Raise Guardian's action review limit to 200,000 bytes (#44060)

## What changed

Increase `GUARDIAN_MAX_ACTION_BYTES` from 8,000 to 200,000 bytes to allow larger actions to be reviewed. Keep unified exec stdin approvals capped at 8,000 bytes with a separate `MAX_STDIN_APPROVAL_BYTES` constant.

## Testing

Update aggregate payload rejection coverage for the new limit and exercise MCP elicitation reviews with tool descriptions exceeding the previous 8,000-byte limit.

GitOrigin-RevId: fd4b97980803a7a687449043931e6f1e57e260d3
(cherry picked from commit 3d3df0a0ca)

codex-rs/core/src/guardian/mod.rs

@@ -67,7 +67,7 @@ const GUARDIAN_MAX_MESSAGE_ENTRY_TOKENS: usize = 5_000;
 const GUARDIAN_MAX_TOOL_ENTRY_TOKENS: usize = 1_000;
 pub(crate) const GUARDIAN_MAX_ROOT_MESSAGE_TOKENS: usize = 900;
 pub(crate) const GUARDIAN_MAX_NODE_REPL_TOOL_RESULT_TOKENS: usize = 6_000;
-pub(crate) const GUARDIAN_MAX_ACTION_BYTES: usize = 8_000;
+pub(crate) const GUARDIAN_MAX_ACTION_BYTES: usize = 50_000 * 4;
 const GUARDIAN_MAX_ACTION_STRING_TOKENS: usize = 16_000;
 const GUARDIAN_RECENT_ENTRY_LIMIT: usize = 40;
 

codex-rs/core/src/guardian/tests.rs

@@ -1229,7 +1229,7 @@ fn guardian_action_formatters_reject_large_aggregate_payloads() {
     let action = GuardianApprovalRequest::ApplyPatch {
         id: "patch-1".to_string(),
         cwd: test_path_buf("/tmp").abs().into(),
-        files: vec![file; 1_000],
+        files: vec![file; 20_000],
         patch: String::new(),
     };
 
@@ -1241,7 +1241,7 @@ fn guardian_action_formatters_reject_large_aggregate_payloads() {
             error
                 .expect_err("aggregate action should exceed the review limit")
                 .to_string(),
-            "Guardian action exceeds the 8000-byte review limit"
+            "Guardian action exceeds the 200000-byte review limit"
         );
     }
 }

codex-rs/core/src/unified_exec/process_manager.rs

@@ -102,6 +102,7 @@ const UNIFIED_EXEC_ENV: [(&str, &str); 10] = [
 const NETWORK_ACCESS_DENIED_MESSAGE: &str =
     "Network access was denied by the Codex sandbox network proxy.";
 const LATE_NETWORK_DENIAL_GRACE_PERIOD: Duration = Duration::from_millis(100);
+const MAX_STDIN_APPROVAL_BYTES: usize = 8_000;
 const INTERRUPT: &str = "\u{3}";
 
 /// Test-only override for deterministic unified exec process IDs.
@@ -862,7 +863,7 @@ impl UnifiedExecProcessManager {
             // Bound the entire serialized action plus its reason, including JSON
             // escaping. Reject, never execute an unreviewed tail.
             let oversized = reviewed.text.len().saturating_add(approval_reason.len())
-                > crate::guardian::GUARDIAN_MAX_ACTION_BYTES;
+                > MAX_STDIN_APPROVAL_BYTES;
             let size_check_result = if reviewed.truncated {
                 "formatter_truncated"
             } else if oversized {

codex-rs/core/tests/suite/guardian_mcp_elicitation.rs

@@ -417,7 +417,7 @@ async fn node_elicitations_attribute_independent_reviews_without_changing_action
             "connector_name": "Inner Connector",
             "connector_description": "Connector for the reviewed inner action",
             "tool_title": "Inner action",
-            "tool_description": "Review this action independently from JavaScript",
+            "tool_description": "Review this action independently from JavaScript".repeat(220),
         });
         match call_id_source {
             CallIdSource::Host | CallIdSource::Missing => {}
@@ -607,7 +607,7 @@ async fn node_elicitations_attribute_independent_reviews_without_changing_action
                 "connector_id": "inner-connector", "connector_name": "Inner Connector",
                 "connector_description": "Connector for the reviewed inner action",
                 "tool_title": "Inner action",
-                "tool_description": "Review this action independently from JavaScript",
+                "tool_description": "Review this action independently from JavaScript".repeat(220),
             })
         );
     }