Skip to content

[codex] Enforce exact managed config values - #28409

Closed
abhinav-oai wants to merge 10 commits into
abhinav/requirements-shell-rulesfrom
abhinav/requirements-exact-values
Closed

abhinav-oai wants to merge 10 commits into
abhinav/requirements-shell-rulesfrom
abhinav/requirements-exact-values

Conversation

@abhinav-oai

@abhinav-oai abhinav-oai commented Jun 15, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Extends requirements.toml with exact-value enforcement for:

  • sqlite_home
  • log_dir
  • model_catalog_json
  • check_for_update_on_startup
  • allow_login_shell
  • feedback.enabled
  • windows.sandbox_private_desktop

We emit a startup warning if these new requirements overrule a user's config.

Also centralizes config-loading in core/src/config/requirements.rs so we can apply requirements before Codex computes and exposes its final config.

App-server and replay

  • configRequirements/read and its generated schemas expose the exact managed values.
  • config/read reports the runtime-effective values after requirements are applied.
  • Writes overlapping a managed field are rejected with configRequirementReadonly.
  • Config locks persist replayable exact values so resumed sessions retain the original behavior.

Stack

PRs: #28411 → #28409 → #28410 → #28412 → #28414 → #28413

Position PR Branch
1 Keyed shell filters abhinav/requirements-shell-rules
2 Exact managed values — this PR abhinav/requirements-exact-values
3 Managed auth/bootstrap abhinav/requirements-auth-bootstrap
4 Managed OTEL abhinav/requirements-otel
5 Managed shell policy abhinav/requirements-shell-policy
6 App-server API/schemas abhinav/requirements-app-server-api

@abhinav-oai
abhinav-oai force-pushed the abhinav/requirements-shell-rules branch from 342a03b to 822b6dc Compare June 16, 2026 07:23
@abhinav-oai
abhinav-oai force-pushed the abhinav/requirements-exact-values branch from 6362b97 to a3edbe9 Compare June 16, 2026 07:23
/// If `false`, the model can never use a login shell: `login = true`
/// requests are rejected, and omitting `login` defaults to a non-login
/// shell.
#[serde(default = "default_allow_login_shell")]

@abhinav-oai abhinav-oai Jun 17, 2026 •

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final config still defaults with unwrap_or(true)

This change is just to avoid emitting a confusing warning to users

  • allow_login_shell deserialized as Some(true) is the same as the user explicitly setting true
  • if requirements are setting false we'd emit the warning

use codex_config::Sourced;
use codex_config::config_toml::ConfigToml;
use codex_config::types::FeedbackConfigToml;

@abhinav-oai abhinav-oai Jun 17, 2026 •

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Later PRs will grow this with managed auth/bootstrap, OTEL, and shell-policy application

Goal was to keep those concerns out of the already-large final Config constructor

@abhinav-oai
abhinav-oai marked this pull request as ready for review June 17, 2026 00:59
@abhinav-oai
abhinav-oai requested a review from a team as a code owner June 17, 2026 00:59

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 79dd7b63ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread codex-rs/config/src/requirements_layers/stack.rs
Comment thread codex-rs/core/src/config/requirements.rs
Comment thread codex-rs/config/src/config_requirements.rs
Comment thread codex-rs/core/src/config/requirements.rs
@abhinav-oai

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 498a1b3c28

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread codex-rs/app-server/src/config_manager_service.rs
Comment thread codex-rs/core/src/tasks/user_shell.rs
Comment thread codex-rs/config/src/config_requirements.rs
Comment thread codex-rs/app-server/src/config_manager_service.rs
@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants