2026-02-23 09:28:17 -08:00
|
|
|
[package]
|
|
|
|
|
edition.workspace = true
|
|
|
|
|
license.workspace = true
|
2026-02-24 16:20:08 -08:00
|
|
|
name = "codex-shell-escalation"
|
|
|
|
|
version.workspace = true
|
2026-02-23 09:28:17 -08:00
|
|
|
|
2026-02-23 20:10:22 -08:00
|
|
|
[[bin]]
|
|
|
|
|
name = "codex-execve-wrapper"
|
|
|
|
|
path = "src/bin/main_execve_wrapper.rs"
|
|
|
|
|
|
2026-02-23 09:28:17 -08:00
|
|
|
[dependencies]
|
|
|
|
|
anyhow = { workspace = true }
|
|
|
|
|
async-trait = { workspace = true }
|
2026-02-23 20:10:22 -08:00
|
|
|
clap = { workspace = true, features = ["derive"] }
|
feat: include sandbox config with escalation request (#12839)
## Why
Before this change, an escalation approval could say that a command
should be rerun, but it could not carry the sandbox configuration that
should still apply when the escalated command is actually spawned.
That left an unsafe gap in the `zsh-fork` skill path: skill scripts
under `scripts/` that did not declare permissions could be escalated
without a sandbox, and scripts that did declare permissions could lose
their bounded sandbox on rerun or cached session approval.
This PR extends the escalation protocol so approvals can optionally
carry sandbox configuration all the way through execution. That lets the
shell runtime preserve the intended sandbox instead of silently widening
access.
We likely want a single permissions type for this codepath eventually,
probably centered on `Permissions`. For now, the protocol needs to
represent both the existing `PermissionProfile` form and the fuller
`Permissions` form, so this introduces a temporary disjoint union,
`EscalationPermissions`, to carry either one.
Further, this means that today, a skill either:
- does not declare any permissions, in which case it is run using the
default sandbox for the turn
- specifies permissions, in which case the skill is run using that exact
sandbox, which might be more restrictive than the default sandbox for
the turn
We will likely change the skill's permissions to be additive to the
existing permissions for the turn.
## What Changed
- Added `EscalationPermissions` to `codex-protocol` so escalation
requests can carry either a `PermissionProfile` or a full `Permissions`
payload.
- Added an explicit `EscalationExecution` mode to the shell escalation
protocol so reruns distinguish between `Unsandboxed`, `TurnDefault`, and
`Permissions(...)` instead of overloading `None`.
- Updated `zsh-fork` shell reruns to resolve `TurnDefault` at execution
time, which keeps ordinary `UseDefault` commands on the turn sandbox and
preserves turn-level macOS seatbelt profile extensions.
- Updated the `zsh-fork` skill path so a skill with no declared
permissions inherits the conversation's effective sandbox instead of
escalating unsandboxed.
- Updated the `zsh-fork` skill path so a skill with declared permissions
reruns with exactly those permissions, including when a cached session
approval is reused.
## Testing
- Added unit coverage in
`core/src/tools/runtimes/shell/unix_escalation.rs` for the explicit
`UseDefault` / `RequireEscalated` / `WithAdditionalPermissions`
execution mapping.
- Added unit coverage in
`core/src/tools/runtimes/shell/unix_escalation.rs` for macOS seatbelt
extension preservation in both the `TurnDefault` and
explicit-permissions rerun paths.
- Added integration coverage in `core/tests/suite/skill_approval.rs` for
permissionless skills inheriting the turn sandbox and explicit skill
permissions remaining bounded across cached approval reuse.
2026-02-26 12:00:18 -08:00
|
|
|
codex-protocol = { workspace = true }
|
2026-02-24 23:52:36 -08:00
|
|
|
codex-utils-absolute-path = { workspace = true }
|
2026-02-23 09:28:17 -08:00
|
|
|
libc = { workspace = true }
|
|
|
|
|
serde = { workspace = true, features = ["derive"] }
|
2026-02-24 16:20:08 -08:00
|
|
|
serde_json = { workspace = true }
|
2026-02-23 20:58:24 -08:00
|
|
|
socket2 = { workspace = true, features = ["all"] }
|
2026-02-23 09:28:17 -08:00
|
|
|
tokio = { workspace = true, features = [
|
|
|
|
|
"io-std",
|
2026-02-23 20:58:24 -08:00
|
|
|
"net",
|
2026-02-23 09:28:17 -08:00
|
|
|
"macros",
|
|
|
|
|
"process",
|
|
|
|
|
"rt-multi-thread",
|
|
|
|
|
"signal",
|
2026-02-23 20:58:24 -08:00
|
|
|
"time",
|
2026-02-23 09:28:17 -08:00
|
|
|
] }
|
|
|
|
|
tokio-util = { workspace = true }
|
|
|
|
|
tracing = { workspace = true }
|
2026-02-23 20:10:22 -08:00
|
|
|
tracing-subscriber = { workspace = true, features = ["env-filter", "fmt"] }
|
2026-02-23 09:28:17 -08:00
|
|
|
|
|
|
|
|
[dev-dependencies]
|
|
|
|
|
pretty_assertions = { workspace = true }
|
|
|
|
|
tempfile = { workspace = true }
|