mirror of
https://github.com/openai/codex.git
synced 2026-05-03 02:46:39 +00:00
abbd74e2be
`SandboxPolicy::ReadOnly` previously implied broad read access and could
not express a narrower read surface.
This change introduces an explicit read-access model so we can support
user-configurable read restrictions in follow-up work, while preserving
current behavior today.
It also ensures unsupported backends fail closed for restricted-read
policies instead of silently granting broader access than intended.
## What
- Added `ReadOnlyAccess` in protocol with:
- `Restricted { include_platform_defaults, readable_roots }`
- `FullAccess`
- Updated `SandboxPolicy` to carry read-access configuration:
- `ReadOnly { access: ReadOnlyAccess }`
- `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
- Preserved existing behavior by defaulting current construction paths
to `ReadOnlyAccess::FullAccess`.
- Threaded the new fields through sandbox policy consumers and call
sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
related tests.
- Updated Seatbelt policy generation to honor restricted read roots by
emitting scoped read rules when full read access is not granted.
- Added fail-closed behavior on Linux and Windows backends when
restricted read access is requested but not yet implemented there
(`UnsupportedOperation`).
- Regenerated app-server protocol schema and TypeScript artifacts,
including `ReadOnlyAccess`.
## Compatibility / rollout
- Runtime behavior remains unchanged by default (`FullAccess`).
- API/schema changes are in place so future config wiring can enable
restricted read access without another policy-shape migration.
61 lines
1.9 KiB
Rust
61 lines
1.9 KiB
Rust
use anyhow::Result;
|
|
pub use codex_protocol::protocol::SandboxPolicy;
|
|
|
|
pub fn parse_policy(value: &str) -> Result<SandboxPolicy> {
|
|
match value {
|
|
"read-only" => Ok(SandboxPolicy::new_read_only_policy()),
|
|
"workspace-write" => Ok(SandboxPolicy::new_workspace_write_policy()),
|
|
"danger-full-access" | "external-sandbox" => anyhow::bail!(
|
|
"DangerFullAccess and ExternalSandbox are not supported for sandboxing"
|
|
),
|
|
other => {
|
|
let parsed: SandboxPolicy = serde_json::from_str(other)?;
|
|
if matches!(
|
|
parsed,
|
|
SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
|
|
) {
|
|
anyhow::bail!(
|
|
"DangerFullAccess and ExternalSandbox are not supported for sandboxing"
|
|
);
|
|
}
|
|
Ok(parsed)
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn rejects_external_sandbox_preset() {
|
|
let err = parse_policy("external-sandbox").unwrap_err();
|
|
assert!(err
|
|
.to_string()
|
|
.contains("DangerFullAccess and ExternalSandbox are not supported"));
|
|
}
|
|
|
|
#[test]
|
|
fn rejects_external_sandbox_json() {
|
|
let payload = serde_json::to_string(
|
|
&codex_protocol::protocol::SandboxPolicy::ExternalSandbox {
|
|
network_access: codex_protocol::protocol::NetworkAccess::Enabled,
|
|
},
|
|
)
|
|
.unwrap();
|
|
let err = parse_policy(&payload).unwrap_err();
|
|
assert!(err
|
|
.to_string()
|
|
.contains("DangerFullAccess and ExternalSandbox are not supported"));
|
|
}
|
|
|
|
#[test]
|
|
fn parses_read_only_policy() {
|
|
assert_eq!(
|
|
parse_policy("read-only").unwrap(),
|
|
SandboxPolicy::new_read_only_policy()
|
|
);
|
|
}
|
|
}
|