openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-26 18:38:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

POC - Configurable ReadAcess in WorkspaceWrite SandboxPolicy

Browse Source
This commit is contained in:
Leo Shimonaka
2026-02-11 10:47:26 -08:00
parent d74fa8edd1
commit 04df7970fc
49 changed files with 1654 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/tests/suite/apply_patch_cli.rs
+2
View File
@@ -581,6 +581,7 @@ async fn apply_patch_cli_rejects_path_traversal_outside_workspace(
network_access: false,
exclude_tmpdir_env_var: true,
exclude_slash_tmp: true,
read_access: Default::default(),
};
harness
.submit_with_policy(
@@ -637,6 +638,7 @@ async fn apply_patch_cli_rejects_move_path_traversal_outside_workspace(
network_access: false,
exclude_tmpdir_env_var: true,
exclude_slash_tmp: true,
read_access: Default::default(),
};
harness
.submit_with_policy("attempt move traversal via apply_patch", sandbox_policy)
codex-rs/core/tests/suite/approvals.rs
+2
View File
@@ -631,6 +631,7 @@ fn scenarios() -> Vec<ScenarioSpec> {
network_access,
exclude_tmpdir_env_var: false,
exclude_slash_tmp: false,
read_access: Default::default(),
};
vec![
@@ -1576,6 +1577,7 @@ async fn approving_apply_patch_for_session_skips_future_prompts_for_same_file()
network_access: false,
exclude_tmpdir_env_var: false,
exclude_slash_tmp: false,
read_access: Default::default(),
};
let sandbox_policy_for_config = sandbox_policy.clone();
codex-rs/core/tests/suite/permissions_messages.rs
+1
View File
@@ -460,6 +460,7 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
network_access: false,
exclude_tmpdir_env_var: false,
exclude_slash_tmp: false,
read_access: Default::default(),
};
let sandbox_policy_for_config = sandbox_policy.clone();
codex-rs/core/tests/suite/prompt_caching.rs
+2
View File
@@ -377,6 +377,7 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
network_access: true,
exclude_tmpdir_env_var: true,
exclude_slash_tmp: true,
read_access: Default::default(),
};
codex
.submit(Op::OverrideTurnContext {
@@ -618,6 +619,7 @@ async fn per_turn_overrides_keep_cached_prefix_and_key_constant() -> anyhow::Res
network_access: true,
exclude_tmpdir_env_var: true,
exclude_slash_tmp: true,
read_access: Default::default(),
};
codex
.submit(Op::UserTurn {
codex-rs/core/tests/suite/seatbelt.rs
+2
View File
@@ -80,6 +80,7 @@ async fn if_parent_of_repo_is_writable_then_dot_git_folder_is_writable() {
network_access: false,
exclude_tmpdir_env_var: true,
exclude_slash_tmp: true,
read_access: Default::default(),
};
test_scenario
@@ -106,6 +107,7 @@ async fn if_git_repo_is_writable_root_then_dot_git_folder_is_read_only() {
network_access: false,
exclude_tmpdir_env_var: true,
exclude_slash_tmp: true,
read_access: Default::default(),
};
test_scenario