sayan-oai e38290846c Enforce environment-specific command policies (#38942) ...

## What changed

- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.

## Testing

- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.

GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d

2026-08-17 04:37:50 +00:00

..

amend.rs

[codex] reduce module visibility (#16978)

2026-04-07 08:03:35 -07:00

decision.rs

…

error.rs

…

execpolicycheck.rs

…

executable_name.rs

…

lib.rs

Move requirements policy ownership to execpolicy (#38899)

2026-08-16 20:27:05 +00:00

main.rs

[codex] reduce module visibility (#16978)

2026-04-07 08:03:35 -07:00

parser.rs

deps: update starlark to 0.14.2 (#24820)

2026-06-07 17:35:33 -07:00

policy.rs

Enforce environment-specific command policies (#38942)

2026-08-17 04:37:50 +00:00

rule.rs

…

sandbox_migration_tests.rs

Migrate legacy exec policy allow rules (#34271)

2026-07-20 06:13:29 +00:00

sandbox_migration.rs

Migrate legacy exec policy allow rules (#34271)

2026-07-20 06:13:29 +00:00