mirror of
https://github.com/openai/codex.git
synced 2026-04-25 07:05:38 +00:00
abbd74e2be
`SandboxPolicy::ReadOnly` previously implied broad read access and could
not express a narrower read surface.
This change introduces an explicit read-access model so we can support
user-configurable read restrictions in follow-up work, while preserving
current behavior today.
It also ensures unsupported backends fail closed for restricted-read
policies instead of silently granting broader access than intended.
## What
- Added `ReadOnlyAccess` in protocol with:
- `Restricted { include_platform_defaults, readable_roots }`
- `FullAccess`
- Updated `SandboxPolicy` to carry read-access configuration:
- `ReadOnly { access: ReadOnlyAccess }`
- `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
- Preserved existing behavior by defaulting current construction paths
to `ReadOnlyAccess::FullAccess`.
- Threaded the new fields through sandbox policy consumers and call
sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
related tests.
- Updated Seatbelt policy generation to honor restricted read roots by
emitting scoped read rules when full read access is not granted.
- Added fail-closed behavior on Linux and Windows backends when
restricted read access is requested but not yet implemented there
(`UnsupportedOperation`).
- Regenerated app-server protocol schema and TypeScript artifacts,
including `ReadOnlyAccess`.
## Compatibility / rollout
- Runtime behavior remains unchanged by default (`FullAccess`).
- API/schema changes are in place so future config wiring can enable
restricted read access without another policy-shape migration.
446 lines
13 KiB
JSON
446 lines
13 KiB
JSON
{
|
||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||
"definitions": {
|
||
"AbsolutePathBuf": {
|
||
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
|
||
"type": "string"
|
||
},
|
||
"AskForApproval": {
|
||
"description": "Determines the conditions under which the user is consulted to approve running the command proposed by Codex.",
|
||
"oneOf": [
|
||
{
|
||
"description": "Under this policy, only \"known safe\" commands—as determined by `is_safe_command()`—that **only read files** are auto‑approved. Everything else will ask the user to approve.",
|
||
"enum": [
|
||
"untrusted"
|
||
],
|
||
"type": "string"
|
||
},
|
||
{
|
||
"description": "*All* commands are auto‑approved, but they are expected to run inside a sandbox where network access is disabled and writes are confined to a specific set of paths. If the command fails, it will be escalated to the user to approve execution without a sandbox.",
|
||
"enum": [
|
||
"on-failure"
|
||
],
|
||
"type": "string"
|
||
},
|
||
{
|
||
"description": "The model decides when to ask the user for approval.",
|
||
"enum": [
|
||
"on-request"
|
||
],
|
||
"type": "string"
|
||
},
|
||
{
|
||
"description": "Never ask the user to approve commands. Failures are immediately returned to the model, and never escalated to the user for approval.",
|
||
"enum": [
|
||
"never"
|
||
],
|
||
"type": "string"
|
||
}
|
||
]
|
||
},
|
||
"InputItem": {
|
||
"oneOf": [
|
||
{
|
||
"properties": {
|
||
"data": {
|
||
"properties": {
|
||
"text": {
|
||
"type": "string"
|
||
},
|
||
"text_elements": {
|
||
"default": [],
|
||
"description": "UI-defined spans within `text` used to render or persist special elements.",
|
||
"items": {
|
||
"$ref": "#/definitions/V1TextElement"
|
||
},
|
||
"type": "array"
|
||
}
|
||
},
|
||
"required": [
|
||
"text"
|
||
],
|
||
"type": "object"
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"text"
|
||
],
|
||
"title": "TextInputItemType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"data",
|
||
"type"
|
||
],
|
||
"title": "TextInputItem",
|
||
"type": "object"
|
||
},
|
||
{
|
||
"properties": {
|
||
"data": {
|
||
"properties": {
|
||
"image_url": {
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"image_url"
|
||
],
|
||
"type": "object"
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"image"
|
||
],
|
||
"title": "ImageInputItemType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"data",
|
||
"type"
|
||
],
|
||
"title": "ImageInputItem",
|
||
"type": "object"
|
||
},
|
||
{
|
||
"properties": {
|
||
"data": {
|
||
"properties": {
|
||
"path": {
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"path"
|
||
],
|
||
"type": "object"
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"localImage"
|
||
],
|
||
"title": "LocalImageInputItemType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"data",
|
||
"type"
|
||
],
|
||
"title": "LocalImageInputItem",
|
||
"type": "object"
|
||
}
|
||
]
|
||
},
|
||
"NetworkAccess": {
|
||
"description": "Represents whether outbound network access is available to the agent.",
|
||
"enum": [
|
||
"restricted",
|
||
"enabled"
|
||
],
|
||
"type": "string"
|
||
},
|
||
"ReadOnlyAccess": {
|
||
"description": "Determines how read-only file access is granted inside a restricted sandbox.",
|
||
"oneOf": [
|
||
{
|
||
"description": "Restrict reads to an explicit set of roots.\n\nWhen `include_platform_defaults` is `true`, platform defaults required for basic execution are included in addition to `readable_roots`.",
|
||
"properties": {
|
||
"include_platform_defaults": {
|
||
"default": true,
|
||
"description": "Include built-in platform read roots required for basic process execution.",
|
||
"type": "boolean"
|
||
},
|
||
"readable_roots": {
|
||
"description": "Additional absolute roots that should be readable.",
|
||
"items": {
|
||
"$ref": "#/definitions/AbsolutePathBuf"
|
||
},
|
||
"type": "array"
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"restricted"
|
||
],
|
||
"title": "RestrictedReadOnlyAccessType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"type"
|
||
],
|
||
"title": "RestrictedReadOnlyAccess",
|
||
"type": "object"
|
||
},
|
||
{
|
||
"description": "Allow unrestricted file reads.",
|
||
"properties": {
|
||
"type": {
|
||
"enum": [
|
||
"full-access"
|
||
],
|
||
"title": "FullAccessReadOnlyAccessType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"type"
|
||
],
|
||
"title": "FullAccessReadOnlyAccess",
|
||
"type": "object"
|
||
}
|
||
]
|
||
},
|
||
"ReasoningEffort": {
|
||
"description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
|
||
"enum": [
|
||
"none",
|
||
"minimal",
|
||
"low",
|
||
"medium",
|
||
"high",
|
||
"xhigh"
|
||
],
|
||
"type": "string"
|
||
},
|
||
"ReasoningSummary": {
|
||
"description": "A summary of the reasoning performed by the model. This can be useful for debugging and understanding the model's reasoning process. See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#reasoning-summaries",
|
||
"oneOf": [
|
||
{
|
||
"enum": [
|
||
"auto",
|
||
"concise",
|
||
"detailed"
|
||
],
|
||
"type": "string"
|
||
},
|
||
{
|
||
"description": "Option to disable reasoning summaries.",
|
||
"enum": [
|
||
"none"
|
||
],
|
||
"type": "string"
|
||
}
|
||
]
|
||
},
|
||
"SandboxPolicy": {
|
||
"description": "Determines execution restrictions for model shell commands.",
|
||
"oneOf": [
|
||
{
|
||
"description": "No restrictions whatsoever. Use with caution.",
|
||
"properties": {
|
||
"type": {
|
||
"enum": [
|
||
"danger-full-access"
|
||
],
|
||
"title": "DangerFullAccessSandboxPolicyType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"type"
|
||
],
|
||
"title": "DangerFullAccessSandboxPolicy",
|
||
"type": "object"
|
||
},
|
||
{
|
||
"description": "Read-only access configuration.",
|
||
"properties": {
|
||
"access": {
|
||
"allOf": [
|
||
{
|
||
"$ref": "#/definitions/ReadOnlyAccess"
|
||
}
|
||
],
|
||
"description": "Read access granted while running under this policy."
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"read-only"
|
||
],
|
||
"title": "ReadOnlySandboxPolicyType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"type"
|
||
],
|
||
"title": "ReadOnlySandboxPolicy",
|
||
"type": "object"
|
||
},
|
||
{
|
||
"description": "Indicates the process is already in an external sandbox. Allows full disk access while honoring the provided network setting.",
|
||
"properties": {
|
||
"network_access": {
|
||
"allOf": [
|
||
{
|
||
"$ref": "#/definitions/NetworkAccess"
|
||
}
|
||
],
|
||
"default": "restricted",
|
||
"description": "Whether the external sandbox permits outbound network traffic."
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"external-sandbox"
|
||
],
|
||
"title": "ExternalSandboxSandboxPolicyType",
|
||
"type": "string"
|
||
}
|
||
},
|
||
"required": [
|
||
"type"
|
||
],
|
||
"title": "ExternalSandboxSandboxPolicy",
|
||
"type": "object"
|
||
},
|
||
{
|
||
"description": "Same as `ReadOnly` but additionally grants write access to the current working directory (\"workspace\").",
|
||
"properties": {
|
||
"exclude_slash_tmp": {
|
||
"default": false,
|
||
"description": "When set to `true`, will NOT include the `/tmp` among the default writable roots on UNIX. Defaults to `false`.",
|
||
"type": "boolean"
|
||
},
|
||
"exclude_tmpdir_env_var": {
|
||
"default": false,
|
||
"description": "When set to `true`, will NOT include the per-user `TMPDIR` environment variable among the default writable roots. Defaults to `false`.",
|
||
"type": "boolean"
|
||
},
|
||
"network_access": {
|
||
"default": false,
|
||
"description": "When set to `true`, outbound network access is allowed. `false` by default.",
|
||
"type": "boolean"
|
||
},
|
||
"read_only_access": {
|
||
"allOf": [
|
||
{
|
||
"$ref": "#/definitions/ReadOnlyAccess"
|
||
}
|
||
],
|
||
"description": "Read access granted while running under this policy."
|
||
},
|
||
"type": {
|
||
"enum": [
|
||
"workspace-write"
|
||
],
|
||
"title": "WorkspaceWriteSandboxPolicyType",
|
||
"type": "string"
|
||
},
|
||
"writable_roots": {
|
||
"description": "Additional folders (beyond cwd and possibly TMPDIR) that should be writable from within the sandbox.",
|
||
"items": {
|
||
"$ref": "#/definitions/AbsolutePathBuf"
|
||
},
|
||
"type": "array"
|
||
}
|
||
},
|
||
"required": [
|
||
"type"
|
||
],
|
||
"title": "WorkspaceWriteSandboxPolicy",
|
||
"type": "object"
|
||
}
|
||
]
|
||
},
|
||
"ThreadId": {
|
||
"type": "string"
|
||
},
|
||
"V1ByteRange": {
|
||
"properties": {
|
||
"end": {
|
||
"description": "End byte offset (exclusive) within the UTF-8 text buffer.",
|
||
"format": "uint",
|
||
"minimum": 0.0,
|
||
"type": "integer"
|
||
},
|
||
"start": {
|
||
"description": "Start byte offset (inclusive) within the UTF-8 text buffer.",
|
||
"format": "uint",
|
||
"minimum": 0.0,
|
||
"type": "integer"
|
||
}
|
||
},
|
||
"required": [
|
||
"end",
|
||
"start"
|
||
],
|
||
"type": "object"
|
||
},
|
||
"V1TextElement": {
|
||
"properties": {
|
||
"byteRange": {
|
||
"allOf": [
|
||
{
|
||
"$ref": "#/definitions/V1ByteRange"
|
||
}
|
||
],
|
||
"description": "Byte range in the parent `text` buffer that this element occupies."
|
||
},
|
||
"placeholder": {
|
||
"description": "Optional human-readable placeholder for the element, displayed in the UI.",
|
||
"type": [
|
||
"string",
|
||
"null"
|
||
]
|
||
}
|
||
},
|
||
"required": [
|
||
"byteRange"
|
||
],
|
||
"type": "object"
|
||
}
|
||
},
|
||
"properties": {
|
||
"approvalPolicy": {
|
||
"$ref": "#/definitions/AskForApproval"
|
||
},
|
||
"conversationId": {
|
||
"$ref": "#/definitions/ThreadId"
|
||
},
|
||
"cwd": {
|
||
"type": "string"
|
||
},
|
||
"effort": {
|
||
"anyOf": [
|
||
{
|
||
"$ref": "#/definitions/ReasoningEffort"
|
||
},
|
||
{
|
||
"type": "null"
|
||
}
|
||
]
|
||
},
|
||
"items": {
|
||
"items": {
|
||
"$ref": "#/definitions/InputItem"
|
||
},
|
||
"type": "array"
|
||
},
|
||
"model": {
|
||
"type": "string"
|
||
},
|
||
"outputSchema": {
|
||
"description": "Optional JSON Schema used to constrain the final assistant message for this turn."
|
||
},
|
||
"sandboxPolicy": {
|
||
"$ref": "#/definitions/SandboxPolicy"
|
||
},
|
||
"summary": {
|
||
"$ref": "#/definitions/ReasoningSummary"
|
||
}
|
||
},
|
||
"required": [
|
||
"approvalPolicy",
|
||
"conversationId",
|
||
"cwd",
|
||
"items",
|
||
"model",
|
||
"sandboxPolicy",
|
||
"summary"
|
||
],
|
||
"title": "SendUserTurnParams",
|
||
"type": "object"
|
||
} |