codex/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "definitions": {
    "ApprovalsReviewer": {
      "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `guardian_subagent` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request.",
      "enum": [
        "user",
        "guardian_subagent"
      ],
      "type": "string"
    },
    "AskForApproval": {
      "oneOf": [
        {
          "enum": [
            "untrusted",
            "on-failure",
            "on-request",
            "never"
          ],
          "type": "string"
        },
        {
          "additionalProperties": false,
          "properties": {
            "granular": {
              "properties": {
                "mcp_elicitations": {
                  "type": "boolean"
                },
                "request_permissions": {
                  "default": false,
                  "type": "boolean"
                },
                "rules": {
                  "type": "boolean"
                },
                "sandbox_approval": {
                  "type": "boolean"
                },
                "skill_approval": {
                  "default": false,
                  "type": "boolean"
                }
              },
              "required": [
                "mcp_elicitations",
                "rules",
                "sandbox_approval"
              ],
              "type": "object"
            }
          },
          "required": [
            "granular"
          ],
          "title": "GranularAskForApproval",
          "type": "object"
        }
      ]
    },
    "ConfigRequirements": {
      "properties": {
        "allowedApprovalPolicies": {
          "items": {
            "$ref": "#/definitions/AskForApproval"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "allowedSandboxModes": {
          "items": {
            "$ref": "#/definitions/SandboxMode"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "allowedWebSearchModes": {
          "items": {
            "$ref": "#/definitions/WebSearchMode"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "apps": {
          "additionalProperties": {
            "$ref": "#/definitions/ConfigRequirementsApp"
          },
          "type": [
            "object",
            "null"
          ]
        },
        "enforceResidency": {
          "anyOf": [
            {
              "$ref": "#/definitions/ResidencyRequirement"
            },
            {
              "type": "null"
            }
          ]
        },
        "featureRequirements": {
          "additionalProperties": {
            "type": "boolean"
          },
          "type": [
            "object",
            "null"
          ]
        },
        "guardianPolicyConfig": {
          "type": [
            "string",
            "null"
          ]
        },
        "mcpServers": {
          "additionalProperties": {
            "$ref": "#/definitions/ConfigRequirementsMcpServer"
          },
          "type": [
            "object",
            "null"
          ]
        },
        "rules": {
          "anyOf": [
            {
              "$ref": "#/definitions/ConfigRequirementsRules"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "type": "object"
    },
    "ConfigRequirementsApp": {
      "properties": {
        "enabled": {
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "ConfigRequirementsMcpServer": {
      "properties": {
        "identity": {
          "$ref": "#/definitions/ConfigRequirementsMcpServerIdentity"
        }
      },
      "required": [
        "identity"
      ],
      "type": "object"
    },
    "ConfigRequirementsMcpServerIdentity": {
      "oneOf": [
        {
          "properties": {
            "command": {
              "type": "string"
            },
            "type": {
              "enum": [
                "command"
              ],
              "title": "CommandConfigRequirementsMcpServerIdentityType",
              "type": "string"
            }
          },
          "required": [
            "command",
            "type"
          ],
          "title": "CommandConfigRequirementsMcpServerIdentity",
          "type": "object"
        },
        {
          "properties": {
            "type": {
              "enum": [
                "url"
              ],
              "title": "UrlConfigRequirementsMcpServerIdentityType",
              "type": "string"
            },
            "url": {
              "type": "string"
            }
          },
          "required": [
            "type",
            "url"
          ],
          "title": "UrlConfigRequirementsMcpServerIdentity",
          "type": "object"
        }
      ]
    },
    "ConfigRequirementsPatternToken": {
      "properties": {
        "anyOf": {
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "token": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "ConfigRequirementsPrefixRule": {
      "properties": {
        "decision": {
          "anyOf": [
            {
              "$ref": "#/definitions/ConfigRequirementsRuleDecision"
            },
            {
              "type": "null"
            }
          ]
        },
        "justification": {
          "type": [
            "string",
            "null"
          ]
        },
        "pattern": {
          "items": {
            "$ref": "#/definitions/ConfigRequirementsPatternToken"
          },
          "type": "array"
        }
      },
      "required": [
        "pattern"
      ],
      "type": "object"
    },
    "ConfigRequirementsRuleDecision": {
      "enum": [
        "allow",
        "prompt",
        "forbidden"
      ],
      "type": "string"
    },
    "ConfigRequirementsRules": {
      "properties": {
        "prefixRules": {
          "items": {
            "$ref": "#/definitions/ConfigRequirementsPrefixRule"
          },
          "type": "array"
        }
      },
      "required": [
        "prefixRules"
      ],
      "type": "object"
    },
    "NetworkDomainPermission": {
      "enum": [
        "allow",
        "deny"
      ],
      "type": "string"
    },
    "NetworkRequirements": {
      "properties": {
        "allowLocalBinding": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "allowUnixSockets": {
          "description": "Legacy compatibility view derived from `unix_sockets`.",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "allowUpstreamProxy": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "allowedDomains": {
          "description": "Legacy compatibility view derived from `domains`.",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "dangerFullAccessDenylistOnly": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "dangerouslyAllowAllUnixSockets": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "dangerouslyAllowNonLoopbackProxy": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "deniedDomains": {
          "description": "Legacy compatibility view derived from `domains`.",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "domains": {
          "additionalProperties": {
            "$ref": "#/definitions/NetworkDomainPermission"
          },
          "description": "Canonical network permission map for `experimental_network`.",
          "type": [
            "object",
            "null"
          ]
        },
        "enabled": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "httpPort": {
          "format": "uint16",
          "minimum": 0.0,
          "type": [
            "integer",
            "null"
          ]
        },
        "managedAllowedDomainsOnly": {
          "description": "When true, only managed allowlist entries are respected while managed network enforcement is active.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "socksPort": {
          "format": "uint16",
          "minimum": 0.0,
          "type": [
            "integer",
            "null"
          ]
        },
        "unixSockets": {
          "additionalProperties": {
            "$ref": "#/definitions/NetworkUnixSocketPermission"
          },
          "description": "Canonical unix socket permission map for `experimental_network`.",
          "type": [
            "object",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "NetworkUnixSocketPermission": {
      "enum": [
        "allow",
        "none"
      ],
      "type": "string"
    },
    "ResidencyRequirement": {
      "enum": [
        "us"
      ],
      "type": "string"
    },
    "SandboxMode": {
      "enum": [
        "read-only",
        "workspace-write",
        "danger-full-access"
      ],
      "type": "string"
    },
    "WebSearchMode": {
      "enum": [
        "disabled",
        "cached",
        "live"
      ],
      "type": "string"
    }
  },
  "properties": {
    "requirements": {
      "anyOf": [
        {
          "$ref": "#/definitions/ConfigRequirements"
        },
        {
          "type": "null"
        }
      ],
      "description": "Null if no requirements are configured (e.g. no requirements.toml/MDM entries)."
    }
  },
  "title": "ConfigRequirementsReadResponse",
  "type": "object"
}