openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-13 21:30:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use native permission profiles for diagnostics and sandbox checks (#61369)

Browse Source 
## What changed

- Derive sampling diagnostic and rollout trace labels directly from permission profiles instead of constructing legacy sandbox policies. Rename the trace metadata field from `sandbox_policy` to `permissions_profile`.
- Extract `with_workspace_write_cwd` to share default workspace metadata protections between legacy policy conversion and the TUI's sandbox-mode compatibility check. Build the check's workspace-write profile from filesystem and network permissions directly.

## Testing

Add a regression test confirming that the sandbox-mode compatibility check accepts standard workspace metadata protections and rejects a profile with an additional writable `.git` root.

GitOrigin-RevId: f20d23afd80dff6347865df3d6a94d6f5e90e1e0
This commit is contained in:
ioanbudea-OAI
2026-11-13 20:22:45 +00:00
committed by copyberry
parent 6d99161bce
commit 400a1e1e82
9 changed files with 70 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/rollout-trace/src/thread.rs
+1 -1
View File
@@ -62,7 +62,7 @@ pub struct ThreadStartedTraceMetadata {
pub model: String,
pub provider_name: String,
pub approval_policy: String,
pub sandbox_policy: String,
pub permissions_profile: String,
}
/// Trace-only payload for a child completion notification delivered to its parent.
codex-rs/rollout-trace/src/thread_tests.rs
+3 -3
View File
@@ -49,7 +49,7 @@ fn create_in_root_writes_replayable_lifecycle_events() -> anyhow::Result<()> {
model: "gpt-test".to_string(),
provider_name: "test-provider".to_string(),
approval_policy: "never".to_string(),
sandbox_policy: "DangerFullAccess".to_string(),
permissions_profile: "danger-full-access".to_string(),
},
)?;
@@ -162,7 +162,7 @@ fn spawned_thread_start_appends_to_root_bundle() -> anyhow::Result<()> {
model: "gpt-test".to_string(),
provider_name: "test-provider".to_string(),
approval_policy: "never".to_string(),
sandbox_policy: "DangerFullAccess".to_string(),
permissions_profile: "danger-full-access".to_string(),
})?;
child_trace.record_ended(RolloutStatus::Completed);
let bundle_dir = single_bundle_dir(temp.path())?;
@@ -458,7 +458,7 @@ fn minimal_metadata(thread_id: ThreadId) -> ThreadStartedTraceMetadata {
model: "gpt-test".to_string(),
provider_name: "test-provider".to_string(),
approval_policy: "never".to_string(),
sandbox_policy: "danger-full-access".to_string(),
permissions_profile: "danger-full-access".to_string(),
}
}