Michael Bolin
c8445b0caa
merge commit for archive created by Sapling
2026-04-26 23:55:16 -07:00
Michael Bolin
25c6ddbe69
permissions: store thread sessions as profiles
2026-04-26 23:54:56 -07:00
Michael Bolin
eddf0715f1
permissions: derive snapshot sandbox projections
2026-04-26 23:54:56 -07:00
Michael Bolin
08769b8684
Merge 8fff5bce53 into sapling-pr-archive-bolinfest
2026-04-26 23:46:08 -07:00
Michael Bolin
241de1c43e
permissions: make SessionConfigured profile-only
2026-04-26 23:45:53 -07:00
Michael Bolin
8fff5bce53
permissions: store thread sessions as profiles
2026-04-26 23:45:53 -07:00
Michael Bolin
6af2340e55
permissions: derive snapshot sandbox projections
2026-04-26 23:45:53 -07:00
Michael Bolin
ead23dce4c
merge commit for archive created by Sapling
2026-04-26 23:36:06 -07:00
Michael Bolin
94e89b575b
permissions: store thread sessions as profiles
2026-04-26 23:33:42 -07:00
Michael Bolin
8e23a09e52
permissions: require profiles in TUI thread state
2026-04-26 23:33:10 -07:00
Michael Bolin
94572449a0
permissions: derive snapshot sandbox projections
2026-04-26 23:33:10 -07:00
Michael Bolin
f1a729b68b
permissions: make SessionConfigured profile-only
2026-04-26 23:33:10 -07:00
Michael Bolin
66a7c938ed
Merge 2e1e5f3de9 into sapling-pr-archive-bolinfest
2026-04-26 23:25:15 -07:00
Michael Bolin
2e1e5f3de9
permissions: store thread sessions as profiles
2026-04-26 23:25:07 -07:00
Michael Bolin
1497658a8c
permissions: derive snapshot sandbox projections
2026-04-26 23:25:07 -07:00
Michael Bolin
926d327524
permissions: make SessionConfigured profile-only
2026-04-26 23:25:07 -07:00
Michael Bolin
b851fa2e08
merge commit for archive created by Sapling
2026-04-26 23:15:42 -07:00
Michael Bolin
d4eb1845f8
permissions: derive config defaults as profiles
2026-04-26 23:15:26 -07:00
Michael Bolin
dbcbf3bb01
permissions: require profiles in TUI thread state
2026-04-26 23:15:26 -07:00
Michael Bolin
4aecf2ae42
permissions: store thread sessions as profiles
2026-04-26 23:15:26 -07:00
Michael Bolin
59e21e6030
permissions: derive snapshot sandbox projections
2026-04-26 23:15:26 -07:00
Michael Bolin
ec9a1d7689
permissions: make SessionConfigured profile-only
2026-04-26 23:15:26 -07:00
Michael Bolin
908da686ec
Merge cb8522799d into sapling-pr-archive-bolinfest
2026-04-26 23:09:27 -07:00
Michael Bolin
cb8522799d
permissions: store thread sessions as profiles
2026-04-26 23:09:14 -07:00
Michael Bolin
54173b9dc8
permissions: derive snapshot sandbox projections
2026-04-26 23:09:14 -07:00
Michael Bolin
c247fed536
permissions: make SessionConfigured profile-only
2026-04-26 23:09:14 -07:00
Michael Bolin
3e7f65718b
permissions: require profiles in TUI thread state
2026-04-26 23:09:14 -07:00
Michael Bolin
0966820051
permissions: derive config defaults as profiles
2026-04-26 23:09:14 -07:00
Michael Bolin
5b5bbb0e00
merge commit for archive created by Sapling
2026-04-26 23:03:53 -07:00
Michael Bolin
7e97545589
permissions: store thread sessions as profiles
2026-04-26 23:03:33 -07:00
Michael Bolin
64876306a9
permissions: derive snapshot sandbox projections
2026-04-26 23:03:33 -07:00
Michael Bolin
f1f1786e6d
permissions: make SessionConfigured profile-only
2026-04-26 23:03:33 -07:00
Michael Bolin
19b079277a
permissions: require profiles in TUI thread state
2026-04-26 23:03:33 -07:00
Michael Bolin
bbb9acc9bf
permissions: derive config defaults as profiles
2026-04-26 23:03:33 -07:00
Michael Bolin
d6fc5e9d9a
Merge 4386fc078f into sapling-pr-archive-bolinfest
2026-04-26 22:59:00 -07:00
Michael Bolin
4386fc078f
permissions: store thread sessions as profiles
2026-04-26 22:58:53 -07:00
Michael Bolin
3841eb0c7e
permissions: derive snapshot sandbox projections
2026-04-26 22:58:53 -07:00
Michael Bolin
1e864f319f
permissions: make SessionConfigured profile-only
2026-04-26 22:58:53 -07:00
Michael Bolin
f0b4f01e34
permissions: require profiles in TUI thread state
2026-04-26 22:58:53 -07:00
Michael Bolin
8335dc59fe
permissions: derive config defaults as profiles
2026-04-26 22:58:53 -07:00
Michael Bolin
6f99911001
Merge 14d736712e into sapling-pr-archive-bolinfest
2026-04-26 22:49:55 -07:00
Michael Bolin
14d736712e
permissions: store thread sessions as profiles
2026-04-26 22:45:59 -07:00
Michael Bolin
9facea673a
permissions: derive snapshot sandbox projections
2026-04-26 22:43:07 -07:00
Michael Bolin
23dc42cae4
permissions: make SessionConfigured profile-only
2026-04-26 22:37:58 -07:00
Michael Bolin
6b5373d9b2
permissions: require profiles in TUI thread state
2026-04-26 22:26:28 -07:00
Michael Bolin
f858b35bc1
permissions: derive config defaults as profiles
2026-04-26 22:19:35 -07:00
Michael Bolin
a6ca39c630
permissions: derive legacy exec policies at boundaries ( #19737 )
...
## Why
After config and requirements store canonical profiles, exec requests
should not cache a derived `SandboxPolicy`. The cached legacy value can
drift from the richer profile state, and most execution paths already
have the filesystem and network runtime policies they need.
## What Changed
- Removes `sandbox_policy` from `codex_sandboxing::SandboxExecRequest`
and `codex_core::sandboxing::ExecRequest`.
- Adds an on-demand `ExecRequest::compatibility_sandbox_policy()` helper
for the Windows and legacy call sites that still need a `SandboxPolicy`
projection.
- Updates Windows filesystem override setup and unified exec policy
serialization to derive that compatibility policy at the boundary.
- Updates Unix escalation reruns and direct shell requests to
reconstruct exec requests from `PermissionProfile` plus runtime
filesystem/network policy, without carrying a cached legacy policy.
- Adjusts sandboxing manager tests to assert the effective profile
rather than the removed legacy field.
## Verification
- `cargo check -p codex-config -p codex-core -p codex-sandboxing -p
codex-app-server -p codex-cli -p codex-tui`
- `cargo test -p codex-sandboxing manager`
- `cargo test -p codex-core
exec_server_params_use_env_policy_overlay_contract`
- `cargo test -p codex-core unix_escalation`
- `cargo test -p codex-core exec::tests`
- `cargo test -p codex-core sandboxing::tests`
2026-04-26 22:11:49 -07:00
Michael Bolin
fae2a52811
Merge 397a2250ab into sapling-pr-archive-bolinfest
2026-04-26 21:51:20 -07:00
Michael Bolin
397a2250ab
permissions: derive legacy exec policies at boundaries
2026-04-26 21:51:11 -07:00
Michael Bolin
523e4aa8e3
permissions: constrain requirements as profiles ( #19736 )
2026-04-26 21:49:30 -07:00
Michael Bolin