agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

core/protocol: add structured macOS additional permissions and merge them into sandbox execution (#13499)

Browse Source 
## Summary
- Introduce strongly-typed macOS additional permissions across
protocol/core/app-server boundaries.
- Merge additional permissions into effective sandbox execution,
including macOS seatbelt profile extensions.
- Expand docs, schema/tool definitions, UI rendering, and tests for
`network`, `file_system`, and `macos` additional permissions.
This commit is contained in:
Celia Chen
2026-03-05 16:21:45 -08:00
committed by GitHub
Unverified
parent 4e77ea0ec7
commit aaefee04cd
24 changed files with 1013 additions and 379 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json
+37 -39
View File
@@ -31,38 +31,24 @@
"AdditionalMacOsPermissions": {
"properties": {
"accessibility": {
"type": [
"boolean",
"null"
]
"type": "boolean"
},
"automations": {
"anyOf": [
{
"$ref": "#/definitions/MacOsAutomationValue"
},
{
"type": "null"
}
]
"$ref": "#/definitions/MacOsAutomationPermission"
},
"calendar": {
"type": [
"boolean",
"null"
]
"type": "boolean"
},
"preferences": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPreferencesValue"
},
{
"type": "null"
}
]
"$ref": "#/definitions/MacOsPreferencesPermission"
}
},
"required": [
"accessibility",
"automations",
"calendar",
"preferences"
],
"type": "object"
},
"AdditionalNetworkPermissions": {
@@ -300,28 +286,40 @@
}
]
},
"MacOsAutomationValue": {
"anyOf": [
"MacOsAutomationPermission": {
"oneOf": [
{
"type": "boolean"
"enum": [
"none",
"all"
],
"type": "string"
},
{
"items": {
"type": "string"
"additionalProperties": false,
"properties": {
"bundle_ids": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "array"
"required": [
"bundle_ids"
],
"title": "BundleIdsMacOsAutomationPermission",
"type": "object"
}
]
},
"MacOsPreferencesValue": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "string"
}
]
"MacOsPreferencesPermission": {
"enum": [
"none",
"read_only",
"read_write"
],
"type": "string"
},
"NetworkApprovalContext": {
"properties": {
codex-rs/app-server-protocol/schema/json/EventMsg.json
+44 -46
View File
@@ -3756,66 +3756,64 @@
],
"type": "string"
},
"MacOsAutomationValue": {
"anyOf": [
"MacOsAutomationPermission": {
"oneOf": [
{
"type": "boolean"
"enum": [
"none",
"all"
],
"type": "string"
},
{
"items": {
"type": "string"
"additionalProperties": false,
"properties": {
"bundle_ids": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "array"
"required": [
"bundle_ids"
],
"title": "BundleIdsMacOsAutomationPermission",
"type": "object"
}
]
},
"MacOsPermissions": {
"MacOsPreferencesPermission": {
"enum": [
"none",
"read_only",
"read_write"
],
"type": "string"
},
"MacOsSeatbeltProfileExtensions": {
"properties": {
"accessibility": {
"type": [
"boolean",
"null"
]
"macos_accessibility": {
"type": "boolean"
},
"automations": {
"anyOf": [
{
"$ref": "#/definitions/MacOsAutomationValue"
},
{
"type": "null"
}
]
"macos_automation": {
"$ref": "#/definitions/MacOsAutomationPermission"
},
"calendar": {
"type": [
"boolean",
"null"
]
"macos_calendar": {
"type": "boolean"
},
"preferences": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPreferencesValue"
},
{
"type": "null"
}
]
"macos_preferences": {
"$ref": "#/definitions/MacOsPreferencesPermission"
}
},
"required": [
"macos_accessibility",
"macos_automation",
"macos_calendar",
"macos_preferences"
],
"type": "object"
},
"MacOsPreferencesValue": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "string"
}
]
},
"McpAuthStatus": {
"enum": [
"unsupported",
@@ -4159,7 +4157,7 @@
"macos": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPermissions"
"$ref": "#/definitions/MacOsSeatbeltProfileExtensions"
},
{
"type": "null"
codex-rs/app-server-protocol/schema/json/ServerRequest.json
+37 -39
View File
@@ -31,38 +31,24 @@
"AdditionalMacOsPermissions": {
"properties": {
"accessibility": {
"type": [
"boolean",
"null"
]
"type": "boolean"
},
"automations": {
"anyOf": [
{
"$ref": "#/definitions/MacOsAutomationValue"
},
{
"type": "null"
}
]
"$ref": "#/definitions/MacOsAutomationPermission"
},
"calendar": {
"type": [
"boolean",
"null"
]
"type": "boolean"
},
"preferences": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPreferencesValue"
},
{
"type": "null"
}
]
"$ref": "#/definitions/MacOsPreferencesPermission"
}
},
"required": [
"accessibility",
"automations",
"calendar",
"preferences"
],
"type": "object"
},
"AdditionalNetworkPermissions": {
@@ -629,28 +615,40 @@
],
"type": "object"
},
"MacOsAutomationValue": {
"anyOf": [
"MacOsAutomationPermission": {
"oneOf": [
{
"type": "boolean"
"enum": [
"none",
"all"
],
"type": "string"
},
{
"items": {
"type": "string"
"additionalProperties": false,
"properties": {
"bundle_ids": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "array"
"required": [
"bundle_ids"
],
"title": "BundleIdsMacOsAutomationPermission",
"type": "object"
}
]
},
"MacOsPreferencesValue": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "string"
}
]
"MacOsPreferencesPermission": {
"enum": [
"none",
"read_only",
"read_write"
],
"type": "string"
},
"McpServerElicitationRequestParams": {
"oneOf": [
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+54 -70
View File
@@ -27,38 +27,24 @@
"AdditionalMacOsPermissions": {
"properties": {
"accessibility": {
"type": [
"boolean",
"null"
]
"type": "boolean"
},
"automations": {
"anyOf": [
{
"$ref": "#/definitions/MacOsAutomationValue"
},
{
"type": "null"
}
]
"$ref": "#/definitions/MacOsAutomationPermission"
},
"calendar": {
"type": [
"boolean",
"null"
]
"type": "boolean"
},
"preferences": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPreferencesValue"
},
{
"type": "null"
}
]
"$ref": "#/definitions/MacOsPreferencesPermission"
}
},
"required": [
"accessibility",
"automations",
"calendar",
"preferences"
],
"type": "object"
},
"AdditionalNetworkPermissions": {
@@ -5229,66 +5215,64 @@
"title": "JSONRPCResponse",
"type": "object"
},
"MacOsAutomationValue": {
"anyOf": [
"MacOsAutomationPermission": {
"oneOf": [
{
"type": "boolean"
"enum": [
"none",
"all"
],
"type": "string"
},
{
"items": {
"type": "string"
"additionalProperties": false,
"properties": {
"bundle_ids": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "array"
"required": [
"bundle_ids"
],
"title": "BundleIdsMacOsAutomationPermission",
"type": "object"
}
]
},
"MacOsPermissions": {
"MacOsPreferencesPermission": {
"enum": [
"none",
"read_only",
"read_write"
],
"type": "string"
},
"MacOsSeatbeltProfileExtensions": {
"properties": {
"accessibility": {
"type": [
"boolean",
"null"
]
"macos_accessibility": {
"type": "boolean"
},
"automations": {
"anyOf": [
{
"$ref": "#/definitions/MacOsAutomationValue"
},
{
"type": "null"
}
]
"macos_automation": {
"$ref": "#/definitions/MacOsAutomationPermission"
},
"calendar": {
"type": [
"boolean",
"null"
]
"macos_calendar": {
"type": "boolean"
},
"preferences": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPreferencesValue"
},
{
"type": "null"
}
]
"macos_preferences": {
"$ref": "#/definitions/MacOsPreferencesPermission"
}
},
"required": [
"macos_accessibility",
"macos_automation",
"macos_calendar",
"macos_preferences"
],
"type": "object"
},
"MacOsPreferencesValue": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "string"
}
]
},
"McpInvocation": {
"properties": {
"arguments": {
@@ -5670,7 +5654,7 @@
"macos": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPermissions"
"$ref": "#/definitions/MacOsSeatbeltProfileExtensions"
},
{
"type": "null"
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
+44 -46
View File
@@ -7350,66 +7350,64 @@
"title": "LogoutAccountResponse",
"type": "object"
},
"MacOsAutomationValue": {
"anyOf": [
"MacOsAutomationPermission": {
"oneOf": [
{
"type": "boolean"
"enum": [
"none",
"all"
],
"type": "string"
},
{
"items": {
"type": "string"
"additionalProperties": false,
"properties": {
"bundle_ids": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "array"
"required": [
"bundle_ids"
],
"title": "BundleIdsMacOsAutomationPermission",
"type": "object"
}
]
},
"MacOsPermissions": {
"MacOsPreferencesPermission": {
"enum": [
"none",
"read_only",
"read_write"
],
"type": "string"
},
"MacOsSeatbeltProfileExtensions": {
"properties": {
"accessibility": {
"type": [
"boolean",
"null"
]
"macos_accessibility": {
"type": "boolean"
},
"automations": {
"anyOf": [
{
"$ref": "#/definitions/MacOsAutomationValue"
},
{
"type": "null"
}
]
"macos_automation": {
"$ref": "#/definitions/MacOsAutomationPermission"
},
"calendar": {
"type": [
"boolean",
"null"
]
"macos_calendar": {
"type": "boolean"
},
"preferences": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPreferencesValue"
},
{
"type": "null"
}
]
"macos_preferences": {
"$ref": "#/definitions/MacOsPreferencesPermission"
}
},
"required": [
"macos_accessibility",
"macos_automation",
"macos_calendar",
"macos_preferences"
],
"type": "object"
},
"MacOsPreferencesValue": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "string"
}
]
},
"McpAuthStatus": {
"enum": [
"unsupported",
@@ -8286,7 +8284,7 @@
"macos": {
"anyOf": [
{
"$ref": "#/definitions/MacOsPermissions"
"$ref": "#/definitions/MacOsSeatbeltProfileExtensions"
},
{
"type": "null"
codex-rs/app-server-protocol/schema/typescript/MacOsPreferencesValue.ts → codex-rs/app-server-protocol/schema/typescript/MacOsAutomationPermission.ts
+1 -1
View File
@@ -2,4 +2,4 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type MacOsPreferencesValue = boolean | string;
export type MacOsAutomationPermission = "none" | "all" | { "bundle_ids": Array<string> };
codex-rs/app-server-protocol/schema/typescript/MacOsPermissions.ts
-7
View File
@@ -1,7 +0,0 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { MacOsAutomationValue } from "./MacOsAutomationValue";
import type { MacOsPreferencesValue } from "./MacOsPreferencesValue";
export type MacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, };
codex-rs/app-server-protocol/schema/typescript/MacOsAutomationValue.ts → codex-rs/app-server-protocol/schema/typescript/MacOsPreferencesPermission.ts
+1 -1
View File
@@ -2,4 +2,4 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
export type MacOsAutomationValue = boolean | Array<string>;
export type MacOsPreferencesPermission = "none" | "read_only" | "read_write";
codex-rs/app-server-protocol/schema/typescript/MacOsSeatbeltProfileExtensions.ts
+7
View File
@@ -0,0 +1,7 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { MacOsAutomationPermission } from "./MacOsAutomationPermission";
import type { MacOsPreferencesPermission } from "./MacOsPreferencesPermission";
export type MacOsSeatbeltProfileExtensions = { macos_preferences: MacOsPreferencesPermission, macos_automation: MacOsAutomationPermission, macos_accessibility: boolean, macos_calendar: boolean, };
codex-rs/app-server-protocol/schema/typescript/PermissionProfile.ts
+2 -2
View File
@@ -2,7 +2,7 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { FileSystemPermissions } from "./FileSystemPermissions";
import type { MacOsPermissions } from "./MacOsPermissions";
import type { MacOsSeatbeltProfileExtensions } from "./MacOsSeatbeltProfileExtensions";
import type { NetworkPermissions } from "./NetworkPermissions";
export type PermissionProfile = { network: NetworkPermissions | null, file_system: FileSystemPermissions | null, macos: MacOsPermissions | null, };
export type PermissionProfile = { network: NetworkPermissions | null, file_system: FileSystemPermissions | null, macos: MacOsSeatbeltProfileExtensions | null, };
codex-rs/app-server-protocol/schema/typescript/index.ts
+3 -3
View File
@@ -100,9 +100,9 @@ export type { ListSkillsResponseEvent } from "./ListSkillsResponseEvent";
export type { LocalShellAction } from "./LocalShellAction";
export type { LocalShellExecAction } from "./LocalShellExecAction";
export type { LocalShellStatus } from "./LocalShellStatus";
export type { MacOsAutomationValue } from "./MacOsAutomationValue";
export type { MacOsPermissions } from "./MacOsPermissions";
export type { MacOsPreferencesValue } from "./MacOsPreferencesValue";
export type { MacOsAutomationPermission } from "./MacOsAutomationPermission";
export type { MacOsPreferencesPermission } from "./MacOsPreferencesPermission";
export type { MacOsSeatbeltProfileExtensions } from "./MacOsSeatbeltProfileExtensions";
export type { McpAuthStatus } from "./McpAuthStatus";
export type { McpInvocation } from "./McpInvocation";
export type { McpListToolsResponseEvent } from "./McpListToolsResponseEvent";
codex-rs/app-server-protocol/schema/typescript/v2/AdditionalMacOsPermissions.ts
+3 -3
View File
@@ -1,7 +1,7 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { MacOsAutomationValue } from "../MacOsAutomationValue";
import type { MacOsPreferencesValue } from "../MacOsPreferencesValue";
import type { MacOsAutomationPermission } from "../MacOsAutomationPermission";
import type { MacOsPreferencesPermission } from "../MacOsPreferencesPermission";
export type AdditionalMacOsPermissions = { preferences: MacOsPreferencesValue | null, automations: MacOsAutomationValue | null, accessibility: boolean | null, calendar: boolean | null, };
export type AdditionalMacOsPermissions = { preferences: MacOsPreferencesPermission, automations: MacOsAutomationPermission, accessibility: boolean, calendar: boolean, };
codex-rs/app-server-protocol/src/protocol/v2.rs
+13 -13
View File
@@ -28,9 +28,9 @@ use codex_protocol::mcp::Resource as McpResource;
use codex_protocol::mcp::ResourceTemplate as McpResourceTemplate;
use codex_protocol::mcp::Tool as McpTool;
use codex_protocol::models::FileSystemPermissions as CoreFileSystemPermissions;
use codex_protocol::models::MacOsAutomationValue as CoreMacOsAutomationValue;
use codex_protocol::models::MacOsPermissions as CoreMacOsPermissions;
use codex_protocol::models::MacOsPreferencesValue as CoreMacOsPreferencesValue;
use codex_protocol::models::MacOsAutomationPermission as CoreMacOsAutomationPermission;
use codex_protocol::models::MacOsPreferencesPermission as CoreMacOsPreferencesPermission;
use codex_protocol::models::MacOsSeatbeltProfileExtensions as CoreMacOsSeatbeltProfileExtensions;
use codex_protocol::models::MessagePhase;
use codex_protocol::models::NetworkPermissions as CoreNetworkPermissions;
use codex_protocol::models::PermissionProfile as CorePermissionProfile;
@@ -837,19 +837,19 @@ impl From<CoreFileSystemPermissions> for AdditionalFileSystemPermissions {
#[serde(rename_all = "camelCase")]
#[ts(export_to = "v2/")]
pub struct AdditionalMacOsPermissions {
pub preferences: Option<CoreMacOsPreferencesValue>,
pub automations: Option<CoreMacOsAutomationValue>,
pub accessibility: Option<bool>,
pub calendar: Option<bool>,
pub preferences: CoreMacOsPreferencesPermission,
pub automations: CoreMacOsAutomationPermission,
pub accessibility: bool,
pub calendar: bool,
}
impl From<CoreMacOsPermissions> for AdditionalMacOsPermissions {
fn from(value: CoreMacOsPermissions) -> Self {
impl From<CoreMacOsSeatbeltProfileExtensions> for AdditionalMacOsPermissions {
fn from(value: CoreMacOsSeatbeltProfileExtensions) -> Self {
Self {
preferences: value.preferences,
automations: value.automations,
accessibility: value.accessibility,
calendar: value.calendar,
preferences: value.macos_preferences,
automations: value.macos_automation,
accessibility: value.macos_accessibility,
calendar: value.macos_calendar,
}
}
}