From 2c85ca68429539ce27b346e573fbd07a18616c53 Mon Sep 17 00:00:00 2001
From: jif-oai <jif@openai.com>
Date: Fri, 27 Mar 2026 14:50:36 +0100
Subject: [PATCH] Use codex-utils-template for sandbox mode prompts (#15998)

---
 codex-rs/Cargo.lock                           |  1 +
 codex-rs/protocol/Cargo.toml                  |  1 +
 codex-rs/protocol/src/models.rs               | 34 ++++++++++++++++---
 .../sandbox_mode/danger_full_access.md        |  2 +-
 .../permissions/sandbox_mode/read_only.md     |  2 +-
 .../sandbox_mode/workspace_write.md           |  2 +-
 6 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index 03e8dc5b6..091dfe31a 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -2386,6 +2386,7 @@ dependencies = [
  "codex-utils-absolute-path",
  "codex-utils-image",
  "codex-utils-string",
+ "codex-utils-template",
  "icu_decimal",
  "icu_locale_core",
  "icu_provider",
diff --git a/codex-rs/protocol/Cargo.toml b/codex-rs/protocol/Cargo.toml
index ebfdaddab..58f3e0606 100644
--- a/codex-rs/protocol/Cargo.toml
+++ b/codex-rs/protocol/Cargo.toml
@@ -17,6 +17,7 @@ codex-git-utils = { workspace = true }
 codex-utils-absolute-path = { workspace = true }
 codex-utils-image = { workspace = true }
 codex-utils-string = { workspace = true }
+codex-utils-template = { workspace = true }
 icu_decimal = { workspace = true }
 icu_locale_core = { workspace = true }
 icu_provider = { workspace = true, features = ["sync"] }
diff --git a/codex-rs/protocol/src/models.rs b/codex-rs/protocol/src/models.rs
index 471790717..7ab0009b4 100644
--- a/codex-rs/protocol/src/models.rs
+++ b/codex-rs/protocol/src/models.rs
@@ -1,8 +1,10 @@
 use std::collections::HashMap;
 use std::path::Path;
+use std::sync::LazyLock;
 
 use codex_utils_image::PromptImageMode;
 use codex_utils_image::load_for_prompt_bytes;
+use codex_utils_template::Template;
 use serde::Deserialize;
 use serde::Deserializer;
 use serde::Serialize;
@@ -30,6 +32,19 @@ use schemars::JsonSchema;
 
 use crate::mcp::CallToolResult;
 
+static SANDBOX_MODE_DANGER_FULL_ACCESS_TEMPLATE: LazyLock<Template> = LazyLock::new(|| {
+    Template::parse(SANDBOX_MODE_DANGER_FULL_ACCESS.trim_end())
+        .unwrap_or_else(|err| panic!("danger-full-access sandbox template must parse: {err}"))
+});
+static SANDBOX_MODE_WORKSPACE_WRITE_TEMPLATE: LazyLock<Template> = LazyLock::new(|| {
+    Template::parse(SANDBOX_MODE_WORKSPACE_WRITE.trim_end())
+        .unwrap_or_else(|err| panic!("workspace-write sandbox template must parse: {err}"))
+});
+static SANDBOX_MODE_READ_ONLY_TEMPLATE: LazyLock<Template> = LazyLock::new(|| {
+    Template::parse(SANDBOX_MODE_READ_ONLY.trim_end())
+        .unwrap_or_else(|err| panic!("read-only sandbox template must parse: {err}"))
+});
+
 /// Controls the per-command sandbox override requested by a shell-like tool call.
 #[derive(
     Debug, Clone, Copy, Default, Eq, Hash, PartialEq, Serialize, Deserialize, JsonSchema, TS,
@@ -583,11 +598,14 @@ impl DeveloperInstructions {
 
     fn sandbox_text(mode: SandboxMode, network_access: NetworkAccess) -> DeveloperInstructions {
         let template = match mode {
-            SandboxMode::DangerFullAccess => SANDBOX_MODE_DANGER_FULL_ACCESS.trim_end(),
-            SandboxMode::WorkspaceWrite => SANDBOX_MODE_WORKSPACE_WRITE.trim_end(),
-            SandboxMode::ReadOnly => SANDBOX_MODE_READ_ONLY.trim_end(),
+            SandboxMode::DangerFullAccess => &*SANDBOX_MODE_DANGER_FULL_ACCESS_TEMPLATE,
+            SandboxMode::WorkspaceWrite => &*SANDBOX_MODE_WORKSPACE_WRITE_TEMPLATE,
+            SandboxMode::ReadOnly => &*SANDBOX_MODE_READ_ONLY_TEMPLATE,
         };
-        let text = template.replace("{network_access}", &network_access.to_string());
+        let network_access = network_access.to_string();
+        let text = template
+            .render([("network_access", network_access.as_str())])
+            .unwrap_or_else(|err| panic!("sandbox template must render: {err}"));
 
         DeveloperInstructions::new(text)
     }
@@ -1654,6 +1672,14 @@ mod tests {
                 "Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `read-only`: The sandbox only permits reading files. Network access is restricted."
             )
         );
+
+        let danger_full_access: DeveloperInstructions = SandboxMode::DangerFullAccess.into();
+        assert_eq!(
+            danger_full_access,
+            DeveloperInstructions::new(
+                "Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled."
+            )
+        );
     }
 
     #[test]
diff --git a/codex-rs/protocol/src/prompts/permissions/sandbox_mode/danger_full_access.md b/codex-rs/protocol/src/prompts/permissions/sandbox_mode/danger_full_access.md
index 4a5cfa9fb..d9b6f2685 100644
--- a/codex-rs/protocol/src/prompts/permissions/sandbox_mode/danger_full_access.md
+++ b/codex-rs/protocol/src/prompts/permissions/sandbox_mode/danger_full_access.md
@@ -1 +1 @@
-Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is {network_access}.
+Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is {{network_access}}.
diff --git a/codex-rs/protocol/src/prompts/permissions/sandbox_mode/read_only.md b/codex-rs/protocol/src/prompts/permissions/sandbox_mode/read_only.md
index 729264a11..a221124ea 100644
--- a/codex-rs/protocol/src/prompts/permissions/sandbox_mode/read_only.md
+++ b/codex-rs/protocol/src/prompts/permissions/sandbox_mode/read_only.md
@@ -1 +1 @@
-Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `read-only`: The sandbox only permits reading files. Network access is {network_access}.
+Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `read-only`: The sandbox only permits reading files. Network access is {{network_access}}.
diff --git a/codex-rs/protocol/src/prompts/permissions/sandbox_mode/workspace_write.md b/codex-rs/protocol/src/prompts/permissions/sandbox_mode/workspace_write.md
index ae74b5f76..0732a998e 100644
--- a/codex-rs/protocol/src/prompts/permissions/sandbox_mode/workspace_write.md
+++ b/codex-rs/protocol/src/prompts/permissions/sandbox_mode/workspace_write.md
@@ -1 +1 @@
-Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval. Network access is {network_access}.
+Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval. Network access is {{network_access}}.