Home

Home

Wiki

Wiki

Review

Review

Docs

Docs

PR #8961

1New DeveloperInstructions Builder

10 files+237−28

user_instructions.rscodex-rs/core/src

BUILD.bazelcodex-rs/protocol

models.rscodex-rs/protocol/src

never.mdcodex-rs/protocol/src/prompts/permissions/approval_policy

on_failure.mdcodex-rs/protocol/src/prompts/permissions/approval_policy

+5 more files

Read explanation

The DeveloperInstructions struct moved from core/src/user_instructions.rs to protocol/src/models.rs and gained a new factory method that constructs permissions messages from runtime configuration.

models.rs:189-231

rust

impl DeveloperInstructions {    pub fn new<T: Into<String>>(text: T) -> Self    pub fn into_text(self) -> String    pub fn concat(self, other: impl Into<Self>) -> Self    /// Main entry point: builds permissions    /// message from current policy settings    pub fn from_policy(        sandbox_policy: &SandboxPolicy,        approval_policy: AskForApproval,        cwd: &Path,    ) -> Self {        // Derive network_access from sandbox_policy        // Derive sandbox_mode and writable_roots        // Combine into structured message    }}

The message content comes from template files that get include_str!'d at compile time:

prompts/permissions/├── approval_policy/│   ├── never.md│   ├── on_failure.md│   ├── on_request.md│   └── unless_trusted.md└── sandbox_mode/    ├── danger_full_access.md    ├── read_only.md    └── workspace_write.md

Each template contains the prose for that mode. For example, workspace_write.mdworkspace_write.md:1:

markdown

Filesystem sandboxing defines which filescan be read or written. `sandbox_mode` is`workspace-write`: The sandbox permitsreading files, and editing files in `cwd`and `writable_roots`. Editing files inother directories requires approval.Network access is {network_access}.

The {network_access} placeholder is replaced with enabled or restricted at runtime models.rs:272-281.

2Permissions Message Injection in Session

1 file+51−7

codex.rscodex-rs/core/src

Read explanation

The permissions message is injected at three points in the session lifecycle.

At session start — added to build_initial_context(): codex.rs:1364-1374

rust

fn build_initial_context(&self, ctx: &TurnContext)    -> Vec<ResponseItem>{    let mut items = Vec::with_capacity(4); // was 3        // NEW: permissions message first    items.push(        DeveloperInstructions::from_policy(            &ctx.sandbox_policy,            ctx.approval_policy,            &ctx.cwd,        ).into()    );        // Then: developer_instructions,    //       user_instructions, environment    ...}

When policies change mid-session — new method build_permissions_update_item(): codex.rs:1012-1032

rust

fn build_permissions_update_item(    &self,    previous: Option<&Arc<TurnContext>>,    next: &TurnContext,) -> Option<ResponseItem> {    let prev = previous?;    if prev.sandbox_policy == next.sandbox_policy        && prev.approval_policy == next.approval_policy    {        return None;  // no change, no message    }    Some(DeveloperInstructions::from_policy(...).into())}

This is called during user input handling codex.rs:1895-1901 alongside the existing environment update check.

On resume/fork — initial context appended after reconstructed history: codex.rs:855-859

rust

// After reconstructing history from rollout:let initial_context =    self.build_initial_context(&turn_context);self.record_conversation_items(    &turn_context, &initial_context).await;

3Simplified EnvironmentContext

1 file+20−223

environment_context.rscodex-rs/core/src

Read explanation

Since sandbox/approval info moved to the permissions message, EnvironmentContext was slimmed down significantly.

environment_context.rs:17-25

diff

    pub struct EnvironmentContext {      pub cwd: Option<PathBuf>,-     pub approval_policy: Option<AskForApproval>,-     pub sandbox_mode: Option<SandboxMode>,-     pub network_access: Option<NetworkAccess>,-     pub writable_roots: Option<Vec<AbsolutePathBuf>>,      pub shell: Shell,  }

The constructor simplified from a complex match on SandboxPolicy to: environment_context.rs:19-20

rust

pub fn new(cwd: Option<PathBuf>, shell: Shell) -> Self {    Self { cwd, shell }}

The equals_except_shell() comparison now only checks cwdenvironment_context.rs:27-34, and the XML serialization no longer emits approval/sandbox/network tags environment_context.rs:51-70.

4Removed Static Prompt Sections

7 files−255

gpt-5.1-codex-max_prompt.mdcodex-rs/core

gpt-5.2-codex_prompt.mdcodex-rs/core

gpt_5_1_prompt.mdcodex-rs/core

gpt_5_2_prompt.mdcodex-rs/core

gpt_5_codex_prompt.mdcodex-rs/core

+2 more files

Read explanation

The "Codex CLI harness, sandboxing, and approvals" section (~35 lines) was removed from all prompt markdown files since this content is now generated dynamically:

prompt.md
5New permissions_messages Test Suite

2 files+449

mod.rscodex-rs/core/tests/suite

permissions_messages.rscodex-rs/core/tests/suite

Read explanation

A comprehensive test file validates the new permissions messaging behavior permissions_messages.rs:1-448:

permissions_message_sent_once_on_start — verifies single emission at session start
- permissions_message_added_on_override_change — verifies re-emission when policy changes
- permissions_message_not_added_when_no_change — verifies no duplicate when policy unchanged
- resume_replays_permissions_messages — verifies history replay on resume
- resume_and_fork_append_permissions_messages — verifies fresh context appended on resume/fork
- permissions_message_includes_writable_roots — verifies writable roots formatting
6Test Adjustments for New Message Structure

9 files+332−142

send_message.rscodex-rs/app-server/tests/suite

truncation.rscodex-rs/core/src/rollout

thread_manager.rscodex-rs/core/src

client.rscodex-rs/core/tests/suite

compact.rscodex-rs/core/tests/suite

+4 more files

Read explanation

Tests throughout the codebase were updated to account for the new permissions message at input[0]. Most changes are mechanical index shifts (e.g., input[0] → input[1]) and additions of permissions_message to expected JSON structures.

Key patterns:

Request body assertions now check for permissions message first client.rs:652-659
- Resume/fork tests verify message ordering client.rs:345-349
- Compact tests filter out permissions messages when comparing compact.rs:607-614
- Fork tests account for initial context appended after truncation fork_thread.rs:141-143

Merged

openai/codex #8961

Assemble sandbox/approval/network prompts dynamically

AIaibrahim-oai

main dynamic/permissions/instructions

30 files

+1089−655

DescriptionDiscussion41Commits48

Devin's AI analysis

This PR moves sandbox/approval/network permission instructions from static system prompt files into dynamically generated developer messages. Previously, these instructions were baked into markdown files and sent identically to every session. Now they're constructed at runtime based on actual configuration.

Key change: A new DeveloperInstructions::from_policy() method models.rs:204-231 builds a developer-role message from the current SandboxPolicy and AskForApproval settings. This message is:

Injected at session start via build_initial_context()codex.rs:1367-1374
Re-injected when policies change mid-session via build_permissions_update_item()codex.rs:1012-1032
Appended after reconstructed history on resume/fork codex.rs:855-859

Consequence: EnvironmentContext no longer carries approval_policy, sandbox_mode, network_access, or writable_roots fields—these moved to the permissions message. The struct now only holds cwd and shell.

Request structure change:

Before:  input[0]: user instructions (AGENTS.md)  input[1]: environment context  input[2]: user messageAfter:  input[0]: permissions (developer role)  input[1]: user instructions (AGENTS.md)  input[2]: environment context  input[3]: user message

Add a single builder for developer permissions messaging that accepts SandboxPolicy and approval policy. This builder now drives the developer “permissions” message that’s injected at session start and any time sandbox/approval settings change.
Trim EnvironmentContext to only include cwd, writable roots, and shell; removed sandbox/approval/network duplication and adjusted XML serialization and tests accordingly.

Follow-up: adding a config value to replace the developer permissions message for custom sandboxes.

Filter

aibrahim-oai112d

@codex review

chatgpt-codex-connector

commented

112d

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:a40e5a755a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

models.rsOutdatedResolved

aibrahim-oai112d

@codex review this and make sure tests changes didn't invalidate tests original intentions

chatgpt-codex-connector

commented

112d

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:2240249141

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

prompt_caching.rsOutdatedResolved

aibrahim-oai112d

@codex review this

chatgpt-codex-connector

commented

112d

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:fc5c68019b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

on_request.mdOutdatedResolved

aibrahim-oai112d

@codex review

chatgpt-codex-connector112d

Codex Review: Didn't find any major issues. Swish!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

PApakrym-oai

commented

112d

models.rsL175

pakrym-oai112d

a bit strange to see all of this formatting stuff in the protocol

aibrahim-oai112d

Yeah, just so that they can be methods on the structs. I can move them with the structs to core.

dylan-hurd-oai109d

Agree w/ pavel. Is the plan to start using DeveloperInstructions as a serialized struct?

aibrahim-oai109d

no I can move it

PApakrym-oai

commented

112d

models.rsOutdated

pakrym-oai112d

A lot of methods. Do we have this many callsites that we need all the overrides?

aibrahim-oai112d

Not really, we can have one method but just wanted to divide responsibility so we don't have a super long function with complicated logic.

pakrym-oai112d

You can return strings from helper method and make them private.

PApakrym-oai

commented

112d

models.rsOutdated

pakrym-oai112d

Why are these values encoded here? is there an existing place where we convert SandboxPolicy to SandboxMode/network?

PApakrym-oai

commented

112d

models.rsL289Resolved

PApakrym-oai

commented

112d

thread_manager.rsL405

pakrym-oai112d

is this expected?

👍1

aibrahim-oai109d

yes we added a new message

PApakrym-oai

commented

112d

environment_context.rsL14

pakrym-oai112d

we left so little here I wonder whether it matters.

aibrahim-oai112d

I want to move it to dev slowly per the plan.

aibrahim-oai111d

@codex do we append a new permission message on resume and fork next to the older messages? If yes, add an integration test. If not, change behavior and add integration test.

chatgpt-codex-connector111d

Summary

Appended a fresh permissions developer message when resuming or forking sessions and persisted it alongside reconstructed history for the new turn context. codex-rs/core/src/codex.rsL836-L861
Updated resume/fork history expectations and expanded permissions integration coverage to include a forked-session case and the extra permissions message count. codex-rs/core/src/codex.rsL2961-L3079 codex-rs/core/tests/suite/permissions_messages.rsL182-L327

Testing

✅ /root/.cargo/bin/just fmt
✅ /root/.cargo/bin/just fix -p codex-core
❌ cargo test -p codex-core (failed: default_client::tests::test_create_client_sets_default_headers; exec::tests::kill_child_process_group_kills_grandchildren_on_timeout; shell_snapshot::tests::linux_sh_snapshot_includes_sections; models_manager::manager::tests::refresh_available_models_{drops_removed_remote_models,refetches_when_cache_stale,sorts_and_marks_default,uses_cache_when_fresh}; unified_exec::tests::{reusing_completed_process_returns_unknown_process,multi_unified_exec_sessions})

View task →

dylan-hurd-oai

commented

109d

Some small comments but mostly LGTM!

codex.rsL1032

dylan-hurd-oai109d

(non-blocking) Should we move this out of codex.rs? Either into environment_context.rs or a new file

aibrahim-oai109d

it's on turn context unfortunately

codex.rsL2982Resolved

1,744 lines left

1New DeveloperInstructions Builder

0 / 10

user_instructions.rscodex-rs/core/src

−28

Mark as viewed

5 linesAll 77 lines5 lines

Move78–104

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]

#[serde(rename = "developer_instructions", rename_all = "snake_case")]

pub(crate) struct DeveloperInstructions {

text: String,

}

impl DeveloperInstructions {

pub fn new<T: Into<String>>(text: T) -> Self {

Self { text: text.into() }

}

pub fn into_text(self) -> String {

self.text

}

impl From<DeveloperInstructions> for ResponseItem {

fn from(di: DeveloperInstructions) -> Self {

ResponseItem::Message {

id: None,

role: "developer".to_string(),

content: vec![ContentItem::InputText {

100

text: di.into_text(),

101

}],

102

}

103

}

104

}

105

5 linesAll 88 lines5 lines

BUILD.bazelcodex-rs/protocol

Mark as viewed

load("//:defs.bzl", "codex_rust_crate")

codex_rust_crate(

name = "protocol",

crate_name = "codex_protocol",

compile_data = glob(["src/prompts/permissions/**/*.md"]),

)

models.rscodex-rs/protocol/src

+218

Mark as viewed

use std::collections::HashMap;

use std::path::Path;

5 linesAll 10 lines5 lines

use crate::config_types::SandboxMode;

use crate::protocol::AskForApproval;

use crate::protocol::NetworkAccess;

use crate::protocol::SandboxPolicy;

use crate::protocol::WritableRoot;

5 linesAll 149 lines5 lines

Move167–294

167

/// Developer-provided guidance that is injected into a turn as a developer role

168

/// message.

169

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, JsonSchema, TS)]

170

#[serde(rename = "developer_instructions", rename_all = "snake_case")]

171

pub struct DeveloperInstructions {

172

text: String,

173

}

174

PA4

CommentR175

175

const APPROVAL_POLICY_NEVER: &str = include_str!("prompts/permissions/approval_policy/never.md");

176

const APPROVAL_POLICY_UNLESS_TRUSTED: &str =

177

include_str!("prompts/permissions/approval_policy/unless_trusted.md");

178

const APPROVAL_POLICY_ON_FAILURE: &str =

179

include_str!("prompts/permissions/approval_policy/on_failure.md");

180

const APPROVAL_POLICY_ON_REQUEST: &str =

181

include_str!("prompts/permissions/approval_policy/on_request.md");

182

183

const SANDBOX_MODE_DANGER_FULL_ACCESS: &str =

184

include_str!("prompts/permissions/sandbox_mode/danger_full_access.md");

185

const SANDBOX_MODE_WORKSPACE_WRITE: &str =

186

include_str!("prompts/permissions/sandbox_mode/workspace_write.md");

187

const SANDBOX_MODE_READ_ONLY: &str = include_str!("prompts/permissions/sandbox_mode/read_only.md");

188

189

impl DeveloperInstructions {

190

pub fn new<T: Into<String>>(text: T) -> Self {

191

Self { text: text.into() }

192

}

193

194

pub fn into_text(self) -> String {

195

self.text

196

}

197

198

pub fn concat(self, other: impl Into<DeveloperInstructions>) -> Self {

199

let mut text = self.text;

200

text.push_str(&other.into().text);

201

Self { text }

202

}

203

204

pub fn from_policy(

205

sandbox_policy: &SandboxPolicy,

206

approval_policy: AskForApproval,

207

cwd: &Path,

208

) -> Self {

209

let network_access = if sandbox_policy.has_full_network_access() {

210

NetworkAccess::Enabled

211

} else {

212

NetworkAccess::Restricted

213

};

214

215

let (sandbox_mode, writable_roots) = match sandbox_policy {

216

SandboxPolicy::DangerFullAccess => (SandboxMode::DangerFullAccess, None),

217

SandboxPolicy::ReadOnly => (SandboxMode::ReadOnly, None),

218

SandboxPolicy::ExternalSandbox { .. } => (SandboxMode::DangerFullAccess, None),

219

SandboxPolicy::WorkspaceWrite { .. } => {

220

let roots = sandbox_policy.get_writable_roots_with_cwd(cwd);

221

(SandboxMode::WorkspaceWrite, Some(roots))

222

}

223

};

224

225

DeveloperInstructions::from_permissions_with_network(

226

sandbox_mode,

227

network_access,

228

approval_policy,

229

writable_roots,

230

)

231

}

232

233

fn from_permissions_with_network(

234

sandbox_mode: SandboxMode,

235

network_access: NetworkAccess,

236

approval_policy: AskForApproval,

237

writable_roots: Option<Vec<WritableRoot>>,

238

) -> Self {

239

let start_tag = DeveloperInstructions::new("<permissions instructions>");

240

let end_tag = DeveloperInstructions::new("</permissions instructions>");

241

start_tag

242

.concat(DeveloperInstructions::sandbox_text(

243

sandbox_mode,

244

network_access,

245

))

246

.concat(DeveloperInstructions::from(approval_policy))

247

.concat(DeveloperInstructions::from_writable_roots(writable_roots))

248

.concat(end_tag)

249

}

250

251

fn from_writable_roots(writable_roots: Option<Vec<WritableRoot>>) -> Self {

252

let Some(roots) = writable_roots else {

253

return DeveloperInstructions::new("");

254

};

255

256

if roots.is_empty() {

257

return DeveloperInstructions::new("");

258

}

259

260

let roots_list: Vec<String> = roots

261

.iter()

262

.map(|r| format!("`{}`", r.root.to_string_lossy()))

263

.collect();

264

let text = if roots_list.len() == 1 {

265

format!(" The writable root is {}.", roots_list[0])

266

} else {

267

format!(" The writable roots are {}.", roots_list.join(", "))

268

};

269

DeveloperInstructions::new(text)

270

}

271

InformationalR272-281

272

fn sandbox_text(mode: SandboxMode, network_access: NetworkAccess) -> DeveloperInstructions {

273

let template = match mode {

274

SandboxMode::DangerFullAccess => SANDBOX_MODE_DANGER_FULL_ACCESS.trim_end(),

275

SandboxMode::WorkspaceWrite => SANDBOX_MODE_WORKSPACE_WRITE.trim_end(),

276

SandboxMode::ReadOnly => SANDBOX_MODE_READ_ONLY.trim_end(),

277

};

278

let text = template.replace("{network_access}", &network_access.to_string());

279

280

DeveloperInstructions::new(text)

281

}

282

}

283

284

impl From<DeveloperInstructions> for ResponseItem {

285

fn from(di: DeveloperInstructions) -> Self {

286

ResponseItem::Message {

287

id: None,

288

role: "developer".to_string(),

CommentR289

Resolved

289

content: vec![ContentItem::InputText {

290

text: di.into_text(),

291

}],

292

}

293

}

294

}

295

296

impl From<SandboxMode> for DeveloperInstructions {

297

fn from(mode: SandboxMode) -> Self {

298

let network_access = match mode {

299

SandboxMode::DangerFullAccess => NetworkAccess::Enabled,

300

SandboxMode::WorkspaceWrite | SandboxMode::ReadOnly => NetworkAccess::Restricted,

301

};

302

303

DeveloperInstructions::sandbox_text(mode, network_access)

304

}

305

}

306

307

impl From<AskForApproval> for DeveloperInstructions {

308

fn from(mode: AskForApproval) -> Self {

309

let text = match mode {

310

AskForApproval::Never => APPROVAL_POLICY_NEVER.trim_end(),

311

AskForApproval::UnlessTrusted => APPROVAL_POLICY_UNLESS_TRUSTED.trim_end(),

312

AskForApproval::OnFailure => APPROVAL_POLICY_ON_FAILURE.trim_end(),

313

AskForApproval::OnRequest => APPROVAL_POLICY_ON_REQUEST.trim_end(),

314

};

315

316

DeveloperInstructions::new(text)

317

}

318

}

319

5 linesAll 389 lines5 lines

550

#[cfg(test)]

709

#[cfg(test)]

551

mod tests {

710

mod tests {

552

use super::*;

711

use super::*;

712

use crate::config_types::SandboxMode;

713

use crate::protocol::AskForApproval;

All 4 lines

718

use std::path::PathBuf;

557

use tempfile::tempdir;

719

use tempfile::tempdir;

558

720

721

#[test]

722

fn converts_sandbox_mode_into_developer_instructions() {

723

assert_eq!(

724

DeveloperInstructions::from(SandboxMode::WorkspaceWrite),

725

DeveloperInstructions::new(

726

"Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval. Network access is restricted."

727

)

728

);

729

730

assert_eq!(

731

DeveloperInstructions::from(SandboxMode::ReadOnly),

732

DeveloperInstructions::new(

733

"Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `read-only`: The sandbox only permits reading files. Network access is restricted."

734

)

735

);

736

}

737

738

#[test]

739

fn builds_permissions_with_network_access_override() {

740

let instructions = DeveloperInstructions::from_permissions_with_network(

741

SandboxMode::WorkspaceWrite,

742

NetworkAccess::Enabled,

743

AskForApproval::OnRequest,

744

None,

745

);

746

747

let text = instructions.into_text();

748

assert!(

749

text.contains("Network access is enabled."),

750

"expected network access to be enabled in message"

751

);

752

assert!(

753

text.contains("`approval_policy` is `on-request`"),

754

"expected approval guidance to be included"

755

);

756

}

757

758

#[test]

759

fn builds_permissions_from_policy() {

760

let policy = SandboxPolicy::WorkspaceWrite {

761

writable_roots: vec![],

762

network_access: true,

763

exclude_tmpdir_env_var: false,

764

exclude_slash_tmp: false,

765

};

766

767

let instructions = DeveloperInstructions::from_policy(

768

&policy,

769

AskForApproval::UnlessTrusted,

770

&PathBuf::from("/tmp"),

771

);

772

let text = instructions.into_text();

773

assert!(text.contains("Network access is enabled."));

774

assert!(text.contains("`approval_policy` is `unless-trusted`"));

775

}

776

5 linesAll 311 lines5 lines

870

}

1088

}

never.mdcodex-rs/protocol/src/prompts/permissions/approval_policy

AddedMark as viewed

Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `never`: This is a non-interactive mode where you may NEVER ask the user for approval to run commands. Instead, you must always persist and work around constraints to solve the task for the user. You MUST do your utmost best to finish the task and validate your work before yielding. If this mode is paired with `danger-full-access`, take advantage of it to deliver the best outcome for the user. Further, in this mode, your default testing philosophy is overridden: Even if you don't see local patterns for testing, you may add tests and scripts to validate your work. Just remove them before yielding.

on_failure.mdcodex-rs/protocol/src/prompts/permissions/approval_policy

AddedMark as viewed

Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `on-failure`: The harness will allow all commands to run in the sandbox (if enabled), and failures will be escalated to the user for approval to run again without the sandbox.

on_request.mdcodex-rs/protocol/src/prompts/permissions/approval_policy

+12

AddedMark as viewed

Move1–12

Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `on-request`: Commands will be run in the sandbox by default, and you can specify in your tool call if you want to escalate a command to run without sandboxing. If the completing the task requires escalated permissions, Do not let these settings or the sandbox deter you from attempting to accomplish the user's task.

Here are scenarios where you'll need to request approval:

- You need to run a command that writes to a directory that requires it (e.g. running tests that write to /var)

- You need to run a GUI app (e.g., open/xdg-open/osascript) to open browsers or files.

- You are running sandboxed and need to run a command that requires network access (e.g. installing packages)

- If you run a command that is important to solving the user's query, but it fails because of sandboxing, rerun the command with approval. ALWAYS proceed to use the `sandbox_permissions` and `justification` parameters - do not message the user before requesting approval for the command.

- You are about to take a potentially destructive action such as an `rm` or `git reset` that the user did not explicitly ask for.

When requesting approval to execute a command that will require escalated privileges:

`` - Provide the sandbox_permissions parameter with the value `"require_escalated"```

- Include a short, 1 sentence explanation for why you need escalated permissions in the justification parameter

unless_trusted.mdcodex-rs/protocol/src/prompts/permissions/approval_policy

AddedMark as viewed

Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `unless-trusted`: The harness will escalate most commands for user approval, apart from a limited allowlist of safe "read" commands.

danger_full_access.mdcodex-rs/protocol/src/prompts/permissions/sandbox_mode

AddedMark as viewed

Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is {network_access}.

read_only.mdcodex-rs/protocol/src/prompts/permissions/sandbox_mode

AddedMark as viewed

Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `read-only`: The sandbox only permits reading files. Network access is {network_access}.

workspace_write.mdcodex-rs/protocol/src/prompts/permissions/sandbox_mode

AddedMark as viewed

Move1–1

Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval. Network access is {network_access}.

2Permissions Message Injection in Session

0 / 1

codex.rscodex-rs/core/src

+51−7

Mark as viewed

5 linesAll 149 lines5 lines

150

use crate::unified_exec::UnifiedExecProcessManager;

150

use crate::unified_exec::UnifiedExecProcessManager;

151

use crate::user_instructions::DeveloperInstructions;

152

use crate::user_instructions::UserInstructions;

151

use crate::user_instructions::UserInstructions;

All 4 lines

157

use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;

156

use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;

158

use codex_protocol::models::ContentItem;

157

use codex_protocol::models::ContentItem;

158

use codex_protocol::models::DeveloperInstructions;

5 linesAll 327 lines5 lines

486

impl Session {

486

impl Session {

5 linesAll 307 lines5 lines

794

async fn record_initial_history(&self, conversation_history: InitialHistory) {

794

async fn record_initial_history(&self, conversation_history: InitialHistory) {

795

let turn_context = self.new_default_turn().await;

795

let turn_context = self.new_default_turn().await;

796

match conversation_history {

796

match conversation_history {

All 7 lines

804

InitialHistory::Resumed(_) | InitialHistory::Forked(_) => {

804

InitialHistory::Resumed(_) | InitialHistory::Forked(_) => {

5 linesAll 46 lines5 lines

851

// If persisting, persist all rollout items as-is (recorder filters)

851

// If persisting, persist all rollout items as-is (recorder filters)

852

if persist && !rollout_items.is_empty() {

852

if persist && !rollout_items.is_empty() {

853

self.persist_rollout_items(&rollout_items).await;

853

self.persist_rollout_items(&rollout_items).await;

854

}

854

}

855

InformationalR856-859

856

// Append the current session's initial context after the reconstructed history.

857

let initial_context = self.build_initial_context(&turn_context);

858

self.record_conversation_items(&turn_context, &initial_context)

859

.await;

855

// Flush after seeding history and any persisted rollout copy.

860

// Flush after seeding history and any persisted rollout copy.

856

self.flush_rollout().await;

861

self.flush_rollout().await;

857

}

862

}

858

}

863

}

859

}

864

}

5 linesAll 147 lines5 lines

Copy + paste1012–1032

1012

fn build_permissions_update_item(

1013

&self,

1014

previous: Option<&Arc<TurnContext>>,

1015

next: &TurnContext,

1016

) -> Option<ResponseItem> {

Potential BugR1017-1022

1017

let prev = previous?;

1018

if prev.sandbox_policy == next.sandbox_policy

1019

&& prev.approval_policy == next.approval_policy

1020

{

1021

return None;

1022

}

1023

1024

Some(

1025

DeveloperInstructions::from_policy(

1026

&next.sandbox_policy,

1027

next.approval_policy,

1028

&next.cwd,

1029

)

1030

.into(),

1031

)

DY2

CommentR1032

1032

}

1033

5 linesAll 329 lines5 lines

1336

1363

1337

pub(crate) fn build_initial_context(&self, turn_context: &TurnContext) -> Vec<ResponseItem> {

1364

pub(crate) fn build_initial_context(&self, turn_context: &TurnContext) -> Vec<ResponseItem> {

1338

let mut items = Vec::<ResponseItem>::with_capacity(3);

1365

let mut items = Vec::<ResponseItem>::with_capacity(4);

1339

let shell = self.user_shell();

1366

let shell = self.user_shell();

1367

items.push(

1368

DeveloperInstructions::from_policy(

1369

&turn_context.sandbox_policy,

1370

turn_context.approval_policy,

1371

&turn_context.cwd,

1372

)

1373

.into(),

1374

);

1340

if let Some(developer_instructions) = turn_context.developer_instructions.as_deref() {

1375

if let Some(developer_instructions) = turn_context.developer_instructions.as_deref() {

5 linesAll 10 lines5 lines

1351

}

1386

}

1352

items.push(ResponseItem::from(EnvironmentContext::new(

1387

items.push(ResponseItem::from(EnvironmentContext::new(

1353

Some(turn_context.cwd.clone()),

1388

Some(turn_context.cwd.clone()),

1354

Some(turn_context.approval_policy),

1355

Some(turn_context.sandbox_policy.clone()),

1356

shell.as_ref().clone(),

1389

shell.as_ref().clone(),

1357

)));

1390

)));

1358

items

1391

items

1359

}

1392

}

5 linesAll 281 lines5 lines

1641

}

1674

}

5 linesAll 101 lines5 lines

1743

mod handlers {

1776

mod handlers {

5 linesAll 60 lines5 lines

1804

pub async fn user_input_or_turn(

1837

pub async fn user_input_or_turn(

1805

sess: &Arc<Session>,

1838

sess: &Arc<Session>,

1806

sub_id: String,

1839

sub_id: String,

1807

op: Op,

1840

op: Op,

1808

previous_context: &mut Option<Arc<TurnContext>>,

1841

previous_context: &mut Option<Arc<TurnContext>>,

1809

) {

1842

) {

5 linesAll 44 lines5 lines

1854

// Attempt to inject input into current task

1887

// Attempt to inject input into current task

1855

if let Err(items) = sess.inject_input(items).await {

1888

if let Err(items) = sess.inject_input(items).await {

1889

let mut update_items = Vec::new();

1856

if let Some(env_item) =

1890

if let Some(env_item) =

1857

sess.build_environment_update_item(previous_context.as_ref(), &current_context)

1891

sess.build_environment_update_item(previous_context.as_ref(), &current_context)

1858

{

1892

{

1859

sess.record_conversation_items(&current_context, std::slice::from_ref(&env_item))

1893

update_items.push(env_item);

1894

}

1895

if let Some(permissions_item) =

1896

sess.build_permissions_update_item(previous_context.as_ref(), &current_context)

1897

{

1898

update_items.push(permissions_item);

1899

}

1900

if !update_items.is_empty() {

1901

sess.record_conversation_items(&current_context, &update_items)

1860

.await;

1902

.await;

1861

}

1903

}

All 4 lines

1866

}

1908

}

1867

}

1909

}

5 linesAll 333 lines5 lines

2201

}

2243

}

5 linesAll 668 lines5 lines

2870

mod tests {

2912

mod tests {

5 linesAll 56 lines5 lines

2927

#[tokio::test]

2969

#[tokio::test]

2928

async fn record_initial_history_reconstructs_resumed_transcript() {

2970

async fn record_initial_history_reconstructs_resumed_transcript() {

2929

let (session, turn_context) = make_session_and_context().await;

2971

let (session, turn_context) = make_session_and_context().await;

2930

let (rollout_items, expected) = sample_rollout(&session, &turn_context);

2972

let (rollout_items, mut expected) = sample_rollout(&session, &turn_context);

2931

2973

All 6 lines

2938

.await;

2980

.await;

2939

2981

CommentR2982

Resolved

2982

expected.extend(session.build_initial_context(&turn_context));

2940

let history = session.state.lock().await.clone_history();

2983

let history = session.state.lock().await.clone_history();

2941

assert_eq!(expected, history.raw_items());

2984

assert_eq!(expected, history.raw_items());

2942

}

2985

}

5 linesAll 78 lines5 lines

3021

#[tokio::test]

3064

#[tokio::test]

3022

async fn record_initial_history_reconstructs_forked_transcript() {

3065

async fn record_initial_history_reconstructs_forked_transcript() {

3023

let (session, turn_context) = make_session_and_context().await;

3066

let (session, turn_context) = make_session_and_context().await;

3024

let (rollout_items, expected) = sample_rollout(&session, &turn_context);

3067

let (rollout_items, mut expected) = sample_rollout(&session, &turn_context);

3025

3068

3026

session

3069

session

3027

.record_initial_history(InitialHistory::Forked(rollout_items))

3070

.record_initial_history(InitialHistory::Forked(rollout_items))

3028

.await;

3071

.await;

3029

3072

3073

expected.extend(session.build_initial_context(&turn_context));

3030

let history = session.state.lock().await.clone_history();

3074

let history = session.state.lock().await.clone_history();

3031

assert_eq!(expected, history.raw_items());

3075

assert_eq!(expected, history.raw_items());

3032

}

3076

}

5 linesAll 1108 lines5 lines

4141

}

4185

}

3Simplified EnvironmentContext

0 / 1

environment_context.rscodex-rs/core/src

+20−223

Mark as viewed

use crate::codex::TurnContext;

use crate::protocol::AskForApproval;

use crate::protocol::NetworkAccess;

use crate::protocol::SandboxPolicy;

use crate::shell::Shell;

use codex_protocol::config_types::SandboxMode;

use codex_protocol::models::ContentItem;

use codex_protocol::models::ResponseItem;

use codex_protocol::protocol::ENVIRONMENT_CONTEXT_CLOSE_TAG;

use codex_protocol::protocol::ENVIRONMENT_CONTEXT_OPEN_TAG;

use codex_utils_absolute_path::AbsolutePathBuf;

use serde::Deserialize;

use serde::Serialize;

use std::path::PathBuf;

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]

InformationalR12-16

#[serde(rename = "environment_context", rename_all = "snake_case")]

pub(crate) struct EnvironmentContext {

PA2

CommentR14

pub cwd: Option<PathBuf>,

pub approval_policy: Option<AskForApproval>,

pub sandbox_mode: Option<SandboxMode>,

pub network_access: Option<NetworkAccess>,

pub writable_roots: Option<Vec<AbsolutePathBuf>>,

pub shell: Shell,

}

impl EnvironmentContext {

pub fn new(

pub fn new(cwd: Option<PathBuf>, shell: Shell) -> Self {

cwd: Option<PathBuf>,

Self { cwd, shell }

approval_policy: Option<AskForApproval>,

sandbox_policy: Option<SandboxPolicy>,

shell: Shell,

) -> Self {

Self {

cwd,

approval_policy,

sandbox_mode: match sandbox_policy {

Some(SandboxPolicy::DangerFullAccess) => Some(SandboxMode::DangerFullAccess),

Some(SandboxPolicy::ReadOnly) => Some(SandboxMode::ReadOnly),

Some(SandboxPolicy::ExternalSandbox { .. }) => Some(SandboxMode::DangerFullAccess),

Some(SandboxPolicy::WorkspaceWrite { .. }) => Some(SandboxMode::WorkspaceWrite),

None => None,

},

network_access: match sandbox_policy {

Some(SandboxPolicy::DangerFullAccess) => Some(NetworkAccess::Enabled),

Some(SandboxPolicy::ReadOnly) => Some(NetworkAccess::Restricted),

Some(SandboxPolicy::ExternalSandbox { network_access }) => Some(network_access),

Some(SandboxPolicy::WorkspaceWrite { network_access, .. }) => {

if network_access {

Some(NetworkAccess::Enabled)

} else {

Some(NetworkAccess::Restricted)

}

None => None,

},

writable_roots: match sandbox_policy {

Some(SandboxPolicy::WorkspaceWrite { writable_roots, .. }) => {

if writable_roots.is_empty() {

None

} else {

Some(writable_roots)

}

_ => None,

},

shell,

}

/// Compares two environment contexts, ignoring the shell. Useful when

/// comparing turn to turn, since the initial environment_context will

/// include the shell, and then it is not configurable from turn to turn.

pub fn equals_except_shell(&self, other: &EnvironmentContext) -> bool {

let EnvironmentContext {

cwd,

approval_policy,

sandbox_mode,

network_access,

writable_roots,

// should compare all fields except shell

shell: _,

} = other;

self.cwd == *cwd

&& self.approval_policy == *approval_policy

&& self.sandbox_mode == *sandbox_mode

&& self.network_access == *network_access

&& self.writable_roots == *writable_roots

}

pub fn diff(before: &TurnContext, after: &TurnContext, shell: &Shell) -> Self {

let cwd = if before.cwd != after.cwd {

Some(after.cwd.clone())

} else {

None

};

let approval_policy = if before.approval_policy != after.approval_policy {

EnvironmentContext::new(cwd, shell.clone())

Some(after.approval_policy)

100

} else {

101

None

102

};

103

let sandbox_policy = if before.sandbox_policy != after.sandbox_policy {

104

Some(after.sandbox_policy.clone())

105

} else {

106

None

107

};

108

EnvironmentContext::new(cwd, approval_policy, sandbox_policy, shell.clone())

109

}

110

111

pub fn from_turn_context(turn_context: &TurnContext, shell: &Shell) -> Self {

112

Self::new(

Self::new(Some(turn_context.cwd.clone()), shell.clone())

113

Some(turn_context.cwd.clone()),

114

Some(turn_context.approval_policy),

115

Some(turn_context.sandbox_policy.clone()),

116

shell.clone(),

117

)

118

}

119

}

120

121

impl EnvironmentContext {

122

`` /// Serializes the environment context to XML. Libraries like `quick-xml```

123

/// require custom macros to handle Enums with newtypes, so we just do it

124

/// manually, to keep things simple. Output looks like:

125

///

126

///xml```

127

/// <environment_context>

128

/// <cwd>...</cwd>

129

/// <approval_policy>...</approval_policy>

130

/// <sandbox_mode>...</sandbox_mode>

131

/// <writable_roots>...</writable_roots>

132

/// <network_access>...</network_access>

133

/// <shell>...</shell>

134

/// </environment_context>

135

``` /// ``````

136

pub fn serialize_to_xml(self) -> String {

137

let mut lines = vec![ENVIRONMENT_CONTEXT_OPEN_TAG.to_string()];

138

if let Some(cwd) = self.cwd {

139

lines.push(format!(" <cwd>{}</cwd>", cwd.to_string_lossy()));

140

}

141

if let Some(approval_policy) = self.approval_policy {

142

lines.push(format!(

143

" <approval_policy>{approval_policy}</approval_policy>"

144

));

145

}

146

if let Some(sandbox_mode) = self.sandbox_mode {

147

lines.push(format!(" <sandbox_mode>{sandbox_mode}</sandbox_mode>"));

148

}

149

if let Some(network_access) = self.network_access {

150

lines.push(format!(

151

" <network_access>{network_access}</network_access>"

152

));

153

}

154

if let Some(writable_roots) = self.writable_roots {

155

lines.push(" <writable_roots>".to_string());

156

for writable_root in writable_roots {

157

lines.push(format!(

158

" <root>{}</root>",

159

writable_root.to_string_lossy()

160

));

161

}

162

lines.push(" </writable_roots>".to_string());

163

}

164

165

let shell_name = self.shell.name();

166

lines.push(format!(" <shell>{shell_name}</shell>"));

167

lines.push(ENVIRONMENT_CONTEXT_CLOSE_TAG.to_string());

168

lines.join("\n")

169

}

170

}

171

172

impl From<EnvironmentContext> for ResponseItem {

All 9 lines

182

}

183

184

#[cfg(test)]

185

mod tests {

186

use crate::shell::ShellType;

187

188

use super::*;

189

use core_test_support::test_path_buf;

190

use core_test_support::test_tmp_path_buf;

191

use pretty_assertions::assert_eq;

192

193

fn fake_shell() -> Shell {

All 5 lines

199

}

100

}

200

101

201

fn workspace_write_policy(writable_roots: Vec<&str>, network_access: bool) -> SandboxPolicy {

202

SandboxPolicy::WorkspaceWrite {

203

writable_roots: writable_roots

204

.into_iter()

205

.map(|s| AbsolutePathBuf::try_from(s).unwrap())

206

.collect(),

207

network_access,

208

exclude_tmpdir_env_var: false,

209

exclude_slash_tmp: false,

210

}

211

}

212

213

#[test]

102

#[test]

214

fn serialize_workspace_write_environment_context() {

103

fn serialize_workspace_write_environment_context() {

215

let cwd = test_path_buf("/repo");

104

let cwd = test_path_buf("/repo");

216

let writable_root = test_tmp_path_buf();

105

let context = EnvironmentContext::new(Some(cwd.clone()), fake_shell());

217

let cwd_str = cwd.to_str().expect("cwd is valid utf-8");

218

let writable_root_str = writable_root

219

.to_str()

220

.expect("writable root is valid utf-8");

221

let context = EnvironmentContext::new(

222

Some(cwd.clone()),

223

Some(AskForApproval::OnRequest),

224

Some(workspace_write_policy(

225

vec![cwd_str, writable_root_str],

226

false,

227

)),

228

fake_shell(),

229

);

230

106

231

let expected = format!(

107

let expected = format!(

232

r#"<environment_context>

108

r#"<environment_context>

233

<cwd>{cwd}</cwd>

109

<cwd>{cwd}</cwd>

234

<approval_policy>on-request</approval_policy>

235

<sandbox_mode>workspace-write</sandbox_mode>

236

<network_access>restricted</network_access>

237

<writable_roots>

238

<root>{cwd}</root>

239

<root>{writable_root}</root>

240

</writable_roots>

241

<shell>bash</shell>

110

<shell>bash</shell>

242

</environment_context>"#,

111

</environment_context>"#,

243

cwd = cwd.display(),

112

cwd = cwd.display(),

244

writable_root = writable_root.display(),

245

);

113

);

246

114

247

assert_eq!(context.serialize_to_xml(), expected);

115

assert_eq!(context.serialize_to_xml(), expected);

248

}

116

}

249

117

250

#[test]

118

#[test]

251

fn serialize_read_only_environment_context() {

119

fn serialize_read_only_environment_context() {

252

let context = EnvironmentContext::new(

120

let context = EnvironmentContext::new(None, fake_shell());

253

None,

254

Some(AskForApproval::Never),

255

Some(SandboxPolicy::ReadOnly),

256

fake_shell(),

257

);

258

121

259

let expected = r#"<environment_context>

122

let expected = r#"<environment_context>

260

<approval_policy>never</approval_policy>

261

<sandbox_mode>read-only</sandbox_mode>

262

<network_access>restricted</network_access>

263

<shell>bash</shell>

123

<shell>bash</shell>

264

</environment_context>"#;

124

</environment_context>"#;

265

125

266

assert_eq!(context.serialize_to_xml(), expected);

126

assert_eq!(context.serialize_to_xml(), expected);

267

}

127

}

268

128

269

#[test]

129

#[test]

270

fn serialize_external_sandbox_environment_context() {

130

fn serialize_external_sandbox_environment_context() {

271

let context = EnvironmentContext::new(

131

let context = EnvironmentContext::new(None, fake_shell());

272

None,

273

Some(AskForApproval::OnRequest),

274

Some(SandboxPolicy::ExternalSandbox {

275

network_access: NetworkAccess::Enabled,

276

}),

277

fake_shell(),

278

);

279

132

280

let expected = r#"<environment_context>

133

let expected = r#"<environment_context>

281

<approval_policy>on-request</approval_policy>

282

<sandbox_mode>danger-full-access</sandbox_mode>

283

<network_access>enabled</network_access>

284

<shell>bash</shell>

134

<shell>bash</shell>

285

</environment_context>"#;

135

</environment_context>"#;

286

136

287

assert_eq!(context.serialize_to_xml(), expected);

137

assert_eq!(context.serialize_to_xml(), expected);

288

}

138

}

289

139

290

#[test]

140

#[test]

291

fn serialize_external_sandbox_with_restricted_network_environment_context() {

141

fn serialize_external_sandbox_with_restricted_network_environment_context() {

292

let context = EnvironmentContext::new(

142

let context = EnvironmentContext::new(None, fake_shell());

293

None,

294

Some(AskForApproval::OnRequest),

295

Some(SandboxPolicy::ExternalSandbox {

296

network_access: NetworkAccess::Restricted,

297

}),

298

fake_shell(),

299

);

300

143

301

let expected = r#"<environment_context>

144

let expected = r#"<environment_context>

302

<approval_policy>on-request</approval_policy>

303

<sandbox_mode>danger-full-access</sandbox_mode>

304

<network_access>restricted</network_access>

305

<shell>bash</shell>

145

<shell>bash</shell>

306

</environment_context>"#;

146

</environment_context>"#;

307

147

308

assert_eq!(context.serialize_to_xml(), expected);

148

assert_eq!(context.serialize_to_xml(), expected);

309

}

149

}

310

150

311

#[test]

151

#[test]

312

fn serialize_full_access_environment_context() {

152

fn serialize_full_access_environment_context() {

313

let context = EnvironmentContext::new(

153

let context = EnvironmentContext::new(None, fake_shell());

314

None,

315

Some(AskForApproval::OnFailure),

316

Some(SandboxPolicy::DangerFullAccess),

317

fake_shell(),

318

);

319

154

320

let expected = r#"<environment_context>

155

let expected = r#"<environment_context>

321

<approval_policy>on-failure</approval_policy>

322

<sandbox_mode>danger-full-access</sandbox_mode>

323

<network_access>enabled</network_access>

324

<shell>bash</shell>

156

<shell>bash</shell>

325

</environment_context>"#;

157

</environment_context>"#;

326

158

327

assert_eq!(context.serialize_to_xml(), expected);

159

assert_eq!(context.serialize_to_xml(), expected);

328

}

160

}

329

161

330

#[test]

162

#[test]

331

fn equals_except_shell_compares_approval_policy() {

163

fn equals_except_shell_compares_cwd() {

332

// Approval policy

164

let context1 = EnvironmentContext::new(Some(PathBuf::from("/repo")), fake_shell());

333

let context1 = EnvironmentContext::new(

165

let context2 = EnvironmentContext::new(Some(PathBuf::from("/repo")), fake_shell());

334

Some(PathBuf::from("/repo")),

166

assert!(context1.equals_except_shell(&context2));

335

Some(AskForApproval::OnRequest),

336

Some(workspace_write_policy(vec!["/repo"], false)),

337

fake_shell(),

338

);

339

let context2 = EnvironmentContext::new(

340

Some(PathBuf::from("/repo")),

341

Some(AskForApproval::Never),

342

Some(workspace_write_policy(vec!["/repo"], true)),

343

fake_shell(),

344

);

345

assert!(!context1.equals_except_shell(&context2));

346

}

167

}

347

168

348

#[test]

169

#[test]

349

fn equals_except_shell_compares_sandbox_policy() {

170

fn equals_except_shell_ignores_sandbox_policy() {

350

let context1 = EnvironmentContext::new(

171

let context1 = EnvironmentContext::new(Some(PathBuf::from("/repo")), fake_shell());

351

Some(PathBuf::from("/repo")),

172

let context2 = EnvironmentContext::new(Some(PathBuf::from("/repo")), fake_shell());

352

Some(AskForApproval::OnRequest),

353

Some(SandboxPolicy::new_read_only_policy()),

354

fake_shell(),

355

);

356

let context2 = EnvironmentContext::new(

357

Some(PathBuf::from("/repo")),

358

Some(AskForApproval::OnRequest),

359

Some(SandboxPolicy::new_workspace_write_policy()),

360

fake_shell(),

361

);

362

173

363

assert!(!context1.equals_except_shell(&context2));

174

assert!(context1.equals_except_shell(&context2));

364

}

175

}

365

176

366

#[test]

177

#[test]

367

fn equals_except_shell_compares_workspace_write_policy() {

178

fn equals_except_shell_compares_cwd_differences() {

368

let context1 = EnvironmentContext::new(

179

let context1 = EnvironmentContext::new(Some(PathBuf::from("/repo1")), fake_shell());

369

Some(PathBuf::from("/repo")),

180

let context2 = EnvironmentContext::new(Some(PathBuf::from("/repo2")), fake_shell());

370

Some(AskForApproval::OnRequest),

371

Some(workspace_write_policy(vec!["/repo", "/tmp", "/var"], false)),

372

fake_shell(),

373

);

374

let context2 = EnvironmentContext::new(

375

Some(PathBuf::from("/repo")),

376

Some(AskForApproval::OnRequest),

377

Some(workspace_write_policy(vec!["/repo", "/tmp"], true)),

378

fake_shell(),

379

);

380

181

381

assert!(!context1.equals_except_shell(&context2));

182

assert!(!context1.equals_except_shell(&context2));

382

}

183

}

383

184

384

#[test]

185

#[test]

385

fn equals_except_shell_ignores_shell() {

186

fn equals_except_shell_ignores_shell() {

386

let context1 = EnvironmentContext::new(

187

let context1 = EnvironmentContext::new(

387

Some(PathBuf::from("/repo")),

188

Some(PathBuf::from("/repo")),

388

Some(AskForApproval::OnRequest),

389

Some(workspace_write_policy(vec!["/repo"], false)),

390

Shell {

189

Shell {

391

shell_type: ShellType::Bash,

190

shell_type: ShellType::Bash,

392

shell_path: "/bin/bash".into(),

191

shell_path: "/bin/bash".into(),

393

shell_snapshot: None,

192

shell_snapshot: None,

394

},

193

},

395

);

194

);

396

let context2 = EnvironmentContext::new(

195

let context2 = EnvironmentContext::new(

397

Some(PathBuf::from("/repo")),

196

Some(PathBuf::from("/repo")),

398

Some(AskForApproval::OnRequest),

399

Some(workspace_write_policy(vec!["/repo"], false)),

400

Shell {

197

Shell {

401

shell_type: ShellType::Zsh,

198

shell_type: ShellType::Zsh,

402

shell_path: "/bin/zsh".into(),

199

shell_path: "/bin/zsh".into(),

403

shell_snapshot: None,

200

shell_snapshot: None,

404

},

201

},

405

);

202

);

406

203

407

assert!(context1.equals_except_shell(&context2));

204

assert!(context1.equals_except_shell(&context2));

408

}

205

}

409

}

206

}

4Removed Static Prompt Sections

0 / 7

gpt-5.1-codex-max_prompt.mdcodex-rs/core

−37

Mark as viewed

5 linesAll 20 lines5 lines

## Plan tool

All 6 lines

## Codex CLI harness, sandboxing, and approvals

The Codex CLI harness supports several different configurations for sandboxing and escalation approvals that the user can choose from.

Filesystem sandboxing defines which files can be read or written. The options for `sandbox_mode` are:

- **read-only**: The sandbox only permits reading files.

- **workspace-write**: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval.

- **danger-full-access**: No filesystem sandboxing - all commands are permitted.

Network sandboxing defines whether network can be accessed without approval. Options for `network_access` are:

- **restricted**: Requires approval

- **enabled**: No approval needed

Approvals are your mechanism to get user consent to run shell commands without the sandbox. Possible configuration options for `approval_policy` are

- **untrusted**: The harness will escalate most commands for user approval, apart from a limited allowlist of safe "read" commands.

- **on-failure**: The harness will allow all commands to run in the sandbox (if enabled), and failures will be escalated to the user for approval to run again without the sandbox.

- **on-request**: Commands will be run in the sandbox by default, and you can specify in your tool call if you want to escalate a command to run without sandboxing. (Note that this mode is not always available. If it is, you'll see parameters for it in the `shell` command description.)

- **never**: This is a non-interactive mode where you may NEVER ask the user for approval to run commands. Instead, you must always persist and work around constraints to solve the task for the user. You MUST do your utmost best to finish the task and validate your work before yielding. If this mode is paired with `danger-full-access`, take advantage of it to deliver the best outcome for the user. Further, in this mode, your default testing philosophy is overridden: Even if you don't see local patterns for testing, you may add tests and scripts to validate your work. Just remove them before yielding.

When you are running with `approval_policy == on-request`, and sandboxing enabled, here are scenarios where you'll need to request approval:

- You need to run a command that writes to a directory that requires it (e.g. running tests that write to /var)

- You need to run a GUI app (e.g., open/xdg-open/osascript) to open browsers or files.

- You are running sandboxed and need to run a command that requires network access (e.g. installing packages)

- You are about to take a potentially destructive action such as an `rm` or `git reset` that the user did not explicitly ask for

- (for all of these, you should weigh alternative paths that do not require approval)

When `sandbox_mode` is set to read-only, you'll need to request approval for any command that isn't a read.

You will be told what filesystem sandboxing, network sandboxing, and approval mode are active in a developer or user message. If you are not told about this, assume that you are running with workspace-write, network sandboxing enabled, and approval on-failure.

Although they introduce friction to the user because your work is paused until the user responds, you should leverage them when necessary to accomplish important work. If the completing the task requires escalated permissions, Do not let these settings or the sandbox deter you from attempting to accomplish the user's task unless it is set to "never", in which case never ask for approvals.

When requesting approval to execute a command that will require escalated privileges:

`` - Provide the sandbox_permissions parameter with the value `"require_escalated"```

- Include a short, 1 sentence explanation for why you need escalated permissions in the justification parameter

## Special user requests

5 linesAll 52 lines5 lines

gpt-5.2-codex_prompt.mdcodex-rs/core

−37

Mark as viewed

You are Codex, based on GPT-5. You are running as a coding agent in the Codex CLI on a user's computer.

## General

- When searching for text or files, prefer using `rg` or `rg --files` respectively because `rg` is much faster than alternatives like `grep`. (If the `rg` command is not found, then use alternatives.)

## Editing constraints

5 linesAll 13 lines5 lines