openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-09 15:58:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

session: stop exposing legacy sandbox policy

Browse Source
This commit is contained in:
Michael Bolin
2026-04-30 08:54:43 -07:00
parent 11f94d436d
commit b08d404f4e
2 changed files with 20 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
codex-rs/core/src/session/session.rs
View File

@@ -2,7 +2,6 @@ use super::*;
use crate::goals::GoalRuntimeState;
use codex_protocol::permissions::FileSystemPath;
use codex_protocol::permissions::FileSystemSpecialPath;
use codex_protocol::protocol::SandboxPolicy;
use tokio::sync::Semaphore;
/// Context for an initialized model agent
@@ -105,20 +104,6 @@ impl SessionConfiguration {
self.active_permission_profile.clone()
}
pub(super) fn sandbox_policy(&self) -> SandboxPolicy {
self.permission_profile()
.to_legacy_sandbox_policy(&self.cwd)
.unwrap_or_else(|_| {
let file_system_sandbox_policy = self.file_system_sandbox_policy();
codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
self.permission_profile.get(),
&file_system_sandbox_policy,
self.network_sandbox_policy(),
&self.cwd,
)
})
}
pub(super) fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
self.permission_profile.get().file_system_sandbox_policy()
}
@@ -146,9 +131,15 @@ impl SessionConfiguration {
pub(crate) fn apply(&self, updates: &SessionSettingsUpdate) -> ConstraintResult<Self> {
let mut next_configuration = self.clone();
let current_sandbox_policy = self.sandbox_policy();
let current_file_system_sandbox_policy = self.file_system_sandbox_policy();
let current_network_sandbox_policy = self.network_sandbox_policy();
let current_sandbox_policy =
codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
self.permission_profile.get(),
&current_file_system_sandbox_policy,
current_network_sandbox_policy,
&self.cwd,
);
let legacy_file_system_projection =
FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
&current_sandbox_policy,

15
codex-rs/core/src/session/tests.rs
View File

@@ -3043,8 +3043,14 @@ async fn session_configuration_apply_permission_profile_accepts_direct_write_roo
updated.file_system_sandbox_policy(),
file_system_sandbox_policy
);
let updated_file_system_policy = updated.file_system_sandbox_policy();
assert_eq!(
updated.sandbox_policy(),
codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
&updated.permission_profile(),
&updated_file_system_policy,
updated.network_sandbox_policy(),
updated.cwd.as_path(),
),
codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
&permission_profile,
&file_system_sandbox_policy,
@@ -3176,7 +3182,12 @@ async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_
.expect("cwd-only update should succeed");
let expected_file_system_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
&updated.sandbox_policy(),
&codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
&updated.permission_profile(),
&updated.file_system_sandbox_policy(),
updated.network_sandbox_policy(),
updated.cwd.as_path(),
),
&project_root,
);
assert!(