fix(server): codex threads honor managed sandbox and approval requirements - #9506
fix(server): codex threads honor managed sandbox and approval requirements#9506JeffOtano wants to merge 4 commits into
Conversation
…ments Codex under an MDM or requirements.toml policy rejects thread/start when the requested sandbox or approval policy is outside the allowed set: invalid thread settings override: invalid value for `sandbox_mode`: `DangerFullAccess` is not in the allowed set [ReadOnly, WorkspaceWrite] (set by MDM com.openai.codex:requirements_toml_base64) T3's full-access runtime mode always asked for danger-full-access and approval never, so every Codex thread failed on a managed machine. The session runtime now reads configRequirements/read once after initialize and lowers the requested sandbox and approval policy to the most permissive value the policy allows, on thread/start, thread/resume, and every turn/start. A setting is never raised above what the runtime mode asked for. When Codex does not support the method or reports no requirements, behavior is unchanged. Downgrades are logged and appended to the session/ready reason so the client can show them. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
github-actions
Bot
added
size:L
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
…nts read Review follow-ups on the managed-requirements clamp. A policy whose allowedApprovalPolicies holds only granular entries has no string the runtime mode maps to, so the resolver now adopts the first allowed entry instead of sending a string Codex will reject. An allowed string at or below the requested policy still wins over a granular one. configRequirements/read is optional, so it now times out after five seconds and is treated as "no requirements", keeping session start from hanging on an app-server that never answers the method. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 61b45192b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 61b4519. Configure here.
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This production change automatically negotiates Codex sandbox and approval settings for existing sessions and every turn, with security-sensitive effects when managed policies are present. The focused tests cover the resolver and fallbacks, but the permission and approval behavior still requires human validation. You can add or adjust custom eligibility rules. Learn more. |
…string fits When the allowed approval policies mix a granular entry with strings that are all more permissive than the requested mode, the resolver kept the requested string because some string existed, and Codex rejected it. It now adopts the first granular entry whenever no allowed string is at or below the request, and keeps the request only when nothing usable exists. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
What Changed
CodexSessionRuntimereadsconfigRequirements/readonce afterinitializeand lowers the requested sandbox and approval policy to the most permissive value the managed policy allows, onthread/start,thread/resume, and everyturn/start. A setting is never raised above what the runtime mode asked for. If Codex does not support the method or reports no requirements, behavior is unchanged. Downgrades are logged and appended to thesession/readyreason.Why
On a machine with a Codex MDM profile or
requirements.tomlthat restrictsallowed_sandbox_modes, every Codex thread in full-access mode fails to start:Full-access always requested
danger-full-accesswith approvals off, so the thread was rejected outright instead of running with the strongest settings the policy permits. Clamping at the runtime keeps the runtime-mode picker meaningful on managed machines without adding a new mode or setting.Verify:
cd apps/server && vp test run src/provider/Layers/CodexSessionRuntime.test.ts— 49 tests pass, 12 of them new (resolveCodexThreadConfig,readCodexManagedRequirements, thread and turn params under requirements).cd apps/server && tsgo --noEmit— clean.workspace-write, and the session-ready reason names the downgrade.Checklist
Note
Make Codex threads honor managed sandbox and approval requirements
makeCodexSessionRuntimereads Codex managed requirements viareadCodexManagedRequirements(5-second timeout, failures treated as no requirements) and stores them for the session lifetime.resolveCodexThreadConfiglowers a requested sandbox or approval policy to the most permissive allowed value at or below the request, recording each change as a downgrade entry; it never escalates above what was requested.openCodexThreadandbuildTurnStartParamsnow use the resolvedCodexThreadConfiginstead of the rawRuntimeMode, so thread-start and turn-start payloads carry settings permitted by Codex policy.describeCodexThreadSettingDowngradesand appended to the session ready event.dangerFullAccessandneverapproval now sendworkspaceWriteandonRequest(or granular) when Codex policy forbids the more permissive values; callers that depend on the original settings in the thread-start or turn-start payload should checkresolveCodexThreadConfigandbuildThreadStartParamsin CodexSessionRuntime.ts.Macroscope summarized b071dd9.
Note
Medium Risk
Changes how Codex sandbox and approval settings are chosen on managed machines; behavior is downgrade-only with legacy fallback when requirements are unknown, but mis-clamping could weaken or over-restrict agent execution.
Overview
Codex sessions no longer fail when MDM or
requirements.tomldisallows the sandbox/approval settings implied by the chosen runtime mode. After initialize, the runtime callsconfigRequirements/read(5s timeout; unsupported RPC, null payload, or errors → no clamping) and stores the allow-lists for the session.resolveCodexThreadConfigmaps each runtime mode to thread settings, then lowers sandbox and approval policy to the most permissive value still allowed—never above what the mode requested, including granular approval policies when needed. Those resolved settings drivethread/start,thread/resume, and everyturn/start; downgrades are warning-logged and summarized onsession/ready.Adds focused unit tests for resolution, requirements read edge cases, and thread/turn payloads under managed policy.
Reviewed by Cursor Bugbot for commit b071dd9. Bugbot is set up for automated code reviews on this repo. Configure here.