chore: add a separate reject-policy flag for skill approvals (#14271)

celia-oai · web-flow · commit 295b56bece8e · 2026-03-10T23:58:23.000Z
## Summary
- add `skill_approval` to `RejectConfig` and the app-server v2
`AskForApproval::Reject` payload so skill-script prompts can be
configured independently from sandbox and rule-based prompts
- update Unix shell escalation to reject prompts based on the actual
decision source, keeping prefix rules tied to `rules`, unmatched command
fallbacks tied to `sandbox_approval`, and skill scripts tied to
`skill_approval`
- regenerate the affected protocol/config schemas and expand
unit/integration coverage for the new flag and skill approval behavior
diff --git a/codex-rs/app-server-protocol/schema/json/ClientRequest.json b/codex-rs/app-server-protocol/schema/json/ClientRequest.json
@@ -66,6 +66,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/EventMsg.json b/codex-rs/app-server-protocol/schema/json/EventMsg.json
@@ -4944,6 +4944,11 @@
         "sandbox_approval": {
           "description": "Reject approval prompts related to sandbox escalation.",
           "type": "boolean"
+        },
+        "skill_approval": {
+          "default": false,
+          "description": "Reject approval prompts triggered by skill script execution.",
+          "type": "boolean"
         }
       },
       "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
@@ -6911,6 +6911,11 @@
         "sandbox_approval": {
           "description": "Reject approval prompts related to sandbox escalation.",
           "type": "boolean"
+        },
+        "skill_approval": {
+          "default": false,
+          "description": "Reject approval prompts triggered by skill script execution.",
+          "type": "boolean"
         }
       },
       "required": [
@@ -9433,6 +9438,10 @@
                   },
                   "sandbox_approval": {
                     "type": "boolean"
+                  },
+                  "skill_approval": {
+                    "default": false,
+                    "type": "boolean"
                   }
                 },
                 "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
@@ -740,6 +740,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
@@ -157,6 +157,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
@@ -29,6 +29,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
@@ -29,6 +29,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
@@ -33,6 +33,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
@@ -29,6 +29,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
@@ -33,6 +33,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
@@ -29,6 +29,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
@@ -33,6 +33,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
@@ -33,6 +33,10 @@
                 },
                 "sandbox_approval": {
                   "type": "boolean"
+                },
+                "skill_approval": {
+                  "default": false,
+                  "type": "boolean"
                 }
               },
               "required": [
diff --git a/codex-rs/app-server-protocol/schema/typescript/RejectConfig.ts b/codex-rs/app-server-protocol/schema/typescript/RejectConfig.ts
@@ -11,6 +11,10 @@ sandbox_approval: boolean,
  * Reject prompts triggered by execpolicy `prompt` rules.
  */
 rules: boolean, 
+/**
+ * Reject approval prompts triggered by skill script execution.
+ */
+skill_approval: boolean, 
 /**
  * Reject approval prompts related to built-in permission requests.
  */
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts b/codex-rs/app-server-protocol/schema/typescript/v2/AskForApproval.ts
@@ -2,4 +2,4 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": { sandbox_approval: boolean, rules: boolean, request_permissions: boolean, mcp_elicitations: boolean, } } | "never";
+export type AskForApproval = "untrusted" | "on-failure" | "on-request" | { "reject": { sandbox_approval: boolean, rules: boolean, skill_approval: boolean, request_permissions: boolean, mcp_elicitations: boolean, } } | "never";
diff --git a/codex-rs/app-server-protocol/src/protocol/v2.rs b/codex-rs/app-server-protocol/src/protocol/v2.rs
@@ -206,6 +206,8 @@ pub enum AskForApproval {
         sandbox_approval: bool,
         rules: bool,
         #[serde(default)]
+        skill_approval: bool,
+        #[serde(default)]
         request_permissions: bool,
         mcp_elicitations: bool,
     },
@@ -221,11 +223,13 @@ impl AskForApproval {
             AskForApproval::Reject {
                 sandbox_approval,
                 rules,
+                skill_approval,
                 request_permissions,
                 mcp_elicitations,
             } => CoreAskForApproval::Reject(CoreRejectConfig {
                 sandbox_approval,
                 rules,
+                skill_approval,
                 request_permissions,
                 mcp_elicitations,
             }),
@@ -243,6 +247,7 @@ impl From<CoreAskForApproval> for AskForApproval {
             CoreAskForApproval::Reject(reject_config) => AskForApproval::Reject {
                 sandbox_approval: reject_config.sandbox_approval,
                 rules: reject_config.rules,
+                skill_approval: reject_config.skill_approval,
                 request_permissions: reject_config.request_permissions,
                 mcp_elicitations: reject_config.mcp_elicitations,
             },
@@ -6159,6 +6164,7 @@ mod tests {
         let v2_policy = AskForApproval::Reject {
             sandbox_approval: true,
             rules: false,
+            skill_approval: false,
             request_permissions: true,
             mcp_elicitations: false,
         };
@@ -6169,6 +6175,7 @@ mod tests {
             CoreAskForApproval::Reject(CoreRejectConfig {
                 sandbox_approval: true,
                 rules: false,
+                skill_approval: false,
                 request_permissions: true,
                 mcp_elicitations: false,
             })
@@ -6179,7 +6186,7 @@ mod tests {
     }
 
     #[test]
-    fn ask_for_approval_reject_defaults_missing_request_permissions_to_false() {
+    fn ask_for_approval_reject_defaults_missing_optional_flags_to_false() {
         let decoded = serde_json::from_value::<AskForApproval>(serde_json::json!({
             "reject": {
                 "sandbox_approval": true,
@@ -6194,6 +6201,7 @@ mod tests {
             AskForApproval::Reject {
                 sandbox_approval: true,
                 rules: false,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: true,
             }
@@ -6206,6 +6214,7 @@ mod tests {
             &AskForApproval::Reject {
                 sandbox_approval: true,
                 rules: false,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: true,
             },
@@ -6228,6 +6237,7 @@ mod tests {
             approval_policy: Some(AskForApproval::Reject {
                 sandbox_approval: true,
                 rules: false,
+                skill_approval: false,
                 request_permissions: true,
                 mcp_elicitations: false,
             }),
@@ -6255,6 +6265,7 @@ mod tests {
             approval_policy: Some(AskForApproval::Reject {
                 sandbox_approval: false,
                 rules: true,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: true,
             }),
@@ -6305,6 +6316,7 @@ mod tests {
                     approval_policy: Some(AskForApproval::Reject {
                         sandbox_approval: true,
                         rules: false,
+                        skill_approval: false,
                         request_permissions: false,
                         mcp_elicitations: true,
                     }),
@@ -6340,6 +6352,7 @@ mod tests {
                 allowed_approval_policies: Some(vec![AskForApproval::Reject {
                     sandbox_approval: true,
                     rules: true,
+                    skill_approval: false,
                     request_permissions: false,
                     mcp_elicitations: false,
                 }]),
@@ -6362,6 +6375,7 @@ mod tests {
                     approval_policy: Some(AskForApproval::Reject {
                         sandbox_approval: true,
                         rules: false,
+                        skill_approval: false,
                         request_permissions: true,
                         mcp_elicitations: false,
                     }),
@@ -6383,6 +6397,7 @@ mod tests {
                     approval_policy: Some(AskForApproval::Reject {
                         sandbox_approval: false,
                         rules: true,
+                        skill_approval: false,
                         request_permissions: false,
                         mcp_elicitations: true,
                     }),
@@ -6404,6 +6419,7 @@ mod tests {
                     approval_policy: Some(AskForApproval::Reject {
                         sandbox_approval: true,
                         rules: false,
+                        skill_approval: false,
                         request_permissions: false,
                         mcp_elicitations: true,
                     }),
@@ -6426,6 +6442,7 @@ mod tests {
                     approval_policy: Some(AskForApproval::Reject {
                         sandbox_approval: false,
                         rules: true,
+                        skill_approval: false,
                         request_permissions: false,
                         mcp_elicitations: true,
                     }),
diff --git a/codex-rs/app-server/tests/suite/v2/experimental_api.rs b/codex-rs/app-server/tests/suite/v2/experimental_api.rs
@@ -183,6 +183,7 @@ async fn thread_start_reject_approval_policy_requires_experimental_api_capabilit
             approval_policy: Some(AskForApproval::Reject {
                 sandbox_approval: true,
                 rules: false,
+                skill_approval: false,
                 request_permissions: true,
                 mcp_elicitations: false,
             }),
diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
@@ -1344,6 +1344,11 @@
         "sandbox_approval": {
           "description": "Reject approval prompts related to sandbox escalation.",
           "type": "boolean"
+        },
+        "skill_approval": {
+          "default": false,
+          "description": "Reject approval prompts triggered by skill script execution.",
+          "type": "boolean"
         }
       },
       "required": [
diff --git a/codex-rs/core/src/codex_tests.rs b/codex-rs/core/src/codex_tests.rs
@@ -2308,6 +2308,7 @@ async fn request_permissions_emits_event_when_reject_policy_allows_requests() {
             crate::protocol::RejectConfig {
                 sandbox_approval: true,
                 rules: true,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: true,
             },
@@ -2382,6 +2383,7 @@ async fn request_permissions_returns_empty_grant_when_reject_policy_blocks_reque
             crate::protocol::RejectConfig {
                 sandbox_approval: false,
                 rules: false,
+                skill_approval: false,
                 request_permissions: true,
                 mcp_elicitations: false,
             },
diff --git a/codex-rs/core/src/exec_policy.rs b/codex-rs/core/src/exec_policy.rs
@@ -1569,6 +1569,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 AskForApproval::Reject(RejectConfig {
                     sandbox_approval: false,
                     rules: false,
+                    skill_approval: false,
                     request_permissions: false,
                     mcp_elicitations: false,
                 }),
@@ -1591,6 +1592,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 approval_policy: AskForApproval::Reject(RejectConfig {
                     sandbox_approval: true,
                     rules: false,
+                    skill_approval: false,
                     request_permissions: false,
                     mcp_elicitations: false,
                 }),
@@ -1628,6 +1630,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 approval_policy: AskForApproval::Reject(RejectConfig {
                     sandbox_approval: true,
                     rules: false,
+                    skill_approval: false,
                     request_permissions: false,
                     mcp_elicitations: false,
                 }),
@@ -1663,6 +1666,7 @@ prefix_rule(pattern=["git"], decision="prompt")
                 approval_policy: AskForApproval::Reject(RejectConfig {
                     sandbox_approval: false,
                     rules: true,
+                    skill_approval: false,
                     request_permissions: false,
                     mcp_elicitations: false,
                 }),
diff --git a/codex-rs/core/src/mcp_connection_manager.rs b/codex-rs/core/src/mcp_connection_manager.rs
@@ -1738,6 +1738,7 @@ mod tests {
             RejectConfig {
                 sandbox_approval: false,
                 rules: false,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: false,
             }
@@ -1751,6 +1752,7 @@ mod tests {
             RejectConfig {
                 sandbox_approval: false,
                 rules: false,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: true,
             }
diff --git a/codex-rs/core/src/safety.rs b/codex-rs/core/src/safety.rs
diff --git a/codex-rs/core/src/tools/runtimes/apply_patch.rs b/codex-rs/core/src/tools/runtimes/apply_patch.rs
diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs
diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs
diff --git a/codex-rs/core/tests/suite/skill_approval.rs b/codex-rs/core/tests/suite/skill_approval.rs
diff --git a/codex-rs/protocol/src/models.rs b/codex-rs/protocol/src/models.rs
diff --git a/codex-rs/protocol/src/protocol.rs b/codex-rs/protocol/src/protocol.rs
