tui: show non-file layer content in /debug-config (#11412)

The debug output listed non-file-backed layers such as session flags and
MDM managed config, but it did not show their values. That made it
difficult to explain unexpected effective settings because users could
not inspect those layers on disk.

Now `/debug-config` might include output like this:

```
Config layer stack (lowest precedence first):
  1. system (/etc/codex/config.toml) (enabled)
  2. user (/Users/mbolin/.codex/config.toml) (enabled)
  3. legacy managed_config.toml (mdm) (enabled)
     MDM value:
       # Production Codex configuration file.

       [otel]
       log_user_prompt = true
       environment = "prod"
       exporter = { otlp-http = {
         endpoint = "https://example.com/otel",
         protocol = "binary"
       }}
```

Author: bolinfest

codex-rs/core/src/config_loader/layer_io.rs

@@ -2,6 +2,8 @@ use super::LoaderOverrides;
 use super::diagnostics::config_error_from_toml;
 use super::diagnostics::io_error_from_config_error;
 #[cfg(target_os = "macos")]
+use super::macos::ManagedAdminConfigLayer;
+#[cfg(target_os = "macos")]
 use super::macos::load_managed_admin_config_layer;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use std::io;
@@ -19,12 +21,18 @@ pub(super) struct MangedConfigFromFile {
     pub file: AbsolutePathBuf,
 }
 
+#[derive(Debug, Clone)]
+pub(super) struct ManagedConfigFromMdm {
+    pub managed_config: TomlValue,
+    pub raw_toml: String,
+}
+
 #[derive(Debug, Clone)]
 pub(super) struct LoadedConfigLayers {
     /// If present, data read from a file such as `/etc/codex/managed_config.toml`.
     pub managed_config: Option<MangedConfigFromFile>,
     /// If present, data read from managed preferences (macOS only).
-    pub managed_config_from_mdm: Option<TomlValue>,
+    pub managed_config_from_mdm: Option<ManagedConfigFromMdm>,
 }
 
 pub(super) async fn load_config_layers_internal(
@@ -57,7 +65,9 @@ pub(super) async fn load_config_layers_internal(
 
     #[cfg(target_os = "macos")]
     let managed_preferences =
-        load_managed_admin_config_layer(managed_preferences_base64.as_deref()).await?;
+        load_managed_admin_config_layer(managed_preferences_base64.as_deref())
+            .await?
+            .map(map_managed_admin_layer);
 
     #[cfg(not(target_os = "macos"))]
     let managed_preferences = None;
@@ -68,6 +78,15 @@ pub(super) async fn load_config_layers_internal(
     })
 }
 
+#[cfg(target_os = "macos")]
+fn map_managed_admin_layer(layer: ManagedAdminConfigLayer) -> ManagedConfigFromMdm {
+    let ManagedAdminConfigLayer { config, raw_toml } = layer;
+    ManagedConfigFromMdm {
+        managed_config: config,
+        raw_toml,
+    }
+}
+
 pub(super) async fn read_config_from_path(
     path: impl AsRef<Path>,
     log_missing_as_info: bool,

codex-rs/core/src/config_loader/macos.rs

@@ -15,6 +15,12 @@ const MANAGED_PREFERENCES_APPLICATION_ID: &str = "com.openai.codex";
 const MANAGED_PREFERENCES_CONFIG_KEY: &str = "config_toml_base64";
 const MANAGED_PREFERENCES_REQUIREMENTS_KEY: &str = "requirements_toml_base64";
 
+#[derive(Debug, Clone)]
+pub(super) struct ManagedAdminConfigLayer {
+    pub config: TomlValue,
+    pub raw_toml: String,
+}
+
 pub(super) fn managed_preferences_requirements_source() -> RequirementSource {
     RequirementSource::MdmManagedPreferences {
         domain: MANAGED_PREFERENCES_APPLICATION_ID.to_string(),
@@ -24,7 +30,7 @@ pub(super) fn managed_preferences_requirements_source() -> RequirementSource {
 
 pub(crate) async fn load_managed_admin_config_layer(
     override_base64: Option<&str>,
-) -> io::Result<Option<TomlValue>> {
+) -> io::Result<Option<ManagedAdminConfigLayer>> {
     if let Some(encoded) = override_base64 {
         let trimmed = encoded.trim();
         return if trimmed.is_empty() {
@@ -47,7 +53,7 @@ pub(crate) async fn load_managed_admin_config_layer(
     }
 }
 
-fn load_managed_admin_config() -> io::Result<Option<TomlValue>> {
+fn load_managed_admin_config() -> io::Result<Option<ManagedAdminConfigLayer>> {
     load_managed_preference(MANAGED_PREFERENCES_CONFIG_KEY)?
         .as_deref()
         .map(str::trim)
@@ -122,9 +128,13 @@ fn load_managed_preference(key_name: &str) -> io::Result<Option<String>> {
     Ok(Some(value))
 }
 
-fn parse_managed_config_base64(encoded: &str) -> io::Result<TomlValue> {
-    match toml::from_str::<TomlValue>(&decode_managed_preferences_base64(encoded)?) {
-        Ok(TomlValue::Table(parsed)) => Ok(TomlValue::Table(parsed)),
+fn parse_managed_config_base64(encoded: &str) -> io::Result<ManagedAdminConfigLayer> {
+    let raw_toml = decode_managed_preferences_base64(encoded)?;
+    match toml::from_str::<TomlValue>(&raw_toml) {
+        Ok(TomlValue::Table(parsed)) => Ok(ManagedAdminConfigLayer {
+            config: TomlValue::Table(parsed),
+            raw_toml,
+        }),
         Ok(other) => {
             tracing::error!("Managed config TOML must have a table at the root, found {other:?}",);
             Err(io::Error::new(

codex-rs/core/src/config_loader/mod.rs

@@ -278,9 +278,10 @@ pub async fn load_config_layers_state(
         ));
     }
     if let Some(config) = managed_config_from_mdm {
-        layers.push(ConfigLayerEntry::new(
+        layers.push(ConfigLayerEntry::new_with_raw_toml(
             ConfigLayerSource::LegacyManagedConfigTomlFromMdm,
-            config,
+            config.managed_config,
+            config.raw_toml,
         ));
     }
 
@@ -485,7 +486,12 @@ async fn load_requirements_from_legacy_scheme(
     } = loaded_config_layers;
 
     for (source, config) in managed_config_from_mdm
-        .map(|config| (RequirementSource::LegacyManagedConfigTomlFromMdm, config))
+        .map(|config| {
+            (
+                RequirementSource::LegacyManagedConfigTomlFromMdm,
+                config.managed_config,
+            )
+        })
         .into_iter()
         .chain(managed_config.map(|c| {
             (

codex-rs/core/src/config_loader/state.rs

@@ -27,6 +27,7 @@ pub struct LoaderOverrides {
 pub struct ConfigLayerEntry {
     pub name: ConfigLayerSource,
     pub config: TomlValue,
+    pub raw_toml: Option<String>,
     pub version: String,
     pub disabled_reason: Option<String>,
 }
@@ -37,6 +38,18 @@ impl ConfigLayerEntry {
         Self {
             name,
             config,
+            raw_toml: None,
+            version,
+            disabled_reason: None,
+        }
+    }
+
+    pub fn new_with_raw_toml(name: ConfigLayerSource, config: TomlValue, raw_toml: String) -> Self {
+        let version = version_for_toml(&config);
+        Self {
+            name,
+            config,
+            raw_toml: Some(raw_toml),
             version,
             disabled_reason: None,
         }
@@ -51,6 +64,7 @@ impl ConfigLayerEntry {
         Self {
             name,
             config,
+            raw_toml: None,
             version,
             disabled_reason: Some(disabled_reason.into()),
         }
@@ -60,6 +74,10 @@ impl ConfigLayerEntry {
         self.disabled_reason.is_some()
     }
 
+    pub fn raw_toml(&self) -> Option<&str> {
+        self.raw_toml.as_deref()
+    }
+
     pub fn metadata(&self) -> ConfigLayerMetadata {
         ConfigLayerMetadata {
             name: self.name.clone(),

codex-rs/core/src/config_loader/tests.rs

@@ -264,6 +264,7 @@ async fn returns_empty_when_all_layers_missing() {
                     .expect("resolve user config.toml path")
             },
             config: TomlValue::Table(toml::map::Map::new()),
+            raw_toml: None,
             version: version_for_toml(&TomlValue::Table(toml::map::Map::new())),
             disabled_reason: None,
         },
@@ -325,18 +326,17 @@ flag = true
 "#,
     )
     .expect("write managed config");
+    let raw_managed_preferences = r#"
+# managed profile
+[nested]
+value = "managed"
+flag = false
+"#;
 
     let overrides = LoaderOverrides {
         managed_config_path: Some(managed_path),
         managed_preferences_base64: Some(
-            base64::prelude::BASE64_STANDARD.encode(
-                r#"
-[nested]
-value = "managed"
-flag = false
-"#
-                .as_bytes(),
-            ),
+            base64::prelude::BASE64_STANDARD.encode(raw_managed_preferences.as_bytes()),
         ),
         macos_managed_config_requirements_base64: None,
     };
@@ -361,6 +361,19 @@ flag = false
         Some(&TomlValue::String("managed".to_string()))
     );
     assert_eq!(nested.get("flag"), Some(&TomlValue::Boolean(false)));
+    let mdm_layer = state
+        .layers_high_to_low()
+        .into_iter()
+        .find(|layer| {
+            matches!(
+                layer.name,
+                super::ConfigLayerSource::LegacyManagedConfigTomlFromMdm
+            )
+        })
+        .expect("mdm layer");
+    let raw = mdm_layer.raw_toml().expect("preserved mdm toml");
+    assert!(raw.contains("# managed profile"));
+    assert!(raw.contains("value = \"managed\""));
 }
 
 #[cfg(target_os = "macos")]
@@ -862,6 +875,7 @@ async fn project_layer_is_added_when_dot_codex_exists_without_config_toml() -> s
                 dot_codex_folder: AbsolutePathBuf::from_absolute_path(project_root.join(".codex"))?,
             },
             config: TomlValue::Table(toml::map::Map::new()),
+            raw_toml: None,
             version: version_for_toml(&TomlValue::Table(toml::map::Map::new())),
             disabled_reason: None,
         }],
@@ -955,6 +969,7 @@ async fn codex_home_within_project_tree_is_not_double_loaded() -> std::io::Resul
                 dot_codex_folder: AbsolutePathBuf::from_absolute_path(&nested_dot_codex)?,
             },
             config: child_config.clone(),
+            raw_toml: None,
             version: version_for_toml(&child_config),
             disabled_reason: None,
         }],