feat(hooks): add managed hooks#15937
Open
viyatb-oai wants to merge 7 commits intocodex/viyatb/hooks-trust-precedencefrom
Open
feat(hooks): add managed hooks#15937viyatb-oai wants to merge 7 commits intocodex/viyatb/hooks-trust-precedencefrom
viyatb-oai wants to merge 7 commits intocodex/viyatb/hooks-trust-precedencefrom
Conversation
viyatb-oai
changed the title
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
f29a621 to
a16d990
Compare
viyatb-oai
changed the base branch from
main
to
codex/viyatb/hooks-trust-precedence
Contributor
|
Thanks for this, looks very directionally correct and spec adherent -- will review again later when you think it's out of draft mode |
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
9401e5f to
f0f222a
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
a16d990 to
6c5ea83
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
f0f222a to
456697a
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
6c5ea83 to
b7976a4
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
456697a to
c564cda
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
b7976a4 to
4f8689d
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
c564cda to
647f61a
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
4f8689d to
36587f3
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
647f61a to
c22dec5
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
2 times, most recently
from
1a06341 to
85609af
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
15872f2 to
6b3ef89
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
85609af to
e00bbff
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
6b3ef89 to
d22f07a
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
e00bbff to
b7f9332
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hooks-trust-precedence
branch
from
d22f07a to
8110afa
Compare
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
2 times, most recently
from
50ae0cd to
513683c
Compare
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <noreply@openai.com>
viyatb-oai
force-pushed
the
codex/viyatb/hook-safety-controls
branch
from
513683c to
5ab034b
Compare
Co-authored-by: Codex noreply@openai.com
…ai/codex into codex/viyatb/pr15937-p3
…ai/codex into codex/viyatb/pr15937-p3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a managed-policy control for lifecycle hooks and surfaces a startup warning when hooks are loaded.
Changes
allow_managed_hooks_only/allowManagedHooksOnlyto config requirements and app-server protocol surfaces.requirements.toml, MDM-managedrequirements_toml_base64, and cloud requirements; legacymanaged_config.tomlremains limited toapproval_policyandsandbox_mode.hooks.jsonfiles when the managed-only requirement is enabled.hooks.jsonfiles.docs/config.md.Why
Hooks are privileged by design and run outside the sandbox. This makes that behavior explicit at startup and gives admins a lockdown option that still allows managed hooks.