sayan-oai 1873e947f8 Honor per-environment permission profiles (#38673) ...

## What changed

- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
  complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
  `FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.

## Testing

- Add coverage proving that a read-only environment blocks writes even when
  the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
  for the resolved attachment configuration.

GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7

2026-08-15 00:24:25 +00:00

..

common

Carry environment config in turn selections (#38521)

2026-08-14 07:52:38 +00:00

remote_env_windows

Carry environment config in turn selections (#38521)

2026-08-14 07:52:38 +00:00

suite

Honor per-environment permission profiles (#38673)

2026-08-15 00:24:25 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Include sandbox mode in response metadata (#37507)

2026-08-07 22:41:20 +00:00