mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
e1eb98461c
## What changed - Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements. - Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events. - Require synchronous review when cached evidence has an unusable encrypted parent compaction. ## Testing Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API. GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
34 lines
1.4 KiB
Rust
34 lines
1.4 KiB
Rust
//! Supplies action categories to the review extension and enforces host-owned requirements.
|
|
|
|
use super::GuardianApprovalRequest;
|
|
use crate::tools::sandboxing::ApprovalAction;
|
|
use codex_protocol::openai_models::GuardianScope;
|
|
|
|
impl GuardianApprovalRequest {
|
|
pub(crate) fn guardian_scope(&self) -> GuardianScope {
|
|
match self {
|
|
Self::ExecCommand { .. } | Self::WriteStdin { .. } => GuardianScope::Shell,
|
|
#[cfg(unix)]
|
|
Self::Execve { .. } => GuardianScope::Shell,
|
|
Self::ApplyPatch { .. } => GuardianScope::FileChanges,
|
|
Self::McpToolCall { server, .. } => GuardianScope::for_mcp_server(server),
|
|
Self::NetworkAccess { .. } => GuardianScope::Network,
|
|
Self::RequestPermissions { .. } => GuardianScope::Permissions,
|
|
}
|
|
}
|
|
}
|
|
|
|
impl ApprovalAction {
|
|
pub(crate) fn guardian_scope(&self) -> GuardianScope {
|
|
match self {
|
|
Self::ExecCommand { .. } | Self::WriteStdin { .. } => GuardianScope::Shell,
|
|
#[cfg(unix)]
|
|
Self::Execve { .. } => GuardianScope::Shell,
|
|
Self::ApplyPatch { .. } => GuardianScope::FileChanges,
|
|
Self::McpToolCall { server, .. } => GuardianScope::for_mcp_server(server),
|
|
Self::NetworkAccess { .. } => GuardianScope::Network,
|
|
Self::RequestPermissions { .. } => GuardianScope::Permissions,
|
|
}
|
|
}
|
|
}
|