Resolve permission requests in the executor context - #42146
Merged
copyberry[bot] merged 1 commit intoSep 1, 2026
Merged
Conversation
## Why `request_permissions` paths and grants need to be evaluated against the selected executor environment, including its path convention, home directory, workspace roots, and temporary directories. ## What changed - Resolve relative and home-relative permission paths using the executor context, reject mismatched path conventions and lossy paths, and support legacy `read` and `write` path lists. - Move grant intersection into core so requested and granted permissions use the originating environment's sandbox context. Preserve deny entries conservatively when a special path cannot be resolved. - Keep the full originating environment with pending permission requests so delayed responses are normalized against the same context. ## Testing - Cover POSIX, Windows, UNC, relative, and home-relative path resolution and invalid path contexts. - Verify end-to-end app-server grants are limited to the requested workspace scope and unresolved temporary-directory denies are preserved. GitOrigin-RevId: 730a2aacd391262e92a6314f3a5b6c262e3dca10
copyberry
Bot
force-pushed
the
copyberry/codex-internal-to-codex-oss/730a2aacd391262e92a6314f3a5b6c262e3dca10
branch
from
September 1, 2026 22:08
6de92e9 to
cd8bd62
Compare
copyberry
Bot
deleted the
copyberry/codex-internal-to-codex-oss/730a2aacd391262e92a6314f3a5b6c262e3dca10
branch
September 1, 2026 22:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolve permission requests in the executor context
Why
request_permissionspaths and grants need to be evaluated against the selected executor environment, including its path convention, home directory, workspace roots, and temporary directories.What changed
readandwritepath lists.Testing