6fe8a05dcb
## Summary - stop `codex sandbox` from forcing legacy `sandbox_mode` when active `[permissions]` profiles are configured - keep the legacy `read-only` / `workspace-write` fallback for legacy configs and reject `--full-auto` for profile-based configs - use split filesystem and network policies in the macOS/Linux debug sandbox helpers and add regressions for the config-loading behavior assuming "codex/docs/private/secret.txt" = "none" ``` codex -c 'default_permissions="limited-read-test"' sandbox macos -- <command> ... codex sandbox macos -- cat codex/docs/private/secret.txt >/dev/null; echo EXIT:$? cat: codex/docs/private/secret.txt: Operation not permitted EXIT:1 ``` --------- Co-authored-by: celia-oai <celia@openai.com> |
||
|---|---|---|
| .. | ||
| debug_sandbox | ||
| desktop_app | ||
| app_cmd.rs | ||
| debug_sandbox.rs | ||
| exit_status.rs | ||
| lib.rs | ||
| login.rs | ||
| main.rs | ||
| mcp_cmd.rs | ||
| wsl_paths.rs | ||