mirror of
https://github.com/openai/codex.git
synced 2026-04-26 07:35:29 +00:00
59 lines
2.0 KiB
Markdown
59 lines
2.0 KiB
Markdown
# codex-execpolicy2
|
|
|
|
## Overview
|
|
- Policy engine and CLI built around `prefix_rule(pattern=[...], decision?, match?, not_match?)`.
|
|
- This release covers only the prefix-rule subset of the planned execpolicy v2 language; a richer language will follow.
|
|
- Tokens are matched in order; any `pattern` element may be a list to denote alternatives. `decision` defaults to `allow`; valid values: `allow`, `prompt`, `forbidden`.
|
|
- `match` / `not_match` supply example invocations that are validated at load time (think of them as unit tests).
|
|
- The CLI always prints the JSON serialization of the evaluation result (whether a match or not).
|
|
|
|
## Policy shapes
|
|
- Prefix rules use Starlark syntax:
|
|
```starlark
|
|
prefix_rule(
|
|
pattern = ["cmd", ["alt1", "alt2"]], # ordered tokens; list entries denote alternatives
|
|
decision = "prompt", # allow | prompt | forbidden; defaults to allow
|
|
match = [["cmd", "alt1"]], # examples that must match this rule
|
|
not_match = [["cmd", "oops"]], # examples that must not match this rule
|
|
)
|
|
```
|
|
|
|
## Response shapes
|
|
- Match:
|
|
```json
|
|
{
|
|
"match": {
|
|
"decision": "allow|prompt|forbidden",
|
|
"matched_rules": [
|
|
{
|
|
"prefixRuleMatch": {
|
|
"matched_prefix": ["<token>", "..."],
|
|
"decision": "allow|prompt|forbidden"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
```
|
|
|
|
- No match:
|
|
```json
|
|
"noMatch"
|
|
```
|
|
|
|
- `matched_rules` lists every rule whose prefix matched the command; `matched_prefix` is the exact prefix that matched.
|
|
- The effective `decision` is the strictest severity across all matches (`forbidden` > `prompt` > `allow`).
|
|
|
|
## CLI
|
|
- Check a command against a policy (default bundled policy shown):
|
|
```bash
|
|
cargo run -p codex-execpolicy2 -- check git status
|
|
```
|
|
- Use a specific policy file instead of the default:
|
|
```bash
|
|
cargo run -p codex-execpolicy2 -- --policy path/to/policy.codexpolicy check git status
|
|
```
|
|
- Example outcomes:
|
|
- Match: `{"Match": { ... "decision": "allow" ... }}`
|
|
- No match: `"NoMatch"`
|