github/codex
4
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-21 14:23:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

core: expose local sandbox helper to workspace tests

Browse Source
This commit is contained in:
pakrym-oai
2026-07-09 18:33:22 -07:00
parent 0e31de2d2f
commit aa7457939e
1 changed files with 31 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/tests/suite/workspace_roots.rs
+31 -16
View File
@@ -34,24 +34,39 @@ const COMMAND_CALL_ID: &str = "workspace-root-command";
const PNG_BASE64: &str =
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=";
fn workspace_roots_read_profile() -> PermissionProfile {
PermissionProfile::from_runtime_permissions(
&FileSystemSandboxPolicy::restricted(vec![
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::Minimal,
},
access: FileSystemAccessMode::Read,
fn workspace_roots_read_profile() -> Result<PermissionProfile> {
let mut entries = vec![
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::Minimal,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Read,
access: FileSystemAccessMode::Read,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
]),
access: FileSystemAccessMode::Read,
},
];
#[cfg(target_os = "linux")]
if !core_test_support::is_remote_test_environment() {
// Bubblewrap re-execs the test binary after applying the filesystem policy.
// Bazel places that binary outside the platform paths covered by `:minimal`.
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(
std::env::current_exe()?,
)?,
},
access: FileSystemAccessMode::Read,
});
}
Ok(PermissionProfile::from_runtime_permissions(
&FileSystemSandboxPolicy::restricted(entries),
NetworkSandboxPolicy::Restricted,
)
))
}
async fn workspace_roots_test(server: &MockServer) -> Result<TestCodex> {
@@ -122,7 +137,7 @@ async fn mount_file_and_command_calls(
}
async fn submit_workspace_turn(test: &TestCodex, prompt: &str) -> Result<()> {
test.submit_turn_with_permission_profile(prompt, workspace_roots_read_profile())
test.submit_turn_with_permission_profile(prompt, workspace_roots_read_profile()?)
.await
}