mirror of
https://github.com/openai/codex.git
synced 2026-04-25 15:15:15 +00:00
425fff7ad6
## Why
We need a way to auto-reject specific approval prompt categories without
switching all approvals off.
The goal is to let users independently control:
- sandbox escalation approvals,
- execpolicy `prompt` rule approvals,
- MCP elicitation prompts.
## What changed
- Added a new primary approval mode in `protocol/src/protocol.rs`:
```rust
pub enum AskForApproval {
// ...
Reject(RejectConfig),
// ...
}
pub struct RejectConfig {
pub sandbox_approval: bool,
pub rules: bool,
pub mcp_elicitations: bool,
}
```
- Wired `RejectConfig` semantics through approval paths in `core`:
- `core/src/exec_policy.rs`
- rejects rule-driven prompts when `rules = true`
- rejects sandbox/escalation prompts when `sandbox_approval = true`
- preserves rule priority when both rule and sandbox prompt conditions
are present
- `core/src/tools/sandboxing.rs`
- applies `sandbox_approval` to default exec approval decisions and
sandbox-failure retry gating
- `core/src/safety.rs`
- keeps `Reject { all false }` behavior aligned with `OnRequest` for
patch safety
- rejects out-of-root patch approvals when `sandbox_approval = true`
- `core/src/mcp_connection_manager.rs`
- auto-declines MCP elicitations when `mcp_elicitations = true`
- Ensured approval policy used by MCP elicitation flow stays in sync
with constrained session policy updates.
- Updated app-server v2 conversions and generated schema/TypeScript
artifacts for the new `Reject` shape.
## Verification
Added focused unit coverage for the new behavior in:
- `core/src/exec_policy.rs`
- `core/src/tools/sandboxing.rs`
- `core/src/mcp_connection_manager.rs`
- `core/src/safety.rs`
- `core/src/tools/runtimes/apply_patch.rs`
Key cases covered include rule-vs-sandbox prompt precedence, MCP
auto-decline behavior, and patch/sandbox retry behavior under
`RejectConfig`.
922 lines
22 KiB
JSON
922 lines
22 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AskForApproval": {
|
|
"oneOf": [
|
|
{
|
|
"enum": [
|
|
"untrusted",
|
|
"on-failure",
|
|
"on-request",
|
|
"never"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"reject": {
|
|
"properties": {
|
|
"mcp_elicitations": {
|
|
"type": "boolean"
|
|
},
|
|
"rules": {
|
|
"type": "boolean"
|
|
},
|
|
"sandbox_approval": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": [
|
|
"mcp_elicitations",
|
|
"rules",
|
|
"sandbox_approval"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": [
|
|
"reject"
|
|
],
|
|
"title": "RejectAskForApproval",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"ContentItem": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"text": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"input_text"
|
|
],
|
|
"title": "InputTextContentItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"text",
|
|
"type"
|
|
],
|
|
"title": "InputTextContentItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"image_url": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"input_image"
|
|
],
|
|
"title": "InputImageContentItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"image_url",
|
|
"type"
|
|
],
|
|
"title": "InputImageContentItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"text": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"output_text"
|
|
],
|
|
"title": "OutputTextContentItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"text",
|
|
"type"
|
|
],
|
|
"title": "OutputTextContentItem",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"FunctionCallOutputBody": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"items": {
|
|
"$ref": "#/definitions/FunctionCallOutputContentItem"
|
|
},
|
|
"type": "array"
|
|
}
|
|
]
|
|
},
|
|
"FunctionCallOutputContentItem": {
|
|
"description": "Responses API compatible content items that can be returned by a tool call. This is a subset of ContentItem with the types we support as function call outputs.",
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"text": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"input_text"
|
|
],
|
|
"title": "InputTextFunctionCallOutputContentItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"text",
|
|
"type"
|
|
],
|
|
"title": "InputTextFunctionCallOutputContentItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"image_url": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"input_image"
|
|
],
|
|
"title": "InputImageFunctionCallOutputContentItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"image_url",
|
|
"type"
|
|
],
|
|
"title": "InputImageFunctionCallOutputContentItem",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"FunctionCallOutputPayload": {
|
|
"description": "The payload we send back to OpenAI when reporting a tool call result.\n\n`body` serializes directly as the wire value for `function_call_output.output`. `success` remains internal metadata for downstream handling.",
|
|
"properties": {
|
|
"body": {
|
|
"$ref": "#/definitions/FunctionCallOutputBody"
|
|
},
|
|
"success": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"body"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"GhostCommit": {
|
|
"description": "Details of a ghost commit created from a repository state.",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"parent": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"preexisting_untracked_dirs": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"preexisting_untracked_files": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"preexisting_untracked_dirs",
|
|
"preexisting_untracked_files"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"LocalShellAction": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"env": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"timeout_ms": {
|
|
"format": "uint64",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"exec"
|
|
],
|
|
"title": "ExecLocalShellActionType",
|
|
"type": "string"
|
|
},
|
|
"user": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"working_directory": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "ExecLocalShellAction",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"LocalShellStatus": {
|
|
"enum": [
|
|
"completed",
|
|
"in_progress",
|
|
"incomplete"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"MessagePhase": {
|
|
"description": "Classifies an assistant message as interim commentary or final answer text.\n\nProviders do not emit this consistently, so callers must treat `None` as \"phase unknown\" and keep compatibility behavior for legacy models.",
|
|
"oneOf": [
|
|
{
|
|
"description": "Mid-turn assistant text (for example preamble/progress narration).\n\nAdditional tool calls or assistant output may follow before turn completion.",
|
|
"enum": [
|
|
"commentary"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "The assistant's terminal answer text for the current turn.",
|
|
"enum": [
|
|
"final_answer"
|
|
],
|
|
"type": "string"
|
|
}
|
|
]
|
|
},
|
|
"Personality": {
|
|
"enum": [
|
|
"none",
|
|
"friendly",
|
|
"pragmatic"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"ReasoningItemContent": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"text": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"reasoning_text"
|
|
],
|
|
"title": "ReasoningTextReasoningItemContentType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"text",
|
|
"type"
|
|
],
|
|
"title": "ReasoningTextReasoningItemContent",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"text": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"text"
|
|
],
|
|
"title": "TextReasoningItemContentType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"text",
|
|
"type"
|
|
],
|
|
"title": "TextReasoningItemContent",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"ReasoningItemReasoningSummary": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"text": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"summary_text"
|
|
],
|
|
"title": "SummaryTextReasoningItemReasoningSummaryType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"text",
|
|
"type"
|
|
],
|
|
"title": "SummaryTextReasoningItemReasoningSummary",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"ResponseItem": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"content": {
|
|
"items": {
|
|
"$ref": "#/definitions/ContentItem"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"end_turn": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"id": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
],
|
|
"writeOnly": true
|
|
},
|
|
"phase": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/MessagePhase"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"role": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"message"
|
|
],
|
|
"title": "MessageResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"content",
|
|
"role",
|
|
"type"
|
|
],
|
|
"title": "MessageResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"content": {
|
|
"default": null,
|
|
"items": {
|
|
"$ref": "#/definitions/ReasoningItemContent"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"encrypted_content": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"id": {
|
|
"type": "string",
|
|
"writeOnly": true
|
|
},
|
|
"summary": {
|
|
"items": {
|
|
"$ref": "#/definitions/ReasoningItemReasoningSummary"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"reasoning"
|
|
],
|
|
"title": "ReasoningResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"summary",
|
|
"type"
|
|
],
|
|
"title": "ReasoningResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"action": {
|
|
"$ref": "#/definitions/LocalShellAction"
|
|
},
|
|
"call_id": {
|
|
"description": "Set when using the Responses API.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"id": {
|
|
"description": "Legacy id field retained for compatibility with older payloads.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
],
|
|
"writeOnly": true
|
|
},
|
|
"status": {
|
|
"$ref": "#/definitions/LocalShellStatus"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"local_shell_call"
|
|
],
|
|
"title": "LocalShellCallResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"action",
|
|
"status",
|
|
"type"
|
|
],
|
|
"title": "LocalShellCallResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"arguments": {
|
|
"type": "string"
|
|
},
|
|
"call_id": {
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
],
|
|
"writeOnly": true
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"function_call"
|
|
],
|
|
"title": "FunctionCallResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"arguments",
|
|
"call_id",
|
|
"name",
|
|
"type"
|
|
],
|
|
"title": "FunctionCallResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"call_id": {
|
|
"type": "string"
|
|
},
|
|
"output": {
|
|
"$ref": "#/definitions/FunctionCallOutputPayload"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"function_call_output"
|
|
],
|
|
"title": "FunctionCallOutputResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"call_id",
|
|
"output",
|
|
"type"
|
|
],
|
|
"title": "FunctionCallOutputResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"call_id": {
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
],
|
|
"writeOnly": true
|
|
},
|
|
"input": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"status": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"custom_tool_call"
|
|
],
|
|
"title": "CustomToolCallResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"call_id",
|
|
"input",
|
|
"name",
|
|
"type"
|
|
],
|
|
"title": "CustomToolCallResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"call_id": {
|
|
"type": "string"
|
|
},
|
|
"output": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"custom_tool_call_output"
|
|
],
|
|
"title": "CustomToolCallOutputResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"call_id",
|
|
"output",
|
|
"type"
|
|
],
|
|
"title": "CustomToolCallOutputResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"action": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/WebSearchAction"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"id": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
],
|
|
"writeOnly": true
|
|
},
|
|
"status": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"web_search_call"
|
|
],
|
|
"title": "WebSearchCallResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "WebSearchCallResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"ghost_commit": {
|
|
"$ref": "#/definitions/GhostCommit"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"ghost_snapshot"
|
|
],
|
|
"title": "GhostSnapshotResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"ghost_commit",
|
|
"type"
|
|
],
|
|
"title": "GhostSnapshotResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"encrypted_content": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"compaction"
|
|
],
|
|
"title": "CompactionResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"encrypted_content",
|
|
"type"
|
|
],
|
|
"title": "CompactionResponseItem",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"other"
|
|
],
|
|
"title": "OtherResponseItemType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "OtherResponseItem",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"SandboxMode": {
|
|
"enum": [
|
|
"read-only",
|
|
"workspace-write",
|
|
"danger-full-access"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"WebSearchAction": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"queries": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"query": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"search"
|
|
],
|
|
"title": "SearchWebSearchActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "SearchWebSearchAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"open_page"
|
|
],
|
|
"title": "OpenPageWebSearchActionType",
|
|
"type": "string"
|
|
},
|
|
"url": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "OpenPageWebSearchAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"pattern": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"find_in_page"
|
|
],
|
|
"title": "FindInPageWebSearchActionType",
|
|
"type": "string"
|
|
},
|
|
"url": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "FindInPageWebSearchAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"other"
|
|
],
|
|
"title": "OtherWebSearchActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "OtherWebSearchAction",
|
|
"type": "object"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nThe precedence is: history > path > thread_id. If using history or path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
|
|
"properties": {
|
|
"approvalPolicy": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AskForApproval"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"baseInstructions": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"config": {
|
|
"additionalProperties": true,
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"cwd": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"developerInstructions": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"model": {
|
|
"description": "Configuration overrides for the resumed thread, if any.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"modelProvider": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"personality": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/Personality"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"sandbox": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/SandboxMode"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"threadId": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"threadId"
|
|
],
|
|
"title": "ThreadResumeParams",
|
|
"type": "object"
|
|
} |