feat(codex): codexConnectorWrites toggle for ChatGPT-connector write tools#1322
Open
cyrusagent wants to merge 2 commits into
Open
feat(codex): codexConnectorWrites toggle for ChatGPT-connector write tools#1322cyrusagent wants to merge 2 commits into
cyrusagent wants to merge 2 commits into
Conversation
…tools Adds a "enabled" | "disabled" policy (default "enabled") controlling whether Codex sessions may use mutating tools from ChatGPT-account connectors (the host-owned codex_apps MCP server, e.g. the Linear connector). With the elicitation auto-accept fix, connector writes now silently succeed under approvalPolicy "never"; this gives operators an explicit off switch. When disabled, CodexConfigBuilder emits apps._default.destructive_enabled=false / open_world_enabled=false into the per-thread config overrides. Codex then blocks destructive and open-world connector tools BEFORE any approval flow, with a clear "blocked by app configuration" error the model can relay. Tools annotated read-only and regular mcp_servers entries are unaffected (verified against the real 0.137 binary: a mutating mcp_servers tool still executes with the override present). Configuration surface: - config.json: top-level codexConnectorWrites, overridable per repository (repo value wins) - env: CYRUS_CODEX_CONNECTOR_WRITES (strict "enabled"/"disabled" parse with a warning on anything else; wins over the global config value, loses to an explicit per-repo value) - hot-reload: wired into ConfigManager's merge whitelist + globalKeys - chat sessions (repo-agnostic) get the global value via createRunner JSON schemas regenerated for the new fields.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #1321. With elicitation auto-accept in place, mutating tools from ChatGPT-account connectors (the host-owned
codex_appsMCP server — e.g. the bundled Linear connector) now silently succeed in Codex sessions. This adds the operator off switch: acodexConnectorWrites: "enabled" | "disabled"policy (default"enabled").Semantics
"Disabled" does not decline approval prompts — it blocks the tools upstream.
CodexConfigBuilderemits per-thread config overrides:Codex then refuses destructive/open-world connector tools before any approval flow, with a clear
"MCP tool call blocked by app configuration"error the model can relay (vs. the misleading "user rejected" a decline would produce). Connector tools annotated read-only and all regularmcp_serversentries are unaffected. The_defaultkey and snake_case fields match codex'sAppsConfigTomlexactly (it rejects unknown fields).This also avoids a pooling conflict: the server-request handler lives on the pooled app-server process shared across sessions, so per-session policy belongs on
thread/startconfig — the same channel as the per-thread sandbox profiles.Configuration surface
repositories[].codexConnectorWritesCYRUS_CODEX_CONNECTOR_WRITESenv var (loaded from~/.cyrus/.env)codexConnectorWritesinconfig.jsonEnv parsing is strict (
enabled/disabled, case-insensitive; anything else warns and is ignored), matching theCYRUS_HOST_EXTERNALconvention. Hot-reload is wired (ConfigManager merge whitelist +globalKeys). Chat sessions (repo-agnostic) get the global value via thecreateRunnerinjection with a live config read.Validation
thread/startwith theapps._defaultoverride is accepted, and a regularmcp_serversmutating tool still executes with the override present — proving the block is scoped tocodex_appsonly. (A live connector-write block test was deliberately skipped: if the block failed, the test would mutate a real third-party account. The gate logic itself is codex's own unit-testedapp_tool_policy_from_apps_configpath.)CodexConfigBuilder.connector-writes.test.ts(emission, default-off, merge preservation with caller-suppliedappsoverrides) andRunnerConfigBuilder.codex-connector-writes.test.ts(plumbing, codex-only).pnpm test:packages:rungreen (722 edge-worker / 77 codex-runner / 137 core),pnpm typecheckclean, JSON schemas regenerated (generate:json-schema).Follow-up (CYHOST)
cyrus-hosted needs the GUI toggle + config emission for cloud users — runner-settings section, not the
/settings/toolstool catalog.🤖 Generated with Claude Code