mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
viyatb-oai
40ad7be2b5
## Why Once a named permission profile is selected, runtime state has to keep that profile identity intact instead of collapsing back to anonymous effective permissions. The session refresh path also needs to rebuild profile-derived network proxy state so active profile switches take effect consistently. ## What changed - Preserve the active permission profile through session updates. - Rebuild profile-derived runtime/network configuration when the active profile changes. - Keep the runtime path aligned with the current session configuration APIs. - Tighten the affected tests, including the Windows delete-pending memory-file case that was intermittently tripping CI. ## Stack 1. **This PR**: runtime/session/network propagation for active permission profiles. 2. [#23708](https://github.com/openai/codex/pull/23708): TUI selection plumbing and guardrail flow. 3. [#21559](https://github.com/openai/codex/pull/21559): profile-aware `/permissions` menu and custom profile display. <img width="1296" height="906" alt="image" src="https://github.com/user-attachments/assets/077fa3a7-80cb-4925-80b1-d2395018d90a" />
85 lines
3.8 KiB
Rust
85 lines
3.8 KiB
Rust
use std::collections::HashMap;
|
|
use std::sync::Arc;
|
|
|
|
use crate::SkillsManager;
|
|
use crate::agent::AgentControl;
|
|
use crate::attestation::AttestationProvider;
|
|
use crate::client::ModelClient;
|
|
use crate::config::NetworkProxyAuditMetadata;
|
|
use crate::config::StartedNetworkProxy;
|
|
use crate::exec_policy::ExecPolicyManager;
|
|
use crate::guardian::GuardianRejection;
|
|
use crate::guardian::GuardianRejectionCircuitBreaker;
|
|
use crate::mcp::McpManager;
|
|
use crate::tools::code_mode::CodeModeService;
|
|
use crate::tools::network_approval::NetworkApprovalService;
|
|
use crate::tools::sandboxing::ApprovalStore;
|
|
use crate::unified_exec::UnifiedExecProcessManager;
|
|
use arc_swap::ArcSwap;
|
|
use arc_swap::ArcSwapOption;
|
|
use codex_analytics::AnalyticsEventsClient;
|
|
use codex_core_plugins::PluginsManager;
|
|
use codex_exec_server::EnvironmentManager;
|
|
use codex_extension_api::ExtensionData;
|
|
use codex_extension_api::ExtensionRegistry;
|
|
use codex_hooks::Hooks;
|
|
use codex_login::AuthManager;
|
|
use codex_mcp::McpConnectionManager;
|
|
use codex_models_manager::manager::SharedModelsManager;
|
|
use codex_otel::SessionTelemetry;
|
|
use codex_rollout::state_db::StateDbHandle;
|
|
use codex_rollout_trace::ThreadTraceContext;
|
|
use codex_thread_store::LiveThread;
|
|
use codex_thread_store::ThreadStore;
|
|
use std::path::PathBuf;
|
|
use tokio::runtime::Handle;
|
|
use tokio::sync::Mutex;
|
|
use tokio::sync::RwLock;
|
|
use tokio::sync::watch;
|
|
use tokio_util::sync::CancellationToken;
|
|
|
|
pub(crate) struct SessionServices {
|
|
pub(crate) mcp_connection_manager: Arc<RwLock<McpConnectionManager>>,
|
|
pub(crate) mcp_startup_cancellation_token: Mutex<CancellationToken>,
|
|
pub(crate) unified_exec_manager: UnifiedExecProcessManager,
|
|
#[cfg_attr(not(unix), allow(dead_code))]
|
|
pub(crate) shell_zsh_path: Option<PathBuf>,
|
|
#[cfg_attr(not(unix), allow(dead_code))]
|
|
pub(crate) main_execve_wrapper_exe: Option<PathBuf>,
|
|
pub(crate) analytics_events_client: AnalyticsEventsClient,
|
|
pub(crate) hooks: ArcSwap<Hooks>,
|
|
pub(crate) rollout_thread_trace: ThreadTraceContext,
|
|
pub(crate) user_shell: Arc<crate::shell::Shell>,
|
|
pub(crate) shell_snapshot_tx: watch::Sender<Option<Arc<crate::shell_snapshot::ShellSnapshot>>>,
|
|
pub(crate) show_raw_agent_reasoning: bool,
|
|
pub(crate) exec_policy: Arc<ExecPolicyManager>,
|
|
pub(crate) auth_manager: Arc<AuthManager>,
|
|
pub(crate) models_manager: SharedModelsManager,
|
|
pub(crate) session_telemetry: SessionTelemetry,
|
|
pub(crate) tool_approvals: Mutex<ApprovalStore>,
|
|
pub(crate) guardian_rejections: Mutex<HashMap<String, GuardianRejection>>,
|
|
pub(crate) guardian_rejection_circuit_breaker: Mutex<GuardianRejectionCircuitBreaker>,
|
|
pub(crate) runtime_handle: Handle,
|
|
pub(crate) skills_manager: Arc<SkillsManager>,
|
|
pub(crate) plugins_manager: Arc<PluginsManager>,
|
|
pub(crate) mcp_manager: Arc<McpManager>,
|
|
pub(crate) extensions: Arc<ExtensionRegistry<crate::config::Config>>,
|
|
pub(crate) session_extension_data: ExtensionData,
|
|
pub(crate) thread_extension_data: ExtensionData,
|
|
pub(crate) agent_control: AgentControl,
|
|
pub(crate) network_proxy: ArcSwapOption<StartedNetworkProxy>,
|
|
pub(crate) network_proxy_audit_metadata: NetworkProxyAuditMetadata,
|
|
pub(crate) managed_network_requirements_configured: bool,
|
|
pub(crate) network_approval: Arc<NetworkApprovalService>,
|
|
pub(crate) state_db: Option<StateDbHandle>,
|
|
pub(crate) live_thread: Option<LiveThread>,
|
|
pub(crate) thread_store: Arc<dyn ThreadStore>,
|
|
pub(crate) attestation_provider: Option<Arc<dyn AttestationProvider>>,
|
|
/// Session-scoped model client shared across turns.
|
|
pub(crate) model_client: ModelClient,
|
|
pub(crate) code_mode_service: CodeModeService,
|
|
/// Shared process-level environment registry. Sessions carry an `Arc` handle so they can pass
|
|
/// the same manager through child-thread spawn paths without reconstructing it.
|
|
pub(crate) environment_manager: Arc<EnvironmentManager>,
|
|
}
|