codex

mirror of https://github.com/openai/codex.git synced 2026-09-17 12:23:33 +00:00

Files

Eric Traut ede5247893 Reject lossy legacy permission projections (#39117 )

## Why

Some managed filesystem permission profiles cannot be represented by the
legacy app-server sandbox policy without changing which paths are accessible.

## What changed

- Require legacy sandbox conversion to preserve the filesystem policy's
  semantics, and reject unsupported profiles with an actionable error.
- Keep queued follow-up messages and safety-buffered retries intact when
  permissions are rejected, resuming queued input only after a compatible
  profile is selected.
- Cover compatible profiles, lossy restrictions and write roots, turn-start
  handling, and safety-buffered retries with regression tests.

GitOrigin-RevId: 345cc2a839206b2b1997e8981feb59f91b6975cc

2026-08-18 01:00:48 +00:00