openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-10 21:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Serialize default thread permissions as a permission profile (#60472)

Browse Source 
## What changed

Initialize thread metadata's `sandbox_policy` with a serialized `PermissionProfile::read_only()`, matching the format used by turn contexts and session settings. Remove the legacy `SandboxPolicy` field from `ThreadMetadataBuilder` and redundant rollout metadata defaults.

## Testing

Extend thread-store tests to cover reading the default read-only permission profile from SQLite and accepting both string and serialized legacy `danger-full-access` policies.

GitOrigin-RevId: ec9b88a47799a20529e28ef8ca6f5f7c2c8faf9e
This commit is contained in:
ioanbudea-OAI
2026-11-10 00:06:35 +00:00
committed by copyberry
parent caae161dd0
commit 486c779c37
5 changed files with 55 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/thread-store/src/local/read_thread.rs
+46 -31
View File
@@ -1038,25 +1038,34 @@ mod tests {
builder.model_provider = Some(config.default_model_provider_id.clone());
builder.cwd = home.path().to_path_buf();
let mut metadata = builder.build(config.default_model_provider_id.as_str());
let permission_profile: PermissionProfile = PermissionProfile::Disabled;
metadata.sandbox_policy =
serde_json::to_string(&permission_profile).expect("serialize profile");
runtime
.upsert_thread(&metadata)
.await
.expect("state db upsert should succeed");
for (value, expected) in [
(
metadata.sandbox_policy.clone(),
PermissionProfile::read_only(),
),
(
serde_json::to_string(&PermissionProfile::Disabled).expect("serialize profile"),
PermissionProfile::Disabled,
),
] {
metadata.sandbox_policy = value;
runtime
.upsert_thread(&metadata)
.await
.expect("state db upsert should succeed");
let thread = store
.read_thread(ReadThreadParams {
thread_id,
include_archived: false,
include_history: false,
})
.await
.expect("read thread");
let thread = store
.read_thread(ReadThreadParams {
thread_id,
include_archived: false,
include_history: false,
})
.await
.expect("read thread");
assert_eq!(thread.preview, "Hello from user");
assert_eq!(thread.permission_profile, PermissionProfile::Disabled);
assert_eq!(thread.preview, "Hello from user");
assert_eq!(thread.permission_profile, expected);
}
}
#[tokio::test]
@@ -1079,22 +1088,28 @@ mod tests {
builder.model_provider = Some(config.default_model_provider_id.clone());
builder.cwd = home.path().to_path_buf();
let mut metadata = builder.build(config.default_model_provider_id.as_str());
metadata.sandbox_policy = "danger-full-access".to_string();
runtime
.upsert_thread(&metadata)
.await
.expect("state db upsert should succeed");
for value in [
"danger-full-access".to_string(),
serde_json::to_string(&SandboxPolicy::DangerFullAccess)
.expect("serialize legacy policy"),
] {
metadata.sandbox_policy = value;
runtime
.upsert_thread(&metadata)
.await
.expect("state db upsert should succeed");
let thread = store
.read_thread(ReadThreadParams {
thread_id,
include_archived: false,
include_history: true,
})
.await
.expect("read thread");
let thread = store
.read_thread(ReadThreadParams {
thread_id,
include_archived: false,
include_history: true,
})
.await
.expect("read thread");
assert_eq!(thread.permission_profile, PermissionProfile::Disabled);
assert_eq!(thread.permission_profile, PermissionProfile::Disabled);
}
}
#[tokio::test]