mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
## Why Codex intentionally ignores unknown `config.toml` fields by default so older and newer config files keep working across versions. That leniency also makes typo detection hard because misspelled or misplaced keys disappear silently. This change adds an opt-in strict config mode so users and tooling can fail fast on unrecognized config fields without changing the default permissive behavior. This feature is possible because `serde_ignored` exposes the exact signal Codex needs: it lets Codex run ordinary Serde deserialization while recording fields Serde would otherwise ignore. That avoids requiring `#[serde(deny_unknown_fields)]` across every config type and keeps strict validation opt-in around the existing config model. ## What Changed ### Added strict config validation - Added `serde_ignored`-based validation for `ConfigToml` in `codex-rs/config/src/strict_config.rs`. - Combined `serde_ignored` with `serde_path_to_error` so strict mode preserves typed config error paths while also collecting fields Serde would otherwise ignore. - Added strict-mode validation for unknown `[features]` keys, including keys that would otherwise be accepted by `FeaturesToml`'s flattened boolean map. - Kept typed config errors ahead of ignored-field reporting, so malformed known fields are reported before unknown-field diagnostics. - Added source-range diagnostics for top-level and nested unknown config fields, including non-file managed preference source names. ### Kept parsing single-pass per source - Reworked file and managed-config loading so strict validation reuses the already parsed `TomlValue` for that source. - For actual config files and managed config strings, the loader now reads once, parses once, and validates that same parsed value instead of deserializing multiple times. - Validated `-c` / `--config` override layers with the same base-directory context used for normal relative-path resolution, so unknown override keys are still reported when another override contains a relative path. ### Scoped `--strict-config` to config-heavy entry points - Added support for `--strict-config` on the main config-loading entry points where it is most useful: - `codex` - `codex resume` - `codex fork` - `codex exec` - `codex review` - `codex mcp-server` - `codex app-server` when running the server itself - the standalone `codex-app-server` binary - the standalone `codex-exec` binary - Commands outside that set now reject `--strict-config` early with targeted errors instead of accepting it everywhere through shared CLI plumbing. - `codex app-server` subcommands such as `proxy`, `daemon`, and `generate-*` are intentionally excluded from the first rollout. - When app-server strict mode sees invalid config, app-server exits with the config error instead of logging a warning and continuing with defaults. - Introduced a dedicated `ReviewCommand` wrapper in `codex-rs/cli` instead of extending shared `ReviewArgs`, so `--strict-config` stays on the outer config-loading command surface and does not become part of the reusable review payload used by `codex exec review`. ### Coverage - Added tests for top-level and nested unknown config fields, unknown `[features]` keys, typed-error precedence, source-location reporting, and non-file managed preference source names. - Added CLI coverage showing invalid `--enable`, invalid `--disable`, and unknown `-c` overrides still error when `--strict-config` is present, including compound-looking feature names such as `multi_agent_v2.subagent_usage_hint_text`. - Added integration coverage showing both `codex app-server --strict-config` and standalone `codex-app-server --strict-config` exit with an error for unknown config fields instead of starting with fallback defaults. - Added coverage showing unsupported command surfaces reject `--strict-config` with explicit errors. ## Example Usage Run Codex with strict config validation enabled: ```shell codex --strict-config ``` Strict config mode is also available on the supported config-heavy subcommands: ```shell codex --strict-config exec "explain this repository" codex review --strict-config --uncommitted codex mcp-server --strict-config codex app-server --strict-config --listen off codex-app-server --strict-config --listen off ``` For example, if `~/.codex/config.toml` contains a typo in a key name: ```toml model = "gpt-5" approval_polic = "on-request" ``` then `codex --strict-config` reports the misspelled key instead of silently ignoring it. The path is shortened to `~` here for readability: ```text $ codex --strict-config Error loading config.toml: ~/.codex/config.toml:2:1: unknown configuration field `approval_polic` | 2 | approval_polic = "on-request" | ^^^^^^^^^^^^^^ ``` Without `--strict-config`, Codex keeps the existing permissive behavior and ignores the unknown key. Strict config mode also validates ad-hoc `-c` / `--config` overrides: ```text $ codex --strict-config -c foo=bar Error: unknown configuration field `foo` in -c/--config override $ codex --strict-config -c features.foo=true Error: unknown configuration field `features.foo` in -c/--config override ``` Invalid feature toggles are rejected too, including values that look like nested config paths: ```text $ codex --strict-config --enable does_not_exist Error: Unknown feature flag: does_not_exist $ codex --strict-config --disable does_not_exist Error: Unknown feature flag: does_not_exist $ codex --strict-config --enable multi_agent_v2.subagent_usage_hint_text Error: Unknown feature flag: multi_agent_v2.subagent_usage_hint_text ``` Unsupported commands reject the flag explicitly: ```text $ codex --strict-config cloud list Error: `--strict-config` is not supported for `codex cloud` ``` ## Verification The `codex-cli` `strict_config` tests cover invalid `--enable`, invalid `--disable`, the compound `multi_agent_v2.subagent_usage_hint_text` case, unknown `-c` overrides, app-server strict startup failure through `codex app-server`, and rejection for unsupported commands such as `codex cloud`, `codex mcp`, `codex remote-control`, and `codex app-server proxy`. The config and config-loader tests cover unknown top-level fields, unknown nested fields, unknown `[features]` keys, source-location reporting, non-file managed config sources, and `-c` validation for keys such as `features.foo`. The app-server test suite covers standalone `codex-app-server --strict-config` startup failure for an unknown config field. ## Documentation The Codex CLI docs on developers.openai.com/codex should mention `--strict-config` as an opt-in validation mode for supported config-heavy entry points once this ships.
140 lines
4.1 KiB
Rust
140 lines
4.1 KiB
Rust
use clap::Args;
|
||
use clap::FromArgMatches;
|
||
use clap::Parser;
|
||
use codex_utils_cli::ApprovalModeCliArg;
|
||
use codex_utils_cli::CliConfigOverrides;
|
||
use codex_utils_cli::SharedCliOptions;
|
||
|
||
#[derive(Parser, Debug)]
|
||
#[command(version)]
|
||
pub struct Cli {
|
||
/// Optional user prompt to start the session.
|
||
#[arg(value_name = "PROMPT", value_hint = clap::ValueHint::Other)]
|
||
pub prompt: Option<String>,
|
||
|
||
/// Error out when config.toml contains fields that are not recognized by this version of Codex.
|
||
#[arg(long = "strict-config", default_value_t = false)]
|
||
pub strict_config: bool,
|
||
|
||
// Internal controls set by the top-level `codex resume` subcommand.
|
||
// These are not exposed as user flags on the base `codex` command.
|
||
#[clap(skip)]
|
||
pub resume_picker: bool,
|
||
|
||
#[clap(skip)]
|
||
pub resume_last: bool,
|
||
|
||
/// Internal: resume a specific recorded session by id (UUID). Set by the
|
||
/// top-level `codex resume <SESSION_ID>` wrapper; not exposed as a public flag.
|
||
#[clap(skip)]
|
||
pub resume_session_id: Option<String>,
|
||
|
||
/// Internal: show all sessions (disables cwd filtering and shows CWD column).
|
||
#[clap(skip)]
|
||
pub resume_show_all: bool,
|
||
|
||
/// Internal: include non-interactive sessions in resume listings.
|
||
#[clap(skip)]
|
||
pub resume_include_non_interactive: bool,
|
||
|
||
// Internal controls set by the top-level `codex fork` subcommand.
|
||
// These are not exposed as user flags on the base `codex` command.
|
||
#[clap(skip)]
|
||
pub fork_picker: bool,
|
||
|
||
#[clap(skip)]
|
||
pub fork_last: bool,
|
||
|
||
/// Internal: fork a specific recorded session by id (UUID). Set by the
|
||
/// top-level `codex fork <SESSION_ID>` wrapper; not exposed as a public flag.
|
||
#[clap(skip)]
|
||
pub fork_session_id: Option<String>,
|
||
|
||
/// Internal: show all sessions (disables cwd filtering and shows CWD column).
|
||
#[clap(skip)]
|
||
pub fork_show_all: bool,
|
||
|
||
#[clap(flatten)]
|
||
pub shared: TuiSharedCliOptions,
|
||
|
||
/// Configure when the model requires human approval before executing a command.
|
||
#[arg(long = "ask-for-approval", short = 'a')]
|
||
pub approval_policy: Option<ApprovalModeCliArg>,
|
||
|
||
/// Enable live web search. When enabled, the native Responses `web_search` tool is available to the model (no per‑call approval).
|
||
#[arg(long = "search", default_value_t = false)]
|
||
pub web_search: bool,
|
||
|
||
/// Disable alternate screen mode
|
||
///
|
||
/// Runs the TUI in inline mode, preserving terminal scrollback history.
|
||
#[arg(long = "no-alt-screen", default_value_t = false)]
|
||
pub no_alt_screen: bool,
|
||
|
||
#[clap(skip)]
|
||
pub config_overrides: CliConfigOverrides,
|
||
}
|
||
|
||
impl std::ops::Deref for Cli {
|
||
type Target = SharedCliOptions;
|
||
|
||
fn deref(&self) -> &Self::Target {
|
||
&self.shared.0
|
||
}
|
||
}
|
||
|
||
impl std::ops::DerefMut for Cli {
|
||
fn deref_mut(&mut self) -> &mut Self::Target {
|
||
&mut self.shared.0
|
||
}
|
||
}
|
||
|
||
#[derive(Debug, Default)]
|
||
pub struct TuiSharedCliOptions(SharedCliOptions);
|
||
|
||
impl TuiSharedCliOptions {
|
||
pub fn into_inner(self) -> SharedCliOptions {
|
||
self.0
|
||
}
|
||
}
|
||
|
||
impl std::ops::Deref for TuiSharedCliOptions {
|
||
type Target = SharedCliOptions;
|
||
|
||
fn deref(&self) -> &Self::Target {
|
||
&self.0
|
||
}
|
||
}
|
||
|
||
impl std::ops::DerefMut for TuiSharedCliOptions {
|
||
fn deref_mut(&mut self) -> &mut Self::Target {
|
||
&mut self.0
|
||
}
|
||
}
|
||
|
||
impl Args for TuiSharedCliOptions {
|
||
fn augment_args(cmd: clap::Command) -> clap::Command {
|
||
mark_tui_args(SharedCliOptions::augment_args(cmd))
|
||
}
|
||
|
||
fn augment_args_for_update(cmd: clap::Command) -> clap::Command {
|
||
mark_tui_args(SharedCliOptions::augment_args_for_update(cmd))
|
||
}
|
||
}
|
||
|
||
impl FromArgMatches for TuiSharedCliOptions {
|
||
fn from_arg_matches(matches: &clap::ArgMatches) -> Result<Self, clap::Error> {
|
||
SharedCliOptions::from_arg_matches(matches).map(Self)
|
||
}
|
||
|
||
fn update_from_arg_matches(&mut self, matches: &clap::ArgMatches) -> Result<(), clap::Error> {
|
||
self.0.update_from_arg_matches(matches)
|
||
}
|
||
}
|
||
|
||
fn mark_tui_args(cmd: clap::Command) -> clap::Command {
|
||
cmd.mut_arg("dangerously_bypass_approvals_and_sandbox", |arg| {
|
||
arg.conflicts_with("approval_policy")
|
||
})
|
||
}
|