Michael Bolin 3ef09c71d3 core tests: migrate tools tests to permission profiles (#20027) ...

## Summary

This continues the test-side migration away from `SandboxPolicy` by
removing the remaining legacy policy setup in
`core/tests/suite/tools.rs`. The affected test was already modeling a
profile-backed filesystem policy with a deny-read glob, so configuring
the test through `Permissions::set_permission_profile()` is a better
match for the behavior being exercised.

## Changes

- Drops the `SandboxPolicy` import from `core/tests/suite/tools.rs`.
- Configures the glob deny-read shell test directly with a
`PermissionProfile` instead of creating a legacy read-only policy first.
- Submits the test turn with the session permission profile so the
deny-read glob remains active for the command under test.

## Verification

- `cargo check -p codex-core --tests`

2026-04-28 17:11:43 -07:00

..

snapshots

Update image outputs to default to high detail (#18386)

2026-04-18 11:01:12 -07:00

abort_tasks.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00

agent_jobs.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

agent_websocket.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

agents_md.rs

Run exec-server fs operations through sandbox helper (#17294)

2026-04-12 18:36:03 -07:00

apply_patch_cli.rs

permissions: remove legacy read-only access modes (#19449)

2026-04-24 17:16:58 -07:00

approvals.rs

permissions: add built-in default profiles (#19900)

2026-04-28 11:21:39 -07:00

cli_stream.rs

Remove OPENAI_BASE_URL config fallback (#16720)

2026-04-03 15:03:21 -07:00

client_websockets.rs

[codex-analytics] include user agent in default headers (#17689)

2026-04-27 21:32:10 -07:00

client.rs

feat: verify agent identity JWTs with JWKS (#19764)

2026-04-28 09:56:20 -07:00

code_mode.rs

core tests: configure profiles directly (#20015)

2026-04-28 17:06:59 -07:00

codex_delegate.rs

core tests: configure profiles directly (#20015)

2026-04-28 17:06:59 -07:00

collaboration_instructions.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

compact_remote.rs

fix: filter dynamic deferred tools from model_visible_specs (#19771)

2026-04-27 19:09:02 +00:00

compact_resume_fork.rs

Remove ghost snapshots (#19481)

2026-04-27 18:48:57 -07:00

compact.rs

Delete unused ResponseItem::Message.end_turn (#19605)

2026-04-26 17:18:09 -07:00

deprecation_notice.rs

[codex] Move config loading into codex-config (#19487)

2026-04-26 15:10:53 -07:00

exec_policy.rs

tui: carry permission profiles on user turns (#18285)

2026-04-23 11:54:17 -07:00

exec.rs

core tests: migrate more turns to permission profiles (#20013)

2026-04-28 17:05:53 -07:00

fork_thread.rs

Migrate fork and resume reads to thread store (#18900)

2026-04-24 13:51:37 -07:00

hierarchical_agents.rs

Run exec-server fs operations through sandbox helper (#17294)

2026-04-12 18:36:03 -07:00

hooks_mcp.rs

Support MCP tools in hooks (#18385)

2026-04-23 07:33:57 +00:00

hooks.rs

Discover hooks bundled with plugins (#19705)

2026-04-28 14:17:18 -07:00

image_rollout.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

items.rs

core tests: migrate plan item turns to profiles (#20026)

2026-04-28 17:11:17 -07:00

json_result.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

live_cli.rs

feat: introduce codex-utils-cargo-bin as an alternative to assert_cmd::Command (#8496)

2025-12-23 19:29:32 -08:00

live_reload.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

mod.rs

feat: split memories part 2 (#19860)

2026-04-28 13:03:28 +02:00

model_overrides.rs

app-server: accept permission profile overrides (#18279)

2026-04-22 13:34:33 -07:00

model_switching.rs

core tests: migrate model/personality turns to profiles (#20018)

2026-04-28 17:09:12 -07:00

model_visible_layout.rs

core tests: configure profiles directly (#20015)

2026-04-28 17:06:59 -07:00

models_cache_ttl.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

models_etag_responses.rs

core tests: migrate more turns to permission profiles (#20013)

2026-04-28 17:05:53 -07:00

openai_file_mcp.rs

core tests: submit turns with permission profiles (#20010)

2026-04-28 23:01:40 +00:00

otel.rs

core tests: configure profiles directly (#20015)

2026-04-28 17:06:59 -07:00

override_updates.rs

app-server: accept permission profile overrides (#18279)

2026-04-22 13:34:33 -07:00

pending_input.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

permissions_messages.rs

[codex] Move config loading into codex-config (#19487)

2026-04-26 15:10:53 -07:00

personality_migration.rs

Update models.json (#18586)

2026-04-20 10:27:01 -07:00

personality.rs

core tests: migrate model/personality turns to profiles (#20018)

2026-04-28 17:09:12 -07:00

plugins.rs

Stabilize plugin MCP fixture tests (#19452)

2026-04-28 01:14:44 +00:00

prompt_caching.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

prompt_debug_tests.rs

Delete unused ResponseItem::Message.end_turn (#19605)

2026-04-26 17:18:09 -07:00

quota_exceeded.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00

realtime_conversation.rs

Delete unused ResponseItem::Message.end_turn (#19605)

2026-04-26 17:18:09 -07:00

remote_env.rs

permissions: remove legacy read-only access modes (#19449)

2026-04-24 17:16:58 -07:00

remote_models.rs

core tests: send model turns with permission profiles (#20016)

2026-04-28 17:08:04 -07:00

request_compression.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00

request_permissions_tool.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

request_permissions.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

request_user_input.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

responses_api_proxy_headers.rs

core tests: send model turns with permission profiles (#20016)

2026-04-28 17:08:04 -07:00

resume_warning.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

resume.rs

app-server: accept permission profile overrides (#18279)

2026-04-22 13:34:33 -07:00

review.rs

Delete unused ResponseItem::Message.end_turn (#19605)

2026-04-26 17:18:09 -07:00

rmcp_client.rs

Remove js_repl feature (#19410)

2026-04-24 17:49:29 -07:00

rollout_list_find.rs

chore: merge name and title (#17116)

2026-04-09 18:44:26 +01:00

safety_check_downgrade.rs

core tests: migrate safety check turns to profiles (#20024)

2026-04-28 17:10:42 -07:00

search_tool.rs

core tests: submit turns with permission profiles (#20010)

2026-04-28 23:01:40 +00:00

shell_command.rs

Update models.json (#18586)

2026-04-20 10:27:01 -07:00

shell_serialization.rs

core tests: submit turns with permission profiles (#20010)

2026-04-28 23:01:40 +00:00

shell_snapshot.rs

core tests: migrate more turns to permission profiles (#20013)

2026-04-28 17:05:53 -07:00

skill_approval.rs

tui: carry permission profiles on user turns (#18285)

2026-04-23 11:54:17 -07:00

skills.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

spawn_agent_description.rs

feat: let model providers own model discovery (#18950)

2026-04-24 04:28:25 +00:00

sqlite_state.rs

core tests: migrate more turns to permission profiles (#20013)

2026-04-28 17:05:53 -07:00

stream_error_allows_next_turn.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00

stream_no_completed.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00

subagent_notifications.rs

feat: drop spawned-agent context instructions (#19127)

2026-04-23 18:54:45 +02:00

tool_harness.rs

core tests: migrate more turns to permission profiles (#20013)

2026-04-28 17:05:53 -07:00

tool_parallelism.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

tool_suggest.rs

core tests: submit turns with permission profiles (#20010)

2026-04-28 23:01:40 +00:00

tools.rs

core tests: migrate tools tests to permission profiles (#20027)

2026-04-28 17:11:43 -07:00

truncation.rs

core tests: submit turns with permission profiles (#20010)

2026-04-28 23:01:40 +00:00

turn_state.rs

Stabilize websocket response.failed error delivery (#14017)

2026-03-11 12:33:09 -07:00

undo.rs

Remove ghost snapshots (#19481)

2026-04-27 18:48:57 -07:00

unified_exec.rs

permissions: store only constrained permission profiles (#19735)

2026-04-26 20:59:58 -07:00

unstable_features_warning.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

user_notification.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00

user_shell_cmd.rs

core tests: configure profiles directly (#20015)

2026-04-28 17:06:59 -07:00

view_image.rs

core tests: migrate view image turns to profiles (#20021)

2026-04-28 17:09:48 -07:00

web_search.rs

core tests: submit turns with permission profiles (#20010)

2026-04-28 23:01:40 +00:00

websocket_fallback.rs

core tests: build user turns from permission profiles (#20011)

2026-04-28 17:03:20 -07:00

window_headers.rs

Add turn-scoped environment selections (#18416)

2026-04-21 17:48:33 -07:00