With a Codex default_permissions profile that denies reads of **/.env and **/.env*, one Full access turn silently removed those denies for the rest of the thread. A fresh Auto turn had them. After Auto → Full access → Auto, the next Auto turn ran under a plain workspace-write sandbox: the injected permission instructions and the profile Codex enforces both lacked the deny entries, even though the composer showed Auto again.
The cause: T3 sends a legacy sandboxPolicy on every turn/start. Codex keeps a named profile only while that policy matches it. After dangerFullAccess and back to workspaceWrite, Codex builds a legacy profile without the profile's deny entries.
CodexAdapterV2 records the user-defined permission profile per Codex thread, as thread/start, cold thread/resume, and thread/fork report it in activePermissionProfile. Built-in :-prefixed ids are ignored. A resume of an already-loaded thread reports its current state (no profile after a legacy-sandbox turn), so it does not clear the remembered one.turn/start selects the profile with Codex's permissions: <id> instead of sandboxPolicy. Other modes, users without a named profile, and Codex versions that do not report the profile send exactly what they did before.config.toml while the thread stays loaded, Codex rejects the permissions turn with a default_permissions error. T3 then forgets the profile and retries once with the legacy sandboxPolicy.permissions is added to the turn/start encoder in effect-codex-app-server. thread/start and thread/fork are read raw because the generated response schemas strip activePermissionProfile.Fixes #20266
Triaged bug via the automated issue flow.
vp test run src/orchestration-v2/Adapters/CodexAdapterV2.test.ts: 82 passed. New tests:thread/resume calls T3 makes between mode changes. It fails on main: the Auto turn/start carries sandboxPolicy: workspaceWrite and no permissions.sandboxPolicy.packages/effect-codex-app-server vp test run src/client.test.ts: 2 passed. tsc --noEmit -p apps/server: 0 errors.permission_profile from Codex's rollout file. No protected file was read.| Run | Turn 3 (Auto after Full access) |
|---|---|
Before, origin/main ed3f965e07 | no .env denies in the permission block or the enforced profile |
| After, this branch | <cwd>/**/.env and <cwd>/**/.env* in both |
| After: Full access, server restart, then Auto | both denies present |
| After: profile renamed mid-thread, then Auto | permissions turn rejected, legacy retry completes the turn |
Runtime transcript: 20266-runtime-transcript.txt
Not checked: macOS, the reporter's platform. The change is in the app-server protocol requests and has no platform-specific code.
Claude Opus 5.5 via Claude Code in T3 Code (implementation and tests on claude-opus-5-5; reviews on claude-opus-5-5 and claude-sonnet-5-5).
🤖 Generated with Claude Code
Review completed
Skipped - Not affected
Added 6 commits
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval — This production change alters Codex sandbox and permission-profile selection, including restoration of deny-read protections for sensitive files after runtime-mode changes. The scope is focused and well tested, but the security-sensitive permission behavior warrants human review.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review. 🎉
af4e7b77-8698-4e2f-a824-6383bf072c30Reviewing files that changed from the base of the PR and between f054d1b8018721bd997d99cbb918a7b17bf098a4 and a9ae44f56c0947fd069ea3f741351e6431c18d98.
apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.tsapps/server/src/orchestration-v2/Adapters/CodexAdapterV2.tspackages/effect-codex-app-server/src/client.tsLimit details: You’ve used all 10 included reviews currently available.
The Codex adapter now retains named permission profiles from thread responses and uses a matching profile for turns when no explicit sandbox policy applies. If Codex rejects the profile as unavailable, the adapter retries with the legacy sandbox policy.
Changes: Codex permission profile handling
| Layer / File(s) | Summary |
|---|---|
Decode and select permission profiles apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts, packages/effect-codex-app-server/src/client.ts, apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts | The turn-start schema accepts permissions. The adapter decodes named profiles and uses a profile only when its sandbox type matches the runtime mode and no explicit sandbox policy applies. Tests cover explicit policies, mismatched profiles, and built-in profiles. |
Capture profiles across thread operations apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts, apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts | The adapter stores reported profiles by thread. It reads raw thread start, resume, and fork responses to capture profile data. |
Apply profiles and retry unavailable profiles apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts, apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts | Turn-start requests use the stored profile. When Codex rejects it with an error mentioning default_permissions, the adapter forgets the profile and retries with the legacy sandbox policy. Replay tests cover the Auto → Full access → Auto sequence and the retry path. |
Priority: ➖ Normal
Estimated code review effort: 3 (Moderate) | ~25 minutes
Change: Bug fix · Severity of issue fixed: Medium
Suggested reviewers: t3dotgg
a9ae4No actionable merge-blocking issue is established. The profile fallback can proceed with normal validation.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title is concise, conventional, and accurately describes the main fix: preserving the Codex permissions profile after switching from Full access back to Auto. |
| Description check | Passed | The description includes all required sections. It clearly explains the problem, implementation, scope approval through issue #20266, focused verification results, manual testing, and known platform l… |
| Linked Issues check | Passed | Issue #20266 requires the configured .env and .env* read-deny entries to return after Auto → Full access → Auto. The PR remembers non-built-in profiles per Codex thread, preserves the profile acro… |
| Out of Scope Changes check | Passed | The changed adapter logic, replay tests, raw response handling, and turn/start protocol plumbing support issue #20266. The tests validate profile retention and fallback behavior. No unrelated produc… |
Explanation
The description includes all required sections. It clearly explains the problem, implementation, scope approval through issue #20266, focused verification results, manual testing, and known platform limitations.
Explanation
Issue #20266 requires the configured .env and .env* read-deny entries to return after Auto → Full access → Auto. The PR remembers non-built-in profiles per Codex thread, preserves the profile across thread resume, and sends permissions: <id> when the runtime sandbox matches. The stale-profile retry preserves operation when Codex removes or renames the profile. The adapter tests cover the round trip, resume calls, stale-profile fallback, mode mismatch, explicit sandbox overrides, and built-in profiles. The app-server client encodes permissions for turn/start.
Explanation
The changed adapter logic, replay tests, raw response handling, and turn/start protocol plumbing support issue #20266. The tests validate profile retention and fallback behavior. No unrelated product behavior is established by the supplied change summary or the inspected files.
Note
This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.
Comment @coderabbitai help to get the list of available commands.
✅ Thread transfer remains within every enforced ceiling.
| Provider | Metric | Main baseline | This PR | Impact | PR ceiling | |
|---|---|---|---|---|---|---|
| Codex | Total thread wire | 4.9 KiB | 5.0 KiB | +23 B (+0.5%) | 6.8 KiB | ✅ |
| Codex | Thread snapshot wire | 3.8 KiB | 3.8 KiB | 0 B (0.0%) | 4.9 KiB | ✅ |
| Codex | Live turn WebSocket wire | 1.2 KiB | 1.2 KiB | +23 B (+1.9%) | 2.0 KiB | ✅ |
| Codex | Live turn WebSocket decoded | 20.8 KiB | 20.9 KiB | +41 B (+0.2%) | 29.3 KiB | ✅ |
| Codex | Live turn messages | 1 | 2 | +1 (+100.0%) | 8 | ✅ |
| Claude | Total thread wire | 5.0 KiB | 5.0 KiB | −7 B (−0.1%) | 6.8 KiB | ✅ |
| Claude | Thread snapshot wire | 3.8 KiB | 3.8 KiB | 0 B (0.0%) | 4.9 KiB | ✅ |
| Claude | Live turn WebSocket wire | 1.2 KiB | 1.2 KiB | −7 B (−0.6%) | 2.0 KiB | ✅ |
| Claude | Live turn WebSocket decoded | 21.2 KiB | 21.2 KiB | 0 B (0.0%) | 29.3 KiB | ✅ |
| Claude | Live turn messages | 2 | 2 | 0 (0.0%) | 8 | ✅ |
Baseline: f054d1b · PR result: a9ae44f · Source CI: success
10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.
