From c5f320733eb5832e4086c8681be7dee866ee34a5 Mon Sep 17 00:00:00 2001 From: Charles Cunningham Date: Wed, 25 Mar 2026 07:57:19 -0700 Subject: [PATCH] codex: keep full access justification requirements-only Remove the app-server protocol and schema exposure for require_full_access_justification so the flag stays internal to requirements.toml loading and runtime enforcement. Co-authored-by: Codex --- .../schema/json/codex_app_server_protocol.schemas.json | 6 ------ .../schema/json/codex_app_server_protocol.v2.schemas.json | 6 ------ .../schema/json/v2/ConfigRequirementsReadResponse.json | 6 ------ .../schema/typescript/v2/ConfigRequirements.ts | 2 +- codex-rs/app-server-protocol/src/protocol/v2.rs | 2 -- codex-rs/app-server/README.md | 2 +- codex-rs/app-server/src/config_api.rs | 4 +--- 7 files changed, 3 insertions(+), 25 deletions(-) diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index 37591aaa7f..d4269f5239 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -6871,12 +6871,6 @@ "object", "null" ] - }, - "requireFullAccessJustification": { - "type": [ - "boolean", - "null" - ] } }, "type": "object" diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json index fc56ca63cc..acf36d6c3c 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json @@ -3431,12 +3431,6 @@ "object", "null" ] - }, - "requireFullAccessJustification": { - "type": [ - "boolean", - "null" - ] } }, "type": "object" diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json index cf6b541bf4..e0c8304c1f 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json @@ -98,12 +98,6 @@ "object", "null" ] - }, - "requireFullAccessJustification": { - "type": [ - "boolean", - "null" - ] } }, "type": "object" diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts index 0a24360f6c..47a99453fe 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts @@ -6,4 +6,4 @@ import type { AskForApproval } from "./AskForApproval"; import type { ResidencyRequirement } from "./ResidencyRequirement"; import type { SandboxMode } from "./SandboxMode"; -export type ConfigRequirements = {allowedApprovalPolicies: Array | null, allowedSandboxModes: Array | null, allowedWebSearchModes: Array | null, requireFullAccessJustification: boolean | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null}; +export type ConfigRequirements = {allowedApprovalPolicies: Array | null, allowedSandboxModes: Array | null, allowedWebSearchModes: Array | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null}; diff --git a/codex-rs/app-server-protocol/src/protocol/v2.rs b/codex-rs/app-server-protocol/src/protocol/v2.rs index af82502174..67c4e95856 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2.rs @@ -855,7 +855,6 @@ pub struct ConfigRequirements { pub allowed_approval_policies: Option>, pub allowed_sandbox_modes: Option>, pub allowed_web_search_modes: Option>, - pub require_full_access_justification: Option, pub feature_requirements: Option>, pub enforce_residency: Option, #[experimental("configRequirements/read.network")] @@ -7240,7 +7239,6 @@ mod tests { }]), allowed_sandbox_modes: None, allowed_web_search_modes: None, - require_full_access_justification: None, feature_requirements: None, enforce_residency: None, network: None, diff --git a/codex-rs/app-server/README.md b/codex-rs/app-server/README.md index a2ff056a2a..1e186c0d5e 100644 --- a/codex-rs/app-server/README.md +++ b/codex-rs/app-server/README.md @@ -185,7 +185,7 @@ Example with notification opt-out: - `externalAgentConfig/import` — apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home). - `config/value/write` — write a single config key/value to the user's config.toml on disk. - `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads. -- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), `requireFullAccessJustification`, pinned feature values (`featureRequirements`), `enforceResidency`, and `network` constraints. +- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), pinned feature values (`featureRequirements`), `enforceResidency`, and `network` constraints. ### Example: Start or resume a thread diff --git a/codex-rs/app-server/src/config_api.rs b/codex-rs/app-server/src/config_api.rs index a7486f80c0..65b004f2ca 100644 --- a/codex-rs/app-server/src/config_api.rs +++ b/codex-rs/app-server/src/config_api.rs @@ -374,7 +374,6 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR } normalized }), - require_full_access_justification: requirements.require_full_access_justification, feature_requirements: requirements .feature_requirements .map(|requirements| requirements.entries), @@ -480,7 +479,7 @@ mod tests { allowed_web_search_modes: Some(vec![ codex_core::config_loader::WebSearchModeRequirement::Cached, ]), - require_full_access_justification: Some(true), + require_full_access_justification: None, guardian_developer_instructions: None, feature_requirements: Some(codex_core::config_loader::FeatureRequirementsToml { entries: std::collections::BTreeMap::from([ @@ -524,7 +523,6 @@ mod tests { mapped.allowed_web_search_modes, Some(vec![WebSearchMode::Cached, WebSearchMode::Disabled]), ); - assert_eq!(mapped.require_full_access_justification, Some(true)); assert_eq!( mapped.feature_requirements, Some(std::collections::BTreeMap::from([