agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add allow_managed_hooks_only hook requirement (#20319)

Browse Source 
## Why

Enterprise-managed hook policy needs a narrow way to require Codex to
ignore user-controlled lifecycle hooks without adopting the broader
trust-precedence model from earlier hook work. This keeps the policy
anchored in `requirements.toml`, so admins can opt into managed hooks
only while normal `config.toml` files cannot enable the restriction
themselves.

## What changed

- Added `allow_managed_hooks_only` to the requirements data flow and
preserved explicit `false` values.
- Also adds it to /debug-config
- Marked MDM, system, and legacy managed config layers as managed for
hook discovery.
- Updated hook discovery so `allow_managed_hooks_only = true`:
  - keeps managed requirements hooks and managed config-layer hooks,
- skips user/project/session `hooks.json` and `[hooks]` entries with
concise startup warnings,
  - skips current unmanaged plugin hooks,
- ignores any `allow_managed_hooks_only` key placed in ordinary
`config.toml` layers.
This commit is contained in:
Andrei Eternal
2026-05-12 19:05:25 -07:00
committed by GitHub
parent fbfbfe5fc5
commit 913aad4d3c
17 changed files with 650 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/cloud-requirements/src/lib.rs
+16
View File
@@ -1204,6 +1204,7 @@ mod tests {
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1286,6 +1287,7 @@ mod tests {
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1319,6 +1321,7 @@ mod tests {
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1369,6 +1372,7 @@ mod tests {
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1519,6 +1523,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1599,6 +1604,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1677,6 +1683,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1883,6 +1890,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1923,6 +1931,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -1983,6 +1992,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -2039,6 +2049,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -2097,6 +2108,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -2156,6 +2168,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -2215,6 +2228,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -2304,6 +2318,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,
@@ -2335,6 +2350,7 @@ command = "sample-mcp"
allowed_sandbox_modes: None,
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
guardian_policy_config: None,
feature_requirements: None,
hooks: None,