From ea4344dd2f22e8c3ec756e015d81a3547daca575 Mon Sep 17 00:00:00 2001 From: viyatb-oai Date: Thu, 5 Mar 2026 14:31:30 -0800 Subject: [PATCH] refactor: rename macos chromium permission --- .../json/CommandExecutionRequestApprovalParams.json | 2 +- codex-rs/app-server-protocol/schema/json/EventMsg.json | 2 +- .../app-server-protocol/schema/json/ServerRequest.json | 2 +- .../schema/json/codex_app_server_protocol.schemas.json | 4 ++-- .../schema/json/codex_app_server_protocol.v2.schemas.json | 2 +- .../schema/typescript/MacOsPermissions.ts | 2 +- .../schema/typescript/v2/AdditionalMacOsPermissions.ts | 2 +- codex-rs/app-server-protocol/src/protocol/v2.rs | 4 ++-- codex-rs/app-server/README.md | 2 +- codex-rs/core/src/skills/loader.rs | 8 ++++---- codex-rs/core/src/skills/permissions.rs | 6 ++---- codex-rs/protocol/src/models.rs | 4 ++-- 12 files changed, 19 insertions(+), 21 deletions(-) diff --git a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json index 7a00bfab2a..b19976cf96 100644 --- a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json +++ b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json @@ -52,7 +52,7 @@ "null" ] }, - "chromiumMachPortRendezvous": { + "chromium": { "type": [ "boolean", "null" diff --git a/codex-rs/app-server-protocol/schema/json/EventMsg.json b/codex-rs/app-server-protocol/schema/json/EventMsg.json index 4221593348..89e201e973 100644 --- a/codex-rs/app-server-protocol/schema/json/EventMsg.json +++ b/codex-rs/app-server-protocol/schema/json/EventMsg.json @@ -3689,7 +3689,7 @@ "null" ] }, - "chromium_mach_port_rendezvous": { + "chromium": { "type": [ "boolean", "null" diff --git a/codex-rs/app-server-protocol/schema/json/ServerRequest.json b/codex-rs/app-server-protocol/schema/json/ServerRequest.json index 600552adff..52c2f86b22 100644 --- a/codex-rs/app-server-protocol/schema/json/ServerRequest.json +++ b/codex-rs/app-server-protocol/schema/json/ServerRequest.json @@ -52,7 +52,7 @@ "null" ] }, - "chromiumMachPortRendezvous": { + "chromium": { "type": [ "boolean", "null" diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index 5d21c01426..52719e2026 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -48,7 +48,7 @@ "null" ] }, - "chromiumMachPortRendezvous": { + "chromium": { "type": [ "boolean", "null" @@ -5144,7 +5144,7 @@ "null" ] }, - "chromium_mach_port_rendezvous": { + "chromium": { "type": [ "boolean", "null" diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json index 8a4a8a0189..72040fd59b 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json @@ -7252,7 +7252,7 @@ "null" ] }, - "chromium_mach_port_rendezvous": { + "chromium": { "type": [ "boolean", "null" diff --git a/codex-rs/app-server-protocol/schema/typescript/MacOsPermissions.ts b/codex-rs/app-server-protocol/schema/typescript/MacOsPermissions.ts index 8af9bbda9a..7a3c4f6031 100644 --- a/codex-rs/app-server-protocol/schema/typescript/MacOsPermissions.ts +++ b/codex-rs/app-server-protocol/schema/typescript/MacOsPermissions.ts @@ -4,4 +4,4 @@ import type { MacOsAutomationValue } from "./MacOsAutomationValue"; import type { MacOsPreferencesValue } from "./MacOsPreferencesValue"; -export type MacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, chromium_mach_port_rendezvous: boolean | null, }; +export type MacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, chromium: boolean | null, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts index dd0536b4f1..dfcad9d631 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts @@ -4,4 +4,4 @@ import type { MacOsAutomationValue } from "../MacOsAutomationValue"; import type { MacOsPreferencesValue } from "../MacOsPreferencesValue"; -export type AdditionalMacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, chromiumMachPortRendezvous: boolean | null, }; +export type AdditionalMacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, chromium: boolean | null, }; diff --git a/codex-rs/app-server-protocol/src/protocol/v2.rs b/codex-rs/app-server-protocol/src/protocol/v2.rs index def55035ba..642ea4a94c 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2.rs @@ -840,7 +840,7 @@ pub struct AdditionalMacOsPermissions { pub automations: Option, pub accessibility: Option, pub calendar: Option, - pub chromium_mach_port_rendezvous: Option, + pub chromium: Option, } impl From for AdditionalMacOsPermissions { @@ -850,7 +850,7 @@ impl From for AdditionalMacOsPermissions { automations: value.automations, accessibility: value.accessibility, calendar: value.calendar, - chromium_mach_port_rendezvous: value.chromium_mach_port_rendezvous, + chromium: value.chromium, } } } diff --git a/codex-rs/app-server/README.md b/codex-rs/app-server/README.md index 20643620f4..41feaf8b0f 100644 --- a/codex-rs/app-server/README.md +++ b/codex-rs/app-server/README.md @@ -742,7 +742,7 @@ Certain actions (shell commands or modifying files) may require explicit user ap Order of messages: 1. `item/started` — shows the pending `commandExecution` item with `command`, `cwd`, and other fields so you can render the proposed action. -2. `item/commandExecution/requestApproval` (request) — carries the same `itemId`, `threadId`, `turnId`, optionally `approvalId` (for subcommand callbacks), and `reason`. For normal command approvals, it also includes `command`, `cwd`, and `commandActions` for friendly display. When `initialize.params.capabilities.experimentalApi = true`, it may also include experimental `additionalPermissions` describing requested per-command sandbox access; any filesystem paths in that payload are absolute on the wire, network access is represented as `additionalPermissions.network.enabled`, and macOS-specific flags such as `additionalPermissions.macos.chromiumMachPortRendezvous` are exposed in camelCase. For network-only approvals, those command fields may be omitted and `networkApprovalContext` is provided instead. Optional persistence hints may also be included via `proposedExecpolicyAmendment` and `proposedNetworkPolicyAmendments`. Clients can prefer `availableDecisions` when present to render the exact set of choices the server wants to expose, while still falling back to the older heuristics if it is omitted. +2. `item/commandExecution/requestApproval` (request) — carries the same `itemId`, `threadId`, `turnId`, optionally `approvalId` (for subcommand callbacks), and `reason`. For normal command approvals, it also includes `command`, `cwd`, and `commandActions` for friendly display. When `initialize.params.capabilities.experimentalApi = true`, it may also include experimental `additionalPermissions` describing requested per-command sandbox access; any filesystem paths in that payload are absolute on the wire, network access is represented as `additionalPermissions.network.enabled`, and macOS-specific flags such as `additionalPermissions.macos.chromium` are exposed in camelCase. For network-only approvals, those command fields may be omitted and `networkApprovalContext` is provided instead. Optional persistence hints may also be included via `proposedExecpolicyAmendment` and `proposedNetworkPolicyAmendments`. Clients can prefer `availableDecisions` when present to render the exact set of choices the server wants to expose, while still falling back to the older heuristics if it is omitted. 3. Client response — for example `{ "decision": "accept" }`, `{ "decision": "acceptForSession" }`, `{ "decision": { "acceptWithExecpolicyAmendment": { "execpolicy_amendment": [...] } } }`, `{ "decision": { "applyNetworkPolicyAmendment": { "network_policy_amendment": { "host": "example.com", "action": "allow" } } } }`, `{ "decision": "decline" }`, or `{ "decision": "cancel" }`. 4. `serverRequest/resolved` — `{ threadId, requestId }` confirms the pending request has been resolved or cleared, including lifecycle cleanup on turn start/complete/interrupt. 5. `item/completed` — final `commandExecution` item with `status: "completed" | "failed" | "declined"` and execution output. Render this as the authoritative result. diff --git a/codex-rs/core/src/skills/loader.rs b/codex-rs/core/src/skills/loader.rs index 5e770d5da0..c3a3c73ba8 100644 --- a/codex-rs/core/src/skills/loader.rs +++ b/codex-rs/core/src/skills/loader.rs @@ -1471,7 +1471,7 @@ permissions: - "com.apple.Notes" accessibility: true calendar: true - chromium_mach_port_rendezvous: true + chromium: true "#, ); @@ -1496,7 +1496,7 @@ permissions: )), accessibility: Some(true), calendar: Some(true), - chromium_mach_port_rendezvous: Some(true), + chromium: Some(true), }), ..Default::default() }) @@ -1520,7 +1520,7 @@ permissions: - "com.apple.Notes" accessibility: true calendar: true - chromium_mach_port_rendezvous: true + chromium: true "#, ); @@ -1545,7 +1545,7 @@ permissions: )), accessibility: Some(true), calendar: Some(true), - chromium_mach_port_rendezvous: Some(true), + chromium: Some(true), }), ..Default::default() }) diff --git a/codex-rs/core/src/skills/permissions.rs b/codex-rs/core/src/skills/permissions.rs index 735303bad5..d1dd725a8f 100644 --- a/codex-rs/core/src/skills/permissions.rs +++ b/codex-rs/core/src/skills/permissions.rs @@ -149,9 +149,7 @@ fn build_macos_seatbelt_profile_extensions( .accessibility .unwrap_or(defaults.macos_accessibility), macos_calendar: permissions.calendar.unwrap_or(defaults.macos_calendar), - macos_chromium: permissions - .chromium_mach_port_rendezvous - .unwrap_or(defaults.macos_chromium), + macos_chromium: permissions.chromium.unwrap_or(defaults.macos_chromium), }; Some(extensions) } @@ -417,7 +415,7 @@ mod tests { ])), accessibility: Some(true), calendar: Some(true), - chromium_mach_port_rendezvous: Some(true), + chromium: Some(true), }), ..Default::default() })) diff --git a/codex-rs/protocol/src/models.rs b/codex-rs/protocol/src/models.rs index 1252d624cd..1d3f452ea2 100644 --- a/codex-rs/protocol/src/models.rs +++ b/codex-rs/protocol/src/models.rs @@ -73,7 +73,7 @@ pub struct MacOsPermissions { pub automations: Option, pub accessibility: Option, pub calendar: Option, - pub chromium_mach_port_rendezvous: Option, + pub chromium: Option, } impl MacOsPermissions { @@ -82,7 +82,7 @@ impl MacOsPermissions { && self.automations.is_none() && self.accessibility.is_none() && self.calendar.is_none() - && self.chromium_mach_port_rendezvous.is_none() + && self.chromium.is_none() } }