mirror of
https://github.com/openai/codex.git
synced 2026-10-23 18:08:45 +00:00
olliem-oai
94350a9101
## Why Managed network policies need to require approval for selected hosts even when an exact or wildcard allow rule matches them. ## What changed - Add `experimental_network.review_domains` to managed requirements and route matching hosts through the existing network approval flow. Explicit denials retain precedence, and approved connections still undergo DNS and local-address checks. - Preserve review patterns across environment policy attachments and remote proxy configuration. Reject execution on an exec-server that lacks the `networkProxyReviewDomains` capability when review patterns are present. - Expose `reviewDomains` through the app-server requirements API and generated schemas, and show `review_domains` in debug configuration output. - Update approval reasons to say that network access requires approval rather than assuming the host is absent from the allowlist. ## Testing Extend coverage for review precedence over exact and wildcard allows, explicit denials, DNS checks after local and remote approvals, approval hooks, policy merging, remote configuration round trips, and requirements API serialization. GitOrigin-RevId: 4a861061a0ed80b3537d3b72f2caecb0db2a4f0b
1216 lines
27 KiB
JSON
Generated
1216 lines
27 KiB
JSON
Generated
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AllowDenyRequirement": {
|
|
"enum": [
|
|
"allow",
|
|
"deny"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"ApplicationNetworkRequirements": {
|
|
"properties": {
|
|
"domains": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/NetworkDomainPermission"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"enabled": {
|
|
"description": "When enabled, only explicitly allowed exact domains may be contacted.",
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": [
|
|
"domains",
|
|
"enabled"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"ApplicationRequirements": {
|
|
"properties": {
|
|
"network": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ApplicationNetworkRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"storage": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ApplicationStorageRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ApplicationStorageRequirements": {
|
|
"description": "Managed storage settings for new Desktop workspaces, not filesystem access restrictions.",
|
|
"properties": {
|
|
"defaultProjectParent": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/LegacyAppPathString"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"projectlessWorkspaceRoot": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/LegacyAppPathString"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ApprovalsReviewer": {
|
|
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",
|
|
"enum": [
|
|
"user",
|
|
"auto_review",
|
|
"guardian_subagent"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"AskForApproval": {
|
|
"oneOf": [
|
|
{
|
|
"enum": [
|
|
"untrusted",
|
|
"on-request",
|
|
"never"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"granular": {
|
|
"properties": {
|
|
"mcp_elicitations": {
|
|
"type": "boolean"
|
|
},
|
|
"request_permissions": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"rules": {
|
|
"type": "boolean"
|
|
},
|
|
"sandbox_approval": {
|
|
"type": "boolean"
|
|
},
|
|
"skill_approval": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": [
|
|
"mcp_elicitations",
|
|
"rules",
|
|
"sandbox_approval"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"granular"
|
|
],
|
|
"title": "GranularAskForApproval",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"AutoReviewRequirements": {
|
|
"properties": {
|
|
"ignoreRules": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"requiredOnModels": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"BrowserUseAccessApprovalLifetime": {
|
|
"enum": [
|
|
"turn",
|
|
"thread"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"BrowserUseExtensionRequirements": {
|
|
"properties": {
|
|
"requestHeaders": {
|
|
"items": {
|
|
"$ref": "#/definitions/RequestHeader"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"BrowserUseOriginPolicy": {
|
|
"properties": {
|
|
"access": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"accessApprovalLifetime": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/BrowserUseAccessApprovalLifetime"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"autoReview": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"downloads": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"fullCdpAccess": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"persistentApproval": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"uploads": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"BrowserUseRequirements": {
|
|
"properties": {
|
|
"allowGlobalPersistentApproval": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowHistoryAccess": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowWebmcp": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"defaultOriginPolicy": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/BrowserUseOriginPolicy"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"disableAutoReview": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"extension": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/BrowserUseExtensionRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"origins": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/BrowserUseOriginPolicy"
|
|
},
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"CliAuthCredentialsStoreMode": {
|
|
"enum": [
|
|
"file",
|
|
"keyring",
|
|
"auto",
|
|
"ephemeral"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"ComputerUseMacosRequirements": {
|
|
"properties": {
|
|
"bundleIds": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ComputerUseRequirements": {
|
|
"properties": {
|
|
"allowLockedComputerUse": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowPersistentApproval": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"defaultAppAccess": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"macos": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ComputerUseMacosRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"windows": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ComputerUseWindowsRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ComputerUseWindowsExeRequirement": {
|
|
"properties": {
|
|
"access": {
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
"binaryName": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"productName": {
|
|
"type": "string"
|
|
},
|
|
"publisherName": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"access",
|
|
"productName",
|
|
"publisherName"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"ComputerUseWindowsRequirements": {
|
|
"properties": {
|
|
"aumids": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/AllowDenyRequirement"
|
|
},
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"exes": {
|
|
"items": {
|
|
"$ref": "#/definitions/ComputerUseWindowsExeRequirement"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ConfigRequirements": {
|
|
"properties": {
|
|
"additionalDeveloperInstructions": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"allowAppshots": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowBrowserAndComputerUse": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowLoginShell": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowManagedHooksOnly": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowRemoteControl": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedApprovalPolicies": {
|
|
"items": {
|
|
"$ref": "#/definitions/AskForApproval"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedLoginMethods": {
|
|
"description": "Effective login methods after managed, forced-login, and workspace restrictions. An empty list permits no login method. Older servers may omit this field.",
|
|
"items": {
|
|
"$ref": "#/definitions/ForcedLoginMethod"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedPermissionProfiles": {
|
|
"additionalProperties": {
|
|
"type": "boolean"
|
|
},
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedSandboxModes": {
|
|
"items": {
|
|
"$ref": "#/definitions/SandboxMode"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedWebSearchModes": {
|
|
"items": {
|
|
"$ref": "#/definitions/WebSearchMode"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedWindowsSandboxImplementations": {
|
|
"items": {
|
|
"$ref": "#/definitions/WindowsSandboxImplementation"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"autoReview": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AutoReviewRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"browserUse": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/BrowserUseRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"chatgptBaseUrl": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"checkForUpdateOnStartup": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"cliAuthCredentialsStore": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/CliAuthCredentialsStoreMode"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"computerUse": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ComputerUseRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"defaultPermissions": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"enforceResidency": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ResidencyRequirement"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"featureRequirements": {
|
|
"additionalProperties": {
|
|
"type": "boolean"
|
|
},
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"feedback": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/FeedbackRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"inAppBrowser": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/InAppBrowserRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"logDir": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"modelCatalogJson": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"modelProvider": {
|
|
"description": "Exact provider selection required by managed policy.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"modelProviders": {
|
|
"additionalProperties": true,
|
|
"description": "Complete required provider definitions, using config.toml field names.",
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"models": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ModelsRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"sqliteHome": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ConfiguredHookHandler": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"additionalContextLimit": {
|
|
"description": "Approximate token threshold for spilling this hook's `additionalContext` to disk. `null` uses 2,500 tokens; `0` disables spilling for this hook. The threshold is evaluated against the original context; a spilled preview also includes recovery metadata.",
|
|
"format": "uint",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"async": {
|
|
"type": "boolean"
|
|
},
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"commandWindows": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"statusMessage": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"timeoutSec": {
|
|
"format": "uint64",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"command"
|
|
],
|
|
"title": "CommandConfiguredHookHandlerType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"async",
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "CommandConfiguredHookHandler",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"input": {
|
|
"additionalProperties": true,
|
|
"type": "object"
|
|
},
|
|
"server": {
|
|
"type": "string"
|
|
},
|
|
"statusMessage": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"timeoutSec": {
|
|
"format": "uint64",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"tool": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"mcp_tool"
|
|
],
|
|
"title": "McpToolConfiguredHookHandlerType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"input",
|
|
"server",
|
|
"tool",
|
|
"type"
|
|
],
|
|
"title": "McpToolConfiguredHookHandler",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"prompt"
|
|
],
|
|
"title": "PromptConfiguredHookHandlerType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "PromptConfiguredHookHandler",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"agent"
|
|
],
|
|
"title": "AgentConfiguredHookHandlerType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "AgentConfiguredHookHandler",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"ConfiguredHookMatcherGroup": {
|
|
"properties": {
|
|
"hooks": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookHandler"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"matcher": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"hooks"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"FeedbackRequirements": {
|
|
"properties": {
|
|
"enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ForcedLoginMethod": {
|
|
"enum": [
|
|
"chatgpt",
|
|
"api"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"InAppBrowserRequirements": {
|
|
"properties": {
|
|
"allowExternalBrowserSettingsImport": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"LegacyAppPathString": {
|
|
"type": "string"
|
|
},
|
|
"ManagedHooksRequirements": {
|
|
"properties": {
|
|
"Interrupt": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PermissionRequest": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PostCompact": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PostModelRequest": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PostToolUse": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PreCompact": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PreModelRequest": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"PreToolUse": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"SessionEnd": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"SessionStart": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"Stop": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"SubagentStart": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"SubagentStop": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"UserPromptSubmit": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfiguredHookMatcherGroup"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"managedDir": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"windowsManagedDir": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"PermissionRequest",
|
|
"PostCompact",
|
|
"PostToolUse",
|
|
"PreCompact",
|
|
"PreToolUse",
|
|
"SessionStart",
|
|
"Stop",
|
|
"SubagentStart",
|
|
"SubagentStop",
|
|
"UserPromptSubmit"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"ModelsRequirements": {
|
|
"properties": {
|
|
"newThread": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/NewThreadModelDefaults"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"NetworkDomainPermission": {
|
|
"enum": [
|
|
"allow",
|
|
"deny"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"NetworkRequirements": {
|
|
"properties": {
|
|
"allowLocalBinding": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowUnixSockets": {
|
|
"description": "Legacy compatibility view derived from `unix_sockets`.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"allowUpstreamProxy": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"allowedDomains": {
|
|
"description": "Legacy compatibility view derived from `domains`.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"dangerouslyAllowAllUnixSockets": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"dangerouslyAllowNonLoopbackProxy": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"deniedDomains": {
|
|
"description": "Legacy compatibility view derived from `domains`.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"domains": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/NetworkDomainPermission"
|
|
},
|
|
"description": "Canonical network permission map for `experimental_network`.",
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"httpPort": {
|
|
"format": "uint16",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"managedAllowedDomainsOnly": {
|
|
"description": "When true, only managed allowlist entries are respected while managed network enforcement is active.",
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"reviewDomains": {
|
|
"description": "Host patterns routed to network approval before ordinary allow rules.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"socksPort": {
|
|
"format": "uint16",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"unixSockets": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/NetworkUnixSocketPermission"
|
|
},
|
|
"description": "Canonical unix socket permission map for `experimental_network`.",
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"NetworkUnixSocketPermission": {
|
|
"enum": [
|
|
"allow",
|
|
"deny"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"NewThreadModelDefaults": {
|
|
"properties": {
|
|
"model": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"modelReasoningEffort": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ReasoningEffort"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"serviceTier": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ReasoningEffort": {
|
|
"description": "A non-empty reasoning effort value advertised by the model.",
|
|
"minLength": 1,
|
|
"type": "string"
|
|
},
|
|
"RequestHeader": {
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"value"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"ResidencyRequirement": {
|
|
"enum": [
|
|
"us"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"SandboxMode": {
|
|
"enum": [
|
|
"read-only",
|
|
"workspace-write",
|
|
"danger-full-access"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"WebSearchMode": {
|
|
"enum": [
|
|
"disabled",
|
|
"cached",
|
|
"indexed",
|
|
"live"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"WindowsSandboxImplementation": {
|
|
"enum": [
|
|
"elevated",
|
|
"unelevated",
|
|
"mxc"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"properties": {
|
|
"requirements": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ConfigRequirements"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Null if no requirements are configured (e.g. no requirements.toml/MDM entries)."
|
|
},
|
|
"supportsIndependentSpeedModes": {
|
|
"default": null,
|
|
"description": "Whether Fast and Ultra Fast requirements are enforced independently. Older servers omit this field and use Fast mode as a shared speed gate.",
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"title": "ConfigRequirementsReadResponse",
|
|
"type": "object"
|
|
} |