92f3566d78
Without this change, it is challenging to create integration tests to verify that the folders not included in `writable_roots` in `SandboxPolicy::WorkspaceWrite` are read-only because, by default, `get_writable_roots_with_cwd()` includes `TMPDIR`, which is where most integrationt tests do their work. This introduces a `use_exact_writable_roots` option to disable the default includes returned by `get_writable_roots_with_cwd()`. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/1785). * #1765 * __->__ #1785
33 lines
1.1 KiB
Rust
33 lines
1.1 KiB
Rust
use codex_core::protocol::SandboxPolicy;
|
|
|
|
pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
|
|
match sandbox_policy {
|
|
SandboxPolicy::DangerFullAccess => "danger-full-access".to_string(),
|
|
SandboxPolicy::ReadOnly => "read-only".to_string(),
|
|
SandboxPolicy::WorkspaceWrite {
|
|
writable_roots,
|
|
network_access,
|
|
include_default_writable_roots,
|
|
} => {
|
|
let mut summary = "workspace-write".to_string();
|
|
if !writable_roots.is_empty() {
|
|
summary.push_str(&format!(
|
|
" [{}]",
|
|
writable_roots
|
|
.iter()
|
|
.map(|p| p.to_string_lossy())
|
|
.collect::<Vec<_>>()
|
|
.join(", ")
|
|
));
|
|
}
|
|
if !*include_default_writable_roots {
|
|
summary.push_str(" (exact writable roots)");
|
|
}
|
|
if *network_access {
|
|
summary.push_str(" (network access enabled)");
|
|
}
|
|
summary
|
|
}
|
|
}
|
|
}
|