Skip to content

Type parent item ids for network approval reviews #15469

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
charley-oai wants to merge 12 commits into from
Closed

Type parent item ids for network approval reviews #15469

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
9fc1605
guardian: attach network approvals to parent tool items
charley-oai Mar 22, 2026
9e6f3de
codex: fix CI failure on PR #15439
charley-oai Mar 22, 2026
2c43c6d
codex: fix Bazel test failure on PR #15439
charley-oai Mar 22, 2026
7b565d1
codex: fix clippy follow-up on PR #15439
charley-oai Mar 22, 2026
d66e3df
app-server: keep unique guardian review ids
charley-oai Mar 22, 2026
33077d5
app-server: type network approval parent item ids
charley-oai Mar 22, 2026
8e2dc92
app-server: add review ids for guardian notifications
charley-oai Mar 22, 2026
7beebc0
core: populate guardian parent ids for direct reviews
charley-oai Mar 23, 2026
7d50d6c
core: relax shell snapshot apply_patch timeout
charley-oai Mar 23, 2026
58b860f
core: attribute network approvals to owning tool calls
charley-oai Mar 23, 2026
da3dc36
core: carry parent tool item id for network approvals
charley-oai Mar 24, 2026
95e8618
network-proxy: reduce proxy disabled args
charley-oai Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 36 additions & 2 deletions codex-rs/app-server-protocol/schema/json/ServerNotification.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1349,13 +1349,30 @@
"type": "object"
},
"ItemGuardianApprovalReviewCompletedNotification": {
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand All @@ -1374,13 +1391,30 @@
"type": "object"
},
"ItemGuardianApprovalReviewStartedNotification": {
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand Down
38 changes: 36 additions & 2 deletions codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8196,13 +8196,30 @@
},
"ItemGuardianApprovalReviewCompletedNotification": {
"$schema": "http://json-schema.org/draft-07/schema#",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/v2/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand All @@ -8223,13 +8240,30 @@
},
"ItemGuardianApprovalReviewStartedNotification": {
"$schema": "http://json-schema.org/draft-07/schema#",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/v2/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand Down
38 changes: 36 additions & 2 deletions codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4944,13 +4944,30 @@
},
"ItemGuardianApprovalReviewCompletedNotification": {
"$schema": "http://json-schema.org/draft-07/schema#",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand All @@ -4971,13 +4988,30 @@
},
"ItemGuardianApprovalReviewStartedNotification": {
"$schema": "http://json-schema.org/draft-07/schema#",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand Down
19 changes: 18 additions & 1 deletion ...s/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewCompletedNotification.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,30 @@
"type": "string"
}
},
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand Down
19 changes: 18 additions & 1 deletion ...-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewStartedNotification.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,30 @@
"type": "string"
}
},
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review. This shape is expected to change soon.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"description": "[UNSTABLE] Temporary notification payload for guardian automatic approval review.\n\nTODO(ccunningham): Attach guardian review state to the reviewed tool item's lifecycle instead of sending separate standalone review notifications so the app-server API can persist and replay review state via `thread/read`.",
"properties": {
"action": true,
"parentToolItemId": {
"default": null,
"description": "Reviewed parent tool item identifier. For direct tool reviews this matches `review_id`; attributed `network_access` reviews may differ, and unattributed `network_access` reviews may omit it.",
"type": [
"string",
"null"
]
},
"review": {
"$ref": "#/definitions/GuardianApprovalReview"
},
"reviewId": {
"default": null,
"description": "Stable guardian review identifier for matching started/completed events.",
"type": [
"string",
"null"
]
},
"targetItemId": {
"description": "Deprecated alias for `review_id`, retained for backwards compatibility.",
"type": "string"
},
"threadId": {
Expand Down
18 changes: 16 additions & 2 deletions ...p-server-protocol/schema/typescript/v2/ItemGuardianApprovalReviewCompletedNotification.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,24 @@ import type { GuardianApprovalReview } from "./GuardianApprovalReview";

/**
* [UNSTABLE] Temporary notification payload for guardian automatic approval
* review. This shape is expected to change soon.
* review.
*
* TODO(ccunningham): Attach guardian review state to the reviewed tool item's
* lifecycle instead of sending separate standalone review notifications so the
* app-server API can persist and replay review state via `thread/read`.
*/
export type ItemGuardianApprovalReviewCompletedNotification = { threadId: string, turnId: string, targetItemId: string, review: GuardianApprovalReview, action: JsonValue | null, };
export type ItemGuardianApprovalReviewCompletedNotification = { threadId: string, turnId: string,
/**
* Deprecated alias for `review_id`, retained for backwards compatibility.
*/
targetItemId: string,
/**
* Stable guardian review identifier for matching started/completed events.
*/
reviewId: string | null,
/**
* Reviewed parent tool item identifier. For direct tool reviews this
* matches `review_id`; attributed `network_access` reviews may differ,
* and unattributed `network_access` reviews may omit it.
*/
parentToolItemId: string | null, review: GuardianApprovalReview, action: JsonValue | null, };
18 changes: 16 additions & 2 deletions ...app-server-protocol/schema/typescript/v2/ItemGuardianApprovalReviewStartedNotification.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,24 @@ import type { GuardianApprovalReview } from "./GuardianApprovalReview";

/**
* [UNSTABLE] Temporary notification payload for guardian automatic approval
* review. This shape is expected to change soon.
* review.
*
* TODO(ccunningham): Attach guardian review state to the reviewed tool item's
* lifecycle instead of sending separate standalone review notifications so the
* app-server API can persist and replay review state via `thread/read`.
*/
export type ItemGuardianApprovalReviewStartedNotification = { threadId: string, turnId: string, targetItemId: string, review: GuardianApprovalReview, action: JsonValue | null, };
export type ItemGuardianApprovalReviewStartedNotification = { threadId: string, turnId: string,
/**
* Deprecated alias for `review_id`, retained for backwards compatibility.
*/
targetItemId: string,
/**
* Stable guardian review identifier for matching started/completed events.
*/
reviewId: string | null,
/**
* Reviewed parent tool item identifier. For direct tool reviews this
* matches `review_id`; attributed `network_access` reviews may differ,
* and unattributed `network_access` reviews may omit it.
*/
parentToolItemId: string | null, review: GuardianApprovalReview, action: JsonValue | null, };
22 changes: 20 additions & 2 deletions codex-rs/app-server-protocol/src/protocol/v2.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4830,15 +4830,24 @@ pub struct ItemStartedNotification {
#[serde(rename_all = "camelCase")]
#[ts(export_to = "v2/")]
/// [UNSTABLE] Temporary notification payload for guardian automatic approval
/// review. This shape is expected to change soon.
/// review.
///
/// TODO(ccunningham): Attach guardian review state to the reviewed tool item's
/// lifecycle instead of sending separate standalone review notifications so the
/// app-server API can persist and replay review state via `thread/read`.
pub struct ItemGuardianApprovalReviewStartedNotification {
pub thread_id: String,
pub turn_id: String,
/// Deprecated alias for `review_id`, retained for backwards compatibility.
pub target_item_id: String,
/// Stable guardian review identifier for matching started/completed events.
#[serde(default)]
pub review_id: Option<String>,
/// Reviewed parent tool item identifier. For direct tool reviews this
/// matches `review_id`; attributed `network_access` reviews may differ,
/// and unattributed `network_access` reviews may omit it.
#[serde(default)]
pub parent_tool_item_id: Option<String>,
pub review: GuardianApprovalReview,
pub action: Option<JsonValue>,
}
Expand All @@ -4847,15 +4856,24 @@ pub struct ItemGuardianApprovalReviewStartedNotification {
#[serde(rename_all = "camelCase")]
#[ts(export_to = "v2/")]
/// [UNSTABLE] Temporary notification payload for guardian automatic approval
/// review. This shape is expected to change soon.
/// review.
///
/// TODO(ccunningham): Attach guardian review state to the reviewed tool item's
/// lifecycle instead of sending separate standalone review notifications so the
/// app-server API can persist and replay review state via `thread/read`.
pub struct ItemGuardianApprovalReviewCompletedNotification {
pub thread_id: String,
pub turn_id: String,
/// Deprecated alias for `review_id`, retained for backwards compatibility.
pub target_item_id: String,
/// Stable guardian review identifier for matching started/completed events.
#[serde(default)]
pub review_id: Option<String>,
/// Reviewed parent tool item identifier. For direct tool reviews this
/// matches `review_id`; attributed `network_access` reviews may differ,
/// and unattributed `network_access` reviews may omit it.
#[serde(default)]
pub parent_tool_item_id: Option<String>,
pub review: GuardianApprovalReview,
pub action: Option<JsonValue>,
}
Expand Down
Loading
Loading