Michael BolinandGitHub 425fff7ad6 feat: add Reject approval policy with granular prompt rejection controls (#12087) ...

## Why

We need a way to auto-reject specific approval prompt categories without
switching all approvals off.

The goal is to let users independently control:
- sandbox escalation approvals,
- execpolicy `prompt` rule approvals,
- MCP elicitation prompts.

## What changed

- Added a new primary approval mode in `protocol/src/protocol.rs`:

```rust
pub enum AskForApproval {
    // ...
    Reject(RejectConfig),
    // ...
}

pub struct RejectConfig {
    pub sandbox_approval: bool,
    pub rules: bool,
    pub mcp_elicitations: bool,
}
```

- Wired `RejectConfig` semantics through approval paths in `core`:
  - `core/src/exec_policy.rs`
    - rejects rule-driven prompts when `rules = true`
    - rejects sandbox/escalation prompts when `sandbox_approval = true`
- preserves rule priority when both rule and sandbox prompt conditions
are present
  - `core/src/tools/sandboxing.rs`
- applies `sandbox_approval` to default exec approval decisions and
sandbox-failure retry gating
  - `core/src/safety.rs`
- keeps `Reject { all false }` behavior aligned with `OnRequest` for
patch safety
    - rejects out-of-root patch approvals when `sandbox_approval = true`
  - `core/src/mcp_connection_manager.rs`
    - auto-declines MCP elicitations when `mcp_elicitations = true`

- Ensured approval policy used by MCP elicitation flow stays in sync
with constrained session policy updates.

- Updated app-server v2 conversions and generated schema/TypeScript
artifacts for the new `Reject` shape.

## Verification

Added focused unit coverage for the new behavior in:
- `core/src/exec_policy.rs`
- `core/src/tools/sandboxing.rs`
- `core/src/mcp_connection_manager.rs`
- `core/src/safety.rs`
- `core/src/tools/runtimes/apply_patch.rs`

Key cases covered include rule-vs-sandbox prompt precedence, MCP
auto-decline behavior, and patch/sandbox retry behavior under
`RejectConfig`.

2026-02-19 11:41:49 -08:00

..

agent

Add configurable agent spawn depth (#12251)

2026-02-19 18:40:41 +00:00

apps

[apps] Fix app mention syntax. (#11894)

2026-02-16 22:01:49 +00:00

auth

fix(app-server): for external auth, replace id_token with chatgpt_acc… (#11240)

2026-02-09 20:48:58 -08:00

bin

add generated jsonschema for config.toml (#8956)

2026-01-13 10:22:51 -08:00

config

Add configurable agent spawn depth (#12251)

2026-02-19 18:40:41 +00:00

config_loader

feat: move agents config to main config (#11982)

2026-02-17 18:17:19 +00:00

context_manager

Move previous turn context tracking into ContextManager history (#12179)

2026-02-19 09:56:20 -08:00

features

chore: rename collab feature flag key to multi_agent (#11918)

2026-02-16 15:28:31 +00:00

instructions

chore: add phase to message responseitem (#10455)

2026-02-03 02:52:26 +00:00

mcp

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

memories

memories: bump rollout summary slug cap to 60 (#12167)

2026-02-18 19:15:07 +00:00

models_manager

client side modelinfo overrides (#12101)

2026-02-19 10:38:57 -08:00

rollout

Restore phase when loading from history (#12244)

2026-02-19 09:56:56 -08:00

sandboxing

feat(core): zsh exec bridge (#12052)

2026-02-17 20:19:53 -08:00

skills

Add remote skill scope/product_surface/enabled params and cleanup (#11801)

2026-02-17 11:05:22 -08:00

state

Move previous turn context tracking into ContextManager history (#12179)

2026-02-19 09:56:20 -08:00

tasks

Disable collab tools during review delegation (#12157)

2026-02-18 17:02:49 +00:00

tools

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

unified_exec

Revert "feat: no timeout mode on ue" (#12256)

2026-02-19 19:02:29 +00:00

zsh_exec_bridge

feat(core): zsh exec bridge (#12052)

2026-02-17 20:19:53 -08:00

analytics_client.rs

support app usage analytics (#11687)

2026-02-13 12:00:16 -08:00

api_bridge.rs

Better error message for model limit hit. (#11636)

2026-02-12 14:10:30 -08:00

apply_patch.rs

remove sandbox globals. (#9797)

2026-01-27 11:04:23 -08:00

auth.rs

Fixed a hole in token refresh logic for app server (#11802)

2026-02-18 09:27:04 -08:00

client_common.rs

Remove ApiPrompt (#11265)

2026-02-10 16:12:31 +00:00

client.rs

Use V2 websockets if feature enabled (#12071)

2026-02-17 18:32:16 -08:00

codex_delegate.rs

feat(core): plumb distinct approval ids for command approvals (#12051)

2026-02-18 01:55:57 +00:00

codex_thread.rs

feat: sub-agent injection (#12152)

2026-02-19 11:32:10 +00:00

codex.rs

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

command_canonicalization.rs

fix(core): canonicalize wrapper approvals and support heredoc prefix … (#10941)

2026-02-10 11:46:40 -08:00

commit_attribution.rs

Use prompt-based co-author attribution with config override (#11617)

2026-02-17 20:15:54 +00:00

compact_remote.rs

Handle model-switch base instructions after compaction (#11659)

2026-02-13 19:02:53 -08:00

compact.rs

Move previous turn context tracking into ContextManager history (#12179)

2026-02-19 09:56:20 -08:00

connectors.rs

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

custom_prompts.rs

fix(core): load custom prompts from symlinked Markdown files (#3643)

2025-11-04 17:44:02 -08:00

default_client.rs

[apps] Update apps allowlist. (#12211)

2026-02-18 23:21:32 -08:00

env.rs

[device-auth] When headless environment is detected, show device login flow instead. (#8756)

2026-01-08 21:48:30 -08:00

environment_context.rs

Move previous turn context tracking into ContextManager history (#12179)

2026-02-19 09:56:20 -08:00

error.rs

feat(core): add structured network approval plumbing and policy decision model (#11672)

2026-02-14 04:18:12 +00:00

event_mapping.rs

fix(tui): conditionally restore status indicator using message phase (#10947)

2026-02-07 02:39:52 +00:00

exec_env.rs

Inject CODEX_THREAD_ID into the terminal environment (#10096)

2026-02-03 11:31:12 -08:00

exec_policy.rs

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

exec.rs

feat(core): zsh exec bridge (#12052)

2026-02-17 20:19:53 -08:00

features.rs

Update docs links for feature flag notice (#12164)

2026-02-19 00:00:44 -08:00

file_watcher.rs

fix: file watcher (#12105)

2026-02-18 18:28:34 +00:00

flags.rs

chore: drop unused values from env_flags (#4188)

2025-09-24 14:29:51 -07:00

function_tool.rs

nit: drop unused function call error (#8903)

2026-01-08 15:07:30 +00:00

git_info.rs

turn metadata: per-turn non-blocking (#11677)

2026-02-13 12:48:29 -08:00

landlock.rs

feat: make sandbox read access configurable with ReadOnlyAccess (#11387)

2026-02-11 18:31:14 -08:00

lib.rs

feat(core): zsh exec bridge (#12052)

2026-02-17 20:19:53 -08:00

mcp_connection_manager.rs

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

mcp_tool_call.rs

Adjust MCP tool approval handling for custom servers (#11787)

2026-02-19 12:52:42 -05:00

memory_trace.rs

memories: add extraction and prompt module foundation (#11200)

2026-02-10 10:10:24 +00:00

mentions.rs

Extract tool building (#11337)

2026-02-10 11:45:23 -08:00

message_history.rs

chore: unify conversation with thread name (#8830)

2026-01-07 17:04:53 +00:00

model_provider_info.rs

Fix: update parallel tool call exec approval to approve on request id (#11162)

2026-02-10 09:38:00 -08:00

network_policy_decision.rs

feat(core): add structured network approval plumbing and policy decision model (#11672)

2026-02-14 04:18:12 +00:00

network_proxy_loader.rs

chore: change ConfigState so it no longer depends on a single config.toml file for reloading (#11262)

2026-02-09 19:26:39 -08:00

otel_init.rs

feat: show runtime metrics in console (#10278)

2026-01-30 22:20:02 -08:00

path_utils.rs

Fixed symlink support for config.toml (#9445)

2026-01-18 19:22:28 -08:00

personality_migration.rs

chore(config) Rename config setting to personality (#10314)

2026-01-31 19:38:06 -08:00

project_doc.rs

Add js_repl_tools_only model and routing restrictions (#10671)

2026-02-12 15:41:05 -08:00

proposed_plan_parser.rs

Plan mode: stream proposed plans, emit plan items, and render in TUI (#9786)

2026-01-30 18:59:30 +00:00

review_format.rs

feat: detached review (#7292)

2025-11-28 11:34:57 +00:00

review_prompts.rs

chore: review everywhere (#7444)

2025-12-02 11:26:27 +00:00

safety.rs

feat: add Reject approval policy with granular prompt rejection controls (#12087)

2026-02-19 11:41:49 -08:00

sandbox_tags.rs

fix(core): add linux bubblewrap sandbox tag (#11767)

2026-02-14 19:00:01 +00:00

seatbelt_base_policy.sbpl

[feat] add seatbelt permission files (#11639)

2026-02-12 23:30:22 +00:00

seatbelt_network_policy.sbpl

feat(sandbox): enforce proxy-aware network routing in sandbox (#11113)

2026-02-10 07:44:21 +00:00

seatbelt_permissions.rs

feat(skills): add permission profiles from openai.yaml metadata (#11658)

2026-02-14 01:43:44 +00:00

seatbelt_platform_defaults.sbpl

fix: Restricted Read: /System is too permissive for macOS platform de… (#11798)

2026-02-17 23:56:35 -08:00

seatbelt.rs

fix: Restricted Read: /System is too permissive for macOS platform de… (#11798)

2026-02-17 23:56:35 -08:00

session_prefix.rs

feat: sub-agent injection (#12152)

2026-02-19 11:32:10 +00:00

shell_detect.rs

chore: rename codex-command to codex-shell-command (#11378)

2026-02-10 17:03:46 -08:00

shell_snapshot.rs

feat: add shell snapshot failure reason (#12233)

2026-02-19 13:49:12 +00:00

shell.rs

chore: rename codex-command to codex-shell-command (#11378)

2026-02-10 17:03:46 -08:00

spawn.rs

feat(sandbox): enforce proxy-aware network routing in sandbox (#11113)

2026-02-10 07:44:21 +00:00

state_db.rs

Ensure list_threads drops stale rollout files (#11572)

2026-02-12 12:49:31 +00:00

stream_events_utils.rs

feat(app-server, core): allow text + image content items for dynamic tool outputs (#10567)

2026-02-04 16:12:47 -08:00

tagged_block_parser.rs

Plan mode: stream proposed plans, emit plan items, and render in TUI (#9786)

2026-01-30 18:59:30 +00:00

terminal.rs

[codex-tui] exit when terminal is dumb (#9293)

2026-01-20 16:17:38 -08:00

test_support.rs

Remove test-support feature from codex-core and replace it with explicit test toggles (#11405)

2026-02-10 22:44:02 -08:00

text_encoding.rs

Fix: Improve text encoding for shell output in VSCode preview (#6178) (#6182)

2025-11-20 11:04:11 -08:00

thread_manager.rs

client side modelinfo overrides (#12101)

2026-02-19 10:38:57 -08:00

token_data.rs

fix(app-server): for external auth, replace id_token with chatgpt_acc… (#11240)

2026-02-09 20:48:58 -08:00

truncate.rs

core: add focused diagnostics for remote compaction overflows (#11133)

2026-02-09 12:42:20 -08:00

turn_diff_tracker.rs

chore: more clippy rules 2 (#4057)

2025-09-22 17:16:02 +00:00

turn_metadata.rs

fix(core): add linux bubblewrap sandbox tag (#11767)

2026-02-14 19:00:01 +00:00

user_shell_command.rs

chore: add phase to message responseitem (#10455)

2026-02-03 02:52:26 +00:00

util.rs

Cloud Requirements: increase timeout and retries (#10631)

2026-02-05 01:52:12 +00:00

web_search.rs

add missing fields to WebSearchAction and update app-server types (#10276)

2026-01-30 16:37:56 -08:00

windows_sandbox_read_grants.rs

add a slash command to grant sandbox read access to inaccessible directories (#11512)

2026-02-12 12:48:36 -08:00

windows_sandbox.rs

app-server support for Windows sandbox setup. (#12025)

2026-02-18 13:03:16 -08:00