openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-28 18:58:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

permissions: derive snapshot sandbox projections

Browse Source
This commit is contained in:
Michael Bolin
2026-04-27 09:30:32 -07:00
parent 347c6f7845
commit 4e3c8ecc07
5 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server/src/codex_message_processor.rs
+9 -9
View File
@@ -2859,6 +2859,7 @@ impl CodexMessageProcessor {
/*has_in_progress_turn*/ false,
);
let sandbox_policy = config_snapshot.sandbox_policy();
let permission_profile =
thread_response_permission_profile(config_snapshot.permission_profile);
@@ -2871,7 +2872,7 @@ impl CodexMessageProcessor {
instruction_sources,
approval_policy: config_snapshot.approval_policy.into(),
approvals_reviewer: config_snapshot.approvals_reviewer.into(),
sandbox: config_snapshot.sandbox_policy.into(),
sandbox: sandbox_policy.into(),
permission_profile,
reasoning_effort: config_snapshot.reasoning_effort,
};
@@ -3597,7 +3598,7 @@ impl CodexMessageProcessor {
builder.model_provider = Some(model_provider.clone());
builder.cwd = config_snapshot.cwd.to_path_buf();
builder.cli_version = Some(env!("CARGO_PKG_VERSION").to_string());
builder.sandbox_policy = config_snapshot.sandbox_policy.clone();
builder.sandbox_policy = config_snapshot.sandbox_policy();
builder.approval_mode = config_snapshot.approval_policy;
let metadata = builder.build(model_provider.as_str());
if let Err(err) = state_db_ctx.insert_thread_if_absent(&metadata).await {
@@ -4687,7 +4688,7 @@ impl CodexMessageProcessor {
instruction_sources,
approval_policy: session_configured.approval_policy.into(),
approvals_reviewer: session_configured.approvals_reviewer.into(),
sandbox: config_snapshot.sandbox_policy.into(),
sandbox: config_snapshot.sandbox_policy().into(),
permission_profile,
reasoning_effort: session_configured.reasoning_effort,
};
@@ -5418,7 +5419,7 @@ impl CodexMessageProcessor {
instruction_sources,
approval_policy: session_configured.approval_policy.into(),
approvals_reviewer: session_configured.approvals_reviewer.into(),
sandbox: config_snapshot.sandbox_policy.into(),
sandbox: config_snapshot.sandbox_policy().into(),
permission_profile,
reasoning_effort: session_configured.reasoning_effort,
};
@@ -8997,13 +8998,13 @@ async fn handle_pending_thread_resume_request(
tracing::warn!("failed to apply goal resume runtime effects: {err}");
}
let sandbox_policy = pending.config_snapshot.sandbox_policy();
let ThreadConfigSnapshot {
model,
model_provider_id,
service_tier,
approval_policy,
approvals_reviewer,
sandbox_policy,
permission_profile,
cwd,
reasoning_effort,
@@ -9226,8 +9227,9 @@ fn collect_resume_override_mismatches(
}
}
if let Some(requested_sandbox) = request.sandbox.as_ref() {
let active_sandbox = config_snapshot.sandbox_policy();
let sandbox_matches = matches!(
(requested_sandbox, &config_snapshot.sandbox_policy),
(requested_sandbox, &active_sandbox),
(
SandboxMode::ReadOnly,
codex_protocol::protocol::SandboxPolicy::ReadOnly { .. }
@@ -9244,8 +9246,7 @@ fn collect_resume_override_mismatches(
);
if !sandbox_matches {
mismatch_details.push(format!(
"sandbox requested={requested_sandbox:?} active={:?}",
config_snapshot.sandbox_policy
"sandbox requested={requested_sandbox:?} active={active_sandbox:?}"
));
}
}
@@ -10931,7 +10932,6 @@ mod tests {
service_tier: Some(codex_protocol::config_types::ServiceTier::Flex),
approval_policy: codex_protocol::protocol::AskForApproval::OnRequest,
approvals_reviewer: codex_protocol::config_types::ApprovalsReviewer::User,
sandbox_policy: codex_protocol::protocol::SandboxPolicy::DangerFullAccess,
permission_profile: codex_protocol::models::PermissionProfile::Disabled,
cwd,
ephemeral: false,