From dc38fe22f127db7cb1b8f1c1c24d31de3302a1c1 Mon Sep 17 00:00:00 2001
From: rreichel3-oai <rreichel3@openai.com>
Date: Fri, 17 Apr 2026 15:33:11 -0400
Subject: [PATCH] Add debug escape hatch for managed config

codex-rs/core/src/config/mod.rs: honor a debug-only CODEX_DISABLE_MANAGED_CONFIG env var in the main config loader so local interactive testing can ignore managed config and managed preferences outside app-server flows.
---
 codex-rs/core/src/config/mod.rs | 42 ++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index 55495c14bc..33e2d47767 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -168,6 +168,8 @@ impl Default for GhostSnapshotConfig {
     }
 }
 
+const DISABLE_MANAGED_CONFIG_ENV_VAR: &str = "CODEX_DISABLE_MANAGED_CONFIG";
+
 /// Maximum number of bytes of the documentation that will be embedded. Larger
 /// files are *silently truncated* to this size so we do not take up too much of
 /// the context window.
@@ -951,7 +953,9 @@ impl ConfigBuilder {
         };
         let cli_overrides = cli_overrides.unwrap_or_default();
         let mut harness_overrides = harness_overrides.unwrap_or_default();
-        let loader_overrides = loader_overrides.unwrap_or_default();
+        let loader_overrides = loader_overrides
+            .map(apply_debug_loader_overrides)
+            .unwrap_or_else(|| apply_debug_loader_overrides(LoaderOverrides::default()));
         let cwd_override = harness_overrides.cwd.as_deref().or(fallback_cwd.as_deref());
         let cwd = match cwd_override {
             Some(path) => AbsolutePathBuf::relative_to_current_dir(path)?,
@@ -1046,6 +1050,42 @@ impl ConfigBuilder {
     }
 }
 
+fn apply_debug_loader_overrides(mut loader_overrides: LoaderOverrides) -> LoaderOverrides {
+    #[cfg(debug_assertions)]
+    if disable_managed_config_from_debug_env() {
+        if loader_overrides.managed_config_path.is_none() {
+            loader_overrides.managed_config_path = Some(
+                std::env::temp_dir()
+                    .join("codex-config-tests")
+                    .join("managed_config.toml"),
+            );
+        }
+        #[cfg(target_os = "macos")]
+        if loader_overrides.managed_preferences_base64.is_none() {
+            loader_overrides.managed_preferences_base64 = Some(String::new());
+        }
+        if loader_overrides
+            .macos_managed_config_requirements_base64
+            .is_none()
+        {
+            loader_overrides.macos_managed_config_requirements_base64 = Some(String::new());
+        }
+    }
+
+    loader_overrides
+}
+
+fn disable_managed_config_from_debug_env() -> bool {
+    #[cfg(debug_assertions)]
+    {
+        if let Ok(value) = std::env::var(DISABLE_MANAGED_CONFIG_ENV_VAR) {
+            return matches!(value.as_str(), "1" | "true" | "TRUE" | "yes" | "YES");
+        }
+    }
+
+    false
+}
+
 impl Config {
     pub fn legacy_sandbox_policy(&self) -> SandboxPolicy {
         self.permissions.legacy_sandbox_policy(self.cwd.as_path())