mirror of
https://github.com/openai/codex.git
synced 2026-05-28 15:00:16 +00:00
9f75a0d395
Introduce an explicit enterprise-managed config layer source and the client-side machinery to materialize cloud-delivered config TOML fragments into the normal config stack. The new ConfigLayerSource::EnterpriseManaged variant carries the backend layer id and display name so diagnostics and debug output can point admins at the exact cloud layer that needs fixing. Add codex_config::cloud_config_layers to build config layers from delivered fragments. The composition keeps backend layer order deterministic, resolves relative path settings against a supplied base directory for consistency with existing MDM-delivered config semantics, and stores the raw TOML with that base directory on ConfigLayerEntry so typed diagnostics can reparse non-file layers without relying on a synthetic filesystem path. Keep this v1 pull-based and snapshot-oriented. The bundle loader/cache work can feed these helpers, but this change does not introduce dynamic refresh or announce/push semantics. Consumers continue to read the config state they are already handed. Tighten provenance and diagnostics for non-file layers: enterprise-managed layers render as enterprise-managed config values in debug output, syntax/type errors use the layer display name, and synthetic hook source paths include the enterprise layer name/id when a filesystem path is needed for existing hook metadata surfaces. Split hook provenance semantically by adding HookSource::CloudManagedConfig. Hooks delivered through enterprise-managed config layers now report cloud_managed_config / cloudManagedConfig, while hooks delivered through requirements remain CloudRequirements. The TUI labels the new source as Cloud-managed config, and analytics/core metric mappings were updated to include the new source. Regenerate app-server protocol JSON and TypeScript schema fixtures for the new ConfigLayerSource and HookSource wire values. Verification: just write-app-server-schema; cargo test -p codex-app-server-protocol; cargo test -p codex-hooks hook_metadata_for_config_layer_source; cargo test -p codex-core hook_run_metric_tags; cargo test -p codex-analytics hook_run_metadata; just fmt; just fix -p codex-protocol -p codex-app-server-protocol -p codex-hooks -p codex-analytics -p codex-core -p codex-tui.
855 lines
20 KiB
JSON
Generated
855 lines
20 KiB
JSON
Generated
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AbsolutePathBuf": {
|
|
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
|
|
"type": "string"
|
|
},
|
|
"AnalyticsConfig": {
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AppConfig": {
|
|
"properties": {
|
|
"default_tools_approval_mode": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AppToolApproval"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"default_tools_enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"destructive_enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"enabled": {
|
|
"default": true,
|
|
"type": "boolean"
|
|
},
|
|
"open_world_enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"tools": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AppToolsConfig"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AppToolApproval": {
|
|
"enum": [
|
|
"auto",
|
|
"prompt",
|
|
"approve"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"AppToolConfig": {
|
|
"properties": {
|
|
"approval_mode": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AppToolApproval"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"enabled": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AppToolsConfig": {
|
|
"type": "object"
|
|
},
|
|
"ApprovalsReviewer": {
|
|
"description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",
|
|
"enum": [
|
|
"user",
|
|
"auto_review",
|
|
"guardian_subagent"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"AppsConfig": {
|
|
"properties": {
|
|
"_default": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AppsDefaultConfig"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"default": null
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AppsDefaultConfig": {
|
|
"properties": {
|
|
"destructive_enabled": {
|
|
"default": true,
|
|
"type": "boolean"
|
|
},
|
|
"enabled": {
|
|
"default": true,
|
|
"type": "boolean"
|
|
},
|
|
"open_world_enabled": {
|
|
"default": true,
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AskForApproval": {
|
|
"oneOf": [
|
|
{
|
|
"enum": [
|
|
"untrusted",
|
|
"on-failure",
|
|
"on-request",
|
|
"never"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"granular": {
|
|
"properties": {
|
|
"mcp_elicitations": {
|
|
"type": "boolean"
|
|
},
|
|
"request_permissions": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"rules": {
|
|
"type": "boolean"
|
|
},
|
|
"sandbox_approval": {
|
|
"type": "boolean"
|
|
},
|
|
"skill_approval": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": [
|
|
"mcp_elicitations",
|
|
"rules",
|
|
"sandbox_approval"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"granular"
|
|
],
|
|
"title": "GranularAskForApproval",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"AutoCompactTokenLimitScope": {
|
|
"description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.",
|
|
"oneOf": [
|
|
{
|
|
"description": "Count the full active context against the limit.",
|
|
"enum": [
|
|
"total"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "Count sampled output and later growth after the carried window prefix.",
|
|
"enum": [
|
|
"body_after_prefix"
|
|
],
|
|
"type": "string"
|
|
}
|
|
]
|
|
},
|
|
"Config": {
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"analytics": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AnalyticsConfig"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"approval_policy": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AskForApproval"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"approvals_reviewer": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ApprovalsReviewer"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "[UNSTABLE] Optional default for where approval requests are routed for review."
|
|
},
|
|
"compact_prompt": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"desktop": {
|
|
"additionalProperties": true,
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"developer_instructions": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"forced_chatgpt_workspace_id": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ForcedChatgptWorkspaceIds"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"forced_login_method": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ForcedLoginMethod"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"instructions": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"model": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"model_auto_compact_token_limit": {
|
|
"format": "int64",
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"model_auto_compact_token_limit_scope": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AutoCompactTokenLimitScope"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"model_context_window": {
|
|
"format": "int64",
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"model_provider": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"model_reasoning_effort": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ReasoningEffort"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"model_reasoning_summary": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ReasoningSummary"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"model_verbosity": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/Verbosity"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"review_model": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"sandbox_mode": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/SandboxMode"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"sandbox_workspace_write": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/SandboxWorkspaceWrite"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"service_tier": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"tools": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/ToolsV2"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"web_search": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/WebSearchMode"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ConfigLayer": {
|
|
"properties": {
|
|
"config": true,
|
|
"disabledReason": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"name": {
|
|
"$ref": "#/definitions/ConfigLayerSource"
|
|
},
|
|
"version": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"config",
|
|
"name",
|
|
"version"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"ConfigLayerMetadata": {
|
|
"properties": {
|
|
"name": {
|
|
"$ref": "#/definitions/ConfigLayerSource"
|
|
},
|
|
"version": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"version"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"ConfigLayerSource": {
|
|
"oneOf": [
|
|
{
|
|
"description": "Managed preferences layer delivered by MDM (macOS only).",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string"
|
|
},
|
|
"key": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"mdm"
|
|
],
|
|
"title": "MdmConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"domain",
|
|
"key",
|
|
"type"
|
|
],
|
|
"title": "MdmConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "Managed config layer from a file (usually `managed_config.toml`).",
|
|
"properties": {
|
|
"file": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
}
|
|
],
|
|
"description": "This is the path to the system config.toml file, though it is not guaranteed to exist."
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"system"
|
|
],
|
|
"title": "SystemConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"file",
|
|
"type"
|
|
],
|
|
"title": "SystemConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "Enterprise-managed config layer delivered by the cloud config bundle.",
|
|
"properties": {
|
|
"id": {
|
|
"description": "Stable identifier for the delivered layer.",
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"description": "Admin-facing name for the delivered layer. This is surfaced in diagnostics so users know which cloud layer needs administrator attention.",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"enterpriseManaged"
|
|
],
|
|
"title": "EnterpriseManagedConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"name",
|
|
"type"
|
|
],
|
|
"title": "EnterpriseManagedConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "User config layer from $CODEX_HOME/config.toml. This layer is special in that it is expected to be: - writable by the user - generally outside the workspace directory",
|
|
"properties": {
|
|
"file": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
}
|
|
],
|
|
"description": "This is the path to the user's config.toml file, though it is not guaranteed to exist."
|
|
},
|
|
"profile": {
|
|
"description": "Name of the selected profile-v2 config layered on top of the base user config, when this layer represents one.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"user"
|
|
],
|
|
"title": "UserConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"file",
|
|
"type"
|
|
],
|
|
"title": "UserConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "Path to a .codex/ folder within a project. There could be multiple of these between `cwd` and the project/repo root.",
|
|
"properties": {
|
|
"dotCodexFolder": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"project"
|
|
],
|
|
"title": "ProjectConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"dotCodexFolder",
|
|
"type"
|
|
],
|
|
"title": "ProjectConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "Session-layer overrides supplied via `-c`/`--config`.",
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"sessionFlags"
|
|
],
|
|
"title": "SessionFlagsConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "SessionFlagsConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "`managed_config.toml` was designed to be a config that was loaded as the last layer on top of everything else. This scheme did not quite work out as intended, but we keep this variant as a \"best effort\" while we phase out `managed_config.toml` in favor of `requirements.toml`.",
|
|
"properties": {
|
|
"file": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"legacyManagedConfigTomlFromFile"
|
|
],
|
|
"title": "LegacyManagedConfigTomlFromFileConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"file",
|
|
"type"
|
|
],
|
|
"title": "LegacyManagedConfigTomlFromFileConfigLayerSource",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"legacyManagedConfigTomlFromMdm"
|
|
],
|
|
"title": "LegacyManagedConfigTomlFromMdmConfigLayerSourceType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "LegacyManagedConfigTomlFromMdmConfigLayerSource",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"ForcedChatgptWorkspaceIds": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
],
|
|
"description": "Backward-compatible API shape for ChatGPT workspace login restrictions."
|
|
},
|
|
"ForcedLoginMethod": {
|
|
"enum": [
|
|
"chatgpt",
|
|
"api"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"ReasoningEffort": {
|
|
"description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
|
|
"enum": [
|
|
"none",
|
|
"minimal",
|
|
"low",
|
|
"medium",
|
|
"high",
|
|
"xhigh"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"ReasoningSummary": {
|
|
"description": "A summary of the reasoning performed by the model. This can be useful for debugging and understanding the model's reasoning process. See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#reasoning-summaries",
|
|
"oneOf": [
|
|
{
|
|
"enum": [
|
|
"auto",
|
|
"concise",
|
|
"detailed"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "Option to disable reasoning summaries.",
|
|
"enum": [
|
|
"none"
|
|
],
|
|
"type": "string"
|
|
}
|
|
]
|
|
},
|
|
"SandboxMode": {
|
|
"enum": [
|
|
"read-only",
|
|
"workspace-write",
|
|
"danger-full-access"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"SandboxWorkspaceWrite": {
|
|
"properties": {
|
|
"exclude_slash_tmp": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"exclude_tmpdir_env_var": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"network_access": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"writable_roots": {
|
|
"default": [],
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ToolsV2": {
|
|
"properties": {
|
|
"web_search": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/WebSearchToolConfig"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"Verbosity": {
|
|
"description": "Controls output length/detail on GPT-5 models via the Responses API. Serialized with lowercase values to match the OpenAI API.",
|
|
"enum": [
|
|
"low",
|
|
"medium",
|
|
"high"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"WebSearchContextSize": {
|
|
"enum": [
|
|
"low",
|
|
"medium",
|
|
"high"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"WebSearchLocation": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"city": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"country": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"region": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"timezone": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"WebSearchMode": {
|
|
"enum": [
|
|
"disabled",
|
|
"cached",
|
|
"live"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"WebSearchToolConfig": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"allowed_domains": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"context_size": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/WebSearchContextSize"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"location": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/WebSearchLocation"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
"properties": {
|
|
"config": {
|
|
"$ref": "#/definitions/Config"
|
|
},
|
|
"layers": {
|
|
"items": {
|
|
"$ref": "#/definitions/ConfigLayer"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"origins": {
|
|
"additionalProperties": {
|
|
"$ref": "#/definitions/ConfigLayerMetadata"
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"config",
|
|
"origins"
|
|
],
|
|
"title": "ConfigReadResponse",
|
|
"type": "object"
|
|
} |