0776d78357
This is a major redesign of how sandbox configuration works and aims to fix https://github.com/openai/codex/issues/1248. Specifically, it replaces `sandbox_permissions` in `config.toml` (and the `-s`/`--sandbox-permission` CLI flags) with a "table" with effectively three variants: ```toml # Safest option: full disk is read-only, but writes and network access are disallowed. [sandbox] mode = "read-only" # The cwd of the Codex task is writable, as well as $TMPDIR on macOS. # writable_roots can be used to specify additional writable folders. [sandbox] mode = "workspace-write" writable_roots = [] # Optional, defaults to the empty list. network_access = false # Optional, defaults to false. # Disable sandboxing: use at your own risk!!! [sandbox] mode = "danger-full-access" ``` This should make sandboxing easier to reason about. While we have dropped support for `-s`, the way it works now is: - no flags => `read-only` - `--full-auto` => `workspace-write` - currently, there is no way to specify `danger-full-access` via a CLI flag, but we will revisit that as part of https://github.com/openai/codex/issues/1254 Outstanding issue: - As noted in the `TODO` on `SandboxPolicy::is_unrestricted()`, we are still conflating sandbox preferences with approval preferences in that case, which needs to be cleaned up.
35 lines
1.2 KiB
Rust
35 lines
1.2 KiB
Rust
//! Standard type to use with the `--approval-mode` CLI option.
|
|
//! Available when the `cli` feature is enabled for the crate.
|
|
|
|
use clap::ValueEnum;
|
|
|
|
use codex_core::protocol::AskForApproval;
|
|
|
|
#[derive(Clone, Copy, Debug, ValueEnum)]
|
|
#[value(rename_all = "kebab-case")]
|
|
pub enum ApprovalModeCliArg {
|
|
/// Run all commands without asking for user approval.
|
|
/// Only asks for approval if a command fails to execute, in which case it
|
|
/// will escalate to the user to ask for un-sandboxed execution.
|
|
OnFailure,
|
|
|
|
/// Only run "known safe" commands (e.g. ls, cat, sed) without
|
|
/// asking for user approval. Will escalate to the user if the model
|
|
/// proposes a command that is not allow-listed.
|
|
UnlessAllowListed,
|
|
|
|
/// Never ask for user approval
|
|
/// Execution failures are immediately returned to the model.
|
|
Never,
|
|
}
|
|
|
|
impl From<ApprovalModeCliArg> for AskForApproval {
|
|
fn from(value: ApprovalModeCliArg) -> Self {
|
|
match value {
|
|
ApprovalModeCliArg::OnFailure => AskForApproval::OnFailure,
|
|
ApprovalModeCliArg::UnlessAllowListed => AskForApproval::UnlessAllowListed,
|
|
ApprovalModeCliArg::Never => AskForApproval::Never,
|
|
}
|
|
}
|
|
}
|