mirror of
https://github.com/openai/codex.git
synced 2026-10-29 19:08:43 +00:00
felixxia-oai
ebc05da3bd
## Why Tool allowlists alone cannot express the reviewer's sandbox and shell restrictions, which previously depended on session identity. Threads need to supply these restrictions explicitly at startup. ## What changed - Replace `AllowedTools` with `ToolPolicy`, combining an optional allowlist with managed-sandbox requirements, unified-exec requirements, and control over additional-permission arguments. - Capture the policy once at startup and apply it during tool registration and construction, including hosted tool filtering. Later extension-state changes cannot relax it. - Supply the reviewer policy explicitly while retaining the fallback for reviewer sessions without a supplied policy. Explicit policies take precedence over session identity; ordinary defaults preserve existing tool setup. ## Testing Update tool-planning tests to use explicit policies and add startup coverage for additional-permission schemas, ordinary defaults, reviewer fallbacks, explicit-policy precedence, and policy capture despite later extension-state changes. GitOrigin-RevId: 71e561d76ea24d961f5b29c7c619bdb1356c216a
45 lines
1.7 KiB
Rust
45 lines
1.7 KiB
Rust
//! A startup ceiling on tool selection and construction, independent of session identity.
|
|
//! This policy only restricts tools; permission and approval checks still apply.
|
|
|
|
use crate::ToolName;
|
|
|
|
/// Supply through `ExtensionDataInit` before starting a thread. The host captures
|
|
/// the policy once; later extension-state changes cannot relax it. Callers must
|
|
/// supply it again when resuming a thread.
|
|
#[derive(Clone, Debug)]
|
|
pub struct ToolPolicy {
|
|
/// `None` keeps ordinary tool selection; an empty list permits no tools.
|
|
/// Names include their namespace; plain names use the default namespace.
|
|
/// Generated tools such as Code Mode's `exec` and `wait` must also be listed.
|
|
pub allowed_tools: Option<Vec<ToolName>>,
|
|
/// Omit core tools unless the thread and every ready environment use a managed sandbox.
|
|
pub require_managed_sandbox: bool,
|
|
/// Omit shell tools when unified exec is disabled, instead of using one-shot exec.
|
|
pub require_unified_exec: bool,
|
|
/// Advertise additional-permission arguments when the feature is enabled.
|
|
pub expose_additional_permissions: bool,
|
|
}
|
|
|
|
impl Default for ToolPolicy {
|
|
fn default() -> Self {
|
|
Self {
|
|
allowed_tools: None,
|
|
require_managed_sandbox: false,
|
|
require_unified_exec: false,
|
|
expose_additional_permissions: true,
|
|
}
|
|
}
|
|
}
|
|
|
|
impl ToolPolicy {
|
|
pub fn allows(&self, tool: &ToolName) -> bool {
|
|
self.allowed_tools.as_ref().is_none_or(|tools| {
|
|
tools.iter().any(|allowed| {
|
|
allowed.name == tool.name
|
|
&& (allowed.namespace == tool.namespace
|
|
|| (allowed.is_default_namespace() && tool.is_default_namespace()))
|
|
})
|
|
})
|
|
}
|
|
}
|