clone/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-05-04 11:26:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

core tests: submit turns with permission profiles (#20010)

Browse Source 
## Summary

- Add `PermissionProfile`-based turn submission helpers to
`core_test_support`, while keeping the legacy `SandboxPolicy` helper for
tests that intentionally exercise legacy fallback behavior.
- Switch the default `TestCodex::submit_turn()` path to send a real
`PermissionProfile` plus the required legacy compatibility projection in
`Op::UserTurn`.
- Migrate straightforward app/search/shell/truncation tests from
`SandboxPolicy::{DangerFullAccess, ReadOnly}` to
`PermissionProfile::{Disabled, read_only}`.
- Add a TUI compatibility projection helper for legacy app-server fields
so non-legacy writable roots are preserved instead of being downgraded
to read-only.
- Fix remote start/resume/fork sandbox-mode projection to classify any
managed profile with writable roots as workspace-write, not only
profiles that can write `cwd`.
- Reduce `SandboxPolicy` references in `codex-rs/core/tests` from 47
files to 41 files without changing production behavior.

## Testing

- `cargo check -p codex-core --tests`
- `cargo test -p codex-tui
compatibility_profile_preserves_unbridgeable_write_roots`
- `cargo test -p codex-tui
sandbox_mode_preserves_non_cwd_write_roots_for_remote_sessions`
- `just fmt`
- `just fix -p core_test_support`
- `just fix -p codex-core`
This commit is contained in:
Michael Bolin
2026-04-28 16:01:40 -07:00
committed by GitHub
parent 2dbde94aa9
commit 891722849d
11 changed files with 354 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
codex-rs/core/tests/suite/truncation.rs
View File

@@ -5,10 +5,10 @@ use anyhow::Context;
use anyhow::Result;
use codex_config::types::McpServerConfig;
use codex_config::types::McpServerTransportConfig;
use codex_protocol::models::PermissionProfile;
use codex_protocol::protocol::AskForApproval;
use codex_protocol::protocol::EventMsg;
use codex_protocol::protocol::Op;
use codex_protocol::protocol::SandboxPolicy;
use codex_protocol::user_input::UserInput;
use core_test_support::assert_regex_match;
use core_test_support::responses;
@@ -82,7 +82,10 @@ async fn tool_call_output_configured_limit_chars_type() -> Result<()> {
.await;
fixture
.submit_turn_with_policy("trigger big shell output", SandboxPolicy::DangerFullAccess)
.submit_turn_with_permission_profile(
"trigger big shell output",
PermissionProfile::Disabled,
)
.await?;
// Inspect what we sent back to the model; it should contain a truncated
@@ -156,7 +159,10 @@ async fn tool_call_output_exceeds_limit_truncated_chars_limit() -> Result<()> {
.await;
fixture
.submit_turn_with_policy("trigger big shell output", SandboxPolicy::DangerFullAccess)
.submit_turn_with_permission_profile(
"trigger big shell output",
PermissionProfile::Disabled,
)
.await?;
// Inspect what we sent back to the model; it should contain a truncated
@@ -229,7 +235,10 @@ async fn tool_call_output_exceeds_limit_truncated_for_model() -> Result<()> {
.await;
fixture
.submit_turn_with_policy("trigger big shell output", SandboxPolicy::DangerFullAccess)
.submit_turn_with_permission_profile(
"trigger big shell output",
PermissionProfile::Disabled,
)
.await?;
// Inspect what we sent back to the model; it should contain a truncated
@@ -303,7 +312,10 @@ async fn tool_call_output_truncated_only_once() -> Result<()> {
.await;
fixture
.submit_turn_with_policy("trigger big shell output", SandboxPolicy::DangerFullAccess)
.submit_turn_with_permission_profile(
"trigger big shell output",
PermissionProfile::Disabled,
)
.await?;
let output = mock2
@@ -399,9 +411,9 @@ async fn mcp_tool_call_output_exceeds_limit_truncated_for_model() -> Result<()>
let fixture = builder.build(&server).await?;
fixture
.submit_turn_with_policy(
.submit_turn_with_permission_profile(
"call the rmcp echo tool with a very large message",
SandboxPolicy::new_read_only_policy(),
PermissionProfile::read_only(),
)
.await?;
@@ -496,6 +508,8 @@ async fn mcp_image_output_preserves_image_and_no_text_summary() -> Result<()> {
});
let fixture = builder.build(&server).await?;
let session_model = fixture.session_configured.model.clone();
let permission_profile = PermissionProfile::read_only();
let sandbox_policy = permission_profile.to_legacy_sandbox_policy(fixture.cwd.path())?;
fixture
.codex
@@ -509,8 +523,8 @@ async fn mcp_image_output_preserves_image_and_no_text_summary() -> Result<()> {
cwd: fixture.cwd.path().to_path_buf(),
approval_policy: AskForApproval::Never,
approvals_reviewer: None,
sandbox_policy: SandboxPolicy::new_read_only_policy(),
permission_profile: None,
sandbox_policy,
permission_profile: Some(permission_profile),
model: session_model,
effort: None,
summary: None,
@@ -577,7 +591,7 @@ async fn token_policy_marker_reports_tokens() -> Result<()> {
.await;
fixture
.submit_turn_with_policy("run the shell tool", SandboxPolicy::DangerFullAccess)
.submit_turn_with_permission_profile("run the shell tool", PermissionProfile::Disabled)
.await?;
let output = done_mock
@@ -628,7 +642,7 @@ async fn byte_policy_marker_reports_bytes() -> Result<()> {
.await;
fixture
.submit_turn_with_policy("run the shell tool", SandboxPolicy::DangerFullAccess)
.submit_turn_with_permission_profile("run the shell tool", PermissionProfile::Disabled)
.await?;
let output = done_mock
@@ -680,9 +694,9 @@ async fn shell_command_output_not_truncated_with_custom_limit() -> Result<()> {
.await;
fixture
.submit_turn_with_policy(
.submit_turn_with_permission_profile(
"run big output without truncation",
SandboxPolicy::DangerFullAccess,
PermissionProfile::Disabled,
)
.await?;
@@ -777,9 +791,9 @@ async fn mcp_tool_call_output_not_truncated_with_custom_limit() -> Result<()> {
let fixture = builder.build(&server).await?;
fixture
.submit_turn_with_policy(
.submit_turn_with_permission_profile(
"call the rmcp echo tool with a very large message",
SandboxPolicy::new_read_only_policy(),
PermissionProfile::read_only(),
)
.await?;