mirror of
https://github.com/openai/codex.git
synced 2026-09-16 12:13:30 +00:00
eb078b4f44
## Why Permission requests can originate in an environment whose path convention differs from the Codex host. Requiring the request working directory to be host-native prevents those requests from reaching interactive approval. ## What changed - Carry the request `cwd` as a `LegacyAppPathString` through core events and the app-server protocol so the target environment's native representation is preserved. - Convert the preserved value back to a `PathUri` when materializing permission grants. - Regenerate the JSON and TypeScript protocol schemas for the updated `cwd` type. ## Testing - Exercise the app-server permission request round trip with a target-native working directory across host path conventions. - Verify remote permission requests retain their environment working directory and granted access still unblocks later execution. GitOrigin-RevId: 97dc9707d9048883d20bab1b69c93871039f3188
100 lines
3.1 KiB
Rust
100 lines
3.1 KiB
Rust
use crate::models::AdditionalPermissionProfile;
|
|
use crate::models::FileSystemPermissions;
|
|
use crate::models::NetworkPermissions;
|
|
use codex_utils_path_uri::LegacyAppPathString;
|
|
use schemars::JsonSchema;
|
|
use serde::Deserialize;
|
|
use serde::Serialize;
|
|
use ts_rs::TS;
|
|
|
|
#[derive(Debug, Clone, Copy, Default, Deserialize, Serialize, PartialEq, Eq, JsonSchema, TS)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub enum PermissionGrantScope {
|
|
#[default]
|
|
Turn,
|
|
Session,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, Eq, JsonSchema, TS)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct RequestPermissionProfile {
|
|
pub network: Option<NetworkPermissions>,
|
|
pub file_system: Option<FileSystemPermissions>,
|
|
}
|
|
|
|
impl RequestPermissionProfile {
|
|
pub fn is_empty(&self) -> bool {
|
|
self.network.is_none() && self.file_system.is_none()
|
|
}
|
|
}
|
|
|
|
impl From<RequestPermissionProfile> for AdditionalPermissionProfile {
|
|
fn from(value: RequestPermissionProfile) -> Self {
|
|
Self {
|
|
network: value.network,
|
|
file_system: value.file_system,
|
|
}
|
|
}
|
|
}
|
|
|
|
impl From<AdditionalPermissionProfile> for RequestPermissionProfile {
|
|
fn from(value: AdditionalPermissionProfile) -> Self {
|
|
Self {
|
|
network: value.network,
|
|
file_system: value.file_system,
|
|
}
|
|
}
|
|
}
|
|
|
|
#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, JsonSchema, TS)]
|
|
pub struct RequestPermissionsArgs {
|
|
#[serde(
|
|
default,
|
|
rename = "environment_id",
|
|
alias = "environmentId",
|
|
skip_serializing_if = "Option::is_none"
|
|
)]
|
|
#[ts(optional)]
|
|
pub environment_id: Option<String>,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub reason: Option<String>,
|
|
pub permissions: RequestPermissionProfile,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, JsonSchema, TS)]
|
|
pub struct RequestPermissionsResponse {
|
|
pub permissions: RequestPermissionProfile,
|
|
#[serde(default)]
|
|
pub scope: PermissionGrantScope,
|
|
/// Review subsequent commands in this turn unless a permission hook resolves the request.
|
|
#[serde(default, skip_serializing_if = "std::ops::Not::not")]
|
|
pub strict_auto_review: bool,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, JsonSchema, TS)]
|
|
pub struct RequestPermissionsEvent {
|
|
/// Responses API call id for the associated tool call, if available.
|
|
pub call_id: String,
|
|
/// Turn ID that this request belongs to.
|
|
/// Uses `#[serde(default)]` for backwards compatibility.
|
|
#[serde(default)]
|
|
pub turn_id: String,
|
|
#[serde(
|
|
default,
|
|
rename = "environmentId",
|
|
alias = "environment_id",
|
|
skip_serializing_if = "Option::is_none"
|
|
)]
|
|
#[ts(optional)]
|
|
#[ts(rename = "environmentId")]
|
|
pub environment_id: Option<String>,
|
|
#[ts(type = "number")]
|
|
pub started_at_ms: i64,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub reason: Option<String>,
|
|
pub permissions: RequestPermissionProfile,
|
|
#[serde(default, skip_serializing_if = "Option::is_none")]
|
|
#[ts(optional)]
|
|
pub cwd: Option<LegacyAppPathString>,
|
|
}
|