Skip to content

Add new enterprise requirement gate #23736

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adams-oai merged 3 commits into from
May 22, 2026
Merged

Add new enterprise requirement gate #23736

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
55f06cc
Add new enterprise requirement gate
adams-oai May 20, 2026
9158ca0
Fix enterprise requirement test fixtures
adams-oai May 20, 2026
f5ecbee
Leave app server README unchanged
adams-oai May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions codex-rs/app-server-protocol/src/protocol/v2/config.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -389,6 +389,7 @@ pub struct ConfigRequirements {
pub allowed_permissions: Option<Vec<String>>,
pub allowed_web_search_modes: Option<Vec<WebSearchMode>>,
pub allow_managed_hooks_only: Option<bool>,
pub allow_appshots: Option<bool>,
pub computer_use: Option<ComputerUseRequirements>,
pub feature_requirements: Option<BTreeMap<String, bool>>,
#[experimental("configRequirements/read.hooks")]
Expand Down
1 change: 1 addition & 0 deletions codex-rs/app-server-protocol/src/protocol/v2/tests.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1731,6 +1731,7 @@ fn config_requirements_granular_allowed_approval_policy_is_marked_experimental()
allowed_permissions: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
feature_requirements: None,
hooks: None,
Expand Down
12 changes: 12 additions & 0 deletions codex-rs/app-server/src/request_processors/config_processor.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -431,6 +431,7 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR
normalized
}),
allow_managed_hooks_only: requirements.allow_managed_hooks_only,
allow_appshots: requirements.allow_appshots,
computer_use: requirements
.computer_use
.map(map_computer_use_requirements_to_api),
Expand Down Expand Up @@ -658,6 +659,17 @@ mod tests {
assert_eq!(mapped.hooks, None);
}

#[test]
fn requirements_api_includes_allow_appshots() {
let mapped = map_requirements_toml_to_api(ConfigRequirementsToml {
allow_appshots: Some(false),
..ConfigRequirementsToml::default()
});

assert_eq!(mapped.allow_appshots, Some(false));
assert_eq!(mapped.hooks, None);
}

#[test]
fn requirements_api_includes_computer_use_requirements() {
let mapped = map_requirements_toml_to_api(ConfigRequirementsToml {
Expand Down
16 changes: 16 additions & 0 deletions codex-rs/cloud-requirements/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1220,6 +1220,7 @@ mod tests {
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1305,6 +1306,7 @@ mod tests {
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1341,6 +1343,7 @@ mod tests {
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1394,6 +1397,7 @@ mod tests {
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1576,6 +1580,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1659,6 +1664,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1740,6 +1746,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1949,6 +1956,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -1992,6 +2000,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2055,6 +2064,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2114,6 +2124,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2175,6 +2186,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2237,6 +2249,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2303,6 +2316,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2395,6 +2409,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down Expand Up @@ -2433,6 +2448,7 @@ command = "sample-mcp"
remote_sandbox_config: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
guardian_policy_config: None,
feature_requirements: None,
Expand Down
44 changes: 44 additions & 0 deletions codex-rs/config/src/config_requirements.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ pub struct ConfigRequirements {
pub permission_profile: ConstrainedWithSource<PermissionProfile>,
pub web_search_mode: ConstrainedWithSource<WebSearchMode>,
pub allow_managed_hooks_only: Option<Sourced<bool>>,
pub allow_appshots: Option<Sourced<bool>>,
pub computer_use: Option<Sourced<ComputerUseRequirementsToml>>,
pub feature_requirements: Option<Sourced<FeatureRequirementsToml>>,
pub managed_hooks: Option<ConstrainedWithSource<ManagedHooksRequirementsToml>>,
Expand Down Expand Up @@ -124,6 +125,7 @@ impl Default for ConfigRequirements {
/*source*/ None,
),
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
feature_requirements: None,
managed_hooks: None,
Expand Down Expand Up @@ -750,6 +752,7 @@ pub struct ConfigRequirementsToml {
pub remote_sandbox_config: Option<Vec<RemoteSandboxConfigToml>>,
pub allowed_web_search_modes: Option<Vec<WebSearchModeRequirement>>,
pub allow_managed_hooks_only: Option<bool>,
pub allow_appshots: Option<bool>,
pub computer_use: Option<ComputerUseRequirementsToml>,
#[serde(rename = "features", alias = "feature_requirements")]
pub feature_requirements: Option<FeatureRequirementsToml>,
Expand Down Expand Up @@ -801,6 +804,7 @@ pub struct ConfigRequirementsWithSources {
pub allowed_permissions: Option<Sourced<Vec<String>>>,
pub allowed_web_search_modes: Option<Sourced<Vec<WebSearchModeRequirement>>>,
pub allow_managed_hooks_only: Option<Sourced<bool>>,
pub allow_appshots: Option<Sourced<bool>>,
pub computer_use: Option<Sourced<ComputerUseRequirementsToml>>,
pub feature_requirements: Option<Sourced<FeatureRequirementsToml>>,
pub hooks: Option<Sourced<ManagedHooksRequirementsToml>>,
Expand Down Expand Up @@ -840,6 +844,7 @@ impl ConfigRequirementsWithSources {
remote_sandbox_config: _,
allowed_web_search_modes: _,
allow_managed_hooks_only: _,
allow_appshots: _,
computer_use: _,
feature_requirements: _,
hooks: _,
Expand Down Expand Up @@ -872,6 +877,7 @@ impl ConfigRequirementsWithSources {
allowed_permissions,
allowed_web_search_modes,
allow_managed_hooks_only,
allow_appshots,
computer_use,
feature_requirements,
hooks,
Expand Down Expand Up @@ -902,6 +908,7 @@ impl ConfigRequirementsWithSources {
allowed_permissions,
allowed_web_search_modes,
allow_managed_hooks_only,
allow_appshots,
computer_use,
feature_requirements,
hooks,
Expand All @@ -922,6 +929,7 @@ impl ConfigRequirementsWithSources {
remote_sandbox_config: None,
allowed_web_search_modes: allowed_web_search_modes.map(|sourced| sourced.value),
allow_managed_hooks_only: allow_managed_hooks_only.map(|sourced| sourced.value),
allow_appshots: allow_appshots.map(|sourced| sourced.value),
computer_use: computer_use.map(|sourced| sourced.value),
feature_requirements: feature_requirements.map(|sourced| sourced.value),
hooks: hooks.map(|sourced| sourced.value),
Expand Down Expand Up @@ -1008,6 +1016,7 @@ impl ConfigRequirementsToml {
&& self.remote_sandbox_config.is_none()
&& self.allowed_web_search_modes.is_none()
&& self.allow_managed_hooks_only.is_none()
&& self.allow_appshots.is_none()
&& self
.computer_use
.as_ref()
Expand Down Expand Up @@ -1054,6 +1063,7 @@ impl TryFrom<ConfigRequirementsWithSources> for ConfigRequirements {
allowed_permissions: _,
allowed_web_search_modes,
allow_managed_hooks_only,
allow_appshots,
computer_use,
feature_requirements,
hooks,
Expand Down Expand Up @@ -1291,6 +1301,7 @@ impl TryFrom<ConfigRequirementsWithSources> for ConfigRequirements {
permission_profile,
web_search_mode,
allow_managed_hooks_only,
allow_appshots,
computer_use,
feature_requirements,
managed_hooks,
Expand Down Expand Up @@ -1361,6 +1372,7 @@ mod tests {
remote_sandbox_config: _,
allowed_web_search_modes,
allow_managed_hooks_only,
allow_appshots,
computer_use,
feature_requirements,
hooks,
Expand All @@ -1386,6 +1398,8 @@ mod tests {
.map(|value| Sourced::new(value, RequirementSource::Unknown)),
allow_managed_hooks_only: allow_managed_hooks_only
.map(|value| Sourced::new(value, RequirementSource::Unknown)),
allow_appshots: allow_appshots
.map(|value| Sourced::new(value, RequirementSource::Unknown)),
computer_use: computer_use.map(|value| Sourced::new(value, RequirementSource::Unknown)),
feature_requirements: feature_requirements
.map(|value| Sourced::new(value, RequirementSource::Unknown)),
Expand Down Expand Up @@ -1466,6 +1480,19 @@ mod tests {
Ok(())
}

#[test]
fn deserialize_allow_appshots() -> Result<()> {
let requirements: ConfigRequirementsToml = from_str(
r#"
allow_appshots = true
"#,
)?;

assert_eq!(requirements.allow_appshots, Some(true));
assert!(!requirements.is_empty());
Ok(())
}

#[test]
fn filesystem_requirements_table_cannot_define_a_permission_profile() {
let err = from_str::<ConfigRequirementsToml>(
Expand All @@ -1484,6 +1511,19 @@ mod tests {
);
}

#[test]
fn allow_appshots_false_is_still_configured() -> Result<()> {
let requirements: ConfigRequirementsToml = from_str(
r#"
allow_appshots = false
"#,
)?;

assert_eq!(requirements.allow_appshots, Some(false));
assert!(!requirements.is_empty());
Ok(())
}

#[test]
fn deserialize_computer_use_requirements() -> Result<()> {
let requirements: ConfigRequirementsToml = from_str(
Expand Down Expand Up @@ -1539,6 +1579,7 @@ mod tests {
remote_sandbox_config: None,
allowed_web_search_modes: Some(allowed_web_search_modes.clone()),
allow_managed_hooks_only: Some(true),
allow_appshots: Some(false),
computer_use: Some(computer_use.clone()),
feature_requirements: Some(feature_requirements.clone()),
hooks: None,
Expand Down Expand Up @@ -1578,6 +1619,7 @@ mod tests {
/*value*/ true,
enforce_source.clone(),
)),
allow_appshots: Some(Sourced::new(/*value*/ false, enforce_source.clone(),)),
computer_use: Some(Sourced::new(computer_use, enforce_source.clone())),
feature_requirements: Some(Sourced::new(
feature_requirements,
Expand Down Expand Up @@ -1623,6 +1665,7 @@ mod tests {
allowed_permissions: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
feature_requirements: None,
hooks: None,
Expand Down Expand Up @@ -1673,6 +1716,7 @@ mod tests {
allowed_permissions: None,
allowed_web_search_modes: None,
allow_managed_hooks_only: None,
allow_appshots: None,
computer_use: None,
feature_requirements: None,
hooks: None,
Expand Down
Loading
Loading