mirror of
https://github.com/openai/codex.git
synced 2026-04-30 11:21:34 +03:00
789f387982
## Why `ReadOnlyAccess` was a transitional legacy shape on `SandboxPolicy`: `FullAccess` meant the historical read-only/workspace-write modes could read the full filesystem, while `Restricted` tried to carry partial readable roots. The partial-read model now belongs in `FileSystemSandboxPolicy` and `PermissionProfile`, so keeping it on `SandboxPolicy` makes every legacy projection reintroduce lossy read-root bookkeeping and creates unnecessary noise in the rest of the permissions migration. This PR makes the legacy policy model narrower and explicit: `SandboxPolicy::ReadOnly` and `SandboxPolicy::WorkspaceWrite` represent the old full-read sandbox modes only. Split readable roots, deny-read globs, and platform-default/minimal read behavior stay in the runtime permissions model. ## What changed - Removes `ReadOnlyAccess` from `codex_protocol::protocol::SandboxPolicy`, including the generated `access` and `readOnlyAccess` API fields. - Updates legacy policy/profile conversions so restricted filesystem reads are represented only by `FileSystemSandboxPolicy` / `PermissionProfile` entries. - Keeps app-server v2 compatible with legacy `fullAccess` read-access payloads by accepting and ignoring that no-op shape, while rejecting legacy `restricted` read-access payloads instead of silently widening them to full-read legacy policies. - Carries Windows sandbox platform-default read behavior with an explicit override flag instead of depending on `ReadOnlyAccess::Restricted`. - Refreshes generated app-server schema/types and updates tests/docs for the simplified legacy policy shape. ## Verification - `cargo check -p codex-app-server-protocol --tests` - `cargo check -p codex-windows-sandbox --tests` - `cargo test -p codex-app-server-protocol sandbox_policy_` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19449). * #19395 * #19394 * #19393 * #19392 * #19391 * __->__ #19449
589 lines
15 KiB
JSON
Generated
589 lines
15 KiB
JSON
Generated
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AbsolutePathBuf": {
|
|
"description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
|
|
"type": "string"
|
|
},
|
|
"CommandExecTerminalSize": {
|
|
"description": "PTY size in character cells for `command/exec` PTY sessions.",
|
|
"properties": {
|
|
"cols": {
|
|
"description": "Terminal width in character cells.",
|
|
"format": "uint16",
|
|
"minimum": 0.0,
|
|
"type": "integer"
|
|
},
|
|
"rows": {
|
|
"description": "Terminal height in character cells.",
|
|
"format": "uint16",
|
|
"minimum": 0.0,
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"cols",
|
|
"rows"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"FileSystemAccessMode": {
|
|
"enum": [
|
|
"read",
|
|
"write",
|
|
"none"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"FileSystemPath": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"path": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"path"
|
|
],
|
|
"title": "PathFileSystemPathType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"path",
|
|
"type"
|
|
],
|
|
"title": "PathFileSystemPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"pattern": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"glob_pattern"
|
|
],
|
|
"title": "GlobPatternFileSystemPathType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"pattern",
|
|
"type"
|
|
],
|
|
"title": "GlobPatternFileSystemPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"special"
|
|
],
|
|
"title": "SpecialFileSystemPathType",
|
|
"type": "string"
|
|
},
|
|
"value": {
|
|
"$ref": "#/definitions/FileSystemSpecialPath"
|
|
}
|
|
},
|
|
"required": [
|
|
"type",
|
|
"value"
|
|
],
|
|
"title": "SpecialFileSystemPath",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"FileSystemSandboxEntry": {
|
|
"properties": {
|
|
"access": {
|
|
"$ref": "#/definitions/FileSystemAccessMode"
|
|
},
|
|
"path": {
|
|
"$ref": "#/definitions/FileSystemPath"
|
|
}
|
|
},
|
|
"required": [
|
|
"access",
|
|
"path"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"FileSystemSpecialPath": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"root"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "RootFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"minimal"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "MinimalFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"current_working_directory"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "CurrentWorkingDirectoryFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"project_roots"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"subpath": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "KindFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"tmpdir"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "TmpdirFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"slash_tmp"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"kind"
|
|
],
|
|
"title": "SlashTmpFileSystemSpecialPath",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kind": {
|
|
"enum": [
|
|
"unknown"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"subpath": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"kind",
|
|
"path"
|
|
],
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"NetworkAccess": {
|
|
"enum": [
|
|
"restricted",
|
|
"enabled"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"PermissionProfile": {
|
|
"oneOf": [
|
|
{
|
|
"description": "Codex owns sandbox construction for this profile.",
|
|
"properties": {
|
|
"fileSystem": {
|
|
"$ref": "#/definitions/PermissionProfileFileSystemPermissions"
|
|
},
|
|
"network": {
|
|
"$ref": "#/definitions/PermissionProfileNetworkPermissions"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"managed"
|
|
],
|
|
"title": "ManagedPermissionProfileType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"fileSystem",
|
|
"network",
|
|
"type"
|
|
],
|
|
"title": "ManagedPermissionProfile",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "Do not apply an outer sandbox.",
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"disabled"
|
|
],
|
|
"title": "DisabledPermissionProfileType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "DisabledPermissionProfile",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"description": "Filesystem isolation is enforced by an external caller.",
|
|
"properties": {
|
|
"network": {
|
|
"$ref": "#/definitions/PermissionProfileNetworkPermissions"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"external"
|
|
],
|
|
"title": "ExternalPermissionProfileType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"network",
|
|
"type"
|
|
],
|
|
"title": "ExternalPermissionProfile",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"PermissionProfileFileSystemPermissions": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"entries": {
|
|
"items": {
|
|
"$ref": "#/definitions/FileSystemSandboxEntry"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"globScanMaxDepth": {
|
|
"format": "uint",
|
|
"minimum": 1.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"restricted"
|
|
],
|
|
"title": "RestrictedPermissionProfileFileSystemPermissionsType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"entries",
|
|
"type"
|
|
],
|
|
"title": "RestrictedPermissionProfileFileSystemPermissions",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"unrestricted"
|
|
],
|
|
"title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "UnrestrictedPermissionProfileFileSystemPermissions",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"PermissionProfileNetworkPermissions": {
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"SandboxPolicy": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": [
|
|
"dangerFullAccess"
|
|
],
|
|
"title": "DangerFullAccessSandboxPolicyType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "DangerFullAccessSandboxPolicy",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"networkAccess": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"readOnly"
|
|
],
|
|
"title": "ReadOnlySandboxPolicyType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "ReadOnlySandboxPolicy",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"networkAccess": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/NetworkAccess"
|
|
}
|
|
],
|
|
"default": "restricted"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"externalSandbox"
|
|
],
|
|
"title": "ExternalSandboxSandboxPolicyType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "ExternalSandboxSandboxPolicy",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"excludeSlashTmp": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"excludeTmpdirEnvVar": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"networkAccess": {
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"workspaceWrite"
|
|
],
|
|
"title": "WorkspaceWriteSandboxPolicyType",
|
|
"type": "string"
|
|
},
|
|
"writableRoots": {
|
|
"default": [],
|
|
"items": {
|
|
"$ref": "#/definitions/AbsolutePathBuf"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
],
|
|
"title": "WorkspaceWriteSandboxPolicy",
|
|
"type": "object"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"description": "Run a standalone command (argv vector) in the server sandbox without creating a thread or turn.\n\nThe final `command/exec` response is deferred until the process exits and is sent only after all `command/exec/outputDelta` notifications for that connection have been emitted.",
|
|
"properties": {
|
|
"command": {
|
|
"description": "Command argv vector. Empty arrays are rejected.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"cwd": {
|
|
"description": "Optional working directory. Defaults to the server cwd.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"disableOutputCap": {
|
|
"description": "Disable stdout/stderr capture truncation for this request.\n\nCannot be combined with `outputBytesCap`.",
|
|
"type": "boolean"
|
|
},
|
|
"disableTimeout": {
|
|
"description": "Disable the timeout entirely for this request.\n\nCannot be combined with `timeoutMs`.",
|
|
"type": "boolean"
|
|
},
|
|
"env": {
|
|
"additionalProperties": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"description": "Optional environment overrides merged into the server-computed environment.\n\nMatching names override inherited values. Set a key to `null` to unset an inherited variable.",
|
|
"type": [
|
|
"object",
|
|
"null"
|
|
]
|
|
},
|
|
"outputBytesCap": {
|
|
"description": "Optional per-stream stdout/stderr capture cap in bytes.\n\nWhen omitted, the server default applies. Cannot be combined with `disableOutputCap`.",
|
|
"format": "uint",
|
|
"minimum": 0.0,
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"permissionProfile": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/PermissionProfile"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Optional full permissions profile for this command.\n\nDefaults to the user's configured permissions when omitted. Cannot be combined with `sandboxPolicy`."
|
|
},
|
|
"processId": {
|
|
"description": "Optional client-supplied, connection-scoped process id.\n\nRequired for `tty`, `streamStdin`, `streamStdoutStderr`, and follow-up `command/exec/write`, `command/exec/resize`, and `command/exec/terminate` calls. When omitted, buffered execution gets an internal id that is not exposed to the client.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"sandboxPolicy": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/SandboxPolicy"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Optional sandbox policy for this command.\n\nUses the same shape as thread/turn execution sandbox configuration and defaults to the user's configured policy when omitted. Cannot be combined with `permissionProfile`."
|
|
},
|
|
"size": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/CommandExecTerminalSize"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Optional initial PTY size in character cells. Only valid when `tty` is true."
|
|
},
|
|
"streamStdin": {
|
|
"description": "Allow follow-up `command/exec/write` requests to write stdin bytes.\n\nRequires a client-supplied `processId`.",
|
|
"type": "boolean"
|
|
},
|
|
"streamStdoutStderr": {
|
|
"description": "Stream stdout/stderr via `command/exec/outputDelta` notifications.\n\nStreamed bytes are not duplicated into the final response and require a client-supplied `processId`.",
|
|
"type": "boolean"
|
|
},
|
|
"timeoutMs": {
|
|
"description": "Optional timeout in milliseconds.\n\nWhen omitted, the server default applies. Cannot be combined with `disableTimeout`.",
|
|
"format": "int64",
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
]
|
|
},
|
|
"tty": {
|
|
"description": "Enable PTY mode.\n\nThis implies `streamStdin` and `streamStdoutStderr`.",
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"required": [
|
|
"command"
|
|
],
|
|
"title": "CommandExecParams",
|
|
"type": "object"
|
|
} |