🤖 fix: allow read-only admin policy in the VS Code webview, redacting gateway URLs

[ThomasK33]

Summary

The VS Code webview's model list now follows the admin policy (#4739). policy.get and policy.onChanged are added to the webview's oRPC allowlist. The extension host strips each provider's forcedBaseUrl from policy.get before the result reaches the webview.

Background

The webview mounts PolicyProvider (since #4740), but the bridge rejected policy.*, so the provider fell back to "no policy". The composer's model dropdown therefore offered models the admin had disallowed; it lists every suggested model when the providers config is not loaded. The backend still rejected those sends (policy_denied), so this was a UI mismatch, not a bypass.

Security: what this adds (the webview is treated as less trusted than the extension host)

Allowlist paths added: policy.get and policy.onChanged. Nothing else under policy is allowed; a test covers this.

What they return (PolicyGetResponseSchema): source (none, env or governor), status{state, reason?}, and policy{policyFormatVersion, serverVersion?, minimumClientVersion?, providerAccess[{id, allowedModels, forcedBaseUrl?}], mcp.allowUserDefined{stdio, remote}, runtimes}. onChanged yields empty change signals only. Both read a cached in-memory snapshot, with no side effects.

Redactor (redactWebviewOrpcResult in vscode/src/orpcAllowlist.ts, applied in the host's handleOrpcCall to non-stream results):

• For policy.get it removes forcedBaseUrl from every providerAccess entry. It is an internal gateway URL that could embed credentials, and no browser code reads it; the only other reference is a Storybook story.
• It returns a copy and leaves every other result unchanged.

What remains visible: provider IDs, allowed model lists, runtime and MCP flags, and the status reason. That is admin configuration with no secrets, and it only keeps the webview's model list consistent with what the backend already enforces.

Not exercised end to end: the redactor runs in the extension host, and I had no VS Code host to run it in. It is a pure function covered by unit tests, and its wiring into handleOrpcCall is covered by typecheck. The served-bundle harness below plays the host's side.

Validation

• Tests written first in vscode/src/orpcAllowlist.test.ts:
  • policy.get and policy.onChanged are allowed; policy.refresh is not.
  • The redactor strips forcedBaseUrl, including a credential-bearing URL, keeps all other fields, and does not mutate its input.
  • A policy-less response and other procedures pass through unchanged.
• Before the fix: the test file failed to load because redactWebviewOrpcResult did not exist, and both policy paths returned false from isAllowedOrpcPath.
• bun test ./vscode/src/ passes, 39/39; make static-check passes.
• I did not add an App-level test for the filtered list: in the unit harness the test plays the host and would answer policy.get itself, so it would pass without this change. The served-bundle check below shows the behavior instead.

Pre-fix output

SyntaxError: Export named 'redactWebviewOrpcResult' not found in module '/home/coder/.mux/src/mux/workspace-5/vscode/src/orpcAllowlist.ts'.
 0 pass
 1 fail
pre-fix isAllowedOrpcPath([policy,get]) = false [policy,onChanged] = false

Dogfood: served bundle

The harness stands in for the host. It answers policy.get with an enforced policy that allows only Anthropic claude-opus-5-5 and claude-sonnet-5, already redacted. The webview requests both paths:

post {"type":"orpcCall","requestId":"4ebbcf2d-79de-4231-b696-dd8ad91bb7a3","path":["policy","get"]}
post {"type":"orpcCall","requestId":"92b610de-99f8-4600-8ac4-86248da0518f","path":["policy","onChanged"]}

Model dropdown before this change, on main, 800px (every suggested model):

With the policy applied, 800px (only Opus 5.5 and Sonnet 5):

With the policy applied, 390px:

The console showed 0 errors.

Risks

Low. Two read-only procedures are added, and the one URL field is redacted. If a future policy field is sensitive, the redactor must be extended; the comments at the allowlist entry and in the redactor point there.

Fixes #4739

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $43.37

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T01:43:55.027734Z	2705275	PR opened
🔒 Security Review	✅ Completed 2026-09-27T01:42:56.874509Z	2705275	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27052754d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".