10 Commits

• feat: auto-approve nl and support piping to sed (#920)

  Auto-approved:
  
  ```
  ["nl", "-ba", "README.md"]
  ["sed", "-n", "1,200p", "filename.txt"]
  ["bash", "-lc", "sed -n '1,200p' filename.txt"]
  ["bash", "-lc", "nl -ba README.md | sed -n '1,200p'"]
  ```
  
  Not auto approved:
  
  ```
  ["sed", "-n", "'1,200p'", "filename.txt"]
  ["sed", "-n", "1,200p", "file1.txt", "file2.txt"]
  ```

  Michael Bolin · 2025-05-13 13:06:35 -07:00
  a786c1d188
• when a shell tool call invokes apply_patch, resolve relative paths against workdir, if specified (#556)

  Previously, we were ignoring the `workdir` field in an `ExecInput` when
  running it through `canAutoApprove()`. For ordinary `exec()` calls, that
  was sufficient, but for `apply_patch`, we need the `workdir` to resolve
  relative paths in the `apply_patch` argument so that we can check them
  in `isPathConstrainedTowritablePaths()`.
  
  Likewise, we also need the workdir when running `execApplyPatch()`
  because the paths need to be resolved again.
  
  Ideally, the `ApplyPatchCommand` returned by `canAutoApprove()` would
  not be a simple `patch: string`, but the parsed patch with all of the
  paths resolved, in which case `execApplyPatch()` could expect absolute
  paths and would not need `workdir`.

  Michael Bolin · 2025-04-22 14:07:47 -07:00
  7c1f2d7deb
• do not auto-approve the find command if it contains options that write files or spawn commands (#482)

  Updates `isSafeCommand()` so that an invocation of `find` is not
  auto-approved if it contains any of: `-exec`, `-execdir`, `-ok`,
  `-okdir`, `-delete`, `-fls`, `-fprint`, `-fprint0`, `-fprintf`.

  Michael Bolin · 2025-04-21 10:29:58 -07:00
  12ec57b330
• revert #386 due to unsafe shell command parsing (#478)

  Reverts https://github.com/openai/codex/pull/386 because:
  
  * The parsing logic for shell commands was unsafe (`split(/\s+/)`
  instead of something like `shell-quote`)
  * We have a different plan for supporting auto-approved commands.

  Michael Bolin · 2025-04-21 12:52:11 -04:00
  d36d295a1a
• chore: consolidate model utils and drive-by cleanups (#476)

  Signed-off-by: Thibault Sottiaux <tibo@openai.com>

  Thibault Sottiaux · 2025-04-21 12:33:57 -04:00
  3c4f1fea9b
• feat: add user-defined safe commands configuration and approval logic #380 (#386)

  This pull request adds a feature that allows users to configure
  auto-approved commands via a `safeCommands` array in the configuration
  file.
  
  ## Related Issue
  #380 
  
  ## Changes
  - Added loading and validation of the `safeCommands` array in
  `src/utils/config.ts`
  - Implemented auto-approval logic for commands matching `safeCommands`
  prefixes in `src/approvals.ts`
  - Added test cases in `src/tests/approvals.test.ts` to verify
  `safeCommands` behavior
  - Updated documentation with examples and explanations of the
  configuration

  autotaker · 2025-04-18 22:35:32 -07:00
  ca7ab76569
• revert: suggest mode file read behavior openai/codex#197 (#285)

  Reverts openai/codex#197

  Fouad Matin · 2025-04-17 17:32:53 -07:00
  45c0175156
• fix(security): Shell commands auto-executing in 'suggest' mode without permission (#197)

  ## Problem
  
  There's a security vulnerability in the current implementation where
  shell commands are being executed without requesting user permission
  even when in 'suggest' mode. According to our documentation:
  
  > In **Suggest** mode (default): All file writes/patches and **ALL
  shell/Bash commands** should require approval.
  
  However, the current implementation in `approvals.ts` was auto-approving
  commands deemed "safe" by the `isSafeCommand` function, bypassing the
  user permission requirement. This is a security risk as users expect all
  shell commands to require explicit approval in 'suggest' mode.
  
  ## Solution
  
  This PR fixes the issue by modifying the `canAutoApprove` function in
  `approvals.ts` to respect the 'suggest' mode policy for all shell
  commands:
  
  1. Added an early check at the beginning of `canAutoApprove` to
  immediately return `{ type: "ask-user" }` when the policy is `suggest`,
  regardless of whether the command is considered "safe" or not.
  
  2. Added a similar check in the bash command handling section to ensure
  bash commands also respect the 'suggest' mode.
  
  3. Updated tests to verify the new behavior, ensuring that all shell
  commands require approval in 'suggest' mode, while still being
  auto-approved in 'auto-edit' and 'full-auto' modes when appropriate.
  
  ## Testing
  
  All tests pass, confirming that the fix works as expected. The updated
  tests verify that:
  - All commands (even "safe" ones) require approval in 'suggest' mode
  - Safe commands are still auto-approved in 'auto-edit' mode
  - Bash commands with redirects still require approval in all modes
  
  This change ensures that the behavior matches what's documented and what
  users expect, improving security by requiring explicit permission for
  all shell commands in the default 'suggest' mode.

  Brayden Moon · 2025-04-17 07:15:02 -07:00
  b62ef70d2a
• Back out @lib indirection in tsconfig.json (#111)
  Michael Bolin · 2025-04-16 14:16:53 -07:00
  9b733fc48f
• move all tests under tests/ (#3)
  Thibault Sottiaux · 2025-04-16 10:21:48 -07:00
  8794df3c08