mirror of
https://github.com/openai/codex.git
synced 2026-05-23 12:34:25 +00:00
## Why The app-server thread lifecycle API should no longer expose the full `PermissionProfile` value. After the permissions-profile migration, clients should round-trip only the active profile identity through `activePermissionProfile` and `permissions` when that identity is known. The full profile is server-side config. Treating a response-derived legacy sandbox projection as a new local profile can lose named-profile restrictions and accidentally widen permissions on the next turn. The legacy `sandbox` response field remains only as the compatibility/display fallback. ## What Changed - Removed `permissionProfile` from `ThreadStartResponse`, `ThreadResumeResponse`, and `ThreadForkResponse`. - Stopped populating that field in app-server thread start/resume/fork responses. - Updated embedded exec/TUI response mapping to derive display permission state from local config or the legacy sandbox fallback instead of a response profile value. - Added a TUI turn override shape that distinguishes preserving server permissions, selecting an active profile id, and sending a legacy sandbox for an explicit local override. - Preserved remote app-server permissions across turns by sending `permissions` only when an `activePermissionProfile` id is known, and otherwise sending no sandbox override unless the user selected a local override. - Kept embedded `thread/resume` hydration server-authored when `activePermissionProfile` is absent, which matches the live-thread attach path where the server ignores requested overrides. - Updated the app-server README to remove the obsolete lifecycle response `permissionProfile` reference. The remaining `permissionProfile` README references are request-side permission overrides. - Regenerated app-server JSON schema and TypeScript fixtures. - Kept the generated typed response enum exempt from `large_enum_variant`, matching the existing payload enum exemption after the lifecycle response variants shrank. ## How To Review Start with `codex-rs/app-server-protocol/src/protocol/v2/thread.rs` to confirm the response shape, then check the response construction in `codex-rs/app-server/src/request_processors`. The generated schema and TypeScript fixture changes are mechanical follow-through from the protocol removal. The TUI behavior is the delicate part: review `codex-rs/tui/src/app_server_session.rs` for response hydration and turn-start override projection, then `codex-rs/tui/src/app/thread_routing.rs` for the decision about whether the next turn should preserve the server snapshot, send an active profile id, or send a legacy sandbox for an explicit local override. ## Verification - `just write-app-server-schema` - `cargo test -p codex-app-server-protocol thread_lifecycle_responses_default_missing_optional_fields` - `cargo test -p codex-exec session_configured_from_thread_response_uses_permission_profile_from_config` - `cargo test -p codex-tui --lib thread_response` - `cargo test -p codex-tui turn_permissions_` - `cargo test -p codex-tui resume_response_restores_turns_from_thread_items` - `cargo test -p codex-analytics track_response_only_enqueues_analytics_relevant_responses` - `just fix -p codex-analytics` - `just fix -p codex-app-server-protocol` - `just fix -p codex-tui` - `just argument-comment-lint` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/22792). * #22795 * __->__ #22792
74 lines
3.0 KiB
Rust
74 lines
3.0 KiB
Rust
//! Canonical TUI session state shared across app-server routing, chat display, and status UI.
|
|
//!
|
|
//! The app-server API is the boundary for session lifecycle events. Once those responses enter
|
|
//! TUI, this module holds the small internal state shape used by app orchestration and widgets.
|
|
|
|
use std::path::PathBuf;
|
|
|
|
use codex_app_server_protocol::AskForApproval;
|
|
use codex_protocol::ThreadId;
|
|
use codex_protocol::models::ActivePermissionProfile;
|
|
use codex_protocol::models::PermissionProfile;
|
|
use codex_utils_absolute_path::AbsolutePathBuf;
|
|
|
|
#[derive(Debug, Clone, PartialEq)]
|
|
pub(crate) struct SessionNetworkProxyRuntime {
|
|
pub(crate) http_addr: String,
|
|
pub(crate) socks_addr: String,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
|
|
pub(crate) struct MessageHistoryMetadata {
|
|
pub(crate) log_id: u64,
|
|
pub(crate) entry_count: usize,
|
|
}
|
|
|
|
#[derive(Debug, Clone, PartialEq)]
|
|
pub(crate) struct ThreadSessionState {
|
|
pub(crate) thread_id: ThreadId,
|
|
pub(crate) forked_from_id: Option<ThreadId>,
|
|
pub(crate) fork_parent_title: Option<String>,
|
|
pub(crate) thread_name: Option<String>,
|
|
pub(crate) model: String,
|
|
pub(crate) model_provider_id: String,
|
|
pub(crate) service_tier: Option<String>,
|
|
pub(crate) approval_policy: AskForApproval,
|
|
pub(crate) approvals_reviewer: codex_protocol::config_types::ApprovalsReviewer,
|
|
/// Permission snapshot used by TUI display surfaces. Legacy app-server
|
|
/// responses are converted to a profile at ingestion time using the
|
|
/// response cwd so cached sessions do not reinterpret cwd-bound grants.
|
|
/// Turn requests must not treat this snapshot as a local permission
|
|
/// override unless the user explicitly changed permissions in the TUI.
|
|
pub(crate) permission_profile: PermissionProfile,
|
|
/// Named or implicit built-in profile that produced `permission_profile`,
|
|
/// when the server knows it.
|
|
pub(crate) active_permission_profile: Option<ActivePermissionProfile>,
|
|
pub(crate) cwd: AbsolutePathBuf,
|
|
pub(crate) runtime_workspace_roots: Vec<AbsolutePathBuf>,
|
|
pub(crate) instruction_source_paths: Vec<AbsolutePathBuf>,
|
|
pub(crate) reasoning_effort: Option<codex_protocol::openai_models::ReasoningEffort>,
|
|
pub(crate) message_history: Option<MessageHistoryMetadata>,
|
|
pub(crate) network_proxy: Option<SessionNetworkProxyRuntime>,
|
|
pub(crate) rollout_path: Option<PathBuf>,
|
|
}
|
|
|
|
impl ThreadSessionState {
|
|
pub(crate) fn set_cwd_retargeting_implicit_runtime_workspace_root(
|
|
&mut self,
|
|
cwd: AbsolutePathBuf,
|
|
) {
|
|
let previous_cwd = std::mem::replace(&mut self.cwd, cwd.clone());
|
|
if !self.runtime_workspace_roots.contains(&previous_cwd) {
|
|
return;
|
|
}
|
|
|
|
let previous_roots = std::mem::take(&mut self.runtime_workspace_roots);
|
|
self.runtime_workspace_roots.push(cwd);
|
|
for root in previous_roots {
|
|
if root != previous_cwd && !self.runtime_workspace_roots.contains(&root) {
|
|
self.runtime_workspace_roots.push(root);
|
|
}
|
|
}
|
|
}
|
|
}
|