Add new enterprise requirement gate (#23736)

Add new enterprise requirement gate.

Validation:
- `cargo test -p codex-config --lib`
- `cargo test -p codex-app-server-protocol --lib`
- `cargo test -p codex-tui --lib debug_config`
- `cargo test -p codex-app-server --lib` *(fails: stack overflow in
`in_process::tests::in_process_start_initializes_and_handles_typed_v2_request`;
reproduces when run alone)*

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -7715,6 +7715,12 @@
       },
       "ConfigRequirements": {
         "properties": {
+          "allowAppshots": {
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
           "allowManagedHooksOnly": {
             "type": [
               "boolean",

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -4084,6 +4084,12 @@
     },
     "ConfigRequirements": {
       "properties": {
+        "allowAppshots": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
         "allowManagedHooksOnly": {
           "type": [
             "boolean",

codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

@@ -73,6 +73,12 @@
     },
     "ConfigRequirements": {
       "properties": {
+        "allowAppshots": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
         "allowManagedHooksOnly": {
           "type": [
             "boolean",

codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts

@@ -7,4 +7,4 @@ import type { ComputerUseRequirements } from "./ComputerUseRequirements";
 import type { ResidencyRequirement } from "./ResidencyRequirement";
 import type { SandboxMode } from "./SandboxMode";
 
-export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedPermissions: Array<string> | null, allowedWebSearchModes: Array<WebSearchMode> | null, allowManagedHooksOnly: boolean | null, computerUse: ComputerUseRequirements | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null};
+export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedPermissions: Array<string> | null, allowedWebSearchModes: Array<WebSearchMode> | null, allowManagedHooksOnly: boolean | null, allowAppshots: boolean | null, computerUse: ComputerUseRequirements | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null};

codex-rs/app-server-protocol/src/protocol/v2/config.rs

@@ -361,6 +361,7 @@ pub struct ConfigRequirements {
     pub allowed_permissions: Option<Vec<String>>,
     pub allowed_web_search_modes: Option<Vec<WebSearchMode>>,
     pub allow_managed_hooks_only: Option<bool>,
+    pub allow_appshots: Option<bool>,
     pub computer_use: Option<ComputerUseRequirements>,
     pub feature_requirements: Option<BTreeMap<String, bool>>,
     #[experimental("configRequirements/read.hooks")]

codex-rs/app-server-protocol/src/protocol/v2/tests.rs

@@ -1593,6 +1593,7 @@ fn config_requirements_granular_allowed_approval_policy_is_marked_experimental()
             allowed_permissions: None,
             allowed_web_search_modes: None,
             allow_managed_hooks_only: None,
+            allow_appshots: None,
             computer_use: None,
             feature_requirements: None,
             hooks: None,

codex-rs/app-server/src/request_processors/config_processor.rs

@@ -431,6 +431,7 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR
             normalized
         }),
         allow_managed_hooks_only: requirements.allow_managed_hooks_only,
+        allow_appshots: requirements.allow_appshots,
         computer_use: requirements
             .computer_use
             .map(map_computer_use_requirements_to_api),
@@ -658,6 +659,17 @@ mod tests {
         assert_eq!(mapped.hooks, None);
     }
 
+    #[test]
+    fn requirements_api_includes_allow_appshots() {
+        let mapped = map_requirements_toml_to_api(ConfigRequirementsToml {
+            allow_appshots: Some(false),
+            ..ConfigRequirementsToml::default()
+        });
+
+        assert_eq!(mapped.allow_appshots, Some(false));
+        assert_eq!(mapped.hooks, None);
+    }
+
     #[test]
     fn requirements_api_includes_computer_use_requirements() {
         let mapped = map_requirements_toml_to_api(ConfigRequirementsToml {

codex-rs/cloud-requirements/src/lib.rs

@@ -1220,6 +1220,7 @@ mod tests {
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1305,6 +1306,7 @@ mod tests {
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1341,6 +1343,7 @@ mod tests {
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1394,6 +1397,7 @@ mod tests {
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1576,6 +1580,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1659,6 +1664,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1740,6 +1746,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1949,6 +1956,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -1992,6 +2000,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2055,6 +2064,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2114,6 +2124,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2175,6 +2186,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2237,6 +2249,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2303,6 +2316,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2395,6 +2409,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,
@@ -2433,6 +2448,7 @@ command = "sample-mcp"
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 guardian_policy_config: None,
                 feature_requirements: None,

codex-rs/config/src/config_requirements.rs

@@ -89,6 +89,7 @@ pub struct ConfigRequirements {
     pub permission_profile: ConstrainedWithSource<PermissionProfile>,
     pub web_search_mode: ConstrainedWithSource<WebSearchMode>,
     pub allow_managed_hooks_only: Option<Sourced<bool>>,
+    pub allow_appshots: Option<Sourced<bool>>,
     pub computer_use: Option<Sourced<ComputerUseRequirementsToml>>,
     pub feature_requirements: Option<Sourced<FeatureRequirementsToml>>,
     pub managed_hooks: Option<ConstrainedWithSource<ManagedHooksRequirementsToml>>,
@@ -124,6 +125,7 @@ impl Default for ConfigRequirements {
                 /*source*/ None,
             ),
             allow_managed_hooks_only: None,
+            allow_appshots: None,
             computer_use: None,
             feature_requirements: None,
             managed_hooks: None,
@@ -750,6 +752,7 @@ pub struct ConfigRequirementsToml {
     pub remote_sandbox_config: Option<Vec<RemoteSandboxConfigToml>>,
     pub allowed_web_search_modes: Option<Vec<WebSearchModeRequirement>>,
     pub allow_managed_hooks_only: Option<bool>,
+    pub allow_appshots: Option<bool>,
     pub computer_use: Option<ComputerUseRequirementsToml>,
     #[serde(rename = "features", alias = "feature_requirements")]
     pub feature_requirements: Option<FeatureRequirementsToml>,
@@ -801,6 +804,7 @@ pub struct ConfigRequirementsWithSources {
     pub allowed_permissions: Option<Sourced<Vec<String>>>,
     pub allowed_web_search_modes: Option<Sourced<Vec<WebSearchModeRequirement>>>,
     pub allow_managed_hooks_only: Option<Sourced<bool>>,
+    pub allow_appshots: Option<Sourced<bool>>,
     pub computer_use: Option<Sourced<ComputerUseRequirementsToml>>,
     pub feature_requirements: Option<Sourced<FeatureRequirementsToml>>,
     pub hooks: Option<Sourced<ManagedHooksRequirementsToml>>,
@@ -840,6 +844,7 @@ impl ConfigRequirementsWithSources {
             remote_sandbox_config: _,
             allowed_web_search_modes: _,
             allow_managed_hooks_only: _,
+            allow_appshots: _,
             computer_use: _,
             feature_requirements: _,
             hooks: _,
@@ -872,6 +877,7 @@ impl ConfigRequirementsWithSources {
                 allowed_permissions,
                 allowed_web_search_modes,
                 allow_managed_hooks_only,
+                allow_appshots,
                 computer_use,
                 feature_requirements,
                 hooks,
@@ -902,6 +908,7 @@ impl ConfigRequirementsWithSources {
             allowed_permissions,
             allowed_web_search_modes,
             allow_managed_hooks_only,
+            allow_appshots,
             computer_use,
             feature_requirements,
             hooks,
@@ -922,6 +929,7 @@ impl ConfigRequirementsWithSources {
             remote_sandbox_config: None,
             allowed_web_search_modes: allowed_web_search_modes.map(|sourced| sourced.value),
             allow_managed_hooks_only: allow_managed_hooks_only.map(|sourced| sourced.value),
+            allow_appshots: allow_appshots.map(|sourced| sourced.value),
             computer_use: computer_use.map(|sourced| sourced.value),
             feature_requirements: feature_requirements.map(|sourced| sourced.value),
             hooks: hooks.map(|sourced| sourced.value),
@@ -1008,6 +1016,7 @@ impl ConfigRequirementsToml {
             && self.remote_sandbox_config.is_none()
             && self.allowed_web_search_modes.is_none()
             && self.allow_managed_hooks_only.is_none()
+            && self.allow_appshots.is_none()
             && self
                 .computer_use
                 .as_ref()
@@ -1054,6 +1063,7 @@ impl TryFrom<ConfigRequirementsWithSources> for ConfigRequirements {
             allowed_permissions: _,
             allowed_web_search_modes,
             allow_managed_hooks_only,
+            allow_appshots,
             computer_use,
             feature_requirements,
             hooks,
@@ -1291,6 +1301,7 @@ impl TryFrom<ConfigRequirementsWithSources> for ConfigRequirements {
             permission_profile,
             web_search_mode,
             allow_managed_hooks_only,
+            allow_appshots,
             computer_use,
             feature_requirements,
             managed_hooks,
@@ -1361,6 +1372,7 @@ mod tests {
             remote_sandbox_config: _,
             allowed_web_search_modes,
             allow_managed_hooks_only,
+            allow_appshots,
             computer_use,
             feature_requirements,
             hooks,
@@ -1386,6 +1398,8 @@ mod tests {
                 .map(|value| Sourced::new(value, RequirementSource::Unknown)),
             allow_managed_hooks_only: allow_managed_hooks_only
                 .map(|value| Sourced::new(value, RequirementSource::Unknown)),
+            allow_appshots: allow_appshots
+                .map(|value| Sourced::new(value, RequirementSource::Unknown)),
             computer_use: computer_use.map(|value| Sourced::new(value, RequirementSource::Unknown)),
             feature_requirements: feature_requirements
                 .map(|value| Sourced::new(value, RequirementSource::Unknown)),
@@ -1466,6 +1480,19 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn deserialize_allow_appshots() -> Result<()> {
+        let requirements: ConfigRequirementsToml = from_str(
+            r#"
+                allow_appshots = true
+            "#,
+        )?;
+
+        assert_eq!(requirements.allow_appshots, Some(true));
+        assert!(!requirements.is_empty());
+        Ok(())
+    }
+
     #[test]
     fn filesystem_requirements_table_cannot_define_a_permission_profile() {
         let err = from_str::<ConfigRequirementsToml>(
@@ -1484,6 +1511,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn allow_appshots_false_is_still_configured() -> Result<()> {
+        let requirements: ConfigRequirementsToml = from_str(
+            r#"
+                allow_appshots = false
+            "#,
+        )?;
+
+        assert_eq!(requirements.allow_appshots, Some(false));
+        assert!(!requirements.is_empty());
+        Ok(())
+    }
+
     #[test]
     fn deserialize_computer_use_requirements() -> Result<()> {
         let requirements: ConfigRequirementsToml = from_str(
@@ -1539,6 +1579,7 @@ mod tests {
             remote_sandbox_config: None,
             allowed_web_search_modes: Some(allowed_web_search_modes.clone()),
             allow_managed_hooks_only: Some(true),
+            allow_appshots: Some(false),
             computer_use: Some(computer_use.clone()),
             feature_requirements: Some(feature_requirements.clone()),
             hooks: None,
@@ -1578,6 +1619,7 @@ mod tests {
                     /*value*/ true,
                     enforce_source.clone(),
                 )),
+                allow_appshots: Some(Sourced::new(/*value*/ false, enforce_source.clone(),)),
                 computer_use: Some(Sourced::new(computer_use, enforce_source.clone())),
                 feature_requirements: Some(Sourced::new(
                     feature_requirements,
@@ -1623,6 +1665,7 @@ mod tests {
                 allowed_permissions: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 feature_requirements: None,
                 hooks: None,
@@ -1673,6 +1716,7 @@ mod tests {
                 allowed_permissions: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 feature_requirements: None,
                 hooks: None,

codex-rs/core/src/config/config_loader_tests.rs

@@ -1101,6 +1101,7 @@ allowed_approval_policies = ["on-request"]
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 feature_requirements: None,
                 hooks: None,
@@ -1161,6 +1162,7 @@ allowed_approval_policies = ["on-request"]
             remote_sandbox_config: None,
             allowed_web_search_modes: None,
             allow_managed_hooks_only: None,
+            allow_appshots: None,
             computer_use: None,
             feature_requirements: None,
             hooks: None,
@@ -1370,6 +1372,7 @@ async fn load_config_layers_includes_cloud_requirements() -> anyhow::Result<()>
         remote_sandbox_config: None,
         allowed_web_search_modes: None,
         allow_managed_hooks_only: None,
+        allow_appshots: None,
         computer_use: None,
         feature_requirements: None,
         hooks: None,

codex-rs/core/src/config/config_tests.rs

@@ -8098,6 +8098,7 @@ async fn test_requirements_web_search_mode_allowlist_does_not_warn_when_unset()
         remote_sandbox_config: None,
         allowed_web_search_modes: Some(vec![codex_config::WebSearchModeRequirement::Cached]),
         allow_managed_hooks_only: None,
+        allow_appshots: None,
         computer_use: None,
         feature_requirements: None,
         hooks: None,
@@ -8820,6 +8821,7 @@ async fn explicit_sandbox_mode_falls_back_when_disallowed_by_requirements() -> s
         remote_sandbox_config: None,
         allowed_web_search_modes: None,
         allow_managed_hooks_only: None,
+        allow_appshots: None,
         computer_use: None,
         feature_requirements: None,
         hooks: None,

codex-rs/core/src/config/mod.rs

@@ -2440,6 +2440,7 @@ impl Config {
             permission_profile: mut constrained_permission_profile,
             web_search_mode: mut constrained_web_search_mode,
             allow_managed_hooks_only: _,
+            allow_appshots: _,
             computer_use: _,
             feature_requirements,
             managed_hooks: _,

codex-rs/tui/src/debug_config.rs

@@ -156,6 +156,17 @@ fn render_debug_config_lines(stack: &ConfigLayerStack) -> Vec<Line<'static>> {
         ));
     }
 
+    if let Some(allow_appshots) = requirements_toml.allow_appshots {
+        requirement_lines.push(requirement_line(
+            "allow_appshots",
+            allow_appshots.to_string(),
+            requirements
+                .allow_appshots
+                .as_ref()
+                .map(|sourced| &sourced.source),
+        ));
+    }
+
     if requirements_toml.guardian_policy_config.is_some() {
         requirement_lines.push(requirement_line(
             "guardian_policy_config",
@@ -662,6 +673,10 @@ mod tests {
                 /*value*/ true,
                 RequirementSource::CloudRequirements,
             )),
+            allow_appshots: Some(Sourced::new(
+                /*value*/ false,
+                RequirementSource::CloudRequirements,
+            )),
             feature_requirements: Some(Sourced::new(
                 FeatureRequirementsToml {
                     entries: BTreeMap::from([("guardian_approval".to_string(), true)]),
@@ -701,6 +716,7 @@ mod tests {
             remote_sandbox_config: None,
             allowed_web_search_modes: Some(vec![WebSearchModeRequirement::Cached]),
             allow_managed_hooks_only: Some(true),
+            allow_appshots: Some(false),
             computer_use: None,
             guardian_policy_config: Some("Use the managed guardian policy.".to_string()),
             feature_requirements: Some(FeatureRequirementsToml {
@@ -763,6 +779,7 @@ mod tests {
             )
         );
         assert!(rendered.contains("allow_managed_hooks_only: true (source: cloud requirements)"));
+        assert!(rendered.contains("allow_appshots: false (source: cloud requirements)"));
         assert!(
             rendered.contains("guardian_policy_config: configured (source: cloud requirements)")
         );
@@ -917,6 +934,7 @@ approval_policy = "never"
             remote_sandbox_config: None,
             allowed_web_search_modes: Some(Vec::new()),
             allow_managed_hooks_only: None,
+            allow_appshots: None,
             computer_use: None,
             guardian_policy_config: None,
             feature_requirements: None,