openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

exec-server: carry filesystem sandbox profiles

Browse Source
This commit is contained in:
Michael Bolin
2026-04-16 21:04:42 -07:00
parent 627b9d3f0f
commit fc6908e432
6 changed files with 219 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/tests/file_system.rs
+9 -2
View File
@@ -23,6 +23,7 @@ use codex_protocol::models::FileSystemPermissions;
use codex_protocol::models::PermissionProfile;
use codex_protocol::protocol::ReadOnlyAccess;
use codex_protocol::protocol::SandboxPolicy;
use codex_sandboxing::policy_transforms::merge_permission_profiles;
use codex_utils_absolute_path::AbsolutePathBuf;
use pretty_assertions::assert_eq;
use tempfile::TempDir;
@@ -473,13 +474,19 @@ async fn file_system_sandboxed_write_allows_additional_write_root(use_remote: bo
std::fs::create_dir_all(&writable_dir)?;
let mut sandbox = read_only_sandbox(readable_dir);
sandbox.additional_permissions = Some(PermissionProfile {
let additional_permissions = PermissionProfile {
network: None,
file_system: Some(FileSystemPermissions::from_read_write_roots(
None,
Some(vec![absolute_path(writable_dir)]),
)),
});
};
let Some(permissions) =
merge_permission_profiles(Some(&sandbox.permissions), Some(&additional_permissions))
else {
panic!("merged permissions should not be empty");
};
sandbox.permissions = permissions;
file_system
.write_file(