openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-15 21:50:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

permissions: support workspace roots in profiles

Browse Source
This commit is contained in:
Michael Bolin
2026-05-14 17:17:10 -07:00
parent 01d93fd9fc
commit 149cf98553
60 changed files with 1355 additions and 731 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec/src/event_processor_with_human_output.rs
+4 -83
View File
@@ -1,5 +1,4 @@
use std::io::IsTerminal;
use std::path::Path;
use std::path::PathBuf;
use codex_app_server_protocol::CommandExecutionStatus;
@@ -11,11 +10,9 @@ use codex_app_server_protocol::ThreadTokenUsage;
use codex_app_server_protocol::TurnStatus;
use codex_core::config::Config;
use codex_model_provider_info::WireApi;
use codex_protocol::models::PermissionProfile;
use codex_protocol::num_format::format_with_separators;
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_protocol::protocol::SessionConfiguredEvent;
use codex_utils_absolute_path::canonicalize_preserving_symlinks;
use codex_utils_sandbox_summary::summarize_permission_profile;
use owo_colors::OwoColorize;
use owo_colors::Style;
@@ -437,8 +434,9 @@ fn config_summary_entries(
(
"sandbox",
summarize_permission_profile(
config.permissions.permission_profile.get(),
config.cwd.as_path(),
&config.permissions.effective_permission_profile(),
&config.cwd,
config.permissions.user_visible_workspace_roots(),
),
),
];
@@ -465,83 +463,6 @@ fn config_summary_entries(
entries
}
fn summarize_permission_profile(permission_profile: &PermissionProfile, cwd: &Path) -> String {
match permission_profile {
PermissionProfile::Disabled => "danger-full-access".to_string(),
PermissionProfile::External { network } => {
let mut summary = "external-sandbox".to_string();
append_network_summary(&mut summary, *network);
summary
}
PermissionProfile::Managed { .. } => {
let file_system_policy = permission_profile.file_system_sandbox_policy();
let network_policy = permission_profile.network_sandbox_policy();
if file_system_policy.has_full_disk_write_access() {
let mut summary = "workspace-write [/]".to_string();
append_network_summary(&mut summary, network_policy);
return summary;
}
let writable_roots = file_system_policy.get_writable_roots_with_cwd(cwd);
if writable_roots.is_empty() {
let mut summary = "read-only".to_string();
append_network_summary(&mut summary, network_policy);
return summary;
}
let mut summary = "workspace-write".to_string();
let writable_entries = writable_roots
.iter()
.map(|root| writable_root_label(root.root.as_path(), cwd))
.collect::<Vec<_>>();
summary.push_str(&format!(" [{}]", writable_entries.join(", ")));
append_network_summary(&mut summary, network_policy);
summary
}
}
}
fn append_network_summary(summary: &mut String, network_policy: NetworkSandboxPolicy) {
if network_policy.is_enabled() {
summary.push_str(" (network access enabled)");
}
}
fn writable_root_label(root: &Path, cwd: &Path) -> String {
if paths_match_after_canonicalization(root, cwd) {
return "workdir".to_string();
}
if paths_match_after_canonicalization(root, Path::new("/tmp")) {
return "/tmp".to_string();
}
if std::env::var_os("TMPDIR")
.filter(|tmpdir| !tmpdir.is_empty())
.is_some_and(|tmpdir| paths_match_after_canonicalization(root, Path::new(&tmpdir)))
{
return "$TMPDIR".to_string();
}
display_path_label(root)
}
fn paths_match_after_canonicalization(left: &Path, right: &Path) -> bool {
match (
canonicalize_preserving_symlinks(left),
canonicalize_preserving_symlinks(right),
) {
(Ok(left), Ok(right)) if left == right => true,
_ => display_path_label(left) == display_path_label(right),
}
}
fn display_path_label(path: &Path) -> String {
path.strip_prefix("/private/tmp")
.ok()
.map(|suffix| Path::new("/tmp").join(suffix))
.unwrap_or_else(|| path.to_path_buf())
.to_string_lossy()
.to_string()
}
fn reasoning_text(
summary: &[String],
content: &[String],
codex-rs/exec/src/event_processor_with_human_output_tests.rs
+12 -14
View File
@@ -10,16 +10,15 @@ use codex_protocol::permissions::FileSystemSandboxPolicy;
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_utils_absolute_path::test_support::PathBufExt;
use codex_utils_absolute_path::test_support::test_path_buf;
use codex_utils_sandbox_summary::summarize_permission_profile;
use owo_colors::Style;
use pretty_assertions::assert_eq;
use super::EventProcessorWithHumanOutput;
use super::final_message_from_turn_items;
use super::paths_match_after_canonicalization;
use super::reasoning_text;
use super::should_print_final_message_to_stdout;
use super::should_print_final_message_to_tty;
use super::summarize_permission_profile;
use crate::event_processor::EventProcessor;
#[test]
@@ -101,10 +100,13 @@ fn reasoning_text_uses_raw_content_when_enabled() {
#[test]
fn summarizes_disabled_permission_profile_as_danger_full_access() {
let cwd = test_path_buf("/tmp").abs();
assert_eq!(
summarize_permission_profile(
&PermissionProfile::Disabled,
test_path_buf("/tmp").as_path()
&cwd,
std::slice::from_ref(&cwd),
),
"danger-full-access"
);
@@ -112,12 +114,15 @@ fn summarizes_disabled_permission_profile_as_danger_full_access() {
#[test]
fn summarizes_external_permission_profile() {
let cwd = test_path_buf("/tmp").abs();
assert_eq!(
summarize_permission_profile(
&PermissionProfile::External {
network: NetworkSandboxPolicy::Enabled,
},
test_path_buf("/tmp").as_path(),
&cwd,
std::slice::from_ref(&cwd),
),
"external-sandbox (network access enabled)"
);
@@ -144,32 +149,25 @@ fn summarizes_managed_workspace_write_permission_profile() {
);
assert_eq!(
summarize_permission_profile(&profile, cwd.as_path()),
summarize_permission_profile(&profile, &cwd, &[cwd.clone(), cache_root.clone()]),
format!("workspace-write [workdir, {}]", cache_root.display())
);
}
#[test]
fn summarizes_managed_read_only_permission_profile() {
let cwd = test_path_buf("/tmp/project").abs();
let profile = PermissionProfile::from_runtime_permissions(
&FileSystemSandboxPolicy::restricted(Vec::new()),
NetworkSandboxPolicy::Restricted,
);
assert_eq!(
summarize_permission_profile(&profile, test_path_buf("/tmp/project").as_path()),
summarize_permission_profile(&profile, &cwd, std::slice::from_ref(&cwd)),
"read-only"
);
}
#[test]
fn distinct_missing_paths_do_not_match_after_canonicalization() {
assert!(!paths_match_after_canonicalization(
test_path_buf("/tmp/codex-missing-left").as_path(),
test_path_buf("/tmp/codex-missing-right").as_path(),
));
}
#[test]
fn final_message_from_turn_items_uses_latest_agent_message() {
let message = final_message_from_turn_items(&[
codex-rs/exec/src/lib.rs
+20 -15
View File
@@ -83,7 +83,6 @@ use codex_protocol::SessionId;
use codex_protocol::ThreadId;
use codex_protocol::config_types::SandboxMode;
use codex_protocol::models::ActivePermissionProfile;
use codex_protocol::models::ActivePermissionProfileModification;
use codex_protocol::models::PermissionProfile;
use codex_protocol::protocol::AskForApproval;
use codex_protocol::protocol::ReviewRequest;
@@ -419,6 +418,7 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
permission_profile: None,
default_permissions: None,
cwd: resolved_cwd,
workspace_roots: None,
model_provider: model_provider.clone(),
service_tier: None,
codex_self_exe: arg0_paths.codex_self_exe.clone(),
@@ -760,7 +760,7 @@ async fn run_exec_session(args: ExecRunArgs) -> anyhow::Result<()> {
event_processor.print_config_summary(&config, &prompt_summary, &session_configured);
if !json_mode
&& let Some(message) =
codex_core::config::system_bwrap_warning(config.permissions.permission_profile.get())
codex_core::config::system_bwrap_warning(config.permissions.permission_profile().get())
{
event_processor.process_warning(message);
}
@@ -953,7 +953,7 @@ fn thread_start_params_from_config(config: &Config) -> ThreadStartParams {
let permissions = permissions_selection_from_config(config);
let sandbox = permissions.is_none().then(|| {
sandbox_mode_from_permission_profile(
&config.permissions.permission_profile(),
&config.permissions.effective_permission_profile(),
config.cwd.as_path(),
)
});
@@ -975,7 +975,7 @@ fn thread_resume_params_from_config(config: &Config, thread_id: String) -> Threa
let permissions = permissions_selection_from_config(config);
let sandbox = permissions.is_none().then(|| {
sandbox_mode_from_permission_profile(
&config.permissions.permission_profile(),
&config.permissions.effective_permission_profile(),
config.cwd.as_path(),
)
});
@@ -997,20 +997,25 @@ fn permissions_selection_from_config(config: &Config) -> Option<PermissionProfil
config
.permissions
.active_permission_profile()
.map(permissions_selection_from_active_profile)
.map(|active| {
permissions_selection_from_active_profile(
active,
config.cwd.as_path(),
config.permissions.user_visible_workspace_roots(),
)
})
}
fn permissions_selection_from_active_profile(
active: ActivePermissionProfile,
cwd: &Path,
workspace_roots: &[AbsolutePathBuf],
) -> PermissionProfileSelectionParams {
let modifications = active
.modifications
.into_iter()
.map(|modification| match modification {
ActivePermissionProfileModification::AdditionalWritableRoot { path } => {
PermissionProfileModificationParams::AdditionalWritableRoot { path }
}
})
let modifications = workspace_roots
.iter()
.filter(|root| root.as_path() != cwd)
.cloned()
.map(|path| PermissionProfileModificationParams::AdditionalWritableRoot { path })
.collect::<Vec<_>>();
PermissionProfileSelectionParams::Profile {
id: active.id,
@@ -1091,7 +1096,7 @@ fn session_configured_from_thread_start_response(
.permission_profile
.clone()
.map(Into::into)
.unwrap_or_else(|| config.permissions.permission_profile()),
.unwrap_or_else(|| config.permissions.effective_permission_profile()),
response.active_permission_profile.clone().map(Into::into),
response.cwd.clone(),
response.reasoning_effort,
@@ -1116,7 +1121,7 @@ fn session_configured_from_thread_resume_response(
.permission_profile
.clone()
.map(Into::into)
.unwrap_or_else(|| config.permissions.permission_profile()),
.unwrap_or_else(|| config.permissions.effective_permission_profile()),
response.active_permission_profile.clone().map(Into::into),
response.cwd.clone(),
response.reasoning_effort,
codex-rs/exec/src/lib_tests.rs
+24
View File
@@ -1,6 +1,8 @@
use super::*;
use codex_otel::set_parent_from_w3c_trace_context;
use codex_protocol::config_types::ApprovalsReviewer;
use codex_protocol::models::ActivePermissionProfile;
use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
use codex_utils_absolute_path::test_support::PathBufExt;
use codex_utils_absolute_path::test_support::test_path_buf;
use opentelemetry::trace::TraceContextExt;
@@ -455,6 +457,28 @@ async fn thread_start_params_include_review_policy_when_auto_review_is_enabled()
);
}
#[test]
fn active_profile_selection_includes_extra_workspace_roots_as_modifications() {
let cwd = test_path_buf("/workspace/project").abs();
let extra_root = test_path_buf("/workspace/cache").abs();
let selection = permissions_selection_from_active_profile(
ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
cwd.as_path(),
&[cwd.clone(), extra_root.clone()],
);
assert_eq!(
selection,
PermissionProfileSelectionParams::Profile {
id: BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string(),
modifications: Some(vec![
PermissionProfileModificationParams::AdditionalWritableRoot { path: extra_root }
]),
}
);
}
#[tokio::test]
async fn thread_lifecycle_params_include_legacy_sandbox_when_no_active_profile() {
let codex_home = tempdir().expect("create temp codex home");