Skip to content

Commit 3d392a8

Browse files
bolinfestbolinfest
committed
rollout: persist turn permission profiles
1 parent 555ef16 commit 3d392a8

11 files changed

Lines changed: 48 additions & 1 deletion

File tree

‎codex-rs/core/src/context_manager/history_tests.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ fn reference_context_item() -> TurnContextItem {
133133
timezone: Some("America/Los_Angeles".to_string()),
134134
approval_policy: AskForApproval::OnRequest,
135135
sandbox_policy: SandboxPolicy::new_read_only_policy(),
136+
permission_profile: None,
136137
network: None,
137138
file_system_sandbox_policy: None,
138139
model: "gpt-test".to_string(),

‎codex-rs/core/src/context_manager/updates.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ fn build_permissions_update_item(
4242
}
4343

4444
let prev = previous?;
45-
if prev.sandbox_policy == *next.sandbox_policy.get()
45+
if prev.permission_profile() == next.permission_profile()
4646
&& prev.approval_policy == next.approval_policy.value()
4747
{
4848
return None;

‎codex-rs/core/src/session/rollout_reconstruction_tests.rs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ async fn record_initial_history_resumed_bare_turn_context_does_not_hydrate_previ
6868
timezone: turn_context.timezone.clone(),
6969
approval_policy: turn_context.approval_policy.value(),
7070
sandbox_policy: turn_context.sandbox_policy.get().clone(),
71+
permission_profile: None,
7172
network: None,
7273
file_system_sandbox_policy: None,
7374
model: previous_model.to_string(),
@@ -108,6 +109,7 @@ async fn record_initial_history_resumed_hydrates_previous_turn_settings_from_lif
108109
timezone: turn_context.timezone.clone(),
109110
approval_policy: turn_context.approval_policy.value(),
110111
sandbox_policy: turn_context.sandbox_policy.get().clone(),
112+
permission_profile: None,
111113
network: None,
112114
file_system_sandbox_policy: None,
113115
model: previous_model.to_string(),
@@ -903,6 +905,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
903905
timezone: turn_context.timezone.clone(),
904906
approval_policy: turn_context.approval_policy.value(),
905907
sandbox_policy: turn_context.sandbox_policy.get().clone(),
908+
permission_profile: None,
906909
network: None,
907910
file_system_sandbox_policy: None,
908911
model: previous_model.to_string(),
@@ -979,6 +982,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
979982
timezone: turn_context.timezone.clone(),
980983
approval_policy: turn_context.approval_policy.value(),
981984
sandbox_policy: turn_context.sandbox_policy.get().clone(),
985+
permission_profile: None,
982986
network: None,
983987
file_system_sandbox_policy: None,
984988
model: previous_model.to_string(),
@@ -1009,6 +1013,7 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu
10091013
timezone: turn_context.timezone.clone(),
10101014
approval_policy: turn_context.approval_policy.value(),
10111015
sandbox_policy: turn_context.sandbox_policy.get().clone(),
1016+
permission_profile: None,
10121017
network: None,
10131018
file_system_sandbox_policy: None,
10141019
model: previous_model.to_string(),
@@ -1122,6 +1127,7 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo
11221127
timezone: turn_context.timezone.clone(),
11231128
approval_policy: turn_context.approval_policy.value(),
11241129
sandbox_policy: turn_context.sandbox_policy.get().clone(),
1130+
permission_profile: None,
11251131
network: None,
11261132
file_system_sandbox_policy: None,
11271133
model: current_model.to_string(),
@@ -1233,6 +1239,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea
12331239
timezone: turn_context.timezone.clone(),
12341240
approval_policy: turn_context.approval_policy.value(),
12351241
sandbox_policy: turn_context.sandbox_policy.get().clone(),
1242+
permission_profile: None,
12361243
network: None,
12371244
file_system_sandbox_policy: None,
12381245
model: previous_model.to_string(),
@@ -1383,6 +1390,7 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear
13831390
timezone: turn_context.timezone.clone(),
13841391
approval_policy: turn_context.approval_policy.value(),
13851392
sandbox_policy: turn_context.sandbox_policy.get().clone(),
1393+
permission_profile: None,
13861394
network: None,
13871395
file_system_sandbox_policy: None,
13881396
model: previous_model.to_string(),

‎codex-rs/core/src/session/tests.rs‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1736,6 +1736,7 @@ async fn record_initial_history_forked_hydrates_previous_turn_settings() {
17361736
timezone: turn_context.timezone.clone(),
17371737
approval_policy: turn_context.approval_policy.value(),
17381738
sandbox_policy: turn_context.sandbox_policy.get().clone(),
1739+
permission_profile: None,
17391740
network: None,
17401741
file_system_sandbox_policy: None,
17411742
model: previous_model.to_string(),
@@ -5226,6 +5227,10 @@ async fn turn_context_item_omits_legacy_equivalent_file_system_sandbox_policy()
52265227
let item = turn_context.to_turn_context_item();
52275228

52285229
assert_eq!(item.file_system_sandbox_policy, None);
5230+
assert_eq!(
5231+
item.permission_profile,
5232+
Some(turn_context.permission_profile())
5233+
);
52295234
}
52305235

52315236
#[tokio::test]
@@ -5240,6 +5245,10 @@ async fn turn_context_item_stores_split_file_system_sandbox_policy_when_differen
52405245
item.file_system_sandbox_policy,
52415246
Some(file_system_sandbox_policy)
52425247
);
5248+
assert_eq!(
5249+
item.permission_profile,
5250+
Some(turn_context.permission_profile())
5251+
);
52435252
}
52445253

52455254
#[tokio::test]

‎codex-rs/core/src/session/turn_context.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,7 @@ impl TurnContext {
260260
timezone: self.timezone.clone(),
261261
approval_policy: self.approval_policy.value(),
262262
sandbox_policy: self.sandbox_policy.get().clone(),
263+
permission_profile: Some(self.permission_profile()),
263264
network: self.turn_context_network_item(),
264265
file_system_sandbox_policy: self.non_legacy_file_system_sandbox_policy(),
265266
model: self.model_info.slug.clone(),

‎codex-rs/core/tests/suite/resume_warning.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ fn resume_history(
3333
timezone: None,
3434
approval_policy: config.permissions.approval_policy.value(),
3535
sandbox_policy: config.permissions.sandbox_policy.get().clone(),
36+
permission_profile: None,
3637
network: None,
3738
file_system_sandbox_policy: None,
3839
model: previous_model.to_string(),

‎codex-rs/protocol/src/protocol.rs‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2913,6 +2913,8 @@ pub struct TurnContextItem {
29132913
pub timezone: Option<String>,
29142914
pub approval_policy: AskForApproval,
29152915
pub sandbox_policy: SandboxPolicy,
2916+
#[serde(default, skip_serializing_if = "Option::is_none")]
2917+
pub permission_profile: Option<PermissionProfile>,
29162918
#[serde(skip_serializing_if = "Option::is_none")]
29172919
pub network: Option<TurnContextNetworkItem>,
29182920
#[serde(default, skip_serializing_if = "Option::is_none")]
@@ -2937,6 +2939,24 @@ pub struct TurnContextItem {
29372939
pub truncation_policy: Option<TruncationPolicy>,
29382940
}
29392941

2942+
impl TurnContextItem {
2943+
pub fn permission_profile(&self) -> PermissionProfile {
2944+
self.permission_profile.clone().unwrap_or_else(|| {
2945+
let file_system_sandbox_policy =
2946+
self.file_system_sandbox_policy.clone().unwrap_or_else(|| {
2947+
FileSystemSandboxPolicy::from_legacy_sandbox_policy(
2948+
&self.sandbox_policy,
2949+
&self.cwd,
2950+
)
2951+
});
2952+
PermissionProfile::from_runtime_permissions(
2953+
&file_system_sandbox_policy,
2954+
NetworkSandboxPolicy::from(&self.sandbox_policy),
2955+
)
2956+
})
2957+
}
2958+
}
2959+
29402960
#[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, JsonSchema, TS)]
29412961
#[serde(tag = "mode", content = "limit", rename_all = "snake_case")]
29422962
pub enum TruncationPolicy {
@@ -5069,6 +5089,7 @@ mod tests {
50695089
timezone: None,
50705090
approval_policy: AskForApproval::Never,
50715091
sandbox_policy: SandboxPolicy::DangerFullAccess,
5092+
permission_profile: None,
50725093
network: Some(TurnContextNetworkItem {
50735094
allowed_domains: vec!["api.example.com".to_string()],
50745095
denied_domains: vec!["blocked.example.com".to_string()],

‎codex-rs/rollout/src/recorder_tests.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -547,6 +547,7 @@ async fn resume_candidate_matches_cwd_reads_latest_turn_context() -> std::io::Re
547547
timezone: None,
548548
approval_policy: AskForApproval::Never,
549549
sandbox_policy: SandboxPolicy::new_read_only_policy(),
550+
permission_profile: None,
550551
network: None,
551552
file_system_sandbox_policy: None,
552553
model: "test-model".to_string(),

‎codex-rs/state/src/extract.rs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ mod tests {
303303
timezone: None,
304304
approval_policy: AskForApproval::Never,
305305
sandbox_policy: SandboxPolicy::DangerFullAccess,
306+
permission_profile: None,
306307
network: None,
307308
file_system_sandbox_policy: None,
308309
model: "gpt-5".to_string(),
@@ -342,6 +343,7 @@ mod tests {
342343
timezone: None,
343344
approval_policy: AskForApproval::OnRequest,
344345
sandbox_policy: SandboxPolicy::new_read_only_policy(),
346+
permission_profile: None,
345347
network: None,
346348
file_system_sandbox_policy: None,
347349
model: "gpt-5".to_string(),
@@ -375,6 +377,7 @@ mod tests {
375377
timezone: None,
376378
approval_policy: AskForApproval::OnRequest,
377379
sandbox_policy: SandboxPolicy::new_read_only_policy(),
380+
permission_profile: None,
378381
network: None,
379382
file_system_sandbox_policy: None,
380383
model: "gpt-5".to_string(),

‎codex-rs/tui/src/app.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9924,6 +9924,7 @@ guardian_approval = true
99249924
timezone: None,
99259925
approval_policy: primary_session.approval_policy,
99269926
sandbox_policy: primary_session.sandbox_policy.clone(),
9927+
permission_profile: None,
99279928
network: None,
99289929
file_system_sandbox_policy: None,
99299930
model: "gpt-agent".to_string(),

0 commit comments

Comments
 (0)