feat(core) Introduce Feature::RequestPermissions by dylan-hurd-oai · Pull Request #11871 · openai/codex

dylan-hurd-oai · 2026-02-15T22:31:47Z

Summary

Introduces the initial implementation of Feature::RequestPermissions. RequestPermissions allows the model to request that a command be run inside the sandbox, with additional permissions, like writing to a specific folder. Eventually this will include other rules as well, and the ability to persist these permissions, but this PR is already quite large - let's get the core flow working and go from there!

Testing

Added tests
Tested locally
Feature

codex-rs/core/src/tools/runtimes/unified_exec.rs

pakrym-oai · 2026-02-19T07:52:24Z

codex-rs/tui/src/chatwidget/tests.rs

        ),
        network_approval_context: None,
        proposed_execpolicy_amendment: None,
+        additional_permissions: None,


Should network_approval_context and additional_permissions be somehow merged?

Soon! I think both are still actively being worked on - I'd like to merge once we've stabilized the APIs

pakrym-oai · 2026-02-19T07:55:13Z

codex-rs/protocol/src/prompts/permissions/approval_policy/on_request_rule_request_permission.md

+
+When you need extra filesystem access for one command, use:
+
+- `sandbox_permissions: "with_additional_permissions"`


do we need to make the model set sandbox_permissions?

Technically no, but I think this is helpful for consistency with require_escalated

codex-rs/core/src/sandboxing/mod.rs

codex-rs/core/src/tools/sandboxing.rs

codex-rs/core/src/codex.rs

pakrym-oai · 2026-02-19T08:09:08Z

I think this PR needs a ton more integration tests that both verify that additional permissions work, error responses an that things are escalated/not escalated accordingly.

jif-oai · 2026-02-19T10:38:41Z

codex-rs/core/src/sandboxing/mod.rs

+                    access: merge_read_only_access_with_additional_reads(access, extra_reads),
+                }
+            } else {
+                SandboxPolicy::WorkspaceWrite {


I think here there is a small bug. ReadOnly basically means the user does not want the model to write anywhere (cwd included).

In this specific case, the model ask to be able to write in one specific directory (from extra_writes). But if we check how WorkspaceWrite is used, we see in get_writable_roots_with_cwd that by default it gives access to writable_root=extra_writes AND the cwd (and /tmp btw).

This means this permission request implicitly give access to the full CWD

Should have added a comment here - I agree that this doesn't map perfectly. We could add a new SandboxPolicy::SpecificWrite which doesn't include the cwd

I've opened #12504 as an example of how we might support fine-grained controls here

SG, must be a blocker to release the feature

100% agreed!

codex-rs/core/src/sandboxing/mod.rs

codex-rs/core/src/tools/handlers/mod.rs

jif-oai · 2026-02-24T14:48:58Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8bb9995c2c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-24T14:54:01Z

codex-rs/core/src/sandboxing/mod.rs

+                SandboxPolicy::WorkspaceWrite {
+                    writable_roots: dedup_absolute_paths(extra_writes),
+                    read_only_access: merge_read_only_access_with_additional_reads(
+                        access,
+                        extra_reads,
+                    ),
+                    network_access: false,
+                    exclude_tmpdir_env_var: false,
+                    exclude_slash_tmp: false,


Preserve read-only sandbox when granting extra write paths

Do not upgrade ReadOnly to WorkspaceWrite for fs_write grants. This branch widens access beyond requested paths by enabling workspace-write defaults (exclude_tmpdir_env_var: false, exclude_slash_tmp: false), so approved commands can write to unrequested locations (e.g., cwd/tmp). That breaks least-privilege and can expose unintended file modification paths.

Useful? React with 👍 / 👎.

As discussed

jif-oai

Not ready to land because of the read escalation thing but good to iterate on

jif-oai · 2026-02-24T14:47:53Z

codex-rs/core/src/tools/handlers/mod.rs

+        );
+    }
+
+    if uses_additional_permissions {


I guess this is intended that if we are in full access, the request is basically ignored?

I think the intention here is to remain similar to OnRequest behavior!

This code might be overly defensive, since it's already handled here. will think about how to clean up as we iterate on this feature

jif-oai · 2026-02-24T15:00:03Z

codex-rs/core/src/sandboxing/mod.rs

+                SandboxPolicy::WorkspaceWrite {
+                    writable_roots: dedup_absolute_paths(extra_writes),
+                    read_only_access: merge_read_only_access_with_additional_reads(
+                        access,
+                        extra_reads,
+                    ),
+                    network_access: false,
+                    exclude_tmpdir_env_var: false,
+                    exclude_slash_tmp: false,


As discussed

dylan-hurd-oai force-pushed the dh--rm-feature-request-rule branch from cf57554 to 686a4ba Compare February 16, 2026 18:48

Base automatically changed from dh--rm-feature-request-rule to main February 16, 2026 22:30

dylan-hurd-oai force-pushed the dh--request-permission-1 branch from b01add8 to 61850cc Compare February 18, 2026 08:26

dylan-hurd-oai marked this pull request as ready for review February 19, 2026 02:44

dylan-hurd-oai force-pushed the dh--request-permission-1 branch from 129cf27 to ea396ea Compare February 19, 2026 02:47

dylan-hurd-oai requested a review from jif-oai February 19, 2026 02:48

pakrym-oai reviewed Feb 19, 2026

View reviewed changes

codex-rs/core/src/tools/runtimes/unified_exec.rs Show resolved Hide resolved

pakrym-oai reviewed Feb 19, 2026

View reviewed changes

codex-rs/core/src/sandboxing/mod.rs Outdated Show resolved Hide resolved

pakrym-oai reviewed Feb 19, 2026

View reviewed changes

codex-rs/core/src/tools/sandboxing.rs Outdated Show resolved Hide resolved

pakrym-oai reviewed Feb 19, 2026

View reviewed changes

codex-rs/core/src/codex.rs Outdated Show resolved Hide resolved

jif-oai reviewed Feb 19, 2026

View reviewed changes

dylan-hurd-oai force-pushed the dh--request-permission-1 branch from ea396ea to 3e74264 Compare February 23, 2026 02:17

dylan-hurd-oai requested review from jif-oai and pakrym-oai February 23, 2026 06:07

dylan-hurd-oai force-pushed the dh--request-permission-1 branch 2 times, most recently from 39ce688 to fb8cba4 Compare February 24, 2026 04:19

github-actions bot mentioned this pull request Feb 24, 2026

📊 AI CLI 工具社区动态日报 2026-02-24 duanyytop/agents-radar#7

Open

dylan-hurd-oai force-pushed the dh--request-permission-1 branch from a2cfdae to fb60743 Compare February 24, 2026 05:58

dylan-hurd-oai added 9 commits February 23, 2026 23:42

feat(core) Introduce Feature::RequestPermissions

cc157ac

fix rebase again

ac8ce4b

fix

f2cc96c

simplify

f756fb0

review

cb94ef5

fix rebase

ddb8c6e

cleanup

e826230

fix escalation logic, add integration tests

5de0f58

cleanup escalation logic

ceffda9

dylan-hurd-oai added 8 commits February 23, 2026 23:42

rename test methods

c141869

rename feature

90c26e7

fix test expectations

d6a36bf

app-server-config

41435d3

restrict sandbox tests from linux boxes

36a37d0

skip_if_sandbox as necessary

2f6084c

fix lint

122dfb2

cleanup imports

8bb9995

dylan-hurd-oai force-pushed the dh--request-permission-1 branch from fb60743 to 8bb9995 Compare February 24, 2026 07:42

chatgpt-codex-connector bot reviewed Feb 24, 2026

View reviewed changes

jif-oai reviewed Feb 24, 2026

View reviewed changes

jif-oai approved these changes Feb 24, 2026

View reviewed changes

dylan-hurd-oai merged commit f6053fd into main Feb 24, 2026
73 of 77 checks passed

dylan-hurd-oai deleted the dh--request-permission-1 branch February 24, 2026 17:49

github-actions bot locked and limited conversation to collaborators Feb 24, 2026


		When you need extra filesystem access for one command, use:

		- `sandbox_permissions: "with_additional_permissions"`

Conversation

dylan-hurd-oai commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pakrym-oai commented Feb 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jif-oai commented Feb 24, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jif-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dylan-hurd-oai commented Feb 15, 2026 •

edited

Loading