8 Commits

Author	SHA1	Message	Date
kevin zhao	d747d1d492	do not send allow_prefix if execpolicy is disabled	2025-12-02 17:38:49 -05:00
kevin zhao	a2528c3675	using RW locks	2025-12-02 17:38:49 -05:00
kevin zhao	8fb06a9d5b	mutating in memory policy instead of reloading	2025-12-02 17:38:49 -05:00
kevin zhao	80e3635b25	Add approval allow-prefix flow in core and tui	2025-12-02 17:38:48 -05:00
zhao-oai	87b211709e	bypass sandbox for policy approved commands (#7110) ... allowing cmds greenlit by execpolicy to bypass sandbox + minor refactor for a world where we have execpolicy rules with specific sandbox requirements	2025-11-21 18:03:23 -05:00
zhao-oai	fe7a3f0c2b	execpolicycheck command in codex cli (#7012) ... adding execpolicycheck tool onto codex cli this is useful for validating policies (can be multiple) against commands. it will also surface errors in policy syntax: <img width="1150" height="281" alt="Screenshot 2025-11-19 at 12 46 21 PM" src="https://github.com/user-attachments/assets/8f99b403-564c-4172-acc9-6574a8d13dc3" /> this PR also changes output format when there's no match in the CLI. instead of returning the raw string `noMatch`, we return `{"noMatch":{}}` this PR is a rewrite of: https://github.com/openai/codex/pull/6932 (due to the numerous merge conflicts present in the original PR) --------- Co-authored-by: Michael Bolin <mbolin@openai.com>	2025-11-20 16:44:31 -05:00
zhao-oai	fb9849e1e3	migrating execpolicy -> execpolicy-legacy and execpolicy2 -> execpolicy (#6956)	2025-11-19 19:14:10 -08:00
zhao-oai	65c13f1ae7	execpolicy2 core integration (#6641) ... This PR threads execpolicy2 into codex-core. activated via feature flag: exec_policy (on by default) reads and parses all .codexpolicy files in `codex_home/codex` refactored tool runtime API to integrate execpolicy logic --------- Co-authored-by: Michael Bolin <mbolin@openai.com>	2025-11-19 16:50:43 -08:00