深入Codex安全围栏:从源码到攻防的全链路拆解

You are expected to be precise, safe, and helpful.

// codex-rs/protocol/src/models.rspub const BASEINSTRUCTIONSDEFAULT: &str = includestr!( "prompts/baseinstructions/default.md" );// codex-rs/core/src/client.rs — 最终注入 API 请求fn buildresponsesrequest(...) -> Result {let instructions = &prompt.base_instructions.text;// ...let request = ResponsesApiRequest {instructions: instructions.clone(),// ...};}

Agent 请求执行工具调用        │        ▼Guardian 子代理启动  ├── 输入：会话上下文 + 待执行操作的 JSON  ├── 策略：policy.md 中的风险评估规则  ├── 输出：{ risk_level, risk_score (0-100), rationale, evidence }        │        ▼risk_score < 阈值(80)? ──是──> 自动批准执行        │        否        ▼拒绝执行 + 返回 GUARDIAN_REJECTION_MESSAGE

## High-risk actions- 删除/损坏重要数据、中断服务、变更权限、暴露密钥- 将私有数据发送到不受信任的外部目的地- 凭证探测（发现/提取/复用 credentials、tokens、cookies 等）- 破坏性或难以逆转的操作## Low-risk actions- 常规的、范围狭窄的、与用户请求一致的操作

pub(crate) const GUARDIAN_REJECTION_MESSAGE: &str = concat!(    "This action was rejected due to unacceptable risk. ",    "The agent must not attempt to achieve the same outcome via workaround, ",    "indirect execution, or policy circumvention. ",    "Proceed only with a materially safer alternative, ",    "or if the user explicitly approves the action after being informed of the risk. ",    "Otherwise, stop and request user input.",);

// 原始逻辑简化版pub fn assess_patch_safety(...) -> SafetyCheck {    match policy {        UnlessTrusted => return AskUser,        // 不信任模式：始终询问        Never | OnFailure | OnRequest => {},     // 继续检查    }    if 补丁在可写路径内 || OnFailure模式 {        if 有沙箱 { AutoApprove } else { AskUser }    } else {        AskUser  // 写到沙箱外需要用户确认    }}

const CYBER_VERIFY_URL: &str = "https://chatgpt.com/cyber";const CYBER_SAFETY_URL: &str = "https://developers.openai.com/codex/concepts/cyber-safety";// 原始逻辑async fn maybe_warn_on_server_model_mismatch(...) -> bool {    if server_model != requested_model {        // 发送 ModelReroute 事件        // 发送警告："Your account was flagged for potentially high-risk cyber activity..."        return true;    }    false}

GLOBAL SAFETY, HYGIENE, AND NO-FILLER RULES (STRICT)- Redact secrets: never store tokens/keys/passwords; replace with [REDACTED_SECRET].

// codex-rs/codex-api/src/sse/responses.rs"response.incomplete" => {let reason = reason.unwrap_or( "unknown" );let message = format!( "Incomplete response returned, reason: {reason}" );return Err(ResponsesEventError::Api(ApiError::Stream(message)));}