diff --git a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json index b7ad3fe31..c8329d1b8 100644 --- a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json +++ b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json @@ -1,6 +1,97 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { + "AdditionalFileSystemPermissions": { + "properties": { + "read": { + "items": { + "type": "string" + }, + "type": [ + "array", + "null" + ] + }, + "write": { + "items": { + "type": "string" + }, + "type": [ + "array", + "null" + ] + } + }, + "type": "object" + }, + "AdditionalMacOsPermissions": { + "properties": { + "accessibility": { + "type": [ + "boolean", + "null" + ] + }, + "automations": { + "anyOf": [ + { + "$ref": "#/definitions/MacOsAutomationValue" + }, + { + "type": "null" + } + ] + }, + "calendar": { + "type": [ + "boolean", + "null" + ] + }, + "preferences": { + "anyOf": [ + { + "$ref": "#/definitions/MacOsPreferencesValue" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "AdditionalPermissionProfile": { + "properties": { + "fileSystem": { + "anyOf": [ + { + "$ref": "#/definitions/AdditionalFileSystemPermissions" + }, + { + "type": "null" + } + ] + }, + "macos": { + "anyOf": [ + { + "$ref": "#/definitions/AdditionalMacOsPermissions" + }, + { + "type": "null" + } + ] + }, + "network": { + "type": [ + "boolean", + "null" + ] + } + }, + "type": "object" + }, "CommandAction": { "oneOf": [ { @@ -111,6 +202,29 @@ } ] }, + "MacOsAutomationValue": { + "anyOf": [ + { + "type": "boolean" + }, + { + "items": { + "type": "string" + }, + "type": "array" + } + ] + }, + "MacOsPreferencesValue": { + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "string" + } + ] + }, "NetworkApprovalContext": { "properties": { "host": { diff --git a/codex-rs/app-server-protocol/schema/json/ServerRequest.json b/codex-rs/app-server-protocol/schema/json/ServerRequest.json index fb73dc0ed..f2f47eaa4 100644 --- a/codex-rs/app-server-protocol/schema/json/ServerRequest.json +++ b/codex-rs/app-server-protocol/schema/json/ServerRequest.json @@ -1,6 +1,97 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { + "AdditionalFileSystemPermissions": { + "properties": { + "read": { + "items": { + "type": "string" + }, + "type": [ + "array", + "null" + ] + }, + "write": { + "items": { + "type": "string" + }, + "type": [ + "array", + "null" + ] + } + }, + "type": "object" + }, + "AdditionalMacOsPermissions": { + "properties": { + "accessibility": { + "type": [ + "boolean", + "null" + ] + }, + "automations": { + "anyOf": [ + { + "$ref": "#/definitions/MacOsAutomationValue" + }, + { + "type": "null" + } + ] + }, + "calendar": { + "type": [ + "boolean", + "null" + ] + }, + "preferences": { + "anyOf": [ + { + "$ref": "#/definitions/MacOsPreferencesValue" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "AdditionalPermissionProfile": { + "properties": { + "fileSystem": { + "anyOf": [ + { + "$ref": "#/definitions/AdditionalFileSystemPermissions" + }, + { + "type": "null" + } + ] + }, + "macos": { + "anyOf": [ + { + "$ref": "#/definitions/AdditionalMacOsPermissions" + }, + { + "type": "null" + } + ] + }, + "network": { + "type": [ + "boolean", + "null" + ] + } + }, + "type": "object" + }, "ApplyPatchApprovalParams": { "properties": { "callId": { @@ -430,6 +521,29 @@ ], "type": "object" }, + "MacOsAutomationValue": { + "anyOf": [ + { + "type": "boolean" + }, + { + "items": { + "type": "string" + }, + "type": "array" + } + ] + }, + "MacOsPreferencesValue": { + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "string" + } + ] + }, "NetworkApprovalContext": { "properties": { "host": { diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index 11dcf4192..5aad0b098 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -1,6 +1,97 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { + "AdditionalFileSystemPermissions": { + "properties": { + "read": { + "items": { + "type": "string" + }, + "type": [ + "array", + "null" + ] + }, + "write": { + "items": { + "type": "string" + }, + "type": [ + "array", + "null" + ] + } + }, + "type": "object" + }, + "AdditionalMacOsPermissions": { + "properties": { + "accessibility": { + "type": [ + "boolean", + "null" + ] + }, + "automations": { + "anyOf": [ + { + "$ref": "#/definitions/MacOsAutomationValue" + }, + { + "type": "null" + } + ] + }, + "calendar": { + "type": [ + "boolean", + "null" + ] + }, + "preferences": { + "anyOf": [ + { + "$ref": "#/definitions/MacOsPreferencesValue" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "AdditionalPermissionProfile": { + "properties": { + "fileSystem": { + "anyOf": [ + { + "$ref": "#/definitions/AdditionalFileSystemPermissions" + }, + { + "type": "null" + } + ] + }, + "macos": { + "anyOf": [ + { + "$ref": "#/definitions/AdditionalMacOsPermissions" + }, + { + "type": "null" + } + ] + }, + "network": { + "type": [ + "boolean", + "null" + ] + } + }, + "type": "object" + }, "AgentMessageContent": { "oneOf": [ { diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalFileSystemPermissions.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalFileSystemPermissions.ts new file mode 100644 index 000000000..fb45464f9 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalFileSystemPermissions.ts @@ -0,0 +1,5 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +export type AdditionalFileSystemPermissions = { read: Array | null, write: Array | null, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts new file mode 100644 index 000000000..eae1ad810 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts @@ -0,0 +1,7 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. +import type { MacOsAutomationValue } from "../MacOsAutomationValue"; +import type { MacOsPreferencesValue } from "../MacOsPreferencesValue"; + +export type AdditionalMacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalPermissionProfile.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalPermissionProfile.ts new file mode 100644 index 000000000..4ca4dca12 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/AdditionalPermissionProfile.ts @@ -0,0 +1,7 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. +import type { AdditionalFileSystemPermissions } from "./AdditionalFileSystemPermissions"; +import type { AdditionalMacOsPermissions } from "./AdditionalMacOsPermissions"; + +export type AdditionalPermissionProfile = { network: boolean | null, fileSystem: AdditionalFileSystemPermissions | null, macos: AdditionalMacOsPermissions | null, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/CommandExecutionRequestApprovalParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/CommandExecutionRequestApprovalParams.ts index 4021e50a6..a7c143c6a 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/CommandExecutionRequestApprovalParams.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/CommandExecutionRequestApprovalParams.ts @@ -1,6 +1,7 @@ // GENERATED CODE! DO NOT MODIFY BY HAND! // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. +import type { AdditionalPermissionProfile } from "./AdditionalPermissionProfile"; import type { CommandAction } from "./CommandAction"; import type { ExecPolicyAmendment } from "./ExecPolicyAmendment"; import type { NetworkApprovalContext } from "./NetworkApprovalContext"; @@ -36,6 +37,10 @@ cwd?: string | null, * Best-effort parsed command actions for friendly display. */ commandActions?: Array | null, +/** + * Optional additional permissions requested for this command. + */ +additionalPermissions?: AdditionalPermissionProfile | null, /** * Optional proposed execpolicy amendment to allow similar commands without prompting. */ diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts index 12e6e9adb..d71980199 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts @@ -4,6 +4,9 @@ export type { Account } from "./Account"; export type { AccountLoginCompletedNotification } from "./AccountLoginCompletedNotification"; export type { AccountRateLimitsUpdatedNotification } from "./AccountRateLimitsUpdatedNotification"; export type { AccountUpdatedNotification } from "./AccountUpdatedNotification"; +export type { AdditionalFileSystemPermissions } from "./AdditionalFileSystemPermissions"; +export type { AdditionalMacOsPermissions } from "./AdditionalMacOsPermissions"; +export type { AdditionalPermissionProfile } from "./AdditionalPermissionProfile"; export type { AgentMessageDeltaNotification } from "./AgentMessageDeltaNotification"; export type { AnalyticsConfig } from "./AnalyticsConfig"; export type { AppBranding } from "./AppBranding"; diff --git a/codex-rs/app-server-protocol/src/export.rs b/codex-rs/app-server-protocol/src/export.rs index b6c8da90e..b48651c03 100644 --- a/codex-rs/app-server-protocol/src/export.rs +++ b/codex-rs/app-server-protocol/src/export.rs @@ -1947,6 +1947,15 @@ mod tests { let thread_start_ts = fs::read_to_string(output_dir.join("v2").join("ThreadStartParams.ts"))?; assert_eq!(thread_start_ts.contains("mockExperimentalField"), true); + let command_execution_request_approval_ts = fs::read_to_string( + output_dir + .join("v2") + .join("CommandExecutionRequestApprovalParams.ts"), + )?; + assert_eq!( + command_execution_request_approval_ts.contains("additionalPermissions"), + true + ); Ok(()) } @@ -2083,6 +2092,12 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k let thread_start_json = fs::read_to_string(output_dir.join("v2").join("ThreadStartParams.json"))?; assert_eq!(thread_start_json.contains("mockExperimentalField"), false); + let command_execution_request_approval_json = + fs::read_to_string(output_dir.join("CommandExecutionRequestApprovalParams.json"))?; + assert_eq!( + command_execution_request_approval_json.contains("additionalPermissions"), + false + ); let client_request_json = fs::read_to_string(output_dir.join("ClientRequest.json"))?; assert_eq!( @@ -2093,6 +2108,7 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k let bundle_json = fs::read_to_string(output_dir.join("codex_app_server_protocol.schemas.json"))?; assert_eq!(bundle_json.contains("mockExperimentalField"), false); + assert_eq!(bundle_json.contains("additionalPermissions"), false); assert_eq!(bundle_json.contains("MockExperimentalMethodParams"), false); assert_eq!( bundle_json.contains("MockExperimentalMethodResponse"), diff --git a/codex-rs/app-server-protocol/src/protocol/common.rs b/codex-rs/app-server-protocol/src/protocol/common.rs index f32925746..9e1e6f230 100644 --- a/codex-rs/app-server-protocol/src/protocol/common.rs +++ b/codex-rs/app-server-protocol/src/protocol/common.rs @@ -1371,4 +1371,33 @@ mod tests { let reason = crate::experimental_api::ExperimentalApi::experimental_reason(&request); assert_eq!(reason, Some("mock/experimentalMethod")); } + + #[test] + fn command_execution_request_approval_additional_permissions_is_marked_experimental() { + let params = v2::CommandExecutionRequestApprovalParams { + thread_id: "thr_123".to_string(), + turn_id: "turn_123".to_string(), + item_id: "call_123".to_string(), + approval_id: None, + reason: None, + network_approval_context: None, + command: Some("cat file".to_string()), + cwd: None, + command_actions: None, + additional_permissions: Some(v2::AdditionalPermissionProfile { + network: None, + file_system: Some(v2::AdditionalFileSystemPermissions { + read: Some(vec![std::path::PathBuf::from("/tmp/allowed")]), + write: None, + }), + macos: None, + }), + proposed_execpolicy_amendment: None, + }; + let reason = crate::experimental_api::ExperimentalApi::experimental_reason(¶ms); + assert_eq!( + reason, + Some("item/commandExecution/requestApproval.additionalPermissions") + ); + } } diff --git a/codex-rs/app-server-protocol/src/protocol/v2.rs b/codex-rs/app-server-protocol/src/protocol/v2.rs index b1f6ceb5c..41e545068 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2.rs @@ -20,7 +20,12 @@ use codex_protocol::items::TurnItem as CoreTurnItem; use codex_protocol::mcp::Resource as McpResource; use codex_protocol::mcp::ResourceTemplate as McpResourceTemplate; use codex_protocol::mcp::Tool as McpTool; +use codex_protocol::models::FileSystemPermissions as CoreFileSystemPermissions; +use codex_protocol::models::MacOsAutomationValue as CoreMacOsAutomationValue; +use codex_protocol::models::MacOsPermissions as CoreMacOsPermissions; +use codex_protocol::models::MacOsPreferencesValue as CoreMacOsPreferencesValue; use codex_protocol::models::MessagePhase; +use codex_protocol::models::PermissionProfile as CorePermissionProfile; use codex_protocol::models::ResponseItem; use codex_protocol::openai_models::InputModality; use codex_protocol::openai_models::ReasoningEffort; @@ -713,6 +718,63 @@ impl From for NetworkApprovalContext { } } +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] +#[serde(rename_all = "camelCase")] +#[ts(export_to = "v2/")] +pub struct AdditionalFileSystemPermissions { + pub read: Option>, + pub write: Option>, +} + +impl From for AdditionalFileSystemPermissions { + fn from(value: CoreFileSystemPermissions) -> Self { + Self { + read: value.read, + write: value.write, + } + } +} + +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] +#[serde(rename_all = "camelCase")] +#[ts(export_to = "v2/")] +pub struct AdditionalMacOsPermissions { + pub preferences: Option, + pub automations: Option, + pub accessibility: Option, + pub calendar: Option, +} + +impl From for AdditionalMacOsPermissions { + fn from(value: CoreMacOsPermissions) -> Self { + Self { + preferences: value.preferences, + automations: value.automations, + accessibility: value.accessibility, + calendar: value.calendar, + } + } +} + +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] +#[serde(rename_all = "camelCase")] +#[ts(export_to = "v2/")] +pub struct AdditionalPermissionProfile { + pub network: Option, + pub file_system: Option, + pub macos: Option, +} + +impl From for AdditionalPermissionProfile { + fn from(value: CorePermissionProfile) -> Self { + Self { + network: value.network, + file_system: value.file_system.map(AdditionalFileSystemPermissions::from), + macos: value.macos.map(AdditionalMacOsPermissions::from), + } + } +} + #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] @@ -3359,7 +3421,7 @@ pub struct ContextCompactedNotification { pub turn_id: String, } -#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)] +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS, ExperimentalApi)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] pub struct CommandExecutionRequestApprovalParams { @@ -3396,12 +3458,26 @@ pub struct CommandExecutionRequestApprovalParams { #[serde(default, skip_serializing_if = "Option::is_none")] #[ts(optional = nullable)] pub command_actions: Option>, + /// Optional additional permissions requested for this command. + #[experimental("item/commandExecution/requestApproval.additionalPermissions")] + #[serde(default, skip_serializing_if = "Option::is_none")] + #[ts(optional = nullable)] + pub additional_permissions: Option, /// Optional proposed execpolicy amendment to allow similar commands without prompting. #[serde(default, skip_serializing_if = "Option::is_none")] #[ts(optional = nullable)] pub proposed_execpolicy_amendment: Option, } +impl CommandExecutionRequestApprovalParams { + pub fn strip_experimental_fields(&mut self) { + // TODO: Avoid hardcoding individual experimental fields here. + // We need a generic outbound compatibility design for stripping or + // otherwise handling experimental server->client payloads. + self.additional_permissions = None; + } +} + #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] diff --git a/codex-rs/app-server-test-client/src/lib.rs b/codex-rs/app-server-test-client/src/lib.rs index 1cba215e2..f5a7fa9c4 100644 --- a/codex-rs/app-server-test-client/src/lib.rs +++ b/codex-rs/app-server-test-client/src/lib.rs @@ -171,6 +171,9 @@ enum CliCommand { }, /// Send a user message through the app-server V2 thread/turn APIs. SendMessageV2 { + /// Opt into experimental app-server methods and fields. + #[arg(long)] + experimental_api: bool, /// User message to send to Codex. user_message: String, }, @@ -260,9 +263,18 @@ pub fn run() -> Result<()> { let endpoint = resolve_endpoint(codex_bin, url)?; send_message(&endpoint, &config_overrides, user_message) } - CliCommand::SendMessageV2 { user_message } => { + CliCommand::SendMessageV2 { + experimental_api, + user_message, + } => { let endpoint = resolve_endpoint(codex_bin, url)?; - send_message_v2_endpoint(&endpoint, &config_overrides, user_message, &dynamic_tools) + send_message_v2_endpoint( + &endpoint, + &config_overrides, + user_message, + experimental_api, + &dynamic_tools, + ) } CliCommand::ResumeMessageV2 { thread_id, @@ -508,19 +520,31 @@ pub fn send_message_v2( dynamic_tools: &Option>, ) -> Result<()> { let endpoint = Endpoint::SpawnCodex(codex_bin.to_path_buf()); - send_message_v2_endpoint(&endpoint, config_overrides, user_message, dynamic_tools) + send_message_v2_endpoint( + &endpoint, + config_overrides, + user_message, + true, + dynamic_tools, + ) } fn send_message_v2_endpoint( endpoint: &Endpoint, config_overrides: &[String], user_message: String, + experimental_api: bool, dynamic_tools: &Option>, ) -> Result<()> { + if dynamic_tools.is_some() && !experimental_api { + bail!("--dynamic-tools requires --experimental-api for send-message-v2"); + } + send_message_v2_with_policies( endpoint, config_overrides, user_message, + experimental_api, None, None, dynamic_tools, @@ -690,6 +714,7 @@ fn trigger_cmd_approval( endpoint, config_overrides, message, + true, Some(AskForApproval::OnRequest), Some(SandboxPolicy::ReadOnly { access: ReadOnlyAccess::FullAccess, @@ -711,6 +736,7 @@ fn trigger_patch_approval( endpoint, config_overrides, message, + true, Some(AskForApproval::OnRequest), Some(SandboxPolicy::ReadOnly { access: ReadOnlyAccess::FullAccess, @@ -729,6 +755,7 @@ fn no_trigger_cmd_approval( endpoint, config_overrides, prompt.to_string(), + true, None, None, dynamic_tools, @@ -739,13 +766,14 @@ fn send_message_v2_with_policies( endpoint: &Endpoint, config_overrides: &[String], user_message: String, + experimental_api: bool, approval_policy: Option, sandbox_policy: Option, dynamic_tools: &Option>, ) -> Result<()> { let mut client = CodexClient::connect(endpoint, config_overrides)?; - let initialize = client.initialize()?; + let initialize = client.initialize_with_experimental_api(experimental_api)?; println!("< initialize response: {initialize:?}"); let thread_response = client.thread_start(ThreadStartParams { @@ -1032,6 +1060,13 @@ impl CodexClient { } fn initialize(&mut self) -> Result { + self.initialize_with_experimental_api(true) + } + + fn initialize_with_experimental_api( + &mut self, + experimental_api: bool, + ) -> Result { let request_id = self.request_id(); let request = ClientRequest::Initialize { request_id: request_id.clone(), @@ -1042,7 +1077,7 @@ impl CodexClient { version: env!("CARGO_PKG_VERSION").to_string(), }, capabilities: Some(InitializeCapabilities { - experimental_api: true, + experimental_api, opt_out_notification_methods: Some( NOTIFICATIONS_TO_OPT_OUT .iter() @@ -1501,6 +1536,7 @@ impl CodexClient { command, cwd, command_actions, + additional_permissions, proposed_execpolicy_amendment, } = params; @@ -1527,6 +1563,9 @@ impl CodexClient { { println!("< command actions: {command_actions:?}"); } + if let Some(additional_permissions) = additional_permissions.as_ref() { + println!("< additional permissions: {additional_permissions:?}"); + } if let Some(execpolicy_amendment) = proposed_execpolicy_amendment.as_ref() { println!("< proposed execpolicy amendment: {execpolicy_amendment:?}"); } diff --git a/codex-rs/app-server/README.md b/codex-rs/app-server/README.md index 8ee15688c..72f686177 100644 --- a/codex-rs/app-server/README.md +++ b/codex-rs/app-server/README.md @@ -667,7 +667,7 @@ Certain actions (shell commands or modifying files) may require explicit user ap Order of messages: 1. `item/started` — shows the pending `commandExecution` item with `command`, `cwd`, and other fields so you can render the proposed action. -2. `item/commandExecution/requestApproval` (request) — carries the same `itemId`, `threadId`, `turnId`, optionally `approvalId` (for subcommand callbacks), and `reason`. For normal command approvals, it also includes `command`, `cwd`, and `commandActions` for friendly display. For network-only approvals, those command fields may be omitted and `networkApprovalContext` is provided instead. +2. `item/commandExecution/requestApproval` (request) — carries the same `itemId`, `threadId`, `turnId`, optionally `approvalId` (for subcommand callbacks), and `reason`. For normal command approvals, it also includes `command`, `cwd`, and `commandActions` for friendly display. When `initialize.params.capabilities.experimentalApi = true`, it may also include experimental `additionalPermissions` describing requested per-command sandbox access. For network-only approvals, those command fields may be omitted and `networkApprovalContext` is provided instead. 3. Client response — `{ "decision": "accept", "acceptSettings": { "forSession": false } }` or `{ "decision": "decline" }`. 4. `item/completed` — final `commandExecution` item with `status: "completed" | "failed" | "declined"` and execution output. Render this as the authoritative result. @@ -1072,6 +1072,8 @@ At runtime, clients must send `initialize` with `capabilities.experimentalApi = 3. In `app-server-protocol/src/protocol/common.rs`, keep the method stable and use `inspect_params: true` when only some fields are experimental (like `thread/start`). If the entire method is experimental, annotate the method variant with `#[experimental("method/name")]`. +For server-initiated request payloads, annotate the field the same way so schema generation treats it as experimental, and make sure app-server omits that field when the client did not opt into `experimentalApi`. + 4. Regenerate protocol fixtures: ```bash diff --git a/codex-rs/app-server/src/bespoke_event_handling.rs b/codex-rs/app-server/src/bespoke_event_handling.rs index 2a5557b5b..d94e9a033 100644 --- a/codex-rs/app-server/src/bespoke_event_handling.rs +++ b/codex-rs/app-server/src/bespoke_event_handling.rs @@ -11,6 +11,7 @@ use crate::thread_state::TurnSummary; use crate::thread_status::ThreadWatchActiveGuard; use crate::thread_status::ThreadWatchManager; use codex_app_server_protocol::AccountRateLimitsUpdatedNotification; +use codex_app_server_protocol::AdditionalPermissionProfile as V2AdditionalPermissionProfile; use codex_app_server_protocol::AgentMessageDeltaNotification; use codex_app_server_protocol::ApplyPatchApprovalParams; use codex_app_server_protocol::ApplyPatchApprovalResponse; @@ -267,6 +268,7 @@ pub(crate) async fn apply_bespoke_event_handling( reason, network_approval_context, proposed_execpolicy_amendment, + additional_permissions, parsed_cmd, .. } = ev; @@ -329,6 +331,8 @@ pub(crate) async fn apply_bespoke_event_handling( }; let proposed_execpolicy_amendment_v2 = proposed_execpolicy_amendment.map(V2ExecPolicyAmendment::from); + let additional_permissions = + additional_permissions.map(V2AdditionalPermissionProfile::from); let params = CommandExecutionRequestApprovalParams { thread_id: conversation_id.to_string(), @@ -340,6 +344,7 @@ pub(crate) async fn apply_bespoke_event_handling( command, cwd, command_actions, + additional_permissions, proposed_execpolicy_amendment: proposed_execpolicy_amendment_v2, }; let rx = outgoing diff --git a/codex-rs/app-server/src/lib.rs b/codex-rs/app-server/src/lib.rs index 8607797e1..5716dbb2d 100644 --- a/codex-rs/app-server/src/lib.rs +++ b/codex-rs/app-server/src/lib.rs @@ -94,6 +94,7 @@ enum OutboundControlEvent { writer: mpsc::Sender, disconnect_sender: Option, initialized: Arc, + experimental_api_enabled: Arc, opted_out_notification_methods: Arc>>, }, /// Remove state for a closed/disconnected connection. @@ -503,6 +504,7 @@ pub async fn run_main_with_transport( writer, disconnect_sender, initialized, + experimental_api_enabled, opted_out_notification_methods, } => { outbound_connections.insert( @@ -510,6 +512,7 @@ pub async fn run_main_with_transport( OutboundConnectionState::new( writer, initialized, + experimental_api_enabled, opted_out_notification_methods, disconnect_sender, ), @@ -609,6 +612,8 @@ pub async fn run_main_with_transport( disconnect_sender, } => { let outbound_initialized = Arc::new(AtomicBool::new(false)); + let outbound_experimental_api_enabled = + Arc::new(AtomicBool::new(false)); let outbound_opted_out_notification_methods = Arc::new(RwLock::new(HashSet::new())); if outbound_control_tx @@ -617,6 +622,9 @@ pub async fn run_main_with_transport( writer, disconnect_sender, initialized: Arc::clone(&outbound_initialized), + experimental_api_enabled: Arc::clone( + &outbound_experimental_api_enabled, + ), opted_out_notification_methods: Arc::clone( &outbound_opted_out_notification_methods, ), @@ -630,6 +638,7 @@ pub async fn run_main_with_transport( connection_id, ConnectionState::new( outbound_initialized, + outbound_experimental_api_enabled, outbound_opted_out_notification_methods, ), ); @@ -679,6 +688,12 @@ pub async fn run_main_with_transport( "failed to update outbound opted-out notifications" ); } + connection_state + .outbound_experimental_api_enabled + .store( + connection_state.session.experimental_api_enabled, + std::sync::atomic::Ordering::Release, + ); if !was_initialized && connection_state.session.initialized { processor.send_initialize_notifications().await; } diff --git a/codex-rs/app-server/src/message_processor.rs b/codex-rs/app-server/src/message_processor.rs index 70e1371ce..8d5412d4e 100644 --- a/codex-rs/app-server/src/message_processor.rs +++ b/codex-rs/app-server/src/message_processor.rs @@ -133,7 +133,7 @@ pub(crate) struct MessageProcessor { #[derive(Clone, Debug, Default)] pub(crate) struct ConnectionSessionState { pub(crate) initialized: bool, - experimental_api_enabled: bool, + pub(crate) experimental_api_enabled: bool, pub(crate) opted_out_notification_methods: HashSet, } diff --git a/codex-rs/app-server/src/transport.rs b/codex-rs/app-server/src/transport.rs index 027522153..70a251ad2 100644 --- a/codex-rs/app-server/src/transport.rs +++ b/codex-rs/app-server/src/transport.rs @@ -6,6 +6,7 @@ use crate::outgoing_message::OutgoingError; use crate::outgoing_message::OutgoingMessage; use codex_app_server_protocol::JSONRPCErrorError; use codex_app_server_protocol::JSONRPCMessage; +use codex_app_server_protocol::ServerRequest; use futures::SinkExt; use futures::StreamExt; use owo_colors::OwoColorize; @@ -144,6 +145,7 @@ pub(crate) enum TransportEvent { pub(crate) struct ConnectionState { pub(crate) outbound_initialized: Arc, + pub(crate) outbound_experimental_api_enabled: Arc, pub(crate) outbound_opted_out_notification_methods: Arc>>, pub(crate) session: ConnectionSessionState, } @@ -151,10 +153,12 @@ pub(crate) struct ConnectionState { impl ConnectionState { pub(crate) fn new( outbound_initialized: Arc, + outbound_experimental_api_enabled: Arc, outbound_opted_out_notification_methods: Arc>>, ) -> Self { Self { outbound_initialized, + outbound_experimental_api_enabled, outbound_opted_out_notification_methods, session: ConnectionSessionState::default(), } @@ -163,6 +167,7 @@ impl ConnectionState { pub(crate) struct OutboundConnectionState { pub(crate) initialized: Arc, + pub(crate) experimental_api_enabled: Arc, pub(crate) opted_out_notification_methods: Arc>>, pub(crate) writer: mpsc::Sender, disconnect_sender: Option, @@ -172,11 +177,13 @@ impl OutboundConnectionState { pub(crate) fn new( writer: mpsc::Sender, initialized: Arc, + experimental_api_enabled: Arc, opted_out_notification_methods: Arc>>, disconnect_sender: Option, ) -> Self { Self { initialized, + experimental_api_enabled, opted_out_notification_methods, writer, disconnect_sender, @@ -577,6 +584,7 @@ async fn send_message_to_connection( warn!("dropping message for disconnected connection: {connection_id:?}"); return false; }; + let message = filter_outgoing_message_for_connection(connection_state, message); if should_skip_notification_for_connection(connection_state, &message) { return false; } @@ -602,6 +610,30 @@ async fn send_message_to_connection( } } +fn filter_outgoing_message_for_connection( + connection_state: &OutboundConnectionState, + message: OutgoingMessage, +) -> OutgoingMessage { + let experimental_api_enabled = connection_state + .experimental_api_enabled + .load(Ordering::Acquire); + match message { + OutgoingMessage::Request(ServerRequest::CommandExecutionRequestApproval { + request_id, + mut params, + }) => { + if !experimental_api_enabled { + params.strip_experimental_fields(); + } + OutgoingMessage::Request(ServerRequest::CommandExecutionRequestApproval { + request_id, + params, + }) + } + _ => message, + } +} + pub(crate) async fn route_outgoing_envelope( connections: &mut HashMap, envelope: OutgoingEnvelope, @@ -641,6 +673,7 @@ mod tests { use crate::error_code::OVERLOADED_ERROR_CODE; use pretty_assertions::assert_eq; use serde_json::json; + use std::path::PathBuf; use tokio::time::Duration; use tokio::time::timeout; @@ -880,6 +913,7 @@ mod tests { OutboundConnectionState::new( writer_tx, initialized, + Arc::new(AtomicBool::new(true)), opted_out_notification_methods, None, ), @@ -905,6 +939,136 @@ mod tests { ); } + #[tokio::test] + async fn command_execution_request_approval_strips_experimental_fields_without_capability() { + let connection_id = ConnectionId(8); + let (writer_tx, mut writer_rx) = mpsc::channel(1); + + let mut connections = HashMap::new(); + connections.insert( + connection_id, + OutboundConnectionState::new( + writer_tx, + Arc::new(AtomicBool::new(true)), + Arc::new(AtomicBool::new(false)), + Arc::new(RwLock::new(HashSet::new())), + None, + ), + ); + + route_outgoing_envelope( + &mut connections, + OutgoingEnvelope::ToConnection { + connection_id, + message: OutgoingMessage::Request(ServerRequest::CommandExecutionRequestApproval { + request_id: codex_app_server_protocol::RequestId::Integer(1), + params: codex_app_server_protocol::CommandExecutionRequestApprovalParams { + thread_id: "thr_123".to_string(), + turn_id: "turn_123".to_string(), + item_id: "call_123".to_string(), + approval_id: None, + reason: Some("Need extra read access".to_string()), + network_approval_context: None, + command: Some("cat file".to_string()), + cwd: Some(PathBuf::from("/tmp")), + command_actions: None, + additional_permissions: Some( + codex_app_server_protocol::AdditionalPermissionProfile { + network: None, + file_system: Some( + codex_app_server_protocol::AdditionalFileSystemPermissions { + read: Some(vec![PathBuf::from("/tmp/allowed")]), + write: None, + }, + ), + macos: None, + }, + ), + proposed_execpolicy_amendment: None, + }, + }), + }, + ) + .await; + + let message = writer_rx + .recv() + .await + .expect("request should be delivered to the connection"); + let json = serde_json::to_value(message).expect("request should serialize"); + assert_eq!(json["params"].get("additionalPermissions"), None); + } + + #[tokio::test] + async fn command_execution_request_approval_keeps_experimental_fields_with_capability() { + let connection_id = ConnectionId(9); + let (writer_tx, mut writer_rx) = mpsc::channel(1); + + let mut connections = HashMap::new(); + connections.insert( + connection_id, + OutboundConnectionState::new( + writer_tx, + Arc::new(AtomicBool::new(true)), + Arc::new(AtomicBool::new(true)), + Arc::new(RwLock::new(HashSet::new())), + None, + ), + ); + + route_outgoing_envelope( + &mut connections, + OutgoingEnvelope::ToConnection { + connection_id, + message: OutgoingMessage::Request(ServerRequest::CommandExecutionRequestApproval { + request_id: codex_app_server_protocol::RequestId::Integer(1), + params: codex_app_server_protocol::CommandExecutionRequestApprovalParams { + thread_id: "thr_123".to_string(), + turn_id: "turn_123".to_string(), + item_id: "call_123".to_string(), + approval_id: None, + reason: Some("Need extra read access".to_string()), + network_approval_context: None, + command: Some("cat file".to_string()), + cwd: Some(PathBuf::from("/tmp")), + command_actions: None, + additional_permissions: Some( + codex_app_server_protocol::AdditionalPermissionProfile { + network: None, + file_system: Some( + codex_app_server_protocol::AdditionalFileSystemPermissions { + read: Some(vec![PathBuf::from("/tmp/allowed")]), + write: None, + }, + ), + macos: None, + }, + ), + proposed_execpolicy_amendment: None, + }, + }), + }, + ) + .await; + + let message = writer_rx + .recv() + .await + .expect("request should be delivered to the connection"); + let json = serde_json::to_value(message).expect("request should serialize"); + assert_eq!( + json["params"]["additionalPermissions"], + json!({ + "network": null, + "fileSystem": { + "read": ["/tmp/allowed"], + "write": null, + }, + "macos": null, + }) + ); + } + #[tokio::test] async fn broadcast_does_not_block_on_slow_connection() { let fast_connection_id = ConnectionId(1); @@ -921,6 +1085,7 @@ mod tests { OutboundConnectionState::new( fast_writer_tx, Arc::new(AtomicBool::new(true)), + Arc::new(AtomicBool::new(true)), Arc::new(RwLock::new(HashSet::new())), Some(fast_disconnect_token.clone()), ), @@ -930,6 +1095,7 @@ mod tests { OutboundConnectionState::new( slow_writer_tx.clone(), Arc::new(AtomicBool::new(true)), + Arc::new(AtomicBool::new(true)), Arc::new(RwLock::new(HashSet::new())), Some(slow_disconnect_token.clone()), ), @@ -1006,6 +1172,7 @@ mod tests { OutboundConnectionState::new( writer_tx, Arc::new(AtomicBool::new(true)), + Arc::new(AtomicBool::new(true)), Arc::new(RwLock::new(HashSet::new())), None, ),