Dylan Hurd

Require approval for input to escalated terminals (#40978) ## What changed - Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal. - Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged. - Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input. ## Testing - Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering. GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d

Represent terminal input in approval reviews (#40528) ## What changed - Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details. - Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events. - Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics. - Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history. ## Testing - Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input. GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950

Propagate approval rejection reasons (#34400) ## What changed - Change `ReviewDecision::Denied` to carry a rejection string and update the generated protocol schemas. - Preserve specific rejection reasons through command, patch, network, MCP, delegated, and automatic approval flows so tool results can return them to the model. - Distinguish invalid approval responses from user declines and truncate oversized rejection messages before adding them to model context. ## Testing - Add coverage for denial serialization, invalid app-server approval responses, dropped automatic reviews, network rejection propagation, and rejection-message truncation. GitOrigin-RevId: d48a55643aa03c7ecfa08a8e4b669913eec5464a

Route network access through the shared approval pipeline (#38299) ## What changed - Represent blocked network requests as approval actions so permission hooks, automatic review, and user review use the common approval flow. - Route network requests using the active turn's review settings, including for background terminals started by an earlier turn. - Record the final applied network decision in tool telemetry without exposing the destination or assigning an approval source. - Persist deny amendments and keep the blocked request denied. ## Testing Added coverage for strict automatic review, cross-turn background network requests, deny amendment persistence, and destination-safe telemetry. GitOrigin-RevId: a2a9d106962f407ed93f4d198f40ced15f090b8e

Route blocked network requests to their owning calls (#32897) ## Why Policy-blocked proxy requests must terminate the corresponding active tool call and preserve the correct approval result, including when multiple calls are running concurrently. ## What changed - Resolve a blocked request's execution ID to its registered active network call before recording the policy denial. - Preserve an outcome already recorded for that call, and cancel the owning call after storing a new denial. ## Testing Expand network approval integration coverage for Guardian and user decisions, permission hooks, persisted policy amendments, concurrent calls, timeouts, cancellations, and unattributed proxy requests. GitOrigin-RevId: 961901bbc07cc498309453ec78cda1a56ab00a4b

Route MCP tool calls through shared approval handling (#38108) ## What changed - Represent MCP tool calls as approval actions and route them through the session-level approval flow for permission hooks, reviewer selection, rejection handling, and resolution telemetry. - Preserve MCP-specific user prompts, session and persistent approval choices, and the approval policy and reviewer captured for the tool call. ## Testing - Add coverage for permission hooks resolving MCP calls before user or automatic review, persistence choices, captured policy routing, and MCP turn metadata with strict automatic review enabled. GitOrigin-RevId: 8e134b3d17a19dc62b3b56076d2cd05a54c9f638

Use model catalog approval messages (#31312) ## Why Approval guidance is currently assembled entirely by the client. Model Messages V2 needs model catalogs to provide model-specific `on_request` guidance for both user-reviewed and auto-reviewed approval flows while retaining the existing generated prompt as a compatibility fallback. ## What changed - add nullable `on_request` and `on_request_auto_review` catalog messages - select the message matching the active approvals reviewer for `on_request` policies - replace the complete legacy approval section when the selected catalog value exists, including support for an empty string that suppresses the section - retain legacy rendering when the object or selected key is absent, and for non-`on_request` policies - preserve approval messages when base-instruction or personality overrides clear instruction templates - refresh permissions instructions when the active model changes - pass catalog messages through initial and incremental permissions construction ## Relationship to reviewer persistence PR #31309 independently persists the approvals reviewer in turn context and refreshes permissions when that reviewer changes. This PR is based directly on `main` and does not duplicate that rollout migration; once both land, reviewer switches will also select and append the new catalog variant. ## Testing - `just test -p codex-protocol` - `just test -p codex-prompts` - `just test -p codex-models-manager` - `just test -p codex-core permissions_messages`

Include policy approval reasons in Guardian reviews (#36939) ## Why Guardian reviews received sandbox retry reasons, but not the execution-policy reason that triggered an initial approval request. ## What changed - Propagate approval and retry reasons through the tool approval flow and include the applicable reason in the Guardian prompt. - Prefer a sandbox retry reason when both are available. - Truncate approval context to 512 tokens while preserving the start and end of the reason. ## Testing Added prompt and integration coverage for policy reasons, retry precedence, and truncation. GitOrigin-RevId: 5b0f4e1c40b792b031bc8f7b31685a61d12b8d92

Strengthen forced `rm` command detection (#33464) ## Why Forced `rm` commands can appear inside complex shell syntax or use option and wrapper variants that the existing dangerous-command heuristic does not recognize. ## What changed - Detect literal forced `rm` invocations in control flow, substitutions, pipelines, traps, nested shells, and `sudo` or `env` wrappers. - Recognize combined, separate, and long-form force options, including when they follow operands. - Require approval for these commands, or reject them with a safer-alternative explanation when approvals are disabled, even when the sandbox is disabled. - Preserve existing rejection reasons for other dangerous commands and explicit policy rules. ## Testing Add unit, policy, and end-to-end coverage for forced `rm` variants, complex shell scripts, approval requests, and rejection messages. GitOrigin-RevId: e1fabc55324e788bae00ab24aae50d089eb7b058

Report network disconnects during approval (#39284) ## Why When a local proxy request disconnects before network approval completes, the owning tool call needs a model-visible explanation instead of remaining tied to the abandoned request. ## What changed - Track disconnect timing while plain HTTP and CONNECT requests await policy decisions. - Cancel the owning execution and report how long the request waited when it disconnects before approval completes. - Preserve an explicit approval outcome when disconnect cleanup runs afterward. ## Testing Added unit coverage for disconnect tracking and outcome precedence, plus end-to-end coverage for plain HTTP and CONNECT requests. GitOrigin-RevId: b354b29bbe86f38e252fcaf529541f177480136b