mirror of
https://github.com/openai/codex.git
synced 2026-04-26 15:45:02 +00:00
a05fe33cc9
Run guardian before Bash PermissionRequest hooks when approvals are already routed to guardian, pass the review into the hook input as advisory context, and reuse the guardian decision when hooks stay quiet. Co-authored-by: Codex <noreply@openai.com>
179 lines
3.7 KiB
JSON
179 lines
3.7 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"additionalProperties": false,
|
|
"definitions": {
|
|
"NullableString": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"PermissionRequestApprovalReviewDecisionWire": {
|
|
"enum": [
|
|
"allow",
|
|
"deny"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"PermissionRequestApprovalReviewRiskLevelWire": {
|
|
"enum": [
|
|
"low",
|
|
"medium",
|
|
"high",
|
|
"critical"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"PermissionRequestApprovalReviewStatusWire": {
|
|
"enum": [
|
|
"approved",
|
|
"denied",
|
|
"aborted",
|
|
"failed",
|
|
"timed_out"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"PermissionRequestApprovalReviewUserAuthorizationWire": {
|
|
"enum": [
|
|
"unknown",
|
|
"low",
|
|
"medium",
|
|
"high"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"PermissionRequestApprovalReviewWire": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"decision": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/PermissionRequestApprovalReviewDecisionWire"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"rationale": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"risk_level": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/PermissionRequestApprovalReviewRiskLevelWire"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"source": {
|
|
"const": "guardian",
|
|
"type": "string"
|
|
},
|
|
"status": {
|
|
"$ref": "#/definitions/PermissionRequestApprovalReviewStatusWire"
|
|
},
|
|
"user_authorization": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/PermissionRequestApprovalReviewUserAuthorizationWire"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"decision",
|
|
"rationale",
|
|
"risk_level",
|
|
"source",
|
|
"status",
|
|
"user_authorization"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"PermissionRequestToolInput": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"properties": {
|
|
"approval_review": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/PermissionRequestApprovalReviewWire"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"cwd": {
|
|
"type": "string"
|
|
},
|
|
"hook_event_name": {
|
|
"const": "PermissionRequest",
|
|
"type": "string"
|
|
},
|
|
"model": {
|
|
"type": "string"
|
|
},
|
|
"permission_mode": {
|
|
"enum": [
|
|
"default",
|
|
"acceptEdits",
|
|
"plan",
|
|
"dontAsk",
|
|
"bypassPermissions"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"session_id": {
|
|
"type": "string"
|
|
},
|
|
"tool_input": {
|
|
"$ref": "#/definitions/PermissionRequestToolInput"
|
|
},
|
|
"tool_name": {
|
|
"const": "Bash",
|
|
"type": "string"
|
|
},
|
|
"transcript_path": {
|
|
"$ref": "#/definitions/NullableString"
|
|
},
|
|
"turn_id": {
|
|
"description": "Codex extension: expose the active turn id to internal turn-scoped hooks.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"approval_review",
|
|
"cwd",
|
|
"hook_event_name",
|
|
"model",
|
|
"permission_mode",
|
|
"session_id",
|
|
"tool_input",
|
|
"tool_name",
|
|
"transcript_path",
|
|
"turn_id"
|
|
],
|
|
"title": "permission-request.command.input",
|
|
"type": "object"
|
|
} |