Files
codex/codex-rs/app-server/tests/suite/v2/mod.rs
T
rka-oai b294638bb5 [codex] reject remote images at app-server ingress (#29419)
## Stack

Stacked on #29417. Review and land that PR first.

## Summary

- reject HTTP(S) image URLs in the handlers for `turn/start` and
`turn/steer`
- validate `thread/inject_items` after its existing
JSON-to-`ResponseItem` conversion, so each item is deserialized once
- turn invalid dynamic-tool image responses into the existing
unsuccessful text fallback; the model receives the validation message as
the function output
- leave `thread/resume.history` compatible with legacy history; #29417
replaces remote images before model input
- continue accepting inline data URLs and `localImage` inputs
- keep this policy in app-server; this PR does not add a shared protocol
API or change core image preparation

## Test plan

- `just test -p codex-app-server -E
'test(/request_handlers_reject_remote_image_urls|dynamic_tool_remote_image_response_becomes_model_visible_error|dynamic_tool_call_round_trip_sends_content_items_to_model|turn_start_tracks_turn_event_analytics|standalone_image_edit_uses_recent_pathless_image/)'`
(5 passed)
- `just fix -p codex-app-server`
- `just fmt`
2026-06-23 00:43:56 +00:00

84 lines
1.7 KiB
Rust

mod account;
mod analytics;
mod app_list;
mod attestation;
mod client_metadata;
mod collaboration_mode_list;
#[cfg(unix)]
mod command_exec;
mod compaction;
mod config_rpc;
mod connection_handling_websocket;
#[cfg(unix)]
mod connection_handling_websocket_unix;
mod current_time;
mod dynamic_tools;
mod environment_add;
#[cfg(not(target_os = "windows"))]
mod executor_mcp;
mod executor_skills;
mod experimental_api;
mod experimental_feature_list;
mod external_agent_config;
mod fs;
mod hooks_list;
mod imagegen_extension;
mod initialize;
mod marketplace_add;
mod marketplace_remove;
mod marketplace_upgrade;
mod mcp_resource;
mod mcp_server_elicitation;
mod mcp_server_status;
mod mcp_tool;
mod memory_reset;
mod model_list;
mod model_provider_capabilities_read;
mod output_schema;
mod permission_profile_list;
mod plan_item;
mod plugin_install;
mod plugin_list;
mod plugin_read;
mod plugin_share;
mod plugin_uninstall;
mod process_exec;
mod rate_limit_reset_credits;
mod rate_limits;
mod realtime_conversation;
mod recommended_plugins;
mod remote_control;
#[cfg(debug_assertions)]
mod remote_thread_store;
mod request_permissions;
mod request_user_input;
mod request_validation;
mod review;
mod safety_check_downgrade;
mod skills_list;
mod sleep;
mod thread_archive;
mod thread_delete;
mod thread_fork;
mod thread_inject_items;
mod thread_list;
mod thread_loaded_list;
mod thread_memory_mode_set;
mod thread_metadata_update;
mod thread_name_websocket;
mod thread_read;
mod thread_resume;
mod thread_rollback;
mod thread_settings_update;
mod thread_shell_command;
mod thread_start;
mod thread_status;
mod thread_unarchive;
mod thread_unsubscribe;
mod turn_interrupt;
mod turn_start;
mod turn_start_zsh_fork;
mod turn_steer;
mod web_search;
mod windows_sandbox_setup;