From ad98d7405251dcf2b5f4400c14ec2cc55eeef002 Mon Sep 17 00:00:00 2001 From: Abhinav Vedmala Date: Mon, 15 Jun 2026 23:33:00 +0000 Subject: [PATCH] Expose managed requirements through the app-server API --- .../codex_app_server_protocol.schemas.json | 238 ++++++++++++++++++ .../codex_app_server_protocol.v2.schemas.json | 238 ++++++++++++++++++ .../schema/json/v2/ConfigReadResponse.json | 43 ++++ .../v2/ConfigRequirementsReadResponse.json | 232 +++++++++++++++++ .../typescript/v2/AuthCredentialsStoreMode.ts | 8 + .../schema/typescript/v2/Config.ts | 3 +- .../typescript/v2/ConfigRequirements.ts | 13 +- .../typescript/v2/FeedbackRequirements.ts | 5 + .../v2/ShellEnvironmentPolicyInherit.ts | 5 + .../v2/ShellEnvironmentPolicyRequirements.ts | 7 + .../v2/ShellEnvironmentPolicyRule.ts | 9 + .../schema/typescript/v2/index.ts | 5 + .../src/protocol/v2/config.rs | 41 ++- .../src/protocol/v2/tests.rs | 17 +- codex-rs/app-server/README.md | 2 +- .../request_processors/config_processor.rs | 106 +++++++- .../app-server/tests/suite/v2/config_rpc.rs | 6 + codex-rs/protocol/src/config_types.rs | 3 +- 18 files changed, 961 insertions(+), 20 deletions(-) create mode 100644 codex-rs/app-server-protocol/schema/typescript/v2/AuthCredentialsStoreMode.ts create mode 100644 codex-rs/app-server-protocol/schema/typescript/v2/FeedbackRequirements.ts create mode 100644 codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyInherit.ts create mode 100644 codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRequirements.ts create mode 100644 codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRule.ts diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index 7e431cea8c..d452b9965c 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -6765,6 +6765,39 @@ } ] }, + "AuthCredentialsStoreMode": { + "description": "Determines where Codex stores CLI authentication credentials.", + "oneOf": [ + { + "description": "Persist credentials in `CODEX_HOME/auth.json`.", + "enum": [ + "file" + ], + "type": "string" + }, + { + "description": "Persist credentials in the operating system keyring. Fail if unavailable.", + "enum": [ + "keyring" + ], + "type": "string" + }, + { + "description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.", + "enum": [ + "auto" + ], + "type": "string" + }, + { + "description": "Store credentials in memory only for the current process.", + "enum": [ + "ephemeral" + ], + "type": "string" + } + ] + }, "AuthMode": { "description": "Authentication mode for OpenAI-backed providers.", "oneOf": [ @@ -7662,6 +7695,16 @@ ], "description": "[UNSTABLE] Optional default for where approval requests are routed for review." }, + "cli_auth_credentials_store": { + "anyOf": [ + { + "$ref": "#/definitions/v2/AuthCredentialsStoreMode" + }, + { + "type": "null" + } + ] + }, "compact_prompt": { "type": [ "string", @@ -8160,6 +8203,12 @@ "null" ] }, + "allowLoginShell": { + "type": [ + "boolean", + "null" + ] + }, "allowManagedHooksOnly": { "type": [ "boolean", @@ -8181,6 +8230,24 @@ "null" ] }, + "allowedChatgptWorkspaces": { + "additionalProperties": { + "type": "boolean" + }, + "type": [ + "object", + "null" + ] + }, + "allowedLoginMethods": { + "additionalProperties": { + "type": "boolean" + }, + "type": [ + "object", + "null" + ] + }, "allowedPermissionProfiles": { "additionalProperties": { "type": "boolean" @@ -8217,6 +8284,28 @@ "null" ] }, + "chatgptBaseUrl": { + "type": [ + "string", + "null" + ] + }, + "checkForUpdateOnStartup": { + "type": [ + "boolean", + "null" + ] + }, + "cliAuthCredentialsStore": { + "anyOf": [ + { + "$ref": "#/definitions/v2/AuthCredentialsStoreMode" + }, + { + "type": "null" + } + ] + }, "computerUse": { "anyOf": [ { @@ -8251,6 +8340,66 @@ "object", "null" ] + }, + "feedback": { + "anyOf": [ + { + "$ref": "#/definitions/v2/FeedbackRequirements" + }, + { + "type": "null" + } + ] + }, + "logDir": { + "anyOf": [ + { + "$ref": "#/definitions/v2/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "modelCatalogJson": { + "anyOf": [ + { + "$ref": "#/definitions/v2/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "otel": { + "description": "Lossless config-native OTEL requirements, including exporter headers." + }, + "shellEnvironmentPolicy": { + "anyOf": [ + { + "$ref": "#/definitions/v2/ShellEnvironmentPolicyRequirements" + }, + { + "type": "null" + } + ], + "description": "Lossless config-native shell environment policy requirements." + }, + "sqliteHome": { + "anyOf": [ + { + "$ref": "#/definitions/v2/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "windowsSandboxPrivateDesktop": { + "type": [ + "boolean", + "null" + ] } }, "type": "object" @@ -9249,6 +9398,17 @@ ], "type": "string" }, + "FeedbackRequirements": { + "properties": { + "enabled": { + "type": [ + "boolean", + "null" + ] + } + }, + "type": "object" + }, "FeedbackUploadParams": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { @@ -15834,6 +15994,84 @@ ], "type": "object" }, + "ShellEnvironmentPolicyInherit": { + "oneOf": [ + { + "description": "\"Core\" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.", + "enum": [ + "core" + ], + "type": "string" + }, + { + "description": "Inherits the full environment from the parent process.", + "enum": [ + "all" + ], + "type": "string" + }, + { + "description": "Do not inherit any environment variables from the parent process.", + "enum": [ + "none" + ], + "type": "string" + } + ] + }, + "ShellEnvironmentPolicyRequirements": { + "properties": { + "experimental_use_profile": { + "type": [ + "boolean", + "null" + ] + }, + "ignore_default_excludes": { + "type": [ + "boolean", + "null" + ] + }, + "inherit": { + "anyOf": [ + { + "$ref": "#/definitions/v2/ShellEnvironmentPolicyInherit" + }, + { + "type": "null" + } + ] + }, + "rules": { + "additionalProperties": { + "$ref": "#/definitions/v2/ShellEnvironmentPolicyRule" + }, + "type": [ + "object", + "null" + ] + }, + "set": { + "additionalProperties": { + "type": "string" + }, + "type": [ + "object", + "null" + ] + } + }, + "type": "object" + }, + "ShellEnvironmentPolicyRule": { + "description": "Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.", + "enum": [ + "include", + "exclude" + ], + "type": "string" + }, "SkillDependencies": { "properties": { "tools": { diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json index 2733bc2719..4923d6f510 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json @@ -1010,6 +1010,39 @@ } ] }, + "AuthCredentialsStoreMode": { + "description": "Determines where Codex stores CLI authentication credentials.", + "oneOf": [ + { + "description": "Persist credentials in `CODEX_HOME/auth.json`.", + "enum": [ + "file" + ], + "type": "string" + }, + { + "description": "Persist credentials in the operating system keyring. Fail if unavailable.", + "enum": [ + "keyring" + ], + "type": "string" + }, + { + "description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.", + "enum": [ + "auto" + ], + "type": "string" + }, + { + "description": "Store credentials in memory only for the current process.", + "enum": [ + "ephemeral" + ], + "type": "string" + } + ] + }, "AuthMode": { "description": "Authentication mode for OpenAI-backed providers.", "oneOf": [ @@ -3975,6 +4008,16 @@ ], "description": "[UNSTABLE] Optional default for where approval requests are routed for review." }, + "cli_auth_credentials_store": { + "anyOf": [ + { + "$ref": "#/definitions/AuthCredentialsStoreMode" + }, + { + "type": "null" + } + ] + }, "compact_prompt": { "type": [ "string", @@ -4473,6 +4516,12 @@ "null" ] }, + "allowLoginShell": { + "type": [ + "boolean", + "null" + ] + }, "allowManagedHooksOnly": { "type": [ "boolean", @@ -4494,6 +4543,24 @@ "null" ] }, + "allowedChatgptWorkspaces": { + "additionalProperties": { + "type": "boolean" + }, + "type": [ + "object", + "null" + ] + }, + "allowedLoginMethods": { + "additionalProperties": { + "type": "boolean" + }, + "type": [ + "object", + "null" + ] + }, "allowedPermissionProfiles": { "additionalProperties": { "type": "boolean" @@ -4530,6 +4597,28 @@ "null" ] }, + "chatgptBaseUrl": { + "type": [ + "string", + "null" + ] + }, + "checkForUpdateOnStartup": { + "type": [ + "boolean", + "null" + ] + }, + "cliAuthCredentialsStore": { + "anyOf": [ + { + "$ref": "#/definitions/AuthCredentialsStoreMode" + }, + { + "type": "null" + } + ] + }, "computerUse": { "anyOf": [ { @@ -4564,6 +4653,66 @@ "object", "null" ] + }, + "feedback": { + "anyOf": [ + { + "$ref": "#/definitions/FeedbackRequirements" + }, + { + "type": "null" + } + ] + }, + "logDir": { + "anyOf": [ + { + "$ref": "#/definitions/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "modelCatalogJson": { + "anyOf": [ + { + "$ref": "#/definitions/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "otel": { + "description": "Lossless config-native OTEL requirements, including exporter headers." + }, + "shellEnvironmentPolicy": { + "anyOf": [ + { + "$ref": "#/definitions/ShellEnvironmentPolicyRequirements" + }, + { + "type": "null" + } + ], + "description": "Lossless config-native shell environment policy requirements." + }, + "sqliteHome": { + "anyOf": [ + { + "$ref": "#/definitions/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "windowsSandboxPrivateDesktop": { + "type": [ + "boolean", + "null" + ] } }, "type": "object" @@ -5562,6 +5711,17 @@ ], "type": "string" }, + "FeedbackRequirements": { + "properties": { + "enabled": { + "type": [ + "boolean", + "null" + ] + } + }, + "type": "object" + }, "FeedbackUploadParams": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { @@ -13642,6 +13802,84 @@ ], "type": "object" }, + "ShellEnvironmentPolicyInherit": { + "oneOf": [ + { + "description": "\"Core\" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.", + "enum": [ + "core" + ], + "type": "string" + }, + { + "description": "Inherits the full environment from the parent process.", + "enum": [ + "all" + ], + "type": "string" + }, + { + "description": "Do not inherit any environment variables from the parent process.", + "enum": [ + "none" + ], + "type": "string" + } + ] + }, + "ShellEnvironmentPolicyRequirements": { + "properties": { + "experimental_use_profile": { + "type": [ + "boolean", + "null" + ] + }, + "ignore_default_excludes": { + "type": [ + "boolean", + "null" + ] + }, + "inherit": { + "anyOf": [ + { + "$ref": "#/definitions/ShellEnvironmentPolicyInherit" + }, + { + "type": "null" + } + ] + }, + "rules": { + "additionalProperties": { + "$ref": "#/definitions/ShellEnvironmentPolicyRule" + }, + "type": [ + "object", + "null" + ] + }, + "set": { + "additionalProperties": { + "type": "string" + }, + "type": [ + "object", + "null" + ] + } + }, + "type": "object" + }, + "ShellEnvironmentPolicyRule": { + "description": "Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.", + "enum": [ + "include", + "exclude" + ], + "type": "string" + }, "SkillDependencies": { "properties": { "tools": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json index 3bc0a8e0a9..ed8bde40a3 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json @@ -208,6 +208,39 @@ } ] }, + "AuthCredentialsStoreMode": { + "description": "Determines where Codex stores CLI authentication credentials.", + "oneOf": [ + { + "description": "Persist credentials in `CODEX_HOME/auth.json`.", + "enum": [ + "file" + ], + "type": "string" + }, + { + "description": "Persist credentials in the operating system keyring. Fail if unavailable.", + "enum": [ + "keyring" + ], + "type": "string" + }, + { + "description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.", + "enum": [ + "auto" + ], + "type": "string" + }, + { + "description": "Store credentials in memory only for the current process.", + "enum": [ + "ephemeral" + ], + "type": "string" + } + ] + }, "AutoCompactTokenLimitScope": { "description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.", "oneOf": [ @@ -261,6 +294,16 @@ ], "description": "[UNSTABLE] Optional default for where approval requests are routed for review." }, + "cli_auth_credentials_store": { + "anyOf": [ + { + "$ref": "#/definitions/AuthCredentialsStoreMode" + }, + { + "type": "null" + } + ] + }, "compact_prompt": { "type": [ "string", diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json index e57bd48b79..41e2b4e3aa 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json @@ -1,6 +1,10 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { + "AbsolutePathBuf": { + "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.", + "type": "string" + }, "ApprovalsReviewer": { "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.", "enum": [ @@ -60,6 +64,39 @@ } ] }, + "AuthCredentialsStoreMode": { + "description": "Determines where Codex stores CLI authentication credentials.", + "oneOf": [ + { + "description": "Persist credentials in `CODEX_HOME/auth.json`.", + "enum": [ + "file" + ], + "type": "string" + }, + { + "description": "Persist credentials in the operating system keyring. Fail if unavailable.", + "enum": [ + "keyring" + ], + "type": "string" + }, + { + "description": "Use the operating system keyring when available; otherwise, fall back to `CODEX_HOME/auth.json`.", + "enum": [ + "auto" + ], + "type": "string" + }, + { + "description": "Store credentials in memory only for the current process.", + "enum": [ + "ephemeral" + ], + "type": "string" + } + ] + }, "ComputerUseRequirements": { "properties": { "allowLockedComputerUse": { @@ -79,6 +116,12 @@ "null" ] }, + "allowLoginShell": { + "type": [ + "boolean", + "null" + ] + }, "allowManagedHooksOnly": { "type": [ "boolean", @@ -100,6 +143,24 @@ "null" ] }, + "allowedChatgptWorkspaces": { + "additionalProperties": { + "type": "boolean" + }, + "type": [ + "object", + "null" + ] + }, + "allowedLoginMethods": { + "additionalProperties": { + "type": "boolean" + }, + "type": [ + "object", + "null" + ] + }, "allowedPermissionProfiles": { "additionalProperties": { "type": "boolean" @@ -136,6 +197,28 @@ "null" ] }, + "chatgptBaseUrl": { + "type": [ + "string", + "null" + ] + }, + "checkForUpdateOnStartup": { + "type": [ + "boolean", + "null" + ] + }, + "cliAuthCredentialsStore": { + "anyOf": [ + { + "$ref": "#/definitions/AuthCredentialsStoreMode" + }, + { + "type": "null" + } + ] + }, "computerUse": { "anyOf": [ { @@ -170,6 +253,66 @@ "object", "null" ] + }, + "feedback": { + "anyOf": [ + { + "$ref": "#/definitions/FeedbackRequirements" + }, + { + "type": "null" + } + ] + }, + "logDir": { + "anyOf": [ + { + "$ref": "#/definitions/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "modelCatalogJson": { + "anyOf": [ + { + "$ref": "#/definitions/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "otel": { + "description": "Lossless config-native OTEL requirements, including exporter headers." + }, + "shellEnvironmentPolicy": { + "anyOf": [ + { + "$ref": "#/definitions/ShellEnvironmentPolicyRequirements" + }, + { + "type": "null" + } + ], + "description": "Lossless config-native shell environment policy requirements." + }, + "sqliteHome": { + "anyOf": [ + { + "$ref": "#/definitions/AbsolutePathBuf" + }, + { + "type": "null" + } + ] + }, + "windowsSandboxPrivateDesktop": { + "type": [ + "boolean", + "null" + ] } }, "type": "object" @@ -274,6 +417,17 @@ ], "type": "object" }, + "FeedbackRequirements": { + "properties": { + "enabled": { + "type": [ + "boolean", + "null" + ] + } + }, + "type": "object" + }, "ManagedHooksRequirements": { "properties": { "PermissionRequest": { @@ -499,6 +653,84 @@ ], "type": "string" }, + "ShellEnvironmentPolicyInherit": { + "oneOf": [ + { + "description": "\"Core\" environment variables for the platform. On UNIX, this would include HOME, LOGNAME, PATH, SHELL, and USER, among others.", + "enum": [ + "core" + ], + "type": "string" + }, + { + "description": "Inherits the full environment from the parent process.", + "enum": [ + "all" + ], + "type": "string" + }, + { + "description": "Do not inherit any environment variables from the parent process.", + "enum": [ + "none" + ], + "type": "string" + } + ] + }, + "ShellEnvironmentPolicyRequirements": { + "properties": { + "experimental_use_profile": { + "type": [ + "boolean", + "null" + ] + }, + "ignore_default_excludes": { + "type": [ + "boolean", + "null" + ] + }, + "inherit": { + "anyOf": [ + { + "$ref": "#/definitions/ShellEnvironmentPolicyInherit" + }, + { + "type": "null" + } + ] + }, + "rules": { + "additionalProperties": { + "$ref": "#/definitions/ShellEnvironmentPolicyRule" + }, + "type": [ + "object", + "null" + ] + }, + "set": { + "additionalProperties": { + "type": "string" + }, + "type": [ + "object", + "null" + ] + } + }, + "type": "object" + }, + "ShellEnvironmentPolicyRule": { + "description": "Assigns a shell environment variable pattern to the include-only or exclude set. Includes do not re-add variables removed by another exclude pattern.", + "enum": [ + "include", + "exclude" + ], + "type": "string" + }, "WebSearchMode": { "enum": [ "disabled", diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AuthCredentialsStoreMode.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AuthCredentialsStoreMode.ts new file mode 100644 index 0000000000..ecc556b9da --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/AuthCredentialsStoreMode.ts @@ -0,0 +1,8 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +/** + * Determines where Codex stores CLI authentication credentials. + */ +export type AuthCredentialsStoreMode = "file" | "keyring" | "auto" | "ephemeral"; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts b/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts index cc15fb4e72..aa1ffc41a4 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts @@ -11,6 +11,7 @@ import type { JsonValue } from "../serde_json/JsonValue"; import type { AnalyticsConfig } from "./AnalyticsConfig"; import type { ApprovalsReviewer } from "./ApprovalsReviewer"; import type { AskForApproval } from "./AskForApproval"; +import type { AuthCredentialsStoreMode } from "./AuthCredentialsStoreMode"; import type { ForcedChatgptWorkspaceIds } from "./ForcedChatgptWorkspaceIds"; import type { SandboxMode } from "./SandboxMode"; import type { SandboxWorkspaceWrite } from "./SandboxWorkspaceWrite"; @@ -20,4 +21,4 @@ export type Config = {model: string | null, review_model: string | null, model_c * [UNSTABLE] Optional default for where approval requests are routed for * review. */ -approvals_reviewer: ApprovalsReviewer | null, sandbox_mode: SandboxMode | null, sandbox_workspace_write: SandboxWorkspaceWrite | null, forced_chatgpt_workspace_id: ForcedChatgptWorkspaceIds | null, forced_login_method: ForcedLoginMethod | null, web_search: WebSearchMode | null, tools: ToolsV2 | null, instructions: string | null, developer_instructions: string | null, compact_prompt: string | null, model_reasoning_effort: ReasoningEffort | null, model_reasoning_summary: ReasoningSummary | null, model_verbosity: Verbosity | null, service_tier: string | null, analytics: AnalyticsConfig | null, desktop: { [key in string]?: JsonValue } | null} & ({ [key in string]?: number | string | boolean | Array | { [key in string]?: JsonValue } | null }); +approvals_reviewer: ApprovalsReviewer | null, sandbox_mode: SandboxMode | null, sandbox_workspace_write: SandboxWorkspaceWrite | null, forced_chatgpt_workspace_id: ForcedChatgptWorkspaceIds | null, forced_login_method: ForcedLoginMethod | null, cli_auth_credentials_store: AuthCredentialsStoreMode | null, web_search: WebSearchMode | null, tools: ToolsV2 | null, instructions: string | null, developer_instructions: string | null, compact_prompt: string | null, model_reasoning_effort: ReasoningEffort | null, model_reasoning_summary: ReasoningSummary | null, model_verbosity: Verbosity | null, service_tier: string | null, analytics: AnalyticsConfig | null, desktop: { [key in string]?: JsonValue } | null} & ({ [key in string]?: number | string | boolean | Array | { [key in string]?: JsonValue } | null }); diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts index 3eb9a65aa6..120c996fdf 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts @@ -1,11 +1,22 @@ // GENERATED CODE! DO NOT MODIFY BY HAND! // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. +import type { AbsolutePathBuf } from "../AbsolutePathBuf"; import type { WebSearchMode } from "../WebSearchMode"; +import type { JsonValue } from "../serde_json/JsonValue"; import type { AskForApproval } from "./AskForApproval"; +import type { AuthCredentialsStoreMode } from "./AuthCredentialsStoreMode"; import type { ComputerUseRequirements } from "./ComputerUseRequirements"; +import type { FeedbackRequirements } from "./FeedbackRequirements"; import type { ResidencyRequirement } from "./ResidencyRequirement"; import type { SandboxMode } from "./SandboxMode"; +import type { ShellEnvironmentPolicyRequirements } from "./ShellEnvironmentPolicyRequirements"; import type { WindowsSandboxSetupMode } from "./WindowsSandboxSetupMode"; -export type ConfigRequirements = {allowedApprovalPolicies: Array | null, allowedSandboxModes: Array | null, allowedWindowsSandboxImplementations: Array | null, allowedPermissionProfiles: { [key in string]?: boolean } | null, defaultPermissions: string | null, allowedWebSearchModes: Array | null, allowManagedHooksOnly: boolean | null, allowAppshots: boolean | null, allowRemoteControl: boolean | null, computerUse: ComputerUseRequirements | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null}; +export type ConfigRequirements = {allowedApprovalPolicies: Array | null, allowedSandboxModes: Array | null, allowedWindowsSandboxImplementations: Array | null, allowedPermissionProfiles: { [key in string]?: boolean } | null, defaultPermissions: string | null, allowedWebSearchModes: Array | null, allowManagedHooksOnly: boolean | null, allowAppshots: boolean | null, allowRemoteControl: boolean | null, computerUse: ComputerUseRequirements | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null, allowedLoginMethods: { [key in string]?: boolean } | null, allowedChatgptWorkspaces: { [key in string]?: boolean } | null, cliAuthCredentialsStore: AuthCredentialsStoreMode | null, chatgptBaseUrl: string | null, sqliteHome: AbsolutePathBuf | null, logDir: AbsolutePathBuf | null, modelCatalogJson: AbsolutePathBuf | null, checkForUpdateOnStartup: boolean | null, /** + * Lossless config-native OTEL requirements, including exporter headers. + */ +otel: JsonValue | null, allowLoginShell: boolean | null, /** + * Lossless config-native shell environment policy requirements. + */ +shellEnvironmentPolicy: ShellEnvironmentPolicyRequirements | null, feedback: FeedbackRequirements | null, windowsSandboxPrivateDesktop: boolean | null}; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/FeedbackRequirements.ts b/codex-rs/app-server-protocol/schema/typescript/v2/FeedbackRequirements.ts new file mode 100644 index 0000000000..8d0a2002ee --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/FeedbackRequirements.ts @@ -0,0 +1,5 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +export type FeedbackRequirements = { enabled: boolean | null, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyInherit.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyInherit.ts new file mode 100644 index 0000000000..4af9dfc5be --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyInherit.ts @@ -0,0 +1,5 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +export type ShellEnvironmentPolicyInherit = "core" | "all" | "none"; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRequirements.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRequirements.ts new file mode 100644 index 0000000000..ce953373b2 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRequirements.ts @@ -0,0 +1,7 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. +import type { ShellEnvironmentPolicyInherit } from "./ShellEnvironmentPolicyInherit"; +import type { ShellEnvironmentPolicyRule } from "./ShellEnvironmentPolicyRule"; + +export type ShellEnvironmentPolicyRequirements = { inherit: ShellEnvironmentPolicyInherit | null, ignore_default_excludes: boolean | null, set: { [key in string]?: string } | null, rules: { [key in string]?: ShellEnvironmentPolicyRule } | null, experimental_use_profile: boolean | null, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRule.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRule.ts new file mode 100644 index 0000000000..059095db21 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/ShellEnvironmentPolicyRule.ts @@ -0,0 +1,9 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +/** + * Assigns a shell environment variable pattern to the include-only or exclude + * set. Includes do not re-add variables removed by another exclude pattern. + */ +export type ShellEnvironmentPolicyRule = "include" | "exclude"; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts index 5aa66a56b5..12da905a4b 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts @@ -35,6 +35,7 @@ export type { AppsListResponse } from "./AppsListResponse"; export type { AskForApproval } from "./AskForApproval"; export type { AttestationGenerateParams } from "./AttestationGenerateParams"; export type { AttestationGenerateResponse } from "./AttestationGenerateResponse"; +export type { AuthCredentialsStoreMode } from "./AuthCredentialsStoreMode"; export type { AutoReviewDecisionSource } from "./AutoReviewDecisionSource"; export type { ByteRange } from "./ByteRange"; export type { CancelLoginAccountParams } from "./CancelLoginAccountParams"; @@ -117,6 +118,7 @@ export type { ExternalAgentConfigImportResponse } from "./ExternalAgentConfigImp export type { ExternalAgentConfigImportTypeResult } from "./ExternalAgentConfigImportTypeResult"; export type { ExternalAgentConfigMigrationItem } from "./ExternalAgentConfigMigrationItem"; export type { ExternalAgentConfigMigrationItemType } from "./ExternalAgentConfigMigrationItemType"; +export type { FeedbackRequirements } from "./FeedbackRequirements"; export type { FeedbackUploadParams } from "./FeedbackUploadParams"; export type { FeedbackUploadResponse } from "./FeedbackUploadResponse"; export type { FileChangeApprovalDecision } from "./FileChangeApprovalDecision"; @@ -353,6 +355,9 @@ export type { SendAddCreditsNudgeEmailResponse } from "./SendAddCreditsNudgeEmai export type { ServerRequestResolvedNotification } from "./ServerRequestResolvedNotification"; export type { SessionMigration } from "./SessionMigration"; export type { SessionSource } from "./SessionSource"; +export type { ShellEnvironmentPolicyInherit } from "./ShellEnvironmentPolicyInherit"; +export type { ShellEnvironmentPolicyRequirements } from "./ShellEnvironmentPolicyRequirements"; +export type { ShellEnvironmentPolicyRule } from "./ShellEnvironmentPolicyRule"; export type { SkillDependencies } from "./SkillDependencies"; export type { SkillErrorInfo } from "./SkillErrorInfo"; export type { SkillInterface } from "./SkillInterface"; diff --git a/codex-rs/app-server-protocol/src/protocol/v2/config.rs b/codex-rs/app-server-protocol/src/protocol/v2/config.rs index c4d113d1c7..c560e46b6c 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2/config.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2/config.rs @@ -4,9 +4,12 @@ use super::SandboxMode; use super::WindowsSandboxSetupMode; use super::shared::default_enabled; use codex_experimental_api_macros::ExperimentalApi; +pub use codex_protocol::config_types::AuthCredentialsStoreMode; use codex_protocol::config_types::AutoCompactTokenLimitScope; use codex_protocol::config_types::ForcedLoginMethod; use codex_protocol::config_types::ReasoningSummary; +use codex_protocol::config_types::ShellEnvironmentPolicyInherit; +use codex_protocol::config_types::ShellEnvironmentPolicyRule; use codex_protocol::config_types::Verbosity; use codex_protocol::config_types::WebSearchMode; use codex_protocol::config_types::WebSearchToolConfig; @@ -257,6 +260,7 @@ pub struct Config { pub sandbox_workspace_write: Option, pub forced_chatgpt_workspace_id: Option, pub forced_login_method: Option, + pub cli_auth_credentials_store: Option, pub web_search: Option, pub tools: Option, pub instructions: Option, @@ -366,7 +370,9 @@ pub struct ConfigReadResponse { pub layers: Option>, } -#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS, ExperimentalApi)] +#[derive( + Serialize, Deserialize, Debug, Clone, Default, PartialEq, JsonSchema, TS, ExperimentalApi, +)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] pub struct ConfigRequirements { @@ -389,6 +395,39 @@ pub struct ConfigRequirements { pub enforce_residency: Option, #[experimental("configRequirements/read.network")] pub network: Option, + pub allowed_login_methods: Option>, + pub allowed_chatgpt_workspaces: Option>, + pub cli_auth_credentials_store: Option, + pub chatgpt_base_url: Option, + pub sqlite_home: Option, + pub log_dir: Option, + pub model_catalog_json: Option, + pub check_for_update_on_startup: Option, + /// Lossless config-native OTEL requirements, including exporter headers. + pub otel: Option, + pub allow_login_shell: Option, + /// Lossless config-native shell environment policy requirements. + pub shell_environment_policy: Option, + pub feedback: Option, + pub windows_sandbox_private_desktop: Option, +} + +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] +#[serde(rename_all = "camelCase")] +#[ts(export_to = "v2/")] +pub struct FeedbackRequirements { + pub enabled: Option, +} + +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] +#[serde(rename_all = "snake_case")] +#[ts(export_to = "v2/")] +pub struct ShellEnvironmentPolicyRequirements { + pub inherit: Option, + pub ignore_default_excludes: Option, + pub r#set: Option>, + pub rules: Option>, + pub experimental_use_profile: Option, } #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] diff --git a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs index 2567e386c8..6bb3d0480e 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs @@ -1643,6 +1643,7 @@ fn config_granular_approval_policy_is_marked_experimental() { sandbox_workspace_write: None, forced_chatgpt_workspace_id: None, forced_login_method: None, + cli_auth_credentials_store: None, web_search: None, tools: None, instructions: None, @@ -1676,6 +1677,7 @@ fn config_approvals_reviewer_is_marked_experimental() { sandbox_workspace_write: None, forced_chatgpt_workspace_id: None, forced_login_method: None, + cli_auth_credentials_store: None, web_search: None, tools: None, instructions: None, @@ -1705,20 +1707,7 @@ fn config_requirements_granular_allowed_approval_policy_is_marked_experimental() request_permissions: false, mcp_elicitations: false, }]), - allowed_approvals_reviewers: None, - allowed_sandbox_modes: None, - allowed_windows_sandbox_implementations: None, - allowed_permission_profiles: None, - default_permissions: None, - allowed_web_search_modes: None, - allow_managed_hooks_only: None, - allow_appshots: None, - allow_remote_control: None, - computer_use: None, - feature_requirements: None, - hooks: None, - enforce_residency: None, - network: None, + ..Default::default() }); assert_eq!(reason, Some("askForApproval.granular")); diff --git a/codex-rs/app-server/README.md b/codex-rs/app-server/README.md index 9188877384..fa4fead322 100644 --- a/codex-rs/app-server/README.md +++ b/codex-rs/app-server/README.md @@ -235,7 +235,7 @@ Example with notification opt-out: - `externalAgentConfig/import` — apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home) and any plugin/session `details` returned by detect. Returns an `importId` used to correlate the completion notification. When a request includes migration items, the server emits `externalAgentConfig/import/completed` once after the full import finishes with type-level `itemResults` containing each migrated type's success count, error count, successes, and raw errors (immediately after the response when everything completed synchronously, or after background imports finish). - `config/value/write` — write a single config key/value to the user's config.toml on disk; dotted paths such as `desktop.someKey` use the same generic write surface. - `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads, including multiple `desktop.*` edits. -- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), the layered permission-profile allow map (`allowedPermissionProfiles`), the managed permission-profile default (`defaultPermissions`), lifecycle hook lockdown (`allowManagedHooksOnly`), remote-control policy (`allowRemoteControl`; `false` force-disables remote control while `true` or `null` preserves existing behavior), computer use policy (`computerUse`), pinned feature values (`featureRequirements`), managed lifecycle hooks (`hooks`), `enforceResidency`, and `network` constraints such as canonical domain/socket permissions plus `managedAllowedDomainsOnly` and `dangerFullAccessDenylistOnly`. +- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`, `allowedLoginMethods`, `allowedChatgptWorkspaces`), the layered permission-profile allow map (`allowedPermissionProfiles`), the managed permission-profile default (`defaultPermissions`), lifecycle hook lockdown (`allowManagedHooksOnly`), remote-control policy (`allowRemoteControl`; `false` force-disables remote control while `true` or `null` preserves existing behavior), computer use policy (`computerUse`), pinned feature values (`featureRequirements`), managed lifecycle hooks (`hooks`), `enforceResidency`, `network` constraints such as canonical domain/socket permissions plus `managedAllowedDomainsOnly` and `dangerFullAccessDenylistOnly`, and pinned runtime settings such as credential storage, ChatGPT base URL, state/log/model-catalog paths, update checks, login-shell and environment policy, feedback, Windows private-desktop use, and OTEL configuration. Shell environment requirements expose pattern-to-action `rules` whose values are `include` or `exclude`; OTEL exporter responses include their complete headers map. ### Example: Start or resume a thread diff --git a/codex-rs/app-server/src/request_processors/config_processor.rs b/codex-rs/app-server/src/request_processors/config_processor.rs index b9a3ad2c9a..c491f44ca1 100644 --- a/codex-rs/app-server/src/request_processors/config_processor.rs +++ b/codex-rs/app-server/src/request_processors/config_processor.rs @@ -22,6 +22,7 @@ use codex_app_server_protocol::ConfiguredHookHandler; use codex_app_server_protocol::ConfiguredHookMatcherGroup; use codex_app_server_protocol::ExperimentalFeatureEnablementSetParams; use codex_app_server_protocol::ExperimentalFeatureEnablementSetResponse; +use codex_app_server_protocol::FeedbackRequirements; use codex_app_server_protocol::JSONRPCErrorError; use codex_app_server_protocol::ManagedHooksRequirements; use codex_app_server_protocol::ModelProviderCapabilitiesReadResponse; @@ -29,6 +30,7 @@ use codex_app_server_protocol::NetworkDomainPermission; use codex_app_server_protocol::NetworkRequirements; use codex_app_server_protocol::NetworkUnixSocketPermission; use codex_app_server_protocol::SandboxMode; +use codex_app_server_protocol::ShellEnvironmentPolicyRequirements; use codex_app_server_protocol::WindowsSandboxSetupMode; use codex_config::ConfigRequirementsToml; use codex_config::HookEventsToml; @@ -37,6 +39,7 @@ use codex_config::ManagedHooksRequirementsToml; use codex_config::MatcherGroup as CoreMatcherGroup; use codex_config::ResidencyRequirement as CoreResidencyRequirement; use codex_config::SandboxModeRequirement as CoreSandboxModeRequirement; +use codex_config::ShellEnvironmentPolicyRequirementsToml; use codex_core::ThreadManager; use codex_features::canonical_feature_for_key; use codex_features::feature_for_key; @@ -325,6 +328,11 @@ impl ConfigRequestProcessor { } fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigRequirements { + let windows_sandbox_private_desktop = requirements + .windows + .as_ref() + .and_then(|windows| windows.sandbox_private_desktop); + ConfigRequirements { allowed_approval_policies: requirements.allowed_approval_policies.map(|policies| { policies @@ -387,6 +395,42 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR .enforce_residency .map(map_residency_requirement_to_api), network: requirements.network.map(map_network_requirements_to_api), + allowed_login_methods: requirements.allowed_login_methods, + allowed_chatgpt_workspaces: requirements.allowed_chatgpt_workspaces, + cli_auth_credentials_store: requirements.cli_auth_credentials_store, + chatgpt_base_url: requirements.chatgpt_base_url, + sqlite_home: requirements.sqlite_home, + log_dir: requirements.log_dir, + model_catalog_json: requirements.model_catalog_json, + check_for_update_on_startup: requirements.check_for_update_on_startup, + otel: requirements.otel.map(|otel| json!(otel)), + allow_login_shell: requirements.allow_login_shell, + shell_environment_policy: requirements + .shell_environment_policy + .map(map_shell_environment_policy_requirements_to_api), + feedback: requirements.feedback.map(|feedback| FeedbackRequirements { + enabled: feedback.enabled, + }), + windows_sandbox_private_desktop, + } +} + +fn map_shell_environment_policy_requirements_to_api( + policy: ShellEnvironmentPolicyRequirementsToml, +) -> ShellEnvironmentPolicyRequirements { + let ShellEnvironmentPolicyRequirementsToml { + inherit, + ignore_default_excludes, + r#set, + rules, + experimental_use_profile, + } = policy; + ShellEnvironmentPolicyRequirements { + inherit, + ignore_default_excludes, + r#set, + rules, + experimental_use_profile, } } @@ -577,12 +621,17 @@ fn config_write_error(code: ConfigWriteErrorCode, message: impl Into) -> #[cfg(test)] mod tests { use super::map_requirements_toml_to_api; + use codex_app_server_protocol::ShellEnvironmentPolicyRequirements; use codex_app_server_protocol::WindowsSandboxSetupMode; use codex_config::ComputerUseRequirementsToml; use codex_config::ConfigRequirementsToml; use codex_config::WindowsRequirementsToml; + use codex_protocol::config_types::ShellEnvironmentPolicyInherit; + use codex_protocol::config_types::ShellEnvironmentPolicyRule; use pretty_assertions::assert_eq; + use serde_json::json; use std::collections::BTreeMap; + use std::collections::HashMap; #[test] fn requirements_api_includes_allow_managed_hooks_only() { @@ -665,7 +714,7 @@ mod tests { codex_config::types::WindowsSandboxModeToml::Elevated, codex_config::types::WindowsSandboxModeToml::Unelevated, ]), - sandbox_private_desktop: None, + sandbox_private_desktop: Some(false), }), ..ConfigRequirementsToml::default() }); @@ -677,5 +726,60 @@ mod tests { WindowsSandboxSetupMode::Unelevated, ]) ); + assert_eq!(mapped.windows_sandbox_private_desktop, Some(false)); + } + + #[test] + fn requirements_api_preserves_otel_headers_and_shell_environment_policy() { + let requirements = toml::from_str( + r#" +[otel] +log_user_prompt = false +environment = "production" +exporter = { otlp-http = { endpoint = "https://otel.example.com/v1/logs", headers = { Authorization = "Bearer secret" }, protocol = "json" } } + +[otel.span_attributes] +team = "codex" + +[shell_environment_policy] +inherit = "core" +ignore_default_excludes = false +experimental_use_profile = false + +[shell_environment_policy.rules] +"*SECRET*" = "exclude" +"HOME" = "include" +"PATH" = "exclude" + +[shell_environment_policy.set] +MANAGED = "true" +"#, + ) + .expect("valid requirements TOML"); + let mapped = map_requirements_toml_to_api(requirements); + + assert_eq!( + mapped + .otel + .as_ref() + .and_then(|otel| otel.pointer("/exporter/otlp-http/headers")), + Some(&json!({"Authorization": "Bearer secret"})) + ); + assert_eq!( + mapped.shell_environment_policy, + Some(ShellEnvironmentPolicyRequirements { + inherit: Some(ShellEnvironmentPolicyInherit::Core), + ignore_default_excludes: Some(false), + r#set: Some(HashMap::from([ + ("MANAGED".to_string(), "true".to_string(),) + ])), + rules: Some(BTreeMap::from([ + ("*SECRET*".to_string(), ShellEnvironmentPolicyRule::Exclude,), + ("HOME".to_string(), ShellEnvironmentPolicyRule::Include,), + ("PATH".to_string(), ShellEnvironmentPolicyRule::Exclude,), + ])), + experimental_use_profile: Some(false), + }) + ); } } diff --git a/codex-rs/app-server/tests/suite/v2/config_rpc.rs b/codex-rs/app-server/tests/suite/v2/config_rpc.rs index bfb7d81720..427995f9fd 100644 --- a/codex-rs/app-server/tests/suite/v2/config_rpc.rs +++ b/codex-rs/app-server/tests/suite/v2/config_rpc.rs @@ -9,6 +9,7 @@ use codex_app_server_protocol::ApprovalsReviewer; use codex_app_server_protocol::AppsConfig; use codex_app_server_protocol::AppsDefaultConfig; use codex_app_server_protocol::AskForApproval; +use codex_app_server_protocol::AuthCredentialsStoreMode; use codex_app_server_protocol::ConfigBatchWriteParams; use codex_app_server_protocol::ConfigEdit; use codex_app_server_protocol::ConfigLayerSource; @@ -83,6 +84,7 @@ async fn config_read_returns_effective_and_layers() -> Result<()> { r#" model = "gpt-user" sandbox_mode = "workspace-write" +cli_auth_credentials_store = "keyring" "#, )?; let codex_home_path = codex_home.path().canonicalize()?; @@ -109,6 +111,10 @@ sandbox_mode = "workspace-write" } = to_response(resp)?; assert_eq!(config.model.as_deref(), Some("gpt-user")); + assert_eq!( + config.cli_auth_credentials_store, + Some(AuthCredentialsStoreMode::Keyring) + ); assert_eq!( origins.get("model").expect("origin").name, ConfigLayerSource::User { diff --git a/codex-rs/protocol/src/config_types.rs b/codex-rs/protocol/src/config_types.rs index c45bb3f3aa..c820502311 100644 --- a/codex-rs/protocol/src/config_types.rs +++ b/codex-rs/protocol/src/config_types.rs @@ -201,8 +201,9 @@ impl JsonSchema for ApprovalsReviewer { } } -#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Default, JsonSchema)] +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Default, JsonSchema, TS)] #[serde(rename_all = "kebab-case")] +#[ts(export_to = "v2/")] pub enum ShellEnvironmentPolicyInherit { /// "Core" environment variables for the platform. On UNIX, this would /// include HOME, LOGNAME, PATH, SHELL, and USER, among others.