Summary: 4821 instances, 3741 unique

Text	Count
&& let Some(guardian_developer_message) =	1
/// Custom enum mirroring [`AskForApproval`], but has an extra dependency on	1
SessionSource::Internal(InternalSessionSource::Guardian) => true,	1
exec_policy_config_folders(parent_config) == exec_policy_config_folders(child_config)	1
runtime_approval_policy_override: None,	2
Some(GuardianReviewFailureReason::SessionError) => "session_error",	1
"guardian MCP elicitation review only supports empty form schemas",	1
if routes_approval_policy_to_guardian(approval_policy, reviewer) {	1
async fn guardian_review_session_config_preserves_parent_network_proxy() {	1
approved_command_prefixes: exec_policy.get_allowed_prefixes().into_iter().collect(),	1
GuardianReviewedAction::NetworkAccess { .. } => "network_access",	1
| GuardianApprovalRequest::RequestPermissions { id, .. } => Some(id),	1
.set_feature_enabled(Feature::GuardianApproval, /*enabled*/ true);	2
if constraints.trusted_guardian_reviewer {	1
use crate::exec_policy::prompt_is_rejected_by_policy;	2
.and_then(|auto_review| normalize_guardian_policy_config(	1
next_features.set_enabled(Feature::GuardianApproval, enabled);	1
.push(r#"approval_policy="on-request""#.to_string());	1
if admitted_config.features.enabled(Feature::GuardianV2)	1
use codex_app_server_protocol::AskForApproval;	5
"guardian prompt should expose the parent session id immediately after the transcript end"	1
thread_extension_init.insert(GuardianReadOnlyHistoryTools(history_tools));	1
pub(crate) async fn build_guardian_prompt_items(	1
GuardianReviewedAction::McpToolCall { .. } => "mcp_tool_call",	1
.guardian_policy_config	1
assert_eq!(first_assessment.outcome, GuardianAssessmentOutcome::Allow);	1
.map_err(|error| format!("invalid Guardian v2 configuration: {error}"))?;	1
let current_exec_policy = exec_policy.current();	1
ReviewDecision::Abort	1
.expect("follow-up guardian user message")	1
let action: GuardianAssessmentAction = serde_json::from_value(serde_json::json!({	1
/*approval_policy*/ None,	2
self.app_event_tx.send(AppEvent::UpdateAskForApprovalPolicy(	1
GuardianRiskLevel::High => "high",	1
pub fn into_core(self) -> CoreExecPolicyAmendment {	1
GuardianApprovalReviewAction::Execve { .. } => (	1
ReviewDecision::ApprovedMcpPolicyAmendment => "approved_mcp_policy_amendment",	1
let action_scope = if matches!(&request, GuardianApprovalRequest::WriteStdin { .. }) {	1
.any(|(feature, _)| *feature == Feature::GuardianApproval)	2
pub async fn guardian_authorization_version(&self) -> GuardianAuthorizationVersion {	1
ReviewDecision::TimedOut => mcp_elicitation_decline_with_message(	1
pub(crate) struct GuardianMcpAnnotations {	1
assert!(guardian_config.mcp_servers.get().is_empty());	2
command: "rm -rf /tmp/guardian".to_string(),	1
Err(err) if is_unsupported_untrusted_approval_policy_error(&err) => {	2
GuardianApprovalReviewAction::ApplyPatch { .. }	2
fn client_request_thread_resume_granular_approval_policy_is_marked_experimental() {	1
pub(crate) fn take(&mut self, id: &str) -> Option<GuardianAssessmentEvent> {	1
"codex.guardian_v2.classification.duration_ms";	1
GuardianElicitationReview::NotRequested => return Ok(None),	1
pub struct GuardianApplyPatchReviewAction {	1
pub(crate) fn action_summary(action: &GuardianAssessmentAction) -> String {	1
decisions.push(ReviewDecision::ApprovedExecpolicyAmendment {	1
use codex_features::GuardianV2ConfigToml;	1
CoreAskForApproval::Granular(CoreGranularApprovalConfig {	1
&& let Ok(action) = guardian_approval_request_to_json(&request)	1
exec_policy: &Policy,	4
let amendment = ExecPolicyAmendment::new(prefix_rule.clone());	1
fn split_guardian_truncation_bounds(	1
let third_request = GuardianApprovalRequest::ExecCommand {	1
use super::review_session::GuardianReviewSessionOutcome;	1
.enabled(Feature::GuardianReuseParentCompaction)	1
guardian_v2: Some(GuardianV2ModelConfig {	1
/// final answer from the guardian review session.	1
guardian_output_schema(),	10
ReviewDecision::Abort => {	1
pub(crate) fn build_guardian_review_session_config(	1
ReviewDecision::Denied { rejection } => {	1
} => GuardianAssessmentAction::McpToolCall {	1
approval_policy: self.approval_policy,	1
Some(codex_app_server_protocol::AskForApproval::OnRequest)	1
use codex_protocol::openai_models::GuardianV2TranscriptModelConfig;	1
guardian_config.model_reasoning_effort,	1
) -> GuardianReviewedAction {	1
let error = wait_before_guardian_retry(	2
Some(AskForApproval::Never)	2
ReviewDecision::ApprovedForSession	1
approval_policy: event.thread_settings.approval_policy,	1
assert!(app.config.features.enabled(Feature::GuardianApproval));	2
impl From<Arc<TurnContext>> for GuardianReviewContext {	1
ev_completed("resp-guardian-3"),	1
pub struct GuardianExtension<S> {	2
matches!(approval_policy, AskForApproval::OnRequest)	1
pub terminal_status: GuardianReviewTerminalStatus,	2
ev_response_created("resp-guardian-2"),	2
pub(super) use codex_app_server_protocol::ExecPolicyAmendment;	1
pub guardian_policy_config: Option<String>,	2
GuardianWarning(WarningEvent),	1
completed_at_ms: (!matches!(status, GuardianAssessmentStatus::InProgress))	1
approval_policy: Some(AskForApproval::Granular {	4
None => commands_for_exec_policy(command),	1
AskForApproval::Never => Some(PROMPT_CONFLICT_REASON),	1
use super::GuardianRejectionCircuitBreakerAction;	1
*transcript == GuardianV2TranscriptModelConfig::default()	1
GuardianTranscriptEntryKind::NodeReplToolResult(_)	1
crate::guardian::is_basic_session_source(&session_source);	1
self.runtime_approval_policy_override = Some(approval_policy);	1
.map(codex_app_server_protocol::AskForApproval::from)	1
Self::Guardian	1
let mut approval_policy_override = None;	1
| codex_protocol::protocol::GuardianAssessmentStatus::Approved => None,	1
metadata.approval_mode = enum_to_string(&turn_ctx.approval_policy);	1
input.thread_store.insert(GuardianV2ScoreProgress {	1
super::GuardianAssessmentOutcome::Deny => {	1
CoreGuardianRiskLevel::High => Self::High,	1
) -> ExtensionFuture<'a, Option<ReviewDecision>> {	2
"follow-up guardian request should include the follow-up reminder"	1
(Some(_), Some(_)) => Err(RequirementsExecPolicyParseError::InvalidPatternToken {	1
guardian_reasoning_effort: None,	1
review_context: GuardianReviewContext::from(&tool_ctx.step_context),	2
GuardianApproved,	1
let approval_policy = AskForApproval::from(config.permissions.approval_policy.value());	1
pub enum ExecPolicyError {	1
let core_action = CoreGuardianAssessmentAction::WriteStdin {	1
approval_policy: session_configuration.step_settings.approval_policy.value().to_string(),	1
guardian_session_kind: GuardianReviewSessionKind,	1
inherited_exec_policy,	5
use codex_execpolicy::RequirementsExecPolicy;	4
fn guardian_request_target_item_id_omits_network_access_trigger_call_id() {	1
let root_snapshot = thread.guardian_root_snapshot().await;	1
PendingApprovalDecision::AllowOnce => ReviewDecision::Approved,	1
GuardianApprovalReviewAction::ApplyPatch { .. } => (	1
AskForApproval::UnlessTrusted => {	3
async fn guardian_review_session_config_allows_pinned_disabled_feature() {	1
use codex_analytics::GuardianReviewSessionKind;	2
let approval_policy = mcp_config.approval_policy.value();	1
fn blank_guardian_policy_config_is_empty() -> Result<()> {	1
pub(crate) fn routes_approval_to_guardian(turn: &TurnContext) -> bool {	1
let mut value = serialize_guardian_action(NetworkAccessApprovalAction {	1
("<guardian_sync_review>", "</guardian_sync_review>")	1
pub(crate) event_params: GuardianReviewEventPayload,	1
GuardianReviewedAction::Execve { .. } => "execve",	1
patch: "*** Begin Patch\n*** Update File: guardian.txt\n@@\n+secret\n*** End Patch"	1
"Guardian v2 {setting} must be between {MIN_MODEL_CONTEXT_ITEM_TOKENS} and {MAX_MODEL_CONTEXT_ITEM_TOKENS} tokens"	1
guardian_config.model_reasoning_effort = reasoning_effort;	1
approval_policy == AskForApproval::Never	1
"Guardian review request layout",	1
GuardianRejectionCircuitBreakerAction::InterruptTurn {	4
/// Preserve the typed identity independently of Guardian's display-name payload.	1
commandArgs.push("--config", `approval_policy="${args.approvalPolicy}"`);	1
"---\nname: {GUARDIAN_SKILL_NAME}\ndescription: Guardian skill injection probe.\n---\n\n{GUARDIAN_SKILL_BODY_PROBE}\n"	1
params.approval_policy = Some(AppServerAskForApproval::OnRequest);	1
approval_request_source: GuardianApprovalRequestSource::MainTurn,	2
fn guardian_approval_request_to_json_renders_network_access_trigger() -> serde_json::Result<()> {	1
assert!(rendered.contains("approval_policy = \"never\""));	2
.set(session.approval_policy.to_core())	2
cursor: GuardianTranscriptCursor {	4
pub(crate) fn elicitation_is_rejected_by_policy(approval_policy: AskForApproval) -> bool {	1
Box::pin(spawn_guardian_review_session(	1
use crate::guardian::review_approval_request;	1
pub(crate) struct GuardianAssessment {	1
let network_access = GuardianApprovalRequest::NetworkAccess {	2
exec_policy	1
entries: BTreeMap::from([("guardian_approval".to_string(), true)]),	1
GuardianPromptMode::Delta {	4
Completed(GuardianAssessment),	1
pub use guardian_review_evidence::GuardianReviewEvidence;	1
pub approval_policy: String,	1
use codex_protocol::protocol::ReviewDecision as CoreReviewDecision;	1
use super::GuardianThreadContext;	1
let auto_review_enabled = crate::guardian::routes_approval_policy_to_guardian(	1
if crate::guardian::is_basic_session_source(session_source) {	1
codex_app_server_protocol::GuardianUserAuthorization::Unknown => {	1
enum GuardianTestCatalog {	1
pub use feature_configs::GuardianV2ConfigToml;	1
requirements.approval_policy.source.as_ref(),	1
routes_approval_policy_to_guardian(turn.approval_policy(), approvals_reviewer)	1
AskForApproval::Granular(_) => None,	1
use crate::guardian::prompt::BUNDLED_GUARDIAN_POLICY_TEMPLATE;	1
Constrained::allow_any(AskForApproval::OnRequest.to_core()),	1
return (GuardianReviewSessionOutcome::Aborted, true, false);	1
use super::trusted_tools::GuardianTrustedToolFragment;	1
let GuardianRejectionCircuitBreakerAction::InterruptTurn {	1
pub struct GuardianV2TranscriptModelConfig {	1
if decision == ReviewDecision::Approved {	1
use codex_app_server_protocol::AskForApproval as AppServerAskForApproval;	1
root_authorization: Option<GuardianRootSnapshot>,	1
GuardianReviewOutcome::Error(GuardianReviewError::parse(anyhow::anyhow!("parse"))),	1
Box::pin(ensure_guardian_node_repl_policy(review_session, params)),	1
approval_request_source: GuardianApprovalRequestSource::MainTurn,	1
"approval policy is {approval_policy:?}; reject command — you cannot request additional permissions unless the approval policy is OnRequest"	1
decision: ReviewDecision,	5
Constrained::allow_any(AskForApproval::OnRequest.to_core()),	1
serde_json::from_value(value.clone()).expect("guardian action");	1
let mut next_reuse_key = GuardianReviewSessionReuseKey::from_spawn_config(	1
ItemGuardianApprovalReviewStartedNotification {	1
/// User-configurable prompt, approval, and context settings for Guardian v2.	1
config.resolve_guardian_policy(model.model_messages.as_ref()) != destination_policy	1
pub use sync_reviewer::GuardianExtension as GuardianReviewerExtension;	1
GuardianElicitationReview::ApprovalRequest(Box::new(	1
&GuardianReviewedAction::NetworkAccess {	1
failure_reason: Some(GuardianReviewFailureReason::Cancelled),	1
id: Feature::GuardianApproval,	1
guardian_truncate_text(&message, MAX_ROOT_MESSAGE_TOKENS).0,	1
match build_without_headless_approval_policy().await {	1
let build_instructions = |exec_policy| {	1
pub guardian_review_model_overridden: Option<bool>,	2
let decision = ReviewDecision::Denied {	1
ElicitationAction::Decline => ReviewDecision::denied("user rejected MCP tool call"),	1
AskForApproval::OnRequest => false,	1
let (text, _) = guardian_truncate_text(	1
kind: GuardianTranscriptEntryKind::Tool("tool shell result".to_string()),	1
AskForApproval::from(self.config.permissions.approval_policy.value());	3
pub(crate) fn guardian_request_turn_id<'a>(	1
if attempt_count >= max_attempts || !should_retry_guardian_review(&outcome) {	1
session.approval_policy = approval_policy;	1
use crate::guardian::GUARDIAN_REVIEW_TIMEOUT;	1
crate::guardian::new_guardian_review_id(),	1
GuardianV2ReviewScope::ComputerUseOnly	1
|| AppServerAskForApproval::from(	1
ApprovalResolutionSource::Guardian => {	1
Some(GuardianAssessmentOutcome::Allow) => "allow",	1
AskForApproval::from(self.config.permissions.approval_policy.value()),	1
approval_policy: self.approval_policy(),	1
use crate::protocol::v2::GuardianApprovalReviewStatus;	1
use codex_protocol::protocol::GuardianAssessmentAction;	1
AskForApproval::OnRequest	1
fn guardian_prompt_text(items: &[codex_protocol::user_input::UserInput]) -> String {	1
GuardianPromptMode::Full,	1
use crate::guardian::new_guardian_review_id;	1
GuardianReviewOutcome::Error(GuardianReviewError::session_with_error_info(	1
pub(crate) use guardian_policy::GuardianPolicy;	1
codex_protocol::approvals::GuardianRiskLevel::Medium	1
AskForApproval::from(	1
/// This is inserted into the fixed guardian prompt template under the	1
use codex_protocol::approvals::GuardianAssessmentAction;	4
SessionSource::Internal(InternalSessionSource::Guardian) => "internal:guardian",	1
| GuardianApprovalRequest::McpToolCall { id, .. }	1
pub struct RequirementsExecPolicyPrefixRuleToml {	1
guardian_policy_config_source,	1
// Guardian context; other developer messages are intentionally	1
.map_err(|_| anyhow!("timed out draining guardian review session after interrupt"))??;	1
Some((_, script)) => ExecPolicyCommands {	1
exec_policy_fallback,	1
let (transcript, omission) = render_guardian_transcript_entries(&entries[..2]);	1
guardian_agent_spawner(thread_manager.clone()),	2
exec_policy,	3
use crate::protocol::v2::GuardianApprovalReview;	1
pub use execpolicycheck::ExecPolicyCheckCommand;	1
pub fn new_guardian_denied_patch_request(files: Vec<String>) -> Box<dyn HistoryCell> {	1
fn later_approve_for_me_overrides_root_tui_approval_policy() {	1
parent_context: Option<&GuardianReviewContext>,	1
fn exec_policy_error_includes_requirement_source() -> Result<()> {	1
pub(super) fn guardian_policy_prompt_with_config_and_template(	1
mod guardian;	2
//! Structured transcript evidence shared by synchronous and asynchronous Guardian.	1
let result = GuardianReviewAnalyticsResult {	1
/// Runs Guardian unless an installed extension explicitly claims the review.	1
"Guardian action identity exceeds the {max_action_tokens}-token limit"	1
GuardianAssessmentAction::McpToolCall {	1
pub(crate) inherited_exec_policy: Option<Arc<crate::exec_policy::ExecPolicyManager>>,	1
review_context: GuardianReviewContext::from(&tool_ctx.step_context),	1
fn risk_level_tag(risk_level: Option<GuardianRiskLevel>) -> &'static str {	1
CoreReviewDecision::Approved => Self::Accept,	1
pub guardian_policy_config_source: Option<RequirementSource>,	1
pub(crate) fn with_exec_policy_network_rules(	1
update.approval_mode = Some(turn_ctx.approval_policy);	1
pub enum GuardianReviewSessionKind {	1
let feature = Option::<FeatureToml<GuardianV2ConfigToml>>::deserialize(deserializer)?;	1
pub async fn guardian_trunk_rollout_path(&self) -> Option<PathBuf> {	1
ev_response_created("resp-guardian-3"),	1
let (outcome, keep_review_session, _) = wait_for_guardian_review(	1
impl GuardianReviewContext {	1
ContentItemKind("guardian.approved_action".to_string())	1
let (outcome, analytics_result) = Box::pin(run_guardian_review_session_with_retry(	1
&approval.clone().into_guardian_request().map_err(|err| {	1
async fn guardian_reuses_prompt_cache_key_and_appends_prior_reviews() -> anyhow::Result<()> {	1
let policy = parent_config.resolve_guardian_policy(model_messages);	1
impl GuardianAction {	1
// Boxing breaks the Session::new -> Guardian -> Session::new future recursion.	1
ApprovalReviewer::Guardian => ApprovalResolutionSource::Guardian,	1
("Follow-up Guardian Review Request", &requests[1]),	1
risk_level: Some(GuardianRiskLevel::Low),	1
output.guardian_policy_config = Some(Sourced::new(	1
guardian_config.base_instructions = Some(guardian_policy_prompt_with_config_and_template(	1
ignore_default_excludes: exec_policy.ignore_default_excludes,	1
guardian_policy_config,	1
fn guardian_exec_command_request(id: &str) -> GuardianApprovalRequest {	1
outcome: super::GuardianAssessmentOutcome,	1
if ev.status == GuardianAssessmentStatus::Approved {	1
|| crate::guardian::is_basic_session_source(&turn_context.session_source)	1
reasoning_effort: guardian_config.reasoning_effort.clone(),	1
pub(crate) fn collect_guardian_transcript_entries<'a>(	1
| GuardianApprovalRequest::WriteStdin { id, .. }	1
fn normalize_guardian_snapshot_paths(text: String) -> String {	1
export type { GuardianRiskLevel } from "./GuardianRiskLevel";	1
CoreAskForApproval::UnlessTrusted => AskForApproval::UnlessTrusted,	1
async fn update_feature_flags_enabling_guardian_selects_auto_review() -> Result<()> {	1
export type { GuardianWarningNotification } from "./GuardianWarningNotification";	1
user_authorization: GuardianUserAuthorization::Unknown,	3
.send_server_notification(ServerNotification::GuardianWarning(notification))	1
.get::<GuardianV2ScoreProgress>()?	1
approval_policy: session_configured.approval_policy.into(),	1
pub(super) use codex_app_server_protocol::AutoReviewDecisionSource as AppServerGuardianApprovalReviewDecisionSource;	1
/// Creates a guardian extension with its host-provided agent spawn helper.	1
ev_assistant_message("msg-guardian-1", &first_assessment),	1
sess.guardian_review_session.shutdown().await;	1
GuardianRejectionCircuitBreakerPolicy::CyberModel	1
type = r#""user" | "auto_review" | "guardian_subagent""#,	1
(GuardianReviewOutcome::Completed(assessment), false),	1
let mut spawn_config = build_guardian_review_session_config(	1
approval_policy: Option<AskForApproval>,	2
pub use crate::approvals::GuardianAssessmentOutcome;	1
pub guardian_catalog_contains_auto_review: bool,	1
fn truncate_guardian_action_value(value: Value) -> (Value, bool) {	1
if config_stack.ignore_user_and_project_exec_policy_rules()	1
/// Host-verified user-owned skill paths for the current Guardian classification.	1
//! Low-cardinality metrics for Guardian V2 classification and approval decisions.	1
) -> ReviewDecision {	4
guardian_truncate_text(&text, GUARDIAN_MAX_ACTION_STRING_TOKENS);	1
fn from(value: GuardianCommandSource) -> Self {	1
// The memories extension depends on codex-core, so this probe verifies the nested Guardian config	1
let fourth_outcome = run_guardian_review_session_for_test(	1
let mut exec_policy = Policy::empty();	1
let node_repl_images = if guardian_config.transcript.include_images {	1
guardian_truncate_text(&text, MAX_ROOT_MESSAGE_TOKENS).0,	1
//! 2. Ask a dedicated guardian review session to assess the exact planned	1
history_cell::new_guardian_denied_action_request(permission_request_summary(	1
//! Attests home-owned MCP tools and renders their bounded Guardian context.	1
| GuardianApprovalRequest::RequestPermissions { turn_id, .. } => turn_id,	1
use crate::protocol::v2::ItemGuardianApprovalReviewStartedNotification;	1
impl GuardianReviewEvidenceFragment {	1
let guardian_permission_profile =	1
Box::pin(spawn_guardian_review_session(	1
GuardianApprovalRequest::RequestPermissions {	2
AskForApproval::Never => Decision::Forbidden,	1
pub struct GuardianThreadContext {	2
self.on_guardian_review_notification(	2
("approval_policy".to_string(), "never".into()),	1
review_session: Arc<GuardianReviewSession>,	1
GuardianRootMessage::User(answers.join("\n")).render()	1
approval_policy: wire.approval_policy,	1
let guardian_review_model_overridden = model_override.is_some();	1
| ReviewDecision::ApprovedExecpolicyAmendment { .. } => {	1
if let Some(policy) = self.runtime_approval_policy_override.as_ref()	1
| EventMsg::GuardianWarning(_)	4
"codex.guardian_v2.classification.truncation";	1
.expect("third guardian thread id"),	1
GuardianApprovalReviewAction::Command {	1
use super::action::GuardianAction;	1
review_session: &GuardianReviewSession,	4
let value = guardian_approval_request_to_json(action)?;	1
fn approved_command_prefixes_text(exec_policy: &Policy) -> Option<String> {	1
.track_guardian_review(tracking, result, completed_at_ms);	1
pub user_authorization: GuardianUserAuthorization,	1
pub(crate) async fn thread_approve_guardian_denied_action(	2
requirements.approval_policy.source,	1
if guardian_config.review_scope != GuardianV2ReviewScope::ComputerUseOnly {	1
guardian_exec_command_request("shell-escalated-retry"),	1
&& let Err(err) = constrained_approval_policy.can_set(&approval_policy)	1
pub guardian_model_provider_id: String,	1
"guardian review metadata should capture TTFT when the nested turn completes"	1
GuardianPromptShape::Full	1
let action = codex_protocol::protocol::GuardianAssessmentAction::Command {	2
pub use guardian_v2::GuardianV2TranscriptModelConfig;	1
fork_snapshot: Option<GuardianReviewForkSnapshot>,	1
InternalSessionSource::Guardian => f.write_str("guardian"),	1
approval_policy: ctx.step_context.settings.approval_policy(),	1
if self.config.free_guardian	1
| ServerNotification::GuardianWarning(_)	1
approval_policy: AskForApproval::OnRequest,	5
GuardianAssessmentStatus::Approved	1
let exec_policy = self.current_for_environment(environment_policy, allow_prefix_rules);	1
ev_completed("resp-guardian-4"),	1
pub(super) struct GuardianReviewSessionConfig {	1
GuardianReviewSessionOutcome::Completed(Ok(turn_complete.last_agent_message)),	1
|| turn.config.features.enabled(Feature::GuardianV2))	1
guardian_config.developer_instructions = None;	1
warn!("failed to initialize guardian review session: {err:#}");	1
return Err(RequirementsExecPolicyParseError::InvalidPatternToken {	3
fn guardian_truncate_text_keeps_prefix_suffix_and_xml_marker() {	1
decision: GuardianReviewDecision::Denied,	2
pub(crate) struct GuardianReviewEventPayload {	1
codex_protocol::approvals::GuardianRiskLevel::High	1
GuardianAssessmentAction::WriteStdin { .. }	1
use prompt::build_guardian_prompt_items;	1
guardian_nested_tool_names.sort_unstable();	1
ApprovalReviewError::Failed(format!("invalid Guardian config: {error}"))	1
| ReviewDecision::Denied { .. }	1
guardian_config.model,	1
/// One root conversation message exposed only to a worker's Guardian reviewers.	1
let guardian_policy = guardian_policy_prompt_with_config_and_template(	1
ExecPolicyCommands {	1
fn failure_reason_tag(reason: Option<GuardianReviewFailureReason>) -> &'static str {	1
pub struct GuardianExecveReviewAction {	1
!third_request_body_text.contains("second guardian rationale"),	1
pub guardian_default_review_model_id: String,	1
"turn-guardian-denied",	2
toml_value_from_serializable(vec![approval_policy])?,	1
let output = ExecPolicyCheckOutput {	1
} => ReviewDecision::ApprovedExecpolicyAmendment {	1
fn guardian_rejection_circuit_breaker_interrupts_after_three_consecutive_denials() {	1
pub(crate) fn format_guardian_action_pretty(	1
fn had_prior_review_context(prompt_mode: &GuardianPromptMode) -> bool {	1
source: ExecPolicyRuleError,	1
let notification = guardian_auto_approval_review_notification(	1
) -> Result<(), ExecPolicyUpdateError> {	3
GuardianAssessmentAction::Command { command, .. } => shlex::split(command)	1
assert_eq!(should_retry_guardian_review(&outcome), expected);	1
GuardianElicitationReview::Decline(reason) => {	1
return ReviewDecision::ApprovedForSession;	1
guardian_default_review_model_id: session_config.default_review_model_id,	1
// retrying without the sandbox requires a fresh guardian review.	1
.enabled(Feature::GuardianApproval),	1
.map_err(|source| ExecPolicyUpdateError::AppendRule {	2
ev_assistant_message("msg-guardian-3", "not valid guardian json"),	1
pub use crate::approvals::GuardianUserAuthorization;	1
use codex_protocol::protocol::GuardianCommandSource;	2
GuardianExt,	1
fn client_request_thread_fork_granular_approval_policy_is_marked_experimental() {	1
use crate::RequirementsExecPolicyToml;	2
Err(ToolError::Codex(_)) => ReviewDecision::Abort,	1
allowed_approval_policies: Some(vec![AskForApproval::UnlessTrusted.to_core()]),	1
decision: GuardianReviewDecision::Denied,	1
pub struct GuardianAssessmentEvent {	1
struct GuardianReviewSessionReuseKey {	1
(!text.trim().is_empty()).then_some(GuardianTranscriptEntry { kind, text })	1
let baseline_approval = resume_config.permissions.approval_policy.value();	1
fn guardian_command_source_tool_name(source: GuardianCommandSource) -> &'static str {	1
return ReviewDecision::Abort;	1
ReviewDecision::denied("network approval failed")	1
&& self.status_state.current_status.is_guardian_review()	1
.with_user_and_project_exec_policy_rules_ignored(	2
// stays isolated as its own top-level developer message for guardian subagents.	1
exec_policy_hint: None,	1
let (mut session, mut turn) = guardian_test_session_and_turn(&server).await;	2
session_source: Some(SessionSource::Internal(InternalSessionSource::Guardian)),	1
use super::approval_request::guardian_reviewed_action;	1
| codex_protocol::protocol::GuardianAssessmentStatus::Aborted => {	1
async fn cancelled_guardian_review_emits_terminal_abort_without_warning() {	1
GuardianReviewError::Session {	1
ReviewDecision::Denied { rejection } => mcp_elicitation_decline_with_message(rejection),	1
commands_for_intercepted_exec_policy(program, argv)	1
assert!(!app.config.features.enabled(Feature::GuardianApproval));	1
history_cell::new_guardian_timed_out_action_request(format!(	2
let (guardian_model, guardian_reasoning_effort) = if let Some(preset) = review_model {	1
fn is_unsupported_untrusted_approval_policy_error(err: &std::io::Error) -> bool {	1
ReviewDecision::Abort => "abort",	1
if guardian_config.transcript.include_images {	1
config.approval_policy,	1
use crate::exec_policy::default_policy_path;	1
return ReviewDecision::TimedOut;	1
use crate::protocol::ReviewDecision;	1
pub use events::GuardianApprovalRequestSource;	1
guardian_config.model_provider.request_max_retries = Some(1);	1
pub enum RequirementsExecPolicyParseError {	1
environment_policy: Option<&RequirementsExecPolicy>,	1
ContentItemKind("guardian.node_repl_review_evidence".to_string())	1
pub struct RequirementsExecPolicyToml {	1
guardian_policy_config_source: None,	1
Some(vec![ReviewDecision::Approved, ReviewDecision::Abort]),	2
pub use codex_thread::GuardianRootSnapshot;	1
impl RequirementsExecPolicy {	1
fn guardian_approval_review_action_round_trips_command_shape() {	1
GuardianPromptShape::Delta {	1
pub(crate) use review::record_guardian_denial_for_test;	1
id: "shell-guardian-2".to_string(),	1
use super::config::GuardianV2ReviewScope;	1
/// Include completed node_repl or cua_repl Code Mode responses in Guardian reviews.	1
CommandExecutionApprovalDecision::AcceptForSession => ReviewDecision::ApprovedForSession,	1
GuardianApprovalRequest::ExecCommand { .. }	1
GuardianApprovalRequest::ApplyPatch { cwd, files, .. } => {	1
.and_then(|guardian| guardian.get("free_guardian"))	1
struct GuardianReviewSessionState {	1
use codex_core::context::GuardianReviewEvidence;	2
let cwd = match guardian_cwd(environment_id, cwd.clone()) {	1
let approval_policy = AskForApproval::from(config.permissions.approval_policy.value());	1
if let Some(approval_policy) = update.approval_policy {	1
(!input.trim().is_empty()).then(|| GuardianTranscriptEntry {	1
GuardianAssessmentAction::NetworkAccess { target, .. } => {	1
GuardianReviewAnalyticsResult::without_session(),	2
fn guardian_rejection_circuit_breaker_resets_consecutive_denials_on_non_denial() {	1
Feature::GuardianV2,	1
let guardian_config = thread_store.get::<GuardianV2Config>()?;	1
anyhow::bail!("guardian review completed without an assessment payload");	1
mod guardian_approved_action;	1
== child_config.config_layer_stack.requirements().exec_policy	1
metadata.guardian_session_kind,	3
return Err("the destination changes the explicit Guardian reviewer model".to_string());	1
GuardianRiskLevel::Medium => "medium",	1
AskForApproval::UnlessTrusted => true,	1
let active_approval: AskForApproval = config_snapshot.approval_policy.into();	1
guardian_default_review_model_id: Some(params.guardian_default_review_model_id),	1
ReviewDecision::ApprovedMcpPolicyAmendment	1
approval_policy: Some(AskForApproval::Never),	1
guardian_assessment_action(&action),	1
) -> Result<ReviewDecision, ToolError> {	1
pub(super) fn on_guardian_assessment(&mut self, ev: GuardianAssessmentEvent) {	1
"guardian reviewer environment `{}` has no resolved permissions",	1
let restore_approval_policy = typesafe_overrides.approval_policy.is_none();	1
policy: AskForApproval,	2
guardian_agent_spawner,	1
CoreGuardianUserAuthorization::High => Self::High,	1
CommandExecutionApprovalDecision::Decline => ReviewDecision::Denied,	1
| EventMsg::GuardianAssessment(_)	4
AskForApproval::Granular(config) if !config.allows_mcp_elicitations() => {	1
impl GuardianThreadContext {	1
codex_app_server_protocol::GuardianApprovalReviewStatus::InProgress => {	1
GuardianReviewOutcome::Error(GuardianReviewError::prompt_build(err)),	1
use crate::extensions::guardian_agent_spawner;	1
let guardian_disabled_reason = |enabled: bool| {	1
| ReviewDecision::NetworkPolicyAmendment { .. } => ElicitationResponse {	1
AskForApproval::OnRequest,	1
let (policy, warning) = load_exec_policy_with_warning(config_stack).await?;	1
kind: GuardianTranscriptEntryKind::Tool("tool shell call".to_string()),	1
) -> tuple[AskForApproval, ApprovalsReviewer | None]:	1
"approval policy is {approval_policy:?}; reject command — you cannot ask for escalated permissions if the approval policy is {approval_policy:?}"	1
let review_id = crate::guardian::new_guardian_review_id();	1
pub fn to_core(self) -> CoreAskForApproval {	1
guardian_request_target_item_id(&action),	1
fn guardian_status_aggregates_parallel_reviews() {	1
outcome: GuardianAssessmentOutcome::Deny,	2
.expect("guardian config")	2
.map(codex_app_server_protocol::AskForApproval::to_core),	1
fn outcome_tag(outcome: Option<GuardianAssessmentOutcome>) -> &'static str {	1
approval_policy: turn.approval_policy(),	1
GuardianApprovalRequest::ExecCommand {	1
third_metadata.guardian_session_kind,	1
GuardianAssessmentAction::RequestPermissions { reason, .. } => {	1
AskForApproval::default()	1
match approval_policy {	1
pub(crate) guardian_review: GuardianReviewEventParams,	1
// Guardian aborts bypass normal task completion, so emit its idle lifecycle here.	1
user_authorization: GuardianUserAuthorization::Unknown,	1
&exec_policy_fallback,	1
world_state.add_section(CompactPermissionsState::new(exec_policy.as_ref()));	1
fn guardian(input: &'a GuardianReviewEventParams) -> Self {	1
&& seen_attachment_paths.insert(guardian_rollout_path.clone())	1
trusted_guardian_reviewer: configuration.trusted_guardian_reviewer,	1
struct GuardianMemoryContextProbe;	1
conversation.guardian_trunk_rollout_path().await	1
pub struct GuardianApprovalReview {	1
"`approval_policy = \"never\"` cannot be used because requirements do not allow `sandbox_mode = \"danger-full-access\"`; Codex would fall back to read-only permissions with approvals disabled. Choose an `approval_policy` based on what you need, such as `on-request`, or choose an allowed sandbox mode.",	1
fn guardian_review_requested_additional_permissions(action: &GuardianApprovalReviewAction) -> bool {	1
if let ReviewDecision::ApprovedExecpolicyAmendment {	1
let action_tokens = guardian_config	1
NetworkApprovalProtocol::Socks5Udp => ExecPolicyNetworkRuleProtocol::Socks5Udp,	1
CoreGuardianUserAuthorization::Unknown => Self::Unknown,	1
exec_policy,	3
/// Builds the guardian user content items from:	1
source: codex_protocol::protocol::GuardianCommandSource::Shell,	2
let guardian_user_text = request.message_input_texts("user").join("\n");	1
use codex_analytics::GuardianReviewAnalyticsResult;	3
fork_snapshot: Option<GuardianReviewForkSnapshot>,	1
config.approval_policy.value(),	1
self.config.permissions.approval_policy =	1
ThreadSource::GuardianReview	1
) -> Option<ExecPolicyAmendment> {	3
GuardianApprovalRequestSource::DelegatedSubagent,	1
assert_eq!(second_assessment.outcome, GuardianAssessmentOutcome::Allow);	2
response.approval_policy.to_core(),	1
&& let Some(guardian_rollout_path) =	1
let reviewed = crate::guardian::format_guardian_action_pretty(	1
pub(crate) request: GuardianApprovalRequest,	1
pub(super) use codex_app_server_protocol::GuardianUserAuthorization as AppServerGuardianUserAuthorization;	1
Some(FeatureToml::Config(crate::GuardianV2ConfigToml {	1
AskForApproval::OnRequest	1
None => GuardianReviewError::session(error),	1
GuardianTestCatalog::Bundled => {}	1
GuardianApprovalReviewStatus::Approved	1
// descendants (oldest to newest within the retained recent set), guardian rollout,	1
// 2. If StrictAutoReview || Guardian enabled, then Guardian. Else, user.	1
GuardianReviewEventParams {	1
command_assessment_action(GuardianCommandSource::UnifiedExec, command, cwd)	1
pub(crate) const BUNDLED_GUARDIAN_POLICY: &str = include_str!("../../assets/guardian/policy.md");	1
risk_level: GuardianRiskLevel::High,	2
let guardian_assessment = serde_json::json!({	2
GuardianReviewAnalyticsResult {	1
app.config.permissions.approval_policy.value(),	1
export type { GuardianApprovalReviewStatus } from "./GuardianApprovalReviewStatus";	1
entries: VecDeque<GuardianAssessmentEvent>,	1
pub decision_source: AutoReviewDecisionSource,	1
id: Feature::GuardianEnhancedNodeReplTranscripts,	1
"guardian_model",	1
exec_policy,	1
exec_policy: None,	1
let action = GuardianApprovalRequest::NetworkAccess {	1
) -> oneshot::Receiver<ReviewDecision> {	1
codex_protocol::protocol::GuardianAssessmentStatus::Approved => {	1
pub struct GuardianV2TranscriptConfigToml {	1
read_only_guardian_permission_profile(parent_config.permissions.permission_profile());	1
.exec_policy	1
assert_eq!(updated_session.approval_policy, AskForApproval::OnRequest);	1
"approval_policy",	1
async fn wait_for_guardian_review(	1
guardian_exec_command_request("shell-exhausted-retry"),	1
let parse_error = GuardianReviewError::parse(anyhow::anyhow!("bad guardian JSON"));	1
status: codex_protocol::protocol::GuardianAssessmentStatus::InProgress,	1
risk_level: Some(codex_protocol::protocol::GuardianRiskLevel::High),	2
guardian_elicitation_review_request(&request)	1
assert_eq!(third_decision, ReviewDecision::Approved);	1
impl GuardianMcpElicitationReviewer {	1
/// If `command` or `exec_policy_hint` is provided, callers can map exec-policy	1
struct PendingGuardianReviewStatusEntry {	1
/// Serialized `codex_protocol::protocol::GuardianAssessmentEvent`.	1
approval_policy: step.settings.approval_policy(),	1
/// Build a guardian-derived [`ThreadItem`].	1
use codex_app_server_protocol::ExecPolicyAmendment;	1
assert_eq!(payload.review.status, GuardianApprovalReviewStatus::Denied);	2
approval_policy: thread_config.approval_policy,	1
fn commands_for_intercepted_exec_policy(	1
policy: AskForApproval,	1
async fn register_active_ephemeral(&self, review_session: Arc<GuardianReviewSession>) {	1
pub(super) use codex_protocol::approvals::GuardianAssessmentStatus;	1
.map(|annotations| GuardianMcpAnnotations {	2
interactive.approval_policy = None;	1
.expect("guardian thread id");	1
struct GuardianAssessmentTestContext {	1
pub struct GuardianReviewEventParams {	1
if crate::guardian::is_basic_session_source(&turn_context.session_source) {	3
guardian_session_kind: Some(params.guardian_session_kind),	1
GuardianReviewTerminalStatus::Approved	1
pub enum GuardianReviewTerminalStatus {	1
first_metadata.guardian_thread_id,	1
approval_policy,	1
codex_app_server_protocol::GuardianApprovalReviewStatus::TimedOut => {	1
impl ExecPolicyManager {	3
| GuardianReviewError::Parse { .. } => {	1
fn guardian_v2_feature_config_deserializes_classifier_and_transcript_settings() {	1
assert!(matches!(error, Some(GuardianReviewError::Timeout)));	1
pub use events::GuardianReviewAnalyticsResult;	1
} => GuardianAssessmentAction::Execve {	1
.exec_policy	2
use codex_protocol::protocol::GuardianAssessmentDecisionSource;	1
let second_request = GuardianApprovalRequest::ExecCommand {	1
"\nCompleted synchronous Guardian review. This decision applies only to the \	1
let guardian_policy_config_source = guardian_policy_config.map(|sourced| sourced.source);	1
let prompt = build_guardian_prompt_items(	7
root_authorization_version: Option<GuardianAuthorizationVersion>,	1
async fn ensure_guardian_node_repl_policy(	1
fn guardian_assessment_action_redacts_apply_patch_patch_text() {	1
guardian_request_model_for_auto_review(	3
.expect("Guardian v2 settings should deserialize");	1
pub use requirements_exec_policy::RequirementsExecPolicyPrefixRuleToml;	1
if matches!(decision, ReviewDecision::ApprovedForSession) {	1
parent_context: &GuardianReviewContext,	1
struct ExecPolicyCheckOutput<'a> {	1
review_session: Option<Arc<GuardianReviewSession>>,	1
ReviewDecision::Abort,	1
.expect("second guardian thread id should be a valid UUID");	1
async fn guardian_review_retries_two_parse_failures_then_approves() -> anyhow::Result<()> {	1
} => GuardianReviewedAction::McpToolCall {	1
ReviewDecision::denied("approval request failed")	1
pub(crate) use review_session::GuardianReviewSessionManager;	1
.apply_guardian_assessment_event(guardian_command_assessment(	4
export type { ItemGuardianApprovalReviewCompletedNotification } from "./ItemGuardianApprovalReviewCompletedNotification";	1
NetworkApprovalProtocol::Http => ExecPolicyNetworkRuleProtocol::Http,	1
..GuardianAuthorizationVersion::from_history(history)	1
fn guardian_risk_level_str(level: GuardianRiskLevel) -> &'static str {	1
async fn build_guardian_prompt_stale_delta_cursor_falls_back_to_full_prompt() -> anyhow::Result<()>	1
super::GuardianAssessmentOutcome::Deny => GuardianRiskLevel::High,	1
let mut guardian_tool_names = guardian_tools	1
pub(crate) proposed_execpolicy_amendment: Option<ExecPolicyAmendment>,	1
current_approval: AskForApproval,	1
"Guardian v2 transcript max_recent_non_user_entries must be positive",	1
decision_source: Some(GuardianAssessmentDecisionSource::Agent),	2
use codex_protocol::approvals::GuardianCommandSource;	1
GuardianReviewOutcome::Error(GuardianReviewError::Cancelled),	1
if self.status_state.current_status.is_guardian_review() {	1
let decoded = serde_json::from_value::<AskForApproval>(serde_json::json!({	1
return Err(RequirementsExecPolicyParseError::EmptyJustification { rule_index });	1
GuardianAssessmentAction::ApplyPatch { files, .. } => {	1
let prompt = build_guardian_prompt_items_with_parent_turn(	1
GuardianUserAuthorization::Unknown => "unknown",	1
Some(Arc::clone(&parent_thread.session.services.exec_policy))	1
ClientRequest::ThreadApproveGuardianDeniedAction { params, .. } => {	1
input.thread_store.insert(GuardianThreadContext {	1
GuardianAssessmentStatus::Denied => (	1
config.permissions.approval_policy.value().to_string()	1
ReviewDecision::Approved	5
thread_id: "guardian-thread".to_string(),	1
source: ExecPolicyRuleError::InvalidRule(	2
pub exec_policy: Option<RequirementsExecPolicy>,	1
ReviewDecision::denied("rejected by user"),	1
approval_policy_override.is_some() || cfg.approval_policy.is_some();	1
guardian_config.model_provider_id,	1
tx: oneshot::Sender<ReviewDecision>,	1
use codex_guardian_context::SectionHistory;	1
fn for_policy(approval_policy: AskForApproval, reviewer: ApprovalsReviewer) -> Self {	1
pub trusted_tool_context: Option<GuardianTrustedToolFragment>,	1
approval_policy, approvals_reviewer = _approval_mode_override_settings(approval_mode)	6
ev_assistant_message("msg-guardian-2", &second_assessment),	1
approval_policy: config.permissions.approval_policy.clone(),	1
assert!(matches!(error, Some(GuardianReviewError::Cancelled)));	1
pub fn exec_policy_source(&self) -> Option<&RequirementSource> {	1
use codex_analytics::GuardianReviewTerminalStatus;	2
pub reviewed_action: GuardianReviewedAction,	1
approval_policy: settings.approval_policy(),	1
pub(crate) guardian_default_review_model_id: String,	1
.can_set(&AskForApproval::OnRequest)	1
GuardianReviewDecision::Approved => "approved",	1
approval_policy = %approval_policy,	1
// Guardian reviewers receive only `exec_command`, `write_stdin`, and `view_image`	1
use crate::guardian::routes_approval_policy_to_guardian;	2
outcome: GuardianAssessmentOutcome::Deny,	1
pub(crate) guardian_review_model_override: Option<String>,	1
pub use feature_configs::GuardianV2TranscriptSource;	1
ConstraintError::ExecPolicyParse {	1
let _ = app.config.features.disable(Feature::GuardianApproval);	1
id: "guardian-execve".into(),	1
| ServerNotification::GuardianWarning(_)	1
use crate::guardian::review::guardian_review_session_config;	1
async fn guardian_reused_trunk_ignores_stale_prior_turn_completion() -> anyhow::Result<()> {	1
assert_eq!(metadata.guardian_model.as_deref(), Some(request_model));	1
) -> codex_extension_api::ExtensionFuture<'a, Option<ReviewDecision>> {	1
fn guardian_elicitation_review_request(	1
risk_level: Option<GuardianRiskLevel>,	1
GuardianTranscriptEntryKind::Tool("tool web_search call".to_string()),	1
model: guardian_model,	1
pub(crate) struct GuardianReviewEventRequest {	1
guardian_exec_command_request("shell-valid-denial"),	1
runtime_approval_policy_override: Option<AskForApproval>,	1
impl From<CoreExecPolicyAmendment> for ExecPolicyAmendment {	1
fn approvals_reviewer_serializes_auto_review_and_accepts_legacy_guardian_subagent() {	1
async fn routes_approval_to_guardian_allows_granular_review_policy() {	1
codex_protocol::protocol::GuardianAssessmentStatus::InProgress => {	1
} => Some(GuardianReviewError::Cancelled),	1
pub(crate) fn guardian_reviewed_action(	1
ReviewDecision::Approved | ReviewDecision::ApprovedExecpolicyAmendment { .. } => {	1
let (allowed_domains, denied_domains) = exec_policy.compiled_network_domains();	1
} => Some(ExecPolicyAmendment::from(command.clone())),	2
tracing::warn!(%err, "failed to set approval_policy on chat config");	1
/// it is pinned to a read-only sandbox with `approval_policy = never` and	1
async fn build_guardian_prompt_items_explains_network_access_review_scope() -> anyhow::Result<()> {	1
.map(GuardianRootMessage::UserInput),	1
approval_policy: Some(approval_policy),	1
outcome: GuardianAssessmentOutcome::Allow,	2
fn terminal_status_tag(status: GuardianReviewTerminalStatus) -> &'static str {	1
use crate::events::GuardianReviewEventPayload;	1
| ReviewDecision::TimedOut	1
let (GuardianReviewOutcome::Completed(fourth_assessment), fourth_metadata) = fourth_outcome	1
&& subagent_source.kind() != crate::guardian::GUARDIAN_REVIEWER_NAME	1
decision: GuardianReviewDecision::Aborted,	1
key: "guardian_reuse_parent_compaction",	1
use ReviewDecision::*;	1
use codex_analytics::GuardianReviewedAction;	3
assert_eq!(guardian_tool_names, vec!["exec", "wait"]);	1
guardian_default_review_model_id: result.guardian_default_review_model_id,	1
#[schemars(rename = "AskForApproval")]	1
ev_completed("resp-guardian-1"),	2
assert_eq!(guardian_config.permissions.network, Some(network));	1
pub use requirements_exec_policy::RequirementsExecPolicyDecisionToml;	1
guardian_request,	1
interactive.approval_policy.map(Into::into)	2
action: GuardianApprovalReviewAction,	1
pub enum AskForApproval {	2
fn run_execpolicycheck(cmd: ExecPolicyCheckCommand) -> anyhow::Result<()> {	1
"cmd-guardian-denied",	2
pub(crate) use guardian_followup_review_reminder::GuardianFollowupReviewReminder;	1
approval_policy: Constrained<AskForApproval>,	1
async fn fork_snapshot(&self) -> Option<GuardianReviewForkSnapshot> {	1
let action = codex_protocol::protocol::GuardianAssessmentAction::NetworkAccess {	1
pub struct RequirementsExecPolicy {	1
.enabled(Feature::GuardianEnhancedNodeReplTranscripts);	1
free_guardian = true	1
pub allowed_approval_policies: Option<Vec<AskForApproval>>,	2
[guardianv2]	1
let pending_command_execution = match build_item_from_guardian_event(	1
pub(crate) struct GuardianTrustedToolFragment {	1
request: &GuardianApprovalRequest,	2
"forked guardian review should include the last committed trunk assessment"	1
fn guardian_review_request_permissions_network_enabled(	1
current_exec_policy.as_ref(),	1
pub const GUARDIAN_REVIEW_COUNT_METRIC: &str = "codex.guardian.review";	1
"approval required by policy rule, but AskForApproval::Granular.rules is false";	2
assert!(matches!(decision, ReviewDecision::Denied { .. }));	4
//! 4. Apply the guardian's explicit allow/deny outcome.	1
ServerNotification::GuardianWarning(notification) => {	1
let mut state = PendingGuardianReviewStatus::default();	1
.ignore_user_and_project_exec_policy_rules,	2
use crate::guardian::spawn_approval_request_review;	1
crate::GuardianV2TranscriptSource::ToolOutputs,	1
let Some((status, resolution)) = guardian_review_result(notification.review.status) else {	1
let mut missing_target = guardian_command_assessment(	1
pub(crate) struct GuardianReadOnlyHistoryTools(	1
) -> anyhow::Result<GuardianReviewSessionConfig> {	1
GuardianApprovalReviewStatus::TimedOut	1
// ExecPolicy `Allow` can intentionally imply full trust (Skip + bypass_sandbox=true),	1
pub use feature_configs::GuardianV2ReviewScopeConfigToml;	1
pub approval_policy: Option<ApprovalModeCliArg>,	1
GuardianReviewOptions {	2
fn guardian_cwd(environment_id: &str, cwd: PathUri) -> std::io::Result<AbsolutePathBuf> {	1
let guardian_config = match guardian_config.with_model_defaults(model_defaults) {	1
/// Supplies one independently scoped section to Guardian context assembly.	1
GuardianReviewSessionOutcome::SessionFailed { error, error_info } => {	1
GuardianPromptMode::Delta { cursor }	1
pub(crate) fn approval_policy(&self) -> AskForApproval {	2
GuardianApprovalReview {	1
GuardianCommandSource::Shell => Self::Shell,	1
.expect("guardian request should include a model");	1
GuardianReviewSessionOutcome::PromptBuildFailed(err),	1
#[serde(rename = "auto_review", alias = "guardian_subagent")]	2
} => serialize_guardian_action(RequestPermissionsApprovalAction {	1
impl From<CoreAskForApproval> for AskForApproval {	1
/// Consumer for which a Guardian context is composed.	1
"Guardian v2 {field} must be between {MIN_TOKENS} and {MAX_TOKENS} tokens"	1
pub struct GuardianReviewAnalyticsResult {	1
if tool_call_lag > guardian_config.max_tool_call_lag {	1
let assessment_turn_id = guardian_request_turn_id(&request, &turn.sub_id).to_string();	1
use crate::events::GuardianReviewEventParams;	2
GuardianAborted,	1
struct GuardianReviewState {	1
event_params: GuardianReviewEventPayload {	1
export type { ItemGuardianApprovalReviewStartedNotification } from "./ItemGuardianApprovalReviewStartedNotification";	1
if cfg.approval_policy == Some(AskForApproval::UnlessTrusted) {	1
"the destination changes the admitted Guardian V2 classification settings"	1
pub guardian_model_provider_id: Option<String>,	2
pub(crate) fn child_uses_parent_exec_policy(parent_config: &Config, child_config: &Config) -> bool {	1
.append_items(&[turn_context("child-model", AskForApproval::OnRequest)])	1
panic!("expected third guardian assessment");	1
GuardianAssessmentStatus::Denied,	1
let message = guardian_timeout_message(&model);	1
"approval_policy = \"untrusted\" is no longer supported; remove this setting"	1
panic!("expected fourth guardian assessment");	1
started.session.approval_policy,	1
Self::ApproveGuardianDeniedAction { event }	1
return (GuardianReviewSessionOutcome::Aborted, keep_review_session, false);	1
} else if let Some(approval) = approval_policy {	1
decision: ReviewDecision::denied("approval request failed"),	2
ExecPolicyError::ParsePolicy { path, source } => {	2
match approval_policy {	5
trigger: GuardianNetworkAccessTrigger {	1
// Guardian must receive read-only permissions for every inherited environment.	1
ApproveGuardianDeniedAction { event: GuardianAssessmentEvent },	1
Some(codex_protocol::protocol::GuardianAssessmentDecisionSource::Agent)	1
Some("guardian_assessment" | "thread_name_updated" | "undo_completed")	1
crate::experimental_api::ExperimentalApi::experimental_reason(&AskForApproval::Granular {	1
GuardianApprovalRequest::ExecCommand {	15
options: GuardianReviewOptions,	3
async fn record_guardian_non_denial(session: &Arc<Session>, turn_id: &str) {	1
pub(crate) struct GuardianApprovedAction {	1
Some("cmd-guardian-approved")	2
GuardianTranscriptEntryKind::NodeReplToolResult(_)	1
target_item_id: Some("guardian-execve".into()),	1
text: "Trusted synchronous Guardian reviews supplied by Codex. Decisions \	1
let prompt_error = GuardianReviewError::prompt_build(anyhow::anyhow!("bad prompt/config"));	1
approval_request_source: GuardianApprovalRequestSource::MainTurn,	1
pub approval_policy: Constrained<AskForApproval>,	2
let file = test_path_buf("/tmp/guardian.txt").abs();	1
self.ingest_guardian_review(*input, out);	1
approval_policy: Option<AskForApproval>,	1
record_guardian_denial(session, turn, turn_id).await;	1
use crate::guardian::GuardianMcpAnnotations;	1
approval_policy,	9
impl TryFrom<GuardianApprovalReviewAction> for CoreGuardianAssessmentAction {	1
[guardianv2.transcript]\n\	1
GuardianReviewSessionKind::TrunkReused	1
/// Optional tool-call categories available to the Guardian v2 classifier.	1
let RequirementsExecPolicyToml { prefix_rules } = incoming;	1
codex_protocol::approvals::GuardianUserAuthorization::Low	1
guardian_model: None,	1
tracking: &GuardianReviewTrackContext,	1
let guardian_approval = ClientRequest::ThreadApproveGuardianDeniedAction {	1
| ReviewDecision::Abort => {	1
let mut decisions = vec![ReviewDecision::Approved, ReviewDecision::ApprovedForSession];	1
vec![AskForApproval::Never],	1
(Reviewer::Guardian, _, _) => FinalApprovalOutcome::GuardianAborted,	1
("Initial Guardian Review Request", &requests[0]),	1
pub const GUARDIAN_REVIEW_TOKEN_USAGE_METRIC: &str = "codex.guardian.review.token_usage";	1
self.chat_widget.set_approval_policy(policy);	1
&& features.enabled(Feature::GuardianNodeReplTranscriptImages)	1
key: "guardian_enhanced_node_repl_transcripts",	1
pub(crate) use approval_request::GuardianNetworkAccessTrigger;	1
self.runtime_approval_policy_override = Some(policy);	1
"managed requirements keep a Guardian reviewer feature enabled"	1
Self::ApproveGuardianDeniedAction { .. } => "approve_guardian_denied_action",	1
record_guardian_denial(&session, &turn, &assessment_turn_id).await;	1
pub struct GuardianRootSnapshot {	1
GuardianReviewDecision::Denied	1
/// Guardian policy prompt.	1
.expect("partial Guardian v2 transcript settings should deserialize");	1
.then_some(GuardianTranscriptEntry {	1
.name("guardian_ephemeral_retry_preserves_parallel_trunk_and_fork_history".to_string())	1
async fn build_guardian_prompt_items_keeps_other_requests_generic() -> anyhow::Result<()> {	1
AskForApproval,	2
let approval = self.runtime_approval_policy_override;	1
/// Structured lifecycle event for a guardian-reviewed approval request.	1
"method": "guardianWarning",	1
config.exec_policy,	1
"rejection message should include guardian rationale: {rejection}"	1
/// Handle guardian review lifecycle events for the current thread.	1
Some(GuardianReviewFailureReason::ParseError) => "parse_error",	1
ReviewDecision::Denied { rejection } => {	1
tracking: &GuardianReviewTrackContext,	1
| GuardianAssessmentAction::McpToolCall { .. }	1
assert_eq!(payload.turn_id, "turn-guardian-denied");	1
..GuardianReviewAnalyticsResult::without_session()	1
ReviewDecision::denied(format!(	1
.expect("first guardian thread id"),	1
async fn guardian_review_session_config_disables_mcp_apps_plugins_memories_and_guardian_v2() {	1
action: GuardianAssessmentAction::Command {	1
pub decision: GuardianReviewDecision,	2
async fn guardian_review_does_not_retry_missing_assessment_payload() -> anyhow::Result<()> {	1
GuardianReviewError::PromptBuild { message }	1
fn user_authorization_tag(user_authorization: Option<GuardianUserAuthorization>) -> &'static str {	1
guardian_review_model_override: params.guardian_review_model_override.clone(),	1
GuardianAssessmentAction::Command {	1
pub(super) async fn run_guardian_review_session_with_retry(	1
GuardianApprovalReviewAction::NetworkAccess { .. } => true,	1
.map_err(|source| ExecPolicyUpdateError::JoinBlockingTask { source })?	2
.guardian_reasoning_effort	1
impl AsRef<Policy> for RequirementsExecPolicy {	1
guardian_review_model_override: session_config.model_override,	1
ReviewDecision::denied("automatic approval review could not complete")	2
pub(crate) struct FormattedGuardianAction {	1
kind: GuardianTranscriptEntryKind::Assistant,	4
&& approval_policy != AskForApproval::Never	1
pub risk_level: Option<GuardianRiskLevel>,	4
ThreadId::from_string(guardian_thread_id).expect("guardian thread id should be a valid UUID");	1
interactive.approval_policy,	2
let build_without_headless_approval_policy = || {	1
self.status_state.pending_guardian_review_status.clear();	1
decision_source: Some(GuardianAssessmentDecisionSource::Agent),	1
GuardianAssessmentStatus::Denied	1
matches!(assessment.outcome, GuardianAssessmentOutcome::Deny);	1
GuardianApprovalRequestSource::MainTurn => "main_turn",	1
.can_set(&AskForApproval::OnRequest.to_core())	1
context: GuardianReviewContext,	2
ReviewDecision::NetworkPolicyAmendment {	1
/// Truncates text using Guardian's approximate token budget and omission marker.	1
ReviewDecision::ApprovedForSession => {	1
fn guardian_review_error_reason_distinguishes_error_kinds() {	1
history_cell::new_guardian_denied_action_request(format!(	2
/// would just add noise because the guardian reviewer already gets the normal	1
if !input.config.features.enabled(Feature::GuardianV2)	1
impl ExecPolicyAmendment {	2
crate::history_cell::ReviewDecision::Denied,	1
AppCommand::ApproveGuardianDeniedAction { event } => {	1
let mut guardian_statuses = Vec::new();	1
pub fn get<K>(&self, key: &K) -> Option<ReviewDecision>	1
match load_exec_policy(config_stack).await {	1
pub source: GuardianCommandSource,	2
let instructions = build_instructions(exec_policy);	1
let network_constraints = guardian_config	1
rx_approve.await.unwrap_or(ReviewDecision::Abort)	2
} => crate::guardian::GuardianApprovalRequest::ExecCommand {	1
pub(crate) kind: GuardianTranscriptEntryKind,	1
pub fn free_guardian_enabled(&self) -> bool {	1
return Err(RequirementsExecPolicyParseError::AllowDecisionNotAllowed {	1
guardian_reasoning_effort: Some("low".to_string()),	1
Err(format!("invalid Guardian v2 transcript source: {source}"))	1
approval_request_source: codex_analytics::GuardianApprovalRequestSource::MainTurn,	1
fn map_file_change_approval_decision(decision: FileChangeApprovalDecision) -> ReviewDecision {	1
let exec_policy = Arc::new(RwLock::new(	1
pub use policy::RequirementsExecPolicy;	1
GuardianReviewSessionOutcome::SessionFailed {	1
/// Additional policy instructions inserted into the guardian prompt.	1
approval_policy: config_snapshot.approval_policy.into(),	1
let approval_policy =	1
assert!(!routes_approval_to_guardian(&turn));	1
third_request_body_text.contains("first guardian rationale"),	1
pub(crate) struct GuardianTrustedSkillsFragment {	1
use super::ExecPolicyCommandOrigin;	1
Guardian,	6
AskForApproval::Never | AskForApproval::OnRequest | AskForApproval::Granular(_) => {	1
let approved = matches!(assessment.outcome, GuardianAssessmentOutcome::Allow);	1
"failed to persist Guardian V2 classification result"	1
"guardian_ephemeral_retry_preserves_parallel_trunk_and_fork_history thread panicked"	1
AskForApproval::UnlessTrusted	1
context: InterceptedExecPolicyContext,	1
const GUARDIAN_SKILL_BODY_PROBE: &str = "guardian skill body probe";	1
export type { GuardianUserAuthorization } from "./GuardianUserAuthorization";	1
guardian_nested_tool_names,	1
self.guardian_policy_config	1
"turn-guardian-missing-target",	1
AskForApproval::Never,	2
assert_eq!(guardian_request_target_item_id(&network_access), None);	1
let inherited_exec_policy = self	1
GuardianTranscriptEntryKind::Tool(format!("tool {name} result")),	1
format_guardian_action_pretty(&request).ok().map(|action| {	1
pub use exec_policy::load_exec_policy;	1
use super::review_session::GuardianReviewSessionParams;	1
pub guardianv2: Option<FeatureToml<GuardianV2ConfigToml>>,	1
/// structure as `config.toml` where fields like `approval_policy` can specify	1
impl GuardianReviewError {	1
"{\"risk_level\":\"low\",\"user_authorization\":\"high\",\"outcome\":\"allow\",\"rationale\":\"fourth guardian rationale\"}",	1
export type { GuardianApprovalReview } from "./GuardianApprovalReview";	1
let reminder: ResponseItem = ContextualUserFragment::into(GuardianFollowupReviewReminder);	1
let InterceptedExecPolicyContext {	1
let auto_review_enabled = crate::guardian::routes_approval_policy_to_guardian(	1
let guardian_permission_snapshot = params	1
} => serialize_guardian_action(McpToolCallApprovalAction {	1
.expect("guardian request functions namespace");	1
if event.status == GuardianAssessmentStatus::Denied =>	1
ev_response_created("resp-guardian-4"),	1
ApprovalReviewer::Guardian	1
GuardianReviewOutcome::Error(error),	1
fn later_resume_approval_policy_partially_overrides_approve_for_me() {	1
Self::Cancelled => GuardianReviewFailureReason::Cancelled,	1
normalize_guardian_snapshot_paths(text)	1
FileChangeApprovalDecision::Cancel => ReviewDecision::Abort,	1
let guardian_command = |action: &GuardianAssessmentAction| match action {	1
pub(super) trusted_guardian_reviewer: bool,	1
async fn guardian_request_model_for_auto_review(	1
let guardian_session_kind = if spawned_trunk {	1
assert_eq!(config.permissions.approval_policy.value(), required_policy);	1
AskForApproval::OnRequest	5
async fn record_guardian_denial(session: &Arc<Session>, turn: &Arc<TurnContext>, turn_id: &str) {	1
AskForApproval::from(full_access.approval),	1
use prompt::GuardianTranscriptEntryKind;	1
command: "rm -rf /tmp/guardian".into(),	1
GuardianAssessmentOutcome::Allow => true,	1
pub enum RequirementsExecPolicyDecisionToml {	1
guardian_policy_config: Some("Use the system guardian policy.".to_string()),	1
entries.insert(Feature::GuardianV2.key().to_string(), enabled);	1
guardian_exec_command_request("shell-1"),	1
self.chat_widget.set_approval_policy(AskForApproval::from(	1
use crate::guardian::BUNDLED_GUARDIAN_POLICY_TEMPLATE;	1
"review-cancelled-guardian".to_string(),	1
PendingApprovalDecision::AllowForSession => ReviewDecision::ApprovedForSession,	1
use prompt::build_guardian_prompt_items_with_parent_turn;	1
serde_json::from_str::<GuardianAssessmentPayload>(slice)?	1
fn parse_guardian_assessment_extracts_embedded_json() {	1
Some(GuardianReviewFailureReason::Timeout) => "timeout",	1
if let Some(requested_approval) = request.approval_policy.as_ref() {	1
ReviewDecision::denied("approval request failed")	2
pub(crate) struct GuardianPromptItems {	1
"guardian request should use Responses Lite tool input"	1
impl<S> GuardianExtension<S> {	2
target: &mut Option<Sourced<RequirementsExecPolicyToml>>,	1
if let Some(approval_policy) = approval_policy {	1
pub(super) use codex_protocol::approvals::GuardianRiskLevel;	1
"{\"risk_level\":\"low\",\"user_authorization\":\"high\",\"outcome\":\"allow\",\"rationale\":\"third guardian rationale\"}",	1
let action = GuardianApprovalRequest::McpToolCall {	1
let review_model_messages = if config.guardian_policy_config.is_none() {	1
let approval_policy = AskForApproval::from(self.config.permissions.approval_policy.value());	2
self.state.lock().await.trunk = Some(Arc::new(GuardianReviewSession {	1
GuardianElicitationReview::ApprovalRequest(guardian_request) => *guardian_request,	1
let approval_policy =	1
format_allow_prefixes(exec_policy.get_allowed_prefixes()).expect("formatted prefixes");	1
pub exec_policy_hint: Option<String>,	2
state: Mutex<GuardianReviewState>,	1
let config_toml = "approvals_reviewer = \"user\"\napproval_policy = \"on-request\"\nsandbox_mode = \"workspace-write\"\n\n[features]\nguardian_approval = true\n";	1
approval_policy: mut constrained_approval_policy,	1
CoreAskForApproval::Never => AskForApproval::Never,	1
impl GuardianV2Extension {	1
ServerNotification::ItemGuardianApprovalReviewCompleted(payload) => {	4
pub enum GuardianReviewDecision {	1
AskForApproval::UnlessTrusted	4
let action: GuardianAssessmentAction =	1
GuardianReviewTerminalStatus::TimedOut => "timed_out",	1
toml::from_str(&format!("[guardianv2.transcript]\n{setting} = 100"))	1
.unwrap_or(GuardianUserAuthorization::Unknown),	1
GuardianReviewFailureReason::ParseError	1
fn read_only_guardian_permission_profile(	1
let transcript_cursor = GuardianTranscriptCursor {	1
let guardian_context = GuardianAssessmentTestContext {	1
id: "guardian-exec".into(),	1
.expect("guardian config should continue when a disabled feature is pinned on");	1
pub(crate) use guardian_approved_action::GuardianApprovedAction;	1
GuardianAssessmentStatus::Denied | GuardianAssessmentStatus::Aborted => {	1
let (path, range) = crate::exec_policy_warning_location(&err);	1
use codex_app_server_protocol::ExecPolicyAmendment as V2ExecPolicyAmendment;	1
Some(codex_protocol::protocol::GuardianRiskLevel::High),	1
field_name: "approval_policy",	3
.expect("Guardian v2 boundary settings should deserialize");	1
approval_policy: Some(approval),	1
"features: guardian_approval=true (source: {requirements_source})"	1
Some(GuardianAssessmentOutcome::Deny) => "deny",	1
exec_policy: None,	7
let notification = guardian_auto_approval_review_notification(	3
"guardian review failed"	1
render_guardian_transcript_entries_with_offset(	1
pub(super) rules: Option<RequirementsExecPolicyToml>,	1
_ => return Err("invalid Guardian V2 classification".to_owned()),	1
assert_eq!(item.approval_policy, AskForApproval::OnRequest);	1
let policy = config.resolve_guardian_policy(review_model_messages.as_ref());	1
&& let Some(detail) = guardian_action_summary(&ev.action)	1
pub use crate::approvals::GuardianAssessmentEvent;	1
let text = guardian_prompt_text(&prompt.items);	9
pub use events::GuardianReviewSessionKind;	1
fn track_guardian_review(	1
trunk: &Arc<GuardianReviewSession>,	1
pub(super) const FAST_DECISION_METRIC: &str = "codex.guardian_v2.fast_decision";	1
.guardian_thread_id	1
fn into_tool_result(self, model_info: &ModelInfo) -> Result<ReviewDecision, ToolError> {	1
use crate::guardian::GuardianReviewContext;	6
} => crate::guardian::GuardianApprovalRequest::Execve {	1
field_name: "approval_policy",	1
assert_eq!(app.runtime_approval_policy_override, None);	2
let decision = runtime.block_on(run_guardian_review(	1
pub(crate) enum GuardianTranscriptEntryKind {	1
/// Delegates one guardian-owned subagent spawn request to the host helper.	1
runtime_approval_policy_override: None,	1
items.push(guardian_developer_message);	1
track_guardian_review(	3
use codex_protocol::protocol::GuardianUserAuthorization;	5
message: format!("Guardian V2 risk scoring failed: {error}"),	2
let (outcome, mut analytics_result) = run_guardian_review_session_before_deadline(	1
pub(super) async fn guardian_review_session_config(	1
guardian_request_turn_id(&network_access, "fallback-turn"),	1
use codex_protocol::approvals::GuardianAssessmentDecisionSource;	1
AskForApproval::OnRequest | AskForApproval::UnlessTrusted | AskForApproval::Granular(_) => {	2
let ThreadApproveGuardianDeniedActionParams { thread_id, event } = params;	1
&& let Err(err) = config.permissions.approval_policy.set(policy.to_core())	1
pub(crate) risk_level: codex_protocol::protocol::GuardianRiskLevel,	1
.get::<GuardianMemoryContextEnabled>()	1
patch: "*** Begin Patch\n*** Update File: guardian.txt\n@@\n+hello\n*** End Patch"	1
codex_guardian_v2::install(	1
use prompt::parse_guardian_assessment;	1
AskForApproval::OnRequest => false,	1
use super::config::GuardianV2Config;	1
error: anyhow!("guardian review input was not started: {submission:?}"),	1
.insert(GuardianThreadContext { parent_thread_id });	1
metadata.approval_mode = enum_to_string(&settings.approval_policy);	1
config.features.get_or_insert_default().guardianv2 = Some(FeatureToml::Enabled(false));	1
status: GuardianAssessmentStatus::Denied,	1
if let Some(policy) = selection.approval_policy {	1
.inherited_exec_policy_for_source(&state, session_source.as_ref(), &config)	1
assert!(!guardian_config.features.enabled(Feature::Apps));	1
matches!(prompt_mode, GuardianPromptMode::Delta { .. })	1
let approval_policy = tool_ctx.step_context.settings.approval_policy();	1
GuardianPolicy::new(developer_instructions).render_fragment(),	1
.push(Arc::new(GuardianReviewSession {	1
third_metadata.guardian_thread_id,	1
CodexToolCallApprovalPolicy::OnRequest => AskForApproval::OnRequest,	1
GuardianReviewSessionOutcome,	1
.map(GuardianRootMessage::render),	1
approval_policy: AskForApproval::Never,	4
GuardianElicitationReview::NotRequested	1
exec_policy: self	1
approval_policy: Option<codex_app_server_protocol::AskForApproval>,	1
} => GuardianAssessmentAction::WriteStdin {	1
pub(super) enum GuardianReviewError {	1
NetworkPolicyRuleAction::Deny => (ExecPolicyDecision::Forbidden, "Deny"),	1
CoreGuardianAssessmentAction::Command {	1
GuardianCommandSource::Shell => "shell",	1
decision: GuardianReviewDecision::Aborted,	1
"guardian request should not include memory context"	1
approval: AskForApproval::OnRequest,	2
ReviewDecision::ApprovedMcpPolicyAmendment => {	1
.wrap_err("thread/approveGuardianDeniedAction failed in TUI")?;	1
) -> Result<Option<FeatureToml<GuardianV2ConfigToml>>, D::Error>	1
"codex.guardian_v2.classification.truncation.bytes";	1
Some("Use the cloud-managed guardian policy.\n")	1
/// Logs Guardian turn and tool events that bypass the app-server listener.	1
use super::approval_request::guardian_request_turn_id;	1
status: GuardianAssessmentStatus::Denied,	1
anyhow::anyhow!("temporary guardian failure"),	1
Self::GuardianClassifier => "/guardian-classifier",	1
mode: GuardianPromptMode,	2
let decision = crate::guardian::review_approval_request_with_cancel(	1
serde_json::to_value(&action).expect("serialize guardian action"),	1
local_overrides: GuardianV2ConfigToml,	1
annotations: Option<crate::guardian::GuardianMcpAnnotations>,	1
async fn build_guardian_prompt_items_keeps_required_node_repl_reviews_generic() -> anyhow::Result<()>	1
self.exec_policy.as_ref().map(|policy| &policy.source)	1
if let Some(policy) = approval_policy_from_effective_config(effective_config) {	1
let approval_policy = if interactive.dangerously_bypass_approvals_and_sandbox {	1
&guardian_snapshot_options(),	1
guardian_config.model_auto_compact_token_limit,	2
ReviewDecision::Abort	1
let reviewed_action = guardian_reviewed_action(&request);	1
Some(GuardianReviewSessionKind::TrunkNew) => "trunk_new",	1
fn build_guardian_transcript_keeps_original_numbering() {	1
pub(crate) fn new_guardian_review_id() -> String {	1
fn guardian_warning_notifications_route_to_threads() {	1
fn plugin_attribution_for_guardian_request(	1
let (prefix, suffix) = split_guardian_truncation_bounds(content, prefix_budget, suffix_budget);	1
ctx.review_context.approval_policy,	1
let guardian_session = Arc::clone(&session);	1
AskForApproval::OnRequest => match approvals_reviewer {	1
guardian_exec_command_request("shell-missing-assessment"),	1
let session_config = match guardian_review_session_config(session.as_ref(), turn.as_ref()).await	1
.get::<GuardianThreadContext>()	1
pub(super) use codex_protocol::approvals::GuardianCommandSource;	1
approval_policy = "never"	3
assessment: &GuardianAssessmentEvent,	2
guardian_rejection_circuit_breaker: Mutex::new(Default::default()),	1
) -> Vec<GuardianTranscriptEntry> {	1
pub enum GuardianV2TranscriptSource {	1
let settings = format!("[guardianv2]\n{setting} = {value}");	1
"second guardian request was not observed"	1
/// The asynchronous Guardian action scorer.	1
match turn_context.approval_policy() {	1
registry.thread_lifecycle_contributor(Arc::new(GuardianExtension::new(	1
let is_guardian_reviewer = crate::guardian::is_basic_session_source(&session_source);	1
&& !trusted_guardian_reviewer	1
second_metadata.guardian_session_kind,	2
pub fn new_guardian_timed_out_action_request(summary: String) -> Box<dyn HistoryCell> {	1
use crate::RequirementsExecPolicy;	1
pub guardian_reasoning_effort: Option<String>,	3
impl ContextualUserFragment for GuardianReviewEvidenceFragment {	1
GuardianAssessmentAction::NetworkAccess { target, .. } => {	1
ReviewDecision::ApprovedForSession => RequestPermissionsResponse {	1
pub use crate::approvals::GuardianRiskLevel;	1
GuardianApprovalReviewAction::RequestPermissions { permissions, .. } => {	3
event: &GuardianAssessmentEvent,	1
if config.permissions.approval_policy.value() != AskForApproval::Never {	1
original_approval_policy	1
parse_guardian_assessment(Some(r#"{"outcome":"allow"}"#)).expect("guardian assessment");	1
guardian_catalog_contains_auto_review: session_config.catalog_contains_auto_review,	1
GuardianAssessmentStatus::Approved	1
vec![AskForApproval::OnRequest],	1
ReviewDecision::Abort => {	2
guardian_config.model_provider.stream_max_retries = Some(1);	1
let action = match action.into_guardian_request() {	1
async fn build_guardian_prompt_full_mode_preserves_initial_review_format() -> anyhow::Result<()> {	1
target_item_id: Some("guardian-exec".into()),	2
.exec_policy	6
} => serialize_guardian_action(WriteStdinApprovalAction {	1
impl GuardianRootMessage {	1
source: GuardianCommandSource::Shell,	1
fn serialize_command_guardian_action(	1
pub(crate) guardian_review_session: GuardianReviewSessionManager,	1
pub protocol: ExecPolicyNetworkRuleProtocol,	1
guardian_thread_id: None,	1
/// Guardian consumers that should receive this contribution.	1
) -> ExecPolicyNetworkRuleAmendment {	1
GuardianApprovalRequest::ExecCommand { id, .. }	1
let trusted_guardian_request = if request.server_name == CODEX_APPS_MCP_SERVER_NAME {	1
guardian_thread_id: review_session.session.thread_id().to_string(),	1
pub(crate) struct GuardianReviewSessionManager {	1
GuardianAssessmentAction::Command { .. } => unreachable!(),	1
fn collect_guardian_transcript_entries_preserves_named_unpaired_tool_sources() {	1
GuardianApprovalReviewAction::Execve {	1
GuardianTestCatalog::ParentOnly => {	1
terminal_status: GuardianReviewTerminalStatus::Aborted,	1
) -> (GuardianReviewOutcome, GuardianReviewAnalyticsResult) {	2
pub(crate) use approval_request::GuardianMcpAnnotations;	1
ReviewResolution::ExecPolicyAmendment,	1
&[turn_context("parent-model", AskForApproval::Never)],	1
guardian_config.model_provider,	1
guardian_reasoning_effort: result.guardian_reasoning_effort,	1
.expect("guardian review should include input items");	1
"{\"risk_level\":\"high\",\"user_authorization\":\"low\",\"outcome\":\"deny\",\"rationale\":\"stale guardian rationale\"}"	1
guardian_policy_config,	5
fn guardian_review_metrics_record_counts_durations_and_token_usage() {	1
return ReviewDecision::Abort;	4
"guardian MCP elicitation review does not support this elicitation mode",	1
approval_request_source: codex_analytics::GuardianApprovalRequestSource::MainTurn,	1
approval_policy,	21
EventMsg::GuardianWarning(WarningEvent {	1
status: GuardianAssessmentStatus::Aborted,	1
/// Full Guardian approval-review agent inference.	1
approval_policy: approval_policy_override,	1
let Some(evidence) = input.thread_store.get::<GuardianReviewEvidence>() else {	1
"rationale": "third guardian rationale",	1
Some("cmd-guardian-denied")	2
pub(crate) review_scope: GuardianV2ReviewScope,	1
let action_summary = guardian_assessment_action(&request);	1
user_authorization: Option<GuardianUserAuthorization>,	1
| GuardianAssessmentAction::NetworkAccess { .. }	1
cli.approval_policy.map(Into::into),	1
} => CoreAskForApproval::Granular(CoreGranularApprovalConfig {	1
GuardianApprovalReviewStatus::Denied => {	1
use codex_execpolicy::ExecPolicyCheckCommand;	2
) -> GuardianApprovalRequest {	1
pub(super) use codex_protocol::approvals::GuardianAssessmentAction;	1
pub use events::GuardianReviewedAction;	1
&ReviewDecision::Approved,	1
ReviewDecision::ApprovedForSession,	1
if approval_policy_override.is_some()	1
approval_mode: parse_or_default(&metadata.approval_mode, AskForApproval::OnRequest),	1
guardian_policy_config: Some("   \n\t".to_string()),	1
guardian_default_review_model_id: params.guardian_default_review_model_id.clone(),	1
AskForApproval::UnlessTrusted => None,	1
GuardianReviewedAction::WriteStdin { .. } => "write_stdin",	1
AskForApproval::Granular(granular_config) if !granular_config.sandbox_approval	1
pub(crate) guardian_rejection_circuit_breaker: Mutex<GuardianRejectionCircuitBreaker>,	1
pub authorization_version: GuardianAuthorizationVersion,	2
| codex_protocol::protocol::GuardianAssessmentStatus::TimedOut	1
.set(turn.approval_policy())	1
/// Returns a rejection reason when `approval_policy` disallows surfacing the	1
GuardianReviewSessionOutcome::Completed(Err(anyhow!(	1
[guardianv2.transcript]	1
pub(crate) struct GuardianReviewOptions {	1
GuardianApprovalReviewStatus::Aborted => {	1
fn from(value: CoreGuardianRiskLevel) -> Self {	1
let approval_policy = step_context.settings.approval_policy();	1
pub guardian_model: String,	1
metadata.guardian_reasoning_effort.as_deref(),	1
ExecPolicyNetworkRuleAmendment {	1
use super::ExecPolicyAmendment;	1
pub pattern: Vec<RequirementsExecPolicyPatternTokenToml>,	1
[guardianv2.review_scope]	1
pub approval_mode: AskForApproval,	2
GuardianClassifier,	1
use super::GuardianReviewContext;	3
| ReviewDecision::Abort	2
pub use events::GuardianReviewSessionAnalyticsParams;	1
guardian_policy_config,	1
export type { GuardianApprovalReviewAction } from "./GuardianApprovalReviewAction";	1
) -> Option<GuardianTrustedToolFragment> {	1
event_name: "guardian",	1
fn dangerous_bypass_conflicts_with_approval_policy() {	1
pub(super) use codex_app_server_protocol::GuardianWarningNotification;	1
| ServerNotification::ItemGuardianApprovalReviewCompleted(_)	1
pub struct GuardianReviewEvidenceRecord {	1
approval_policy: Some(AskForApproval::Never),	1
use codex_protocol::protocol::GuardianAssessmentOutcome;	3
Some(self.config.permissions.approval_policy.value().into());	1
approval_policy: turn_context.approval_policy,	1
guardian_agent_spawner: S,	1
(AskForApproval::Granular(granular_config), DecisionSource::PrefixRule)	1
GuardianReviewDecision::Approved	1
Some(codex_app_server_protocol::GuardianUserAuthorization::Low)	1
terminal_status: GuardianReviewTerminalStatus::Aborted,	1
.expect("first guardian thread id should be a valid UUID");	1
EventMsg::GuardianAssessment(GuardianAssessmentEvent {	1
use crate::context::GuardianNodeReplPolicy;	1
pub action: GuardianApprovalReviewAction,	2
ExecPolicyManager::load(&config.config_layer_stack)	1
requirements.exec_policy_source(),	1
if keep_review_session && matches!(outcome, GuardianReviewSessionOutcome::Completed(_)) {	1
Constrained::allow_any(AskForApproval::Never),	1
self.config.permissions.approval_policy.value(),	1
pub(crate) enum GuardianReviewSessionOutcome {	1
ev_response_created("resp-guardian-1"),	2
guardian_approval_request_to_json(&action)?,	2
GuardianAssessmentAction::ApplyPatch { files, .. } => {	1
guardian_policy_config: guardian_policy_config	1
per_turn_config.permissions.approval_policy =	1
GuardianReviewError::PromptBuild { .. }	1
"guardian reviewer could not set read-only permissions: {error}"	1
assert_eq!(second_review.await?, ReviewDecision::Approved);	1
Some(AskForApproval::from(p.approval)),	1
&& tool.should_bypass_approval(approval_policy, already_approved)	1
review_threshold = guardian_config.review_threshold,	1
CoreThreadSource::GuardianReview => ThreadSource::GuardianReview,	1
pub(crate) use guardian_node_repl_policy::GuardianNodeReplPolicy;	1
ephemeral_reviews: Vec<Arc<GuardianReviewSession>>,	1
reviews: VecDeque<Arc<GuardianReviewEvidenceRecord>>,	1
AskForApproval::Never,	1
"guardian request should contain the untrusted skill mention from the parent transcript"	1
serde_json::to_value(&action).expect("serialize guardian review action"),	1
fn guardian_approval_request_to_json_renders_mcp_tool_call_shape() -> serde_json::Result<()> {	1
let GuardianReviewOutcome::Completed(assessment) = outcome else {	2
assert!(!guardian_config.memories.dedicated_tools);	1
annotations: Option<&'a GuardianMcpAnnotations>,	1
GuardianApprovalRequest::WriteStdin {	2
review_scope: Some(crate::GuardianV2ReviewScopeConfigToml {	1
let live_thread = session.live_thread_for_persistence("guardian review fork")?;	1
"the destination changes the Guardian parent-fallback policy template".to_string(),	1
async fn seed_guardian_parent_history(session: &Arc<Session>, turn: &Arc<TurnContext>) {	1
source: GuardianCommandSource::Shell,	3
GuardianReviewOutcome::Completed(assessment),	1
CommandExecutionApprovalDecision::Accept => ReviewDecision::Approved,	1
.ignore_user_and_project_exec_policy_rules(),	2
"invalid Guardian v2 settings should fail: {settings}"	1
guardian_review_model_override: result.guardian_review_model_override,	1
per_turn_config.permissions.approval_policy.value(),	1
approval_policy_override = Some(auto_review_preset.approval_policy);	1
Some(format!("guardian:{parent_thread_id}"))	1
pub(crate) async fn request_guardian_approval(	1
guardian_config.notify = None;	1
CoreGuardianAssessmentAction::McpToolCall {	1
let outcome = run_guardian_review_session_for_test(	1
|| params.approval_policy.is_some()	1
impl GuardianApprovedAction {	1
let schema = guardian_output_schema();	2
export type { AutoReviewDecisionSource } from "./AutoReviewDecisionSource";	1
assessment: &GuardianAssessmentEvent,	1
.guardian_review_session	1
pub outcome: GuardianAssessmentOutcome,	1
let (session, turn, rx) = guardian_test_session_turn_and_rx(&server).await;	1
.and_then(|messages| messages.guardian_v2.clone())	1
mod guardian_policy;	1
let GuardianV2ReviewScope::Standard {	1
body: sse(vec![ev_response_created("resp-guardian-2")]),	1
"cmd-guardian-missing-target",	1
async fn guardian_review_session_config_clears_context_overrides_for_distinct_effective_model() {	1
arg.conflicts_with("approval_policy")	1
EventMsg::GuardianAssessment(assessment) => {	1
AskForApproval::Granular {	1
crate::guardian::GuardianReviewOptions {	1
} => serialize_command_guardian_action(	1
if let Some(enabled) = self.guardianv2.as_ref().and_then(FeatureToml::enabled) {	1
let mut circuit_breaker = GuardianRejectionCircuitBreaker::default();	5
.track_guardian_session_event(self.thread_id, &event);	1
if !separate_guardian_developer_message	1
approval_policy: constrained_approval_policy.value,	1
result: GuardianReviewAnalyticsResult,	2
approve_guardian_denied_action(&sess, event).await;	1
crate::exec_policy::render_decision_for_unmatched_command(	1
let (allowed_domains, denied_domains) = exec_policy.compiled_network_domains();	1
GuardianApprovalRequest::ApplyPatch {	2
normalize_guardian_snapshot_paths(context_snapshot::format_labeled_requests_snapshot(	1
command_origin: ExecPolicyCommandOrigin,	3
let mut policy_commands = commands_for_exec_policy(command);	1
if event.status != GuardianAssessmentStatus::Denied {	1
pub(crate) use prompt::guardian_truncate_text;	1
async fn run_guardian_review(	1
} => crate::guardian::GuardianApprovalRequest::McpToolCall {	1
state: Mutex::new(GuardianReviewState {	1
GuardianApprovalRequest::McpToolCall {	2
pub(super) const TOOL_CALL_LAG_METRIC: &str = "codex.guardian_v2.tool_call_lag";	1
let context = GuardianReviewContext::from(&turn);	5
"approval_policy": "never",	4
let second_outcome = run_guardian_review_session_for_test(	2
reasoning_effort: guardian_reasoning_effort,	1
available_decisions: Option<Vec<ReviewDecision>>,	1
"codex_core__guardian__tests__guardian_review_request_layout",	1
approval_policy: AskForApproval::OnRequest,	5
pub(crate) struct GuardianFollowupReviewReminder;	1
ReviewDecision::Abort => {	1
return vec![ReviewDecision::Approved, ReviewDecision::Abort];	1
assert_eq!(overrides.approval_policy, Some(AskForApproval::Never));	1
} => crate::guardian::GuardianApprovalRequest::NetworkAccess {	1
.or_else(|| guardian_disabled_reason(true)),	1
Ok(Some(mcp_elicitation_response_from_guardian_decision(	1
} else if self.status_state.pending_guardian_review_status.is_empty()	1
GuardianAssessmentAction::Execve { .. } => unreachable!(),	1
AskForApproval::OnRequest => true,	1
decision_source: Some(GuardianAssessmentDecisionSource::Agent),	1
if config.approval_policy == Some(AskForApproval::UnlessTrusted) {	1
AskForApproval::Granular(_) => match file_system_sandbox_policy.kind {	1
AskForApproval::from(preset.approval),	1
(ReviewDecision::ApprovedForSession, None)	1
ServerNotification::ItemGuardianApprovalReviewStarted(notification) => {	2
export type { ReviewDecision } from "./ReviewDecision";	1
impl RequirementsExecPolicyDecisionToml {	1
ReviewDecision::NetworkPolicyAmendment {	1
/// Renders a compact guardian transcript from the retained history entries,	1
analytics_result.guardian_default_review_model_id.as_deref(),	3
pub proposed_execpolicy_amendment: Option<ExecPolicyAmendment>,	2
pub decision_source: Option<GuardianAssessmentDecisionSource>,	1
// Allow 5s for Guardian cleanup and 5s for controller processing after review.	1
&& admitted_config.features.enabled(Feature::GuardianApproval)	1
pub struct ExecPolicyAmendment {	2
r#"approval_policy="on-request""#.to_string(),	1
source: GuardianCommandSource::UnifiedExec,	1
mod guardian_followup_review_reminder;	1
context: impl Into<GuardianReviewContext>,	4
fn guardian_policy_config_from_requirements(	1
if typesafe_overrides.approval_policy.is_none()	1
return Err("Guardian v2 review_threshold must be between 0.0 and 1.0".to_owned());	1
// The first REPL execution never waits for synchronous Guardian review.	1
.expect("second guardian thread id"),	1
ReviewDecision::TimedOut => "timed_out",	1
use crate::events::GuardianReviewAnalyticsResult;	1
if feature == Feature::GuardianApproval {	1
.map_err(|err| internal_error(format!("failed to approve Guardian denial: {err}")))?;	1
use prompt::guardian_output_schema;	1
EventMsg::GuardianAssessment(payload) => self.handle_guardian_assessment(payload),	1
CoreAskForApproval::OnRequest => AskForApproval::OnRequest,	1
pub struct ItemGuardianApprovalReviewCompletedNotification {	1
registry.thread_lifecycle_contributor(Arc::new(GuardianExtension::new(agent_spawner)));	1
pub use requirements_exec_policy::RequirementsExecPolicyParseError;	1
GuardianReviewOutcome::Error(GuardianReviewError::session(err)),	1
"failed to localize guardian filesystem paths: {err}"	1
if lease.connection.endpoint == ResponsesEndpoint::GuardianClassifier {	1
async fn guardian_review_retry_wait_honors_cancellation() {	1
let third_outcome = run_guardian_review_session_for_test(	1
pub exec_policy: Option<Sourced<RequirementsExecPolicy>>,	1
let planned_action = match action.render(guardian_config.max_action_tokens) {	1
fork_config.permissions.approval_policy.value(),	1
GuardianAssessmentAction::McpToolCall {	1
typesafe_overrides.approval_policy = Some(persisted_settings.approval_policy);	2
let guardian_request = match guardian_elicitation_review_request(&request) {	1
text: "Compacted summary of earlier guardian context.".to_string(),	1
guardian_tool_names.sort_unstable();	1
Ok(GuardianPromptItems {	1
fn guardian_assessment_completed_emits_review_payload() {	1
AskForApproval::from(preset.approval),	1
|| crate::guardian::is_basic_session_source(&step_context.turn.session_source)	1
decision: &ReviewDecision,	1
let parsed = parse_guardian_assessment(Some(	1
mod guardian_v2;	1
guardian_review_result(GuardianApprovalReviewStatus::TimedOut),	1
guardian_session_kind: None,	1
Some(codex_protocol::protocol::GuardianRiskLevel::Low),	1
tx.send(AppEvent::UpdateAskForApprovalPolicy(approval));	1
impl From<CodexToolCallApprovalPolicy> for AskForApproval {	1
.enabled(Feature::GuardianApproval)	1
path: guardian_rollout_path,	1
impl From<Vec<String>> for ExecPolicyAmendment {	1
features.guardianv2,	1
//! Guardian's shared UTF-8-safe, prefix/suffix text truncation primitive.	1
self.runtime_approval_policy_override = selection.approval_policy;	1
CoreGuardianRiskLevel::Medium => Self::Medium,	1
&self.selected.approval_policy	1
GuardianAssessmentOutcome::Deny => false,	1
pub guardian_policy_config: Option<Sourced<String>>,	1
include_str!("../templates/permissions/approval_policy/unless_trusted.md");	1
decisions.push(ReviewDecision::NetworkPolicyAmendment {	1
let evaluation = exec_policy.check_multiple_with_options(	1
incoming: Option<RequirementsExecPolicyToml>,	1
decision_source: if matches!(status, GuardianAssessmentStatus::InProgress) {	1
approval_policy: Some(AskForApproval::Granular {	2
let v2_policy = AskForApproval::Granular {	1
.pending_guardian_review_status	3
approval_policy: None,	9
if !constraints.trusted_guardian_reviewer	1
GuardianReviewAnalyticsResult {	1
ItemGuardianApprovalReviewCompleted => "item/autoApprovalReview/completed" (v2::ItemGuardianApprovalReviewCompletedNotification),	1
let Some(guardian_config) = input.thread_store.get::<GuardianV2Config>() else {	1
op: AppCommand::approve_guardian_denied_action(event),	1
GuardianApprovalRequest::Execve {	4
"rationale": "first guardian rationale",	1
.and_then(|environment| environment.config().exec_policy.as_ref())	1
builder.approval_mode = AskForApproval::OnRequest;	1
ReviewDecision::Denied { rejection } => Err(ToolError::Rejected(rejection)),	1
use codex_protocol::protocol::GuardianUserAuthorization as CoreGuardianUserAuthorization;	1
GuardianReviewedAction::RequestPermissions {} => "request_permissions",	1
guardian_config.model = Some(active_model.to_string());	1
fn should_retry_guardian_review(outcome: &GuardianReviewOutcome) -> bool {	1
) -> (GuardianReviewSessionOutcome, GuardianReviewAnalyticsResult) {	2
.enabled(Feature::GuardianNodeReplTranscriptImages)	1
ReviewDecision::ApprovedExecpolicyAmendment {	1
crate::experimental_api::ExperimentalApi::experimental_reason(&AskForApproval::OnRequest,),	1
GuardianReviewTerminalStatus::FailedClosed => "failed_closed",	1
(Reviewer::Guardian, ReviewStatus::Denied, _) => FinalApprovalOutcome::GuardianDenied,	1
pub(super) fn constrained_approval_policy(&self) -> &Constrained<AskForApproval> {	1
use super::GuardianRejectionCircuitBreakerPolicy;	1
/// Source for the managed guardian policy config, when one is configured.	1
response.approval_policy.to_core(),	2
interactive.approval_policy = Some(approval);	1
async fn guardian_review_uses_preferred_review_model_without_model_catalog_override()	1
| codex_protocol::protocol::GuardianAssessmentStatus::Denied	1
GuardianApprovalRequestSource::DelegatedSubagent => "delegated_subagent",	1
pub struct GuardianV2ReviewScopeConfigToml {	1
let notification = crate::exec_policy_config_warning(&err);	1
codex_app_server_protocol::GuardianRiskLevel::Critical => {	1
use approval_request::guardian_assessment_action;	1
Self::Parse { .. } => GuardianReviewFailureReason::ParseError,	1
&& item["id"] == "cmp_guardian_parent_summary"	1
pub(crate) fn guardian_approval_request_to_json(	1
session.services.exec_policy.current().as_ref(),	1
pub const GUARDIAN_REVIEW_DURATION_METRIC: &str = "codex.guardian.review.duration_ms";	1
.with_exec_policy_network_rules(exec_policy)	1
let (transcript, omission) = render_guardian_transcript_entries(&entries);	2
codex_protocol::protocol::GuardianAssessmentStatus::Denied => {	1
Some(GuardianRootSnapshot {	1
let feature: FeatureToml<GuardianV2ConfigToml> = value	1
/// Stable identifier for this guardian review lifecycle.	1
use codex_app_server_protocol::GuardianWarningNotification;	2
GuardianReview(Box<GuardianReviewEventRequest>),	1
AskForApproval::from(config.permissions.approval_policy.value()),	1
GuardianApprovalReviewAction::RequestPermissions {	1
super::GuardianAssessmentOutcome::Allow => GuardianRiskLevel::Low,	1
let policy = ctx.review_context.turn().approval_policy();	1
last_committed_fork_snapshot: Option<GuardianReviewForkSnapshot>,	1
GuardianReviewAnalyticsResult,	1
.map_err(|source| ExecPolicyError::ReadDir {	2
guardian_config.model_context_window,	2
GuardianAssessmentStatus::InProgress,	2
pub(super) const CLASSIFICATION_METRIC: &str = "codex.guardian_v2.classification";	1
let approval_policy = context.step_context.settings.approval_policy();	1
"approval required by policy, but AskForApproval::Granular.sandbox_approval is false";	2
guardian_config.include_skill_instructions = false;	1
fn parent_turn_denied_reads_context(context: &GuardianReviewContext) -> Option<String> {	1
GuardianApprovalRequest::NetworkAccess { protocol, port, .. } => {	1
ServerNotification::GuardianWarning(notification) => Some(notification.thread_id.as_str()),	1
GuardianRejectionCircuitBreakerAction::InterruptTurn {	1
// Guardian V2 may satisfy ordinary reviews, including required-model reviews, but broader	1
let Some(score_progress) = input.thread_store.get::<GuardianV2ScoreProgress>() else {	1
notification: codex_app_server_protocol::ItemGuardianApprovalReviewCompletedNotification,	1
use super::ExecPolicyCommands;	1
//! This event runs in the approval path, before guardian or user approval UI is	1
assert_eq!(id, "cmd-guardian-denied");	2
let exec_policy_fallback = |cmd: &[String]| {	1
| GuardianAssessmentAction::McpToolCall { .. }	1
.map(AutoReviewDecisionSource::from)	1
command: "rm -rf /tmp/guardian".into(),	1
params: v2::ThreadApproveGuardianDeniedActionParams {	1
AskForApproval::from(self.config.permissions.approval_policy.value());	1
overrides.ignore_user_and_project_exec_policy_rules;	1
) -> Option<GuardianRootSnapshot> {	1
if guardian_config.transcript.include_images {	1
review_context: GuardianReviewContext::from(&ctx.step_context),	1
GuardianReviewOutcome::Error(GuardianReviewError::Cancelled),	1
let guardian_reasoning_effort = params	1
Reviewer::Guardian,	1
codex_app_server_protocol::GuardianUserAuthorization::High => {	1
GuardianApprovalReviewStatus::Approved	1
export type { ExecPolicyAmendment } from "./ExecPolicyAmendment";	2
guardian_config.memories.dedicated_tools = false;	1
if guardian_config.review_scope != GuardianV2ReviewScope::ComputerUseOnly	1
use super::metrics::emit_guardian_review_metrics;	1
let planned_action_json = format_guardian_action_pretty(&request)?;	1
ExecPolicyParse {	1
pub(crate) fn with_free_guardian_enabled(mut self, free_guardian_enabled: bool) -> Self {	1
if !tool.wants_no_sandbox_approval(approval_policy) {	1
use codex_protocol::protocol::AskForApproval;	6
let default_approval_policy = config.permissions.approval_policy.value();	1
Ok(GuardianAssessment {	1
*approval_policy,	1
fn render_guardian_transcript_entries_with_offset(	1
let approval_policy = match allowed_approval_policies {	1
if ev.status == GuardianAssessmentStatus::TimedOut {	1
GuardianApprovalReviewStatus::TimedOut => {	1
crate::guardian::GuardianReviewOptions {	1
CoreGuardianUserAuthorization::Low => Self::Low,	1
use crate::guardian::guardian_timeout_message;	1
use codex_protocol::protocol::GuardianRiskLevel as CoreGuardianRiskLevel;	1
AskForApproval::Never => {	1
pub(super) use codex_protocol::approvals::GuardianAssessmentDecisionSource;	1
guardian_model: Some("gpt-5.4 guardian".to_string()),	1
let (_, warning) = load_exec_policy_with_warning(config_stack).await?;	1
pub(crate) use codex_features::GuardianV2TranscriptSource as TranscriptSource;	1
use codex_app_server_protocol::ExecPolicyAmendment;	1
Feature::GuardianV2,	1
pub guardian_catalog_contains_auto_review: Option<bool>,	2
if feature.id == codex_features::Feature::GuardianV2 {	1
pub guardian_v2: Option<GuardianV2ModelConfig>,	1
"guardian review completed without an assessment payload"	1
.set_enabled(Feature::GuardianApproval, /*enabled*/ true)?;	2
command_origin: ExecPolicyCommandOrigin::Generic,	1
config.features.get_or_insert_default().guardianv2 = Some(FeatureToml::Enabled(false));	1
.approval_policy	7
inherited_exec_policy: Option<Arc<crate::exec_policy::ExecPolicyManager>>,	2
Self::PromptBuild { .. } => GuardianReviewFailureReason::PromptBuildError,	1
.expect("guardian action"),	1
use codex_analytics::GuardianReviewFailureReason;	2
assert_eq!(decision, ReviewDecision::Abort);	1
&& guardian_config.permissions.network.is_some()	1
| GuardianApprovalRequest::WriteStdin { .. }	1
GuardianPromptMode::Full,	7
assert_eq!(third_assessment.outcome, GuardianAssessmentOutcome::Allow);	1
match prompt_is_rejected_by_policy(approval_policy, prompt_is_rule) {	1
ElicitationAction::Cancel => ReviewDecision::Abort,	1
FileChangeApprovalDecision::Accept => ReviewDecision::Approved,	1
pub guardian_model: Option<String>,	2
review_session: &Arc<GuardianReviewSession>,	1
"approval_policy requested={requested_approval:?} active={active_approval:?}"	1
target.guardian_policy_config,	1
if elicitation_is_rejected_by_policy(approval_policy) {	1
/// Request explicit user approval; rejected outright when running with `approval_policy="never"`.	1
let first_request = GuardianApprovalRequest::ExecCommand {	1
Reviewer::Guardian => summary.guardian_review_count += 1,	1
impl codex_extension_api::ThreadLifecycleContributor<Config> for GuardianMemoryContextProbe {	1
config.approval_policy = desired.config.permissions.approval_policy.clone();	1
preserve_headless_approval_policy: bool,	1
decision: ReviewDecision,	3
Feature::GuardianExt,	1
let transcript_config = guardian_config	1
history_cell::ApprovalDecisionActor::Guardian,	1
pub fn track_guardian_review(	1
.approval_policy	2
if *approval_policy == AskForApproval::Never {	1
.expect("guardian config");	9
ev_response_created("resp-guardian-1"),	1
/// The guardian itself should not mutate state or trigger further approvals, so	1
self.inherited_exec_policy_for_source(&state, Some(&session_source), &config)	1
pub(crate) struct GuardianTranscriptCursor {	1
fn from(value: CoreGuardianAssessmentAction) -> Self {	1
emit_guardian_token_usage_histograms(session_telemetry, token_usage, tags);	1
GuardianAssessmentStatus::InProgress,	3
use codex_app_server_protocol::GuardianWarningNotification;	1
guardian_policy_config: None,	2
approval_policy: codex_app_server_protocol::AskForApproval::Never,	2
codex_protocol::protocol::GuardianAssessmentDecisionSource::Agent,	3
|| destination.approval_policy() != turn_context.approval_policy()	1
GuardianAssessmentAction::Command { command, .. } => command.clone(),	1
) -> Result<ThreadApproveGuardianDeniedActionResponse, JSONRPCErrorError> {	1
"approval_policy": AskForApproval::OnRequest,	1
Fut: Future<Output = ReviewDecision>,	1
EventMsg::GuardianAssessment(_) => {	1
let (GuardianReviewOutcome::Completed(third_assessment), third_metadata) = third_outcome else {	1
impl ReviewDecision {	1
#[ts(type = r#""user" | "auto_review" | "guardian_subagent""#)]	1
id: "review-guardian-execve".into(),	1
let approval_policy_was_explicit =	1
use codex_protocol::protocol::AskForApproval;	49
allowed_approvals_reviewers = ["guardian_subagent", "user"]	1
pub review_scope: Option<GuardianV2ReviewScopeConfigToml>,	1
approval_policy: snapshot.approval_policy,	1
fn verify_guardian_warning_notification_serialization() {	1
fn exec_policy_config_folders(config: &Config) -> Vec<AbsolutePathBuf> {	1
let Some(requirements_policy) = config_stack.requirements().exec_policy.as_deref() else {	1
GuardianReviewOutcome::Error(GuardianReviewError::parse(err)),	1
use codex_analytics::GuardianReviewTrackContext;	1
terminal_status: GuardianReviewTerminalStatus::TimedOut,	1
GuardianApprovalReviewStatus::Denied	1
fn fixed_guardian_parent_session_id() -> ThreadId {	1
key: "guardian_approval",	1
let separate_guardian_developer_message =	1
GuardianAssessmentAction::Execve { .. } => unreachable!(),	1
review_context: crate::guardian::GuardianReviewContext::from(step_context),	1
let review_id = new_guardian_review_id();	1
let action: GuardianApprovalReviewAction =	1
GuardianRejectionCircuitBreakerPolicy::CyberModel => (	1
GuardianAssessment {	3
/// Bounds and optional sources for the Guardian v2 conversation transcript.	1
seed_guardian_parent_history(&session, &turn).await;	21
use super::GuardianAssessment;	2
pub fn guardian_auto_approval_review_notification(	1
fn parse_guardian_assessment_treats_bare_deny_as_high_risk() {	1
.expect("guardian trunk should exist");	1
assert!(max_attempts > 0, "guardian review must run at least once");	1
let (outcome, metadata) = run_guardian_review_session_for_test(	2
GuardianAssessment {	1
/// Explains why Guardian v2 requires synchronous approval review.	1
pub(super) use codex_app_server_protocol::GuardianApprovalReview;	1
ResponsesEndpoint::Guardian	1
self.ignore_user_and_project_exec_policy_rules	1
AskForApproval::Granular(config) if !config.allows_mcp_elicitations()	1
output_schema_strict: !crate::guardian::is_basic_session_source(	1
use codex_protocol::approvals::GuardianCommandSource as CoreGuardianCommandSource;	1
| EventMsg::GuardianWarning(_)	1
guardian_review_count: u64,	1
&& item["encrypted_content"] == "encrypted guardian parent summary"	1
pub use feature_configs::GuardianV2TranscriptConfigToml;	1
| ReviewDecision::ApprovedForSession	1
let local_trusted_skill_paths = guardian_evidence.trusted_skill_paths(input.turn_id);	1
fn guardian_review_result_maps_terminal_statuses() {	1
async fn guardian_review_request_layout_matches_model_visible_request_snapshot()	1
guardian_config.permissions.approval_policy,	1
if let EventMsg::GuardianAssessment(event) = event.msg {	1
async fn build_guardian_prompt_items_includes_parent_session_id() -> anyhow::Result<()> {	1
guardian_catalog_contains_auto_review: None,	1
ReviewDecision::NetworkPolicyAmendment {	1
impl From<&Arc<TurnContext>> for GuardianReviewContext {	1
pub struct GuardianReviewEvidenceFragment {	1
/// Controls which retained REPL evidence a Guardian reviewer may receive.	1
GuardianAssessmentAction::WriteStdin { .. } => {	1
if let Err(err) = config.permissions.approval_policy.set(policy.to_core()) {	1
GuardianApprovalRequest::ExecCommand { command, cwd, .. } => {	2
thread_id: "guardian-thread".to_string()	1
pub(crate) use approval_request::format_guardian_action_pretty;	1
.initialize(Arc::clone(&guardian_session), guardian_parent_turn)	1
GuardianReviewedAction::RequestPermissions {}	1
exec_policy_hint,	2
ev_response_created("resp-guardian-4"),	1
GuardianUserAuthorization::Low => "low",	1
let guardian_policy_config = "Use the company-managed guardian policy.".to_string();	1
fn guardian_assessment_action_deserializes_command_shape() {	1
GuardianReviewSessionOutcome::Completed(Err(err.into())),	1
allowed_approval_policies: Some(vec![AskForApproval::Granular {	1
.get_or_init(GuardianReviewEvidence::default);	1
fn guardian_v2_feature_config_accepts_boundary_values() {	1
state: Arc<Mutex<GuardianReviewSessionState>>,	2
.set(AskForApproval::Granular(GranularApprovalConfig {	1
amendment: &ExecPolicyAmendment,	2
guardian_review_request_permissions_network_enabled(permissions)	2
mcp_elicitation_response_from_guardian_decision(decision, turn_context.model_info())	1
self.clear_guardian_review_status();	2
next.approval_policy.set(approval_policy)?;	1
pub(crate) exec_policy: Arc<ExecPolicyManager>,	1
) -> Option<ReviewDecision> {	1
fn evaluate_intercepted_exec_policy(	1
.thread_approve_guardian_denied_action(thread_id, event)	1
patch: "*** Begin Patch\n*** Update File: guardian.txt\n@@\n+hello\n*** End Patch"	1
source: GuardianCommandSource,	2
exec_policy_hint: None,	8
ThreadApproveGuardianDeniedAction => "thread/approveGuardianDeniedAction" {	1
(!arguments.trim().is_empty()).then(|| GuardianTranscriptEntry {	1
Some(GuardianUserAuthorization::High) => "high",	1
pub struct ThreadApproveGuardianDeniedActionResponse {}	1
"command": "rm -rf /tmp/guardian",	1
fn from(value: CoreGuardianCommandSource) -> Self {	1
/// Returns bounded REPL evidence using the existing Guardian text and image layout.	1
/// Enable Guardian V2 automatic approval reviews.	1
fn deserialize_exec_policy_requirements() -> Result<()> {	1
EventMsg::GuardianWarning(warning_event) => {	1
if restore_approval_policy {	1
"rationale": "second guardian rationale",	1
GuardianRiskLevel::Low => "low",	1
"msg-guardian-4",	1
if assessment.status == codex_protocol::protocol::GuardianAssessmentStatus::InProgress	2
GuardianAssessmentEvent {	2
impl PendingGuardianReviewStatus {	1
use crate::guardian::GuardianRejectionCircuitBreaker;	1
normalize_guardian_policy_config(requirements_toml.guardian_policy_config.as_deref())	1
pub fn new_guardian_timed_out_patch_request(files: Vec<String>) -> Box<dyn HistoryCell> {	1
input.thread_store.insert(GuardianMemoryContextEnabled(	1
fn guardian_snapshot_options() -> ContextSnapshotOptions {	1
struct ExecPolicyCommands {	1
fn handle_guardian_assessment(&mut self, payload: &GuardianAssessmentEvent) {	1
assert_eq!(payload.decision_source, AutoReviewDecisionSource::Agent);	4
super::GuardianAssessmentOutcome::Allow => {	1
mod requirements_exec_policy;	1
GuardianAssessmentStatus::Approved => (	1
async fn guardian_review_uses_model_catalog_override_when_preferred_review_model_exists()	1
pub async fn load_exec_policy(config_stack: &ConfigLayerStack) -> Result<Policy, ExecPolicyError> {	1
decision: GuardianReviewDecision::Approved,	1
GuardianReviewTerminalStatus::Aborted => "aborted",	1
&& !preserve_headless_approval_policy =>	1
| ReviewDecision::TimedOut	1
use codex_app_server_protocol::build_item_from_guardian_event;	1
} | GuardianReviewError::Parse { .. }	1
guardian_session_kind: Some(GuardianReviewSessionKind::TrunkReused),	1
let tags = guardian_review_metric_tags(result, approval_request_source, reviewed_action);	1
impl From<CoreGuardianRiskLevel> for GuardianRiskLevel {	1
let rendered = format_guardian_action_pretty(&action)?;	2
) -> std::io::Result<crate::guardian::GuardianApprovalRequest> {	1
/// Structured output contract that the guardian reviewer must satisfy.	1
if approval_policy != AskForApproval::Never {	1
None => GuardianV2ConfigToml::default(),	1
if let Some(prefixes) = approved_command_prefixes_text(exec_policy) {	1
impl ContextualUserFragment for GuardianApprovedAction {	1
pub guardian_review_model_override: Option<String>,	3
GuardianAssessmentAction::WriteStdin {	2
message: format!("Guardian V2 action serialization failed: {error}"),	1
pub(super) pending_guardian_review_status: PendingGuardianReviewStatus,	1
Err(ToolError::Rejected(rejection)) => Ok(ReviewDecision::denied(rejection)),	1
cwd: guardian_cwd(&environment_id, cwd)?,	2
assert_eq!(settings.approval_policy, AskForApproval::OnRequest);	1
impl From<CoreGuardianAssessmentAction> for GuardianApprovalReviewAction {	1
impl GuardianReviewTrackContext {	1
"guardian_classifier_source_thread_id": self.config.thread_id,	1
"approval_policy": "never",	2
let guardian_evidence = input	1
Ok(guardian_config)	1
pub(super) use codex_app_server_protocol::GuardianCommandSource as AppServerGuardianCommandSource;	1
crate::mcp_tool_call::build_guardian_mcp_tool_review_request(	1
let cell = if let Some(command) = guardian_command(&ev.action) {	1
pub failure_reason: Option<GuardianReviewFailureReason>,	2
pub decision: ExecPolicyDecision,	1
approval_policy: v2::AskForApproval::OnRequest,	1
matches!(policy, AskForApproval::Never)	1
GuardianAssessmentAction::Execve { program, argv, .. } => {	1
async fn wait_before_guardian_retry(	1
use crate::context::GuardianApprovedAction;	1
guardian_config.permissions.permission_profile(),	1
crate::guardian::guardian_timeout_message(model_info),	1
pub approval_request_source: GuardianApprovalRequestSource,	1
) -> Result<T, GuardianReviewSessionOutcome> {	2
if event.status != GuardianAssessmentStatus::Denied {	1
state: Arc<Mutex<GuardianReviewSessionState>>,	1
/// Guardian-specific policy config override from requirements.toml or config.toml.	1
/*inherited_exec_policy*/ None,	1
pub(crate) use review::new_guardian_review_id;	1
async fn spawn_guardian_review_session(	1
("x-openai-subagent".to_owned(), "guardian".to_owned()),	1
thread_start_params.approval_policy = Some(source.approval_policy);	1
turns: std::collections::HashMap<String, GuardianRejectionCircuitBreakerTurn>,	1
pub fn from_session(params: GuardianReviewSessionAnalyticsParams) -> Self {	1
assert!(!guardian_config.include_apps_instructions);	2
reviewed_action: GuardianReviewedAction,	1
guardian_config.features.disable(feature).map_err(|err| {	1
/// Resolves the configured, reviewer-catalog, or bundled Guardian policy.	1
pub(crate) use approval_request::guardian_approval_request_to_json;	1
let (GuardianReviewOutcome::Completed(assessment), metadata) = outcome else {	1
&guardian_snapshot_options(),	1
kind: GuardianTranscriptEntryKind::Tool(format!("tool {name} call")),	2
use codex_analytics::GuardianReviewSessionAnalyticsParams;	1
let second_request = GuardianApprovalRequest::ExecCommand {	1
/// Installs the guardian contributors into the extension registry.	2
/// Optional conversation sources available to the Guardian v2 classifier.	1
ev_completed("resp-guardian-3"),	1
id: "review-guardian-exec".into(),	2
fn guardian_preserve_mode_does_not_churn_marker_with_empty_proxy_ports() {	1
effective_config.config.approval_policy	1
guardian_policy_config: None,	1
approval_policy: *approval_policy,	1
use crate::exec_policy::BANNED_PREFIX_SUGGESTIONS;	1
ReviewDecision::Approved	3
fn exec_policy_message_for_display(source: &codex_execpolicy::Error) -> String {	1
approval_policy: AskForApproval::Never,	2
let commands = commands_for_exec_policy(req.command);	1
exclude: exec_policy	1
pub(super) const CLASSIFICATION_RISK_METRIC: &str = "codex.guardian_v2.classification.risk";	1
analytics_result.guardian_catalog_contains_auto_review,	3
prompt_cache_key: Some(format!("guardian-v2:{}", self.config.thread_id)),	1
use crate::protocol::v2::AutoReviewDecisionSource;	1
let trusted_guardian_reviewer = crate::guardian::is_basic_session_source(&session_source)	1
GuardianReviewTerminalStatus::Denied	1
execpolicy_amendment: ExecPolicyAmendment {	2
.set(AskForApproval::OnRequest.to_core())?;	1
use codex_protocol::protocol::GuardianAssessmentEvent;	5
impl From<CoreGuardianCommandSource> for GuardianCommandSource {	1
Some(codex_protocol::protocol::GuardianUserAuthorization::High),	1
fn guardian_review_result(	1
fn config_granular_approval_policy_is_marked_experimental() {	1
let extensions = if is_guardian_reviewer {	1
r#"approval_policy="on-request""#.to_string(),	5
) -> Option<Arc<GuardianReviewSession>> {	2
let message = exec_policy_message_for_display(source);	1
let reviewer = if config.features.enabled(Feature::GuardianApproval)	1
state.last_committed_fork_snapshot = Some(GuardianReviewForkSnapshot {	1
"guardian review session could not disable `features.{}`; continuing with the feature enabled",	1
per_turn_config.permissions.approval_policy.value(),	1
msg: EventMsg::GuardianAssessment(assessment),	1
warn!("failed to refresh guardian trunk rollout snapshot: {err}");	1
return (outcome, GuardianReviewAnalyticsResult::without_session());	2
.map(codex_execpolicy::RequirementsExecPolicy::fingerprint);	1
files: vec![test_path_buf("/tmp/guardian.txt").abs()],	1
| GuardianApprovalReviewAction::McpToolCall { .. } => false,	2
// TODO(rhan-oai): plumb nested Guardian review session tool-call counts.	1
"turn-guardian-approved",	2
"guardian review session could not disable `features.{}`: {err}",	1
) -> GuardianAssessmentEvent {	1
"  Use the workspace-managed guardian policy.  ".to_string(),	1
exec_policy: &'a Policy,	1
guardian_approval.serialization_scope(),	1
pub async fn notify_approval(&self, approval_id: &str, decision: ReviewDecision) {	1
pub struct ItemGuardianApprovalReviewStartedNotification {	1
codex_app_server_protocol::GuardianUserAuthorization::Medium => {	1
fn parse_guardian_assessment_treats_bare_allow_as_low_risk() {	1
GuardianReviewOptions {	1
fn guardian_stdin_review_action_round_trips_native_and_foreign_paths() {	1
GuardianAssessmentAction::Execve {	1
Self::Session { .. } => GuardianReviewFailureReason::SessionError,	1
/// Guardian timeouts, review-session failures, and parse failures all block	1
if !should_classify_tool(input.tool_name, input.payload, guardian_config.review_scope) {	1
fn record_recent_review(turn: &mut GuardianRejectionCircuitBreakerTurn, denied: bool) {	1
AskForApproval::Never => approval_messages.never.as_ref(),	1
step_context.settings.approval_policy(),	1
GuardianReview(Box<GuardianReviewEventParams>),	1
use codex_core::context::GuardianReviewEvidenceRecord;	1
assert_eq!(update.patch.approval_mode, Some(AskForApproval::Never));	1
CoreGuardianAssessmentAction::WriteStdin {	1
pub transcript: Option<GuardianV2TranscriptModelConfig>,	1
GuardianReviewTerminalStatus::Denied => "denied",	1
guardian_exec_command_request("shell-parse-retry"),	1
codex_protocol::approvals::GuardianUserAuthorization::Unknown	1
panic!("guardian error should deny the approval");	1
ev_completed("resp-guardian"),	2
state: Mutex::new(GuardianReviewState {	1
assert!(guardian_config.features.enabled(Feature::Collab));	1
CoreGuardianAssessmentAction::try_from(deserialized)	1
ReviewDecision::Approved | ReviewDecision::ApprovedExecpolicyAmendment { .. } => {	1
InterceptedExecPolicyContext {	1
let (truncated, was_truncated) = guardian_truncate_text(&content, /*token_cap*/ 20);	1
free_guardian_enabled: bool,	1
GuardianAssessmentAction::Command {	1
params: GuardianReviewSessionParams,	2
ensure_guardian_followup_reminder(review_session).await;	1
export type { ThreadApproveGuardianDeniedActionParams } from "./ThreadApproveGuardianDeniedActionParams";	1
let GuardianReviewOutcome::Completed(_) = outcome else {	1
Some(GuardianRiskLevel::Medium) => "medium",	1
crate::guardian::prompt_cache_key_override_for_review_session(	1
matches!(store.get(key), Some(ReviewDecision::ApprovedForSession))	1
approval_policy: Some(approval_policy),	1
/// Borrowed host inputs available while one Guardian context section is built.	1
ev_response_created("resp-guardian"),	2
struct GuardianV2Enabled;	1
Feature::GuardianApproval,	1
GuardianAssessmentAction::Command { .. } => unreachable!(),	1
|| features.enabled(Feature::GuardianEnhancedNodeReplTranscripts)	1
use crate::codex_thread::GuardianAuthorizationVersion;	2
codex_app_server_protocol::GuardianUserAuthorization::Low => {	1
GuardianReviewOutcome::Error(GuardianReviewError::session(anyhow::anyhow!(	2
prepared_call.config().approval_policy.value(),	1
pub(crate) parent_context: GuardianReviewContext,	1
pub(crate) fn emit_guardian_review_metrics(	1
use crate::protocol::item_builders::build_item_from_guardian_event;	1
async fn guardian_review_session_config_clears_parent_developer_instructions() {	1
impl GuardianAssessmentTestContext {	1
pub free_guardian: Option<bool>,	1
model_defaults: Option<&GuardianV2ModelConfig>,	1
"guardian-approval-mvp".to_string(),	1
.thread_approve_guardian_denied_action(&request_id, params)	1
started.session.approval_policy,	2
guardian_thread_id: Some(params.guardian_thread_id),	1
kind: GuardianTranscriptEntryKind::Assistant,	1
pending_guardian_review_status: PendingGuardianReviewStatus::default(),	1
if separate_guardian_developer_message	1
self.ignore_user_and_project_exec_policy_rules = ignore_user_and_project_exec_policy_rules;	1
impl PartialEq for RequirementsExecPolicy {	1
GuardianApprovalReviewAction::McpToolCall { tool_name, .. } => (	1
use codex_app_server_protocol::ThreadApproveGuardianDeniedActionParams;	2
if typesafe_overrides.approval_policy.is_none() {	1
assert_ne!(guardian_thread_id, session.thread_id.to_string());	1
use codex_protocol::approvals::GuardianUserAuthorization;	1
Some(GuardianRiskLevel::Low) => "low",	1
|model: &ModelInfo| -> GuardianV2ModelConfig {	1
GuardianEnhancedNodeReplTranscripts,	1
.field("exec_policy", &self.exec_policy)	1
Err(err @ ExecPolicyError::ParsePolicy { .. }) => {	1
use crate::guardian::GuardianNetworkAccessTrigger;	3
ApproveGuardianDeniedAction {	1
let entries = collect_guardian_transcript_entries(&items);	3
assert_eq!(decision, ReviewDecision::ApprovedForSession);	1
struct GuardianV2ScoreProgress {	1
pub(crate) guardian_catalog_contains_auto_review: bool,	1
"thread_source": "guardian_classifier",	1
use codex_protocol::approvals::GuardianAssessmentAction as CoreGuardianAssessmentAction;	2
approval: AskForApproval,	1
async fn guardian_review_records_missing_auto_review_model_in_analytics_metadata()	1
pub async fn guardian_root_snapshot(&self) -> Option<GuardianRootSnapshot> {	1
pub(crate) guardian_approval_enabled: bool,	1
include_str!("../../assets/guardian/policy_template.md");	1
ReviewDecision::denied("approval request failed"),	2
"out-of-range Guardian v2 setting should fail: {setting} = {value}"	1
assert!(!guardian_config.features.enabled(Feature::GuardianV2));	1
codex_config::Constrained::allow_any(AskForApproval::OnRequest.to_core());	2
GuardianReviewFailureReason::PromptBuildError	1
AskForApproval::Granular(granular_config) => !granular_config.allows_mcp_elicitations(),	1
GuardianRootMessage::User(	1
| GuardianApprovalReviewAction::WriteStdin { .. }	2
emit_guardian_review_metrics(	1
use codex_core::GuardianRootSnapshot;	1
AskForApproval::Never => "bypassPermissions",	1
"approval required by policy, but AskForApproval is set to Never";	2
AskForApproval::Never => false,	2
GuardianAssessmentAction::ApplyPatch { files, .. } => Some(if files.len() == 1 {	1
let followup_reminder = GuardianFollowupReviewReminder.body();	1
fn build_guardian_transcript_reserves_separate_budget_for_tool_evidence() {	1
let (sandbox_mode, approval_policy) = if cli.dangerously_bypass_approvals_and_sandbox {	1
wait_before_guardian_retry(attempt_count, deadline, external_cancel.as_ref()).await	1
approval_policy: Option<codex_app_server_protocol::AskForApproval>,	1
GuardianAssessment(GuardianAssessmentEvent),	1
GuardianApprovalReviewStatus::InProgress	4
"guardian reviewer could not preserve Code Mode developer policy: {error}"	1
use crate::exec_policy::ExecPolicyUpdateError;	1
guardian_review_count: review_summary.guardian_review_count,	1
let guardian_model_info = session	1
impl Default for ExecPolicyManager {	1
| ReviewDecision::NetworkPolicyAmendment { .. }	1
//!    The guardian clones the parent config, so it inherits any managed	1
self.runtime_approval_policy_override =	1
let _: ThreadApproveGuardianDeniedActionResponse = self	1
if approval_policy == AskForApproval::OnRequest && sandbox == "workspace" {	1
return GuardianElicitationReview::NotRequested;	1
match (approval_policy, decision_source) {	1
Constrained::allow_only(session.approval_policy.to_core());	1
CoreGuardianAssessmentAction::Execve {	1
fn allows_network_approval_flow(policy: AskForApproval) -> bool {	1
let instructions = guardian_config.render_classifier_instructions(policy);	1
export type { ThreadApproveGuardianDeniedActionResponse } from "./ThreadApproveGuardianDeniedActionResponse";	1
anyhow::anyhow!("guardian review session could not clear MCP servers: {err}")	1
/// session for guardian review.	1
AskForApproval::OnRequest.to_core(),	1
ApprovalRequest(Box<crate::guardian::GuardianApprovalRequest>),	1
GuardianRejectionCircuitBreakerAction::Continue	8
//! Shared context sections for synchronous Guardian review and asynchronous scoring.	1
pub sources: Option<Vec<GuardianV2TranscriptSource>>,	1
if self.config.permissions.approval_policy.value() != baseline_approval {	1
if approval_policy == AskForApproval::Never	1
.or(cfg.approval_policy)	1
"{\"risk_level\":\"low\",\"user_authorization\":\"high\",\"outcome\":\"allow\",\"rationale\":\"second guardian rationale\"}",	2
.get::<GuardianReviewEvidence>();	1
pub guardian_session_kind: Option<GuardianReviewSessionKind>,	2
toml::from_str::<FeaturesToml>(&format!("[guardianv2]\n{settings}")).is_err(),	1
pub fn to_policy(&self) -> Result<Policy, RequirementsExecPolicyParseError> {	1
pub fn with_user_and_project_exec_policy_rules_ignored(	1
approval_policy: v2::AskForApproval::Never,	1
ServerNotification::ItemGuardianApprovalReviewStarted(	1
build_guardian_prompt_items_with_parent_turn(	1
// TODO(anp): Migrate guardian review thread settings to a PathUri fallback cwd so foreign	1
use crate::guardian::review_approval_request_with_cancel;	1
guardian_v2: None,	1
GuardianRiskLevel::Critical => "critical",	1
"guardian review session could not preserve REPL developer policy: {error}"	1
let policy = GuardianNodeReplPolicy;	1
fn from_overrides(configured: GuardianV2ConfigToml) -> Result<Self, String> {	1
"guardian_approval": false,	1
CoreGuardianRiskLevel::Critical => Self::Critical,	1
AskForApproval::Granular(GranularApprovalConfig {	1
status: codex_protocol::protocol::GuardianAssessmentStatus::Aborted,	1
} => Err(GuardianReviewSessionOutcome::Aborted),	1
status: GuardianAssessmentStatus::InProgress,	3
AskForApproval::UnlessTrusted => approval_messages.unless_trusted.as_ref(),	1
) -> Result<PatternToken, RequirementsExecPolicyParseError> {	1
use codex_protocol::protocol::AskForApproval as CoreAskForApproval;	2
app.config.permissions.approval_policy =	2
trunk: Option<Arc<GuardianReviewSession>>,	1
impl GuardianReviewSession {	1
async fn guardian_review_surfaces_responses_api_errors_in_rejection_reason() -> anyhow::Result<()> {	1
async fn update_feature_flags_disabling_guardian_clears_manual_review_policy_without_history()	1
guardian_config.base_instructions_provenance = Some(BaseInstructionsProvenance::Custom);	1
pub(crate) use approval_request::GuardianApprovalRequest;	1
/*approval_policy*/ None,	3
async fn guardian_test_session_turn_and_rx(	1
use review_session::build_guardian_review_session_config as build_guardian_review_session_config_for_test;	1
event: json!({ "type": "guardian" }),	1
.and_then(|overrides| overrides.remove("approval_policy"))	1
GuardianReviewOutcome::Error(GuardianReviewError::session_with_error_info(	1
approval_policy: AskForApproval,	9
} => serialize_guardian_action(ExecveApprovalAction {	1
let initial_request = GuardianApprovalRequest::ExecCommand {	1
ev_assistant_message("msg-guardian", &guardian_assessment),	2
// tools::approvals and guardian::review still route approvals using the	1
Some(GuardianRiskLevel::High) => "high",	1
guardian_policy_config: guardian_policy_config.map(|sourced| sourced.value),	1
use crate::exec_policy::ExecPolicyManager;	2
pub fn format_exec_policy_error_with_source(error: &ExecPolicyError) -> String {	1
guardian_config.permissions.network = Some(NetworkProxySpec::from_config_and_constraints(	1
AskForApproval(root=AskForApprovalValue.on_request),	1
use crate::context::GuardianPolicy;	1
pub(super) use codex_app_server_protocol::ItemGuardianApprovalReviewCompletedNotification;	1
return ReviewDecision::denied(	1
use crate::guardian::approval_request::guardian_request_target_item_id;	1
params: ThreadApproveGuardianDeniedActionParams {	1
pub(crate) trusted_guardian_reviewer: bool,	1
CoreReviewDecision::ApprovedForSession => Self::AcceptForSession,	1
impl ContextualUserFragment for GuardianTrustedSkillsFragment {	1
let text = guardian_prompt_text(&prompt.items);	1
deserialize_with = "feature_configs::deserialize_guardian_v2_feature"	1
pub enum ReviewDecision {	1
codex_app_server_protocol::GuardianApprovalReviewStatus::Aborted => {	1
) = if crate::guardian::is_basic_session_source(&session_source) {	1
decisions.push(ReviewDecision::Abort);	1
text.replace(&guardian_policy, "<GUARDIAN_POLICY>")	1
impl From<CoreReviewDecision> for CommandExecutionApprovalDecision {	1
use codex_protocol::protocol::ReviewDecision;	19
token: &RequirementsExecPolicyPatternTokenToml,	1
let config_toml = "approvals_reviewer = \"guardian_subagent\"\napproval_policy = \"on-request\"\nsandbox_mode = \"workspace-write\"\n\n[features]\nguardian_approval = true\n";	1
root_authorization: Option<GuardianRootSnapshot>,	1
key: "guardian_node_repl_transcript_images",	1
fn guardian_request_turn_id_prefers_network_access_owner_turn() {	1
) -> Result<(Policy, Option<ExecPolicyError>), ExecPolicyError> {	1
exec_policy: &Policy,	4
content_entry(GuardianTranscriptEntryKind::User, content)	1
approval_policy: AskForApproval::Never,	10
let prompt = build_guardian_prompt_items_with_parent_turn(	4
EventMsg::GuardianAssessment(event) => guardian_statuses.push(event.status),	1
fn from(value: CoreExecPolicyAmendment) -> Self {	1
async fn build_guardian_prompt_includes_parent_turn_denied_reads() -> anyhow::Result<()> {	1
pub(super) approval_policy: AskForApproval,	1
guardian_review_model_overridden: result.guardian_review_model_overridden,	1
// Guardian review status is derived from the full set of currently pending	1
fn collect_guardian_transcript_entries_keeps_manual_approval_developer_message() {	1
pub struct GuardianNetworkAccessReviewAction {	1
"Guardian v2 review_threshold must be between 0.0 and 1.0",	1
GuardianApprovalReviewAction::WriteStdin { .. } => (	1
codex_protocol::protocol::GuardianAssessmentStatus::TimedOut => {	1
entries.extend((0..12).map(|index| GuardianTranscriptEntry {	1
Some(AskForApproval::Never.to_core()),	1
GuardianUserAuthorization::Medium => "medium",	1
use codex_protocol::approvals::GuardianAssessmentOutcome;	1
return ReviewDecision::ApprovedForSession;	1
use prompt::GuardianTranscriptCursor;	1
codex_protocol::protocol::GuardianAssessmentStatus::Denied	1
"Guardian V2 classification result"	1
history_cell::ApprovalDecisionActor::Guardian,	1
.record_denial("turn-1", GuardianRejectionCircuitBreakerPolicy::Standard),	2
transcript: Some(GuardianV2TranscriptModelConfig {	1
let back_to_v2 = AskForApproval::from(core_policy);	1
use crate::exec_policy::ExecApprovalRequest;	1
assert_eq!(guardian_config.model, Some("active-model".to_string()));	1
pub guardian_thread_id: String,	1
GuardianPromptShape::Full => {	1
pub user_authorization: Option<GuardianUserAuthorization>,	4
let parent_compaction = if guardian_config.reuse_parent_compaction {	1
| AskForApproval::UnlessTrusted	2
fn guardian_v2_feature_config_preserves_boolean_toggle() {	1
AskForApproval::from(default.approval),	1
| GuardianApprovalReviewAction::Execve { .. }	2
record_guardian_non_denial(&session, &assessment_turn_id).await;	2
if !allows_network_approval_flow(review_context.approval_policy) {	1
pub use crate::approvals::GuardianAssessmentStatus;	1
let mut policy_with_prefix_rule = exec_policy.clone();	1
pub(super) use codex_app_server_protocol::GuardianApprovalReviewStatus;	1
decision @ (ReviewDecision::Approved	1
impl ExecPolicyCheckCommand {	1
GuardianReviewSessionOutcome::SessionFailed {	3
async fn routes_approval_to_guardian_can_use_app_reviewer_override() {	1
guardian_model: result.guardian_model,	1
GuardianPromptMode::Delta { cursor } => {	1
struct GuardianV2Extension {	1
AskForApproval::Never => true,	1
CoreReviewDecision::ApprovedMcpPolicyAmendment => Self::Decline,	1
pub approval_policy: ConstrainedWithSource<AskForApproval>,	1
use codex_protocol::protocol::GuardianAssessmentStatus;	4
GuardianTestCatalog::Bundled,	2
trigger: Option<&'a GuardianNetworkAccessTrigger>,	1
pub allowed_approval_policies: Option<Sourced<Vec<AskForApproval>>>,	1
(AskForApproval::Never, _) => Some(PROMPT_CONFLICT_REASON),	1
#[path = "openai_models/guardian_v2.rs"]	1
/// Public entrypoint for approval requests that should be reviewed by guardian.	1
pub(crate) enum GuardianV2ReviewScope {	1
command_origin: crate::exec_policy::ExecPolicyCommandOrigin::Generic,	1
fn reconstructs_in_progress_guardian_execve_item() {	1
guardian_context	5
self.chat_widget.set_approval_policy(approval_policy);	1
Some(GuardianUserAuthorization::Medium) => "medium",	1
if feature == Feature::GuardianApproval && effective_enabled {	1
GuardianAssessmentAction::ApplyPatch { files, .. } => {	1
EventMsg::GuardianAssessment(event)	1
|| !self.config.features.enabled(Feature::GuardianApproval))	1
.expect("guardian action");	1
| GuardianReviewError::Session { message, .. }	1
status: GuardianAssessmentStatus::Aborted,	1
ReviewDecision::Approved,	3
unreachable!("permission requests are routed directly to Guardian")	1
Some(approval_policy),	1
GuardianV2ReviewScope::Standard {	1
pub(crate) enum ExecPolicyCommandOrigin {	1
) -> Option<ReviewDecision> {	1
GuardianReviewOptions {	1
/// The reusable synchronous Guardian reviewer.	1
!= next.step_settings.approval_policy.value()	1
GuardianReviewSessionOutcome::Completed(Ok(last_agent_message)) => match last_agent_message	1
entries: &[GuardianTranscriptEntry],	2
AskForApproval::Never,	2
exec_policy: _,	1
pub struct GuardianRequestPermissionsReviewAction {	1
approval_policy: params.approval_policy,	2
self.thread_approve_guardian_denied_action_inner(request_id, params)	1
review_context: GuardianReviewContext,	1
.get_or_init(|| Arc::new(GuardianMcpElicitationReviewer::new(self))),	1
notification.thread_settings.approval_policy,	3
pub(crate) fn guardian_timeout_message(model_info: &ModelInfo) -> String {	1
self.free_guardian_enabled = free_guardian_enabled;	1
ServerNotification::ItemGuardianApprovalReviewCompleted(notification) => {	1
use super::prompt::guardian_output_schema;	1
"msg-guardian-3",	1
pub enum GuardianApprovalRequestSource {	1
async fn ensure_guardian_followup_reminder(review_session: &GuardianReviewSession) {	1
use codex_core_api::AskForApproval;	1
impl GuardianTranscriptEntryKind {	1
let approval_call_id = format!("{guardian_approval_id}#{}", Uuid::new_v4());	1
let structured_session_error = GuardianReviewError::session_with_error_info(	1
.set_feature_enabled(Feature::GuardianApproval, /*enabled*/ false);	1
ReviewDecision::TimedOut => {	2
/// Transcript entry retained for guardian review after filtering.	1
approval_policy: AskForApproval,	1
fn guardian_review_requested_network_access(action: &GuardianApprovalReviewAction) -> bool {	1
let action = GuardianApprovalReviewAction::from(core_action.clone());	1
guardian_policy_config: _,	1
pub use events::GuardianReviewEventParams;	1
GuardianAssessmentStatus::TimedOut	1
history_cell::new_guardian_timed_out_action_request(	1
use codex_execpolicy::Decision as ExecPolicyDecision;	1
GuardianApprovalRequest::Execve { .. } => default_turn_id,	1
"guardian session should append earlier reviews into the follow-up request"	1
guardian_approval_enabled: self.features.enabled(Feature::GuardianApproval),	2
"guardian review session was not available after spawn"	1
fn guardian_command_assessment(	1
tracing::warn!(%err, "failed to sync approval_policy from SessionConfigured");	1
let exec_policy = match rules {	1
pub use events::GuardianReviewFailureReason;	1
use codex_protocol::protocol::GuardianRiskLevel;	5
.can_set(&self.approval_policy())?;	1
if !crate::exec_policy::child_uses_parent_exec_policy(&parent_config, &config) {	1
use codex_protocol::approvals::GuardianCommandSource;	2
GuardianApproval,	1
pub approval_policy: AskForApproval,	9
return ReviewDecision::denied(	1
GuardianReviewSessionOutcome::PromptBuildFailed(err),	1
let Some(item) = build_item_from_guardian_event(payload, status) else {	1
) -> Result<Option<ExecPolicyError>, ExecPolicyError> {	1
// Legacy Guardian omitted environment identity and cwd. Include them here so the	1
/// Points to the end of the transcript that the guardian has already reviewed.	1
GuardianApprovalReviewAction::McpToolCall {	1
request: &'a GuardianApprovalRequest,	1
return Some(ReviewDecision::Approved);	1
Err(ToolError::Rejected(guardian_timeout_message(model_info)))	1
pub use sync_reviewer::GuardianThreadContext as GuardianReviewerThreadContext;	1
review: &GuardianReviewEvidenceRecord,	1
BTreeMap::from([("guardianv2".to_owned(), true)])	2
pub guardian_session_kind: GuardianReviewSessionKind,	1
// footer is currently rendered; this helper computes the guardian-specific	1
GuardianRootMessage::Assistant(question_text).render(),	1
} else if self.status_state.current_status.is_guardian_review() {	1
GuardianAssessmentStatus::Denied	1
Arc::clone(exec_policy)	1
AskForApproval::UnlessTrusted | AskForApproval::OnRequest | AskForApproval::Granular(_) => {	1
GuardianCommandSource::UnifiedExec => Self::UnifiedExec,	1
/// Concise guardian warning message for the user.	1
fn from(value: CoreReviewDecision) -> Self {	1
CoreGuardianAssessmentAction::RequestPermissions {	1
.can_set(&AskForApproval::UnlessTrusted),	1
step_context.settings.approval_policy(),	1
second_metadata.guardian_thread_id	1
id: Feature::GuardianExt,	1
/// Escalate from extension fast approval to the synchronous Guardian reviewer.	1
pub struct GuardianReviewTrackContext {	1
/// Temporary restrictions while approvals and Guardian still read the admitted	1
approval_policy: turn_context.approval_policy(),	1
impl GuardianReviewEvidence {	1
guardian_config.permissions.permission_profile(),	1
GuardianAssessmentAction::RequestPermissions { reason, .. } => reason	1
| GuardianApprovalReviewAction::NetworkAccess { .. } => true,	1
proposed_execpolicy_amendment: ExecPolicyAmendment,	2
fork_config.permissions.approval_policy.value(),	1
/// Enable the extension-owned synchronous Guardian reviewer.	1
Some(GuardianTrustedToolFragment {	1
return Err(RequirementsExecPolicyParseError::EmptyPattern { rule_index });	1
ReviewDecision::NetworkPolicyAmendment { .. }	1
use crate::guardian::BUNDLED_GUARDIAN_POLICY;	1
Delta { cursor: GuardianTranscriptCursor },	1
request.inherited_exec_policy = inherited_exec_policy;	3
exec_policy	1
ThreadSource::GuardianReview => "guardian_review",	1
&& prompt_is_rejected_by_policy(approval_policy, /*prompt_is_rule*/ false).is_some()	1
pub rules: Option<Sourced<RequirementsExecPolicyToml>>,	1
GuardianReviewAnalyticsResult::from_session(GuardianReviewSessionAnalyticsParams {	1
if approval_policy_override.is_some() {	1
user_authorization: Some(codex_protocol::protocol::GuardianUserAuthorization::Low),	2
use crate::events::GuardianReviewEventRequest;	1
fn ingest_guardian_review(	1
pub enum GuardianRiskLevel {	2
Box::pin(async move { Some(ReviewDecision::Approved) })	1
export type { GuardianCommandSource } from "./GuardianCommandSource";	1
| ServerNotification::ItemGuardianApprovalReviewStarted(_)	1
source: GuardianCommandSource,	7
pub enum GuardianReviewedAction {	1
pub(crate) outcome: GuardianAssessmentOutcome,	1
let (GuardianReviewOutcome::Completed(first_assessment), first_metadata) = first_outcome else {	2
| GuardianApprovalRequest::ApplyPatch { .. }	1
("guardian_reasoning_effort".to_string(), "low".to_string()),	1
if guardian_model != turn.model_info().slug {	1
trusted_guardian_reviewer: self.trusted_guardian_reviewer,	1
guardian_config	2
fn ingest_guardian_review_completed(	1
GuardianReviewedAction::ApplyPatch {} => "apply_patch",	1
kind: GuardianTranscriptEntryKind::Tool("tool slack.notifications result".to_string()),	2
/// Thread target for the guardian warning.	1
fn format_guardian_action_pretty_truncates_large_string_fields() -> serde_json::Result<()> {	1
.get::<crate::codex_delegate::GuardianReadOnlyHistoryTools>()	1
let request = GuardianApprovalRequest::ExecCommand {	1
reviewed_action: GuardianReviewedAction,	1
run_guardian_review(	1
if execve_prompt_is_rejected_by_policy(self.approval_policy, &decision_source)	1
.can_set(&approval_policy.to_core())	1
.and_then(|messages| messages.guardian_v2.as_ref());	1
codex_app_server_protocol::GuardianApprovalReviewStatus::Approved => {	1
Arc::new(ExecPolicyManager::new(Arc::new(managed_policy)))	1
Err(headless_error) if !preserve_headless_approval_policy => {	1
async fn guardian_review_does_not_retry_valid_denial() -> anyhow::Result<()> {	1
pinned_features.insert(Feature::GuardianApproval, enabled);	1
pub(crate) fn routes_approval_policy_to_guardian(	1
use super::AskForApproval;	3
fn collect_guardian_transcript_entries_includes_recent_tool_calls_and_output() {	1
if crate::guardian::routes_approval_policy_to_guardian(approval_policy, approvals_reviewer)	1
track_guardian_review(	1
GuardianAssessmentAction::Command { command, .. } => Some(command.clone()),	1
GuardianReviewDecision::Aborted => "aborted",	1
ServerNotification::ItemGuardianApprovalReviewCompleted(	1
pub(crate) struct GuardianReviewContext {	1
// Approval and guardian flows can emit the command start notification before core	1
files: vec![test_path_buf("/tmp/guardian.txt").abs()],	1
panic!("expected second guardian assessment");	2
/// Returns the thread that future guardian subagents should fork from by default.	1
pub(crate) use review::routes_approval_policy_to_guardian;	1
let guardian_config = guardian_review_session_config(session.as_ref(), turn.as_ref())	2
ReviewDecision::ApprovedMcpPolicyAmendment => {	1
pub prefix_rules: Vec<RequirementsExecPolicyPrefixRuleToml>,	1
CoreGuardianUserAuthorization::Medium => Self::Medium,	1
normalize_guardian_snapshot_paths(	1
let review_tracking = GuardianReviewTrackContext::new(	1
use codex_protocol::approvals::GuardianAssessmentStatus;	2
fn approval_policy_from_effective_config(	1
.enabled(Feature::GuardianReuseParentCompaction)	2
use codex_protocol::approvals::GuardianAssessmentEvent;	4
fn build_guardian_transcript_preserves_recent_tool_context_when_user_history_is_large() {	1
GuardianReviewError::Cancelled => {	1
let selected = match &approval_policy {	1
Some(ThreadSource::Subagent | ThreadSource::GuardianReview)	1
pub root_authorization_version: Option<GuardianAuthorizationVersion>,	1
GuardianReviewSessionKind::TrunkNew	1
let reuse_key = GuardianReviewSessionReuseKey::from_spawn_config(	2
exec_policy: &codex_execpolicy::Policy,	1
GuardianApprovalRequest::NetworkAccess { .. } => None,	1
return Err("the destination changes the admitted Guardian rejection policy".to_string());	1
.guardian_policy_config	1
pub struct RequirementsExecPolicyPatternTokenToml {	1
approval_policy: config_snapshot.approval_policy.into(),	1
AskForApproval::OnRequest | AskForApproval::Granular(_)	1
let (session, mut turn) = guardian_test_session_and_turn(&server).await;	2
GuardianReviewSessionOutcome::Aborted => (	1
impl GuardianReviewSessionReuseKey {	1
async fn thread_approve_guardian_denied_action_inner(	1
"command": "rm -rf /tmp/guardian",	2
AskForApproval::from(trusted_config.permissions.approval_policy.value()),	1
_ => ReviewDecision::Abort,	1
} => GuardianAssessmentAction::NetworkAccess {	1
async fn run_guardian_review_session_before_deadline(	1
pub(super) fn on_guardian_review_notification(	1
GuardianReviewOutcome::Error(error) => match error {	1
guardian_reasoning_effort.clone(),	1
// makes guardian review observable in the current thread.	1
pub(crate) enum GuardianApprovalRequest {	1
f"{indent}approval_policy=approval_policy,",	1
approval_policy: Some(self.step_settings.approval_policy.value()),	1
"{\"risk_level\":\"low\",\"user_authorization\":\"high\",\"outcome\":\"allow\",\"rationale\":\"first guardian rationale\"}",	1
Self::Timeout => GuardianReviewFailureReason::Timeout,	1
fn try_from(value: GuardianApprovalReviewAction) -> Result<Self, Self::Error> {	1
return (outcome, GuardianReviewAnalyticsResult::without_session());	1
Ok(ThreadApproveGuardianDeniedActionResponse {})	1
use codex_protocol::protocol::GuardianAssessmentEvent;	1
guardian_catalog_contains_auto_review: params.guardian_catalog_contains_auto_review,	1
guardian_review_model_override: params.guardian_review_model_override,	1
None => GuardianTranscriptEntryKind::Tool("tool result".to_string()),	1
CoreGuardianCommandSource::UnifiedExec => Self::UnifiedExec,	1
map: HashMap<String, ReviewDecision>,	1
policy: GuardianRejectionCircuitBreakerPolicy,	1
guardian_policy_config: None,	1
ReviewDecision::Approved => "approved",	1
/// Optional model-owned defaults for selecting and bounding Guardian v2 history.	1
agent_config.permissions.approval_policy = Constrained::allow_only(AskForApproval::Never);	1
impl RequirementsExecPolicyToml {	1
pub(crate) async fn record_guardian_denial_for_test(	1
warn!("network Guardian review task failed: {err}");	1
) != AppServerAskForApproval::OnRequest);	1
|| session.approval_policy.to_core() != config.permissions.approval_policy.value()	1
review_scope: GuardianV2ReviewScope,	1
return ReviewDecision::Approved;	1
let guardian_catalog_contains_auto_review = available_models	1
enum GuardianElicitationReview {	1
ensure_guardian_followup_reminder(review_session).await;	1
turn_context.approval_policy(),	1
guardian_policy_config: Some(guardian_policy_config.clone()),	1
impl GuardianRejectionCircuitBreaker {	1
GuardianTranscriptEntryKind::Tool("tool shell call".to_string()),	1
guardian_reasoning_effort: guardian_reasoning_effort.map(|effort| effort.to_string()),	1
.pending_guardian_review_status	1
/// Route Guardian review and classification through the unmetered Codex endpoints.	1
use super::GuardianAssessmentOutcome;	1
let review = GuardianApprovalReview {	1
let third_request = GuardianApprovalRequest::ExecCommand {	1
requirements.approval_policy.value(),	1
let guardian_config = match GuardianV2Config::resolve(input.config) {	1
req.turn_environment.config().exec_policy.as_ref(),	1
return (GuardianReviewOutcome::Error(error), analytics_result);	1
GuardianReviewOutcome::Error(GuardianReviewError::Timeout),	1
&mut constrained_approval_policy,	1
codex_protocol::protocol::GuardianAssessmentStatus::TimedOut => {	1
GuardianTrustedSkillsFragment {	1
/// Whether this thread may use the unmetered Guardian classifier endpoint.	1
// interleaved with their bounded tool response and provenance. Guardian V2	1
fn reviewed_action_tag(action: &GuardianReviewedAction) -> &'static str {	1
AskForApproval::Granular(granular_config)	2
config.permissions.approval_policy.value().to_string(),	1
if guardian_config.features.enabled(feature) {	1
return AskForApproval(root=AskForApprovalValue.never), None	1
use codex_analytics::GuardianApprovalRequestSource;	4
"Guardian v2 transcript {entry_setting} must not exceed {transcript_setting}"	1
pub(crate) fn guardian_output_schema() -> Value {	1
GuardianAssessmentAction::McpToolCall {	1
.expect("guardian code-mode exec description");	1
let override_model = "guardian-review-model-override".to_string();	1
/// Ordered collection of independently scoped Guardian section contributors.	1
exec_policy.as_ref(),	2
let action = GuardianApprovalRequest::WriteStdin {	1
"review-shell-guardian-3".to_string(),	1
.get_or_init(GuardianReviewEvidence::default)	1
match parse_guardian_assessment(Some(&last_agent_message)) {	1
use codex_guardian_context::TranscriptHistory;	1
emit_guardian_review_metrics(	1
pub use guardian_review_evidence::GuardianReviewEvidenceFragment;	1
pub fn put<K>(&mut self, key: K, value: ReviewDecision)	1
use crate::history_cell::ReviewDecision;	1
use codex_app_server_protocol::GuardianApprovalReviewAction;	2
approval_policy,	1
self.set_approval_policy(settings.approval_policy);	1
store.put(key, ReviewDecision::ApprovedForSession);	1
panic!("expected guardian assessment");	4
ev_response_created("resp-guardian-3"),	1
fn guardian_review_metric_tags(	1
thread_source: Some(if is_guardian_reviewer {	1
CoreReviewDecision::Abort => Self::Cancel,	1
guardian_config.include_apps_instructions = false;	1
guardian_policy_config = """	2
pub(crate) fn guardian_agent_spawner(	1
use super::prompt::build_guardian_prompt_items_with_parent_turn;	1
async fn guardian_review_retries_transient_session_failure_then_approves() -> anyhow::Result<()> {	1
content_entry(GuardianTranscriptEntryKind::Assistant, content)	1
approval_policy: self.step_settings.approval_policy.value(),	2
pub enum AutoReviewDecisionSource {	1
pub(super) struct PendingGuardianReviewStatus {	1
pub(crate) approval_request_source: GuardianApprovalRequestSource,	1
} => GuardianReviewedAction::Execve {	1
let approval_policy = if prepared_call.is_selected_plugin_server() {	1
AskForApproval::UnlessTrusted => false,	1
ReviewDecision::Abort => ElicitationResponse {	1
Constrained::allow_only(AskForApproval::Never)	1
&& !self.config.features.enabled(Feature::GuardianApproval)	1
.map(|_| GuardianTranscriptEntry {	1
CoreAskForApproval::Granular(granular_config) => AskForApproval::Granular {	1
config.permissions.approval_policy.set(policy.to_core())?;	1
|| !self.config.features.enabled(Feature::GuardianApproval)	1
/// Thread-local guardian state captured after the host registers a thread.	1
pub(crate) user_authorization: codex_protocol::protocol::GuardianUserAuthorization,	1
struct GuardianPromptHeadings {	1
|| current.step_settings.approval_policy.value()	1
let text = match approval_policy {	1
exec_policy_fallback: &impl Fn(&[String]) -> Decision,	2
| GuardianAssessmentAction::RequestPermissions { .. } => None,	1
guardian_session_kind: result.guardian_session_kind,	1
pub messages: Vec<GuardianRootMessage>,	1
serde_json::to_value(guardian_assessment_action(&action)).expect("serialize action"),	1
pub enum GuardianRootMessage {	1
enum GuardianPromptShape {	1
let action = GuardianAction {	1
vec![GuardianTranscriptEntry {	3
guardian_request_turn_id(&apply_patch, "fallback-turn"),	1
impl codex_extension_api::ContextContributor for GuardianMemoryContextProbe {	1
terminal_status: GuardianReviewTerminalStatus::Approved,	1
ContentItemKind("guardian.node_repl_policy".to_string())	1
guardian_review_model_overridden: Some(params.guardian_review_model_overridden),	1
encrypted_content: "encrypted guardian parent summary".to_string(),	1
GuardianApprovalReviewAction::WriteStdin {	1
guardian_catalog_contains_auto_review: result.guardian_catalog_contains_auto_review,	1
fn apply_exec_policy_network_rules(config: &mut NetworkProxyConfig, exec_policy: &Policy) {	1
"ignoring approval for non-denied Guardian assessment"	1
) -> GuardianRejectionCircuitBreakerAction {	1
let mut approval_policy = approval_policy_override	1
guardian_policy_config_from_requirements(config_layer_stack.requirements_toml())	1
pub use events::GuardianReviewTerminalStatus;	1
) -> GuardianAssessmentAction {	2
serde_json::from_value(value.clone()).expect("guardian review action");	1
.guardian_model	1
for value in ["user", "auto_review", "guardian_subagent"] {	1
.ok_or(RequirementsExecPolicyParseError::EmptyPattern { rule_index })?;	1
if ev.status != GuardianAssessmentStatus::Denied {	1
AskForApproval::Granular(granular_config) => granular_instructions(	1
self.on_guardian_assessment(GuardianAssessmentEvent {	1
if approval_policy == AskForApproval::OnRequest {	2
GuardianApprovalRequest::NetworkAccess { trigger, .. } => {	1
pub fn proposed_execpolicy_amendment(&self) -> Option<&ExecPolicyAmendment> {	1
let allowed_approval_policies = vec![AskForApproval::UnlessTrusted, AskForApproval::Never];	1
async fn guardian_review_exhausts_three_failures_with_one_terminal_event() -> anyhow::Result<()> {	1
fn exec_policy_config_warning(err: &ExecPolicyError) -> ConfigWarningNotification {	1
| ReviewDecision::ApprovedForSession	1
"retried ephemeral review should preserve the guardian prompt cache key"	1
.all(|key| matches!(store.get(key), Some(ReviewDecision::ApprovedForSession)))	1
.set(AskForApproval::UnlessTrusted.to_core())	2
use codex_features::GuardianV2TranscriptConfigToml;	1
async fn guardian_review_session_config_uses_live_network_proxy_state() {	1
"guardian reviewer could not clear MCP servers: {error}"	1
ignore_user_and_project_exec_policy_rules: false,	2
use codex_core::context::GuardianReviewEvidenceFragment;	1
"guardian reviewer could not preserve managed network restrictions: {error}"	1
Some(error_info) => GuardianReviewError::session_with_error_info(error, error_info),	1
approval_policy: approval_policy.to_string(),	1
input.thread_store.insert(GuardianReviewEvidence::default());	1
Ok(approval_policy) => approval_policy,	1
"approval_policy = \"never\"\nsandbox_mode = \"workspace-write\"\nmodel_instructions_file = \"./managed.md\"",	1
kind: GuardianTranscriptEntryKind::Developer,	1
struct GuardianReviewEvidenceState {	1
if let Ok(payload) = serde_json::from_str::<GuardianAssessmentPayload>(text) {	1
anyhow::anyhow!("guardian review session could not set permission profile: {err}")	1
.map_err(|err| invalid_request(format!("invalid Guardian denial event: {err}")))?;	1
input: GuardianReviewEventParams,	1
if ev.status == GuardianAssessmentStatus::InProgress	1
.get::<GuardianReviewEvidence>()	3
GuardianReviewAnalyticsResult::without_session(),	1
use super::prompt::GuardianTranscriptCursor;	1
| GuardianApprovalRequest::McpToolCall { .. } => default_turn_id,	1
AskForApproval::from(app.config.permissions.approval_policy.value()),	3
current_exec_policy.as_ref(),	1
.run_review(GuardianReviewSessionParams {	1
let hosted_specs = if crate::guardian::is_basic_session_source(&turn_context.session_source) {	1
let guardian_parent_turn = Arc::clone(&startup_turn_context);	1
let rejects_sandbox_approval = matches!(policy, AskForApproval::Never)	1
GuardianAssessmentStatus::InProgress	1
GuardianApprovalReviewAction::Command { .. } => (	1
fn guardian_rejection_circuit_breaker_interrupts_cyber_models_after_one_denial() {	1
) -> GuardianReviewEventParams {	1
pub(crate) use review::guardian_timeout_message;	1
kind: GuardianTranscriptEntryKind::Tool("tool read_file result".to_string()),	1
analytics_result.guardian_model_provider_id.as_deref(),	3
pub use requirements_exec_policy::RequirementsExecPolicyPatternTokenToml;	1
guardian_exec_command_request("shell-4"),	1
&& parent_config.config_layer_stack.requirements().exec_policy	1
assert_eq!(second_assessment.rationale, "second guardian rationale");	1
policy: approval_policy,	1
// GuardianV2Extension::on_tool_start reads the parent ModelInfo from	1
| ReviewDecision::ApprovedExecpolicyAmendment { .. }	1
async fn guardian_test_session_and_turn_with_base_url(	1
restore_approval_policy || restore_approvals_reviewer || restore_permission_profile;	1
GuardianReviewSessionOutcome::PromptBuildFailed(err),	1
ReviewDecision::ApprovedForSession => "approved_for_session",	1
terminal_status: GuardianReviewTerminalStatus::FailedClosed,	1
GuardianAssessmentStatus::InProgress => (None, None, None),	1
track_guardian_review(	1
| ServerNotification::ItemGuardianApprovalReviewStarted(_)	1
pub(super) use codex_app_server_protocol::GuardianRiskLevel as AppServerGuardianRiskLevel;	1
approval_policy: codex_protocol::protocol::AskForApproval::Never,	1
let first_outcome = run_guardian_review_session_for_test(	2
session_configuration.step_settings.approval_policy.clone();	1
let review: BoxFuture<'_, ReviewDecision> = Box::pin(run_guardian_review(	1
let assessment = GuardianAssessment {	1
if !crate::guardian::routes_approval_policy_to_guardian(approval_policy, approvals_reviewer) {	1
EventMsg::GuardianAssessment(GuardianAssessmentEvent {	2
assert_eq!(guardian_config.notify, None);	1
GuardianTranscriptEntry {	10
if !crate::exec_policy::child_uses_parent_exec_policy(&parent_config, child_config) {	1
fn collect_guardian_transcript_entries_skips_contextual_user_messages() {	1
// Keep the guardian policy prompt out of the aggregated developer bundle so it	1
NetworkPolicyRuleAction::Allow => (ExecPolicyDecision::Allow, "Allow"),	1
GuardianNodeReplTranscriptImages,	1
"Use the workspace-managed guardian policy.",	1
if self.free_guardian_enabled	1
assert!(guardian_review_result(GuardianApprovalReviewStatus::InProgress).is_none());	1
async fn overridden_disabled_guardian_does_not_apply_auto_review_companions() -> Result<()> {	1
codex_protocol::protocol::GuardianAssessmentStatus::Approved	1
"Guardian v2 transcript max_recent_non_user_entries must be positive".to_owned(),	1
anyhow::bail!("guardian assessment was not valid JSON");	1
guardian_review_model_overridden: params.guardian_review_model_overridden,	1
params.approval_policy,	1
config.permissions.approval_policy = Constrained::allow_only(AskForApproval::Never);	2
ev_assistant_message("msg-parse-failure-1", "not valid guardian json"),	1
| ReviewDecision::NetworkPolicyAmendment { .. }	1
Some(GuardianUserAuthorization::Low) => "low",	1
use crate::exec_policy::AllowPrefixRules;	2
.guardian_review_session	2
FileChangeApprovalDecision::AcceptForSession => ReviewDecision::ApprovedForSession,	1
command_origin: ExecPolicyCommandOrigin::Generic,	1
let mut guardian_config = parent_config.clone();	1
config.permissions.approval_policy.value().to_string(),	1
guardian_review_model_overridden: session_config.model_overridden,	1
GuardianTranscriptEntryKind::NodeReplToolResult(format!(	1
ServerNotification::ItemGuardianApprovalReviewStarted(notification) => {	1
CommandExecutionApprovalDecision::Accept => (ReviewDecision::Approved, None),	1
command_origin: ExecPolicyCommandOrigin::PowerShell,	2
pub(super) struct GuardianAction {	1
.thread_id = fixed_guardian_parent_session_id();	1
.expect("guardian action"),	3
assert_eq!(assessment.outcome, GuardianAssessmentOutcome::Allow);	3
pub(crate) enum GuardianRejectionCircuitBreakerAction {	1
"codex_core__guardian__tests__guardian_followup_review_request_layout",	1
const GUARDIAN_SKILL_NAME: &str = "guardian-context-probe";	1
let ReviewDecision::Denied { rejection } = decision else {	1
| ReviewDecision::Denied { .. }	1
async fn update_feature_flags_enabling_guardian_overrides_explicit_manual_review_policy()	1
use codex_guardian_v2::StrictReviewReason;	1
async fn guardian_review_retry_wait_honors_deadline() {	1
GuardianReviewSessionOutcome::PromptBuildFailed(err) => (	1
"msg-guardian-2",	2
async fn guardian_review_session_config_clears_legacy_notify() {	1
terminal_status: GuardianReviewTerminalStatus::FailedClosed,	1
assert!(!app.config.features.enabled(Feature::GuardianApproval));	2
fn guardian_timeout_message_distinguishes_timeout_from_policy_denial() {	1
ContentItemKind("guardian.trusted_tool".to_owned())	1
use crate::history_cell::ReviewDecision;	1
evaluate_intercepted_exec_policy(	1
let (session, turn) = guardian_test_session_and_turn(&server).await;	5
fn guardian_v2_feature_config_rejects_invalid_settings() {	1
if !approval_policy_was_explicit	1
// guardian::review::guardian_review_session_config and Guardian V2 still	1
impl GuardianV2Config {	1
kind: GuardianTranscriptEntryKind::Tool(format!("tool call {index}")),	1
AskForApprovalValue,	1
| codex_protocol::protocol::GuardianAssessmentStatus::Aborted => {	1
let tenant_policy_config = parent_config.resolve_guardian_policy(model_messages);	1
use crate::guardian::review::routes_approval_to_guardian_with_reviewer;	1
requested_additional_permissions: guardian_review_requested_additional_permissions(	1
AskForApproval::Never => APPROVAL_POLICY_NEVER.to_string(),	1
if endpoint == ResponsesEndpoint::Guardian {	2
GuardianApprovalReviewAction::NetworkAccess {	1
GuardianAssessmentDecisionSource::Agent	1
let guardian_approval_enabled = self.config.features.enabled(Feature::GuardianApproval);	1
impl FeatureConfig for GuardianV2ConfigToml {	1
codex_app_server_protocol::GuardianRiskLevel::Medium => {	1
pub(crate) fn routes_approval_to_guardian_with_reviewer(	1
/// Record that the user approved one retry of a concrete Guardian-denied action.	1
action: &GuardianApprovalRequest,	3
approval_policy: None,	2
GuardianAssessmentStatus::Approved,	1
) -> anyhow::Result<ReviewDecision> {	1
.set_approval_policy(AskForApproval::UnlessTrusted);	2
use crate::guardian::prompt::guardian_policy_prompt_with_config_and_template;	1
if let Some(prefixes) = approved_command_prefixes_text(exec_policy) {	1
.map(|tool| tool["name"].as_str().expect("guardian code-mode tool name"))	1
let (text, _) = guardian_truncate_text(&entry.text, token_cap);	1
"guardian request should not inject a skill body from its generated review prompt"	1
.or_else(|| guardian_disabled_reason(false));	1
let guardian_exec_description = guardian_tools	1
let guardian_thread_id = metadata	1
ApprovalReviewer::Guardian => self.request_guardian_approval(action, ctx).await,	1
async fn build_guardian_prompt_truncates_oversized_approval_reason() -> anyhow::Result<()> {	1
let spawn_config = guardian_review_session_config(&parent_session, &parent_turn)	1
.expect("fresh guardian user message")	1
"guardian reviewer could not disable `features.{}`: {error}",	1
GuardianApprovalRequest::RequestPermissions { .. } => {	1
use codex_app_server_protocol::AutoReviewDecisionSource;	1
"follow-up reminder should be persisted for guardian forks"	1
.request_typed(ClientRequest::ThreadApproveGuardianDeniedAction {	1
pub risk_level: GuardianRiskLevel,	1
assert_eq!(first_assessment.rationale, "first guardian rationale");	1
assert_eq!(payload.review_id, "review-cmd-guardian-missing-target");	1
assert!(!guardian_config.memories.use_memories);	1
guardian_config.base_instructions,	3
| ReviewDecision::ApprovedMcpPolicyAmendment	1
guardian_policy_config.filter(|value| !value.trim().is_empty())	1
use crate::codex_thread::GuardianRootSnapshot;	1
pub(crate) use review::GuardianReviewOptions;	1
approval_policy: context.step_context.settings.approval_policy(),	1
GuardianReviewSessionOutcome::SessionFailed {	1
assert_eq!(payload.turn_id, "turn-guardian-approved");	1
use super::GuardianApprovalRequest;	3
let review: GuardianApprovalReview = serde_json::from_value(json!({	1
impl ToolLifecycleContributor for GuardianV2Extension {	1
.expect("second guardian review gate should still be open");	1
ReviewDecision::ApprovedExecpolicyAmendment { .. } => "approved_with_amendment",	1
fourth_metadata.guardian_thread_id	1
pub use requirements_exec_policy::RequirementsExecPolicyToml;	1
CoreGuardianAssessmentDecisionSource::Agent => Self::Agent,	1
pending_approvals: HashMap<String, oneshot::Sender<ReviewDecision>>,	1
id: "shell-guardian-error".to_string(),	1
fn client_request_thread_start_granular_approval_policy_is_marked_experimental() {	1
record_guardian_non_denial(&session, guardian_request_turn_id(&request, &turn.sub_id))	1
use codex_core::GuardianRootMessage;	1
"codex.guardian_v2.classification.token_usage";	1
!matches!(policy, AskForApproval::Never)	1
proposed_execpolicy_amendment: Option<&ExecPolicyAmendment>,	2
include_str!("../../assets/guardian/node_repl_policy.md").to_string()	1
user_authorization: Some(GuardianUserAuthorization::High),	1
) -> Option<GuardianReviewError> {	1
inheritance.exec_policy,	1
| GuardianApprovalReviewAction::Command { .. }	1
pub approval_mode: Option<AskForApproval>,	1
/// See core/src/exec_policy.rs for more details on how proposed_execpolicy_amendment is determined.	1
pub(crate) fn into_guardian_request(	1
fn legacy_managed_config_backfill_allows_user_when_guardian_is_required() -> io::Result<()> {	1
exec_policy_hint: None,	4
let deserialized: GuardianApprovalReviewAction =	1
.get_or_insert_with(GuardianV2TranscriptConfigToml::default);	1
codex_protocol::approvals::GuardianUserAuthorization::Medium	1
"parent denied-read restrictions exceed the Guardian evidence limit".to_string(),	1
config.permissions.approval_policy.value()	1
approval_policy: Some(default_approval_policy.into()),	1
impl AskForApproval {	1
GuardianReviewSessionOutcome::Completed(Err(err)) => (	1
params: &GuardianReviewSessionParams,	2
let (session, turn) = guardian_test_session_and_turn_with_base_url("http://localhost").await;	9
FunctionCallError::RespondToModel(format!("approval_policy is invalid: {err}"))	1
let exec_policy = if crate::guardian::is_basic_session_source(&session_source) {	1
proposed_execpolicy_amendment: Option<&codex_app_server_protocol::ExecPolicyAmendment>,	1
Check(ExecPolicyCheckCommand),	2
use crate::guardian::GuardianReviewOptions;	1
GuardianApprovalRequest::ApplyPatch { .. } => GuardianReviewedAction::ApplyPatch {},	1
GuardianApprovalReviewAction::NetworkAccess { .. } => (	1
// footer summary by `PendingGuardianReviewStatus`.	1
ignore_user_and_project_exec_policy_rules: bool,	1
/// Guardian reviewer identity is trusted only when established during an in-memory spawn.	1
GuardianApprovalReviewStatus::InProgress	1
impl GuardianPolicy {	1
mod exec_policy;	1
//! that render approvals, permissions, tool input, and guardian reviews.	1
ctx.step_context.settings.approval_policy(),	1
.ignore_user_and_project_exec_policy_rules()	1
let memory_extension = Arc::new(GuardianMemoryContextProbe);	1
use super::prompt::GuardianPromptMode;	1
Error(GuardianReviewError),	1
AskForApproval::Never => CoreAskForApproval::Never,	1
app.update_feature_flags(&mut app_server, vec![(Feature::GuardianApproval, true)])	2
guardian_config.permissions.network,	1
out.push(TrackEventRequest::GuardianReview(Box::new(	1
/// Include sandboxed shell command calls in Guardian v2 classification.	1
EventMsg::GuardianAssessment(assessment_event),	1
use super::trusted_skills::GuardianTrustedSkillsFragment;	1
let mut guardian_nested_tool_names = guardian_exec_description	1
/// Optional model-owned defaults for Guardian v2 classification experiments.	1
GuardianPromptHeadings {	2
use codex_app_server_protocol::guardian_auto_approval_review_notification;	1
fn session_kind_tag(kind: Option<GuardianReviewSessionKind>) -> &'static str {	1
if score >= guardian_config.review_threshold {	1
) -> tuple[AskForApproval | None, ApprovalsReviewer | None]:	1
.expect("Guardian parent-compaction reuse should be configurable");	1
pub enum GuardianCommandSource {	2
.get::<GuardianReviewEvidence>()	1
pub use exec_policy::ExecPolicyError;	1
assert!(config.contains("approval_policy = \"on-request\""));	3
guardian_review: input,	1
approval_policy: self.permissions.approval_policy.clone(),	1
fn should_bypass_approval(&self, policy: AskForApproval, already_approved: bool) -> bool {	1
/// Lightweight asynchronous Guardian risk classification.	1
inherited_exec_policy: Some(Arc::clone(&parent_session.services.exec_policy)),	1
use codex_core::GuardianAuthorizationVersion;	1
async fn build_guardian_prompt_prefers_retry_reason_over_approval_reason() -> anyhow::Result<()> {	1
impl From<&Arc<StepContext>> for GuardianReviewContext {	1
return GuardianElicitationReview::Decline(	2
guardian_v2: None,	4
toml::from_str("guardianv2 = true").expect("Guardian v2 boolean should deserialize");	1
pub use codex_thread::GuardianRootMessage;	1
GuardianReviewedAction::NetworkAccess {	1
.guardian_rejection_circuit_breaker	3
guardian_model.as_str(),	1
pub(super) fn try_set_approval_policy_on_config(	1
use prompt::collect_guardian_transcript_entries;	1
proposed_execpolicy_amendment.map(V2ExecPolicyAmendment::from);	1
return if approval_policy == AskForApproval::Never {	1
async fn guardian_review_session_config_uses_default_guardian_policy_without_requirements_override()	1
input.thread_store.insert(guardian_config);	1
session_kind_tag(result.guardian_session_kind).to_string(),	1
NetworkApprovalProtocol::Socks5Tcp => ExecPolicyNetworkRuleProtocol::Socks5Tcp,	1
let (outcome, analytics_result) = run_guardian_review_session_for_test(	1
"AskForApproval",	1
.expect("third guardian thread id should be a valid UUID");	1
&[(Feature::GuardianApproval, /*enabled*/ true)],	1
guardian_risk_level_str(assessment.risk_level),	1
let (inherited_environments, inherited_exec_policy, client_mcp_extensions) = if let Some(	1
codex_app_server_protocol::GuardianRiskLevel::High => {	1
ReviewDecision::Abort => Err(ToolError::Codex(CodexErr::TurnAborted)),	1
/// contract is appended from code so it stays near `guardian_output_schema()`.	1
let Some(score_progress) = thread_store.get::<GuardianV2ScoreProgress>() else {	1
text: GuardianReviewEvidenceFragment::new(body).render(),	1
.mut_arg("auto_review", |arg| arg.conflicts_with("approval_policy"))	1
pub fn new_guardian_denied_action_request(summary: String) -> Box<dyn HistoryCell> {	1
Some(Arc::clone(&parent.session.services.exec_policy)),	1
&["user", "auto_review", "guardian_subagent"],	2
let current_exec_policy = self.services.exec_policy.current();	1
pub use exec_policy::check_execpolicy_for_warnings;	1
use codex_protocol::approvals::GuardianAssessmentDecisionSource as CoreGuardianAssessmentDecisionSource;	1
pub free_guardian: bool,	1
let GuardianElicitationReview::ApprovalRequest(guardian_request) =	1
ThreadSource::GuardianReview => CoreThreadSource::GuardianReview,	1
fn denied_event(id: usize) -> GuardianAssessmentEvent {	1
.ignore_user_and_project_exec_policy_rules()	2
use super::approval_request::guardian_request_target_item_id;	1
pub(crate) async fn load(config_stack: &ConfigLayerStack) -> Result<Self, ExecPolicyError> {	1
pub(crate) fn set_approval_policy(&mut self, policy: AskForApproval) {	1
use codex_core::ExecPolicyError;	1
ev_assistant_message("msg-guardian-4", &third_assessment),	1
id: "shell-guardian-3".to_string(),	1
} => GuardianReviewedAction::UnifiedExec {	1
|| GuardianAuthorizationVersion::from_history(history.as_ref()),	1
first_metadata.guardian_session_kind,	2
guardian_request,	1
pub status: GuardianApprovalReviewStatus,	1
impl Default for ReviewDecision {	1
let approval_policy = if shared.dangerously_bypass_approvals_and_sandbox {	1
free_guardian_enabled: false,	1
) -> Vec<ReviewDecision> {	1
review: codex_app_server_protocol::GuardianApprovalReview,	1
pub approval: AskForApproval,	1
approval_request_source: GuardianApprovalRequestSource,	4
return f"{indent}approval_policy, approvals_reviewer = {helper_name}(approval_mode)"	1
pub(crate) fn push(&mut self, event: GuardianAssessmentEvent) {	1
annotations: Some(GuardianMcpAnnotations {	2
exec_policy: inherited_exec_policy,	1
let guardian_config = build_guardian_review_session_config_for_test(	10
configuration.trusted_guardian_reviewer,	1
}: ExecPolicyCommands,	1
permission_profile: Some(guardian_permission_snapshot.permission_profile().clone()),	1
trigger: GuardianNetworkAccessTrigger,	1
GuardianV2,	1
"the destination changes the Guardian parent-fallback policy".to_string(),	1
guardian_mcp_request("node_repl", "inspect"),	1
use super::prompt::guardian_policy_prompt_with_config_and_template;	1
fn deserialize_guardian_policy_config() -> Result<()> {	1
&& crate::guardian::is_basic_session_source(&self.state.session_source)	1
"guardian_policy_config: configured (source: {requirements_source})"	1
last_reviewed_transcript_cursor: Option<GuardianTranscriptCursor>,	2
approval_policy: approval_policy	1
GuardianApprovalRequest::NetworkAccess { turn_id, .. }	1
let (value, truncated) = truncate_guardian_action_value(value);	1
review_context: GuardianReviewContext::from(&context.step_context),	1
impl ContextualUserFragment for GuardianFollowupReviewReminder {	1
let decision = crate::guardian::review_approval_request_with_cancel(	1
fn guardian_output_schema_requires_only_outcome_and_allows_optional_details() {	1
) -> GuardianElicitationReview {	1
model_overridden: guardian_review_model_overridden,	1
/// Structured synchronous-review evidence retained for Guardian V2 classification.	1
"guardian MCP elicitation tool_params must be an object",	1
GuardianReviewDecision::Denied => "denied",	1
// Guardian input embeds the parent transcript as untrusted evidence. Do not interpret skill or	1
assert_eq!(serde_json::from_value::<ReviewDecision>(value)?, decision);	1
assert_eq!(id, "cmd-guardian-approved");	1
struct GuardianAssessmentPayload {	1
return ReviewDecision::ApprovedMcpPolicyAmendment;	1
.guardian_thread_id	3
use super::review::guardian_review_session_config;	1
"forked guardian review should reuse the trunk guardian prompt cache key"	1
pub(super) fn is_guardian_review(&self) -> bool {	1
let review_context = GuardianReviewContext::from_resolved_settings(	1
return Err(RequirementsExecPolicyParseError::EmptyPrefixRules);	1
status: GuardianAssessmentStatus,	1
let preset_approval = AskForApproval::from(preset.approval);	1
AskForApproval::UnlessTrusted => CoreAskForApproval::UnlessTrusted,	1
self.ingest_guardian_review_completed(notification, out);	1
let guardian_approval_id = Self::approval_id_for_key(&key);	1
guardian_catalog_contains_auto_review: Some(	1
ExecPolicyCommandOrigin::Generic => dangerous_command_match(command),	1
let (path, range) = exec_policy_warning_location(err);	1
SessionSource::Internal(InternalSessionSource::Guardian)	1
/// Whether an approval with its own reviewer selection should be routed through guardian.	1
GuardianAssessmentStatus::TimedOut => CommandExecutionStatus::Failed,	1
if let Some(guardian_policy_config) =	1
fn guardian_assessment_started_uses_event_turn_id_fallback() {	1
tool: guardian_command_source_tool_name(*source),	1
use crate::guardian::GUARDIAN_MAX_NODE_REPL_TOOL_RESULT_TOKENS;	1
GuardianElicitationReview::Decline(	1
self.selected.approval_policy.value()	1
id: guardian_approval_id,	1
decision = self.request_guardian_approval(	1
session.thread_id = fixed_guardian_parent_session_id();	3
ContentItemKind("guardian.trusted_skills".to_owned())	1
codex_app_server_protocol::GuardianApprovalReviewStatus::Denied => {	1
source_for_top_level_keys(layers, &["guardian_policy_config"]),	1
&GuardianAssessmentEvent {	3
pub(super) const REVIEW_FALLBACK_METRIC: &str = "codex.guardian_v2.review_fallback";	1
GuardianAssessmentStatus::InProgress => CommandExecutionStatus::InProgress,	1
if !user_input.is_empty() && turn.config.features.enabled(Feature::GuardianApproval) {	1
pub use events::GuardianReviewTrackContext;	1
review_context: GuardianReviewContext::from_resolved_settings(	1
impl ElicitationReviewer for GuardianMcpElicitationReviewer {	1
GuardianAssessmentAction::NetworkAccess { target, .. } => {	1
&ReviewDecision::denied("network approval was rejected"),	1
use crate::guardian::GuardianApprovalRequest;	1
crate::guardian::guardian_timeout_message(turn_context.model_info()),	1
guardian_policy_config: Some(Sourced::new(guardian_policy_config, source)),	1
pub use crate::approvals::GuardianCommandSource;	1
return GuardianElicitationReview::Decline(	3
pub(crate) fn approve_guardian_denied_action(event: GuardianAssessmentEvent) -> Self {	1
if turn_context.approval_policy() == AskForApproval::Never {	1
decisions.push(ReviewDecision::Abort);	1
AppEvent::UpdateAskForApprovalPolicy(policy) => {	1
if self.config.features.enabled(Feature::GuardianApproval) {	1
"review-shell-guardian-error".to_string(),	1
"the trunk guardian review should still be blocked on its gated response"	1
"guardian MCP elicitation review only supports form elicitations",	1
circuit_breaker.record_denial("turn-1", GuardianRejectionCircuitBreakerPolicy::CyberModel),	2
async fn approve_guardian_denied_action(sess: &Arc<Session>, event: GuardianAssessmentEvent) {	1
.approval_policy	6
GuardianTranscriptEntryKind::Tool(format!("tool {name} result"))	1
use crate::guardian::AUTO_REVIEW_DENIED_ACTION_APPROVAL_DEVELOPER_PREFIX;	1
|| !input.config.features.enabled(Feature::GuardianApproval)	1
.trusted_guardian_reviewer	1
completion: Option<(i64, codex_app_server_protocol::AutoReviewDecisionSource)>,	1
use codex_protocol::approvals::ExecPolicyAmendment as CoreExecPolicyAmendment;	1
pub struct GuardianV2ConfigToml {	1
async fn guardian_review_session_config_keeps_bedrock_provider_for_bedrock_gpt_5_4() {	1
let approval_policy = config.approval_policy.value();	1
analytics_result: &mut GuardianReviewAnalyticsResult,	1
AskForApproval::OnRequest => on_request_instructions(),	1
approval_policy,	15
approval_policy: AskForApproval::from(	1
("guardian_model".to_string(), "gpt-5.4_guardian".to_string()),	1
analytics_result.guardian_review_model_override.as_deref(),	3
ev_completed("resp-guardian-2"),	1
pub(crate) guardian_review_model_overridden: bool,	1
pub(crate) inherited_exec_policy: Option<Arc<ExecPolicyManager>>,	1
approval_policy: AskForApproval::Never,	2
pub(crate) struct ExecPolicyManager {	1
execpolicy_amendment: ExecPolicyAmendment,	1
if guardian_config.review_scope == GuardianV2ReviewScope::ComputerUseOnly {	1
guardian_mcp_request("another_server", "js"),	1
request: GuardianApprovalRequest,	8
exec_policy: Option<Arc<crate::exec_policy::ExecPolicyManager>>,	1
fn exec_policy_warning_location(err: &ExecPolicyError) -> (Option<String>, Option<AppTextRange>) {	1
approval_request_source: GuardianApprovalRequestSource,	1
pub(crate) struct ExecPolicyNetworkRuleAmendment {	1
impl ApprovalReviewContributor for GuardianV2Extension {	1
let guardian_tools = request_body["input"]	1
.with_free_guardian_enabled(config.free_guardian_enabled())	1
fn client_request_turn_start_granular_approval_policy_is_marked_experimental() {	1
kind: GuardianTranscriptEntryKind::Tool("tool read_file call".to_string()),	1
warn!("failed to resolve guardian trunk rollout path: {err}");	1
struct InterceptedExecPolicyContext {	1
async fn collect_policy_files(dir: impl AsRef<Path>) -> Result<Vec<PathBuf>, ExecPolicyError> {	1
risk_level: GuardianRiskLevel::Medium,	1
approval_policy: config.approval_policy.value(),	1
use codex_protocol::openai_models::GuardianV2ModelConfig;	2
use super::prompt::parse_guardian_assessment;	1
// guardian::review::record_guardian_denial still selects its circuit-breaker	1
/// Installs feature-gated Guardian V2 tool classification for each thread.	1
&& !(ctx.strict_auto_review && matches!(policy, AskForApproval::Never))	1
"a fresh guardian session should not inherit the follow-up reminder"	1
codex_features::GuardianV2ConfigToml,	1
ApprovalModeCliArg::OnRequest => AskForApproval::OnRequest,	1
GuardianAssessmentAction::WriteStdin { .. } => {	1
.enable(Feature::GuardianReuseParentCompaction)	1
kind: GuardianTranscriptEntryKind::Developer,	1
pub(crate) fn guardian_request_target_item_id(request: &GuardianApprovalRequest) -> Option<&str> {	1
risk_level: GuardianRiskLevel::Low,	1
/// Reuse encrypted parent compaction when restarting Guardian review sessions.	1
.expect("guardian assessment");	1
assert!(!config.contains("guardian_approval = true"));	2
environment_policy: request.turn_environment.config().exec_policy.as_ref(),	1
Op::ApproveGuardianDeniedAction { event } => {	1
GuardianAssessmentStatus::Aborted	1
decision: ReviewDecision::Approved,	1
GuardianAssessmentAction::ApplyPatch {	1
Some(codex_analytics::GuardianReviewSessionKind::TrunkNew)	4
) -> anyhow::Result<GuardianReviewSession> {	1
UpdateAskForApprovalPolicy(AskForApproval),	1
pub struct GuardianReviewSessionAnalyticsParams {	1
Some(guardian_policy_prompt_with_config_and_template(	3
approval_policy: AskForApproval::OnRequest,	6
pub enum GuardianAssessmentAction {	1
state: Mutex::new(GuardianReviewState {	1
pub(crate) use review::routes_approval_to_guardian;	1
response.approval_policy,	3
guardian_config.permissions.approval_policy = Constrained::allow_only(AskForApproval::Never);	1
GuardianApprovalRequest::McpToolCall { server, tool_name, .. }	1
assert_eq!(payload.review_id, "review-cmd-guardian-approved");	2
GuardianPromptShape::Delta {	1
typesafe_overrides.approval_policy = Some(approval_policy);	1
result: &GuardianReviewAnalyticsResult,	2
ev_completed("resp-guardian-1"),	1
pub enum GuardianAssessmentStatus {	1
key: "guardianv2",	1
async fn guardian_review_session_config_uses_requirements_guardian_policy_config() {	1
thread_store.get::<GuardianV2Enabled>()?;	1
outcome: Some(GuardianAssessmentOutcome::Allow),	1
"forked guardian review should not include the still in-flight trunk assessment"	1
format_allow_prefixes(exec_policy.get_allowed_prefixes())	1
"Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",	2
if score < guardian_config.review_threshold {	1
pub(crate) transcript_cursor: GuardianTranscriptCursor,	1
(ThreadSource::GuardianReview, "guardian_review"),	1
approval_policy.map(codex_app_server_protocol::AskForApproval::to_core);	1
guardian_user_text.contains(&format!("${GUARDIAN_SKILL_NAME}")),	1
ContentItemKind("guardian.policy".to_string())	1
if destination.constrained_approval_policy() != current.constrained_approval_policy()	1
.with_user_and_project_exec_policy_rules_ignored(ignore_user_and_project_exec_policy_rules);	1
use prompt::GuardianPromptMode;	1
use super::ExecPolicyManager;	2
async fn guardian_ephemeral_retry_preserves_parallel_trunk_and_fork_history() -> anyhow::Result<()>	1
id: Feature::GuardianV2,	1
include_str!("../templates/permissions/approval_policy/on_request.md");	1
if name == crate::guardian::GUARDIAN_REVIEWER_NAME	1
// guardian_review_session_config and Guardian V2 can fall back to parent	1
Some(codex_analytics::GuardianReviewSessionKind::TrunkReused)	5
AskForApproval::Granular(granular_config) if !granular_config.allows_mcp_elicitations() => {	1
assert!(config.contains("guardian_approval = true"));	2
GuardianAssessmentStatus::Denied,	1
use crate::guardian::prompt::BUNDLED_GUARDIAN_POLICY;	1
"Guardian follow-up review request layout",	1
third_metadata.guardian_thread_id	1
ServerNotification::ItemGuardianApprovalReviewCompleted(notification) => {	2
let first_rationale = "first guardian rationale from the prior review";	1
app.update_feature_flags(&mut app_server, vec![(Feature::GuardianApproval, false)])	2
.map_err(|source| ExecPolicyError::ReadFile {	1
) -> GuardianAuthorizationVersion {	1
pub(crate) fn deserialize_guardian_v2_feature<'de, D>(	1
if !matches!(outcome, GuardianReviewSessionOutcome::Completed(Ok(_))) {	1
user_authorization: GuardianUserAuthorization::Low,	1
include_str!("../templates/permissions/approval_policy/on_request_rule_request_permission.md");	1
let (requirements, overrides, trusted_guardian_reviewer) = {	1
codex_protocol::protocol::GuardianAssessmentStatus::InProgress	1
guardian_policy_config_source: _,	1
guardian_model_provider_id: None,	1
review_guardian_mcp_elicitation(session, request).await	1
let guardian_config = input	1
) -> ReviewDecision {	8
if matches!(outcome.0, GuardianReviewSessionOutcome::Completed(_)) {	1
if requirements_toml.guardian_policy_config.is_some() {	1
| ReviewDecision::ApprovedForSession	1
pub(crate) fn entries(&self) -> impl Iterator<Item = &GuardianAssessmentEvent> {	1
decision: ReviewDecision::denied("invalid command approval cwd"),	1
GuardianApprovalReviewAction::Command {	1
AskForApproval::OnRequest,	2
if routes_approval_to_guardian(&startup_turn_context) {	1
guardian_review_model_overridden: None,	1
impl From<GuardianCommandSource> for CoreGuardianCommandSource {	1
trigger: Some(GuardianNetworkAccessTrigger {	1
let approval_policy = match serde_json::from_value(value) {	1
fn commands_for_exec_policy(command: &[String]) -> ExecPolicyCommands {	1
let assessment_event = GuardianAssessmentEvent {	1
let extension = Arc::new(GuardianV2Extension {	1
fn approval_request_source_tag(source: GuardianApprovalRequestSource) -> &'static str {	1
let spec = match spec.with_exec_policy_network_rules(current_exec_policy.as_ref()) {	1
ApprovalModeCliArg::Never => AskForApproval::Never,	1
| ReviewDecision::ApprovedExecpolicyAmendment { .. }	1
/// Takes a vector of approval keys and returns a ReviewDecision.	1
GuardianAssessmentAction::NetworkAccess { target, .. } => {	1
fn merge_unset_fields_ignores_blank_guardian_override() {	1
CoreReviewDecision::TimedOut => Self::Decline,	1
GuardianApprovalRequest::WriteStdin { tty, .. } => {	1
guardian_review_session: GuardianReviewSessionManager::default(),	1
Some(GuardianUserAuthorization::Unknown) => "unknown",	1
/// Shared, process-lifetime registry of built-in Guardian sections.	1
status: GuardianAssessmentStatus::TimedOut,	1
NetworkApprovalProtocol::Https => ExecPolicyNetworkRuleProtocol::Https,	1
"msg-guardian-1",	2
pub action: GuardianAssessmentAction,	1
guardian_mcp_request("node_repl", "js"),	2
ContentItemKind("guardian.followup_review_reminder".to_string())	1
routes_approval_to_guardian_with_reviewer(turn, turn.config.approvals_reviewer)	1
pub(crate) struct GuardianReviewSessionParams {	1
"[guardianv2]\n\	1
if let Some(policy) = approval_policy {	1
approval: AskForApproval::Never,	1
AskForApproval::Never => return result,	1
GuardianAssessmentAction::RequestPermissions { reason, .. } => {	1
ApprovalResolutionSource::Guardian => ToolDecisionSource::AutomatedReviewer,	1
async fn update_feature_flags_disabling_guardian_clears_review_policy_and_restores_default()	1
impl SkillInvocationContributor for GuardianV2Extension {	1
GuardianWarning => "guardianWarning" (v2::GuardianWarningNotification),	1
pub(crate) review_context: GuardianReviewContext,	1
fn wants_no_sandbox_approval(&self, policy: AskForApproval) -> bool {	2
/// Warning issued by the guardian automatic approval reviewer.	1
AskForApproval::from(untrusted_config.permissions.approval_policy.value()),	1
| ThreadSource::GuardianReview	1
| GuardianAssessmentAction::ApplyPatch { .. }	1
"Guardian v2 transcript max_{kind}_entry_tokens must not exceed max_{kind}_transcript_tokens"	1
Err(ToolError::Rejected(rejection)) => ReviewDecision::denied(rejection),	1
pub struct GuardianMcpToolCallReviewAction {	1
return Err(ExecPolicyError::ReadDir {	1
pub(super) use codex_protocol::approvals::GuardianAssessmentEvent;	1
params: ThreadApproveGuardianDeniedActionParams,	2
approval_policy: Some(AskForApproval::OnRequest),	1
decision: &ReviewDecision,	1
pub(super) use codex_app_server_protocol::ItemGuardianApprovalReviewStartedNotification;	1
entries: BTreeMap::from([("guardian_approval".to_string(), true)]),	1
} else if features.enabled(Feature::GuardianEnhancedNodeReplTranscripts) {	1
use super::approval_request::guardian_approval_request_to_json;	1
pub(crate) fn build_guardian_mcp_tool_review_request(	1
ExecPolicyAmendment,	1
status: codex_protocol::protocol::GuardianAssessmentStatus::Denied,	1
codex_app_server_protocol::AutoReviewDecisionSource::Agent => {	1
if routes_approval_policy_to_guardian(	1
return GuardianElicitationReview::NotRequested;	2
return ReviewDecision::denied(format!(	1
guardian_evidence.user_input_fragments(input.conversation_history.as_ref());	1
pub use codex_execpolicy::RequirementsExecPolicy;	1
default_exec_approval_requirement(approval_policy, &file_system_sandbox_policy)	1
ApprovalReviewer::for_policy(*approval_policy, *reviewer)	1
fn guardian_write_stdin_preserves_input_and_foreign_cwd(	1
let (value, value_truncated) = truncate_guardian_action_value(value);	2
"guardian MCP elicitation metadata must declare mcp_tool_call approval kind",	1
free_guardian: Some(true),	1
} => ReviewDecision::NetworkPolicyAmendment {	1
self.to_policy().map(RequirementsExecPolicy::new)	1
pub enum GuardianAssessmentOutcome {	1
pub fn ignore_user_and_project_exec_policy_rules(&self) -> bool {	1
let (GuardianReviewOutcome::Completed(second_assessment), second_metadata) = second_outcome	2
EventMsg::GuardianWarning(WarningEvent {	1
) -> ReviewDecision	1
fn from(value: CoreAskForApproval) -> Self {	1
// Emit the guardian policy prompt as a separate developer item so the guardian	1
use review::run_guardian_review_session_with_retry as run_guardian_review_session_for_test;	1
let (mut session, turn) = guardian_test_session_and_turn(&server).await;	1
if !crate::guardian::is_basic_session_source(&turn_context.session_source) {	2
AskForApproval::Granular(granular_config) => granular_config.sandbox_approval,	1
prefixes: exec_policy.get_allowed_prefixes().into_iter().collect(),	1
use crate::events::GuardianReviewTrackContext;	1
guardian_policy_config: Some("Use the managed guardian policy.".to_string()),	1
impl GuardianReviewAnalyticsResult {	1
approval_policy: Some(AskForApproval::Never),	1
} => crate::guardian::GuardianApprovalRequest::RequestPermissions {	1
inherit: exec_policy.inherit,	1
/// Whether this turn should route allowed approval prompts through the guardian	1
FeatureToml::Enabled(_) => GuardianV2ConfigToml::default(),	1
classifier_instructions: Some("Guardian classification".to_string()),	1
let policy = requirements.exec_policy.expect("exec policy").value;	1
assert!(routes_approval_to_guardian(&turn));	2
let exec_policy = self	1
codex_protocol::approvals::GuardianUserAuthorization::High	1
| GuardianAssessmentAction::RequestPermissions { .. } => None,	1
trusted_guardian_reviewer,	2
risk_level: GuardianRiskLevel::High,	1
"cmd-guardian-approved",	2
async fn guardian_review_session_config_preserves_context_overrides_for_same_effective_model() {	1
guardian_thread_id: result.guardian_thread_id,	1
pub fn effective_available_decisions(&self) -> Vec<ReviewDecision> {	1
inherited_exec_policy,	4
GuardianRejectionCircuitBreakerAction::Continue	3
serialize_guardian_action(CommandApprovalAction {	1
fn normalize_guardian_policy_config(value: Option<&str>) -> Option<String> {	1
ExecPolicyCommandOrigin::PowerShell => {	1
GuardianAssessmentAction::WriteStdin { .. } => {	1
GuardianAssessmentStatus::Aborted => (None, None, None),	1
fn from(value: CoreGuardianUserAuthorization) -> Self {	1
if guardian_config.persist_scores	1
use codex_app_server_protocol::GuardianApprovalReviewStatus;	1
/// Trusted user answers, verified skill paths, and completed Guardian reviews.	1
guardian_review_subject_metadata(&notification.action);	1
let transcript_entries = collect_guardian_transcript_entries(history.review_items());	1
pub(crate) fn render_guardian_transcript_entries(	1
pub struct GuardianV2ModelConfig {	1
guardian_statuses,	1
crate::guardian::guardian_timeout_message(	1
guardian_model_provider_id: result.guardian_model_provider_id,	1
GuardianAssessmentStatus::Approved => return,	1
| ReviewDecision::ApprovedMcpPolicyAmendment	1
struct GuardianReviewSession {	1
) || (current_approval == AskForApproval::OnRequest	1
result: GuardianReviewAnalyticsResult,	1
impl From<CoreGuardianAssessmentDecisionSource> for AutoReviewDecisionSource {	1
pub enum GuardianReviewFailureReason {	1
/// Final allow/deny outcome returned by the guardian reviewer.	1
| GuardianAssessmentAction::NetworkAccess { .. }	1
"codex_core__guardian__tests__network_access_guardian_prompt_layout",	1
GuardianTestCatalog::ParentOnly,	1
warn!(%error, review_id = event.id.as_str(), "failed to serialize approved Guardian action");	1
| GuardianAssessmentAction::ApplyPatch { .. }	1
pub guardian_review_model_overridden: bool,	1
impl ContextualUserFragment for GuardianTrustedToolFragment {	1
/// Runs the guardian in a locked-down reusable review session.	1
if is_mcp_tool_call && resolution.decision == ReviewDecision::ApprovedMcpPolicyAmendment {	1
pub(crate) approval_policy: Option<AskForApproval>,	1
CodexErr::InvalidRequest(format!("approval_policy is invalid: {err}"))	1
Some(AskForApproval::from(preset.approval)),	1
| GuardianReviewError::Session { .. }	1
fn guardian_assessment_action_round_trips_execve_shape() {	1
"Use the system guardian policy.".to_string(),	1
struct GuardianMemoryContextEnabled(bool);	1
AskForApproval::UnlessTrusted => true,	2
history_cell::new_guardian_denied_patch_request(files)	1
assert_eq!(guardian_approval_request_to_json(&action)?, expected);	1
ignore_user_and_project_exec_policy_rules: bool,	1
let transcript = guardian_config	1
guardian_model: Some(params.guardian_model),	1
Some(GuardianReviewSessionKind::TrunkReused) => "trunk_reused",	1
guardian_approval_enabled: self	1
.enabled(Feature::GuardianApproval)	3
fn guardian_assessment_aborted_emits_completed_review_payload() {	1
headers.insert("x-openai-subagent", HeaderValue::from_static("guardian"));	1
/// Optional policy instructions for the guardian auto-reviewer.	1
guardian_default_review_model_id: None,	1
config.permissions.approval_policy.value(),	1
let turn_context = |model: &str, approval_policy| {	1
impl From<ApprovalModeCliArg> for AskForApproval {	1
config.resolve_guardian_policy(destination.model_messages.as_ref());	1
use codex_app_server_protocol::AskForApproval;	16
.set_approval_policy(AskForApproval::OnRequest);	2
event_type: "codex_guardian_review",	1
let actual = config.permissions.approval_policy.value();	1
pub approval_policy: Option<CodexToolCallApprovalPolicy>,	1
let guardian_action_summary = |action: &GuardianAssessmentAction| match action {	1
fn reconstructs_declined_guardian_command_item() {	1
pub use guardian_v2::GuardianV2ModelConfig;	1
.guardian_root_snapshot()	1
id: Feature::GuardianNodeReplTranscriptImages,	1
export type { AskForApproval } from "./AskForApproval";	1
let approval = AskForApproval::from(preset.approval);	1
.check_with_options(command, exec_policy_fallback, match_options)	1
for value in ["user", "auto_review", "guardian_subagent"] {	1
.and_then(|features| features.get("guardianv2"))	2
pub enum GuardianApprovalReviewAction {	1
.set_permission_profile(guardian_permission_profile)	1
let (session, turn) = guardian_test_session_and_turn_with_base_url(server.uri()).await;	1
pub trigger: GuardianNetworkAccessTrigger,	1
pub(crate) environment_policy: Option<&'a RequirementsExecPolicy>,	1
&& !self.try_set_approval_policy_on_config(	1
/// The isolated developer policy provided to a Guardian reviewer.	1
return match approval_policy {	1
"invalid `approval_policy` config override: {err}"	1
pub(crate) approval_policy: String,	1
let review = Arc::new(GuardianReviewEvidenceRecord {	1
return Some(ReviewDecision::Approved);	1
GuardianApprovalReviewAction::ApplyPatch { cwd, files } => {	1
//! Both Guardian consumers receive the same role and tool-source attribution,	1
pub(crate) enum GuardianRejectionCircuitBreakerPolicy {	1
ReviewDecision::ApprovedForSession | ReviewDecision::ApprovedMcpPolicyAmendment	1
pub ignore_user_and_project_exec_policy_rules: bool,	1
sess.guardian_review_session.invalidate().await;	1
pub decision: Option<RequirementsExecPolicyDecisionToml>,	1
ReviewDecision::Denied { .. } => "denied",	1
let reuse_key = GuardianReviewSessionReuseKey::from_spawn_config(	1
let original_policy = app.config.permissions.approval_policy.value();	1
ReviewDecision::Abort => ReviewDecision::Approved,	1
GuardianAssessmentAction::Command { command, cwd, .. } => {	1
let target_item_id = guardian_request_target_item_id(&request).map(str::to_string);	1
requirements.guardian_policy_config_source.as_ref(),	1
pub outcome: Option<GuardianAssessmentOutcome>,	2
pub use exec_policy::format_exec_policy_error_with_source;	1
policy: Arc::clone(&exec_policy),	1
GuardianApprovalRequest::McpToolCall {	3
use crate::context::GuardianFollowupReviewReminder;	1
use crate::codex_thread::GuardianRootMessage;	2
GuardianAssessmentAction::WriteStdin { .. }	1
GuardianApprovalReviewAction::Command { .. }	1
let ignore_user_and_project_exec_policy_rules =	1
CoreReviewDecision::Denied { .. } => Self::Decline,	1
pub(crate) struct GuardianV2Config {	1
| ReviewDecision::TimedOut	1
// --config approval_policy	1
use codex_execpolicy::NetworkRuleProtocol as ExecPolicyNetworkRuleProtocol;	1
crate::exec_policy::UnmatchedCommandContext {	1
assert!(!guardian_config.features.enabled(Feature::Plugins));	1
let action = GuardianApprovalRequest::ApplyPatch {	3
pub guardian_default_review_model_id: Option<String>,	2
AskForApproval::OnRequest => None,	1
.enable(Feature::GuardianV2)	1
AskForApproval::Never => {	2
approval_policy: Some(config.permissions.approval_policy.value().into()),	1
ReviewDecision::ApprovedMcpPolicyAmendment	1
impl From<CoreGuardianUserAuthorization> for GuardianUserAuthorization {	1
guardian_model_info.model_messages.as_ref(),	1
codex_protocol::protocol::GuardianAssessmentStatus::Aborted => {	1
GuardianRejectionCircuitBreakerPolicy::Standard	1
GuardianReviewedAction::UnifiedExec { .. } => "unified_exec",	1
//! Guardian review decides whether an `on-request` approval should be granted	1
| ReviewDecision::Denied { .. }	2
..GuardianReviewAnalyticsResult::without_session()	1
collect_guardian_transcript_entries(&items)[2].kind,	1
panic!("expected first guardian assessment");	2
guardian_config.memories.use_memories = false;	1
GuardianReviewOutcome::Error(	1
"approval_policy",	1
| ReviewDecision::ApprovedForSession	1
parse_guardian_assessment(Some(r#"{"outcome":"deny"}"#)).expect("guardian assessment");	1
let root_authorization = parent.guardian_root_snapshot().await;	1
ResponsesEndpoint::GuardianClassifier	1
mod guardian_review_evidence;	1
ReviewDecision::denied("approval request failed"),	1
approval_policy: Some(auto_review.approval_policy),	2
self.config.permissions.approval_policy.value()	1
fn serialize_guardian_action(value: impl Serialize) -> serde_json::Result<Value> {	1
pub(crate) guardian_review_count: u64,	1
Some(codex_protocol::protocol::GuardianUserAuthorization::Low),	1
pub use codex_thread::GuardianAuthorizationVersion;	1
Some(codex_app_server_protocol::GuardianRiskLevel::High)	1
ev_completed("resp-guardian-2"),	2
/// Whether Guardian may use the unmetered Codex inference endpoints.	1
self.chat_widget.set_approval_policy(policy);	1
/// Returns the current user-authorization revision for Guardian.	1
use super::prompt::guardian_truncate_text;	1
ReviewDecision::NetworkPolicyAmendment {	3
session.approval_policy = settings.approval_policy;	1
guardian_review_model_override: None,	1
| GuardianApprovalRequest::ApplyPatch { id, .. }	1
config_warnings.push(exec_policy_config_warning(&err));	1
CoreReviewDecision::NetworkPolicyAmendment {	1
guardian_reasoning_effort: params.guardian_reasoning_effort,	1
build_without_headless_approval_policy().await	1
let required_policy = codex_protocol::protocol::AskForApproval::Never;	1
EventMsg::GuardianWarning(WarningEvent { message: warning }),	1
pub decision: ReviewDecision,	4
pub enum GuardianAssessmentDecisionSource {	1
pub(crate) approval_policy: AskForApproval,	4
use crate::guardian::routes_approval_to_guardian;	1
ItemGuardianApprovalReviewStarted => "item/autoApprovalReview/started" (v2::ItemGuardianApprovalReviewStartedNotification),	1
fn decision_tag(decision: GuardianReviewDecision) -> &'static str {	1
pub fn snapshot(&self) -> Vec<Arc<GuardianReviewEvidenceRecord>> {	1
if let Err(err) = guardian_session	1
ignore_user_and_project_exec_policy_rules: ignore_rules,	1
guardian_model: params.model.clone(),	1
approval_policy: AskForApproval,	16
GuardianApprovalRequest::ExecCommand {	1
ev_completed("resp-guardian-4"),	1
sub_agent_config.permissions.approval_policy = Constrained::allow_only(AskForApproval::Never);	1
codex_protocol::protocol::GuardianAssessmentStatus::InProgress => {	1
pub enum ExecPolicyUpdateError {	1
return ReviewDecision::denied(	1
.guardian_review_session	2
impl GuardianAuthorizationVersion {	1
let sync_reviews = guardian_evidence.snapshot();	1
.set(runtime_approval_policy)	1
/// `guardian_output_schema()`.	1
GuardianReviewedAction::WriteStdin { tty: *tty }	1
EventMsg::GuardianWarning(event) => warnings.push(event.message),	2
CoreGuardianAssessmentAction::ApplyPatch { cwd, files } => {	1
approval_policy = constrained_approval_policy.value();	1
Some(GuardianRootMessage::Assistant(	1
approval_policy, approvals_reviewer = _approval_mode_settings(approval_mode)	2
let mut omission_key = "_guardian_omitted_fields".to_owned();	1
PermissionProfileSnapshot::legacy(read_only_guardian_permission_profile(	1
async fn escalated_retry_bypasses_extension_approval_and_runs_guardian() -> anyhow::Result<()> {	1
use codex_protocol::protocol::GuardianAssessmentStatus;	1
mod guardian_node_repl_policy;	1
ReviewDecision::ApprovedMcpPolicyAmendment => {	1
use review::GuardianReviewOutcome;	1
use crate::protocol::v2::ItemGuardianApprovalReviewCompletedNotification;	1
GuardianReviewOutcome::Completed(assessment) => {	1
pub(crate) fn parse_guardian_assessment(text: Option<&str>) -> anyhow::Result<GuardianAssessment> {	1
GuardianReviewSessionOutcome::TimedOut => (	1
record_guardian_non_denial(&session, &assessment_turn_id).await;	2
/// must continue to preserve the guardian policy as exact top-level developer	1
return ExecPolicyCommands {	1
pub enum GuardianUserAuthorization {	2
struct GuardianMcpElicitationReviewer {	1
include_only: exec_policy	1
(AskForApproval::Granular(granular_config), DecisionSource::UnmatchedCommandFallback)	1
// Guardian prewarm can register lineage before parent client metadata is set.	1
use super::requirements_exec_policy::RequirementsExecPolicyToml;	1
/// Structured text evidence shared by sync Guardian and async scoring.	1
fn failure_reason(&self) -> GuardianReviewFailureReason {	1
inherited_exec_policy: None,	1
use crate::guardian::GuardianReviewSessionManager;	1
params.guardian_catalog_contains_auto_review,	1
use codex_core::format_exec_policy_error_with_source;	1
AskForApproval::Never => false,	1
_ = tokio::time::sleep_until(deadline) => Err(GuardianReviewSessionOutcome::TimedOut),	1
guardian_test_session_and_turn_with_base_url("http://localhost").await;	1
CoreGuardianCommandSource::Shell => Self::Shell,	1
format_exec_policy_error_with_source(&err)	1
pub use codex_protocol::protocol::AskForApproval;	1
input.thread_store.insert(guardian_config.clone());	1
Some(GuardianReviewFailureReason::PromptBuildError) => "prompt_build_error",	1
pub use crate::approvals::GuardianAssessmentAction;	1
assert!(!routes_approval_to_guardian_with_reviewer(	1
pub guardian_thread_id: Option<String>,	2
assert_eq!(payload.review.status, GuardianApprovalReviewStatus::Aborted);	1
// TurnMetadataState pins both node REPL flags. Guardian prompt/evidence	1
ApprovalDecisionActor::Guardian => vec![	1
telemetry_decision = ReviewDecision::denied("network approval was not applied");	1
pub(crate) struct GuardianTranscriptEntry {	1
codex_analytics::GuardianReviewAnalyticsResult,	1
Some(ThreadSource::Subagent | ThreadSource::GuardianReview)	1
GuardianAssessmentAction::Execve { program, argv, .. } => Some(if argv.is_empty() {	1
(Reviewer::Guardian, ReviewStatus::Approved, _) => FinalApprovalOutcome::GuardianApproved,	1
use crate::context::GuardianReviewEvidence;	5
CoreGuardianRiskLevel::Low => Self::Low,	1
return Some(ReviewDecision::Approved);	1
approval_policy: selection.approval_policy,	1
pub(crate) struct GuardianRejectionCircuitBreaker {	1
entries: Vec<PendingGuardianReviewStatusEntry>,	1
.unwrap_or(AskForApproval::Never),	1
inherited_exec_policy: Option<Arc<crate::exec_policy::ExecPolicyManager>>,	1
async fn inherited_exec_policy_for_source(	1
/// Keep this next to `guardian_output_contract_prompt()` so the prompt text and	1
.expect("guardian request should include a model")	1
fn approvals_reviewer_serializes_auto_review_and_accepts_legacy_guardian_subagent() {	1
pub review: GuardianApprovalReview,	2
AskForApproval::Granular(granular_config) => {	1
ReviewDecision::Approved	1
status: GuardianApprovalReviewStatus,	1
reuse_key: GuardianReviewSessionReuseKey,	2
pub(super) local: GuardianAuthorizationVersion,	1
catalog: GuardianTestCatalog,	1
pub async fn patch_approval(sess: &Arc<Session>, id: String, decision: ReviewDecision) {	1
model_override: guardian_review_model_override,	1
proposed_execpolicy_amendment: Option<ExecPolicyAmendment>,	4
| AskForApproval::Granular(_) => {}	1
struct GuardianRejectionCircuitBreakerTurn {	1
AskForApproval::OnRequest => CoreAskForApproval::OnRequest,	1
decision: ReviewDecision::denied("approval request failed"),	1
response: v2::ThreadApproveGuardianDeniedActionResponse,	1
ReviewDecision::ApprovedMcpPolicyAmendment	1
use super::approval_request::guardian_assessment_action;	1
pub(super) use codex_app_server_protocol::GuardianApprovalReviewAction as AppServerGuardianApprovalReviewAction;	1
fn emit_guardian_token_usage_histograms(	1
GuardianDenied,	1
} => history_cell::new_guardian_timed_out_action_request(format!(	1
let outcome = wait_for_guardian_review(	1
) -> (GuardianReviewSessionOutcome, bool, bool) {	1
fn clear_guardian_review_status(&mut self) {	1
Some(GuardianReviewSessionKind::EphemeralForked) => "ephemeral_forked",	1
"guardian MCP elicitation metadata must include a non-empty tool_name",	1
pub struct GuardianAuthorizationVersion {	1
// Guardian inherits only the current turn's ready environments. A retained	1
/// Creates a guardian extension with its host-owned internal-session spawner.	1
assert_eq!(fourth_assessment.outcome, GuardianAssessmentOutcome::Allow);	1
|| approval_policy.is_some()	1
guardian_timeout_message(&model),	1
/// Returns the role label currently used in Guardian transcript prompts.	1
pub(crate) enum ReviewDecision {	1
async fn apply_guardian_assessment_event(&self, assessment: GuardianAssessmentEvent) {	1
| ReviewDecision::NetworkPolicyAmendment { .. }) => {	1
.inherited_exec_policy_for_source(&state, Some(&session_source), &config)	1
"approval_policy": "on-failure",	1
guardian_model_provider_id: Some(params.guardian_model_provider_id),	1
return Err(RequirementsExecPolicyParseError::MissingDecision { rule_index });	1
allowed_approval_policies: Some(vec![AskForApproval::OnRequest.to_core()]),	1
use codex_analytics::GuardianReviewDecision;	2
pub transcript: Option<GuardianV2TranscriptConfigToml>,	1
guardian_policy_config: Some(	1
let GuardianReviewOptions {	1
.push(PendingGuardianReviewStatusEntry { id, detail });	1
approval_policy: session_configured.approval_policy.into(),	1
Some(GuardianReviewFailureReason::Cancelled) => "cancelled",	1
pub struct ExecPolicyCheckCommand {	1
fn guardian_mcp_request(server: &str, tool_name: &str) -> GuardianApprovalRequest {	1
approval_policy=approval_policy,	8
apply_exec_policy_network_rules(&mut spec.config, exec_policy);	1
requirements.guardian_policy_config.as_deref(),	1
CommandExecutionApprovalDecision::Cancel => ReviewDecision::Abort,	1
catalog_contains_auto_review: guardian_catalog_contains_auto_review,	1
return ExecPolicyCommands {	1
if guardian_approval_enabled {	1
impl ContextualUserFragment for GuardianNodeReplPolicy {	1
pub const GUARDIAN_REVIEW_TTFT_DURATION_METRIC: &str = "codex.guardian.review.ttft.duration_ms";	1
/// [`GuardianAssessmentAction::Command`] and [`GuardianAssessmentAction::Execve`].	1
approval_policy = turn_context.approval_policy(),	1
) -> Option<AskForApproval> {	1
pub(crate) fn guardian_truncate_text(content: &str, token_cap: usize) -> (String, bool) {	1
use crate::extensions::guardian_agent_spawner;	1
local: thread.guardian_authorization_version().await,	1
pub rules: Option<RequirementsExecPolicyToml>,	1
pub(crate) const GUARDIAN_REVIEWER_NAME: &str = "guardian";	1
GuardianReviewOutcome::Error(GuardianReviewError::Timeout),	1
fourth_metadata.guardian_session_kind,	1
let mut prompt_items = build_guardian_prompt_items_with_parent_turn(	1
Ok(GuardianReviewSessionConfig {	1
"declining Guardian MCP elicitation before review"	1
use super::approval_request::format_guardian_action_pretty;	2
GuardianReviewEventRequest {	1
id: Feature::GuardianReuseParentCompaction,	1
guardian_model.as_str(),	1
GuardianUserAuthorization::High => "high",	1
Ok(FormattedGuardianAction {	1
r#set: exec_policy.r#set,	1
guardian_config.model,	1
second_metadata.guardian_thread_id,	1
async fn guardian_review_session_config_uses_parent_active_model_instead_of_hardcoded_slug() {	1
guardian_v2: None,	8
pub use crate::approvals::ExecPolicyAmendment;	1
guardian_config.max_parent_compaction_tokens,	1
| ReviewDecision::ApprovedExecpolicyAmendment { .. }	2
CustomAnalyticsFact::GuardianReview(input) => {	1
use codex_app_server_protocol::ThreadApproveGuardianDeniedActionResponse;	2
Some(AskForApproval::OnRequest),	1
GuardianReviewTerminalStatus::Approved => "approved",	1
assert_eq!(session.approval_policy, primary_session.approval_policy);	1
(ReviewDecision::Abort, ApprovalResolutionSource::Guardian) => {	1
GuardianReviewedAction::Shell { .. } => "shell",	1
let completed_review = matches!(&outcome, GuardianReviewOutcome::Completed(_));	1
|| GuardianAuthorizationVersion::from_history(history.as_ref()),	1
async fn build_guardian_prompt_delta_mode_preserves_original_numbering() -> anyhow::Result<()> {	1
codex_protocol::approvals::GuardianRiskLevel::Low	1
store.put(key, ReviewDecision::ApprovedForSession);	1
(None, None) => Err(RequirementsExecPolicyParseError::InvalidPatternToken {	1
.apply_guardian_assessment_event(missing_target)	1
GuardianReviewOutcome::Error(GuardianReviewError::prompt_build(anyhow::anyhow!(	1
let exec_policy =	1
crate::GuardianV2TranscriptSource::Reasoning,	1
Some("parent or managed config should not replace guardian policy".to_string());	1
CoreExecPolicyAmendment::new(self.command)	1
.expect("committed guardian fork snapshot");	1
pub struct ThreadApproveGuardianDeniedActionParams {	1
approval_mode: AskForApproval::OnRequest,	2
pub struct GuardianCommandReviewAction {	1
pub use crate::approvals::GuardianAssessmentDecisionSource;	1
/// The fixed guardian policy lives in the review session developer message.	1
"cmp_guardian_parent_summary".to_string(),	1
GuardianReviewError::Timeout | GuardianReviewError::Cancelled => {	1
guardian_policy_config_source: Some(RequirementSource::LegacyManagedConfigTomlFromMdm),	1
approval_policy_override,	1
#[path = "exec_policy_tests.rs"]	1
"review-shell-guardian-1".to_string(),	1
use super::review_session::build_guardian_review_session_config;	1
pub approval_policy: Option<AskForApproval>,	13
Some(RequirementsExecPolicyDecisionToml::Allow) => {	1
trigger: Some(GuardianNetworkAccessTrigger {	2
key: "guardian_ext",	1
/// later approvals append onto that same guardian conversation to preserve a	1
FileChangeApprovalDecision::Decline => ReviewDecision::denied("rejected by user"),	1
pub(crate) enum GuardianPromptMode {	1
Use the cloud-managed guardian policy.	1
.or_else(|| plugin_attribution_for_guardian_request(turn.as_ref(), &request));	1
GuardianAssessmentAction::McpToolCall {	1
history_cell::new_guardian_timed_out_patch_request(files)	1
GuardianApprovalReviewStatus::Aborted	1
pub fn build_item_from_guardian_event(	1
/// Thread-local guardian state captured when the host starts a thread.	1
approval_policy: approval_policy.map(Into::into),	1
let parent_context = GuardianReviewContext::from(parent_turn);	1
approval_policy: Some(config.permissions.approval_policy.value().into()),	5
if crate::guardian::is_basic_session_source(&context.turn_context.session_source) {	1
pub(super) use codex_protocol::approvals::GuardianUserAuthorization;	1
!message.contains("guardian review completed without an assessment payload")	1
"review-shell-guardian-2".to_string(),	1
async fn build_guardian_prompt_delta_mode_handles_empty_delta() -> anyhow::Result<()> {	1
use super::commands_for_exec_policy;	1
} => plaintext_agent_message_content(content).map(|text| GuardianTranscriptEntry {	1
review_context: GuardianReviewContext::from(step_context),	1
pub struct GuardianReviewEvidence(Mutex<GuardianReviewEvidenceState>);	1
event: GuardianAssessmentEvent,	1
async fn guardian_test_session_and_turn(	1
ReviewDecision::denied("network approval was not applied")	1
self.record_fact(AnalyticsFact::Custom(CustomAnalyticsFact::GuardianReview(	1
GuardianReviewError::session(anyhow::anyhow!("guardian runtime failed"));	1
| AskForApproval::Granular(_) => Decision::Prompt,	1
CodexToolCallApprovalPolicy::Never => AskForApproval::Never,	1
pub(crate) async fn load_exec_policy_with_warning(	1
async fn guardian_command_execution_notifications_wrap_review_lifecycle() -> Result<()> {	1
GuardianApprovalReviewStatus::InProgress => None,	1
GuardianReviewAnalyticsResult::without_session(),	1
) -> Result<RequirementsExecPolicy, RequirementsExecPolicyParseError> {	1
GuardianReviewSessionKind::EphemeralForked,	1
const GUARDIAN_MEMORY_CONTEXT_PROBE: &str = "guardian memory context probe";	1
fn mcp_elicitation_response_from_guardian_decision(	1
GuardianReview,	2
GuardianRejectionCircuitBreakerPolicy::Standard => (	1
pub(crate) struct GuardianNetworkAccessTrigger {	1
self.runtime_approval_policy_override = None;	1
let guardian_review_model_override = model_override.map(str::to_string);	1
|| guardian_approval_id.clone(),	1
decision: ReviewDecision::denied(message),	1
(Instant::now() >= deadline).then_some(GuardianReviewError::Timeout)	1
let original_approval_policy = app.config.permissions.approval_policy.value();	1
.set(AskForApproval::OnRequest.to_core())	11
GuardianPromptMode::Full => GuardianPromptShape::Full,	1
Self::Guardian => "Auto-reviewer ",	1
GuardianApprovalReviewStatus::Approved => {	1
/// Include completed node_repl or cua_repl Code Mode response images in Guardian reviews.	1
input.thread_store.insert(GuardianV2Enabled);	1
other.guardian_policy_config = None;	1
&exec_policy_fallback,	1
"guardian_review" => Ok(ThreadSource::GuardianReview),	1
pub(crate) approval_policy: Constrained<AskForApproval>,	1
crate::guardian::GuardianApprovalRequest::McpToolCall {	1
pub(crate) struct GuardianNodeReplPolicy;	1
GuardianAssessmentAction::Execve { program, argv, .. } => {	1
AskForApproval::OnRequest | AskForApproval::Granular(_) => {	1
use codex_app_server_protocol::GuardianApprovalReviewStatus;	1
CoreReviewDecision::ApprovedExecpolicyAmendment {	1
if !permissions_preapproved && !matches!(approval_policy, AskForApproval::OnRequest) {	1
use codex_execpolicy::Error as ExecPolicyRuleError;	1
/*approval_policy*/ None,	1
pub(crate) async fn build_guardian_prompt_items_with_parent_turn(	1
assert_eq!(guardian_config.developer_instructions, None);	3
| ReviewDecision::Abort => {}	1
"guardian.memory_context_probe".to_string(),	1
Ok(GuardianReviewSession {	1
) -> Option<Arc<crate::exec_policy::ExecPolicyManager>> {	1
let runtime_approval_policy = config.permissions.approval_policy.value();	1
approval_policy: ConstrainedWithSource::new(	2
/// guardian developer prompt.	1
fn guardian_review_subject_metadata(	1
pub status: GuardianAssessmentStatus,	1
async fn review_guardian_mcp_elicitation(	1
codex_protocol::approvals::GuardianRiskLevel::Critical	1
pub enum GuardianApprovalReviewStatus {	1
reviewed_action: &GuardianReviewedAction,	3
} => history_cell::new_guardian_denied_action_request(format!(	1
&& current_approval == approval_policy	1
pub(crate) struct GuardianPolicy {	1
exec_policy: Arc<ExecPolicyManager>,	1
"guardian_reasoning_effort",	1
approval_mode: AskForApproval::OnRequest,	2
let rendered_images = guardian_config	1
self.config.permissions.approval_policy.value(),	1
seed_guardian_parent_history(&session, &turn).await;	1
use prompt::render_guardian_transcript_entries;	1
/*approval_policy*/ None,	1
EventMsg::GuardianAssessment(GuardianAssessmentEvent {	4
ReviewDecision::TimedOut => EscalationDecision::deny(Some(	1
|call| format!("{guardian_approval_id}#{}", call.registration_id),	1
} else if let Some(exec_policy) = &inherited_exec_policy {	1
| ReviewDecision::TimedOut => RequestPermissionsResponse {	1
guardian_model_provider_id: params.spawn_config.model_provider_id.clone(),	1
ApprovalDecisionActor::Guardian => {	1
AskForApproval::Granular {	1
ev_assistant_message("msg-parse-failure-2", "still not valid guardian json"),	1
AskForApproval::OnRequest => {	1
GuardianAssessmentAction::Execve {	1
use approval_request::guardian_request_turn_id;	1
format!("{prompt}\n\n{}\n", guardian_output_contract_prompt())	1
pub(crate) enum ConfigAskForApproval {	1
params: v2::ThreadApproveGuardianDeniedActionParams,	1
auto_review.approval_policy	3
AskForApproval::Granular(granular_config) => granular_config.allows_sandbox_approval(),	1
approval_policy,	4
Self::Guardian => "/guardian",	1
GuardianAssessmentStatus::Aborted,	1
pub use guardian_review_evidence::GuardianReviewEvidenceRecord;	1
authorization_version: GuardianAuthorizationVersion,	1
session.approval_policy,	1
.map_err(|source| ExecPolicyError::ParsePolicy {	1
ExecPolicyCommands {	1
pub available_decisions: Option<Vec<ReviewDecision>>,	1
#[error("approval_policy = \"untrusted\" is no longer supported; remove this setting")]	1
return (GuardianReviewSessionOutcome::TimedOut, keep_review_session, false);	1
fn guardian_output_contract_prompt() -> &'static str {	1
let notification = ServerNotification::GuardianWarning(GuardianWarningNotification {	2
fn format_guardian_action_pretty_reports_no_truncation_for_small_payload() -> serde_json::Result<()>	1
assert!(interactive.approval_policy.is_none());	1
let apply_patch = GuardianApprovalRequest::ApplyPatch {	1
.map_err(|_| ExecPolicyUpdateError::AddRule {	2
fn guardian_review_retry_only_retries_transient_session_and_parse_errors() {	1
guardian_evidence.authorization_version(input.conversation_history.as_ref());	1
render_guardian_transcript_entries_with_offset(	2
GuardianApprovalRequest::Execve { id, .. } => Some(id),	1
assert_eq!(payload.review_id, "review-cmd-guardian-denied");	2
crate::history_cell::ReviewDecision::TimedOut,	1
GuardianReviewFailureReason::SessionError	2
pub fn track_guardian_session_event(&self, thread_id: ThreadId, event: &Event) {	1
ReviewDecision::ApprovedForSession => {	1
Op::ApproveGuardianDeniedAction { event },	1
GuardianReviewOutcome::Error(GuardianReviewError::prompt_build(err)),	1
ItemGuardianApprovalReviewCompletedNotification {	1
/// designed to use [AskForApproval::Never] exclusively.	1
&[("Guardian Review Request", &request)],	1
.expect("guardian v2 feature is configurable");	1
/// Whether an exact approval policy and reviewer should route through Guardian.	1
impl ContextualUserFragment for GuardianPolicy {	1
use codex_protocol::approvals::ExecPolicyAmendment;	5
.approval_policy	15
transcript: Some(crate::GuardianV2TranscriptConfigToml {	1
let approval = AskForApproval::from(preset.approval);	1
pub(crate) use config::GuardianV2Config;	1
if let Some(policy) = approval_policy	1
CoreGuardianAssessmentAction::NetworkAccess {	1
Some(GuardianRiskLevel::Critical) => "critical",	1
GuardianReviewError::Timeout => {	1
.unwrap_or(AutoReviewDecisionSource::Agent),	1
collect_guardian_transcript_entries(&items),	2
id: "shell-guardian-1".to_string(),	1
let guardian_policy_config =	1
assert!(fourth_body.to_string().contains("third guardian rationale"));	1
requested_network_access: guardian_review_requested_network_access(	1
include_str!("../templates/permissions/approval_policy/never.md");	1
ConstraintError::ExecPolicyParse {	1
approval_fields = {"approval_policy", "approvals_reviewer"}	1
let fragment = guardian_truncate_text(&user_input, MAX_GUARDIAN_USER_INPUT_TOKENS).0;	1
pub(crate) fn new(exec_policy: &Policy) -> Self {	1
GuardianAuthorizationVersion {	1
) -> serde_json::Result<FormattedGuardianAction> {	1
.and_then(|messages| messages.guardian_v2.as_ref());	1
disabled_reason: self.permission_mode_disabled_reason(preset, approval_policy),	1
approval_policy: approval_policy.into(),	1
impl<S> ThreadLifecycleContributor<Config> for GuardianExtension<S>	2
// Model and reasoning inputs are carried for the follow-up Guardian and V2 migrations.	1
let items = vec![ContextualUserFragment::into(GuardianApprovedAction::new(	1
/// Guardian extension dependencies supplied by the host at construction time.	2
/// waits. Only `node_repl`/`cua_repl` receive them; Guardian sessions are excluded.	1
action: &GuardianApprovalReviewAction,	1
impl ThreadLifecycleContributor<Config> for GuardianV2Extension {	1
GuardianAssessmentStatus::TimedOut => {	1
.guardian_rejection_circuit_breaker	2
fn from(value: CoreGuardianAssessmentDecisionSource) -> Self {	1
let approval = status_approval_label(approval_policy, config.approvals_reviewer, &approval);	1
pub(crate) fn guardian_assessment_action(	1
) -> serde_json::Result<GuardianPromptItems> {	2
guardian_session_kind,	2
trigger: Option<GuardianNetworkAccessTrigger>,	2
pub(super) enum GuardianReviewOutcome {	1
let mut decisions = vec![ReviewDecision::Approved];	1
.get::<GuardianV2Config>()	1
let notification = GuardianWarningNotification {	1
pub(crate) command_origin: ExecPolicyCommandOrigin,	1
.map_or(GuardianPromptMode::Full, |cursor| {	1
#[schemars(with = "Option<crate::schema::ConfigAskForApproval>")]	2
"""approval_policy = "never"	1
update.approval_mode = Some(settings.approval_policy);	1
thread_source: Some(ThreadSource::GuardianReview),	1
status: GuardianApprovalReviewStatus::Aborted,	1
use crate::guardian::guardian_truncate_text;	3
use prompt::GuardianTranscriptEntry;	1
&& constraints.guardian_approval_enabled	1
pub fn resolve_guardian_policy<'a>(	1
reuse_key: GuardianReviewSessionReuseKey,	1
let guardian_request = trusted_guardian_request.unwrap_or(*guardian_request);	1
) -> Option<oneshot::Sender<ReviewDecision>> {	2
fn config_requirements_granular_allowed_approval_policy_is_marked_experimental() {	1
guardian_exec_command_request("shell-session-retry"),	1
ReviewDecision::NetworkPolicyAmendment {	1
ignore_user_and_project_exec_policy_rules: self	2
/// evidence for guardian review and skips synthetic contextual scaffolding that	1
let review_session = spawn_guardian_review_session(	1
guardian_request_turn_id(&action, "current-turn"),	1
} => GuardianAssessmentAction::RequestPermissions {	1
assert_eq!(features.guardianv2, Some(FeatureToml::Enabled(true)));	1
} => crate::guardian::GuardianApprovalRequest::WriteStdin {	1
auto_review_preset.approval_policy,	1
&& !loader_overrides.ignore_user_and_project_exec_policy_rules	1
| ServerNotification::ItemGuardianApprovalReviewCompleted(_)	1
kind: GuardianTranscriptEntryKind::User,	3
let cell = if let Some(command) = guardian_command(&ev.action) {	1
} => crate::guardian::GuardianApprovalRequest::ApplyPatch {	1
&& constrained_approval_policy.value() == AskForApproval::Never	1
"guardian_policy_config",	1
pub struct GuardianWarningNotification {	1
codex_app_server_protocol::GuardianRiskLevel::Low => {	1
GuardianReuseParentCompaction,	1
AskForApproval::from(read_only.approval),	1
GuardianReviewAnalyticsResult {	3
guardian_test_session_and_turn_with_base_url(server.uri().as_str()).await	1
async fn build_guardian_prompt_stale_delta_version_falls_back_to_full_prompt() -> anyhow::Result<()>	1
pub(super) root: Option<GuardianAuthorizationVersion>,	1
| GuardianReviewError::Parse { message } => message,	1
pub use events::GuardianReviewDecision;	1
assert!(matches!(features.guardianv2, Some(FeatureToml::Config(_))));	2
free_guardian: input.config.free_guardian_enabled(),	1
self.chat_widget.set_approval_policy(AskForApproval::from(config.permissions.approval_policy.value()));	1
impl GuardianReviewSessionManager {	1
struct GuardianReviewForkSnapshot {	1
circuit_breaker.record_denial("turn-1", GuardianRejectionCircuitBreakerPolicy::Standard),	10
analytics_result.guardian_review_model_overridden,	3
requirements.approval_policy.can_set(&AskForApproval::Never),	2
/// Host-supplied Guardian reviews isolated from untrusted transcript entries.	1
self.thread_context_or_warn(AnalyticsDropSite::guardian(&input))	1
/// Enables screenshot capture even when synchronous Guardian transcripts are disabled.	1
GuardianAssessmentAction::RequestPermissions { reason, .. } => {	1
use codex_protocol::approvals::GuardianRiskLevel;	1
assert!(routes_approval_to_guardian_with_reviewer(	1
async fn routes_approval_to_guardian_requires_guardian_reviewer() {	1
// Private reviewers have no app-server listener; publicly resumed Guardian threads do.	1
if is_guardian_reviewer {	1
ContentItemKind("guardian.review_evidence".to_string())	1
ServerNotification::ItemGuardianApprovalReviewStarted(payload) => {	4
annotations: Option<GuardianMcpAnnotations>,	1
impl Eq for RequirementsExecPolicy {}	1
use crate::async_scorer::GuardianV2Config;	1
GuardianCommandSource::UnifiedExec => "exec_command",	1
if !self.try_set_approval_policy_on_config(	2
GuardianApprovalRequest::NetworkAccess {	3
