mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Anton Panasenko
3429de21b3
## Description
Introduced `ExternalSandbox` policy to cover use case when sandbox
defined by outside environment, effectively it translates to
`SandboxMode#DangerFullAccess` for file system (since sandbox configured
on container level) and configurable `network_access` (either Restricted
or Enabled by outside environment).
as example you can configure `ExternalSandbox` policy as part of
`sendUserTurn` v1 app_server API:
```
{
"conversationId": <id>,
"cwd": <cwd>,
"approvalPolicy": "never",
"sandboxPolicy": {
"type": ""external-sandbox",
"network_access": "enabled"/"restricted"
},
"model": <model>,
"effort": <effort>,
....
}
```
48 lines
1.4 KiB
Rust
48 lines
1.4 KiB
Rust
//! Standard type to use with the `--sandbox` (`-s`) CLI option.
|
|
//!
|
|
//! This mirrors the variants of [`codex_core::protocol::SandboxPolicy`], but
|
|
//! without any of the associated data so it can be expressed as a simple flag
|
|
//! on the command-line. Users that need to tweak the advanced options for
|
|
//! `workspace-write` can continue to do so via `-c` overrides or their
|
|
//! `config.toml`.
|
|
|
|
use clap::ValueEnum;
|
|
use codex_protocol::config_types::SandboxMode;
|
|
|
|
#[derive(Clone, Copy, Debug, ValueEnum)]
|
|
#[value(rename_all = "kebab-case")]
|
|
pub enum SandboxModeCliArg {
|
|
ReadOnly,
|
|
WorkspaceWrite,
|
|
DangerFullAccess,
|
|
}
|
|
|
|
impl From<SandboxModeCliArg> for SandboxMode {
|
|
fn from(value: SandboxModeCliArg) -> Self {
|
|
match value {
|
|
SandboxModeCliArg::ReadOnly => SandboxMode::ReadOnly,
|
|
SandboxModeCliArg::WorkspaceWrite => SandboxMode::WorkspaceWrite,
|
|
SandboxModeCliArg::DangerFullAccess => SandboxMode::DangerFullAccess,
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn maps_cli_args_to_protocol_modes() {
|
|
assert_eq!(SandboxMode::ReadOnly, SandboxModeCliArg::ReadOnly.into());
|
|
assert_eq!(
|
|
SandboxMode::WorkspaceWrite,
|
|
SandboxModeCliArg::WorkspaceWrite.into()
|
|
);
|
|
assert_eq!(
|
|
SandboxMode::DangerFullAccess,
|
|
SandboxModeCliArg::DangerFullAccess.into()
|
|
);
|
|
}
|
|
}
|