Michael Bolin 9c0eced391 shell-escalation: carry resolved permission profiles (#18287) ...

## Why

Shell escalation still has adapter code that expects a legacy sandbox
policy, but command approvals should carry the resolved
`PermissionProfile` so callers can reason about the granted permissions
canonically.

## What changed

This introduces profile-shaped resolved escalation permissions while
retaining the derived legacy sandbox policy for the Unix escalation
adapter. It updates approval types, the escalation server protocol, and
tests that inspect escalated command permissions.

## Verification

- `cargo test -p codex-core --test all handle_container_exec_ --
--nocapture`
- `cargo test -p codex-core --test all handle_sandbox_ -- --nocapture`

























































---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/18287).
* #18288
* __->__ #18287

2026-04-23 12:46:19 -07:00

..

agent

core: box multi-agent wrapper futures (#19059)

2026-04-22 17:48:13 -07:00

apps

Split DeveloperInstructions into individual fragments. (#18813)

2026-04-21 10:22:36 -07:00

bin

Refactor config types into a separate crate (#16962)

2026-04-07 00:32:41 +00:00

config

Add remote thread config endpoint (#18908)

2026-04-23 11:46:06 -07:00

config_loader

codex: support hooks in config.toml and requirements.toml (#18893)

2026-04-22 21:20:09 -07:00

context

feat: drop spawned-agent context instructions (#19127)

2026-04-23 18:54:45 +02:00

context_manager

rollout: persist turn permission profiles (#18281)

2026-04-22 17:00:29 -07:00

guardian

tui: carry permission profiles on user turns (#18285)

2026-04-23 11:54:17 -07:00

memories

[rollout_trace] Record core session rollout traces (#18877)

2026-04-22 17:00:48 +00:00

plugins

Move marketplace add/remove and startup sync out of core. (#19099)

2026-04-23 11:27:17 -07:00

sandboxing

Add Windows sandbox unified exec runtime support (#15578)

2026-04-21 10:44:49 -07:00

session

[rollout_trace] Trace tool and code-mode boundaries (#18878)

2026-04-23 12:22:11 -07:00

state

[codex] Route live thread writes through ThreadStore (#18882)

2026-04-23 10:17:09 -07:00

tasks

feat(auto-review) short-circuit (#18890)

2026-04-22 20:34:15 +00:00

tools

shell-escalation: carry resolved permission profiles (#18287)

2026-04-23 12:46:19 -07:00

unified_exec

hooks: emit Bash PostToolUse when exec_command completes via write_stdin (#18888)

2026-04-22 17:14:22 -07:00

utils

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

agents_md_tests.rs

Refactor AGENTS.md discovery into AgentsMdManager (#18035)

2026-04-16 10:51:33 -07:00

agents_md.rs

Refactor AGENTS.md discovery into AgentsMdManager (#18035)

2026-04-16 10:51:33 -07:00

apply_patch_tests.rs

[codex] Migrate apply_patch to executor filesystem (#17027)

2026-04-07 21:20:22 +00:00

apply_patch.rs

Move codex module under session (#18249)

2026-04-17 16:18:53 +00:00

arc_monitor_tests.rs

fix: fully revert agent identity runtime wiring (#18757)

2026-04-21 14:30:55 -07:00

arc_monitor.rs

fix: fully revert agent identity runtime wiring (#18757)

2026-04-21 14:30:55 -07:00

client_common_tests.rs

Allow guardian bare allow output (#18797)

2026-04-21 15:37:12 -07:00

client_common.rs

Allow guardian bare allow output (#18797)

2026-04-21 15:37:12 -07:00

client_tests.rs

fix: fully revert agent identity runtime wiring (#18757)

2026-04-21 14:30:55 -07:00

client.rs

[rollout_trace] Record core session rollout traces (#18877)

2026-04-22 17:00:48 +00:00

codex_delegate_tests.rs

feat(request-permissions) approve with strict review (#19050)

2026-04-23 01:56:32 +00:00

codex_delegate.rs

[codex] Route live thread writes through ThreadStore (#18882)

2026-04-23 10:17:09 -07:00

codex_thread.rs

app-server: accept permission profile overrides (#18279)

2026-04-22 13:34:33 -07:00

command_canonicalization_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

command_canonicalization.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

commit_attribution_tests.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

commit_attribution.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

compact_remote.rs

[rollout_trace] Record core session rollout traces (#18877)

2026-04-22 17:00:48 +00:00

compact_tests.rs

feat: add a built-in Amazon Bedrock model provider (#18744)

2026-04-21 00:54:05 +00:00

compact.rs

[rollout_trace] Record core session rollout traces (#18877)

2026-04-22 17:00:48 +00:00

connectors_tests.rs

Make app tool hint defaults pessimistic for app policies (#17232)

2026-04-17 13:27:49 -04:00

connectors.rs

Support multiple managed environments (#18401)

2026-04-21 15:29:35 -07:00

consequential_tool_message_templates.json

[elicitation] User-friendly tool call messages. (#14403)

2026-03-12 00:35:21 -07:00

event_mapping_tests.rs

Update image outputs to default to high detail (#18386)

2026-04-18 11:01:12 -07:00

event_mapping.rs

Organize context fragments (#18794)

2026-04-20 22:39:17 -07:00

exec_env_tests.rs

fix: preserve platform-specific core shell env vars (#16707)

2026-04-03 12:07:07 -07:00

exec_env.rs

Build remote exec env from exec-server policy (#17216)

2026-04-13 09:59:08 +01:00

exec_policy_tests.rs

fix: exec policy loading for sub-agents (#18654)

2026-04-20 11:51:58 +01:00

exec_policy.rs

refactor: use semaphores for async serialization gates (#18403)

2026-04-20 17:21:29 +00:00

exec_tests.rs

feat(permissions): add glob deny-read policy support (#15979)

2026-04-16 10:31:51 -07:00

exec.rs

Add Windows sandbox unified exec runtime support (#15578)

2026-04-21 10:44:49 -07:00

file_watcher_tests.rs

fix: FS watcher when file does not exist yet (#18492)

2026-04-20 11:23:00 +01:00

file_watcher.rs

fix: FS watcher when file does not exist yet (#18492)

2026-04-20 11:23:00 +01:00

flags.rs

…

function_tool.rs

…

git_info_tests.rs

Refactor config loading to use filesystem abstraction (#18209)

2026-04-17 00:51:21 +00:00

hook_runtime.rs

Support MCP tools in hooks (#18385)

2026-04-23 07:33:57 +00:00

installation_id.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

landlock.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

lib.rs

app-server: accept permission profile overrides (#18279)

2026-04-22 13:34:33 -07:00

mcp_openai_file.rs

fix: fully revert agent identity runtime wiring (#18757)

2026-04-21 14:30:55 -07:00

mcp_skill_dependencies.rs

Move codex module under session (#18249)

2026-04-17 16:18:53 +00:00

mcp_tool_approval_templates.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

mcp_tool_call_tests.rs

Support MCP tools in hooks (#18385)

2026-04-23 07:33:57 +00:00

mcp_tool_call.rs

mcp: include permission profiles in sandbox state (#18286)

2026-04-23 12:21:26 -07:00

mcp_tool_exposure_test.rs

Update models.json (#18586)

2026-04-20 10:27:01 -07:00

mcp_tool_exposure.rs

add token-based tool deferral behind feature flag (#18097)

2026-04-17 18:34:06 +08:00

mcp.rs

fix: fully revert agent identity runtime wiring (#18757)

2026-04-21 14:30:55 -07:00

memory_trace_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

memory_trace.rs

remove temporary ownership re-exports (#16626)

2026-04-03 00:33:34 -07:00

mention_syntax.rs

Extract codex-utils-plugins crate (#15746)

2026-03-25 11:05:35 -07:00

message_history_tests.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

message_history.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

network_policy_decision_tests.rs

extract models manager and related ownership from core (#16508)

2026-04-02 23:00:02 -07:00

network_policy_decision.rs

refactor(proxy): clarify sandbox block messages (#17168)

2026-04-09 10:53:06 -07:00

network_proxy_loader_tests.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

network_proxy_loader.rs

Add remote_sandbox_config to our config requirements (#18763)

2026-04-21 05:05:02 +00:00

original_image_detail.rs

Support original-detail metadata on MCP image outputs (#17714)

2026-04-15 14:43:33 -07:00

otel_init.rs

Use AbsolutePathBuf in skill loading and codex_home (#17407)

2026-04-13 10:26:51 -07:00

personality_migration_tests.rs

[codex] Add local thread store listing (#17824)

2026-04-15 11:34:27 -07:00

personality_migration.rs

Support multiple cwd filters for thread list (#18502)

2026-04-22 06:10:09 -04:00

prompt_debug.rs

test(core): move prompt debug coverage to integration suite (#18916)

2026-04-22 01:08:25 +00:00

realtime_context_tests.rs

Update models.json (#18586)

2026-04-20 10:27:01 -07:00

realtime_context.rs

[codex] Route live thread writes through ThreadStore (#18882)

2026-04-23 10:17:09 -07:00

realtime_conversation_tests.rs

Update realtime handoff transcript handling (#18597)

2026-04-20 14:04:09 -07:00

realtime_conversation.rs

Add realtime silence tool (#18635)

2026-04-20 15:43:20 -07:00

realtime_prompt.rs

[codex] Update realtime V2 VAD silence delay and 1.5 prompt (#18092)

2026-04-16 14:30:57 -07:00

review_format.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

review_prompts.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

rollout.rs

[codex] Route live thread writes through ThreadStore (#18882)

2026-04-23 10:17:09 -07:00

safety_tests.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

safety.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

sandbox_tags_tests.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

sandbox_tags.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

session_prefix.rs

Organize context fragments (#18794)

2026-04-20 22:39:17 -07:00

session_rollout_init_error.rs

remove temporary ownership re-exports (#16626)

2026-04-03 00:33:34 -07:00

session_startup_prewarm.rs

Move codex module under session (#18249)

2026-04-17 16:18:53 +00:00

shell_detect.rs

chore: rename codex-command to codex-shell-command (#11378)

2026-02-10 17:03:46 -08:00

shell_snapshot_tests.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

shell_snapshot.rs

Avoid false shell snapshot cleanup warnings (#18441)

2026-04-20 15:15:05 +01:00

shell_tests.rs

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

shell.rs

fix: add shell fallback paths for pwsh/powershell that work on GitHub Actions Windows runners (#16617)

2026-04-02 13:47:10 -07:00

skills_watcher.rs

Make skill loading filesystem-aware (#17720)

2026-04-14 15:40:40 -07:00

skills.rs

Split DeveloperInstructions into individual fragments. (#18813)

2026-04-21 10:22:36 -07:00

spawn.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

state_db_bridge.rs

[codex] reduce module visibility (#16978)

2026-04-07 08:03:35 -07:00

stream_events_utils_tests.rs

Move codex module under session (#18249)

2026-04-17 16:18:53 +00:00

stream_events_utils.rs

Split DeveloperInstructions into individual fragments. (#18813)

2026-04-21 10:22:36 -07:00

test_support.rs

remove temporary ownership re-exports (#16626)

2026-04-03 00:33:34 -07:00

thread_manager_tests.rs

Support multiple managed environments (#18401)

2026-04-21 15:29:35 -07:00

thread_manager.rs

[codex] Implement remote thread store methods (#19008)

2026-04-23 17:49:28 +00:00

thread_rollout_truncation_tests.rs

Move codex module under session (#18249)

2026-04-17 16:18:53 +00:00

thread_rollout_truncation.rs

[codex-analytics] feature plumbing and emittance (#16640)

2026-04-13 23:11:49 -07:00

turn_diff_tracker_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

turn_diff_tracker.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

turn_metadata_tests.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

turn_metadata.rs

Spread AbsolutePathBuf (#17792)

2026-04-14 14:26:10 -07:00

turn_timing_tests.rs

feat: add memory citation to agent message (#14821)

2026-03-18 10:03:38 +00:00

turn_timing.rs

Add safety check notification and error handling (#19055)

2026-04-22 22:24:12 -07:00

unavailable_tool.rs

[mcp] Add dummy tools for previously called but currently missing tools. (#17853)

2026-04-15 21:48:05 +00:00

user_shell_command_tests.rs

Organize context fragments (#18794)

2026-04-20 22:39:17 -07:00

user_shell_command.rs

Organize context fragments (#18794)

2026-04-20 22:39:17 -07:00

util_tests.rs

Update models.json (#18586)

2026-04-20 10:27:01 -07:00

util.rs

remove temporary ownership re-exports (#16626)

2026-04-03 00:33:34 -07:00

web_search.rs

add missing fields to WebSearchAction and update app-server types (#10276)

2026-01-30 16:37:56 -08:00

windows_sandbox_read_grants_tests.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

windows_sandbox_read_grants.rs

core: remove cross-crate re-exports from lib.rs (#16512)

2026-04-01 23:06:24 -07:00

windows_sandbox_tests.rs

Configure multi_agent_v2 spawn agent hints (#17071)

2026-04-08 08:42:18 -07:00

windows_sandbox.rs

Configure multi_agent_v2 spawn agent hints (#17071)

2026-04-08 08:42:18 -07:00