Skip to content

protocol: canonicalize turn context permissions#20440

Closed
bolinfest wants to merge 1 commit into
pr20438from
pr20440
Closed

protocol: canonicalize turn context permissions#20440
bolinfest wants to merge 1 commit into
pr20438from
pr20440

Conversation

@bolinfest

@bolinfest bolinfest commented Apr 30, 2026

Copy link
Copy Markdown
Collaborator

Why

TurnContextItem is persisted into rollout history and is the durable turn baseline used for resume, fork, and compaction reconstruction. New writers already record permission_profile, but the public type still exposed legacy sandbox_policy and file_system_sandbox_policy fields, forcing callers and tests to keep filling legacy compatibility slots even though the canonical data is available.

This PR makes the serialized shape canonical for new rollout writes while preserving reads of old rollout files.

What Changed

  • Changes TurnContextItem.permission_profile from Option<PermissionProfile> to required PermissionProfile.
  • Removes public sandbox_policy and file_system_sandbox_policy fields from TurnContextItem.
  • Adds custom Deserialize for TurnContextItem that still accepts old rollout JSON containing sandbox_policy and optional file_system_sandbox_policy, immediately projecting that legacy data into PermissionProfile.
  • Updates rollout, session, state, and TUI fixtures to construct turn context items with canonical permission profiles directly.

Verification

  • cargo check -p codex-protocol -p codex-core -p codex-tui -p codex-state -p codex-rollout --tests
  • cargo test -p codex-protocol turn_context_item_
  • cargo test -p codex-core turn_context_item_

Stack created with Sapling. Best reviewed with ReviewStack.

@bolinfest bolinfest requested a review from a team as a code owner April 30, 2026 15:02
@bolinfest bolinfest changed the base branch from main to pr20438 April 30, 2026 15:02
This was referenced Apr 30, 2026
@chatgpt-codex-connector

Copy link
Copy Markdown
Contributor

💡 Codex Review

// Current app-server responses include `permissionProfile`. If it is absent,
// keep the TUI on its configured profile rather than rebuilding a lossy
// profile from the legacy `sandbox` compatibility field.
config.permissions.permission_profile()

P2 Badge Restore sandbox fallback when thread response omits profile

When permission_profile is None, this now unconditionally falls back to local config instead of deriving permissions from the response's legacy sandbox field. In remote mode, that creates a client/server permission mismatch whenever the server omits permissionProfile (the field is still optional in the v2 schema), so the TUI can believe a thread is running under different sandbox/approval constraints than the server actually uses. Please keep a fallback path from the response sandbox for this case, at least for remote compatibility.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@github-actions

Copy link
Copy Markdown
Contributor

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.

@github-actions github-actions Bot closed this May 15, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant