diff --git a/codex-rs/app-server-protocol/schema/json/ServerNotification.json b/codex-rs/app-server-protocol/schema/json/ServerNotification.json index 167c63791..aa320f8b4 100644 --- a/codex-rs/app-server-protocol/schema/json/ServerNotification.json +++ b/codex-rs/app-server-protocol/schema/json/ServerNotification.json @@ -1704,6 +1704,23 @@ ], "type": "string" }, + "GuardianWarningNotification": { + "properties": { + "message": { + "description": "Concise guardian warning message for the user.", + "type": "string" + }, + "threadId": { + "description": "Thread target for the guardian warning.", + "type": "string" + } + }, + "required": [ + "message", + "threadId" + ], + "type": "object" + }, "HookCompletedNotification": { "properties": { "run": { @@ -5342,6 +5359,26 @@ "title": "WarningNotification", "type": "object" }, + { + "properties": { + "method": { + "enum": [ + "guardianWarning" + ], + "title": "GuardianWarningNotificationMethod", + "type": "string" + }, + "params": { + "$ref": "#/definitions/GuardianWarningNotification" + } + }, + "required": [ + "method", + "params" + ], + "title": "GuardianWarningNotification", + "type": "object" + }, { "properties": { "method": { diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json index cf54aca28..677a7fa94 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json @@ -4437,6 +4437,26 @@ "title": "WarningNotification", "type": "object" }, + { + "properties": { + "method": { + "enum": [ + "guardianWarning" + ], + "title": "GuardianWarningNotificationMethod", + "type": "string" + }, + "params": { + "$ref": "#/definitions/v2/GuardianWarningNotification" + } + }, + "required": [ + "method", + "params" + ], + "title": "GuardianWarningNotification", + "type": "object" + }, { "properties": { "method": { @@ -9288,6 +9308,25 @@ ], "type": "string" }, + "GuardianWarningNotification": { + "$schema": "http://json-schema.org/draft-07/schema#", + "properties": { + "message": { + "description": "Concise guardian warning message for the user.", + "type": "string" + }, + "threadId": { + "description": "Thread target for the guardian warning.", + "type": "string" + } + }, + "required": [ + "message", + "threadId" + ], + "title": "GuardianWarningNotification", + "type": "object" + }, "HookCompletedNotification": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json index 506d92e60..421abb76c 100644 --- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json +++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json @@ -6006,6 +6006,25 @@ ], "type": "string" }, + "GuardianWarningNotification": { + "$schema": "http://json-schema.org/draft-07/schema#", + "properties": { + "message": { + "description": "Concise guardian warning message for the user.", + "type": "string" + }, + "threadId": { + "description": "Thread target for the guardian warning.", + "type": "string" + } + }, + "required": [ + "message", + "threadId" + ], + "title": "GuardianWarningNotification", + "type": "object" + }, "HookCompletedNotification": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { @@ -10786,6 +10805,26 @@ "title": "WarningNotification", "type": "object" }, + { + "properties": { + "method": { + "enum": [ + "guardianWarning" + ], + "title": "GuardianWarningNotificationMethod", + "type": "string" + }, + "params": { + "$ref": "#/definitions/GuardianWarningNotification" + } + }, + "required": [ + "method", + "params" + ], + "title": "GuardianWarningNotification", + "type": "object" + }, { "properties": { "method": { diff --git a/codex-rs/app-server-protocol/schema/json/v2/GuardianWarningNotification.json b/codex-rs/app-server-protocol/schema/json/v2/GuardianWarningNotification.json new file mode 100644 index 000000000..5a4ef82f0 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/json/v2/GuardianWarningNotification.json @@ -0,0 +1,19 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "properties": { + "message": { + "description": "Concise guardian warning message for the user.", + "type": "string" + }, + "threadId": { + "description": "Thread target for the guardian warning.", + "type": "string" + } + }, + "required": [ + "message", + "threadId" + ], + "title": "GuardianWarningNotification", + "type": "object" +} \ No newline at end of file diff --git a/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts b/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts index f55700bf5..614dd611d 100644 --- a/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts +++ b/codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts @@ -18,6 +18,7 @@ import type { ExternalAgentConfigImportCompletedNotification } from "./v2/Extern import type { FileChangeOutputDeltaNotification } from "./v2/FileChangeOutputDeltaNotification"; import type { FileChangePatchUpdatedNotification } from "./v2/FileChangePatchUpdatedNotification"; import type { FsChangedNotification } from "./v2/FsChangedNotification"; +import type { GuardianWarningNotification } from "./v2/GuardianWarningNotification"; import type { HookCompletedNotification } from "./v2/HookCompletedNotification"; import type { HookStartedNotification } from "./v2/HookStartedNotification"; import type { ItemCompletedNotification } from "./v2/ItemCompletedNotification"; @@ -62,4 +63,4 @@ import type { WindowsWorldWritableWarningNotification } from "./v2/WindowsWorldW /** * Notification sent from the server to the client. */ -export type ServerNotification = { "method": "error", "params": ErrorNotification } | { "method": "thread/started", "params": ThreadStartedNotification } | { "method": "thread/status/changed", "params": ThreadStatusChangedNotification } | { "method": "thread/archived", "params": ThreadArchivedNotification } | { "method": "thread/unarchived", "params": ThreadUnarchivedNotification } | { "method": "thread/closed", "params": ThreadClosedNotification } | { "method": "skills/changed", "params": SkillsChangedNotification } | { "method": "thread/name/updated", "params": ThreadNameUpdatedNotification } | { "method": "thread/tokenUsage/updated", "params": ThreadTokenUsageUpdatedNotification } | { "method": "turn/started", "params": TurnStartedNotification } | { "method": "hook/started", "params": HookStartedNotification } | { "method": "turn/completed", "params": TurnCompletedNotification } | { "method": "hook/completed", "params": HookCompletedNotification } | { "method": "turn/diff/updated", "params": TurnDiffUpdatedNotification } | { "method": "turn/plan/updated", "params": TurnPlanUpdatedNotification } | { "method": "item/started", "params": ItemStartedNotification } | { "method": "item/autoApprovalReview/started", "params": ItemGuardianApprovalReviewStartedNotification } | { "method": "item/autoApprovalReview/completed", "params": ItemGuardianApprovalReviewCompletedNotification } | { "method": "item/completed", "params": ItemCompletedNotification } | { "method": "rawResponseItem/completed", "params": RawResponseItemCompletedNotification } | { "method": "item/agentMessage/delta", "params": AgentMessageDeltaNotification } | { "method": "item/plan/delta", "params": PlanDeltaNotification } | { "method": "command/exec/outputDelta", "params": CommandExecOutputDeltaNotification } | { "method": "item/commandExecution/outputDelta", "params": CommandExecutionOutputDeltaNotification } | { "method": "item/commandExecution/terminalInteraction", "params": TerminalInteractionNotification } | { "method": "item/fileChange/outputDelta", "params": FileChangeOutputDeltaNotification } | { "method": "item/fileChange/patchUpdated", "params": FileChangePatchUpdatedNotification } | { "method": "serverRequest/resolved", "params": ServerRequestResolvedNotification } | { "method": "item/mcpToolCall/progress", "params": McpToolCallProgressNotification } | { "method": "mcpServer/oauthLogin/completed", "params": McpServerOauthLoginCompletedNotification } | { "method": "mcpServer/startupStatus/updated", "params": McpServerStatusUpdatedNotification } | { "method": "account/updated", "params": AccountUpdatedNotification } | { "method": "account/rateLimits/updated", "params": AccountRateLimitsUpdatedNotification } | { "method": "app/list/updated", "params": AppListUpdatedNotification } | { "method": "externalAgentConfig/import/completed", "params": ExternalAgentConfigImportCompletedNotification } | { "method": "fs/changed", "params": FsChangedNotification } | { "method": "item/reasoning/summaryTextDelta", "params": ReasoningSummaryTextDeltaNotification } | { "method": "item/reasoning/summaryPartAdded", "params": ReasoningSummaryPartAddedNotification } | { "method": "item/reasoning/textDelta", "params": ReasoningTextDeltaNotification } | { "method": "thread/compacted", "params": ContextCompactedNotification } | { "method": "model/rerouted", "params": ModelReroutedNotification } | { "method": "warning", "params": WarningNotification } | { "method": "deprecationNotice", "params": DeprecationNoticeNotification } | { "method": "configWarning", "params": ConfigWarningNotification } | { "method": "fuzzyFileSearch/sessionUpdated", "params": FuzzyFileSearchSessionUpdatedNotification } | { "method": "fuzzyFileSearch/sessionCompleted", "params": FuzzyFileSearchSessionCompletedNotification } | { "method": "thread/realtime/started", "params": ThreadRealtimeStartedNotification } | { "method": "thread/realtime/itemAdded", "params": ThreadRealtimeItemAddedNotification } | { "method": "thread/realtime/transcript/delta", "params": ThreadRealtimeTranscriptDeltaNotification } | { "method": "thread/realtime/transcript/done", "params": ThreadRealtimeTranscriptDoneNotification } | { "method": "thread/realtime/outputAudio/delta", "params": ThreadRealtimeOutputAudioDeltaNotification } | { "method": "thread/realtime/sdp", "params": ThreadRealtimeSdpNotification } | { "method": "thread/realtime/error", "params": ThreadRealtimeErrorNotification } | { "method": "thread/realtime/closed", "params": ThreadRealtimeClosedNotification } | { "method": "windows/worldWritableWarning", "params": WindowsWorldWritableWarningNotification } | { "method": "windowsSandbox/setupCompleted", "params": WindowsSandboxSetupCompletedNotification } | { "method": "account/login/completed", "params": AccountLoginCompletedNotification }; +export type ServerNotification = { "method": "error", "params": ErrorNotification } | { "method": "thread/started", "params": ThreadStartedNotification } | { "method": "thread/status/changed", "params": ThreadStatusChangedNotification } | { "method": "thread/archived", "params": ThreadArchivedNotification } | { "method": "thread/unarchived", "params": ThreadUnarchivedNotification } | { "method": "thread/closed", "params": ThreadClosedNotification } | { "method": "skills/changed", "params": SkillsChangedNotification } | { "method": "thread/name/updated", "params": ThreadNameUpdatedNotification } | { "method": "thread/tokenUsage/updated", "params": ThreadTokenUsageUpdatedNotification } | { "method": "turn/started", "params": TurnStartedNotification } | { "method": "hook/started", "params": HookStartedNotification } | { "method": "turn/completed", "params": TurnCompletedNotification } | { "method": "hook/completed", "params": HookCompletedNotification } | { "method": "turn/diff/updated", "params": TurnDiffUpdatedNotification } | { "method": "turn/plan/updated", "params": TurnPlanUpdatedNotification } | { "method": "item/started", "params": ItemStartedNotification } | { "method": "item/autoApprovalReview/started", "params": ItemGuardianApprovalReviewStartedNotification } | { "method": "item/autoApprovalReview/completed", "params": ItemGuardianApprovalReviewCompletedNotification } | { "method": "item/completed", "params": ItemCompletedNotification } | { "method": "rawResponseItem/completed", "params": RawResponseItemCompletedNotification } | { "method": "item/agentMessage/delta", "params": AgentMessageDeltaNotification } | { "method": "item/plan/delta", "params": PlanDeltaNotification } | { "method": "command/exec/outputDelta", "params": CommandExecOutputDeltaNotification } | { "method": "item/commandExecution/outputDelta", "params": CommandExecutionOutputDeltaNotification } | { "method": "item/commandExecution/terminalInteraction", "params": TerminalInteractionNotification } | { "method": "item/fileChange/outputDelta", "params": FileChangeOutputDeltaNotification } | { "method": "item/fileChange/patchUpdated", "params": FileChangePatchUpdatedNotification } | { "method": "serverRequest/resolved", "params": ServerRequestResolvedNotification } | { "method": "item/mcpToolCall/progress", "params": McpToolCallProgressNotification } | { "method": "mcpServer/oauthLogin/completed", "params": McpServerOauthLoginCompletedNotification } | { "method": "mcpServer/startupStatus/updated", "params": McpServerStatusUpdatedNotification } | { "method": "account/updated", "params": AccountUpdatedNotification } | { "method": "account/rateLimits/updated", "params": AccountRateLimitsUpdatedNotification } | { "method": "app/list/updated", "params": AppListUpdatedNotification } | { "method": "externalAgentConfig/import/completed", "params": ExternalAgentConfigImportCompletedNotification } | { "method": "fs/changed", "params": FsChangedNotification } | { "method": "item/reasoning/summaryTextDelta", "params": ReasoningSummaryTextDeltaNotification } | { "method": "item/reasoning/summaryPartAdded", "params": ReasoningSummaryPartAddedNotification } | { "method": "item/reasoning/textDelta", "params": ReasoningTextDeltaNotification } | { "method": "thread/compacted", "params": ContextCompactedNotification } | { "method": "model/rerouted", "params": ModelReroutedNotification } | { "method": "warning", "params": WarningNotification } | { "method": "guardianWarning", "params": GuardianWarningNotification } | { "method": "deprecationNotice", "params": DeprecationNoticeNotification } | { "method": "configWarning", "params": ConfigWarningNotification } | { "method": "fuzzyFileSearch/sessionUpdated", "params": FuzzyFileSearchSessionUpdatedNotification } | { "method": "fuzzyFileSearch/sessionCompleted", "params": FuzzyFileSearchSessionCompletedNotification } | { "method": "thread/realtime/started", "params": ThreadRealtimeStartedNotification } | { "method": "thread/realtime/itemAdded", "params": ThreadRealtimeItemAddedNotification } | { "method": "thread/realtime/transcript/delta", "params": ThreadRealtimeTranscriptDeltaNotification } | { "method": "thread/realtime/transcript/done", "params": ThreadRealtimeTranscriptDoneNotification } | { "method": "thread/realtime/outputAudio/delta", "params": ThreadRealtimeOutputAudioDeltaNotification } | { "method": "thread/realtime/sdp", "params": ThreadRealtimeSdpNotification } | { "method": "thread/realtime/error", "params": ThreadRealtimeErrorNotification } | { "method": "thread/realtime/closed", "params": ThreadRealtimeClosedNotification } | { "method": "windows/worldWritableWarning", "params": WindowsWorldWritableWarningNotification } | { "method": "windowsSandbox/setupCompleted", "params": WindowsSandboxSetupCompletedNotification } | { "method": "account/login/completed", "params": AccountLoginCompletedNotification }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/GuardianWarningNotification.ts b/codex-rs/app-server-protocol/schema/typescript/v2/GuardianWarningNotification.ts new file mode 100644 index 000000000..1659f62f1 --- /dev/null +++ b/codex-rs/app-server-protocol/schema/typescript/v2/GuardianWarningNotification.ts @@ -0,0 +1,13 @@ +// GENERATED CODE! DO NOT MODIFY BY HAND! + +// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually. + +export type GuardianWarningNotification = { +/** + * Thread target for the guardian warning. + */ +threadId: string, +/** + * Concise guardian warning message for the user. + */ +message: string, }; diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts index 837b265fc..aa0ed36d2 100644 --- a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts +++ b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts @@ -147,6 +147,7 @@ export type { GuardianApprovalReviewStatus } from "./GuardianApprovalReviewStatu export type { GuardianCommandSource } from "./GuardianCommandSource"; export type { GuardianRiskLevel } from "./GuardianRiskLevel"; export type { GuardianUserAuthorization } from "./GuardianUserAuthorization"; +export type { GuardianWarningNotification } from "./GuardianWarningNotification"; export type { HookCompletedNotification } from "./HookCompletedNotification"; export type { HookEventName } from "./HookEventName"; export type { HookExecutionMode } from "./HookExecutionMode"; diff --git a/codex-rs/app-server-protocol/src/protocol/common.rs b/codex-rs/app-server-protocol/src/protocol/common.rs index 503cb6bc1..a751f11ec 100644 --- a/codex-rs/app-server-protocol/src/protocol/common.rs +++ b/codex-rs/app-server-protocol/src/protocol/common.rs @@ -1061,6 +1061,7 @@ server_notification_definitions! { ContextCompacted => "thread/compacted" (v2::ContextCompactedNotification), ModelRerouted => "model/rerouted" (v2::ModelReroutedNotification), Warning => "warning" (v2::WarningNotification), + GuardianWarning => "guardianWarning" (v2::GuardianWarningNotification), DeprecationNotice => "deprecationNotice" (v2::DeprecationNoticeNotification), ConfigWarning => "configWarning" (v2::ConfigWarningNotification), FuzzyFileSearchSessionUpdated => "fuzzyFileSearch/sessionUpdated" (FuzzyFileSearchSessionUpdatedNotification), diff --git a/codex-rs/app-server-protocol/src/protocol/v2.rs b/codex-rs/app-server-protocol/src/protocol/v2.rs index f8bc91c01..e15fe5dab 100644 --- a/codex-rs/app-server-protocol/src/protocol/v2.rs +++ b/codex-rs/app-server-protocol/src/protocol/v2.rs @@ -7250,6 +7250,16 @@ pub struct WarningNotification { pub message: String, } +#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)] +#[serde(rename_all = "camelCase")] +#[ts(export_to = "v2/")] +pub struct GuardianWarningNotification { + /// Thread target for the guardian warning. + pub thread_id: String, + /// Concise guardian warning message for the user. + pub message: String, +} + #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)] #[serde(rename_all = "camelCase")] #[ts(export_to = "v2/")] diff --git a/codex-rs/app-server/src/bespoke_event_handling.rs b/codex-rs/app-server/src/bespoke_event_handling.rs index 12129f7ee..4730d3167 100644 --- a/codex-rs/app-server/src/bespoke_event_handling.rs +++ b/codex-rs/app-server/src/bespoke_event_handling.rs @@ -45,6 +45,7 @@ use codex_app_server_protocol::FileChangeRequestApprovalParams; use codex_app_server_protocol::FileChangeRequestApprovalResponse; use codex_app_server_protocol::FileUpdateChange; use codex_app_server_protocol::GrantedPermissionProfile as V2GrantedPermissionProfile; +use codex_app_server_protocol::GuardianWarningNotification; use codex_app_server_protocol::HookCompletedNotification; use codex_app_server_protocol::HookStartedNotification; use codex_app_server_protocol::InterruptConversationResponse; @@ -286,6 +287,22 @@ pub(crate) async fn apply_bespoke_event_handling( .await; } } + EventMsg::GuardianWarning(warning_event) => { + if let ApiVersion::V2 = api_version { + let notification = GuardianWarningNotification { + thread_id: conversation_id.to_string(), + message: warning_event.message, + }; + if let Some(analytics_events_client) = analytics_events_client.as_ref() { + analytics_events_client.track_notification( + ServerNotification::GuardianWarning(notification.clone()), + ); + } + outgoing + .send_server_notification(ServerNotification::GuardianWarning(notification)) + .await; + } + } EventMsg::GuardianAssessment(assessment) => { if let ApiVersion::V2 = api_version { let pending_command_execution = match build_item_from_guardian_event( diff --git a/codex-rs/app-server/src/outgoing_message.rs b/codex-rs/app-server/src/outgoing_message.rs index 3c5bef3ea..e3c92f70b 100644 --- a/codex-rs/app-server/src/outgoing_message.rs +++ b/codex-rs/app-server/src/outgoing_message.rs @@ -657,6 +657,7 @@ mod tests { use codex_app_server_protocol::ConfigWarningNotification; use codex_app_server_protocol::DynamicToolCallParams; use codex_app_server_protocol::FileChangeRequestApprovalParams; + use codex_app_server_protocol::GuardianWarningNotification; use codex_app_server_protocol::ModelRerouteReason; use codex_app_server_protocol::ModelReroutedNotification; use codex_app_server_protocol::RateLimitSnapshot; @@ -812,6 +813,28 @@ mod tests { ); } + #[test] + fn verify_guardian_warning_notification_serialization() { + let notification = ServerNotification::GuardianWarning(GuardianWarningNotification { + thread_id: "thread-1".to_string(), + message: "Automatic approval review denied the requested action.".to_string(), + }); + + let jsonrpc_notification = OutgoingMessage::AppServerNotification(notification); + assert_eq!( + json!({ + "method": "guardianWarning", + "params": { + "threadId": "thread-1", + "message": "Automatic approval review denied the requested action.", + }, + }), + serde_json::to_value(jsonrpc_notification) + .expect("ensure the notification serializes correctly"), + "ensure the notification serializes correctly" + ); + } + #[test] fn verify_model_rerouted_notification_serialization() { let notification = ServerNotification::ModelRerouted(ModelReroutedNotification { diff --git a/codex-rs/core/src/guardian/mod.rs b/codex-rs/core/src/guardian/mod.rs index a2c9b45c8..155db6f1f 100644 --- a/codex-rs/core/src/guardian/mod.rs +++ b/codex-rs/core/src/guardian/mod.rs @@ -30,6 +30,8 @@ pub(crate) use review::guardian_rejection_message; pub(crate) use review::guardian_timeout_message; pub(crate) use review::is_guardian_reviewer_source; pub(crate) use review::new_guardian_review_id; +#[cfg(test)] +pub(crate) use review::record_guardian_denial_for_test; pub(crate) use review::review_approval_request; #[cfg(test)] pub(crate) use review::review_approval_request_with_cancel; @@ -40,6 +42,8 @@ pub(crate) use review_session::GuardianReviewSessionManager; const GUARDIAN_PREFERRED_MODEL: &str = "codex-auto-review"; pub(crate) const GUARDIAN_REVIEW_TIMEOUT: Duration = Duration::from_secs(90); pub(crate) const GUARDIAN_REVIEWER_NAME: &str = "guardian"; +pub(crate) const MAX_CONSECUTIVE_GUARDIAN_DENIALS_PER_TURN: u32 = 3; +pub(crate) const MAX_TOTAL_GUARDIAN_DENIALS_PER_TURN: u32 = 10; const GUARDIAN_MAX_MESSAGE_TRANSCRIPT_TOKENS: usize = 10_000; const GUARDIAN_MAX_TOOL_TRANSCRIPT_TOKENS: usize = 10_000; const GUARDIAN_MAX_MESSAGE_ENTRY_TOKENS: usize = 2_000; @@ -63,6 +67,56 @@ pub(crate) struct GuardianRejection { pub(crate) source: GuardianAssessmentDecisionSource, } +#[derive(Debug, Default)] +pub(crate) struct GuardianRejectionCircuitBreaker { + turns: std::collections::HashMap, +} + +#[derive(Debug, Default)] +struct GuardianRejectionCircuitBreakerTurn { + consecutive_denials: u32, + total_denials: u32, + interrupt_triggered: bool, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub(crate) enum GuardianRejectionCircuitBreakerAction { + Continue, + InterruptTurn { + consecutive_denials: u32, + total_denials: u32, + }, +} + +impl GuardianRejectionCircuitBreaker { + pub(crate) fn clear_turn(&mut self, turn_id: &str) { + self.turns.remove(turn_id); + } + + pub(crate) fn record_denial(&mut self, turn_id: &str) -> GuardianRejectionCircuitBreakerAction { + let turn = self.turns.entry(turn_id.to_string()).or_default(); + turn.consecutive_denials = turn.consecutive_denials.saturating_add(1); + turn.total_denials = turn.total_denials.saturating_add(1); + if !turn.interrupt_triggered + && (turn.consecutive_denials >= MAX_CONSECUTIVE_GUARDIAN_DENIALS_PER_TURN + || turn.total_denials >= MAX_TOTAL_GUARDIAN_DENIALS_PER_TURN) + { + turn.interrupt_triggered = true; + GuardianRejectionCircuitBreakerAction::InterruptTurn { + consecutive_denials: turn.consecutive_denials, + total_denials: turn.total_denials, + } + } else { + GuardianRejectionCircuitBreakerAction::Continue + } + } + + pub(crate) fn record_non_denial(&mut self, turn_id: &str) { + let turn = self.turns.entry(turn_id.to_string()).or_default(); + turn.consecutive_denials = 0; + } +} + #[cfg(test)] use approval_request::format_guardian_action_pretty; #[cfg(test)] diff --git a/codex-rs/core/src/guardian/review.rs b/codex-rs/core/src/guardian/review.rs index ce01ac970..3b5c63b4d 100644 --- a/codex-rs/core/src/guardian/review.rs +++ b/codex-rs/core/src/guardian/review.rs @@ -17,6 +17,7 @@ use codex_protocol::protocol::GuardianRiskLevel; use codex_protocol::protocol::GuardianUserAuthorization; use codex_protocol::protocol::ReviewDecision; use codex_protocol::protocol::SubAgentSource; +use codex_protocol::protocol::TurnAbortReason; use codex_protocol::protocol::WarningEvent; use tokio::sync::oneshot; use tokio_util::sync::CancellationToken; @@ -30,6 +31,7 @@ use super::GuardianApprovalRequest; use super::GuardianAssessment; use super::GuardianAssessmentOutcome; use super::GuardianRejection; +use super::GuardianRejectionCircuitBreakerAction; use super::approval_request::guardian_assessment_action; use super::approval_request::guardian_request_target_item_id; use super::approval_request::guardian_request_turn_id; @@ -172,6 +174,64 @@ fn track_guardian_review( .track_guardian_review(tracking, result); } +async fn record_guardian_non_denial(session: &Arc, turn_id: &str) { + session + .services + .guardian_rejection_circuit_breaker + .lock() + .await + .record_non_denial(turn_id); +} + +async fn record_guardian_denial(session: &Arc, turn: &Arc, turn_id: &str) { + let action = session + .services + .guardian_rejection_circuit_breaker + .lock() + .await + .record_denial(turn_id); + let GuardianRejectionCircuitBreakerAction::InterruptTurn { + consecutive_denials, + total_denials, + } = action + else { + return; + }; + + if session.turn_context_for_sub_id(turn_id).await.is_none() { + return; + } + + session + .send_event( + turn.as_ref(), + EventMsg::GuardianWarning(WarningEvent { + message: format!( + "Automatic approval review rejected too many approval requests for this turn ({consecutive_denials} consecutive, {total_denials} total); interrupting the turn." + ), + }), + ) + .await; + + let runtime_handle = session.services.runtime_handle.clone(); + let session = Arc::clone(session); + let turn_id = turn_id.to_string(); + let _abort_task = runtime_handle.spawn(async move { + session + .abort_turn_if_active(&turn_id, TurnAbortReason::Interrupted) + .await; + }); +} + +#[cfg(test)] +pub(crate) async fn record_guardian_denial_for_test( + session: &Arc, + turn: &Arc, + turn_id: &str, +) { + record_guardian_denial(session, turn, turn_id).await; +} + /// This function always fails closed: timeouts, review-session failures, and /// parse failures all block execution, but timeouts are still surfaced to the /// caller as distinct from explicit guardian denials. @@ -234,7 +294,7 @@ async fn run_guardian_review( EventMsg::GuardianAssessment(GuardianAssessmentEvent { id: review_id, target_item_id, - turn_id: assessment_turn_id, + turn_id: assessment_turn_id.clone(), status: GuardianAssessmentStatus::Aborted, risk_level: None, user_authorization: None, @@ -244,6 +304,7 @@ async fn run_guardian_review( }), ) .await; + record_guardian_non_denial(&session, &assessment_turn_id).await; return ReviewDecision::Abort; } @@ -259,7 +320,7 @@ async fn run_guardian_review( )) .await; - let assessment = match outcome { + let (assessment, count_denial_for_circuit_breaker) = match outcome { GuardianReviewOutcome::Completed(assessment) => { let approved = matches!(assessment.outcome, GuardianAssessmentOutcome::Allow); track_guardian_review( @@ -284,7 +345,9 @@ async fn run_guardian_review( ..analytics_result }, ); - assessment + let count_denial_for_circuit_breaker = + matches!(assessment.outcome, GuardianAssessmentOutcome::Deny); + (assessment, count_denial_for_circuit_breaker) } GuardianReviewOutcome::Error(error) => match error { GuardianReviewError::Timeout => { @@ -305,7 +368,7 @@ async fn run_guardian_review( session .send_event( turn.as_ref(), - EventMsg::Warning(WarningEvent { + EventMsg::GuardianWarning(WarningEvent { message: rationale.clone(), }), ) @@ -316,7 +379,7 @@ async fn run_guardian_review( EventMsg::GuardianAssessment(GuardianAssessmentEvent { id: review_id, target_item_id, - turn_id: assessment_turn_id, + turn_id: assessment_turn_id.clone(), status: GuardianAssessmentStatus::TimedOut, risk_level: None, user_authorization: None, @@ -326,6 +389,7 @@ async fn run_guardian_review( }), ) .await; + record_guardian_non_denial(&session, &assessment_turn_id).await; return ReviewDecision::TimedOut; } GuardianReviewError::Cancelled => { @@ -346,7 +410,7 @@ async fn run_guardian_review( EventMsg::GuardianAssessment(GuardianAssessmentEvent { id: review_id, target_item_id, - turn_id: assessment_turn_id, + turn_id: assessment_turn_id.clone(), status: GuardianAssessmentStatus::Aborted, risk_level: None, user_authorization: None, @@ -356,6 +420,7 @@ async fn run_guardian_review( }), ) .await; + record_guardian_non_denial(&session, &assessment_turn_id).await; return ReviewDecision::Abort; } GuardianReviewError::PromptBuild { .. } @@ -381,12 +446,15 @@ async fn run_guardian_review( ..analytics_result }, ); - GuardianAssessment { - risk_level: GuardianRiskLevel::High, - user_authorization: GuardianUserAuthorization::Unknown, - outcome: GuardianAssessmentOutcome::Deny, - rationale, - } + ( + GuardianAssessment { + risk_level: GuardianRiskLevel::High, + user_authorization: GuardianUserAuthorization::Unknown, + outcome: GuardianAssessmentOutcome::Deny, + rationale, + }, + false, + ) } }, }; @@ -410,7 +478,7 @@ async fn run_guardian_review( session .send_event( turn.as_ref(), - EventMsg::Warning(WarningEvent { message: warning }), + EventMsg::GuardianWarning(WarningEvent { message: warning }), ) .await; let status = if approved { @@ -436,7 +504,7 @@ async fn run_guardian_review( EventMsg::GuardianAssessment(GuardianAssessmentEvent { id: review_id, target_item_id, - turn_id: assessment_turn_id, + turn_id: assessment_turn_id.clone(), status, risk_level: Some(assessment.risk_level), user_authorization: Some(assessment.user_authorization), @@ -447,6 +515,12 @@ async fn run_guardian_review( ) .await; + if count_denial_for_circuit_breaker { + record_guardian_denial(&session, &turn, &assessment_turn_id).await; + } else { + record_guardian_non_denial(&session, &assessment_turn_id).await; + } + if approved { ReviewDecision::Approved } else { diff --git a/codex-rs/core/src/guardian/tests.rs b/codex-rs/core/src/guardian/tests.rs index 02ff93dd0..cf29c5411 100644 --- a/codex-rs/core/src/guardian/tests.rs +++ b/codex-rs/core/src/guardian/tests.rs @@ -67,6 +67,74 @@ fn fixed_guardian_parent_session_id() -> ThreadId { .expect("fixed parent session id should be a valid UUID") } +#[test] +fn guardian_rejection_circuit_breaker_interrupts_after_three_consecutive_denials() { + let mut circuit_breaker = GuardianRejectionCircuitBreaker::default(); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::InterruptTurn { + consecutive_denials: 3, + total_denials: 3, + } + ); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); +} + +#[test] +fn guardian_rejection_circuit_breaker_resets_consecutive_denials_on_non_denial() { + let mut circuit_breaker = GuardianRejectionCircuitBreaker::default(); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); + circuit_breaker.record_non_denial("turn-1"); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::InterruptTurn { + consecutive_denials: 3, + total_denials: 4, + } + ); +} + +#[test] +fn guardian_rejection_circuit_breaker_interrupts_after_ten_total_denials() { + let mut circuit_breaker = GuardianRejectionCircuitBreaker::default(); + for _ in 0..9 { + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::Continue + ); + circuit_breaker.record_non_denial("turn-1"); + } + assert_eq!( + circuit_breaker.record_denial("turn-1"), + GuardianRejectionCircuitBreakerAction::InterruptTurn { + consecutive_denials: 1, + total_denials: 10, + } + ); +} + async fn guardian_test_session_and_turn( server: &wiremock::MockServer, ) -> (Arc, Arc) { @@ -739,7 +807,7 @@ async fn cancelled_guardian_review_emits_terminal_abort_without_warning() { while let Ok(event) = rx.try_recv() { match event.msg { EventMsg::GuardianAssessment(event) => guardian_statuses.push(event.status), - EventMsg::Warning(event) => warnings.push(event.message), + EventMsg::GuardianWarning(event) => warnings.push(event.message), _ => {} } } @@ -1491,7 +1559,7 @@ async fn guardian_review_surfaces_responses_api_errors_in_rejection_reason() -> let mut denial_rationales = Vec::new(); while let Ok(event) = rx.try_recv() { match event.msg { - EventMsg::Warning(event) => warnings.push(event.message), + EventMsg::GuardianWarning(event) => warnings.push(event.message), EventMsg::GuardianAssessment(event) if event.status == GuardianAssessmentStatus::Denied => { diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs index 5803d9e42..29b6f4e29 100644 --- a/codex-rs/core/src/session/session.rs +++ b/codex-rs/core/src/session/session.rs @@ -695,6 +695,8 @@ impl Session { models_manager: Arc::clone(&models_manager), tool_approvals: Mutex::new(ApprovalStore::default()), guardian_rejections: Mutex::new(HashMap::new()), + guardian_rejection_circuit_breaker: Mutex::new(Default::default()), + runtime_handle: tokio::runtime::Handle::current(), skills_manager, plugins_manager: Arc::clone(&plugins_manager), mcp_manager: Arc::clone(&mcp_manager), diff --git a/codex-rs/core/src/session/tests.rs b/codex-rs/core/src/session/tests.rs index b50273713..5e50ea5fb 100644 --- a/codex-rs/core/src/session/tests.rs +++ b/codex-rs/core/src/session/tests.rs @@ -3093,6 +3093,8 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) { models_manager: Arc::clone(&models_manager), tool_approvals: Mutex::new(ApprovalStore::default()), guardian_rejections: Mutex::new(std::collections::HashMap::new()), + guardian_rejection_circuit_breaker: Mutex::new(Default::default()), + runtime_handle: tokio::runtime::Handle::current(), skills_manager, plugins_manager, mcp_manager, @@ -4313,6 +4315,8 @@ pub(crate) async fn make_session_and_context_with_dynamic_tools_and_rx( models_manager: Arc::clone(&models_manager), tool_approvals: Mutex::new(ApprovalStore::default()), guardian_rejections: Mutex::new(std::collections::HashMap::new()), + guardian_rejection_circuit_breaker: Mutex::new(Default::default()), + runtime_handle: tokio::runtime::Handle::current(), skills_manager, plugins_manager, mcp_manager, @@ -5545,6 +5549,125 @@ impl SessionTask for NeverEndingTask { } } +#[derive(Clone, Copy)] +struct GuardianDeniedApprovalTask; + +impl SessionTask for GuardianDeniedApprovalTask { + fn kind(&self) -> TaskKind { + TaskKind::Regular + } + + fn span_name(&self) -> &'static str { + "session_task.guardian_denied_approval" + } + + async fn run( + self: Arc, + session: Arc, + ctx: Arc, + _input: Vec, + cancellation_token: CancellationToken, + ) -> Option { + let session = session.clone_session(); + for _ in 0..3 { + crate::guardian::record_guardian_denial_for_test(&session, &ctx, &ctx.sub_id).await; + } + + cancellation_token.cancelled().await; + None + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn guardian_auto_review_interrupts_after_three_consecutive_denials() { + let (sess, tc, rx) = make_session_and_context_with_rx().await; + let input = vec![UserInput::Text { + text: "trigger guardian denials".to_string(), + text_elements: Vec::new(), + }]; + sess.spawn_task(Arc::clone(&tc), input, GuardianDeniedApprovalTask) + .await; + + let mut observed = Vec::new(); + let aborted = tokio::time::timeout(std::time::Duration::from_secs(5), async { + loop { + let event = rx.recv().await.expect("event"); + if let EventMsg::TurnAborted(event) = &event.msg { + let event = event.clone(); + observed.push(EventMsg::TurnAborted(event.clone())); + break event; + } + observed.push(event.msg); + } + }) + .await + .unwrap_or_else(|_| { + panic!( + "guardian denial circuit breaker should interrupt the turn; observed events: {observed:?}" + ) + }); + assert_eq!(aborted.reason, TurnAbortReason::Interrupted); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn guardian_helper_review_interrupts_after_three_consecutive_denials() { + let (sess, tc, rx) = make_session_and_context_with_rx().await; + let input = vec![UserInput::Text { + text: "keep turn active for helper reviews".to_string(), + text_elements: Vec::new(), + }]; + sess.spawn_task( + Arc::clone(&tc), + input, + NeverEndingTask { + kind: TaskKind::Regular, + listen_to_cancellation_token: true, + }, + ) + .await; + + let session_for_review = Arc::clone(&sess); + let turn_for_review = Arc::clone(&tc); + let turn_id = tc.sub_id.clone(); + let review_thread = std::thread::spawn(move || { + let runtime = tokio::runtime::Builder::new_current_thread() + .enable_all() + .build() + .expect("helper review runtime"); + runtime.block_on(async move { + for _ in 0..3 { + crate::guardian::record_guardian_denial_for_test( + &session_for_review, + &turn_for_review, + &turn_id, + ) + .await; + } + }); + }); + review_thread.join().expect("helper review thread"); + + let mut observed = Vec::new(); + let aborted = timeout(StdDuration::from_secs(5), async { + loop { + let event = rx.recv().await.expect("event"); + if let EventMsg::TurnAborted(event) = &event.msg { + let event = event.clone(); + observed.push(EventMsg::TurnAborted(event.clone())); + break event; + } + observed.push(event.msg); + } + }) + .await + .unwrap_or_else(|_| { + panic!( + "helper review circuit breaker should interrupt the turn; observed events: {observed:?}" + ) + }); + assert_eq!(aborted.reason, TurnAbortReason::Interrupted); +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] #[test_log::test] async fn abort_regular_task_emits_turn_aborted_only() { diff --git a/codex-rs/core/src/session/turn.rs b/codex-rs/core/src/session/turn.rs index 780cee5f8..15b48f392 100644 --- a/codex-rs/core/src/session/turn.rs +++ b/codex-rs/core/src/session/turn.rs @@ -1484,6 +1484,7 @@ pub(super) fn realtime_text_for_event(msg: &EventMsg) -> Option { }, EventMsg::Error(_) | EventMsg::Warning(_) + | EventMsg::GuardianWarning(_) | EventMsg::RealtimeConversationStarted(_) | EventMsg::RealtimeConversationSdp(_) | EventMsg::RealtimeConversationRealtime(_) diff --git a/codex-rs/core/src/state/service.rs b/codex-rs/core/src/state/service.rs index 29f4433ce..f93a44d7f 100644 --- a/codex-rs/core/src/state/service.rs +++ b/codex-rs/core/src/state/service.rs @@ -8,6 +8,7 @@ use crate::client::ModelClient; use crate::config::StartedNetworkProxy; use crate::exec_policy::ExecPolicyManager; use crate::guardian::GuardianRejection; +use crate::guardian::GuardianRejectionCircuitBreaker; use crate::mcp::McpManager; use crate::plugins::PluginsManager; use crate::skills_watcher::SkillsWatcher; @@ -26,6 +27,7 @@ use codex_rollout::state_db::StateDbHandle; use codex_rollout_trace::RolloutTraceRecorder; use codex_thread_store::LocalThreadStore; use std::path::PathBuf; +use tokio::runtime::Handle; use tokio::sync::Mutex; use tokio::sync::RwLock; use tokio::sync::watch; @@ -52,6 +54,8 @@ pub(crate) struct SessionServices { pub(crate) session_telemetry: SessionTelemetry, pub(crate) tool_approvals: Mutex, pub(crate) guardian_rejections: Mutex>, + pub(crate) guardian_rejection_circuit_breaker: Mutex, + pub(crate) runtime_handle: Handle, pub(crate) skills_manager: Arc, pub(crate) plugins_manager: Arc, pub(crate) mcp_manager: Arc, diff --git a/codex-rs/core/src/tasks/mod.rs b/codex-rs/core/src/tasks/mod.rs index d9dfeb7db..b9621d8fa 100644 --- a/codex-rs/core/src/tasks/mod.rs +++ b/codex-rs/core/src/tasks/mod.rs @@ -269,6 +269,12 @@ impl Session { let cancellation_token = CancellationToken::new(); let done = Arc::new(Notify::new()); + self.services + .guardian_rejection_circuit_breaker + .lock() + .await + .clear_turn(&turn_context.sub_id); + let queued_response_items = self.take_queued_response_items_for_next_turn().await; let mailbox_items = self.get_pending_input().await; let turn_state = { @@ -410,6 +416,40 @@ impl Session { } } + pub(crate) async fn abort_turn_if_active( + self: &Arc, + turn_id: &str, + reason: TurnAbortReason, + ) -> bool { + let active_turn = { + let mut active = self.active_turn.lock().await; + if active + .as_ref() + .is_some_and(|active_turn| active_turn.tasks.contains_key(turn_id)) + { + active.take() + } else { + None + } + }; + let Some(mut active_turn) = active_turn else { + return false; + }; + + for task in active_turn.drain_tasks() { + self.handle_task_abort(task, reason.clone()).await; + } + // Let interrupted tasks observe cancellation before dropping pending approvals, or an + // in-flight approval wait can surface as a model-visible rejection before TurnAborted. + active_turn.clear_pending().await; + + if reason == TurnAbortReason::Interrupted { + self.maybe_start_turn_for_pending_work().await; + } + + true + } + pub async fn on_task_finished( self: &Arc, turn_context: Arc, @@ -568,6 +608,11 @@ impl Session { time_to_first_token_ms, }); self.send_event(turn_context.as_ref(), event).await; + self.services + .guardian_rejection_circuit_breaker + .lock() + .await + .clear_turn(&turn_context.sub_id); if should_clear_active_turn { let session = Arc::clone(self); @@ -654,6 +699,11 @@ impl Session { duration_ms, }); self.send_event(task.turn_context.as_ref(), event).await; + self.services + .guardian_rejection_circuit_breaker + .lock() + .await + .clear_turn(&task.turn_context.sub_id); } } diff --git a/codex-rs/mcp-server/src/codex_tool_runner.rs b/codex-rs/mcp-server/src/codex_tool_runner.rs index 5ad6b160b..039aab66b 100644 --- a/codex-rs/mcp-server/src/codex_tool_runner.rs +++ b/codex-rs/mcp-server/src/codex_tool_runner.rs @@ -263,7 +263,7 @@ async fn run_codex_tool_session_inner( outgoing.send_response(request_id.clone(), result).await; break; } - EventMsg::Warning(_) => { + EventMsg::Warning(_) | EventMsg::GuardianWarning(_) => { continue; } EventMsg::GuardianAssessment(_) => { diff --git a/codex-rs/protocol/src/protocol.rs b/codex-rs/protocol/src/protocol.rs index 1b8021bc7..dfbe085a8 100644 --- a/codex-rs/protocol/src/protocol.rs +++ b/codex-rs/protocol/src/protocol.rs @@ -1441,6 +1441,9 @@ pub enum EventMsg { /// indicates the turn continued but the user should still be notified. Warning(WarningEvent), + /// Warning issued by the guardian automatic approval reviewer. + GuardianWarning(WarningEvent), + /// Realtime conversation lifecycle start event. RealtimeConversationStarted(RealtimeConversationStartedEvent), diff --git a/codex-rs/rollout/src/policy.rs b/codex-rs/rollout/src/policy.rs index df41d2c76..897cd0bbf 100644 --- a/codex-rs/rollout/src/policy.rs +++ b/codex-rs/rollout/src/policy.rs @@ -132,6 +132,7 @@ fn event_msg_persistence_mode(ev: &EventMsg) -> Option { | EventMsg::DynamicToolCallRequest(_) | EventMsg::DynamicToolCallResponse(_) => Some(EventPersistenceMode::Extended), EventMsg::Warning(_) + | EventMsg::GuardianWarning(_) | EventMsg::RealtimeConversationStarted(_) | EventMsg::RealtimeConversationSdp(_) | EventMsg::RealtimeConversationRealtime(_) diff --git a/codex-rs/tui/src/app/app_server_adapter.rs b/codex-rs/tui/src/app/app_server_adapter.rs index db5aa1314..f7793a55a 100644 --- a/codex-rs/tui/src/app/app_server_adapter.rs +++ b/codex-rs/tui/src/app/app_server_adapter.rs @@ -425,6 +425,7 @@ fn server_notification_thread_target( Some(notification.thread_id.as_str()) } ServerNotification::Warning(notification) => notification.thread_id.as_deref(), + ServerNotification::GuardianWarning(notification) => Some(notification.thread_id.as_str()), ServerNotification::SkillsChanged(_) | ServerNotification::McpServerStatusUpdated(_) | ServerNotification::McpServerOauthLoginCompleted(_) @@ -1067,6 +1068,7 @@ mod tests { use codex_app_server_protocol::CommandExecutionOutputDeltaNotification; use codex_app_server_protocol::CommandExecutionSource; use codex_app_server_protocol::CommandExecutionStatus; + use codex_app_server_protocol::GuardianWarningNotification; use codex_app_server_protocol::ItemCompletedNotification; use codex_app_server_protocol::ItemStartedNotification; use codex_app_server_protocol::ReasoningSummaryTextDeltaNotification; @@ -1686,4 +1688,17 @@ mod tests { assert_eq!(target, ServerNotificationThreadTarget::Thread(thread_id)); } + + #[test] + fn guardian_warning_notifications_route_to_threads() { + let thread_id = ThreadId::new(); + let notification = ServerNotification::GuardianWarning(GuardianWarningNotification { + thread_id: thread_id.to_string(), + message: "warning".to_string(), + }); + + let target = server_notification_thread_target(¬ification); + + assert_eq!(target, ServerNotificationThreadTarget::Thread(thread_id)); + } } diff --git a/codex-rs/tui/src/app/replay_filter.rs b/codex-rs/tui/src/app/replay_filter.rs index ec9176ffa..273ca0dd5 100644 --- a/codex-rs/tui/src/app/replay_filter.rs +++ b/codex-rs/tui/src/app/replay_filter.rs @@ -25,7 +25,9 @@ pub(super) fn event_is_notice(event: &ThreadBufferedEvent) -> bool { matches!( event, ThreadBufferedEvent::Notification( - ServerNotification::Warning(_) | ServerNotification::ConfigWarning(_) + ServerNotification::Warning(_) + | ServerNotification::GuardianWarning(_) + | ServerNotification::ConfigWarning(_) ) ) } diff --git a/codex-rs/tui/src/chatwidget.rs b/codex-rs/tui/src/chatwidget.rs index 46850c830..093ff91aa 100644 --- a/codex-rs/tui/src/chatwidget.rs +++ b/codex-rs/tui/src/chatwidget.rs @@ -6570,6 +6570,9 @@ impl ChatWidget { } ServerNotification::ModelRerouted(_) => {} ServerNotification::Warning(notification) => self.on_warning(notification.message), + ServerNotification::GuardianWarning(notification) => { + self.on_warning(notification.message) + } ServerNotification::DeprecationNotice(notification) => { self.on_deprecation_notice(DeprecationNoticeEvent { summary: notification.summary, @@ -7067,7 +7070,8 @@ impl ChatWidget { self.set_token_info(ev.info); self.on_rate_limit_snapshot(ev.rate_limits); } - EventMsg::Warning(WarningEvent { message }) => self.on_warning(message), + EventMsg::Warning(WarningEvent { message }) + | EventMsg::GuardianWarning(WarningEvent { message }) => self.on_warning(message), EventMsg::GuardianAssessment(ev) => self.on_guardian_assessment(ev), EventMsg::ModelReroute(_) => {} EventMsg::Error(ErrorEvent { diff --git a/codex-rs/tui/src/chatwidget/tests.rs b/codex-rs/tui/src/chatwidget/tests.rs index d81544e4f..f001c3afd 100644 --- a/codex-rs/tui/src/chatwidget/tests.rs +++ b/codex-rs/tui/src/chatwidget/tests.rs @@ -51,6 +51,7 @@ pub(super) use codex_app_server_protocol::GuardianApprovalReviewStatus; pub(super) use codex_app_server_protocol::GuardianCommandSource as AppServerGuardianCommandSource; pub(super) use codex_app_server_protocol::GuardianRiskLevel as AppServerGuardianRiskLevel; pub(super) use codex_app_server_protocol::GuardianUserAuthorization as AppServerGuardianUserAuthorization; +pub(super) use codex_app_server_protocol::GuardianWarningNotification; pub(super) use codex_app_server_protocol::HookCompletedNotification as AppServerHookCompletedNotification; pub(super) use codex_app_server_protocol::HookEventName as AppServerHookEventName; pub(super) use codex_app_server_protocol::HookExecutionMode as AppServerHookExecutionMode; diff --git a/codex-rs/tui/src/chatwidget/tests/app_server.rs b/codex-rs/tui/src/chatwidget/tests/app_server.rs index 95ec72940..06acb16d0 100644 --- a/codex-rs/tui/src/chatwidget/tests/app_server.rs +++ b/codex-rs/tui/src/chatwidget/tests/app_server.rs @@ -212,6 +212,27 @@ async fn live_app_server_warning_notification_renders_message() { ); } +#[tokio::test] +async fn live_app_server_guardian_warning_notification_renders_message() { + let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await; + + chat.handle_server_notification( + ServerNotification::GuardianWarning(GuardianWarningNotification { + thread_id: "thread-1".to_string(), + message: "Automatic approval review denied the requested action.".to_string(), + }), + /*replay_kind*/ None, + ); + + let cells = drain_insert_history(&mut rx); + assert_eq!(cells.len(), 1, "expected one warning history cell"); + let rendered = lines_to_single_string(&cells[0]); + assert!( + rendered.contains("Automatic approval review denied the requested action."), + "expected guardian warning notification message, got {rendered}" + ); +} + #[tokio::test] async fn live_app_server_config_warning_prefixes_summary() { let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await; diff --git a/codex-rs/tui/src/chatwidget/tests/guardian.rs b/codex-rs/tui/src/chatwidget/tests/guardian.rs index ffdefa534..dfb74a5d5 100644 --- a/codex-rs/tui/src/chatwidget/tests/guardian.rs +++ b/codex-rs/tui/src/chatwidget/tests/guardian.rs @@ -28,7 +28,7 @@ async fn guardian_denied_exec_renders_warning_and_denied_request() { }); chat.handle_codex_event(Event { id: "guardian-warning".into(), - msg: EventMsg::Warning(WarningEvent { + msg: EventMsg::GuardianWarning(WarningEvent { message: "Automatic approval review denied (risk: high): The planned action would transmit the full contents of a workspace source file (`core/src/codex.rs`) to `https://example.com`, which is an external and untrusted endpoint.".into(), }), }); @@ -228,7 +228,7 @@ async fn guardian_timed_out_exec_renders_warning_and_timed_out_request() { }); chat.handle_codex_event(Event { id: "guardian-warning".into(), - msg: EventMsg::Warning(WarningEvent { + msg: EventMsg::GuardianWarning(WarningEvent { message: "Automatic approval review timed out while evaluating the requested approval." .into(), }),