feat: support permissions-scoped exec rules

Author: bolinfest

codex-rs/config/src/config_toml.rs

@@ -7,6 +7,7 @@ use std::path::Path;
 use crate::HooksToml;
 use crate::permissions_toml::PermissionsToml;
 use crate::profile_toml::ConfigProfile;
+use crate::requirements_exec_policy::RequirementsExecPolicyToml;
 use crate::types::AnalyticsConfigToml;
 use crate::types::ApprovalsReviewer;
 use crate::types::AppsConfigToml;
@@ -182,6 +183,10 @@ pub struct ConfigToml {
     #[serde(default)]
     pub auto_review: Option<AutoReviewToml>,
 
+    /// Optional command execution policy rules for this config layer.
+    #[serde(default)]
+    pub rules: Option<RequirementsExecPolicyToml>,
+
     #[serde(default)]
     pub shell_environment_policy: ShellEnvironmentPolicyToml,
 

codex-rs/config/src/requirements_exec_policy.rs

@@ -5,7 +5,9 @@ use codex_execpolicy::rule::PatternToken;
 use codex_execpolicy::rule::PrefixPattern;
 use codex_execpolicy::rule::PrefixRule;
 use multimap::MultiMap;
+use schemars::JsonSchema;
 use serde::Deserialize;
+use serde::Serialize;
 use std::sync::Arc;
 use thiserror::Error;
 
@@ -46,33 +48,34 @@ fn policy_fingerprint(policy: &Policy) -> Vec<String> {
 }
 
 /// TOML representation of `[rules]` within `requirements.toml`.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
 pub struct RequirementsExecPolicyToml {
     pub prefix_rules: Vec<RequirementsExecPolicyPrefixRuleToml>,
 }
 
 /// A TOML representation of the `prefix_rule(...)` Starlark builtin.
 ///
 /// This mirrors the builtin defined in `execpolicy/src/parser.rs`.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
 pub struct RequirementsExecPolicyPrefixRuleToml {
     pub pattern: Vec<RequirementsExecPolicyPatternTokenToml>,
     pub decision: Option<RequirementsExecPolicyDecisionToml>,
     pub justification: Option<String>,
+    pub permissions: Option<String>,
 }
 
 /// TOML-friendly representation of a pattern token.
 ///
 /// Starlark supports either a string token or a list of alternative tokens at
 /// each position, but TOML arrays cannot mix strings and arrays. Using an
 /// array of tables sidesteps that restriction.
-#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
 pub struct RequirementsExecPolicyPatternTokenToml {
     pub token: Option<String>,
     pub any_of: Option<Vec<String>>,
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
 pub enum RequirementsExecPolicyDecisionToml {
     Allow,
@@ -110,6 +113,9 @@ pub enum RequirementsExecPolicyParseError {
     #[error("rules prefix_rule at index {rule_index} has an empty justification")]
     EmptyJustification { rule_index: usize },
 
+    #[error("rules prefix_rule at index {rule_index} has an empty permissions value")]
+    EmptyPermissions { rule_index: usize },
+
     #[error("rules prefix_rule at index {rule_index} is missing a decision")]
     MissingDecision { rule_index: usize },
 
@@ -123,6 +129,22 @@ impl RequirementsExecPolicyToml {
     /// Convert requirements TOML rules into the internal `.rules`
     /// representation used by `codex-execpolicy`.
     pub fn to_policy(&self) -> Result<Policy, RequirementsExecPolicyParseError> {
+        self.to_policy_with_allow_rules(/*allow_allow_decision*/ false)
+    }
+
+    /// Convert config TOML rules into the internal `.rules` representation.
+    ///
+    /// Unlike `requirements.toml`, regular config layers may contain allow
+    /// rules because they are user/project policy rather than managed
+    /// restrictions.
+    pub fn to_config_policy(&self) -> Result<Policy, RequirementsExecPolicyParseError> {
+        self.to_policy_with_allow_rules(/*allow_allow_decision*/ true)
+    }
+
+    fn to_policy_with_allow_rules(
+        &self,
+        allow_allow_decision: bool,
+    ) -> Result<Policy, RequirementsExecPolicyParseError> {
         if self.prefix_rules.is_empty() {
             return Err(RequirementsExecPolicyParseError::EmptyPrefixRules);
         }
@@ -135,6 +157,11 @@ impl RequirementsExecPolicyToml {
             {
                 return Err(RequirementsExecPolicyParseError::EmptyJustification { rule_index });
             }
+            if let Some(permissions) = &rule.permissions
+                && permissions.trim().is_empty()
+            {
+                return Err(RequirementsExecPolicyParseError::EmptyPermissions { rule_index });
+            }
 
             if rule.pattern.is_empty() {
                 return Err(RequirementsExecPolicyParseError::EmptyPattern { rule_index });
@@ -148,7 +175,7 @@ impl RequirementsExecPolicyToml {
                 .collect::<Result<Vec<_>, _>>()?;
 
             let decision = match rule.decision {
-                Some(RequirementsExecPolicyDecisionToml::Allow) => {
+                Some(RequirementsExecPolicyDecisionToml::Allow) if !allow_allow_decision => {
                     return Err(RequirementsExecPolicyParseError::AllowDecisionNotAllowed {
                         rule_index,
                     });
@@ -159,6 +186,7 @@ impl RequirementsExecPolicyToml {
                 }
             };
             let justification = rule.justification.clone();
+            let permissions = rule.permissions.clone();
 
             let (first_token, remaining_tokens) = pattern_tokens
                 .split_first()
@@ -174,6 +202,7 @@ impl RequirementsExecPolicyToml {
                     },
                     decision,
                     justification: justification.clone(),
+                    permissions: permissions.clone(),
                 });
                 rules_by_program.insert(head.clone(), rule);
             }

codex-rs/core/config.schema.json

@@ -2708,6 +2708,68 @@
         }
       ]
     },
+    "RequirementsExecPolicyDecisionToml": {
+      "enum": [
+        "allow",
+        "prompt",
+        "forbidden"
+      ],
+      "type": "string"
+    },
+    "RequirementsExecPolicyPatternTokenToml": {
+      "description": "TOML-friendly representation of a pattern token.\n\nStarlark supports either a string token or a list of alternative tokens at each position, but TOML arrays cannot mix strings and arrays. Using an array of tables sidesteps that restriction.",
+      "properties": {
+        "any_of": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "token": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "RequirementsExecPolicyPrefixRuleToml": {
+      "description": "A TOML representation of the `prefix_rule(...)` Starlark builtin.\n\nThis mirrors the builtin defined in `execpolicy/src/parser.rs`.",
+      "properties": {
+        "decision": {
+          "$ref": "#/definitions/RequirementsExecPolicyDecisionToml"
+        },
+        "justification": {
+          "type": "string"
+        },
+        "pattern": {
+          "items": {
+            "$ref": "#/definitions/RequirementsExecPolicyPatternTokenToml"
+          },
+          "type": "array"
+        },
+        "permissions": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "pattern"
+      ],
+      "type": "object"
+    },
+    "RequirementsExecPolicyToml": {
+      "description": "TOML representation of `[rules]` within `requirements.toml`.",
+      "properties": {
+        "prefix_rules": {
+          "items": {
+            "$ref": "#/definitions/RequirementsExecPolicyPrefixRuleToml"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "prefix_rules"
+      ],
+      "type": "object"
+    },
     "RolloutBudgetConfigToml": {
       "additionalProperties": false,
       "properties": {
@@ -5410,6 +5472,15 @@
       "description": "Review model override used by the `/review` feature.",
       "type": "string"
     },
+    "rules": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/RequirementsExecPolicyToml"
+        }
+      ],
+      "default": null,
+      "description": "Optional command execution policy rules for this config layer."
+    },
     "sandbox_mode": {
       "allOf": [
         {

codex-rs/core/src/config/config_loader_tests.rs

@@ -3515,6 +3515,7 @@ mod requirements_exec_policy_tests {
     use codex_config::RequirementsExecPolicyToml;
     use codex_execpolicy::Decision;
     use codex_execpolicy::Evaluation;
+    use codex_execpolicy::MatchOptions;
     use codex_execpolicy::RuleMatch;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use pretty_assertions::assert_eq;
@@ -3572,6 +3573,7 @@ prefix_rules = [
                     }],
                     decision: Some(RequirementsExecPolicyDecisionToml::Forbidden),
                     justification: None,
+                    permissions: None,
                 }],
             }
         );
@@ -3601,6 +3603,7 @@ prefix_rules = [
                         }],
                         decision: Some(RequirementsExecPolicyDecisionToml::Forbidden),
                         justification: None,
+                        permissions: None,
                     },
                     RequirementsExecPolicyPrefixRuleToml {
                         pattern: vec![
@@ -3615,6 +3618,7 @@ prefix_rules = [
                         ],
                         decision: Some(RequirementsExecPolicyDecisionToml::Prompt),
                         justification: Some("review changes before push or commit".to_string()),
+                        permissions: None,
                     },
                 ],
             }
@@ -3650,6 +3654,58 @@ prefix_rules = [
         Ok(())
     }
 
+    #[test]
+    fn converts_rules_toml_permissions_scope() -> anyhow::Result<()> {
+        let toml_str = r#"
+prefix_rules = [
+    { pattern = [{ token = "git" }, { token = "status" }], decision = "prompt", permissions = "strict" },
+]
+"#;
+
+        let parsed: RequirementsExecPolicyToml = from_str(toml_str)?;
+        let policy = parsed.to_policy()?;
+        let command = tokens(&["git", "status"]);
+
+        assert_eq!(
+            policy.check_with_options(
+                &command,
+                &|_| Decision::Allow,
+                &MatchOptions {
+                    active_permission_profile: Some("strict".to_string()),
+                    ..MatchOptions::default()
+                }
+            ),
+            Evaluation {
+                decision: Decision::Prompt,
+                matched_rules: vec![RuleMatch::PrefixRuleMatch {
+                    matched_prefix: command.clone(),
+                    decision: Decision::Prompt,
+                    resolved_program: None,
+                    justification: None,
+                }],
+            }
+        );
+        assert_eq!(
+            policy.check_with_options(
+                &command,
+                &|_| Decision::Allow,
+                &MatchOptions {
+                    active_permission_profile: Some("relaxed".to_string()),
+                    ..MatchOptions::default()
+                }
+            ),
+            Evaluation {
+                decision: Decision::Allow,
+                matched_rules: vec![RuleMatch::HeuristicsRuleMatch {
+                    command,
+                    decision: Decision::Allow,
+                }],
+            }
+        );
+
+        Ok(())
+    }
+
     #[test]
     fn head_any_of_expands_into_multiple_program_rules() -> anyhow::Result<()> {
         let toml_str = r#"