agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(approvals) RejectConfig for request_permissions (#14118)

Browse Source 
## Summary
We need to support allowing request_permissions calls when using
`Reject` policy

<img width="1133" height="588" alt="Screenshot 2026-03-09 at 12 06
40 PM"
src="https://github.com/user-attachments/assets/a8df987f-c225-4866-b8ab-5590960daec5"
/>

Note that this is a backwards-incompatible change for Reject policy. I'm
not sure if we need to add a default based on our current use/setup

## Testing
- [x] Added tests
- [x] Tested locally
This commit is contained in:
Dylan Hurd
2026-03-09 18:16:54 -07:00
committed by GitHub
parent c1defcc98c
commit 6da84efed8
28 changed files with 285 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server-protocol/schema/json/ClientRequest.json
+4
View File
@@ -57,6 +57,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -66,6 +69,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/EventMsg.json
+5
View File
@@ -4683,6 +4683,10 @@
"description": "Reject MCP elicitation prompts.",
"type": "boolean"
},
"request_permissions": {
"description": "Reject approval prompts related to built-in permission requests.",
"type": "boolean"
},
"rules": {
"description": "Reject prompts triggered by execpolicy `prompt` rules.",
"type": "boolean"
@@ -4694,6 +4698,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+9
View File
@@ -6752,6 +6752,10 @@
"description": "Reject MCP elicitation prompts.",
"type": "boolean"
},
"request_permissions": {
"description": "Reject approval prompts related to built-in permission requests.",
"type": "boolean"
},
"rules": {
"description": "Reject prompts triggered by execpolicy `prompt` rules.",
"type": "boolean"
@@ -6763,6 +6767,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
@@ -9232,6 +9237,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -9241,6 +9249,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
+4
View File
@@ -731,6 +731,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -740,6 +743,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
+4
View File
@@ -148,6 +148,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -157,6 +160,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
+4
View File
@@ -20,6 +20,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -29,6 +32,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
+4
View File
@@ -20,6 +20,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -29,6 +32,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
+4
View File
@@ -24,6 +24,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -33,6 +36,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
+4
View File
@@ -20,6 +20,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -29,6 +32,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
+4
View File
@@ -24,6 +24,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -33,6 +36,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
+4
View File
@@ -20,6 +20,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -29,6 +32,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
+4
View File
@@ -24,6 +24,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -33,6 +36,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
+4
View File
@@ -24,6 +24,9 @@
"mcp_elicitations": {
"type": "boolean"
},
"request_permissions": {
"type": "boolean"
},
"rules": {
"type": "boolean"
},
@@ -33,6 +36,7 @@
},
"required": [
"mcp_elicitations",
"request_permissions",
"rules",
"sandbox_approval"
],
codex-rs/app-server-protocol/schema/typescript/RejectConfig.ts
+4
View File
@@ -11,6 +11,10 @@ sandbox_approval: boolean,
* Reject prompts triggered by execpolicy `prompt` rules.
*/
rules: boolean,
/**
* Reject approval prompts related to built-in permission requests.
*/
request_permissions: boolean,
/**
* Reject MCP elicitation prompts.
*/
codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts
+1 -1
View File
@@ -2,4 +2,4 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": { sandbox_approval: boolean, rules: boolean, mcp_elicitations: boolean, } } | "never";
export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": { sandbox_approval: boolean, rules: boolean, request_permissions: boolean, mcp_elicitations: boolean, } } | "never";
codex-rs/app-server-protocol/src/protocol/v2.rs
+28
View File
@@ -193,6 +193,7 @@ pub enum AskForApproval {
Reject {
sandbox_approval: bool,
rules: bool,
request_permissions: bool,
mcp_elicitations: bool,
},
Never,
@@ -207,10 +208,12 @@ impl AskForApproval {
AskForApproval::Reject {
sandbox_approval,
rules,
request_permissions,
mcp_elicitations,
} => CoreAskForApproval::Reject(CoreRejectConfig {
sandbox_approval,
rules,
request_permissions,
mcp_elicitations,
}),
AskForApproval::Never => CoreAskForApproval::Never,
@@ -227,6 +230,7 @@ impl From<CoreAskForApproval> for AskForApproval {
CoreAskForApproval::Reject(reject_config) => AskForApproval::Reject {
sandbox_approval: reject_config.sandbox_approval,
rules: reject_config.rules,
request_permissions: reject_config.request_permissions,
mcp_elicitations: reject_config.mcp_elicitations,
},
CoreAskForApproval::Never => AskForApproval::Never,
@@ -5832,6 +5836,30 @@ mod tests {
assert_eq!(back_to_v2, v2_policy);
}
#[test]
fn ask_for_approval_reject_round_trips_request_permissions_flag() {
let v2_policy = AskForApproval::Reject {
sandbox_approval: true,
rules: false,
request_permissions: true,
mcp_elicitations: false,
};
let core_policy = v2_policy.to_core();
assert_eq!(
core_policy,
CoreAskForApproval::Reject(CoreRejectConfig {
sandbox_approval: true,
rules: false,
request_permissions: true,
mcp_elicitations: false,
})
);
let back_to_v2 = AskForApproval::from(core_policy);
assert_eq!(back_to_v2, v2_policy);
}
#[test]
fn mcp_server_elicitation_response_round_trips_rmcp_result() {
let rmcp_result = rmcp::model::CreateElicitationResult {