ioanbudea-OAI 0e6f153732 Derive sandbox telemetry labels directly from permission profiles (#60500) ...

## What changed

Compute the `sandbox_policy` label for `codex.conversation_starts` from the effective `PermissionProfile` without constructing a legacy `SandboxPolicy`. Preserve the historical labels and native-path compatibility fallbacks, including `workspace-write` for writable profiles that cannot be represented by a legacy policy.

Share the full-disk write compatibility check with session startup and the write-intent check with legacy policy conversion.

## Testing

Extend telemetry tests to assert sandbox labels in both logs and traces across disabled, external, read-only, workspace-write, and full-disk profiles, including unrenderable writable URIs and read restrictions. Add protocol assertions for legacy write-intent detection.

GitOrigin-RevId: 00f11d763c366453e7bb0899546a4ebbdb93c4d5

2026-11-10 02:31:50 +00:00

..

harness

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

suite

Derive sandbox telemetry labels directly from permission profiles (#60500)

2026-11-10 02:31:50 +00:00

tests.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00