github/codex
4
0 Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-03 08:22:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rename reject approval policy to granular (#14516)

Browse Source
This commit is contained in:
Jack Mousseau authored and GitHub committed 2026-03-12 16:38:04 -07:00
1 parent d32820ab07
commit b7dba72dbd
46 files changed
+456 -419
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

codex-rs/core/src/tools/runtimes/apply_patch.rs
+1 -1
View File
@@ -166,7 +166,7 @@ impl Approvable<ApplyPatchRequest> for ApplyPatchRuntime {
fn wants_no_sandbox_approval(&self, policy: AskForApproval) -> bool {
match policy {
AskForApproval::Never => false,
AskForApproval::Reject(reject_config) => !reject_config.rejects_sandbox_approval(),
AskForApproval::Granular(granular_config) => granular_config.allows_sandbox_approval(),
AskForApproval::OnFailure => true,
AskForApproval::OnRequest => true,
AskForApproval::UnlessTrusted => true,
codex-rs/core/src/tools/runtimes/apply_patch_tests.rs
+14 -14
View File
@@ -1,28 +1,28 @@
use super::*;
use codex_protocol::protocol::RejectConfig;
use codex_protocol::protocol::GranularApprovalConfig;
use pretty_assertions::assert_eq;
use std::collections::HashMap;
#[test]
fn wants_no_sandbox_approval_reject_respects_sandbox_flag() {
fn wants_no_sandbox_approval_granular_respects_sandbox_flag() {
let runtime = ApplyPatchRuntime::new();
assert!(runtime.wants_no_sandbox_approval(AskForApproval::OnRequest));
assert!(
!runtime.wants_no_sandbox_approval(AskForApproval::Reject(RejectConfig {
sandbox_approval: true,
rules: false,
skill_approval: false,
request_permissions: false,
mcp_elicitations: false,
!runtime.wants_no_sandbox_approval(AskForApproval::Granular(GranularApprovalConfig {
sandbox_approval: false,
rules: true,
skill_approval: true,
request_permissions: true,
mcp_elicitations: true,
}))
);
assert!(
runtime.wants_no_sandbox_approval(AskForApproval::Reject(RejectConfig {
sandbox_approval: false,
rules: false,
skill_approval: false,
request_permissions: false,
mcp_elicitations: false,
runtime.wants_no_sandbox_approval(AskForApproval::Granular(GranularApprovalConfig {
sandbox_approval: true,
rules: true,
skill_approval: true,
request_permissions: true,
mcp_elicitations: true,
}))
);
}
codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
+9 -9
View File
@@ -65,11 +65,11 @@ pub(crate) struct PreparedUnifiedExecZshFork {
const PROMPT_CONFLICT_REASON: &str =
"approval required by policy, but AskForApproval is set to Never";
const REJECT_SANDBOX_APPROVAL_REASON: &str =
"approval required by policy, but AskForApproval::Reject.sandbox_approval is set";
"approval required by policy, but AskForApproval::Granular.sandbox_approval is false";
const REJECT_RULES_APPROVAL_REASON: &str =
"approval required by policy rule, but AskForApproval::Reject.rules is set";
"approval required by policy rule, but AskForApproval::Granular.rules is false";
const REJECT_SKILL_APPROVAL_REASON: &str =
"approval required by skill, but AskForApproval::Reject.skill_approval is set";
"approval required by skill, but AskForApproval::Granular.skill_approval is false";
fn approval_sandbox_permissions(
sandbox_permissions: SandboxPermissions,
@@ -358,18 +358,18 @@ fn execve_prompt_is_rejected_by_policy(
) -> Option<&'static str> {
match (approval_policy, decision_source) {
(AskForApproval::Never, _) => Some(PROMPT_CONFLICT_REASON),
(AskForApproval::Reject(reject_config), DecisionSource::SkillScript { .. })
if reject_config.rejects_skill_approval() =>
(AskForApproval::Granular(granular_config), DecisionSource::SkillScript { .. })
if !granular_config.allows_skill_approval() =>
{
Some(REJECT_SKILL_APPROVAL_REASON)
}
(AskForApproval::Reject(reject_config), DecisionSource::PrefixRule)
if reject_config.rejects_rules_approval() =>
(AskForApproval::Granular(granular_config), DecisionSource::PrefixRule)
if !granular_config.allows_rules_approval() =>
{
Some(REJECT_RULES_APPROVAL_REASON)
}
(AskForApproval::Reject(reject_config), DecisionSource::UnmatchedCommandFallback)
if reject_config.rejects_sandbox_approval() =>
(AskForApproval::Granular(granular_config), DecisionSource::UnmatchedCommandFallback)
if !granular_config.allows_sandbox_approval() =>
{
Some(REJECT_SANDBOX_APPROVAL_REASON)
}
codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs
+25 -25
View File
@@ -16,8 +16,8 @@ use crate::config::Permissions;
use crate::config::types::ShellEnvironmentPolicy;
use crate::exec::SandboxType;
use crate::protocol::AskForApproval;
use crate::protocol::GranularApprovalConfig;
use crate::protocol::ReadOnlyAccess;
use crate::protocol::RejectConfig;
use crate::protocol::SandboxPolicy;
use crate::sandboxing::SandboxPermissions;
#[cfg(target_os = "macos")]
@@ -105,12 +105,12 @@ fn execve_prompt_rejection_uses_skill_approval_for_skill_scripts() {
assert_eq!(
super::execve_prompt_is_rejected_by_policy(
AskForApproval::Reject(RejectConfig {
AskForApproval::Granular(GranularApprovalConfig {
sandbox_approval: true,
rules: true,
skill_approval: false,
request_permissions: false,
mcp_elicitations: false,
skill_approval: true,
request_permissions: true,
mcp_elicitations: true,
}),
&decision_source,
),
@@ -118,16 +118,16 @@ fn execve_prompt_rejection_uses_skill_approval_for_skill_scripts() {
);
assert_eq!(
super::execve_prompt_is_rejected_by_policy(
AskForApproval::Reject(RejectConfig {
sandbox_approval: false,
rules: false,
skill_approval: true,
request_permissions: false,
mcp_elicitations: false,
AskForApproval::Granular(GranularApprovalConfig {
sandbox_approval: true,
rules: true,
skill_approval: false,
request_permissions: true,
mcp_elicitations: true,
}),
&decision_source,
),
Some("approval required by skill, but AskForApproval::Reject.skill_approval is set"),
Some("approval required by skill, but AskForApproval::Granular.skill_approval is false"),
);
}
@@ -135,16 +135,16 @@ fn execve_prompt_rejection_uses_skill_approval_for_skill_scripts() {
fn execve_prompt_rejection_keeps_prefix_rules_on_rules_flag() {
assert_eq!(
super::execve_prompt_is_rejected_by_policy(
AskForApproval::Reject(RejectConfig {
AskForApproval::Granular(GranularApprovalConfig {
sandbox_approval: true,
rules: true,
skill_approval: false,
request_permissions: false,
mcp_elicitations: false,
rules: false,
skill_approval: true,
request_permissions: true,
mcp_elicitations: true,
}),
&super::DecisionSource::PrefixRule,
),
Some("approval required by policy rule, but AskForApproval::Reject.rules is set"),
Some("approval required by policy rule, but AskForApproval::Granular.rules is false"),
);
}
@@ -152,16 +152,16 @@ fn execve_prompt_rejection_keeps_prefix_rules_on_rules_flag() {
fn execve_prompt_rejection_keeps_unmatched_commands_on_sandbox_flag() {
assert_eq!(
super::execve_prompt_is_rejected_by_policy(
AskForApproval::Reject(RejectConfig {
sandbox_approval: true,
rules: false,
skill_approval: false,
request_permissions: false,
mcp_elicitations: false,
AskForApproval::Granular(GranularApprovalConfig {
sandbox_approval: false,
rules: true,
skill_approval: true,
request_permissions: true,
mcp_elicitations: true,
}),
&super::DecisionSource::UnmatchedCommandFallback,
),
Some("approval required by policy, but AskForApproval::Reject.sandbox_approval is set"),
Some("approval required by policy, but AskForApproval::Granular.sandbox_approval is false"),
);
}