agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

core/protocol: add structured macOS additional permissions and merge them into sandbox execution (#13499)

Browse Source 
## Summary
- Introduce strongly-typed macOS additional permissions across
protocol/core/app-server boundaries.
- Merge additional permissions into effective sandbox execution,
including macOS seatbelt profile extensions.
- Expand docs, schema/tool definitions, UI rendering, and tests for
`network`, `file_system`, and `macos` additional permissions.
This commit is contained in:
Celia Chen
2026-03-05 16:21:45 -08:00
committed by GitHub
Unverified
parent 4e77ea0ec7
commit aaefee04cd
24 changed files with 1013 additions and 379 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/skills/loader.rs
+56 -26
View File
@@ -866,6 +866,9 @@ mod tests {
use codex_config::CONFIG_TOML_FILE;
use codex_protocol::config_types::TrustLevel;
use codex_protocol::models::FileSystemPermissions;
use codex_protocol::models::MacOsAutomationPermission;
use codex_protocol::models::MacOsPreferencesPermission;
use codex_protocol::models::MacOsSeatbeltProfileExtensions;
use codex_protocol::models::PermissionProfile;
use codex_protocol::protocol::SkillScope;
use codex_utils_absolute_path::AbsolutePathBuf;
@@ -1454,6 +1457,37 @@ permissions: {}
assert_eq!(outcome.skills[0].permission_profile, None);
}
#[test]
fn skill_metadata_parses_macos_permissions_yaml() {
let parsed = serde_yaml::from_str::<SkillMetadataFile>(
r#"
permissions:
macos:
macos_preferences: "read_write"
macos_automation:
- "com.apple.Notes"
macos_accessibility: true
macos_calendar: true
"#,
)
.expect("parse skill metadata");
assert_eq!(
parsed.permissions,
Some(PermissionProfile {
macos: Some(MacOsSeatbeltProfileExtensions {
macos_preferences: MacOsPreferencesPermission::ReadWrite,
macos_automation: MacOsAutomationPermission::BundleIds(vec![
"com.apple.Notes".to_string(),
]),
macos_accessibility: true,
macos_calendar: true,
}),
..Default::default()
})
);
}
#[cfg(target_os = "macos")]
#[tokio::test]
async fn loads_skill_macos_permissions_from_yaml() {
@@ -1466,11 +1500,11 @@ permissions: {}
r#"
permissions:
macos:
preferences: "readwrite"
automations:
macos_preferences: "read_write"
macos_automation:
- "com.apple.Notes"
accessibility: true
calendar: true
macos_accessibility: true
macos_calendar: true
"#,
);
@@ -1486,15 +1520,13 @@ permissions:
assert_eq!(
outcome.skills[0].permission_profile,
Some(PermissionProfile {
macos: Some(codex_protocol::models::MacOsPermissions {
preferences: Some(codex_protocol::models::MacOsPreferencesValue::Mode(
"readwrite".to_string(),
),),
automations: Some(codex_protocol::models::MacOsAutomationValue::BundleIds(
vec!["com.apple.Notes".to_string()],
)),
accessibility: Some(true),
calendar: Some(true),
macos: Some(MacOsSeatbeltProfileExtensions {
macos_preferences: MacOsPreferencesPermission::ReadWrite,
macos_automation: MacOsAutomationPermission::BundleIds(vec![
"com.apple.Notes".to_string()
],),
macos_accessibility: true,
macos_calendar: true,
}),
..Default::default()
})
@@ -1513,11 +1545,11 @@ permissions:
r#"
permissions:
macos:
preferences: "readwrite"
automations:
macos_preferences: "read_write"
macos_automation:
- "com.apple.Notes"
accessibility: true
calendar: true
macos_accessibility: true
macos_calendar: true
"#,
);
@@ -1533,15 +1565,13 @@ permissions:
assert_eq!(
outcome.skills[0].permission_profile,
Some(PermissionProfile {
macos: Some(codex_protocol::models::MacOsPermissions {
preferences: Some(codex_protocol::models::MacOsPreferencesValue::Mode(
"readwrite".to_string(),
)),
automations: Some(codex_protocol::models::MacOsAutomationValue::BundleIds(
vec!["com.apple.Notes".to_string()],
)),
accessibility: Some(true),
calendar: Some(true),
macos: Some(MacOsSeatbeltProfileExtensions {
macos_preferences: MacOsPreferencesPermission::ReadWrite,
macos_automation: MacOsAutomationPermission::BundleIds(vec![
"com.apple.Notes".to_string()
],),
macos_accessibility: true,
macos_calendar: true,
}),
..Default::default()
})