jif 93beee910d Add conservative restriction helpers for tool policies (#38183) ...

## What changed

- Add `restrict_to` helpers that combine parent and requested `WebSearchMode`
  and `AppToolApproval` values without granting access beyond either policy.
- Treat `Auto` and `Writes` approval modes as incomparable, falling back to
  `Prompt` when they are combined.

## Testing

- Cover every pair of web search and app tool approval modes.

GitOrigin-RevId: 41b3da5ace2fbdaab667c4b834bc2051a8e5e9cf

2026-08-12 12:53:07 +00:00

..

loader

Embed defaults in the packaged config layer (#38179)

2026-08-12 12:15:47 +00:00

requirements_layers

Support execution-host context when resolving cloud config (#38086)

2026-08-11 23:31:26 +00:00

thread_config

Allow custom providers to opt into standalone web search (#34846)

2026-07-23 00:02:15 +00:00

auth_policy.rs

Enforce managed authentication requirements locally (#37132)

2026-08-05 18:09:26 +00:00

cloud_config_bundle_tests.rs

Support execution-host context when resolving cloud config (#38086)

2026-08-11 23:31:26 +00:00

cloud_config_bundle.rs

Apply refreshed cloud config bundles to later sessions (#37908)

2026-08-11 01:05:48 +00:00

cloud_config_layers_tests.rs

Clarify config layer iteration APIs (#36774)

2026-08-03 17:29:42 +00:00

cloud_config_layers.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

config_layer_source.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

config_requirements.rs

Remove config lockfile support (#38011)

2026-08-11 13:52:48 +00:00

config_toml.rs

Remove config lockfile support (#38011)

2026-08-11 13:52:48 +00:00

constraint.rs

Enforce automatic review for managed models (#37511)

2026-08-07 23:43:14 +00:00

diagnostics.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

fingerprint.rs

Preserve multi-agent settings across config representations (#35656)

2026-07-27 18:41:09 +00:00

hook_config.rs

Generalize hook handler execution (#37644)

2026-08-09 00:57:15 +00:00

hooks_tests.rs

Generalize hook handler execution (#37644)

2026-08-09 00:57:15 +00:00

host_name.rs

perf(config): defer remote sandbox hostname lookup (#28542)

2026-06-16 11:17:41 -04:00

key_aliases.rs

Unify multi-agent settings under agents (#33550)

2026-07-16 09:00:51 +00:00

lib.rs

Support execution-host context when resolving cloud config (#38086)

2026-08-11 23:31:26 +00:00

marketplace_edit.rs

[codex] Add marketplace remove command and shared logic (#17752)

2026-04-17 21:44:47 -07:00

mcp_edit.rs

Consolidate MCP config editing in codex-core (#36359)

2026-07-31 16:28:22 +00:00

mcp_requirements_tests.rs

Add per-surface MCP tool exposure controls (#36781)

2026-08-03 18:51:46 +00:00

mcp_requirements.rs

[codex] Add managed MCP server matchers (#29648)

2026-06-25 22:15:50 +01:00

mcp_types_tests.rs

Add conservative restriction helpers for tool policies (#38183)

2026-08-12 12:53:07 +00:00

mcp_types.rs

Add conservative restriction helpers for tool policies (#38183)

2026-08-12 12:53:07 +00:00

merge_tests.rs

Preserve multi-agent settings across config representations (#35656)

2026-07-27 18:41:09 +00:00

merge.rs

Preserve multi-agent settings across config representations (#35656)

2026-07-27 18:41:09 +00:00

overrides.rs

Preserve multi-agent settings across config representations (#35656)

2026-07-27 18:41:09 +00:00

permissions_toml.rs

Remove unused Rust helpers (#34345)

2026-07-20 13:45:29 +00:00

plugin_edit.rs

Move plugin out of core. (#20348)

2026-04-30 14:26:14 -07:00

profile_toml.rs

package: include zsh fork in Codex package (#23756)

2026-05-22 17:54:07 -07:00

project_root_markers.rs

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

requirements_exec_policy.rs

feat: single app-server bootstrap in TUI (#16582)

2026-04-08 13:49:06 +01:00

schema.rs

Add tool registry collision policy configuration (#36954)

2026-08-04 19:28:37 +00:00

shell_environment_policy_tests.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

shell_environment_policy.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

skills_config_tests.rs

Honor per-directory bundled skill settings in skills/list (#37979)

2026-08-11 10:20:54 +00:00

skills_config.rs

Honor per-directory bundled skill settings in skills/list (#37979)

2026-08-11 10:20:54 +00:00

state_tests.rs

Clarify config layer iteration APIs (#36774)

2026-08-03 17:29:42 +00:00

state.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

strict_config_tests.rs

Include call IDs in MCP requests and clarify metadata config (#37477)

2026-08-07 17:44:05 +00:00

strict_config.rs

Enforce strict tool name collision errors (#37020)

2026-08-05 04:00:50 +00:00

test_support_tests.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

test_support.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

thread_config.rs

Allow custom providers to opt into standalone web search (#34846)

2026-07-23 00:02:15 +00:00

tui_keymap_chord_tests.rs

Support two-stroke TUI key chords (#36511)

2026-08-01 17:43:03 +00:00

tui_keymap.rs

Support two-stroke TUI key chords (#36511)

2026-08-01 17:43:03 +00:00

types_tests.rs

feat: skip memory startup when Codex rate limits are low (#19990)

2026-04-28 17:07:16 +02:00

types.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00