openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-07 20:30:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove the legacy sandbox policy constructor (#59772)

Browse Source 
## What changed

Remove `FileSystemSandboxContext::from_legacy_sandbox_policy` and migrate its test callers to `from_permission_profile`. Construct read-only, disabled, and externally enforced sandbox contexts directly with `PermissionProfile`.

GitOrigin-RevId: e330b89d060061eda106232eab554be5ccd06149
This commit is contained in:
ioanbudea-OAI
2026-11-06 00:37:27 +00:00
committed by copyberry
parent 94ca55a93c
commit c2bd770ca7
10 changed files with 40 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/tests/capabilities_v2.rs
+3 -3
View File
@@ -169,10 +169,10 @@ async fn v2_rpc_refreshes_metadata_and_enforces_sandbox() -> anyhow::Result<()>
.contains("cannot enforce split filesystem read restrictions")),
"{error:#}"
);
let mut sandbox = FileSystemSandboxContext::from_legacy_sandbox_policy(
codex_protocol::protocol::SandboxPolicy::new_read_only_policy(),
let mut sandbox = FileSystemSandboxContext::from_permission_profile(
PermissionProfile::read_only(),
cwd.clone(),
)?;
);
sandbox.windows_sandbox_selection =
codex_exec_server::WindowsSandboxSelection::RestrictedToken;
let permitted = DiscoverV2CapabilitiesRequest {
codex-rs/exec-server/tests/exec_process.rs
+3 -4
View File
@@ -59,7 +59,6 @@ use codex_protocol::permissions::FileSystemSandboxPolicy;
use codex_protocol::permissions::FileSystemSpecialPath;
#[cfg(unix)]
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_protocol::protocol::SandboxPolicy;
use codex_utils_path_uri::PathUri;
use pretty_assertions::assert_eq;
use tempfile::TempDir;
@@ -1904,10 +1903,10 @@ async fn assert_remote_windows_sandbox_process_write(
let workspace = TempDir::new()?;
let blocked_file = workspace.path().join("blocked.txt");
let cwd = PathUri::from_host_native_path(workspace.path())?;
let mut sandbox = FileSystemSandboxContext::from_legacy_sandbox_policy(
SandboxPolicy::new_read_only_policy(),
let mut sandbox = FileSystemSandboxContext::from_permission_profile(
codex_protocol::models::PermissionProfile::read_only(),
cwd.clone(),
)?;
);
match expected_sandbox_type {
codex_sandboxing::SandboxType::WindowsRestrictedToken => {
sandbox.windows_sandbox_selection = WindowsSandboxSelection::RestrictedToken;
codex-rs/exec-server/tests/file_system_windows.rs
+3 -4
View File
@@ -30,7 +30,6 @@ use codex_protocol::permissions::FileSystemSandboxEntry;
use codex_protocol::permissions::FileSystemSandboxPolicy;
use codex_protocol::permissions::FileSystemSpecialPath;
use codex_protocol::permissions::NetworkSandboxPolicy;
use codex_protocol::protocol::SandboxPolicy;
use codex_sandboxing::SandboxType;
use codex_utils_path_uri::PathUri;
use codex_windows_sandbox_test_support::WindowsSandboxAccountTestGuard;
@@ -746,8 +745,8 @@ fn process_private_desktops() -> Result<BTreeSet<String>> {
}
fn read_only_sandbox_for_cwd(cwd: std::path::PathBuf) -> Result<FileSystemSandboxContext> {
Ok(FileSystemSandboxContext::from_legacy_sandbox_policy(
SandboxPolicy::new_read_only_policy(),
Ok(FileSystemSandboxContext::from_permission_profile(
PermissionProfile::read_only(),
PathUri::from_host_native_path(cwd)?,
)?)
))
}