feat(permissions): resolve permission profile inheritance#22270
Merged
Conversation
viyatb-oai
force-pushed
the
codex/permissions-profile-extends
branch
from
6d6f15c to
b129da1
Compare
viyatb-oai
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8a8ed4dff
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
viyatb-oai
changed the title
viyatb-oai
force-pushed
the
codex/permissions-profile-extends
branch
from
a8a8ed4 to
c2cd30a
Compare
bolinfest
reviewed
May 19, 2026
viyatb-oai
changed the title
viyatb-oai
force-pushed
the
codex/permissions-profile-extends
branch
from
c2cd30a to
e5dc91a
Compare
bolinfest
reviewed
May 20, 2026
viyatb-oai
force-pushed
the
codex/permissions-profile-extends
branch
from
1130a3c to
3440740
Compare
viyatb-oai
changed the title
bolinfest
approved these changes
May 20, 2026
Collaborator
bolinfest
left a comment
bolinfest
left a comment
There was a problem hiding this comment.
Thanks for splitting things up and changing the merge logic: this is much easier to follow!
bolinfest
pushed a commit
that referenced
this pull request
May 20, 2026
## Stack This PR is stacked on #22270. Review #22270 first for the config-level `extends` resolver and merge semantics; this follow-up contains the runtime and protocol wiring on top of that foundation. ## Why The resolver in #22270 makes inherited permission profiles well-defined in config, but selected profiles still need to flow through runtime permission compilation, network-proxy selection, and the active-profile metadata exposed to clients. This PR keeps that integration separate from the inheritance rules themselves so each diff has a narrower review surface. ## What changed - Resolve selected custom permission profiles before compiling runtime sandbox and network policy, including supported built-in baselines such as `:read-only` and `:workspace`. - Preserve the selected profile's `extends` metadata on the active permission profile while the resolved permissions drive runtime behavior. - Update network proxy profile loading so built-in defaults and inherited custom profiles select the effective network policy consistently. - Add runtime coverage for built-in extension baselines, active-profile metadata, and network-proxy selection. - Refresh app-server protocol comments and generated schema/TypeScript fixtures for the now-active `extends` field. ## Validation Run on the full inheritance stack before the PR split: - `cargo test -p codex-config` - `cargo test -p codex-core permissions_profiles_` - `cargo test -p codex-core selected_network_from_tables_` - `cargo test -p codex-core default_permissions_profile_can_extend_builtin_workspace`
Co-authored-by: Codex noreply@openai.com
Co-authored-by: Codex noreply@openai.com
## Stack This PR is stacked on #22270. Review #22270 first for the config-level `extends` resolver and merge semantics; this follow-up contains the runtime and protocol wiring on top of that foundation. ## Why The resolver in #22270 makes inherited permission profiles well-defined in config, but selected profiles still need to flow through runtime permission compilation, network-proxy selection, and the active-profile metadata exposed to clients. This PR keeps that integration separate from the inheritance rules themselves so each diff has a narrower review surface. ## What changed - Resolve selected custom permission profiles before compiling runtime sandbox and network policy, including supported built-in baselines such as `:read-only` and `:workspace`. - Preserve the selected profile's `extends` metadata on the active permission profile while the resolved permissions drive runtime behavior. - Update network proxy profile loading so built-in defaults and inherited custom profiles select the effective network policy consistently. - Add runtime coverage for built-in extension baselines, active-profile metadata, and network-proxy selection. - Refresh app-server protocol comments and generated schema/TypeScript fixtures for the now-active `extends` field. ## Validation Run on the full inheritance stack before the PR split: - `cargo test -p codex-config` - `cargo test -p codex-core permissions_profiles_` - `cargo test -p codex-core selected_network_from_tables_` - `cargo test -p codex-core default_permissions_profile_can_extend_builtin_workspace`
viyatb-oai
force-pushed
the
codex/permissions-profile-extends
branch
from
7155129 to
4be6e4d
Compare
Co-authored-by: Codex noreply@openai.com
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
This is the foundation PR for the permission-profile inheritance stack.
extendsresolution and merge semantics.Why
Permission profiles are starting to carry enough policy that copy-pasting near-identical definitions becomes hard to review and easy to drift. Before the runtime can consume inherited profiles, the config layer needs one explicit resolver that can merge parent chains and reject unsafe or invalid inheritance shapes.
What changed
extendsto permission-profile TOML and resolve parent chains in inheritance order.Validation
cargo test -p codex-configcargo test -p codex-core permissions_profiles_