openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-14 21:40:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove the legacy sandbox policy setter from Config (#61144)

Browse Source 
## What changed

- Remove `Config::set_legacy_sandbox_policy` and update session, approval, and Guardian test setup to set permission profiles and workspace roots explicitly.
- Reuse `PermissionProfile::from_legacy_sandbox_policy_for_cwd` for legacy policy validation and updates in `Permissions`.

GitOrigin-RevId: 5ee92c46290ee6a3d7e2d2db7b02641e80bdc44f
This commit is contained in:
ioanbudea-OAI
2026-11-12 15:35:27 +00:00
committed by copyberry
parent d0edb0b1fa
commit ce3031018e
9 changed files with 340 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/config/mod.rs
+4 -31
View File
@@ -126,7 +126,6 @@ use codex_protocol::models::BaseInstructionsProvenance;
use codex_protocol::models::PermissionProfile;
pub use codex_protocol::models::PermissionProfileSnapshot;
use codex_protocol::models::ProfileWorkspaceRoot;
use codex_protocol::models::SandboxEnforcement;
use codex_protocol::openai_models::ModelsResponse;
use codex_protocol::openai_models::ReasoningEffort;
use codex_protocol::permissions::DenyReadValidator;
@@ -510,14 +509,8 @@ impl Permissions {
sandbox_policy: &SandboxPolicy,
cwd: &Path,
) -> ConstraintResult<()> {
let file_system_sandbox_policy =
FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(sandbox_policy, cwd);
let network_sandbox_policy = NetworkSandboxPolicy::from(sandbox_policy);
let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
SandboxEnforcement::from_legacy_sandbox_policy(sandbox_policy),
&file_system_sandbox_policy,
network_sandbox_policy,
);
let permission_profile =
PermissionProfile::from_legacy_sandbox_policy_for_cwd(sandbox_policy, cwd);
self.can_set_permission_profile(&permission_profile)
}
@@ -529,14 +522,8 @@ impl Permissions {
cwd: &Path,
) -> ConstraintResult<()> {
self.can_set_legacy_sandbox_policy(&sandbox_policy, cwd)?;
let file_system_sandbox_policy =
FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, cwd);
let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
&file_system_sandbox_policy,
network_sandbox_policy,
);
let permission_profile =
PermissionProfile::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, cwd);
self.workspace_roots = match &sandbox_policy {
SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
let mut workspace_roots = vec![
@@ -1788,20 +1775,6 @@ impl Config {
self.permissions.legacy_sandbox_policy(self.cwd.as_path())
}
pub fn set_legacy_sandbox_policy(
&mut self,
sandbox_policy: SandboxPolicy,
) -> ConstraintResult<()> {
self.workspace_roots_explicit = matches!(
&sandbox_policy,
SandboxPolicy::WorkspaceWrite { writable_roots, .. } if !writable_roots.is_empty()
);
self.permissions
.set_legacy_sandbox_policy(sandbox_policy, self.cwd.as_path())?;
self.workspace_roots = self.permissions.workspace_roots().to_vec();
Ok(())
}
/// Combine runtime and profile roots without interpreting them on the current host.
pub fn effective_workspace_roots(&self) -> Vec<PathUri> {
let mut workspace_roots = self
codex-rs/core/src/session/tests.rs
+9 -6
View File
@@ -4241,21 +4241,24 @@ async fn record_initial_history_assigns_and_persists_id_for_forked_response_item
async fn session_configured_reports_permission_profile_for_external_sandbox() -> anyhow::Result<()>
{
let server = start_mock_server().await;
let sandbox_policy = SandboxPolicy::ExternalSandbox {
network_access: codex_protocol::protocol::NetworkAccess::Restricted,
};
let permission_profile = PermissionProfile::External {
network: NetworkSandboxPolicy::Restricted,
};
let expected_permission_profile = permission_profile.clone();
let mut builder = test_codex().with_config(move |config| {
config.workspace_roots_explicit = false;
config
.permissions
.set_permission_profile(permission_profile.clone())
.can_set_permission_profile(&permission_profile)
.expect("set permission profile");
config
.set_legacy_sandbox_policy(sandbox_policy)
.expect("set sandbox policy");
.permissions
.set_workspace_roots(vec![config.cwd.clone()]);
config
.permissions
.set_permission_profile(permission_profile)
.expect("set permission profile");
config.workspace_roots = config.permissions.workspace_roots().to_vec();
});
let test = builder.build(&server).await?;