mirror of
https://github.com/openai/codex.git
synced 2026-09-17 12:23:33 +00:00
a118494323
This PR makes it possible to disable live web search via an enterprise config even if the user is running in `--yolo` mode (though cached web search will still be available). To do this, create `/etc/codex/requirements.toml` as follows: ```toml # "live" is not allowed; "disabled" is allowed even though not listed explicitly. allowed_web_search_modes = ["cached"] ``` Or set `requirements_toml_base64` MDM as explained on https://developers.openai.com/codex/security/#locations. ### Why - Enforce admin/MDM/`requirements.toml` constraints on web-search behavior, independent of user config and per-turn sandbox defaults. - Ensure per-turn config resolution and review-mode overrides never crash when constraints are present. ### What - Add `allowed_web_search_modes` to requirements parsing and surface it in app-server v2 `ConfigRequirements` (`allowedWebSearchModes`), with fixtures updated. - Define a requirements allowlist type (`WebSearchModeRequirement`) and normalize semantics: - `disabled` is always implicitly allowed (even if not listed). - An empty list is treated as `["disabled"]`. - Make `Config.web_search_mode` a `Constrained<WebSearchMode>` and apply requirements via `ConstrainedWithSource<WebSearchMode>`. - Update per-turn resolution (`resolve_web_search_mode_for_turn`) to: - Prefer `Live → Cached → Disabled` when `SandboxPolicy::DangerFullAccess` is active (subject to requirements), unless the user preference is explicitly `Disabled`. - Otherwise, honor the user’s preferred mode, falling back to an allowed mode when necessary. - Update TUI `/debug-config` and app-server mapping to display normalized `allowed_web_search_modes` (including implicit `disabled`). - Fix web-search integration tests to assert cached behavior under `SandboxPolicy::ReadOnly` (since `DangerFullAccess` legitimately prefers `live` when allowed).
codex-core config loader
This module is the canonical place to load and describe Codex configuration layers (user config, CLI/session overrides, managed config, and MDM-managed preferences) and to produce:
- An effective merged TOML config.
- Per-key origins metadata (which layer “wins” for a given key).
- Per-layer versions (stable fingerprints) used for optimistic concurrency / conflict detection.
Public surface
Exported from codex_core::config_loader:
load_config_layers_state(codex_home, cwd_opt, cli_overrides, overrides, cloud_requirements) -> ConfigLayerStackConfigLayerStackeffective_config() -> toml::Valueorigins() -> HashMap<String, ConfigLayerMetadata>layers_high_to_low() -> Vec<ConfigLayer>with_user_config(user_config) -> ConfigLayerStack
ConfigLayerEntry(one layer’s{name, config, version, disabled_reason};namecarries source metadata)LoaderOverrides(test/override hooks for managed config sources)merge_toml_values(base, overlay)(public helper used elsewhere)
Layering model
Precedence is top overrides bottom:
- MDM managed preferences (macOS only)
- System managed config (e.g.
managed_config.toml) - Session flags (CLI overrides, applied as dotted-path TOML writes)
- User config (
config.toml)
Layers with a disabled_reason are still surfaced for UI, but are ignored when
computing the effective config and origins metadata. This is what
ConfigLayerStack::effective_config() implements.
Typical usage
Most callers want the effective config plus metadata:
use codex_core::config_loader::{load_config_layers_state, LoaderOverrides};
use codex_utils_absolute_path::AbsolutePathBuf;
use toml::Value as TomlValue;
let cli_overrides: Vec<(String, TomlValue)> = Vec::new();
let cwd = AbsolutePathBuf::current_dir()?;
let layers = load_config_layers_state(
&codex_home,
Some(cwd),
&cli_overrides,
LoaderOverrides::default(),
None,
).await?;
let effective = layers.effective_config();
let origins = layers.origins();
let layers_for_ui = layers.layers_high_to_low();
Internal layout
Implementation is split by concern:
state.rs: public types (ConfigLayerEntry,ConfigLayerStack) + merge/origins convenience methods.layer_io.rs: readingconfig.toml, managed config, and managed preferences inputs.overrides.rs: CLI dotted-path overrides → TOML “session flags” layer.merge.rs: recursive TOML merge.fingerprint.rs: stable per-layer hashing and per-key origins traversal.macos.rs: managed preferences integration (macOS only).