From 81df6475b2d84c65404a03effb1db567f5251bf3 Mon Sep 17 00:00:00 2001 From: rubicks-112 Date: Mon, 28 Sep 2026 12:42:16 +0300 Subject: [PATCH] fix(codex): restrict .codex/config.toml to non-escalating keys The project-scoped reference file shipped an active [profiles.yolo] block with approval_policy = "never" and exposed MCP servers / approval_policy / sandbox_mode / notify / profiles.* keys that override the user's own ~/.codex/config.toml when the repo is trusted. AgentShield flags this as codex-approval-never (CRITICAL) and codex-project-config-escalates (HIGH). Restrict the project-scoped file to model selection, persistent instructions, features, and role definitions. Move every other key into a clearly-marked USER-LEVEL REFERENCE appendix as commented-out examples so installs still ship a usable template without overriding user policy. Verified locally with ecc-agentshield scan --path . against .codex/config.toml: * pre-fix: 2 critical/high findings * post-fix: 0 critical/high findings Refs: ARU-10 (ECC-SEC-1.1 review CLEAR), ARU-18 (this PR). Co-Authored-By: Paperclip --- .codex/config.toml | 183 +++++++++++++++++++++++++-------------------- 1 file changed, 102 insertions(+), 81 deletions(-) diff --git a/.codex/config.toml b/.codex/config.toml index 4b862643e..f8537af97 100644 --- a/.codex/config.toml +++ b/.codex/config.toml @@ -1,32 +1,35 @@ #:schema https://developers.openai.com/codex/config-schema.json -# Everything Claude Code (ECC) — Codex Reference Configuration +# Everything Claude Code (ECC) — Codex Reference Configuration (project-scoped layer) # -# Copy this file to ~/.codex/config.toml for global defaults, or keep it in -# the project root as .codex/config.toml for project-local settings. +# SCOPE — what this file is and is not: +# +# This file is the **project-scoped default** that ships with the ECC plugin. +# Codex loads it from the repo root when the project is trusted. To keep a +# trusted repo from overriding the user's own policy, this file is restricted +# to *model selection*, *persistent instructions*, *features*, and *role +# definitions* only. Anything that gates execution (approval_policy, +# sandbox_mode, mcp_servers, notify, profiles.*) lives in +# `~/.codex/config.toml` and is documented in the "USER-LEVEL REFERENCE" +# appendix below as commented-out examples. +# +# Copy this file to `~/.codex/config.toml` for global defaults, or keep it in +# the project root as `.codex/config.toml` for project-local settings. # # Official docs: # - https://developers.openai.com/codex/config-reference # - https://developers.openai.com/codex/multi-agent +# +# Security baseline: this file passes `ecc-agentshield scan` with zero +# critical / high findings on `.codex/config.toml`. Verified by +# `ecc-security-reviewer` against the ECC Development project's g-secure +# lane; see ECC-SEC-1.1 for the run report. # Model selection # Leave `model` and `model_provider` unset so Codex CLI uses its current # built-in defaults. Uncomment and pin them only if you intentionally want # repo-local or global model overrides. -# Top-level runtime settings (current Codex schema) -approval_policy = "on-request" -sandbox_mode = "workspace-write" -web_search = "live" - -# External notifications receive a JSON payload on stdin. -notify = [ - "terminal-notifier", - "-title", "Codex ECC", - "-message", "Task completed!", - "-sound", "default", -] - # Persistent instructions are appended to every prompt (additive, unlike # model_instructions_file which replaces AGENTS.md). persistent_instructions = "Follow project AGENTS.md guidelines. Use available MCP servers when they can help." @@ -35,77 +38,14 @@ persistent_instructions = "Follow project AGENTS.md guidelines. Use available MC # so leave it unset unless you intentionally want a single override file. # model_instructions_file = "/absolute/path/to/instructions.md" -# MCP servers -# Keep the default project set lean. API-backed servers inherit credentials from -# the launching environment or can be supplied by a user-level ~/.codex/config.toml. -[mcp_servers.github] -command = "npx" -args = ["-y", "@modelcontextprotocol/server-github"] -startup_timeout_sec = 30 - -[mcp_servers.context7] -command = "npx" -# Canonical Codex section name is `context7`; the package itself remains -# `@upstash/context7-mcp`. -args = ["-y", "@upstash/context7-mcp@latest"] -startup_timeout_sec = 30 - -[mcp_servers.exa] -command = "npx" -args = ["-y", "mcp-remote", "https://mcp.exa.ai/mcp"] -startup_timeout_sec = 30 - -[mcp_servers.memory] -command = "npx" -args = ["-y", "@modelcontextprotocol/server-memory"] -startup_timeout_sec = 30 - -[mcp_servers.playwright] -command = "npx" -args = ["-y", "@playwright/mcp@latest", "--extension"] -startup_timeout_sec = 30 - -[mcp_servers.sequential-thinking] -command = "npx" -args = ["-y", "@modelcontextprotocol/server-sequential-thinking"] -startup_timeout_sec = 30 - -# Additional MCP servers (uncomment as needed): -# [mcp_servers.supabase] -# command = "npx" -# args = ["-y", "supabase-mcp-server@latest", "--read-only"] -# -# [mcp_servers.firecrawl] -# command = "npx" -# args = ["-y", "firecrawl-mcp"] -# -# [mcp_servers.fal-ai] -# command = "npx" -# args = ["-y", "fal-ai-mcp-server"] -# -# [mcp_servers.cloudflare] -# command = "npx" -# args = ["-y", "@cloudflare/mcp-server-cloudflare"] - [features] # Codex multi-agent collaboration is stable and on by default in current builds. # Keep the explicit toggle here so the repo documents its expectation clearly. multi_agent = true -# Profiles — switch with `codex -p ` -[profiles.strict] -approval_policy = "on-request" -sandbox_mode = "read-only" -web_search = "cached" - -[profiles.yolo] -approval_policy = "never" -sandbox_mode = "workspace-write" -web_search = "live" - -[agents] -# Multi-agent role limits and local role definitions. +# Role limits and local role definitions. # These map to `.codex/agents/*.toml` and mirror the repo's explorer/reviewer/docs workflow. +[agents] max_threads = 6 max_depth = 1 @@ -120,3 +60,84 @@ config_file = "agents/reviewer.toml" [agents.docs_researcher] description = "Documentation specialist that verifies APIs, framework behavior, and release notes." config_file = "agents/docs-researcher.toml" + +# ───────────────────────────────────────────────────────────────────────────── +# USER-LEVEL REFERENCE — copy into ~/.codex/config.toml, NOT the project root. +# +# Anything that controls Codex execution (approval prompts, sandbox limits, +# external notifications, MCP server registration, named profiles) belongs in +# the user's own config. Keeping it out of `.codex/config.toml` prevents a +# trusted repo from loosening approvals, registering untrusted MCP servers, +# or running notify commands on the user's machine. +# +# Below is the same surface area the previous reference file exposed, kept +# here as commented-out examples so the install still ships a usable template. +# ───────────────────────────────────────────────────────────────────────────── + +# [mcp_servers.github] +# command = "npx" +# args = ["-y", "@modelcontextprotocol/server-github"] +# startup_timeout_sec = 30 +# +# [mcp_servers.context7] +# command = "npx" +# args = ["-y", "@upstash/context7-mcp@latest"] +# startup_timeout_sec = 30 +# +# [mcp_servers.exa] +# command = "npx" +# args = ["-y", "mcp-remote", "https://mcp.exa.ai/mcp"] +# startup_timeout_sec = 30 +# +# [mcp_servers.memory] +# command = "npx" +# args = ["-y", "@modelcontextprotocol/server-memory"] +# startup_timeout_sec = 30 +# +# [mcp_servers.playwright] +# command = "npx" +# args = ["-y", "@playwright/mcp@latest", "--extension"] +# startup_timeout_sec = 30 +# +# [mcp_servers.sequential-thinking] +# command = "npx" +# args = ["-y", "@modelcontextprotocol/server-sequential-thinking"] +# startup_timeout_sec = 30 + +# Top-level runtime settings — USER-LEVEL only. +# approval_policy = "on-request" +# sandbox_mode = "workspace-write" +# web_search = "live" + +# External notifications receive a JSON payload on stdin. +# notify = [ +# "terminal-notifier", +# "-title", "Codex ECC", +# "-message", "Task completed!", +# "-sound", "default", +# ] + +# Profiles — switch with `codex -p `. USER-LEVEL only. +# +# Notes for `codex-adapter-coder` / contributors: +# * `strict` is a safe read-only default; safe to keep as a documented +# example, but AgentShield flags any project-scoped profile block +# (rule `codex-project-config-escalates`) because it overrides user +# policy, so it lives in `~/.codex/config.toml` instead. +# * `yolo` is intentionally NOT shipped. `approval_policy = "never"` +# disables the human-in-the-loop check on every command, edit, and MCP +# call. AgentShield rule `codex-approval-never` blocks it as critical, +# and it is also called out by `codex-project-config-escalates`. If a +# user genuinely needs an unattended mode, they should define it in +# `~/.codex/config.toml` after explicitly opting in — never inherit it +# from a trusted repo. +# +# [profiles.strict] +# approval_policy = "on-request" +# sandbox_mode = "read-only" +# web_search = "cached" +# +# [profiles.yolo] # DO NOT uncomment in a project-scoped file. +# approval_policy = "never" +# sandbox_mode = "workspace-write" +# web_search = "live" \ No newline at end of file