openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-06 20:20:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

POC - Configurable ReadAcess in WorkspaceWrite SandboxPolicy

Browse Source
This commit is contained in:
Leo Shimonaka
2026-02-11 10:47:26 -08:00
parent d74fa8edd1
commit 04df7970fc
49 changed files with 1654 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server-protocol/schema/json/ClientRequest.json
+100
View File
@@ -1933,6 +1933,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -2037,6 +2040,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess2"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -3097,6 +3108,95 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
},
"WorkspaceReadAccess2": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccess2Type",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess2",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccess2Type",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess2",
"type": "object"
}
]
}
},
"description": "Request from the client to the server.",
codex-rs/app-server-protocol/schema/json/EventMsg.json
+54
View File
@@ -4303,6 +4303,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -5044,6 +5052,52 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"description": "Response event from the agent NOTE: Make sure none of these values have optional types, as it will mess up the extension code-gen.",
codex-rs/app-server-protocol/schema/json/ServerNotification.json
+54
View File
@@ -5343,6 +5343,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -7365,6 +7373,52 @@
"samplePaths"
],
"type": "object"
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"description": "Notification sent from the server to the client.",
codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+103
View File
@@ -7548,6 +7548,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -9684,6 +9692,52 @@
}
]
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
},
"v2": {
"AbsolutePathBuf": {
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
@@ -13464,6 +13518,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/v2/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -13501,6 +13558,9 @@
"default": false,
"type": "boolean"
},
"read_access": {
"$ref": "#/definitions/v2/WorkspaceReadAccess"
},
"writable_roots": {
"default": [],
"items": {
@@ -16055,6 +16115,49 @@
"title": "WindowsWorldWritableWarningNotification",
"type": "object"
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/v2/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
},
"WriteStatus": {
"enum": [
"ok",
codex-rs/app-server-protocol/schema/json/v1/ExecOneOffCommandParams.json
+54
View File
@@ -94,6 +94,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -116,6 +124,52 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v1/ForkConversationResponse.json
+54
View File
@@ -4303,6 +4303,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -5044,6 +5052,52 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v1/ResumeConversationResponse.json
+54
View File
@@ -4303,6 +4303,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -5044,6 +5052,52 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v1/SendUserTurnParams.json
+54
View File
@@ -255,6 +255,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -324,6 +332,52 @@
"byteRange"
],
"type": "object"
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v1/SessionConfiguredNotification.json
+54
View File
@@ -4303,6 +4303,14 @@
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
"type": "boolean"
},
"read_access": {
"allOf": [
{
"$ref": "#/definitions/WorkspaceReadAccess"
}
],
"description": "Controls whether the workspace-write policy has full read access or an explicit read allowlist."
},
"type": {
"enum": [
"workspace-write"
@@ -5044,6 +5052,52 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"description": "Controls read access semantics for `workspace-write` sandbox policies.",
"oneOf": [
{
"description": "Preserve current behavior where all file-system paths are readable.",
"properties": {
"type": {
"enum": [
"full-read-access"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"description": "Restrict reads to an explicit allowlist plus implicitly readable paths.",
"properties": {
"readable_roots": {
"description": "Additional folders that should be readable from inside the sandbox.",
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restricted-read-access"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
+46
View File
@@ -84,6 +84,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -106,6 +109,49 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
+46
View File
@@ -530,6 +530,9 @@
"default": false,
"type": "boolean"
},
"read_access": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"writable_roots": {
"default": [],
"items": {
@@ -573,6 +576,49 @@
"live"
],
"type": "string"
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
+46
View File
@@ -571,6 +571,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -1538,6 +1541,49 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
+46
View File
@@ -571,6 +571,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -1538,6 +1541,49 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
+46
View File
@@ -571,6 +571,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -1538,6 +1541,49 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
+46
View File
@@ -176,6 +176,9 @@
"default": false,
"type": "boolean"
},
"readAccess": {
"$ref": "#/definitions/WorkspaceReadAccess"
},
"type": {
"enum": [
"workspaceWrite"
@@ -369,6 +372,49 @@
"type": "object"
}
]
},
"WorkspaceReadAccess": {
"oneOf": [
{
"properties": {
"type": {
"enum": [
"fullReadAccess"
],
"title": "FullReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "FullReadAccessWorkspaceReadAccess",
"type": "object"
},
{
"properties": {
"readableRoots": {
"default": [],
"items": {
"$ref": "#/definitions/AbsolutePathBuf"
},
"type": "array"
},
"type": {
"enum": [
"restrictedReadAccess"
],
"title": "RestrictedReadAccessWorkspaceReadAccessType",
"type": "string"
}
},
"required": [
"type"
],
"title": "RestrictedReadAccessWorkspaceReadAccess",
"type": "object"
}
]
}
},
"properties": {
codex-rs/app-server-protocol/schema/typescript/SandboxPolicy.ts
+7 -1
View File
@@ -3,6 +3,7 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { AbsolutePathBuf } from "./AbsolutePathBuf";
import type { NetworkAccess } from "./NetworkAccess";
import type { WorkspaceReadAccess } from "./WorkspaceReadAccess";
/**
* Determines execution restrictions for model shell commands.
@@ -32,4 +33,9 @@ exclude_tmpdir_env_var: boolean,
* When set to `true`, will NOT include the `/tmp` among the default
* writable roots on UNIX. Defaults to `false`.
*/
exclude_slash_tmp: boolean, };
exclude_slash_tmp: boolean,
/**
* Controls whether the workspace-write policy has full read access or
* an explicit read allowlist.
*/
read_access?: WorkspaceReadAccess, };
codex-rs/app-server-protocol/schema/typescript/WorkspaceReadAccess.ts
+13
View File
@@ -0,0 +1,13 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { AbsolutePathBuf } from "./AbsolutePathBuf";
/**
* Controls read access semantics for `workspace-write` sandbox policies.
*/
export type WorkspaceReadAccess = { "type": "full-read-access" } | { "type": "restricted-read-access",
/**
* Additional folders that should be readable from inside the sandbox.
*/
readable_roots?: Array<AbsolutePathBuf>, };
codex-rs/app-server-protocol/schema/typescript/index.ts
+1
View File
@@ -219,4 +219,5 @@ export type { WebSearchBeginEvent } from "./WebSearchBeginEvent";
export type { WebSearchEndEvent } from "./WebSearchEndEvent";
export type { WebSearchItem } from "./WebSearchItem";
export type { WebSearchMode } from "./WebSearchMode";
export type { WorkspaceReadAccess } from "./WorkspaceReadAccess";
export * as v2 from "./v2";
codex-rs/app-server-protocol/schema/typescript/v2/SandboxPolicy.ts
+2 -1
View File
@@ -3,5 +3,6 @@
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { AbsolutePathBuf } from "../AbsolutePathBuf";
import type { NetworkAccess } from "./NetworkAccess";
import type { WorkspaceReadAccess } from "./WorkspaceReadAccess";
export type SandboxPolicy = { "type": "dangerFullAccess" } | { "type": "readOnly" } | { "type": "externalSandbox", networkAccess: NetworkAccess, } | { "type": "workspaceWrite", writableRoots: Array<AbsolutePathBuf>, networkAccess: boolean, excludeTmpdirEnvVar: boolean, excludeSlashTmp: boolean, };
export type SandboxPolicy = { "type": "dangerFullAccess" } | { "type": "readOnly" } | { "type": "externalSandbox", networkAccess: NetworkAccess, } | { "type": "workspaceWrite", writableRoots: Array<AbsolutePathBuf>, networkAccess: boolean, excludeTmpdirEnvVar: boolean, excludeSlashTmp: boolean, readAccess?: WorkspaceReadAccess, };
codex-rs/app-server-protocol/schema/typescript/v2/SandboxWorkspaceWrite.ts
+2 -1
View File
@@ -1,5 +1,6 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { WorkspaceReadAccess } from "./WorkspaceReadAccess";
export type SandboxWorkspaceWrite = { writable_roots: Array<string>, network_access: boolean, exclude_tmpdir_env_var: boolean, exclude_slash_tmp: boolean, };
export type SandboxWorkspaceWrite = { writable_roots: Array<string>, network_access: boolean, exclude_tmpdir_env_var: boolean, exclude_slash_tmp: boolean, read_access?: WorkspaceReadAccess, };
codex-rs/app-server-protocol/schema/typescript/v2/WorkspaceReadAccess.ts
+6
View File
@@ -0,0 +1,6 @@
// GENERATED CODE! DO NOT MODIFY BY HAND!
// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
import type { AbsolutePathBuf } from "../AbsolutePathBuf";
export type WorkspaceReadAccess = { "type": "fullReadAccess" } | { "type": "restrictedReadAccess", readableRoots: Array<AbsolutePathBuf>, };
codex-rs/app-server-protocol/schema/typescript/v2/index.ts
+1
View File
@@ -185,4 +185,5 @@ export type { TurnSteerResponse } from "./TurnSteerResponse";
export type { UserInput } from "./UserInput";
export type { WebSearchAction } from "./WebSearchAction";
export type { WindowsWorldWritableWarningNotification } from "./WindowsWorldWritableWarningNotification";
export type { WorkspaceReadAccess } from "./WorkspaceReadAccess";
export type { WriteStatus } from "./WriteStatus";