app-server: accept permission profile overrides (#18279)

## Why `PermissionProfile` is becoming the canonical permissions shape shared by core and app-server. After app-server responses expose the active profile, clients need to be able to send that same shape back when starting, resuming, forking, or overriding a turn instead of translating through the legacy `sandbox`/`sandboxPolicy` shorthands. This still needs to preserve the existing requirements/platform enforcement model. A profile-shaped request can be downgraded or rejected by constraints, but the server should keep the user's elevated-access intent for project trust decisions. Turn-level profile overrides also need to retain existing read protections, including deny-read entries and bounded glob-scan metadata, so a permission override cannot accidentally drop configured protections such as `**/*.env = deny`. ## What changed - Adds optional `permissionProfile` request fields to `thread/start`, `thread/resume`, `thread/fork`, and `turn/start`. - Rejects ambiguous requests that specify both `permissionProfile` and the legacy `sandbox`/`sandboxPolicy` fields, including running-thread resume requests. - Converts profile-shaped overrides into core runtime filesystem/network permissions while continuing to derive the constrained legacy sandbox projection used by existing execution paths. - Preserves project-trust intent for profile overrides that are equivalent to workspace-write or full-access sandbox requests. - Preserves existing deny-read entries and `globScanMaxDepth` when applying turn-level `permissionProfile` overrides. - Updates app-server docs plus generated JSON/TypeScript schema fixtures and regression coverage. ## Verification - `cargo test -p codex-app-server-protocol schema_fixtures` - `cargo test -p codex-core session_configuration_apply_permission_profile_preserves_existing_deny_read_entries` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18279). * #18288 * #18287 * #18286 * #18285 * #18284 * #18283 * #18282 * #18281 * #18280 * __->__ #18279
2026-04-29 08:56:38 +00:00 · 2026-04-22 13:34:33 -07:00
parent ed4def8286
commit 18a26d7bbc
46 changed files with 2425 additions and 59 deletions
--- a/codex-rs/core/tests/suite/collaboration_instructions.rs
+++ b/codex-rs/core/tests/suite/collaboration_instructions.rs
@@ -128,6 +128,7 @@ async fn user_input_includes_collaboration_instructions_after_override() -> Resu
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -229,6 +230,7 @@ async fn override_then_next_turn_uses_updated_collaboration_instructions() -> Re
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -283,6 +285,7 @@ async fn user_turn_overrides_collaboration_instructions_after_override() -> Resu
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -355,6 +358,7 @@ async fn collaboration_mode_update_emits_new_instruction_message() -> Result<()>
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -384,6 +388,7 @@ async fn collaboration_mode_update_emits_new_instruction_message() -> Result<()>
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -442,6 +447,7 @@ async fn collaboration_mode_update_noop_does_not_append() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -471,6 +477,7 @@ async fn collaboration_mode_update_noop_does_not_append() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -528,6 +535,7 @@ async fn collaboration_mode_update_emits_new_instruction_message_when_mode_chang
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -560,6 +568,7 @@ async fn collaboration_mode_update_emits_new_instruction_message_when_mode_chang
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -621,6 +630,7 @@ async fn collaboration_mode_update_noop_does_not_append_when_mode_is_unchanged()
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -653,6 +663,7 @@ async fn collaboration_mode_update_noop_does_not_append_when_mode_is_unchanged()
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -720,6 +731,7 @@ async fn resume_replays_collaboration_instructions() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -787,6 +799,7 @@ async fn empty_collaboration_instructions_are_ignored() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
--- a/codex-rs/core/tests/suite/compact.rs
+++ b/codex-rs/core/tests/suite/compact.rs
@@ -3083,6 +3083,7 @@ async fn snapshot_request_shape_pre_turn_compaction_including_incoming_user_mess
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
--- a/codex-rs/core/tests/suite/compact_remote.rs
+++ b/codex-rs/core/tests/suite/compact_remote.rs
@@ -2103,6 +2103,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_including_incoming_us
                    approval_policy: None,
                    approvals_reviewer: None,
                    sandbox_policy: None,
+                    permission_profile: None,
                    windows_sandbox_level: None,
                    model: None,
                    effort: None,
@@ -2218,6 +2219,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_strips_incoming_model
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some(next_model.to_string()),
            effort: None,
--- a/codex-rs/core/tests/suite/compact_resume_fork.rs
+++ b/codex-rs/core/tests/suite/compact_resume_fork.rs
@@ -575,6 +575,7 @@ async fn snapshot_rollback_followup_turn_trims_context_updates() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
--- a/codex-rs/core/tests/suite/model_overrides.rs
+++ b/codex-rs/core/tests/suite/model_overrides.rs
@@ -30,6 +30,7 @@ async fn override_turn_context_does_not_persist_when_config_exists() {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some("o3".to_string()),
            effort: Some(Some(ReasoningEffort::High)),
@@ -68,6 +69,7 @@ async fn override_turn_context_does_not_create_config_file() {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some("o3".to_string()),
            effort: Some(Some(ReasoningEffort::Medium)),
--- a/codex-rs/core/tests/suite/model_switching.rs
+++ b/codex-rs/core/tests/suite/model_switching.rs
@@ -147,6 +147,7 @@ async fn model_change_appends_model_instructions_developer_message() -> Result<(
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some(next_model.to_string()),
            effort: None,
@@ -246,6 +247,7 @@ async fn model_and_personality_change_only_appends_model_instructions() -> Resul
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some(next_model.to_string()),
            effort: None,
@@ -1038,6 +1040,7 @@ async fn model_switch_to_smaller_model_updates_token_context_window() -> Result<
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some(smaller_model_slug.to_string()),
            effort: None,
--- a/codex-rs/core/tests/suite/model_visible_layout.rs
+++ b/codex-rs/core/tests/suite/model_visible_layout.rs
@@ -458,6 +458,7 @@ async fn snapshot_model_visible_layout_resume_override_matches_rollout_model() -
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some("gpt-5.2".to_string()),
            effort: None,
--- a/codex-rs/core/tests/suite/override_updates.rs
+++ b/codex-rs/core/tests/suite/override_updates.rs
@@ -118,6 +118,7 @@ async fn override_turn_context_without_user_turn_does_not_record_permissions_upd
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -160,6 +161,7 @@ async fn override_turn_context_without_user_turn_does_not_record_environment_upd
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -199,6 +201,7 @@ async fn override_turn_context_without_user_turn_does_not_record_collaboration_u
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
--- a/codex-rs/core/tests/suite/permissions_messages.rs
+++ b/codex-rs/core/tests/suite/permissions_messages.rs
@@ -105,6 +105,7 @@ async fn permissions_message_added_on_override_change() -> Result<()> {
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -237,6 +238,7 @@ async fn permissions_message_omitted_when_disabled() -> Result<()> {
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -325,6 +327,7 @@ async fn resume_replays_permissions_messages() -> Result<()> {
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -430,6 +433,7 @@ async fn resume_and_fork_append_permissions_messages() -> Result<()> {
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
--- a/codex-rs/core/tests/suite/personality.rs
+++ b/codex-rs/core/tests/suite/personality.rs
@@ -352,6 +352,7 @@ async fn user_turn_personality_some_adds_update_message() -> anyhow::Result<()>
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -459,6 +460,7 @@ async fn user_turn_personality_same_value_does_not_add_update_message() -> anyho
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -579,6 +581,7 @@ async fn user_turn_personality_skips_if_feature_disabled() -> anyhow::Result<()>
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
@@ -860,6 +863,7 @@ async fn user_turn_personality_remote_model_template_includes_update_message() -
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,
--- a/codex-rs/core/tests/suite/prompt_caching.rs
+++ b/codex-rs/core/tests/suite/prompt_caching.rs
@@ -444,6 +444,7 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: Some(new_policy.clone()),
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: Some(Some(ReasoningEffort::High)),
@@ -529,6 +530,7 @@ async fn override_before_first_turn_emits_environment_context() -> anyhow::Resul
            approval_policy: Some(AskForApproval::Never),
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some("gpt-5.4".to_string()),
            effort: Some(Some(ReasoningEffort::Low)),
--- a/codex-rs/core/tests/suite/remote_models.rs
+++ b/codex-rs/core/tests/suite/remote_models.rs
@@ -595,6 +595,7 @@ async fn remote_models_remote_model_uses_unified_exec() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some(REMOTE_MODEL_SLUG.to_string()),
            effort: None,
@@ -840,6 +841,7 @@ async fn remote_models_apply_remote_base_instructions() -> Result<()> {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some(model.to_string()),
            effort: None,
--- a/codex-rs/core/tests/suite/resume.rs
+++ b/codex-rs/core/tests/suite/resume.rs
@@ -428,6 +428,7 @@ async fn resume_model_switch_is_not_duplicated_after_pre_turn_override() -> Resu
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: Some("gpt-5.4".to_string()),
            effort: None,
--- a/codex-rs/core/tests/suite/review.rs
+++ b/codex-rs/core/tests/suite/review.rs
@@ -839,6 +839,7 @@ async fn review_uses_overridden_cwd_for_base_branch_merge_base() {
            approval_policy: None,
            approvals_reviewer: None,
            sandbox_policy: None,
+            permission_profile: None,
            windows_sandbox_level: None,
            model: None,
            effort: None,