mirror of
https://github.com/openai/codex.git
synced 2026-05-05 05:42:33 +03:00
ab26554a3a
## Why Customers need finer-grained control over allowed sandbox modes based on the host Codex is running on. For example, they may want stricter sandbox limits on devboxes while keeping a different default elsewhere. Our current cloud requirements can target user/account groups, but they cannot vary sandbox requirements by host. That makes remote development environments awkward because the same top-level `allowed_sandbox_modes` has to apply everywhere. ## What Adds a new `remote_sandbox_config` section to `requirements.toml`: ```toml allowed_sandbox_modes = ["read-only"] [[remote_sandbox_config]] hostname_patterns = ["*.org"] allowed_sandbox_modes = ["read-only", "workspace-write"] [[remote_sandbox_config]] hostname_patterns = ["*.sh", "runner-*.ci"] allowed_sandbox_modes = ["read-only", "danger-full-access"] ``` During requirements resolution, Codex resolves the local host name once, preferring the machine FQDN when available and falling back to the cleaned kernel hostname. This host classification is best effort rather than authenticated device proof. Each requirements source applies its first matching `remote_sandbox_config` entry before it is merged with other sources. The shared merge helper keeps that `apply_remote_sandbox_config` step paired with requirements merging so new requirements sources do not have to remember the extra call. That preserves source precedence: a lower-precedence requirements file with a matching `remote_sandbox_config` cannot override a higher-precedence source that already set `allowed_sandbox_modes`. This also wires the hostname-aware resolution through app-server, CLI/TUI config loading, config API reads, and config layer metadata so they all evaluate remote sandbox requirements consistently. ## Verification - `cargo test -p codex-config remote_sandbox_config` - `cargo test -p codex-config host_name` - `cargo test -p codex-core load_config_layers_applies_matching_remote_sandbox_config` - `cargo test -p codex-core system_remote_sandbox_config_keeps_cloud_sandbox_modes` - `cargo test -p codex-config` - `cargo test -p codex-core` unit tests passed; `tests/all.rs` integration matrix was intentionally stopped after the relevant focused tests passed - `just fix -p codex-config` - `just fix -p codex-core` - `cargo check -p codex-app-server`
111 lines
4.4 KiB
Rust
111 lines
4.4 KiB
Rust
mod cloud_requirements;
|
|
mod config_requirements;
|
|
pub mod config_toml;
|
|
mod constraint;
|
|
mod diagnostics;
|
|
mod fingerprint;
|
|
mod host_name;
|
|
mod key_aliases;
|
|
mod marketplace_edit;
|
|
mod mcp_edit;
|
|
mod mcp_types;
|
|
mod merge;
|
|
mod overrides;
|
|
pub mod permissions_toml;
|
|
pub mod profile_toml;
|
|
mod project_root_markers;
|
|
mod requirements_exec_policy;
|
|
pub mod schema;
|
|
pub mod shell_environment;
|
|
mod skills_config;
|
|
mod state;
|
|
mod thread_config;
|
|
pub mod types;
|
|
|
|
pub const CONFIG_TOML_FILE: &str = "config.toml";
|
|
|
|
pub use cloud_requirements::CloudRequirementsLoadError;
|
|
pub use cloud_requirements::CloudRequirementsLoadErrorCode;
|
|
pub use cloud_requirements::CloudRequirementsLoader;
|
|
pub use config_requirements::AppRequirementToml;
|
|
pub use config_requirements::AppsRequirementsToml;
|
|
pub use config_requirements::ConfigRequirements;
|
|
pub use config_requirements::ConfigRequirementsToml;
|
|
pub use config_requirements::ConfigRequirementsWithSources;
|
|
pub use config_requirements::ConstrainedWithSource;
|
|
pub use config_requirements::FeatureRequirementsToml;
|
|
pub use config_requirements::FilesystemConstraints;
|
|
pub use config_requirements::FilesystemDenyReadPattern;
|
|
pub use config_requirements::McpServerIdentity;
|
|
pub use config_requirements::McpServerRequirement;
|
|
pub use config_requirements::NetworkConstraints;
|
|
pub use config_requirements::NetworkDomainPermissionToml;
|
|
pub use config_requirements::NetworkDomainPermissionsToml;
|
|
pub use config_requirements::NetworkRequirementsToml;
|
|
pub use config_requirements::NetworkUnixSocketPermissionToml;
|
|
pub use config_requirements::NetworkUnixSocketPermissionsToml;
|
|
pub use config_requirements::RemoteSandboxConfigToml;
|
|
pub use config_requirements::RequirementSource;
|
|
pub use config_requirements::ResidencyRequirement;
|
|
pub use config_requirements::SandboxModeRequirement;
|
|
pub use config_requirements::Sourced;
|
|
pub use config_requirements::WebSearchModeRequirement;
|
|
pub use constraint::Constrained;
|
|
pub use constraint::ConstraintError;
|
|
pub use constraint::ConstraintResult;
|
|
pub use diagnostics::ConfigError;
|
|
pub use diagnostics::ConfigLoadError;
|
|
pub use diagnostics::TextPosition;
|
|
pub use diagnostics::TextRange;
|
|
pub use diagnostics::config_error_from_toml;
|
|
pub use diagnostics::config_error_from_typed_toml;
|
|
pub use diagnostics::first_layer_config_error;
|
|
pub use diagnostics::first_layer_config_error_from_entries;
|
|
pub use diagnostics::format_config_error;
|
|
pub use diagnostics::format_config_error_with_source;
|
|
pub use diagnostics::io_error_from_config_error;
|
|
pub use fingerprint::version_for_toml;
|
|
pub use host_name::host_name;
|
|
pub use marketplace_edit::MarketplaceConfigUpdate;
|
|
pub use marketplace_edit::RemoveMarketplaceConfigOutcome;
|
|
pub use marketplace_edit::record_user_marketplace;
|
|
pub use marketplace_edit::remove_user_marketplace;
|
|
pub use marketplace_edit::remove_user_marketplace_config;
|
|
pub use mcp_edit::ConfigEditsBuilder;
|
|
pub use mcp_edit::load_global_mcp_servers;
|
|
pub use mcp_types::AppToolApproval;
|
|
pub use mcp_types::McpServerConfig;
|
|
pub use mcp_types::McpServerDisabledReason;
|
|
pub use mcp_types::McpServerEnvVar;
|
|
pub use mcp_types::McpServerToolConfig;
|
|
pub use mcp_types::McpServerTransportConfig;
|
|
pub use mcp_types::RawMcpServerConfig;
|
|
pub use merge::merge_toml_values;
|
|
pub use overrides::build_cli_overrides_layer;
|
|
pub use project_root_markers::default_project_root_markers;
|
|
pub use project_root_markers::project_root_markers_from_config;
|
|
pub use requirements_exec_policy::RequirementsExecPolicy;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyDecisionToml;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyParseError;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyPatternTokenToml;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyPrefixRuleToml;
|
|
pub use requirements_exec_policy::RequirementsExecPolicyToml;
|
|
pub use skills_config::BundledSkillsConfig;
|
|
pub use skills_config::SkillConfig;
|
|
pub use skills_config::SkillsConfig;
|
|
pub use state::ConfigLayerEntry;
|
|
pub use state::ConfigLayerStack;
|
|
pub use state::ConfigLayerStackOrdering;
|
|
pub use state::LoaderOverrides;
|
|
pub use thread_config::NoopThreadConfigLoader;
|
|
pub use thread_config::SessionThreadConfig;
|
|
pub use thread_config::StaticThreadConfigLoader;
|
|
pub use thread_config::ThreadConfigContext;
|
|
pub use thread_config::ThreadConfigLoadError;
|
|
pub use thread_config::ThreadConfigLoadErrorCode;
|
|
pub use thread_config::ThreadConfigLoader;
|
|
pub use thread_config::ThreadConfigSource;
|
|
pub use thread_config::UserThreadConfig;
|
|
|
|
pub use codex_app_server_protocol::ConfigLayerSource;
|