66a4b89822
## Summary - Coerce Windows `workspace-write` configs back to read-only, surface the forced downgrade in the approvals popup, and funnel users toward WSL or Full Access. - Add WSL installation instructions to the Auto preset on Windows while keeping the preset available for other platforms. - Skip the trust-on-first-run prompt on native Windows so new folders remain read-only without additional confirmation. - Expose a structured sandbox policy resolution from config to flag Windows downgrades and adjust tests (core, exec, TUI) to reflect the new behavior; provide a Windows-only approvals snapshot. ## Testing - cargo fmt - cargo test -p codex-core config::tests::add_dir_override_extends_workspace_writable_roots - cargo test -p codex-exec suite::resume::exec_resume_preserves_cli_configuration_overrides - cargo test -p codex-tui chatwidget::tests::approvals_selection_popup_snapshot - cargo test -p codex-tui approvals_popup_includes_wsl_note_for_auto_mode - cargo test -p codex-tui windows_skips_trust_prompt - just fix -p codex-core - just fix -p codex-tui
47 lines
1.8 KiB
Rust
47 lines
1.8 KiB
Rust
use codex_core::protocol::AskForApproval;
|
|
use codex_core::protocol::SandboxPolicy;
|
|
|
|
/// A simple preset pairing an approval policy with a sandbox policy.
|
|
#[derive(Debug, Clone)]
|
|
pub struct ApprovalPreset {
|
|
/// Stable identifier for the preset.
|
|
pub id: &'static str,
|
|
/// Display label shown in UIs.
|
|
pub label: &'static str,
|
|
/// Short human description shown next to the label in UIs.
|
|
pub description: &'static str,
|
|
/// Approval policy to apply.
|
|
pub approval: AskForApproval,
|
|
/// Sandbox policy to apply.
|
|
pub sandbox: SandboxPolicy,
|
|
}
|
|
|
|
/// Built-in list of approval presets that pair approval and sandbox policy.
|
|
///
|
|
/// Keep this UI-agnostic so it can be reused by both TUI and MCP server.
|
|
pub fn builtin_approval_presets() -> Vec<ApprovalPreset> {
|
|
vec![
|
|
ApprovalPreset {
|
|
id: "read-only",
|
|
label: "Read Only",
|
|
description: "Codex can read files and answer questions. Codex requires approval to make edits, run commands, or access network.",
|
|
approval: AskForApproval::OnRequest,
|
|
sandbox: SandboxPolicy::ReadOnly,
|
|
},
|
|
ApprovalPreset {
|
|
id: "auto",
|
|
label: "Auto",
|
|
description: "Codex can read files, make edits, and run commands in the workspace. Codex requires approval to work outside the workspace or access network.",
|
|
approval: AskForApproval::OnRequest,
|
|
sandbox: SandboxPolicy::new_workspace_write_policy(),
|
|
},
|
|
ApprovalPreset {
|
|
id: "full-access",
|
|
label: "Full Access",
|
|
description: "Codex can read files, make edits, and run commands with network access, without approval. Exercise caution.",
|
|
approval: AskForApproval::Never,
|
|
sandbox: SandboxPolicy::DangerFullAccess,
|
|
},
|
|
]
|
|
}
|