Make cloud_requirements fail close

[alexsong-oai]

Make it fail-close only for CLI for now
Will extend this for app-server later

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/app-server/src/lib.rs

Lines 417 to 421 in cb831b9

	Err(err) => {
	let message = config_warning_from_error("Invalid configuration; using defaults.", &err);
	config_warnings.push(message);
	Config::load_default_with_cli_overrides(cli_kv_overrides.clone()).map_err(|e| {
	std::io::Error::new(

Treat cloud requirement load failures as fatal

ConfigBuilder::build() now returns an error when cloud requirements cannot be fetched, but this branch catches all build errors and silently falls back to Config::load_default_with_cli_overrides(), which uses CloudRequirementsLoader::default() (Ok(None)). In app-server, a transient cloud-requirements outage for Business/Enterprise can therefore start with no enforced constraints, contradicting fail-closed behavior.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alexsong-oai]

💡 Codex Review

codex/codex-rs/app-server/src/lib.rs

Lines 417 to 421 in cb831b9

	Err(err) => {
	let message = config_warning_from_error("Invalid configuration; using defaults.", &err);
	config_warnings.push(message);
	Config::load_default_with_cli_overrides(cli_kv_overrides.clone()).map_err(|e| {
	std::io::Error::new(

Treat cloud requirement load failures as fatal
ConfigBuilder::build() now returns an error when cloud requirements cannot be fetched, but this branch catches all build errors and silently falls back to Config::load_default_with_cli_overrides(), which uses CloudRequirementsLoader::default() (Ok(None)). In app-server, a transient cloud-requirements outage for Business/Enterprise can therefore start with no enforced constraints, contradicting fail-closed behavior.

ℹ️ About Codex in GitHub

Will support the fail-close for App afterwards

[xl-openai]

Today do we check if it is a ChatGPT Business and Enterprise accounts? If not we should, if so we could change the error message to something more speicfic/meaningful, like:

"Failed to load your workspace-managed config".

[alexsong-oai]

Yes, we only fetch for ChatGPT Business and Enterprise accounts