openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-14 21:40:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove legacy sandbox-policy accessors from configuration (#61395)

Browse Source 
## What changed

- Remove `Config::legacy_sandbox_policy` and `Permissions::legacy_sandbox_policy`.
- Update core and TUI tests to use permission profiles and filesystem/network policies directly, with explicit conversion where legacy wire formats are required.
- Report the active sandbox label in app-server resume override mismatch diagnostics.

GitOrigin-RevId: cbc5417944e23404523e69dc5516d66d6bfafefe
This commit is contained in:
ioanbudea-OAI
2026-11-13 23:03:49 +00:00
committed by copyberry
parent 5158e9780e
commit f626b8fde9
15 changed files with 170 additions and 277 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/tests/suite/agent_websocket.rs
+20 -8
View File
@@ -781,8 +781,11 @@ async fn websocket_test_codex_shell_chain() -> Result<()> {
let mut builder = test_codex().with_windows_cmd_shell();
let test = builder.build_with_websocket_server(&server).await?;
test.submit_turn_with_policy("run the echo command", test.config.legacy_sandbox_policy())
.await?;
test.submit_turn_with_permission_profile(
"run the echo command",
test.config.permissions.effective_permission_profile(),
)
.await?;
let connection = server.single_connection();
assert_eq!(connection.len(), 2);
@@ -847,8 +850,11 @@ async fn websocket_first_turn_uses_startup_prewarm_and_create(
});
}
let test = builder.build_with_websocket_server(&server).await?;
test.submit_turn_with_policy("hello", test.config.legacy_sandbox_policy())
.await?;
test.submit_turn_with_permission_profile(
"hello",
test.config.permissions.effective_permission_profile(),
)
.await?;
assert_eq!(server.handshakes().len(), 1);
let connection = server.single_connection();
@@ -942,8 +948,11 @@ async fn websocket_first_turn_handles_handshake_delay_with_startup_prewarm() ->
let mut builder = test_codex();
let test = builder.build_with_websocket_server(&server).await?;
test.submit_turn_with_policy("hello", test.config.legacy_sandbox_policy())
.await?;
test.submit_turn_with_permission_profile(
"hello",
test.config.permissions.effective_permission_profile(),
)
.await?;
assert_eq!(server.handshakes().len(), 1);
let connection = server.single_connection();
@@ -999,8 +1008,11 @@ async fn websocket_v2_test_codex_shell_chain() -> Result<()> {
});
let test = builder.build_with_websocket_server(&server).await?;
test.submit_turn_with_policy("run the echo command", test.config.legacy_sandbox_policy())
.await?;
test.submit_turn_with_permission_profile(
"run the echo command",
test.config.permissions.effective_permission_profile(),
)
.await?;
let connection = server.single_connection();
assert_eq!(connection.len(), 3);
codex-rs/core/tests/suite/client.rs
+2 -2
View File
@@ -2843,7 +2843,7 @@ async fn user_turn_collaboration_mode_overrides_model_and_effort() -> anyhow::Re
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(config.cwd.clone())),
approval_policy: Some(config.permissions.approval_policy.value()),
sandbox_policy: Some(config.legacy_sandbox_policy()),
permission_profile: Some(config.permissions.effective_permission_profile()),
summary: Some(
config
.model_reasoning_summary
@@ -3101,7 +3101,7 @@ async fn user_turn_explicit_reasoning_summary_overrides_model_catalog_default()
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(config.cwd.clone())),
approval_policy: Some(config.permissions.approval_policy.value()),
sandbox_policy: Some(config.legacy_sandbox_policy()),
permission_profile: Some(config.permissions.effective_permission_profile()),
summary: Some(ReasoningSummary::Concise),
collaboration_mode: Some(CollaborationMode {
mode: ModeKind::Default,
codex-rs/core/tests/suite/collaboration_instructions.rs
+3 -3
View File
@@ -546,7 +546,7 @@ async fn collaboration_instructions_added_on_user_turn() -> Result<()> {
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(test.config.cwd.clone())),
approval_policy: Some(test.config.permissions.approval_policy.value()),
sandbox_policy: Some(test.config.legacy_sandbox_policy()),
permission_profile: Some(test.config.permissions.effective_permission_profile()),
summary: Some(
test.config
.model_reasoning_summary
@@ -593,7 +593,7 @@ async fn collaboration_instructions_omitted_when_disabled() -> Result<()> {
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(test.config.cwd.clone())),
approval_policy: Some(test.config.permissions.approval_policy.value()),
sandbox_policy: Some(test.config.legacy_sandbox_policy()),
permission_profile: Some(test.config.permissions.effective_permission_profile()),
summary: Some(
test.config
.model_reasoning_summary
@@ -651,7 +651,7 @@ async fn user_turn_overrides_collaboration_instructions_after_override() -> Resu
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(test.config.cwd.clone())),
approval_policy: Some(test.config.permissions.approval_policy.value()),
sandbox_policy: Some(test.config.legacy_sandbox_policy()),
permission_profile: Some(test.config.permissions.effective_permission_profile()),
summary: Some(
test.config
.model_reasoning_summary
codex-rs/core/tests/suite/mcp_auth_elicitation.rs
+1 -1
View File
@@ -260,7 +260,7 @@ approvals_reviewer = "user"
"model": session.model, "modelProvider": session.model_provider_id, "cwd": session.cwd,
"approvalPolicy": app::AskForApproval::from(session.approval_policy),
"approvalsReviewer": app::ApprovalsReviewer::from(session.approvals_reviewer),
"sandbox": app::SandboxPolicy::from(test.config.legacy_sandbox_policy()),
"sandbox": app::SandboxPolicy::from(test.config.permissions.effective_permission_profile().to_legacy_sandbox_policy(test.config.cwd.as_path())?),
}))?;
client.track_response(
/*connection_id*/ 1,
codex-rs/core/tests/suite/prompt_caching.rs
+5 -5
View File
@@ -916,7 +916,7 @@ async fn send_user_turn_with_no_changes_does_not_send_environment_context() -> a
let default_cwd = config.cwd.clone();
let default_approval_policy = config.permissions.approval_policy.value();
let default_sandbox_policy = &config.legacy_sandbox_policy();
let default_permission_profile = config.permissions.effective_permission_profile();
let default_model = session_configured.model;
let default_effort = config.model_reasoning_effort.clone();
let default_summary = config.model_reasoning_summary;
@@ -930,7 +930,7 @@ async fn send_user_turn_with_no_changes_does_not_send_environment_context() -> a
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(default_cwd.clone())),
approval_policy: Some(default_approval_policy),
sandbox_policy: Some(default_sandbox_policy.clone()),
permission_profile: Some(default_permission_profile.clone()),
summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
collaboration_mode: Some(CollaborationMode {
mode: ModeKind::Default,
@@ -955,7 +955,7 @@ async fn send_user_turn_with_no_changes_does_not_send_environment_context() -> a
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(default_cwd.clone())),
approval_policy: Some(default_approval_policy),
sandbox_policy: Some(default_sandbox_policy.clone()),
permission_profile: Some(default_permission_profile.clone()),
summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
collaboration_mode: Some(CollaborationMode {
mode: ModeKind::Default,
@@ -1053,7 +1053,7 @@ async fn send_user_turn_with_changes_sends_environment_context() -> anyhow::Resu
let default_cwd = config.cwd.clone();
let default_approval_policy = config.permissions.approval_policy.value();
let default_sandbox_policy = &config.legacy_sandbox_policy();
let default_permission_profile = config.permissions.effective_permission_profile();
let default_model = session_configured.model;
let default_effort = config.model_reasoning_effort.clone();
let default_summary = config.model_reasoning_summary;
@@ -1067,7 +1067,7 @@ async fn send_user_turn_with_changes_sends_environment_context() -> anyhow::Resu
.with_thread_settings(ThreadSettingsOverrides {
environments: Some(local_requests(default_cwd.clone())),
approval_policy: Some(default_approval_policy),
sandbox_policy: Some(default_sandbox_policy.clone()),
permission_profile: Some(default_permission_profile.clone()),
summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
collaboration_mode: Some(CollaborationMode {
mode: ModeKind::Default,
codex-rs/core/tests/suite/worktree_trust.rs
+4 -6
View File
@@ -5,9 +5,9 @@ use anyhow::Result;
use codex_config::LoaderOverrides;
use codex_core::config::ConfigBuilder;
use codex_core::config::ConfigOverrides;
use codex_protocol::models::PermissionProfile;
use codex_protocol::protocol::AskForApproval;
use codex_protocol::protocol::EventMsg;
use codex_protocol::protocol::SandboxPolicy;
use codex_utils_cargo_bin::cargo_bin;
use core_test_support::responses;
use core_test_support::skip_if_remote;
@@ -107,13 +107,11 @@ async fn forged_worktree_project_config_cannot_start_host_mcp() -> Result<()> {
}
);
assert_eq!(
loaded.permissions.legacy_sandbox_policy(&checkout),
loaded.permissions.effective_permission_profile(),
if registered {
SandboxPolicy::DangerFullAccess
PermissionProfile::Disabled
} else {
SandboxPolicy::ReadOnly {
network_access: false,
}
PermissionProfile::read_only()
}
);