From 772259b01f6f3c088ac8b04414206d8cb52e0251 Mon Sep 17 00:00:00 2001 From: Dylan Hurd Date: Mon, 9 Mar 2026 21:56:23 -0700 Subject: [PATCH] fix(core) default RejectConfig.request_permissions (#14165) ## Summary Adds a default here so existing config deserializes ## Testing - [x] Added a unit test --- .../schema/json/ClientRequest.json | 2 +- .../schema/json/EventMsg.json | 2 +- .../codex_app_server_protocol.schemas.json | 4 ++-- .../codex_app_server_protocol.v2.schemas.json | 2 +- .../schema/json/v2/ConfigReadResponse.json | 2 +- .../v2/ConfigRequirementsReadResponse.json | 2 +- .../schema/json/v2/ThreadForkParams.json | 2 +- .../schema/json/v2/ThreadForkResponse.json | 2 +- .../schema/json/v2/ThreadResumeParams.json | 2 +- .../schema/json/v2/ThreadResumeResponse.json | 2 +- .../schema/json/v2/ThreadStartParams.json | 2 +- .../schema/json/v2/ThreadStartResponse.json | 2 +- .../schema/json/v2/TurnStartParams.json | 2 +- .../app-server-protocol/src/protocol/v2.rs | 23 +++++++++++++++++++ codex-rs/core/config.schema.json | 2 +- codex-rs/protocol/src/protocol.rs | 21 +++++++++++++++++ 16 files changed, 59 insertions(+), 15 deletions(-) diff --git a/codex-rs/app-server-protocol/schema/json/ClientRequest.json b/codex-rs/app-server-protocol/schema/json/ClientRequest.json index 03be878ce..93199094c 100644 --- a/codex-rs/app-server-protocol/schema/json/ClientRequest.json +++ b/codex-rs/app-server-protocol/schema/json/ClientRequest.json @@ -58,6 +58,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -69,7 +70,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/EventMsg.json b/codex-rs/app-server-protocol/schema/json/EventMsg.json index a826efc11..bda386119 100644 --- a/codex-rs/app-server-protocol/schema/json/EventMsg.json +++ b/codex-rs/app-server-protocol/schema/json/EventMsg.json @@ -4872,6 +4872,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "description": "Reject approval prompts related to built-in permission requests.", "type": "boolean" }, @@ -4886,7 +4887,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index 1faf8e9ac..beeb5a506 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -6805,6 +6805,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "description": "Reject approval prompts related to built-in permission requests.", "type": "boolean" }, @@ -6819,7 +6820,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], @@ -9330,6 +9330,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -9341,7 +9342,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json index 0c94f4b70..7c2d5961d 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json @@ -732,6 +732,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -743,7 +744,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json index 2a2f0be78..a9c4d0b29 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json @@ -149,6 +149,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -160,7 +161,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json index 0d7b24528..0eb33c2e1 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json @@ -21,6 +21,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -32,7 +33,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json index 92f3a1600..6d530e17f 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json @@ -21,6 +21,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -32,7 +33,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json index c671a7738..96772c6aa 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json @@ -25,6 +25,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -36,7 +37,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json index aec9a6d49..c4d9dbc0c 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json @@ -21,6 +21,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -32,7 +33,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json index 42a931c6e..013485bd1 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json @@ -25,6 +25,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -36,7 +37,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json index 659fb9f97..69cde5a36 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json @@ -21,6 +21,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -32,7 +33,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json index 966ed815d..97193de56 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json +++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json @@ -25,6 +25,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -36,7 +37,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json index 7a6184e3c..404a00209 100644 --- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json +++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json @@ -25,6 +25,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "type": "boolean" }, "rules": { @@ -36,7 +37,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/app-server-protocol/src/protocol/v2.rs b/codex-rs/app-server-protocol/src/protocol/v2.rs index d52cef6ae..f4a5d4dea 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2.rs @@ -201,6 +201,7 @@ pub enum AskForApproval { Reject { sandbox_approval: bool, rules: bool, + #[serde(default)] request_permissions: bool, mcp_elicitations: bool, }, @@ -5978,6 +5979,28 @@ mod tests { assert_eq!(back_to_v2, v2_policy); } + #[test] + fn ask_for_approval_reject_defaults_missing_request_permissions_to_false() { + let decoded = serde_json::from_value::(serde_json::json!({ + "reject": { + "sandbox_approval": true, + "rules": false, + "mcp_elicitations": true, + } + })) + .expect("legacy reject approval policy should deserialize"); + + assert_eq!( + decoded, + AskForApproval::Reject { + sandbox_approval: true, + rules: false, + request_permissions: false, + mcp_elicitations: true, + } + ); + } + #[test] fn mcp_server_elicitation_response_round_trips_rmcp_result() { let rmcp_result = rmcp::model::CreateElicitationResult { diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json index db31bf1ee..e3be35ad0 100644 --- a/codex-rs/core/config.schema.json +++ b/codex-rs/core/config.schema.json @@ -1323,6 +1323,7 @@ "type": "boolean" }, "request_permissions": { + "default": false, "description": "Reject approval prompts related to built-in permission requests.", "type": "boolean" }, @@ -1337,7 +1338,6 @@ }, "required": [ "mcp_elicitations", - "request_permissions", "rules", "sandbox_approval" ], diff --git a/codex-rs/protocol/src/protocol.rs b/codex-rs/protocol/src/protocol.rs index 67399f511..633e530d2 100644 --- a/codex-rs/protocol/src/protocol.rs +++ b/codex-rs/protocol/src/protocol.rs @@ -527,6 +527,7 @@ pub struct RejectConfig { /// Reject prompts triggered by execpolicy `prompt` rules. pub rules: bool, /// Reject approval prompts related to built-in permission requests. + #[serde(default)] pub request_permissions: bool, /// Reject MCP elicitation prompts. pub mcp_elicitations: bool, @@ -3487,6 +3488,26 @@ mod tests { ); } + #[test] + fn reject_config_defaults_missing_request_permissions_to_false() { + let decoded = serde_json::from_value::(serde_json::json!({ + "sandbox_approval": true, + "rules": false, + "mcp_elicitations": true, + })) + .expect("legacy reject config should deserialize"); + + assert_eq!( + decoded, + RejectConfig { + sandbox_approval: true, + rules: false, + request_permissions: false, + mcp_elicitations: true, + } + ); + } + #[test] fn workspace_write_restricted_read_access_includes_effective_writable_roots() { let cwd = if cfg!(windows) {