Adam Perry @ OpenAI 7ece061767 Enforce filesystem permissions when loading AGENTS.md (#39653) ...

## Why

Project instructions must respect the selected environment's filesystem read
permissions. Tightening those permissions for a later turn must not allow
previously cached instructions to reach the model.

## What changed

- Apply each environment's filesystem sandbox while discovering and reading
  `AGENTS.md` files.
- Fail thread or turn setup when sandboxing blocks a discovered instruction
  file, while allowing a restricted project with no instructions to start.
- Clear cached instructions before refresh and include the Windows sandbox
  level in the cache key.
- Ignore inaccessible ancestor marker probes so readable instructions in the
  selected working directory can still load.

## Testing

Added coverage for restricted projects, denied instruction files, cache
invalidation after permissions tighten, and unreadable ancestor markers.

GitOrigin-RevId: 6ea1a27b9c873a6260e4f87d42ae1317a6a4ae4b

2026-08-20 07:48:46 +00:00

..

account_thread_usage.rs

Show estimated thread usage in /status (#38281)

2026-08-13 00:30:08 +00:00

account.rs

Support Edu Plus and Edu Pro account plans (#39316)

2026-08-18 23:47:00 +00:00

analytics.rs

Collect plugin metrics from remote executors (#38283)

2026-08-13 00:39:04 +00:00

app_installed.rs

Remove the workspace settings gate for apps and plugins (#38994)

2026-08-17 12:26:59 +00:00

app_list.rs

Remove the workspace settings gate for apps and plugins (#38994)

2026-08-17 12:26:59 +00:00

app_read.rs

Use thread configuration for app/read (#37891)

2026-08-10 22:39:29 +00:00

attestation.rs

Negotiate MCP extensions per app-server session (#36910)

2026-08-04 15:23:43 +00:00

auto_env.rs

test: add delayed exec-server transport (#31427)

2026-07-09 00:17:38 +00:00

client_metadata.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

code_mode_host.rs

Support gRPC code-mode hosts in app server (#38288)

2026-08-13 01:32:42 +00:00

collaboration_mode_list.rs

test: migrate TestAppServer callers to builder (#31451)

2026-07-08 00:15:49 +00:00

command_exec.rs

Add a feature flag to preserve apply_patch line endings (#37758)

2026-08-10 01:44:30 +00:00

compaction.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

config_rpc.rs

Preserve parent repository discovery through sandbox metadata mounts (#39629)

2026-08-20 06:57:00 +00:00

connection_handling_websocket_unix.rs

[codex] Add user input client ids (#24653)

2026-05-28 14:54:39 -07:00

connection_handling_websocket.rs

Remove app-server's direct reqwest dependency (#39293)

2026-08-18 22:00:25 +00:00

curated_mcp_sync.rs

Isolate automatic plugin Git operations (#39520)

2026-08-19 17:34:00 +00:00

current_time.rs

Tag current time reminders in model context (#38443)

2026-08-13 21:53:52 +00:00

dynamic_tools.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

environment_add.rs

Report selected environment connection transitions (#33251)

2026-07-15 05:21:13 +00:00

environment_info.rs

test: migrate TestAppServer callers to builder (#31451)

2026-07-08 00:15:49 +00:00

environment_status.rs

Expose environment status through app-server (#32920)

2026-07-14 01:49:16 +00:00

exec_server_test_support.rs

[app-server] expose environment info RPC (#30291)

2026-06-27 19:34:10 +00:00

executor_mcp.rs

Remove app-server's direct reqwest dependency (#39293)

2026-08-18 22:00:25 +00:00

executor_skills.rs

Attribute executor skill invocations to plugins (#39309)

2026-08-18 22:53:31 +00:00

experimental_api.rs

Negotiate MCP extensions per app-server session (#36910)

2026-08-04 15:23:43 +00:00

experimental_feature_list.rs

Remove the workspace settings gate for apps and plugins (#38994)

2026-08-17 12:26:59 +00:00

external_agent_config.rs

Stop migrating Cursor sandbox settings (#39325)

2026-08-19 01:06:12 +00:00

external_agent_import_sync.rs

Sync updates to imported external agent sessions (#36356)

2026-07-31 16:17:44 +00:00

feedback.rs

Report diagnostic upload failures (#39287)

2026-08-18 21:46:18 +00:00

fs.rs

test: migrate TestAppServer callers to builder (#31451)

2026-07-08 00:15:49 +00:00

git_attribution.rs

Represent persisted world state as JSON objects (#38274)

2026-08-12 23:56:45 +00:00

guardian_v2.rs

Keep Guardian v2 risk scores in memory (#39304)

2026-08-18 22:37:50 +00:00

hooks_list.rs

Validate linked worktrees before inheriting project trust (#39616)

2026-08-20 06:29:32 +00:00

host_skills.rs

Refresh host skill catalogs through world state (#33425)

2026-07-15 20:59:21 +00:00

imagegen_extension.rs

Expose image generation usage-limit failures (#38024)

2026-08-11 15:40:52 +00:00

initialize.rs

Negotiate MCP extensions per app-server session (#36910)

2026-08-04 15:23:43 +00:00

marketplace_add.rs

Handle @ in local marketplace paths (#34959)

2026-07-23 15:32:36 +00:00

marketplace_remove.rs

Keep marketplace upgrade state out of config (#39595)

2026-08-20 05:24:56 +00:00

marketplace_upgrade.rs

Keep marketplace upgrade state out of config (#39595)

2026-08-20 05:24:56 +00:00

mcp_resource_origin.rs

Scope MCP resource reads by connector (#39244)

2026-08-18 18:01:39 +00:00

mcp_resource.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

mcp_server_elicitation.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

mcp_server_status.rs

Bind MCP OAuth refresh tokens to their issuer (#39615)

2026-08-20 06:25:17 +00:00

mcp_tool.rs

Support MCP form input in full-access user threads (#37864)

2026-08-10 18:20:12 +00:00

memory_reset.rs

Honor the configured SQLite home across state consumers (#34994)

2026-07-23 19:19:35 +00:00

misalignment_policy.rs

Surface misalignment policy violations as typed errors (#38682)

2026-08-15 01:34:33 +00:00

mod.rs

Enforce managed residency for model providers (#39645)

2026-08-20 07:33:27 +00:00

model_auto_review.rs

Restore permission profiles when resuming threads (#39153)

2026-08-18 06:22:04 +00:00

model_list.rs

Enable parallel tool calls for all model prompts (#38499)

2026-08-14 05:49:33 +00:00

model_provider_capabilities_read.rs

Add an Amazon Bedrock Runtime provider (#38470)

2026-08-14 01:23:59 +00:00

multi_agent_v2_developer_instructions.rs

Allow agent roles on full-history forks (#37252)

2026-08-06 10:27:33 +00:00

otel.rs

Reload app-server telemetry after account changes (#37339)

2026-08-07 00:28:32 +00:00

output_schema.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

permission_profile_list.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

plan_item.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

plugin_install.rs

Remove the workspace settings gate for apps and plugins (#38994)

2026-08-17 12:26:59 +00:00

plugin_list.rs

Prevent marketplace identity spoofing (#39165)

2026-08-18 07:56:41 +00:00

plugin_read.rs

Prevent marketplace identity spoofing (#39165)

2026-08-18 07:56:41 +00:00

plugin_search.rs

Merge local plugins into plugin search results (#36919)

2026-08-04 16:16:30 +00:00

plugin_share.rs

Expose plugin installation timestamps in app-server summaries (#35859)

2026-07-29 01:16:29 +00:00

plugin_uninstall.rs

Run plugin app-server tests in automatic environments (#38189)

2026-08-12 13:33:01 +00:00

process_exec.rs

Prevent launch context from reaching child processes (#37607)

2026-08-08 16:58:26 +00:00

projects.rs

Add experimental app-server project APIs (#38940)

2026-08-17 04:01:37 +00:00

rate_limit_reset_credits.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

rate_limits.rs

Support Edu Plus and Edu Pro account plans (#39316)

2026-08-18 23:47:00 +00:00

realtime_conversation.rs

Add a realtime delegation acknowledgement control (#36413)

2026-08-01 01:17:26 +00:00

recommended_plugins.rs

Hydrate recommended plugin metadata on selection (#39143)

2026-08-18 05:42:39 +00:00

remote_control.rs

Exit the stdio app-server when its connection closes (#36035)

2026-07-29 22:00:20 +00:00

remote_thread_store.rs

Add experimental app-server project APIs (#38940)

2026-08-17 04:01:37 +00:00

request_permissions.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

request_user_input.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

request_validation.rs

Reject obsolete app-server permission profile fields (#38919)

2026-08-17 00:25:19 +00:00

residency.rs

Enforce managed residency for model providers (#39645)

2026-08-20 07:33:27 +00:00

review.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

rollout_migration.rs

Add rollout migration tooling and background migration (#37348)

2026-08-07 01:26:42 +00:00

safety_check_downgrade.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

selected_capability_stack.rs

Read executor skill packages directly (#38167)

2026-08-12 10:34:25 +00:00

selected_environment.rs

Preserve executor paths in read command actions (#36223)

2026-07-30 21:12:41 +00:00

server_diagnostics.rs

Expose runtime activity in server diagnostics (#37486)

2026-08-07 18:38:24 +00:00

session_end.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

skills_list.rs

Allow config reads to join active app-server read batches (#39036)

2026-08-17 17:28:37 +00:00

sleep.rs

Refresh environment dates from the configured clock (#36187)

2026-07-30 16:44:18 +00:00

thread_archive.rs

Track thread archive analytics (#37199)

2026-08-06 02:30:18 +00:00

thread_delete.rs

Enforce writer ownership for thread archive and deletion (#35031)

2026-07-23 23:18:06 +00:00

thread_fork.rs

Restore permission profiles when resuming threads (#39153)

2026-08-18 06:22:04 +00:00

thread_inject_items.rs

Track client-authored developer messages in rollout history (#38243)

2026-08-12 20:05:49 +00:00

thread_list.rs

Add experimental app-server project APIs (#38940)

2026-08-17 04:01:37 +00:00

thread_loaded_list.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

thread_memory_mode_set.rs

Honor the configured SQLite home across state consumers (#34994)

2026-07-23 19:19:35 +00:00

thread_metadata_update.rs

Persist thread section moves before the first turn (#39523)

2026-08-19 17:57:40 +00:00

thread_name_websocket.rs

Restore app-server websocket listener with auth guard (#22404)

2026-05-12 18:40:53 -07:00

thread_queue.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

thread_read.rs

Add async delivery metadata to agent messages (#39312)

2026-08-18 23:05:52 +00:00

thread_resume.rs

Add async delivery metadata to agent messages (#39312)

2026-08-18 23:05:52 +00:00

thread_revert.rs

Add app-server support for reverting paginated threads (#38440)

2026-08-13 21:45:02 +00:00

thread_rollback.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

thread_sections.rs

Add appearance metadata to thread sections (#37898)

2026-08-10 23:32:42 +00:00

thread_settings_update.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

thread_shell_command.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

thread_start.rs

Enforce filesystem permissions when loading AGENTS.md (#39653)

2026-08-20 07:48:46 +00:00

thread_status.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

thread_unarchive.rs

Add appearance metadata to thread sections (#37898)

2026-08-10 23:32:42 +00:00

thread_unsubscribe.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

turn_interrupt.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

turn_start_zsh_fork.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

turn_start.rs

Enforce filesystem permissions when loading AGENTS.md (#39653)

2026-08-20 07:48:46 +00:00

turn_steer.rs

Simplify app-server integration test setup (#34786)

2026-07-22 16:30:12 +00:00

view_image.rs

Allow disabling the built-in image viewer (#36966)

2026-08-04 20:10:31 +00:00

web_search.rs

Allow custom providers to opt into standalone web search (#34846)

2026-07-23 00:02:15 +00:00

windows_sandbox_setup.rs

test: migrate TestAppServer callers to builder (#31451)

2026-07-08 00:15:49 +00:00