ioanbudea-OAI d3fc4a73b0 Compare resume sandbox overrides using permission profile labels (#61136) ...

## What changed

Use `legacy_sandbox_policy_label` from the active permission profile to check sandbox overrides when resuming a loaded thread. Continue accepting `external-sandbox` for `danger-full-access` requests, and construct the legacy sandbox policy only when reporting a mismatch.

GitOrigin-RevId: 0f923323394692d2e1f39bafe637c70ce305dc3d

2026-11-12 14:46:17 +00:00

..

bin

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

external_agent_migration

Use typed context window IDs throughout thread persistence (#60757)

2026-11-11 08:16:52 +00:00

request_processors

Compare resume sandbox overrides using permission profile labels (#61136)

2026-11-12 14:46:17 +00:00

account_notifications_tests.rs

Add scoped leases for persisted account OAuth grants (#55546)

2026-10-20 11:48:54 +00:00

account_notifications.rs

Expose selected workspace routing in app-server account reads (#45529)

2026-09-14 22:31:32 +00:00

analytics_utils.rs

Use runtime authentication across backend request paths (#59572)

2026-11-05 05:09:32 +00:00

app_info.rs

Use batch metadata for plugin app summaries (#34851)

2026-07-23 01:00:35 +00:00

app_server_tracing.rs

Reduce app-server JSON serialization overhead (#34761)

2026-07-22 14:16:51 +00:00

application_network_tests.rs

Apply shared network policy throughout embedded Codex startup (#47411)

2026-09-23 00:49:19 +00:00

application_network.rs

Clarify config loader APIs and share interactive login setup (#57169)

2026-10-26 18:05:05 +00:00

attestation.rs

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

auth_mode.rs

Support managed AWS access keys for Amazon Bedrock (#40481)

2026-08-24 21:39:48 +00:00

bespoke_event_handling.rs

Reset app-server turn summaries when a turn starts (#60434)

2026-11-09 19:28:34 +00:00

code_mode_host_tests.rs

Remove WebSocket transport from code-mode hosts (#40692)

2026-08-25 20:37:15 +00:00

code_mode_host.rs

Remove WebSocket transport from code-mode hosts (#40692)

2026-08-25 20:37:15 +00:00

codex_home_metrics.rs

Limit app-server storage metrics to session directories (#43790)

2026-09-08 10:18:59 +00:00

command_exec.rs

Support close-on-exec attachments without changing PTY semantics (#47797)

2026-09-24 09:25:19 +00:00

config_layer.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

config_manager_provider_tests.rs

Keep threads on their saved model provider when defaults change (#59503)

2026-11-04 22:20:18 +00:00

config_manager_service_credential_edits.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

config_manager_service_model_providers.rs

Add model provider configuration writes to the app-server (#58876)

2026-11-02 12:22:22 +00:00

config_manager_service_provider_setup.rs

Add experimental GCP account setup to the app server (#57394)

2026-10-27 08:06:10 +00:00

config_manager_service_provider_write.rs

Allow creating custom providers during sign-in (#60186)

2026-11-07 23:51:58 +00:00

config_manager_service_tests.rs

Add refreshable headers for OTLP HTTP exporters (#61028)

2026-11-12 05:21:30 +00:00

config_manager_service.rs

Add web search provider metadata and configuration (#59033)

2026-11-03 01:58:18 +00:00

config_manager.rs

Keep threads on their saved model provider when defaults change (#59503)

2026-11-04 22:20:18 +00:00

connection_cleanup.rs

fix(app-server): avoid blocking connection cleanup (#26852)

2026-06-08 10:20:54 -07:00

connection_rpc_gate.rs

Bind remote-control sessions to their authentication owner (#44341)

2026-09-09 23:59:14 +00:00

current_time.rs

[app-server] increase currentTime/read timeout (#30384)

2026-06-27 16:42:03 -07:00

daemon_thread_recovery.rs

Continue interrupted work after managed daemon restarts (#45820)

2026-09-16 00:54:58 +00:00

dynamic_tools.rs

Add audio output support to dynamic tools and code mode (#34080)

2026-07-18 23:22:13 +00:00

effective_plugin_change_tests.rs

Refresh runtimes for remote plugin state changes (#41396)

2026-08-28 19:12:34 +00:00

effective_plugin_change.rs

Trace MCP refresh causes and plugin metadata changes (#60505)

2026-11-10 02:45:30 +00:00

error_code.rs

Explain session creation failures during server shutdown (#52721)

2026-10-09 23:16:46 +00:00

extensions.rs

Move agent message board host integration to app-server (#59162)

2026-11-03 13:38:59 +00:00

external_auth.rs

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

filters.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

fs_watch.rs

Fix fs/watch debounce batching (#24716)

2026-05-28 23:09:55 -07:00

fuzzy_file_search.rs

Simple directory mentions (#14970)

2026-03-19 05:24:09 +00:00

gateway_oauth_notifications.rs

Add device authorization to app-server gateway OAuth (#60486)

2026-11-10 01:28:45 +00:00

image_url.rs

[codex] reject remote images at app-server ingress (#29419)

2026-06-23 00:43:56 +00:00

in_process_bootstrap_tests.rs

Route FedRAMP API keys to government endpoints by default (#57178)

2026-10-26 18:20:30 +00:00

in_process_bootstrap.rs

Route FedRAMP API keys to government endpoints by default (#57178)

2026-10-26 18:20:30 +00:00

in_process.rs

Wait for the in-process initialization handshake to finish (#60871)

2026-11-11 22:30:35 +00:00

lib_tests.rs

Consolidate Rust unit tests under dedicated test modules (#56247)

2026-10-22 19:36:47 +00:00

lib.rs

Keep thread storage available when diagnostic logs fail (#60466)

2026-11-09 23:22:08 +00:00

log_write_warning_tests.rs

Warn users when SQLite diagnostic log writes fail (#47887)

2026-09-24 17:04:50 +00:00

log_write_warning.rs

Warn users when SQLite diagnostic log writes fail (#47887)

2026-09-24 17:04:50 +00:00

main_tests.rs

Remove WebSocket transport from code-mode hosts (#40692)

2026-08-25 20:37:15 +00:00

main.rs

Add frozen cloud skill snapshots to the app server (#55631)

2026-10-20 17:01:52 +00:00

managed_daemon.rs

Raise the managed app-server file descriptor limit on Unix (#51470)

2026-10-06 19:51:15 +00:00

mcp_refresh.rs

Respect turn filesystem permissions during executor skill discovery (#59291)

2026-11-04 02:00:01 +00:00

message_processor_gateway_oauth_tests.rs

Add device authorization to app-server gateway OAuth (#60486)

2026-11-10 01:28:45 +00:00

message_processor_thread_lifecycle_tests.rs

Add managed command checkpoints requiring fresh human approval (#58045)

2026-10-29 11:23:51 +00:00

message_processor_tracing_tests.rs

Use runtime authentication across backend request paths (#59572)

2026-11-05 05:09:32 +00:00

message_processor_workspace_routing_tests.rs

Expose ChatGPT user IDs in account/read responses (#60004)

2026-11-06 22:27:47 +00:00

message_processor.rs

Hand off approved plans through attachments in fresh sessions (#60763)

2026-11-11 09:01:04 +00:00

model_catalog.rs

Preserve first-party catalog display order in app-server model lists (#60525)

2026-11-10 05:08:19 +00:00

models_refresh_worker_tests.rs

Wire shared runtime authentication through threads and API clients (#59177)

2026-11-03 15:02:57 +00:00

models_refresh_worker.rs

Enforce current provider requirements for the model catalog (#46917)

2026-09-21 01:19:40 +00:00

models.rs

Remove legacy personality template metadata (#51223)

2026-10-06 01:46:33 +00:00

notification_media.rs

Broadcast thread section changes to connected clients (#58380)

2026-10-30 16:09:46 +00:00

otel_config.rs

Add an option to disable successful SSE delta logs (#58034)

2026-10-29 10:34:17 +00:00

otel_reloader.rs

Fix trace exporter activation after account switches (#57657)

2026-10-28 06:22:58 +00:00

outgoing_message.rs

Resolve network approval prompts when their requests end (#58350)

2026-10-30 14:40:32 +00:00

plugin_config_reload.rs

Keep global app-server config independent of the launch directory (#51872)

2026-10-07 23:19:26 +00:00

request_processors.rs

Preserve inherited previews for paginated thread forks (#60559)

2026-11-10 08:52:02 +00:00

request_serialization.rs

Include environment hooks in thread hook listings (#56553)

2026-10-23 18:39:28 +00:00

server_request_error.rs

…

skills_watcher.rs

Stop re-exporting skill APIs from codex-core (#37984)

2026-08-11 10:43:11 +00:00

startup_config.rs

Clarify config loader APIs and share interactive login setup (#57169)

2026-10-26 18:05:05 +00:00

startup_warnings.rs

Surface automatic marketplace update failures as startup warnings (#57166)

2026-10-26 17:56:43 +00:00

stderr_logging_tests.rs

Consolidate Rust unit tests under dedicated test modules (#56247)

2026-10-22 19:36:47 +00:00

thread_sample_cancel_context_tests.rs

Add cancellation for experimental thread samples (#55441)

2026-10-20 03:09:44 +00:00

thread_sample.rs

Allow sampling in-progress turns with thread/sample (#60620)

2026-11-10 16:31:52 +00:00

thread_state.rs

Support environment updates in app-server settings APIs (#60655)

2026-11-10 20:35:28 +00:00

thread_status.rs

Release app-server thread runtimes after shutdown (#57788)

2026-10-28 16:55:57 +00:00

transport_tests.rs

Avoid redundant clones when sending app-server notifications (#55723)

2026-10-21 01:49:26 +00:00

transport.rs

Avoid redundant clones when sending app-server notifications (#55723)

2026-10-21 01:49:26 +00:00

turn_admission_tests.rs

Add experimental ChatGPT workspace switching to app-server (#57514)

2026-10-27 17:04:16 +00:00

turn_admission.rs

Add experimental ChatGPT workspace switching to app-server (#57514)

2026-10-27 17:04:16 +00:00

turn_cost_worker_chatgpt_tests.rs

Emit turn cost telemetry for ChatGPT sessions (#41944)

2026-09-01 00:30:55 +00:00

turn_cost_worker_chatgpt.rs

Use runtime authentication across backend request paths (#59572)

2026-11-05 05:09:32 +00:00

turn_cost_worker_runtime_auth_tests.rs

Use runtime authentication across backend request paths (#59572)

2026-11-05 05:09:32 +00:00

turn_cost_worker_tests.rs

Use runtime authentication across backend request paths (#59572)

2026-11-05 05:09:32 +00:00

turn_cost_worker.rs

Use runtime authentication across backend request paths (#59572)

2026-11-05 05:09:32 +00:00

user_verification_activation_tests.rs

Preserve metadata in native user verification requests (#46952)

2026-09-21 07:01:52 +00:00

user_verification_adapter_tests.rs

Add user-verification provider abstractions and RPC adapters (#43547)

2026-09-07 18:43:20 +00:00

user_verification_adapter.rs

Add user-verification provider abstractions and RPC adapters (#43547)

2026-09-07 18:43:20 +00:00

user_verification_auth.rs

Enable user verification for the bundled TUI on supported devices (#43715)

2026-09-08 05:57:24 +00:00

user_verification_cancel_context_tests.rs

Report biometric type in user verification responses (#60948)

2026-11-12 00:44:27 +00:00

user_verification_cancel_tests.rs

Add cancellation for native user-verification RPCs (#43925)

2026-09-08 21:48:53 +00:00

user_verification_connection_tests.rs

Preserve metadata in native user verification requests (#46952)

2026-09-21 07:01:52 +00:00

user_verification_ownership_tests.rs

Preserve metadata in native user verification requests (#46952)

2026-09-21 07:01:52 +00:00

user_verification_response_tests.rs

Preserve diagnostic reasons for MCP user verification failures (#51808)

2026-10-07 19:28:14 +00:00

user_verification_response.rs

Preserve diagnostic reasons for MCP user verification failures (#51808)

2026-10-07 19:28:14 +00:00

user_verification_rpc_tests.rs

Report biometric type in user verification responses (#60948)

2026-11-12 00:44:27 +00:00

user_verification_test_support.rs

Report biometric type in user verification responses (#60948)

2026-11-12 00:44:27 +00:00

user_verification_tests.rs

Report biometric type in user verification responses (#60948)

2026-11-12 00:44:27 +00:00

user_verification.rs

Report biometric type in user verification responses (#60948)

2026-11-12 00:44:27 +00:00