Celia Chen e6773f856c Feat: Preserve network access on read-only sandbox policies (#13409) ...

## Summary

`PermissionProfile.network` could not be preserved when additional or
compiled permissions resolved to
`SandboxPolicy::ReadOnly`, because `ReadOnly` had no network_access
field. This change makes read-only + network
enabled representable directly and threads that through the protocol,
app-server v2 mirror, and permission-
  merging logic.

## What changed

- Added `network_access: bool` to `SandboxPolicy::ReadOnly` in the core
protocol and app-server v2 protocol.
- Kept backward compatibility by defaulting the new field to false, so
legacy read-only payloads still
    deserialize unchanged.
- Updated `has_full_network_access()` and sandbox summaries to respect
read-only network access.
  - Preserved PermissionProfile.network when:
      - compiling skill permission profiles into sandbox policies
      - normalizing additional permissions
      - merging additional permissions into existing sandbox policies
- Updated the approval overlay to show network in the rendered
permission rule when requested.
  - Regenerated app-server schema fixtures for the new v2 wire shape.

2026-03-04 02:41:57 +00:00

..

AccountLoginCompletedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

AccountRateLimitsUpdatedNotification.json

feat: support multiple rate limits (#11260)

2026-02-10 20:09:31 -08:00

AccountUpdatedNotification.json

[codex] include plan type in account updates (#13181)

2026-03-01 13:43:37 -08:00

AgentMessageDeltaNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

AppListUpdatedNotification.json

[apps] Expose more fields from apps listing endpoints. (#11706)

2026-02-17 11:45:04 -08:00

AppsListParams.json

[apps] Add thread_id param to optionally load thread config for apps feature check. (#11279)

2026-02-09 23:10:26 -08:00

AppsListResponse.json

[apps] Expose more fields from apps listing endpoints. (#11706)

2026-02-17 11:45:04 -08:00

CancelLoginAccountParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

CancelLoginAccountResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

CommandExecParams.json

Feat: Preserve network access on read-only sandbox policies (#13409)

2026-03-04 02:41:57 +00:00

CommandExecResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

CommandExecutionOutputDeltaNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ConfigBatchWriteParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ConfigReadParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ConfigReadResponse.json

app-server service tier plumbing (plus some cleanup) (#13334)

2026-03-03 02:35:09 -08:00

ConfigRequirementsReadResponse.json

fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368)

2026-02-20 10:56:57 -08:00

ConfigValueWriteParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ConfigWarningNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ConfigWriteResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ContextCompactedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

DeprecationNoticeNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ErrorNotification.json

change model cap to server overload (#11388)

2026-02-11 17:16:27 -08:00

ExperimentalFeatureListParams.json

[app-server] Add a method to list experimental features. (#10721)

2026-02-05 20:04:01 +00:00

ExperimentalFeatureListResponse.json

Add stage field for experimental flags. (#10793)

2026-02-05 23:31:04 +00:00

ExternalAgentConfigDetectParams.json

Support external agent config detect and import (#12660)

2026-02-25 02:11:51 -08:00

ExternalAgentConfigDetectResponse.json

Support external agent config detect and import (#12660)

2026-02-25 02:11:51 -08:00

ExternalAgentConfigImportParams.json

Support external agent config detect and import (#12660)

2026-02-25 02:11:51 -08:00

ExternalAgentConfigImportResponse.json

Support external agent config detect and import (#12660)

2026-02-25 02:11:51 -08:00

FeedbackUploadParams.json

Add ability to attach extra files to feedback (#12370)

2026-02-20 22:26:14 +00:00

FeedbackUploadResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

FileChangeOutputDeltaNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

GetAccountParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

GetAccountRateLimitsResponse.json

feat: support multiple rate limits (#11260)

2026-02-10 20:09:31 -08:00

GetAccountResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ItemCompletedNotification.json

feat(app-server): add ThreadItem::DynamicToolCall (#12732)

2026-02-25 12:00:10 -08:00

ItemStartedNotification.json

feat(app-server): add ThreadItem::DynamicToolCall (#12732)

2026-02-25 12:00:10 -08:00

ListMcpServerStatusParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ListMcpServerStatusResponse.json

feat: replace custom mcp-types crate with equivalents from rmcp (#10349)

2026-02-02 17:41:55 -08:00

LoginAccountParams.json

fix(app-server): for external auth, replace id_token with chatgpt_acc… (#11240)

2026-02-09 20:48:58 -08:00

LoginAccountResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

LogoutAccountResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

McpServerOauthLoginCompletedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

McpServerOauthLoginParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

McpServerOauthLoginResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

McpServerRefreshResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

McpToolCallProgressNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ModelListParams.json

fix: send unfiltered models over model/list (#11793)

2026-02-13 16:26:32 -08:00

ModelListResponse.json

Add model availability NUX metadata (#12972)

2026-02-26 22:02:57 -08:00

ModelReroutedNotification.json

Feat: add model reroute notification (#12001)

2026-02-17 11:02:23 -08:00

PlanDeltaNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

RawResponseItemCompletedNotification.json

Add under-development original-resolution view_image support (#13050)

2026-03-03 15:56:54 -08:00

ReasoningSummaryPartAddedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ReasoningSummaryTextDeltaNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ReasoningTextDeltaNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ReviewStartParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ReviewStartResponse.json

feat(app-server): add ThreadItem::DynamicToolCall (#12732)

2026-02-25 12:00:10 -08:00

ServerRequestResolvedNotification.json

app-server: Replay pending item requests on thread/resume (#12560)

2026-02-27 12:45:59 -08:00

SkillsChangedNotification.json

feat(app-server): add a skills/changed v2 notification (#13414)

2026-03-03 17:01:00 -08:00

SkillsConfigWriteParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

SkillsConfigWriteResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

SkillsListParams.json

feat: extend skills/list to support additional roots. (#10835)

2026-02-09 13:30:38 -08:00

SkillsListResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

SkillsRemoteReadParams.json

app-server: Emit thread archive/unarchive notifications (#12030)

2026-02-17 14:53:58 -08:00

SkillsRemoteReadResponse.json

feat: add APIs to list and download public remote skills (#10448)

2026-02-03 14:09:37 -08:00

SkillsRemoteWriteParams.json

Add remote skill scope/product_surface/enabled params and cleanup (#11801)

2026-02-17 11:05:22 -08:00

SkillsRemoteWriteResponse.json

app-server: Emit thread archive/unarchive notifications (#12030)

2026-02-17 14:53:58 -08:00

TerminalInteractionNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadArchivedNotification.json

app-server: Emit thread archive/unarchive notifications (#12030)

2026-02-17 14:53:58 -08:00

ThreadArchiveParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadArchiveResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadClosedNotification.json

feat(app-server): thread/unsubscribe API (#10954)

2026-02-25 13:14:30 -08:00

ThreadCompactStartParams.json

Add thread/compact v2 (#10445)

2026-02-03 18:15:55 -08:00

ThreadCompactStartResponse.json

Add thread/compact v2 (#10445)

2026-02-03 18:15:55 -08:00

ThreadForkParams.json

app-server service tier plumbing (plus some cleanup) (#13334)

2026-03-03 02:35:09 -08:00

ThreadForkResponse.json

Feat: Preserve network access on read-only sandbox policies (#13409)

2026-03-04 02:41:57 +00:00

ThreadListParams.json

feat: add search term to thread list (#12578)

2026-02-25 09:59:41 +00:00

ThreadListResponse.json

app-server: Add ephemeral field to Thread object (#13084)

2026-02-27 17:42:25 -08:00

ThreadLoadedListParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadLoadedListResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadMetadataUpdateParams.json

Add thread metadata update endpoint to app server (#13280)

2026-03-03 15:56:11 -08:00

ThreadMetadataUpdateResponse.json

Add thread metadata update endpoint to app server (#13280)

2026-03-03 15:56:11 -08:00

ThreadNameUpdatedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadReadParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadReadResponse.json

app-server: Add ephemeral field to Thread object (#13084)

2026-02-27 17:42:25 -08:00

ThreadRealtimeClosedNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeErrorNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeItemAddedNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeOutputAudioDeltaNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadRealtimeStartedNotification.json

Add app-server v2 thread realtime API (#12715)

2026-02-25 09:59:10 -08:00

ThreadResumeParams.json

Add under-development original-resolution view_image support (#13050)

2026-03-03 15:56:54 -08:00

ThreadResumeResponse.json

Feat: Preserve network access on read-only sandbox policies (#13409)

2026-03-04 02:41:57 +00:00

ThreadRollbackParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadRollbackResponse.json

app-server: Add ephemeral field to Thread object (#13084)

2026-02-27 17:42:25 -08:00

ThreadSetNameParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadSetNameResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadStartedNotification.json

app-server: Add ephemeral field to Thread object (#13084)

2026-02-27 17:42:25 -08:00

ThreadStartParams.json

app-server service tier plumbing (plus some cleanup) (#13334)

2026-03-03 02:35:09 -08:00

ThreadStartResponse.json

Feat: Preserve network access on read-only sandbox policies (#13409)

2026-03-04 02:41:57 +00:00

ThreadStatusChangedNotification.json

app-server: expose loaded thread status via read/list and notifications (#11786)

2026-02-18 15:20:03 -08:00

ThreadTokenUsageUpdatedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadUnarchivedNotification.json

app-server: Emit thread archive/unarchive notifications (#12030)

2026-02-17 14:53:58 -08:00

ThreadUnarchiveParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

ThreadUnarchiveResponse.json

app-server: Add ephemeral field to Thread object (#13084)

2026-02-27 17:42:25 -08:00

ThreadUnsubscribeParams.json

feat(app-server): thread/unsubscribe API (#10954)

2026-02-25 13:14:30 -08:00

ThreadUnsubscribeResponse.json

feat(app-server): thread/unsubscribe API (#10954)

2026-02-25 13:14:30 -08:00

TurnCompletedNotification.json

feat(app-server): add ThreadItem::DynamicToolCall (#12732)

2026-02-25 12:00:10 -08:00

TurnDiffUpdatedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

TurnInterruptParams.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

TurnInterruptResponse.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

TurnPlanUpdatedNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

TurnStartedNotification.json

feat(app-server): add ThreadItem::DynamicToolCall (#12732)

2026-02-25 12:00:10 -08:00

TurnStartParams.json

Feat: Preserve network access on read-only sandbox policies (#13409)

2026-03-04 02:41:57 +00:00

TurnStartResponse.json

feat(app-server): add ThreadItem::DynamicToolCall (#12732)

2026-02-25 12:00:10 -08:00

TurnSteerParams.json

feat(app-server): turn/steer API (#10821)

2026-02-06 00:35:04 +00:00

TurnSteerResponse.json

feat(app-server): turn/steer API (#10821)

2026-02-06 00:35:04 +00:00

WindowsSandboxSetupCompletedNotification.json

app-server support for Windows sandbox setup. (#12025)

2026-02-18 13:03:16 -08:00

WindowsSandboxSetupStartParams.json

app-server support for Windows sandbox setup. (#12025)

2026-02-18 13:03:16 -08:00

WindowsSandboxSetupStartResponse.json

app-server support for Windows sandbox setup. (#12025)

2026-02-18 13:03:16 -08:00

WindowsWorldWritableWarningNotification.json

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00