.rs +++ b/codex-rs/core/src/tools/sandboxing.rs @@ -4,7 +4,7 @@ //! `ApprovalCtx`, `Approvable`) together with the sandbox orchestration traits //! and helpers (`Sandboxable`, `ToolRuntime`, `SandboxAttempt`, etc.). -use crate::guardian::ApprovalRequest; +use crate::guardian::GuardianApprovalRequest; use crate::sandboxing::ExecOptions; use crate::sandboxing::SandboxPermissions; use crate::session::session::Session; @@ -312,7 +312,11 @@ pub(crate) trait Approvable { /// Return the canonical approval action for this request when the runtime /// participates in approval hooks and/or guardian review. - fn approval_request(&self, _req: &Req, _ctx: &ApprovalCtx<'_>) -> Option { + fn approval_request( + &self, + _req: &Req, + _ctx: &ApprovalCtx<'_>, + ) -> Option { None }