Repository navigation

feat: managed policy for organization-wide T3 Code configuration - #27197

Merged

juliusmarminge merged 54 commits into

mainfrom

t3/managed-policy

Nov 1, 2026

Merged

feat: managed policy for organization-wide T3 Code configuration#27197
juliusmarminge merged 54 commits into
mainfrom
t3/managed-policy

Commits on Oct 29, 2026
- feat(server): administrators can manage settings with a policy file
  
  juliusmarminge
  and
  claude
  committed
  ec8a788
- feat(server): `t3 policy show` and `t3 policy check` explain the managed policy
  
  juliusmarminge
  and
  claude
  committed
  ef061cd
- feat(web,mobile): settings an administrator locks say who manages them
  
  juliusmarminge
  and
  claude
  committed
  a4b437d
- docs: explain managed policy for administrators
  
  juliusmarminge
  and
  claude
  committed
  dc62cea
- feat(server): a managed policy can cap the runtime mode of every thread
  
  juliusmarminge
  and
  claude
  committed
  75acda2
- feat(server): managed policy can limit clients and turn off T3 Connect
  
  juliusmarminge
  and
  claude
  committed
  ca81520
- feat(server): policy can turn off webhook tasks, telemetry, and cookie import
  
  juliusmarminge
  and
  claude
  committed
  e45f09f
- feat(server): policy can restrict provider drivers and pin their instances
  
  juliusmarminge
  and
  claude
  committed
  4849bf0
- feat(policy): administrators can control how T3 Code updates
  
  juliusmarminge
  and
  claude
  committed
  9170f46
- refactor(contracts): one set of managed-policy refusal messages for every surface
  
  juliusmarminge
  and
  claude
  committed
  2577c43
- docs: describe every managed-policy limit for administrators
  
  juliusmarminge
  and
  claude
  committed
  d8d97a3
- feat(web): shared pieces for explaining what a managed policy turns off
  
  juliusmarminge
  and
  claude
  committed
  66c2971
- feat(web): pairing and T3 Connect say when a managed policy turns them off
  
  juliusmarminge
  and
  claude
  committed
  6609aac
- feat(web): permission modes above a managed ceiling are unavailable
  
  juliusmarminge
  and
  claude
  committed
  62c7e75
- feat(web): provider settings follow the managed policy's driver limits
  
  juliusmarminge
  and
  claude
  committed
  7f5a84b
- feat(web): webhook tasks and cookie import follow the managed policy
  
  juliusmarminge
  and
  claude
  committed
  a59f487
- feat(web): updates, usage data, and About reflect the managed policy
  
  juliusmarminge
  and
  claude
  committed
  df4beeb
- feat(mobile): runtime modes above a managed ceiling are unavailable
  
  juliusmarminge
  and
  claude
  committed
  5b8e958
- feat(mobile): model pickers leave out providers a managed policy disallows
  
  juliusmarminge
  and
  claude
  committed
  6234327
- feat(mobile): locked server settings are disabled and say who manages them
  
  juliusmarminge
  and
  claude
  committed
  1939f7d
- feat(mobile): scheduled tasks respect a policy that turns off webhook tasks
  
  juliusmarminge
  and
  claude
  committed
  15a660d
- feat(mobile): environment details say who manages them and their updates
  
  juliusmarminge
  and
  claude
  committed
  1483589
- fix(mobile): agent activity updates skip environments whose policy turns off Connect
  
  juliusmarminge
  and
  claude
  committed
  e5c8529
- test(mobile): server controls test mocks the managed runtime mode helper
  
  juliusmarminge
  and
  claude
  committed
  1d010de
- feat(web): agent sign-in disables access levels above a managed ceiling
  
  juliusmarminge
  and
  claude
  committed
  4826a71
- fix(server): a runtime mode ceiling makes provider launch settings the administrator's
  
  juliusmarminge
  and
  claude
  committed
  0f6d4cb
- fix(server): turns above the policy ceiling never start, and ACP mode picks stay under it
  
  juliusmarminge
  and
  claude
  committed
  84bd92a
- fix(server): imported agent sessions stay under the policy's runtime mode ceiling
  
  juliusmarminge
  and
  claude
  committed
  bbcd291
- fix(server): saving a scheduled task above the policy ceiling is refused
  
  juliusmarminge
  and
  claude
  committed
  901e633
- fix(server): enabling a disallowed provider for one project is refused
  
  juliusmarminge
  and
  claude
  committed
  04b6a55
- refactor(contracts): drop the manual updates mode from managed policy
  
  juliusmarminge
  and
  claude
  committed
  80548d1
- fix(server,desktop): a policy with telemetry off also stops relay tracing to T3 Connect
  
  juliusmarminge
  and
  claude
  committed
  23686f2
- fix(web): the provider environment editor locks entirely under a managed ceiling
  
  juliusmarminge
  and
  claude
  committed
  c3ca1fd
- docs: say what a managed runtime-mode ceiling takes over from users
  
  juliusmarminge
  and
  claude
  committed
  77db192
- chore: drop managed policy exports nothing imports
  
  juliusmarminge
  and
  claude
  committed
  090d45d
- Merge remote-tracking branch 'origin/main' into t3/managed-policy
  juliusmarminge
  committed
  ed79e82
- fix: address managed policy review findings
  
  juliusmarminge
  and
  claude
  committed
  3ec9150
- fix: managed policy writes accept what clients echo back
  
  juliusmarminge
  and
  claude
  committed
  7b331ae
- fix: more managed policy review findings
  
  juliusmarminge
  and
  claude
  committed
  b8da077
- fix(server): a policy-owned Codex pin cannot be bypassed by managed setup
  
  juliusmarminge
  and
  claude
  committed
  792ef26
- fix(desktop,web): only a policy-only nightly block lets the app switch itself to Stable
  
  juliusmarminge
  and
  claude
  committed
  b819b7c
- fix(web): an enabled provider the policy leaves out can still be switched off
  
  juliusmarminge
  and
  claude
  committed
  2c2e755
- feat: read managed policy from macOS profiles and the Windows registry
  
  juliusmarminge
  and
  claude
  committed
  e172afe
- fix(shared): a failed registry query is not read as no policy
  
  juliusmarminge
  and
  claude
  committed
  ad456b7
Commits on Oct 30, 2026
- fix(shared): read a macOS profile whether or not its keys sit under Forced
  
  juliusmarminge
  and
  claude
  committed
  55928ca
- fix(shared): a macOS profile with keys beside its Forced wrapper is refused
  
  juliusmarminge
  and
  claude
  committed
  f866f9e
- docs: bring the managed policy guide up to date
  
  juliusmarminge
  and
  claude
  committed
  daf1c89
- fix: read macOS profiles despite the keys macOS adds
  
  MatthewFeroz
  authored and
  juliusmarminge
  committed
  4d0eef2
- fix(shared): an invalid policy names the key that is wrong
  
  juliusmarminge
  and
  claude
  committed
  401e880
- docs: make the managed policy guide a rollout an admin can follow (#27410)
  MatthewFeroz
  authored
  7a51ded
Commits on Oct 31, 2026
- fix(policy): close managed policy bypasses and stuck states before release (#27322)
  
  t3dotgg
  and
  claude
  authored
  d86ca50
- fix(policy): local-only binds, scoped Serve cleanup, Windows registry reads, and rollout checks (#28000)
  
  authored
  3da15ea
Commits on Nov 1, 2026
- Merge remote-tracking branch 'origin/main' into t3/managed-policy
  juliusmarminge
  committed
  3dd5887
- fix(policy): refuse credentials in a policy and keep locked rows editable where needed
  
  juliusmarminge
  and
  claude
  committed
  ee73a65

Commits

Commits on Oct 29, 2026

Commits on Oct 30, 2026

Commits on Oct 31, 2026

Commits on Nov 1, 2026