mirror of
https://github.com/openai/codex.git
synced 2026-09-14 11:57:03 +00:00
e84ee33cc0
## Summary - add the guardian reviewer flow for `on-request` approvals in command, patch, sandbox-retry, and managed-network approval paths - keep guardian behind `features.guardian_approval` instead of exposing a public `approval_policy = guardian` mode - route ordinary `OnRequest` approvals to the guardian subagent when the feature is enabled, without changing the public approval-mode surface ## Public model - public approval modes stay unchanged - guardian is enabled via `features.guardian_approval` - when that feature is on, `approval_policy = on-request` keeps the same approval boundaries but sends those approval requests to the guardian reviewer instead of the user - `/experimental` only persists the feature flag; it does not rewrite `approval_policy` - CLI and app-server no longer expose a separate `guardian` approval mode in this PR ## Guardian reviewer - the reviewer runs as a normal subagent and reuses the existing subagent/thread machinery - it is locked to a read-only sandbox and `approval_policy = never` - it does not inherit user/project exec-policy rules - it prefers `gpt-5.4` when the current provider exposes it, otherwise falls back to the parent turn's active model - it fail-closes on timeout, startup failure, malformed output, or any other review error - it currently auto-approves only when `risk_score < 80` ## Review context and policy - guardian mirrors `OnRequest` approval semantics rather than introducing a separate approval policy - explicit `require_escalated` requests follow the same approval surface as `OnRequest`; the difference is only who reviews them - managed-network allowlist misses that enter the approval flow are also reviewed by guardian - the review prompt includes bounded recent transcript history plus recent tool call/result evidence - transcript entries and planned-action strings are truncated with explicit `<guardian_truncated ... />` markers so large payloads stay bounded - apply-patch reviews include the full patch content (without duplicating the structured `changes` payload) - the guardian request layout is snapshot-tested using the same model-visible Responses request formatter used elsewhere in core ## Guardian network behavior - the guardian subagent inherits the parent session's managed-network allowlist when one exists, so it can use the same approved network surface while reviewing - exact session-scoped network approvals are copied into the guardian session with protocol/port scope preserved - those copied approvals are now seeded before the guardian's first turn is submitted, so inherited approvals are available during any immediate review-time checks ## Out of scope / follow-ups - the sandbox-permission validation split was pulled into a separate PR and is not part of this diff - a future follow-up can enable `serde_json` preserve-order in `codex-core` and then simplify the guardian action rendering further --------- Co-authored-by: Codex <noreply@openai.com>
173 lines
5.2 KiB
Rust
173 lines
5.2 KiB
Rust
//! Root of the `codex-core` library.
|
|
|
|
// Prevent accidental direct writes to stdout/stderr in library code. All
|
|
// user-visible output must go through the appropriate abstraction (e.g.,
|
|
// the TUI or the tracing stack).
|
|
#![deny(clippy::print_stdout, clippy::print_stderr)]
|
|
|
|
mod analytics_client;
|
|
pub mod api_bridge;
|
|
mod apply_patch;
|
|
mod apps;
|
|
pub mod auth;
|
|
mod client;
|
|
mod client_common;
|
|
pub mod codex;
|
|
mod realtime_context;
|
|
mod realtime_conversation;
|
|
pub use codex::SteerInputError;
|
|
mod codex_thread;
|
|
mod compact_remote;
|
|
pub use codex_thread::CodexThread;
|
|
pub use codex_thread::ThreadConfigSnapshot;
|
|
mod agent;
|
|
mod codex_delegate;
|
|
mod command_canonicalization;
|
|
mod commit_attribution;
|
|
pub mod config;
|
|
pub mod config_loader;
|
|
pub mod connectors;
|
|
mod context_manager;
|
|
mod contextual_user_message;
|
|
pub mod custom_prompts;
|
|
pub mod env;
|
|
mod environment_context;
|
|
pub mod error;
|
|
pub mod exec;
|
|
pub mod exec_env;
|
|
mod exec_policy;
|
|
pub mod external_agent_config;
|
|
pub mod features;
|
|
mod file_watcher;
|
|
mod flags;
|
|
pub mod git_info;
|
|
mod guardian;
|
|
pub mod instructions;
|
|
pub mod landlock;
|
|
pub mod mcp;
|
|
mod mcp_connection_manager;
|
|
pub mod models_manager;
|
|
mod network_policy_decision;
|
|
pub mod network_proxy_loader;
|
|
pub use mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
|
|
pub use mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
|
|
pub use mcp_connection_manager::SandboxState;
|
|
pub use text_encoding::bytes_to_string_smart;
|
|
mod mcp_tool_call;
|
|
mod memories;
|
|
mod mentions;
|
|
mod message_history;
|
|
mod model_provider_info;
|
|
pub mod path_utils;
|
|
pub mod personality_migration;
|
|
pub mod plugins;
|
|
mod sandbox_tags;
|
|
pub mod sandboxing;
|
|
mod session_prefix;
|
|
mod shell_detect;
|
|
mod stream_events_utils;
|
|
pub mod test_support;
|
|
mod text_encoding;
|
|
pub mod token_data;
|
|
mod truncate;
|
|
mod unified_exec;
|
|
pub mod windows_sandbox;
|
|
pub use client::X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER;
|
|
pub use model_provider_info::DEFAULT_LMSTUDIO_PORT;
|
|
pub use model_provider_info::DEFAULT_OLLAMA_PORT;
|
|
pub use model_provider_info::LMSTUDIO_OSS_PROVIDER_ID;
|
|
pub use model_provider_info::ModelProviderInfo;
|
|
pub use model_provider_info::OLLAMA_OSS_PROVIDER_ID;
|
|
pub use model_provider_info::WireApi;
|
|
pub use model_provider_info::built_in_model_providers;
|
|
pub use model_provider_info::create_oss_provider_with_base_url;
|
|
mod event_mapping;
|
|
pub mod review_format;
|
|
pub mod review_prompts;
|
|
mod seatbelt_permissions;
|
|
mod thread_manager;
|
|
pub mod web_search;
|
|
pub mod windows_sandbox_read_grants;
|
|
pub use thread_manager::NewThread;
|
|
pub use thread_manager::ThreadManager;
|
|
#[deprecated(note = "use ThreadManager")]
|
|
pub type ConversationManager = ThreadManager;
|
|
#[deprecated(note = "use NewThread")]
|
|
pub type NewConversation = NewThread;
|
|
#[deprecated(note = "use CodexThread")]
|
|
pub type CodexConversation = CodexThread;
|
|
// Re-export common auth types for workspace consumers
|
|
pub use auth::AuthManager;
|
|
pub use auth::CodexAuth;
|
|
pub mod default_client;
|
|
pub mod project_doc;
|
|
mod rollout;
|
|
pub(crate) mod safety;
|
|
pub mod seatbelt;
|
|
pub mod shell;
|
|
pub mod shell_snapshot;
|
|
pub mod skills;
|
|
pub mod spawn;
|
|
pub mod state_db;
|
|
pub mod terminal;
|
|
mod tools;
|
|
pub mod turn_diff_tracker;
|
|
mod turn_metadata;
|
|
mod turn_timing;
|
|
pub use rollout::ARCHIVED_SESSIONS_SUBDIR;
|
|
pub use rollout::INTERACTIVE_SESSION_SOURCES;
|
|
pub use rollout::RolloutRecorder;
|
|
pub use rollout::RolloutRecorderParams;
|
|
pub use rollout::SESSIONS_SUBDIR;
|
|
pub use rollout::SessionMeta;
|
|
pub use rollout::append_thread_name;
|
|
pub use rollout::find_archived_thread_path_by_id_str;
|
|
#[deprecated(note = "use find_thread_path_by_id_str")]
|
|
pub use rollout::find_conversation_path_by_id_str;
|
|
pub use rollout::find_thread_name_by_id;
|
|
pub use rollout::find_thread_path_by_id_str;
|
|
pub use rollout::find_thread_path_by_name_str;
|
|
pub use rollout::list::Cursor;
|
|
pub use rollout::list::ThreadItem;
|
|
pub use rollout::list::ThreadSortKey;
|
|
pub use rollout::list::ThreadsPage;
|
|
pub use rollout::list::parse_cursor;
|
|
pub use rollout::list::read_head_for_summary;
|
|
pub use rollout::list::read_session_meta_line;
|
|
pub use rollout::policy::EventPersistenceMode;
|
|
pub use rollout::rollout_date_parts;
|
|
pub use rollout::session_index::find_thread_names_by_ids;
|
|
mod function_tool;
|
|
mod state;
|
|
mod tasks;
|
|
mod user_shell_command;
|
|
pub mod util;
|
|
pub(crate) use codex_protocol::protocol;
|
|
pub(crate) use codex_shell_command::bash;
|
|
pub(crate) use codex_shell_command::is_dangerous_command;
|
|
pub(crate) use codex_shell_command::is_safe_command;
|
|
pub(crate) use codex_shell_command::parse_command;
|
|
pub(crate) use codex_shell_command::powershell;
|
|
|
|
pub use client::ModelClient;
|
|
pub use client::ModelClientSession;
|
|
pub use client::X_CODEX_TURN_METADATA_HEADER;
|
|
pub use client::ws_version_from_features;
|
|
pub use client_common::Prompt;
|
|
pub use client_common::REVIEW_PROMPT;
|
|
pub use client_common::ResponseEvent;
|
|
pub use client_common::ResponseStream;
|
|
pub use compact::content_items_to_text;
|
|
pub use event_mapping::parse_turn_item;
|
|
pub use exec_policy::ExecPolicyError;
|
|
pub use exec_policy::check_execpolicy_for_warnings;
|
|
pub use exec_policy::format_exec_policy_error_with_source;
|
|
pub use exec_policy::load_exec_policy;
|
|
pub use file_watcher::FileWatcherEvent;
|
|
pub use safety::get_platform_sandbox;
|
|
pub use tools::spec::parse_tool_input_schema;
|
|
pub use turn_metadata::build_turn_metadata_header;
|
|
pub mod compact;
|
|
pub mod memory_trace;
|
|
pub mod otel_init;
|