mirror of
https://github.com/affaan-m/ECC.git
synced 2026-10-18 05:57:40 +02:00
fix(codex): restrict .codex/config.toml to non-escalating keys
The project-scoped reference file shipped an active [profiles.yolo] block with approval_policy = "never" and exposed MCP servers / approval_policy / sandbox_mode / notify / profiles.* keys that override the user's own ~/.codex/config.toml when the repo is trusted. AgentShield flags this as codex-approval-never (CRITICAL) and codex-project-config-escalates (HIGH). Restrict the project-scoped file to model selection, persistent instructions, features, and role definitions. Move every other key into a clearly-marked USER-LEVEL REFERENCE appendix as commented-out examples so installs still ship a usable template without overriding user policy. Verified locally with ecc-agentshield scan --path . against .codex/config.toml: * pre-fix: 2 critical/high findings * post-fix: 0 critical/high findings Refs: ARU-10 (ECC-SEC-1.1 review CLEAR), ARU-18 (this PR). Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
rubicks-112
+102
-81
@@ -1,32 +1,35 @@
|
||||
#:schema https://developers.openai.com/codex/config-schema.json
|
||||
|
||||
# Everything Claude Code (ECC) — Codex Reference Configuration
|
||||
# Everything Claude Code (ECC) — Codex Reference Configuration (project-scoped layer)
|
||||
#
|
||||
# Copy this file to ~/.codex/config.toml for global defaults, or keep it in
|
||||
# the project root as .codex/config.toml for project-local settings.
|
||||
# SCOPE — what this file is and is not:
|
||||
#
|
||||
# This file is the **project-scoped default** that ships with the ECC plugin.
|
||||
# Codex loads it from the repo root when the project is trusted. To keep a
|
||||
# trusted repo from overriding the user's own policy, this file is restricted
|
||||
# to *model selection*, *persistent instructions*, *features*, and *role
|
||||
# definitions* only. Anything that gates execution (approval_policy,
|
||||
# sandbox_mode, mcp_servers, notify, profiles.*) lives in
|
||||
# `~/.codex/config.toml` and is documented in the "USER-LEVEL REFERENCE"
|
||||
# appendix below as commented-out examples.
|
||||
#
|
||||
# Copy this file to `~/.codex/config.toml` for global defaults, or keep it in
|
||||
# the project root as `.codex/config.toml` for project-local settings.
|
||||
#
|
||||
# Official docs:
|
||||
# - https://developers.openai.com/codex/config-reference
|
||||
# - https://developers.openai.com/codex/multi-agent
|
||||
#
|
||||
# Security baseline: this file passes `ecc-agentshield scan` with zero
|
||||
# critical / high findings on `.codex/config.toml`. Verified by
|
||||
# `ecc-security-reviewer` against the ECC Development project's g-secure
|
||||
# lane; see ECC-SEC-1.1 for the run report.
|
||||
|
||||
# Model selection
|
||||
# Leave `model` and `model_provider` unset so Codex CLI uses its current
|
||||
# built-in defaults. Uncomment and pin them only if you intentionally want
|
||||
# repo-local or global model overrides.
|
||||
|
||||
# Top-level runtime settings (current Codex schema)
|
||||
approval_policy = "on-request"
|
||||
sandbox_mode = "workspace-write"
|
||||
web_search = "live"
|
||||
|
||||
# External notifications receive a JSON payload on stdin.
|
||||
notify = [
|
||||
"terminal-notifier",
|
||||
"-title", "Codex ECC",
|
||||
"-message", "Task completed!",
|
||||
"-sound", "default",
|
||||
]
|
||||
|
||||
# Persistent instructions are appended to every prompt (additive, unlike
|
||||
# model_instructions_file which replaces AGENTS.md).
|
||||
persistent_instructions = "Follow project AGENTS.md guidelines. Use available MCP servers when they can help."
|
||||
@@ -35,77 +38,14 @@ persistent_instructions = "Follow project AGENTS.md guidelines. Use available MC
|
||||
# so leave it unset unless you intentionally want a single override file.
|
||||
# model_instructions_file = "/absolute/path/to/instructions.md"
|
||||
|
||||
# MCP servers
|
||||
# Keep the default project set lean. API-backed servers inherit credentials from
|
||||
# the launching environment or can be supplied by a user-level ~/.codex/config.toml.
|
||||
[mcp_servers.github]
|
||||
command = "npx"
|
||||
args = ["-y", "@modelcontextprotocol/server-github"]
|
||||
startup_timeout_sec = 30
|
||||
|
||||
[mcp_servers.context7]
|
||||
command = "npx"
|
||||
# Canonical Codex section name is `context7`; the package itself remains
|
||||
# `@upstash/context7-mcp`.
|
||||
args = ["-y", "@upstash/context7-mcp@latest"]
|
||||
startup_timeout_sec = 30
|
||||
|
||||
[mcp_servers.exa]
|
||||
command = "npx"
|
||||
args = ["-y", "mcp-remote", "https://mcp.exa.ai/mcp"]
|
||||
startup_timeout_sec = 30
|
||||
|
||||
[mcp_servers.memory]
|
||||
command = "npx"
|
||||
args = ["-y", "@modelcontextprotocol/server-memory"]
|
||||
startup_timeout_sec = 30
|
||||
|
||||
[mcp_servers.playwright]
|
||||
command = "npx"
|
||||
args = ["-y", "@playwright/mcp@latest", "--extension"]
|
||||
startup_timeout_sec = 30
|
||||
|
||||
[mcp_servers.sequential-thinking]
|
||||
command = "npx"
|
||||
args = ["-y", "@modelcontextprotocol/server-sequential-thinking"]
|
||||
startup_timeout_sec = 30
|
||||
|
||||
# Additional MCP servers (uncomment as needed):
|
||||
# [mcp_servers.supabase]
|
||||
# command = "npx"
|
||||
# args = ["-y", "supabase-mcp-server@latest", "--read-only"]
|
||||
#
|
||||
# [mcp_servers.firecrawl]
|
||||
# command = "npx"
|
||||
# args = ["-y", "firecrawl-mcp"]
|
||||
#
|
||||
# [mcp_servers.fal-ai]
|
||||
# command = "npx"
|
||||
# args = ["-y", "fal-ai-mcp-server"]
|
||||
#
|
||||
# [mcp_servers.cloudflare]
|
||||
# command = "npx"
|
||||
# args = ["-y", "@cloudflare/mcp-server-cloudflare"]
|
||||
|
||||
[features]
|
||||
# Codex multi-agent collaboration is stable and on by default in current builds.
|
||||
# Keep the explicit toggle here so the repo documents its expectation clearly.
|
||||
multi_agent = true
|
||||
|
||||
# Profiles — switch with `codex -p <name>`
|
||||
[profiles.strict]
|
||||
approval_policy = "on-request"
|
||||
sandbox_mode = "read-only"
|
||||
web_search = "cached"
|
||||
|
||||
[profiles.yolo]
|
||||
approval_policy = "never"
|
||||
sandbox_mode = "workspace-write"
|
||||
web_search = "live"
|
||||
|
||||
[agents]
|
||||
# Multi-agent role limits and local role definitions.
|
||||
# Role limits and local role definitions.
|
||||
# These map to `.codex/agents/*.toml` and mirror the repo's explorer/reviewer/docs workflow.
|
||||
[agents]
|
||||
max_threads = 6
|
||||
max_depth = 1
|
||||
|
||||
@@ -120,3 +60,84 @@ config_file = "agents/reviewer.toml"
|
||||
[agents.docs_researcher]
|
||||
description = "Documentation specialist that verifies APIs, framework behavior, and release notes."
|
||||
config_file = "agents/docs-researcher.toml"
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# USER-LEVEL REFERENCE — copy into ~/.codex/config.toml, NOT the project root.
|
||||
#
|
||||
# Anything that controls Codex execution (approval prompts, sandbox limits,
|
||||
# external notifications, MCP server registration, named profiles) belongs in
|
||||
# the user's own config. Keeping it out of `.codex/config.toml` prevents a
|
||||
# trusted repo from loosening approvals, registering untrusted MCP servers,
|
||||
# or running notify commands on the user's machine.
|
||||
#
|
||||
# Below is the same surface area the previous reference file exposed, kept
|
||||
# here as commented-out examples so the install still ships a usable template.
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
# [mcp_servers.github]
|
||||
# command = "npx"
|
||||
# args = ["-y", "@modelcontextprotocol/server-github"]
|
||||
# startup_timeout_sec = 30
|
||||
#
|
||||
# [mcp_servers.context7]
|
||||
# command = "npx"
|
||||
# args = ["-y", "@upstash/context7-mcp@latest"]
|
||||
# startup_timeout_sec = 30
|
||||
#
|
||||
# [mcp_servers.exa]
|
||||
# command = "npx"
|
||||
# args = ["-y", "mcp-remote", "https://mcp.exa.ai/mcp"]
|
||||
# startup_timeout_sec = 30
|
||||
#
|
||||
# [mcp_servers.memory]
|
||||
# command = "npx"
|
||||
# args = ["-y", "@modelcontextprotocol/server-memory"]
|
||||
# startup_timeout_sec = 30
|
||||
#
|
||||
# [mcp_servers.playwright]
|
||||
# command = "npx"
|
||||
# args = ["-y", "@playwright/mcp@latest", "--extension"]
|
||||
# startup_timeout_sec = 30
|
||||
#
|
||||
# [mcp_servers.sequential-thinking]
|
||||
# command = "npx"
|
||||
# args = ["-y", "@modelcontextprotocol/server-sequential-thinking"]
|
||||
# startup_timeout_sec = 30
|
||||
|
||||
# Top-level runtime settings — USER-LEVEL only.
|
||||
# approval_policy = "on-request"
|
||||
# sandbox_mode = "workspace-write"
|
||||
# web_search = "live"
|
||||
|
||||
# External notifications receive a JSON payload on stdin.
|
||||
# notify = [
|
||||
# "terminal-notifier",
|
||||
# "-title", "Codex ECC",
|
||||
# "-message", "Task completed!",
|
||||
# "-sound", "default",
|
||||
# ]
|
||||
|
||||
# Profiles — switch with `codex -p <name>`. USER-LEVEL only.
|
||||
#
|
||||
# Notes for `codex-adapter-coder` / contributors:
|
||||
# * `strict` is a safe read-only default; safe to keep as a documented
|
||||
# example, but AgentShield flags any project-scoped profile block
|
||||
# (rule `codex-project-config-escalates`) because it overrides user
|
||||
# policy, so it lives in `~/.codex/config.toml` instead.
|
||||
# * `yolo` is intentionally NOT shipped. `approval_policy = "never"`
|
||||
# disables the human-in-the-loop check on every command, edit, and MCP
|
||||
# call. AgentShield rule `codex-approval-never` blocks it as critical,
|
||||
# and it is also called out by `codex-project-config-escalates`. If a
|
||||
# user genuinely needs an unattended mode, they should define it in
|
||||
# `~/.codex/config.toml` after explicitly opting in — never inherit it
|
||||
# from a trusted repo.
|
||||
#
|
||||
# [profiles.strict]
|
||||
# approval_policy = "on-request"
|
||||
# sandbox_mode = "read-only"
|
||||
# web_search = "cached"
|
||||
#
|
||||
# [profiles.yolo] # DO NOT uncomment in a project-scoped file.
|
||||
# approval_policy = "never"
|
||||
# sandbox_mode = "workspace-write"
|
||||
# web_search = "live"
|
||||
Reference in New Issue
Block a user