mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Celia Chen
dd30c8eedd
## Summary This PR replaces the legacy network allow/deny list model with explicit rule maps for domains and unix sockets across managed requirements, permissions profiles, the network proxy config, and the app server protocol. Concretely, it: - introduces typed domain (`allow` / `deny`) and unix socket permission (`allow` / `none`) entries instead of separate `allowed_domains`, `denied_domains`, and `allow_unix_sockets` lists - updates config loading, managed requirements merging, and exec-policy overlays to read and upsert rule entries consistently - exposes the new shape through protocol/schema outputs, debug surfaces, and app-server config APIs - rejects the legacy list-based keys and updates docs/tests to reflect the new config format ## Why The previous representation split related network policy across multiple parallel lists, which made merging and overriding rules harder to reason about. Moving to explicit keyed permission maps gives us a single source of truth per host/socket entry, makes allow/deny precedence clearer, and gives protocol consumers access to the full rule state instead of derived projections only. ## Backward Compatibility ### Backward compatible - Managed requirements still accept the legacy `experimental_network.allowed_domains`, `experimental_network.denied_domains`, and `experimental_network.allow_unix_sockets` fields. They are normalized into the new canonical `domains` and `unix_sockets` maps internally. - App-server v2 still deserializes legacy `allowedDomains`, `deniedDomains`, and `allowUnixSockets` payloads, so older clients can continue reading managed network requirements. - App-server v2 responses still populate `allowedDomains`, `deniedDomains`, and `allowUnixSockets` as legacy compatibility views derived from the canonical maps. - `managed_allowed_domains_only` keeps the same behavior after normalization. Legacy managed allowlists still participate in the same enforcement path as canonical `domains` entries. ### Not backward compatible - Permissions profiles under `[permissions.<profile>.network]` no longer accept the legacy list-based keys. Those configs must use the canonical `[domains]` and `[unix_sockets]` tables instead of `allowed_domains`, `denied_domains`, or `allow_unix_sockets`. - Managed `experimental_network` config cannot mix canonical and legacy forms in the same block. For example, `domains` cannot be combined with `allowed_domains` or `denied_domains`, and `unix_sockets` cannot be combined with `allow_unix_sockets`. - The canonical format can express explicit `"none"` entries for unix sockets, but those entries do not round-trip through the legacy compatibility fields because the legacy fields only represent allow/deny lists. ## Testing `/target/debug/codex sandbox macos --log-denials /bin/zsh -c 'curl https://www.example.com' ` gives 200 with config ``` [permissions.workspace.network.domains] "www.example.com" = "allow" ``` and fails when set to deny: `curl: (56) CONNECT tunnel failed, response 403`. Also tested backward compatibility path by verifying that adding the following to `/etc/codex/requirements.toml` works: ``` [experimental_network] allowed_domains = ["www.example.com"] ```
70 lines
2.9 KiB
Rust
70 lines
2.9 KiB
Rust
mod cloud_requirements;
|
|
mod config_requirements;
|
|
mod constraint;
|
|
mod diagnostics;
|
|
mod fingerprint;
|
|
mod merge;
|
|
mod overrides;
|
|
mod project_root_markers;
|
|
mod requirements_exec_policy;
|
|
mod skills_config;
|
|
mod state;
|
|
|
|
pub const CONFIG_TOML_FILE: &str = "config.toml";
|
|
|
|
pub use cloud_requirements::CloudRequirementsLoadError;
|
|
pub use cloud_requirements::CloudRequirementsLoadErrorCode;
|
|
pub use cloud_requirements::CloudRequirementsLoader;
|
|
pub use config_requirements::AppRequirementToml;
|
|
pub use config_requirements::AppsRequirementsToml;
|
|
pub use config_requirements::ConfigRequirements;
|
|
pub use config_requirements::ConfigRequirementsToml;
|
|
pub use config_requirements::ConfigRequirementsWithSources;
|
|
pub use config_requirements::ConstrainedWithSource;
|
|
pub use config_requirements::FeatureRequirementsToml;
|
|
pub use config_requirements::McpServerIdentity;
|
|
pub use config_requirements::McpServerRequirement;
|
|
pub use config_requirements::NetworkConstraints;
|
|
pub use config_requirements::NetworkDomainPermissionToml;
|
|
pub use config_requirements::NetworkDomainPermissionsToml;
|
|
pub use config_requirements::NetworkRequirementsToml;
|
|
pub use config_requirements::NetworkUnixSocketPermissionToml;
|
|
pub use config_requirements::NetworkUnixSocketPermissionsToml;
|
|
pub use config_requirements::RequirementSource;
|
|
pub use config_requirements::ResidencyRequirement;
|
|
pub use config_requirements::SandboxModeRequirement;
|
|
pub use config_requirements::Sourced;
|
|
pub use config_requirements::WebSearchModeRequirement;
|
|
pub use constraint::Constrained;
|
|
pub use constraint::ConstraintError;
|
|
pub use constraint::ConstraintResult;
|
|
pub use diagnostics::ConfigError;
|
|
pub use diagnostics::ConfigLoadError;
|
|
pub use diagnostics::TextPosition;
|
|
pub use diagnostics::TextRange;
|
|
pub use diagnostics::config_error_from_toml;
|
|
pub use diagnostics::config_error_from_typed_toml;
|
|
pub use diagnostics::first_layer_config_error;
|
|
pub use diagnostics::first_layer_config_error_from_entries;
|
|
pub use diagnostics::format_config_error;
|
|
pub use diagnostics::format_config_error_with_source;
|
|
pub use diagnostics::io_error_from_config_error;
|
|
pub use fingerprint::version_for_toml;
|
|
pub use merge::merge_toml_values;
|
|
pub use overrides::build_cli_overrides_layer;
|
|
pub use project_root_markers::default_project_root_markers;
|
|
pub use project_root_markers::project_root_markers_from_config;
|
|
pub use requirements_exec_policy::RequirementsExecPolicy;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyDecisionToml;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyParseError;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyPatternTokenToml;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyPrefixRuleToml;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyToml;
|
|
pub use skills_config::BundledSkillsConfig;
|
|
pub use skills_config::SkillConfig;
|
|
pub use skills_config::SkillsConfig;
|
|
pub use state::ConfigLayerEntry;
|
|
pub use state::ConfigLayerStack;
|
|
pub use state::ConfigLayerStackOrdering;
|
|
pub use state::LoaderOverrides;
|