Repository navigation
feat(agents): Codex asks the owner before it acts (A3b of spec 30) - #250
Merged
Merged
Conversation
approvalPolicy on-request (never in plan mode): a command or a file change the sandbox does not allow reaches the chat as the usual approval card, with the bot's 'allow always' rules and its mode (bypass, accept edits). A request that names a fenced folder is refused without asking. The decoder moves to codex_decoder.rs and gets the shared daemon to wait for the owner in a task. Checked with the real codex: allowed, the file was made; denied, it was not.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second slice of Codex bots (#249): the bot is no longer limited to reading.
Asking. The thread runs with
approvalPolicy: on-request(neverfor a bot in plan mode) in theread-onlysandbox. A command that needs more than reading, or a file change, arrives fromcodex app-serveras a request. It becomes the usual approval card (Bashwith the command,Write/Editwith the path from the item'sitem/started), goes through the bot's 'allow always' rules and its mode (bypass_permissionsallows;accept_editsallows edits and still asks for commands), and the answer goes back asaccept/decline. The tool of a non-Botloft MCP server asks too; Botloft's own tools do not.Fences. A request whose path or command names a folder Botloft fences (spec 7.5; slashes and case aside) is declined without making a card.
Plumbing.
approvals::agent_request(rules, then the owner) is the shared entry for an agent that asks in its own protocol;OutputDecoder::handletakes&Arc<Daemon>so the wait runs in a task while the output goes on; the decoder moved tocodex_decoder.rs. The dialog's warning and the README say what is true now.Real Codex 0.148.0-alpha.9, dev daemon. A command that writes a file arrived as a
Bashcard, the bot went toneeds_approval; allowed, the file was created and the bot said so; denied, nothing was created and the bot reported the denial.Not covered (spec 30.3.2). Reading is not fenced: a read-only command runs without asking, so a fenced folder can be read by a command. No model picker or images yet (A3c).
Tests:
codex_bot.rs(change allowed/denied by the owner, command card and crew tools, fenced folders, mode), a unit test for the fence match; fmt, clippy -D warnings,cargo test --workspaceandpnpm checkpass.