feat: add Codex permission env fallback#802
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR adds server-side environment-driven fallback for Codex permission modes. New helpers validate ChangesCodex Permission Mode Environment Configuration
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
server/openai-codex.js (1)
203-203: 💤 Low valueInclude the invalid value in warning messages for easier debugging.
When operators misconfigure the environment variable or clients send invalid modes, the current warnings don't reveal what value was received. Including the offending value helps diagnose issues faster.
🔧 Proposed improvement
- console.warn(`[Codex] Invalid ${CODEX_PERMISSION_MODE_ENV}; falling back to default`); + console.warn(`[Codex] Invalid ${CODEX_PERMISSION_MODE_ENV}="${normalizedPermissionMode}"; falling back to default`);And for the request validation:
- console.warn('[Codex] Invalid request permission mode; falling back to default'); + console.warn(`[Codex] Invalid request permission mode="${normalizedPermissionMode}"; falling back to default`);Also applies to: 217-217
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/openai-codex.js` at line 203, Update the warning log calls so they include the actual invalid value received: where console.warn(`[Codex] Invalid ${CODEX_PERMISSION_MODE_ENV}; falling back to default`) is used, append the runtime value (e.g. the env value or the variable being validated) into the message so it reads something like "Invalid X: <value>; falling back to default". Do the same for the other warning at the request validation site (the other console.warn around line 217) so both console.warn calls include the offending value for easier debugging; locate the console.warn calls and the VARIABLE/identifier used to validate (CODEX_PERMISSION_MODE_ENV or the runtime variable holding the mode) and interpolate it into the message.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 155-162: Expand the "Codex Permission Defaults" section to
document the behavior of each mode (default, acceptEdits, bypassPermissions) so
operators can choose appropriately: describe what "default" enforces (strict
permission checks requiring explicit approval or admin-controlled decisions),
what "acceptEdits" permits (automatic acceptance of non-sensitive
client-suggested edits or a reduced-approval workflow), and clarify
"bypassPermissions" (full access with no approval, already mentioned); reference
the server-side env var CLOUDCLI_CODEX_PERMISSION_MODE and show an example usage
of setting it to each value so readers can test configurations.
---
Nitpick comments:
In `@server/openai-codex.js`:
- Line 203: Update the warning log calls so they include the actual invalid
value received: where console.warn(`[Codex] Invalid
${CODEX_PERMISSION_MODE_ENV}; falling back to default`) is used, append the
runtime value (e.g. the env value or the variable being validated) into the
message so it reads something like "Invalid X: <value>; falling back to
default". Do the same for the other warning at the request validation site (the
other console.warn around line 217) so both console.warn calls include the
offending value for easier debugging; locate the console.warn calls and the
VARIABLE/identifier used to validate (CODEX_PERMISSION_MODE_ENV or the runtime
variable holding the mode) and interpolate it into the message.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: de4756ba-7f68-4d67-9e0c-d6a7adf00c7a
📒 Files selected for processing (2)
README.mdserver/openai-codex.js
|
Hey @CoderLuii, thanks for the PR. Can u resolve the merge conflict and I'll review it. |
2 participants
Summary
CLOUDCLI_CODEX_PERMISSION_MODEas a server-side fallback for Codex chat requests that do not includepermissionMode.default,acceptEdits, andbypassPermissions.bypassPermissions.Why
Self-hosted and containerized CloudCLI deployments sometimes need a process-level Codex permission default for clients that do not send
permissionMode. This keeps upstream defaults unchanged (default) while allowing trusted deployments to opt intoacceptEditsorbypassPermissionsexplicitly.Testing
node --check server/openai-codex.jsgit diff --checkSummary by CodeRabbit
Documentation
New Features