openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-05 20:10:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expose managed requirements through the app-server API

Browse Source
This commit is contained in:
Abhinav Vedmala
2026-06-16 08:00:17 +00:00
parent 96602d7990
commit ad98d74052
18 changed files with 961 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
Generated
+238
View File
@@ -6765,6 +6765,39 @@
}
]
},
"AuthCredentialsStoreMode": {
"description": "Determines where Codex stores CLI authentication credentials.",
"oneOf": [
{
"description": "Persist credentials in `CODEX_HOME/auth.json`.",
"enum": [
"file"
],
"type": "string"
},
{
"description": "Persist credentials in the operating system keyring. Fail if unavailable.",
"enum": [
"keyring"
],
"type": "string"
},
{
"description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.",
"enum": [
"auto"
],
"type": "string"
},
{
"description": "Store credentials in memory only for the current process.",
"enum": [
"ephemeral"
],
"type": "string"
}
]
},
"AuthMode": {
"description": "Authentication mode for OpenAI-backed providers.",
"oneOf": [
@@ -7662,6 +7695,16 @@
],
"description": "[UNSTABLE] Optional default for where approval requests are routed for review."
},
"cli_auth_credentials_store": {
"anyOf": [
{
"$ref": "#/definitions/v2/AuthCredentialsStoreMode"
},
{
"type": "null"
}
]
},
"compact_prompt": {
"type": [
"string",
@@ -8160,6 +8203,12 @@
"null"
]
},
"allowLoginShell": {
"type": [
"boolean",
"null"
]
},
"allowManagedHooksOnly": {
"type": [
"boolean",
@@ -8181,6 +8230,24 @@
"null"
]
},
"allowedChatgptWorkspaces": {
"additionalProperties": {
"type": "boolean"
},
"type": [
"object",
"null"
]
},
"allowedLoginMethods": {
"additionalProperties": {
"type": "boolean"
},
"type": [
"object",
"null"
]
},
"allowedPermissionProfiles": {
"additionalProperties": {
"type": "boolean"
@@ -8217,6 +8284,28 @@
"null"
]
},
"chatgptBaseUrl": {
"type": [
"string",
"null"
]
},
"checkForUpdateOnStartup": {
"type": [
"boolean",
"null"
]
},
"cliAuthCredentialsStore": {
"anyOf": [
{
"$ref": "#/definitions/v2/AuthCredentialsStoreMode"
},
{
"type": "null"
}
]
},
"computerUse": {
"anyOf": [
{
@@ -8251,6 +8340,66 @@
"object",
"null"
]
},
"feedback": {
"anyOf": [
{
"$ref": "#/definitions/v2/FeedbackRequirements"
},
{
"type": "null"
}
]
},
"logDir": {
"anyOf": [
{
"$ref": "#/definitions/v2/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"modelCatalogJson": {
"anyOf": [
{
"$ref": "#/definitions/v2/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"otel": {
"description": "Lossless config-native OTEL requirements, including exporter headers."
},
"shellEnvironmentPolicy": {
"anyOf": [
{
"$ref": "#/definitions/v2/ShellEnvironmentPolicyRequirements"
},
{
"type": "null"
}
],
"description": "Lossless config-native shell environment policy requirements."
},
"sqliteHome": {
"anyOf": [
{
"$ref": "#/definitions/v2/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"windowsSandboxPrivateDesktop": {
"type": [
"boolean",
"null"
]
}
},
"type": "object"
@@ -9249,6 +9398,17 @@
],
"type": "string"
},
"FeedbackRequirements": {
"properties": {
"enabled": {
"type": [
"boolean",
"null"
]
}
},
"type": "object"
},
"FeedbackUploadParams": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
@@ -15834,6 +15994,84 @@
],
"type": "object"
},
"ShellEnvironmentPolicyInherit": {
"oneOf": [
{
"description": "\"Core\" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.",
"enum": [
"core"
],
"type": "string"
},
{
"description": "Inherits the full environment from the parent process.",
"enum": [
"all"
],
"type": "string"
},
{
"description": "Do not inherit any environment variables from the parent process.",
"enum": [
"none"
],
"type": "string"
}
]
},
"ShellEnvironmentPolicyRequirements": {
"properties": {
"experimental_use_profile": {
"type": [
"boolean",
"null"
]
},
"ignore_default_excludes": {
"type": [
"boolean",
"null"
]
},
"inherit": {
"anyOf": [
{
"$ref": "#/definitions/v2/ShellEnvironmentPolicyInherit"
},
{
"type": "null"
}
]
},
"rules": {
"additionalProperties": {
"$ref": "#/definitions/v2/ShellEnvironmentPolicyRule"
},
"type": [
"object",
"null"
]
},
"set": {
"additionalProperties": {
"type": "string"
},
"type": [
"object",
"null"
]
}
},
"type": "object"
},
"ShellEnvironmentPolicyRule": {
"description": "Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.",
"enum": [
"include",
"exclude"
],
"type": "string"
},
"SkillDependencies": {
"properties": {
"tools": {
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
Generated
+238
View File
@@ -1010,6 +1010,39 @@
}
]
},
"AuthCredentialsStoreMode": {
"description": "Determines where Codex stores CLI authentication credentials.",
"oneOf": [
{
"description": "Persist credentials in `CODEX_HOME/auth.json`.",
"enum": [
"file"
],
"type": "string"
},
{
"description": "Persist credentials in the operating system keyring. Fail if unavailable.",
"enum": [
"keyring"
],
"type": "string"
},
{
"description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.",
"enum": [
"auto"
],
"type": "string"
},
{
"description": "Store credentials in memory only for the current process.",
"enum": [
"ephemeral"
],
"type": "string"
}
]
},
"AuthMode": {
"description": "Authentication mode for OpenAI-backed providers.",
"oneOf": [
@@ -3975,6 +4008,16 @@
],
"description": "[UNSTABLE] Optional default for where approval requests are routed for review."
},
"cli_auth_credentials_store": {
"anyOf": [
{
"$ref": "#/definitions/AuthCredentialsStoreMode"
},
{
"type": "null"
}
]
},
"compact_prompt": {
"type": [
"string",
@@ -4473,6 +4516,12 @@
"null"
]
},
"allowLoginShell": {
"type": [
"boolean",
"null"
]
},
"allowManagedHooksOnly": {
"type": [
"boolean",
@@ -4494,6 +4543,24 @@
"null"
]
},
"allowedChatgptWorkspaces": {
"additionalProperties": {
"type": "boolean"
},
"type": [
"object",
"null"
]
},
"allowedLoginMethods": {
"additionalProperties": {
"type": "boolean"
},
"type": [
"object",
"null"
]
},
"allowedPermissionProfiles": {
"additionalProperties": {
"type": "boolean"
@@ -4530,6 +4597,28 @@
"null"
]
},
"chatgptBaseUrl": {
"type": [
"string",
"null"
]
},
"checkForUpdateOnStartup": {
"type": [
"boolean",
"null"
]
},
"cliAuthCredentialsStore": {
"anyOf": [
{
"$ref": "#/definitions/AuthCredentialsStoreMode"
},
{
"type": "null"
}
]
},
"computerUse": {
"anyOf": [
{
@@ -4564,6 +4653,66 @@
"object",
"null"
]
},
"feedback": {
"anyOf": [
{
"$ref": "#/definitions/FeedbackRequirements"
},
{
"type": "null"
}
]
},
"logDir": {
"anyOf": [
{
"$ref": "#/definitions/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"modelCatalogJson": {
"anyOf": [
{
"$ref": "#/definitions/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"otel": {
"description": "Lossless config-native OTEL requirements, including exporter headers."
},
"shellEnvironmentPolicy": {
"anyOf": [
{
"$ref": "#/definitions/ShellEnvironmentPolicyRequirements"
},
{
"type": "null"
}
],
"description": "Lossless config-native shell environment policy requirements."
},
"sqliteHome": {
"anyOf": [
{
"$ref": "#/definitions/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"windowsSandboxPrivateDesktop": {
"type": [
"boolean",
"null"
]
}
},
"type": "object"
@@ -5562,6 +5711,17 @@
],
"type": "string"
},
"FeedbackRequirements": {
"properties": {
"enabled": {
"type": [
"boolean",
"null"
]
}
},
"type": "object"
},
"FeedbackUploadParams": {
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
@@ -13642,6 +13802,84 @@
],
"type": "object"
},
"ShellEnvironmentPolicyInherit": {
"oneOf": [
{
"description": "\"Core\" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.",
"enum": [
"core"
],
"type": "string"
},
{
"description": "Inherits the full environment from the parent process.",
"enum": [
"all"
],
"type": "string"
},
{
"description": "Do not inherit any environment variables from the parent process.",
"enum": [
"none"
],
"type": "string"
}
]
},
"ShellEnvironmentPolicyRequirements": {
"properties": {
"experimental_use_profile": {
"type": [
"boolean",
"null"
]
},
"ignore_default_excludes": {
"type": [
"boolean",
"null"
]
},
"inherit": {
"anyOf": [
{
"$ref": "#/definitions/ShellEnvironmentPolicyInherit"
},
{
"type": "null"
}
]
},
"rules": {
"additionalProperties": {
"$ref": "#/definitions/ShellEnvironmentPolicyRule"
},
"type": [
"object",
"null"
]
},
"set": {
"additionalProperties": {
"type": "string"
},
"type": [
"object",
"null"
]
}
},
"type": "object"
},
"ShellEnvironmentPolicyRule": {
"description": "Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.",
"enum": [
"include",
"exclude"
],
"type": "string"
},
"SkillDependencies": {
"properties": {
"tools": {
codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
Generated
+43
View File
@@ -208,6 +208,39 @@
}
]
},
"AuthCredentialsStoreMode": {
"description": "Determines where Codex stores CLI authentication credentials.",
"oneOf": [
{
"description": "Persist credentials in `CODEX_HOME/auth.json`.",
"enum": [
"file"
],
"type": "string"
},
{
"description": "Persist credentials in the operating system keyring. Fail if unavailable.",
"enum": [
"keyring"
],
"type": "string"
},
{
"description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.",
"enum": [
"auto"
],
"type": "string"
},
{
"description": "Store credentials in memory only for the current process.",
"enum": [
"ephemeral"
],
"type": "string"
}
]
},
"AutoCompactTokenLimitScope": {
"description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.",
"oneOf": [
@@ -261,6 +294,16 @@
],
"description": "[UNSTABLE] Optional default for where approval requests are routed for review."
},
"cli_auth_credentials_store": {
"anyOf": [
{
"$ref": "#/definitions/AuthCredentialsStoreMode"
},
{
"type": "null"
}
]
},
"compact_prompt": {
"type": [
"string",
codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
Generated
+232
View File
@@ -1,6 +1,10 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"AbsolutePathBuf": {
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
"type": "string"
},
"ApprovalsReviewer": {
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",
"enum": [
@@ -60,6 +64,39 @@
}
]
},
"AuthCredentialsStoreMode": {
"description": "Determines where Codex stores CLI authentication credentials.",
"oneOf": [
{
"description": "Persist credentials in `CODEX_HOME/auth.json`.",
"enum": [
"file"
],
"type": "string"
},
{
"description": "Persist credentials in the operating system keyring. Fail if unavailable.",
"enum": [
"keyring"
],
"type": "string"
},
{
"description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.",
"enum": [
"auto"
],
"type": "string"
},
{
"description": "Store credentials in memory only for the current process.",
"enum": [
"ephemeral"
],
"type": "string"
}
]
},
"ComputerUseRequirements": {
"properties": {
"allowLockedComputerUse": {
@@ -79,6 +116,12 @@
"null"
]
},
"allowLoginShell": {
"type": [
"boolean",
"null"
]
},
"allowManagedHooksOnly": {
"type": [
"boolean",
@@ -100,6 +143,24 @@
"null"
]
},
"allowedChatgptWorkspaces": {
"additionalProperties": {
"type": "boolean"
},
"type": [
"object",
"null"
]
},
"allowedLoginMethods": {
"additionalProperties": {
"type": "boolean"
},
"type": [
"object",
"null"
]
},
"allowedPermissionProfiles": {
"additionalProperties": {
"type": "boolean"
@@ -136,6 +197,28 @@
"null"
]
},
"chatgptBaseUrl": {
"type": [
"string",
"null"
]
},
"checkForUpdateOnStartup": {
"type": [
"boolean",
"null"
]
},
"cliAuthCredentialsStore": {
"anyOf": [
{
"$ref": "#/definitions/AuthCredentialsStoreMode"
},
{
"type": "null"
}
]
},
"computerUse": {
"anyOf": [
{
@@ -170,6 +253,66 @@
"object",
"null"
]
},
"feedback": {
"anyOf": [
{
"$ref": "#/definitions/FeedbackRequirements"
},
{
"type": "null"
}
]
},
"logDir": {
"anyOf": [
{
"$ref": "#/definitions/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"modelCatalogJson": {
"anyOf": [
{
"$ref": "#/definitions/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"otel": {
"description": "Lossless config-native OTEL requirements, including exporter headers."
},
"shellEnvironmentPolicy": {
"anyOf": [
{
"$ref": "#/definitions/ShellEnvironmentPolicyRequirements"
},
{
"type": "null"
}
],
"description": "Lossless config-native shell environment policy requirements."
},
"sqliteHome": {
"anyOf": [
{
"$ref": "#/definitions/AbsolutePathBuf"
},
{
"type": "null"
}
]
},
"windowsSandboxPrivateDesktop": {
"type": [
"boolean",
"null"
]
}
},
"type": "object"
@@ -274,6 +417,17 @@
],
"type": "object"
},
"FeedbackRequirements": {
"properties": {
"enabled": {
"type": [
"boolean",
"null"
]
}
},
"type": "object"
},
"ManagedHooksRequirements": {
"properties": {
"PermissionRequest": {
@@ -499,6 +653,84 @@
],
"type": "string"
},
"ShellEnvironmentPolicyInherit": {
"oneOf": [
{
"description": "\"Core\" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.",
"enum": [
"core"
],
"type": "string"
},
{
"description": "Inherits the full environment from the parent process.",
"enum": [
"all"
],
"type": "string"
},
{
"description": "Do not inherit any environment variables from the parent process.",
"enum": [
"none"
],
"type": "string"
}
]
},
"ShellEnvironmentPolicyRequirements": {
"properties": {
"experimental_use_profile": {
"type": [
"boolean",
"null"
]
},
"ignore_default_excludes": {
"type": [
"boolean",
"null"
]
},
"inherit": {
"anyOf": [
{
"$ref": "#/definitions/ShellEnvironmentPolicyInherit"
},
{
"type": "null"
}
]
},
"rules": {
"additionalProperties": {
"$ref": "#/definitions/ShellEnvironmentPolicyRule"
},
"type": [
"object",
"null"
]
},
"set": {
"additionalProperties": {
"type": "string"
},
"type": [
"object",
"null"
]
}
},
"type": "object"
},
"ShellEnvironmentPolicyRule": {
"description": "Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.",
"enum": [
"include",
"exclude"
],
"type": "string"
},
"WebSearchMode": {
"enum": [
"disabled",
codex-rs/app-server-protocol/schema/typescript/v2/AuthCredentialsStoreMode.ts
Generated
+8
View File
@@ -0,0 +1,8 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
/**
* Determines where Codex stores CLI authentication credentials.
*/
export type AuthCredentialsStoreMode = "file" | "keyring" | "auto" | "ephemeral";
codex-rs/app-server-protocol/schema/typescript/v2/Config.ts
Generated
+2 -1
View File
@@ -11,6 +11,7 @@ import type { JsonValue } from "../serde_json/JsonValue";
import type { AnalyticsConfig } from "./AnalyticsConfig";
import type { ApprovalsReviewer } from "./ApprovalsReviewer";
import type { AskForApproval } from "./AskForApproval";
import type { AuthCredentialsStoreMode } from "./AuthCredentialsStoreMode";
import type { ForcedChatgptWorkspaceIds } from "./ForcedChatgptWorkspaceIds";
import type { SandboxMode } from "./SandboxMode";
import type { SandboxWorkspaceWrite } from "./SandboxWorkspaceWrite";
@@ -20,4 +21,4 @@ export type Config = {model: string | null, review_model: string | null, model_c
* [UNSTABLE] Optional default for where approval requests are routed for
* review.
*/
approvals_reviewer: ApprovalsReviewer | null, sandbox_mode: SandboxMode | null, sandbox_workspace_write: SandboxWorkspaceWrite | null, forced_chatgpt_workspace_id: ForcedChatgptWorkspaceIds | null, forced_login_method: ForcedLoginMethod | null, web_search: WebSearchMode | null, tools: ToolsV2 | null, instructions: string | null, developer_instructions: string | null, compact_prompt: string | null, model_reasoning_effort: ReasoningEffort | null, model_reasoning_summary: ReasoningSummary | null, model_verbosity: Verbosity | null, service_tier: string | null, analytics: AnalyticsConfig | null, desktop: { [key in string]?: JsonValue } | null} & ({ [key in string]?: number | string | boolean | Array<JsonValue> | { [key in string]?: JsonValue } | null });
approvals_reviewer: ApprovalsReviewer | null, sandbox_mode: SandboxMode | null, sandbox_workspace_write: SandboxWorkspaceWrite | null, forced_chatgpt_workspace_id: ForcedChatgptWorkspaceIds | null, forced_login_method: ForcedLoginMethod | null, cli_auth_credentials_store: AuthCredentialsStoreMode | null, web_search: WebSearchMode | null, tools: ToolsV2 | null, instructions: string | null, developer_instructions: string | null, compact_prompt: string | null, model_reasoning_effort: ReasoningEffort | null, model_reasoning_summary: ReasoningSummary | null, model_verbosity: Verbosity | null, service_tier: string | null, analytics: AnalyticsConfig | null, desktop: { [key in string]?: JsonValue } | null} & ({ [key in string]?: number | string | boolean | Array<JsonValue> | { [key in string]?: JsonValue } | null });
codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts
Generated
+12 -1
View File
@@ -1,11 +1,22 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { AbsolutePathBuf } from "../AbsolutePathBuf";
import type { WebSearchMode } from "../WebSearchMode";
import type { JsonValue } from "../serde_json/JsonValue";
import type { AskForApproval } from "./AskForApproval";
import type { AuthCredentialsStoreMode } from "./AuthCredentialsStoreMode";
import type { ComputerUseRequirements } from "./ComputerUseRequirements";
import type { FeedbackRequirements } from "./FeedbackRequirements";
import type { ResidencyRequirement } from "./ResidencyRequirement";
import type { SandboxMode } from "./SandboxMode";
import type { ShellEnvironmentPolicyRequirements } from "./ShellEnvironmentPolicyRequirements";
import type { WindowsSandboxSetupMode } from "./WindowsSandboxSetupMode";
export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedWindowsSandboxImplementations: Array<WindowsSandboxSetupMode> | null, allowedPermissionProfiles: { [key in string]?: boolean } | null, defaultPermissions: string | null, allowedWebSearchModes: Array<WebSearchMode> | null, allowManagedHooksOnly: boolean | null, allowAppshots: boolean | null, allowRemoteControl: boolean | null, computerUse: ComputerUseRequirements | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null};
export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedWindowsSandboxImplementations: Array<WindowsSandboxSetupMode> | null, allowedPermissionProfiles: { [key in string]?: boolean } | null, defaultPermissions: string | null, allowedWebSearchModes: Array<WebSearchMode> | null, allowManagedHooksOnly: boolean | null, allowAppshots: boolean | null, allowRemoteControl: boolean | null, computerUse: ComputerUseRequirements | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null, allowedLoginMethods: { [key in string]?: boolean } | null, allowedChatgptWorkspaces: { [key in string]?: boolean } | null, cliAuthCredentialsStore: AuthCredentialsStoreMode | null, chatgptBaseUrl: string | null, sqliteHome: AbsolutePathBuf | null, logDir: AbsolutePathBuf | null, modelCatalogJson: AbsolutePathBuf | null, checkForUpdateOnStartup: boolean | null, /**
* Lossless config-native OTEL requirements, including exporter headers.
*/
otel: JsonValue | null, allowLoginShell: boolean | null, /**
* Lossless config-native shell environment policy requirements.
*/
shellEnvironmentPolicy: ShellEnvironmentPolicyRequirements | null, feedback: FeedbackRequirements | null, windowsSandboxPrivateDesktop: boolean | null};
codex-rs/app-server-protocol/schema/typescript/v2/FeedbackRequirements.ts
Generated
+5
View File
@@ -0,0 +1,5 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type FeedbackRequirements = { enabled: boolean | null, };
codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyInherit.ts
Generated
+5
View File
@@ -0,0 +1,5 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type ShellEnvironmentPolicyInherit = "core" | "all" | "none";
codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRequirements.ts
Generated
+7
View File
@@ -0,0 +1,7 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { ShellEnvironmentPolicyInherit } from "./ShellEnvironmentPolicyInherit";
import type { ShellEnvironmentPolicyRule } from "./ShellEnvironmentPolicyRule";
export type ShellEnvironmentPolicyRequirements = { inherit: ShellEnvironmentPolicyInherit | null, ignore_default_excludes: boolean | null, set: { [key in string]?: string } | null, rules: { [key in string]?: ShellEnvironmentPolicyRule } | null, experimental_use_profile: boolean | null, };
codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRule.ts
Generated
+9
View File
@@ -0,0 +1,9 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
/**
* Assigns a shell environment variable pattern to the include-only or exclude
* set. Includes do not re-add variables removed by another exclude pattern.
*/
export type ShellEnvironmentPolicyRule = "include" | "exclude";
codex-rs/app-server-protocol/schema/typescript/v2/index.ts
Generated
+5
View File
@@ -35,6 +35,7 @@ export type { AppsListResponse } from "./AppsListResponse";
export type { AskForApproval } from "./AskForApproval";
export type { AttestationGenerateParams } from "./AttestationGenerateParams";
export type { AttestationGenerateResponse } from "./AttestationGenerateResponse";
export type { AuthCredentialsStoreMode } from "./AuthCredentialsStoreMode";
export type { AutoReviewDecisionSource } from "./AutoReviewDecisionSource";
export type { ByteRange } from "./ByteRange";
export type { CancelLoginAccountParams } from "./CancelLoginAccountParams";
@@ -117,6 +118,7 @@ export type { ExternalAgentConfigImportResponse } from "./ExternalAgentConfigImp
export type { ExternalAgentConfigImportTypeResult } from "./ExternalAgentConfigImportTypeResult";
export type { ExternalAgentConfigMigrationItem } from "./ExternalAgentConfigMigrationItem";
export type { ExternalAgentConfigMigrationItemType } from "./ExternalAgentConfigMigrationItemType";
export type { FeedbackRequirements } from "./FeedbackRequirements";
export type { FeedbackUploadParams } from "./FeedbackUploadParams";
export type { FeedbackUploadResponse } from "./FeedbackUploadResponse";
export type { FileChangeApprovalDecision } from "./FileChangeApprovalDecision";
@@ -353,6 +355,9 @@ export type { SendAddCreditsNudgeEmailResponse } from "./SendAddCreditsNudgeEmai
export type { ServerRequestResolvedNotification } from "./ServerRequestResolvedNotification";
export type { SessionMigration } from "./SessionMigration";
export type { SessionSource } from "./SessionSource";
export type { ShellEnvironmentPolicyInherit } from "./ShellEnvironmentPolicyInherit";
export type { ShellEnvironmentPolicyRequirements } from "./ShellEnvironmentPolicyRequirements";
export type { ShellEnvironmentPolicyRule } from "./ShellEnvironmentPolicyRule";
export type { SkillDependencies } from "./SkillDependencies";
export type { SkillErrorInfo } from "./SkillErrorInfo";
export type { SkillInterface } from "./SkillInterface";
codex-rs/app-server-protocol/src/protocol/v2/config.rs
+40 -1
View File
@@ -4,9 +4,12 @@ use super::SandboxMode;
use super::WindowsSandboxSetupMode;
use super::shared::default_enabled;
use codex_experimental_api_macros::ExperimentalApi;
pub use codex_protocol::config_types::AuthCredentialsStoreMode;
use codex_protocol::config_types::AutoCompactTokenLimitScope;
use codex_protocol::config_types::ForcedLoginMethod;
use codex_protocol::config_types::ReasoningSummary;
use codex_protocol::config_types::ShellEnvironmentPolicyInherit;
use codex_protocol::config_types::ShellEnvironmentPolicyRule;
use codex_protocol::config_types::Verbosity;
use codex_protocol::config_types::WebSearchMode;
use codex_protocol::config_types::WebSearchToolConfig;
@@ -257,6 +260,7 @@ pub struct Config {
pub sandbox_workspace_write: Option<SandboxWorkspaceWrite>,
pub forced_chatgpt_workspace_id: Option<ForcedChatgptWorkspaceIds>,
pub forced_login_method: Option<ForcedLoginMethod>,
pub cli_auth_credentials_store: Option<AuthCredentialsStoreMode>,
pub web_search: Option<WebSearchMode>,
pub tools: Option<ToolsV2>,
pub instructions: Option<String>,
@@ -366,7 +370,9 @@ pub struct ConfigReadResponse {
pub layers: Option<Vec<ConfigLayer>>,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS, ExperimentalApi)]
#[derive(
Serialize, Deserialize, Debug, Clone, Default, PartialEq, JsonSchema, TS, ExperimentalApi,
)]
#[serde(rename_all = "camelCase")]
#[ts(export_to = "v2/")]
pub struct ConfigRequirements {
@@ -389,6 +395,39 @@ pub struct ConfigRequirements {
pub enforce_residency: Option<ResidencyRequirement>,
#[experimental("configRequirements/read.network")]
pub network: Option<NetworkRequirements>,
pub allowed_login_methods: Option<BTreeMap<String, bool>>,
pub allowed_chatgpt_workspaces: Option<BTreeMap<String, bool>>,
pub cli_auth_credentials_store: Option<AuthCredentialsStoreMode>,
pub chatgpt_base_url: Option<String>,
pub sqlite_home: Option<AbsolutePathBuf>,
pub log_dir: Option<AbsolutePathBuf>,
pub model_catalog_json: Option<AbsolutePathBuf>,
pub check_for_update_on_startup: Option<bool>,
/// Lossless config-native OTEL requirements, including exporter headers.
pub otel: Option<JsonValue>,
pub allow_login_shell: Option<bool>,
/// Lossless config-native shell environment policy requirements.
pub shell_environment_policy: Option<ShellEnvironmentPolicyRequirements>,
pub feedback: Option<FeedbackRequirements>,
pub windows_sandbox_private_desktop: Option<bool>,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
#[serde(rename_all = "camelCase")]
#[ts(export_to = "v2/")]
pub struct FeedbackRequirements {
pub enabled: Option<bool>,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
#[serde(rename_all = "snake_case")]
#[ts(export_to = "v2/")]
pub struct ShellEnvironmentPolicyRequirements {
pub inherit: Option<ShellEnvironmentPolicyInherit>,
pub ignore_default_excludes: Option<bool>,
pub r#set: Option<HashMap<String, String>>,
pub rules: Option<BTreeMap<String, ShellEnvironmentPolicyRule>>,
pub experimental_use_profile: Option<bool>,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
codex-rs/app-server-protocol/src/protocol/v2/tests.rs
+3 -14
View File
@@ -1643,6 +1643,7 @@ fn config_granular_approval_policy_is_marked_experimental() {
sandbox_workspace_write: None,
forced_chatgpt_workspace_id: None,
forced_login_method: None,
cli_auth_credentials_store: None,
web_search: None,
tools: None,
instructions: None,
@@ -1676,6 +1677,7 @@ fn config_approvals_reviewer_is_marked_experimental() {
sandbox_workspace_write: None,
forced_chatgpt_workspace_id: None,
forced_login_method: None,
cli_auth_credentials_store: None,
web_search: None,
tools: None,
instructions: None,
@@ -1705,20 +1707,7 @@ fn config_requirements_granular_allowed_approval_policy_is_marked_experimental()
request_permissions: false,
mcp_elicitations: false,
}]),
allowed_approvals_reviewers: None,
allowed_sandbox_modes: None,
allowed_windows_sandbox_implementations: None,
allowed_permission_profiles: None,
default_permissions: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
allow_remote_control: None,
computer_use: None,
feature_requirements: None,
hooks: None,
enforce_residency: None,
network: None,
..Default::default()
});
assert_eq!(reason, Some("askForApproval.granular"));
codex-rs/app-server/README.md
+1 -1
View File
@@ -235,7 +235,7 @@ Example with notification opt-out:
- `externalAgentConfig/import` — apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home) and any plugin/session `details` returned by detect. Returns an `importId` used to correlate the completion notification. When a request includes migration items, the server emits `externalAgentConfig/import/completed` once after the full import finishes with type-level `itemResults` containing each migrated type's success count, error count, successes, and raw errors (immediately after the response when everything completed synchronously, or after background imports finish).
- `config/value/write` — write a single config key/value to the user's config.toml on disk; dotted paths such as `desktop.someKey` use the same generic write surface.
- `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads, including multiple `desktop.*` edits.
- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), the layered permission-profile allow map (`allowedPermissionProfiles`), the managed permission-profile default (`defaultPermissions`), lifecycle hook lockdown (`allowManagedHooksOnly`), remote-control policy (`allowRemoteControl`; `false` force-disables remote control while `true` or `null` preserves existing behavior), computer use policy (`computerUse`), pinned feature values (`featureRequirements`), managed lifecycle hooks (`hooks`), `enforceResidency`, and `network` constraints such as canonical domain/socket permissions plus `managedAllowedDomainsOnly` and `dangerFullAccessDenylistOnly`.
- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`, `allowedLoginMethods`, `allowedChatgptWorkspaces`), the layered permission-profile allow map (`allowedPermissionProfiles`), the managed permission-profile default (`defaultPermissions`), lifecycle hook lockdown (`allowManagedHooksOnly`), remote-control policy (`allowRemoteControl`; `false` force-disables remote control while `true` or `null` preserves existing behavior), computer use policy (`computerUse`), pinned feature values (`featureRequirements`), managed lifecycle hooks (`hooks`), `enforceResidency`, `network` constraints such as canonical domain/socket permissions plus `managedAllowedDomainsOnly` and `dangerFullAccessDenylistOnly`, and pinned runtime settings such as credential storage, ChatGPT base URL, state/log/model-catalog paths, update checks, login-shell and environment policy, feedback, Windows private-desktop use, and OTEL configuration. Shell environment requirements expose pattern-to-action `rules` whose values are `include` or `exclude`; OTEL exporter responses include their complete headers map.
### Example: Start or resume a thread
codex-rs/app-server/src/request_processors/config_processor.rs
+105 -1
View File
@@ -22,6 +22,7 @@ use codex_app_server_protocol::ConfiguredHookHandler;
use codex_app_server_protocol::ConfiguredHookMatcherGroup;
use codex_app_server_protocol::ExperimentalFeatureEnablementSetParams;
use codex_app_server_protocol::ExperimentalFeatureEnablementSetResponse;
use codex_app_server_protocol::FeedbackRequirements;
use codex_app_server_protocol::JSONRPCErrorError;
use codex_app_server_protocol::ManagedHooksRequirements;
use codex_app_server_protocol::ModelProviderCapabilitiesReadResponse;
@@ -29,6 +30,7 @@ use codex_app_server_protocol::NetworkDomainPermission;
use codex_app_server_protocol::NetworkRequirements;
use codex_app_server_protocol::NetworkUnixSocketPermission;
use codex_app_server_protocol::SandboxMode;
use codex_app_server_protocol::ShellEnvironmentPolicyRequirements;
use codex_app_server_protocol::WindowsSandboxSetupMode;
use codex_config::ConfigRequirementsToml;
use codex_config::HookEventsToml;
@@ -37,6 +39,7 @@ use codex_config::ManagedHooksRequirementsToml;
use codex_config::MatcherGroup as CoreMatcherGroup;
use codex_config::ResidencyRequirement as CoreResidencyRequirement;
use codex_config::SandboxModeRequirement as CoreSandboxModeRequirement;
use codex_config::ShellEnvironmentPolicyRequirementsToml;
use codex_core::ThreadManager;
use codex_features::canonical_feature_for_key;
use codex_features::feature_for_key;
@@ -325,6 +328,11 @@ impl ConfigRequestProcessor {
}
fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigRequirements {
let windows_sandbox_private_desktop = requirements
.windows
.as_ref()
.and_then(|windows| windows.sandbox_private_desktop);
ConfigRequirements {
allowed_approval_policies: requirements.allowed_approval_policies.map(|policies| {
policies
@@ -387,6 +395,42 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR
.enforce_residency
.map(map_residency_requirement_to_api),
network: requirements.network.map(map_network_requirements_to_api),
allowed_login_methods: requirements.allowed_login_methods,
allowed_chatgpt_workspaces: requirements.allowed_chatgpt_workspaces,
cli_auth_credentials_store: requirements.cli_auth_credentials_store,
chatgpt_base_url: requirements.chatgpt_base_url,
sqlite_home: requirements.sqlite_home,
log_dir: requirements.log_dir,
model_catalog_json: requirements.model_catalog_json,
check_for_update_on_startup: requirements.check_for_update_on_startup,
otel: requirements.otel.map(|otel| json!(otel)),
allow_login_shell: requirements.allow_login_shell,
shell_environment_policy: requirements
.shell_environment_policy
.map(map_shell_environment_policy_requirements_to_api),
feedback: requirements.feedback.map(|feedback| FeedbackRequirements {
enabled: feedback.enabled,
}),
windows_sandbox_private_desktop,
}
}
fn map_shell_environment_policy_requirements_to_api(
policy: ShellEnvironmentPolicyRequirementsToml,
) -> ShellEnvironmentPolicyRequirements {
let ShellEnvironmentPolicyRequirementsToml {
inherit,
ignore_default_excludes,
r#set,
rules,
experimental_use_profile,
} = policy;
ShellEnvironmentPolicyRequirements {
inherit,
ignore_default_excludes,
r#set,
rules,
experimental_use_profile,
}
}
@@ -577,12 +621,17 @@ fn config_write_error(code: ConfigWriteErrorCode, message: impl Into<String>) ->
#[cfg(test)]
mod tests {
use super::map_requirements_toml_to_api;
use codex_app_server_protocol::ShellEnvironmentPolicyRequirements;
use codex_app_server_protocol::WindowsSandboxSetupMode;
use codex_config::ComputerUseRequirementsToml;
use codex_config::ConfigRequirementsToml;
use codex_config::WindowsRequirementsToml;
use codex_protocol::config_types::ShellEnvironmentPolicyInherit;
use codex_protocol::config_types::ShellEnvironmentPolicyRule;
use pretty_assertions::assert_eq;
use serde_json::json;
use std::collections::BTreeMap;
use std::collections::HashMap;
#[test]
fn requirements_api_includes_allow_managed_hooks_only() {
@@ -665,7 +714,7 @@ mod tests {
codex_config::types::WindowsSandboxModeToml::Elevated,
codex_config::types::WindowsSandboxModeToml::Unelevated,
]),
sandbox_private_desktop: None,
sandbox_private_desktop: Some(false),
}),
..ConfigRequirementsToml::default()
});
@@ -677,5 +726,60 @@ mod tests {
WindowsSandboxSetupMode::Unelevated,
])
);
assert_eq!(mapped.windows_sandbox_private_desktop, Some(false));
}
#[test]
fn requirements_api_preserves_otel_headers_and_shell_environment_policy() {
let requirements = toml::from_str(
r#"
[otel]
log_user_prompt = false
environment = "production"
exporter = { otlp-http = { endpoint = "https://otel.example.com/v1/logs", headers = { Authorization = "Bearer secret" }, protocol = "json" } }
[otel.span_attributes]
team = "codex"
[shell_environment_policy]
inherit = "core"
ignore_default_excludes = false
experimental_use_profile = false
[shell_environment_policy.rules]
"*SECRET*" = "exclude"
"HOME" = "include"
"PATH" = "exclude"
[shell_environment_policy.set]
MANAGED = "true"
"#,
)
.expect("valid requirements TOML");
let mapped = map_requirements_toml_to_api(requirements);
assert_eq!(
mapped
.otel
.as_ref()
.and_then(|otel| otel.pointer("/exporter/otlp-http/headers")),
Some(&json!({"Authorization": "Bearer secret"}))
);
assert_eq!(
mapped.shell_environment_policy,
Some(ShellEnvironmentPolicyRequirements {
inherit: Some(ShellEnvironmentPolicyInherit::Core),
ignore_default_excludes: Some(false),
r#set: Some(HashMap::from([
("MANAGED".to_string(), "true".to_string(),)
])),
rules: Some(BTreeMap::from([
("*SECRET*".to_string(), ShellEnvironmentPolicyRule::Exclude,),
("HOME".to_string(), ShellEnvironmentPolicyRule::Include,),
("PATH".to_string(), ShellEnvironmentPolicyRule::Exclude,),
])),
experimental_use_profile: Some(false),
})
);
}
}
codex-rs/app-server/tests/suite/v2/config_rpc.rs
+6
View File
@@ -9,6 +9,7 @@ use codex_app_server_protocol::ApprovalsReviewer;
use codex_app_server_protocol::AppsConfig;
use codex_app_server_protocol::AppsDefaultConfig;
use codex_app_server_protocol::AskForApproval;
use codex_app_server_protocol::AuthCredentialsStoreMode;
use codex_app_server_protocol::ConfigBatchWriteParams;
use codex_app_server_protocol::ConfigEdit;
use codex_app_server_protocol::ConfigLayerSource;
@@ -83,6 +84,7 @@ async fn config_read_returns_effective_and_layers() -> Result<()> {
r#"
model = "gpt-user"
sandbox_mode = "workspace-write"
cli_auth_credentials_store = "keyring"
"#,
)?;
let codex_home_path = codex_home.path().canonicalize()?;
@@ -109,6 +111,10 @@ sandbox_mode = "workspace-write"
} = to_response(resp)?;
assert_eq!(config.model.as_deref(), Some("gpt-user"));
assert_eq!(
config.cli_auth_credentials_store,
Some(AuthCredentialsStoreMode::Keyring)
);
assert_eq!(
origins.get("model").expect("origin").name,
ConfigLayerSource::User {
codex-rs/protocol/src/config_types.rs
+2 -1
View File
@@ -201,8 +201,9 @@ impl JsonSchema for ApprovalsReviewer {
}
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Default, JsonSchema)]
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Default, JsonSchema, TS)]
#[serde(rename_all = "kebab-case")]
#[ts(export_to = "v2/")]
pub enum ShellEnvironmentPolicyInherit {
/// "Core" environment variables for the platform. On UNIX, this would
/// include HOME, LOGNAME, PATH, SHELL, and USER, among others.