Skip to content

[codex] Default values from requirements if unset#10531

Merged
gt-oai merged 1 commit intomainfrom
gt/defaults
Feb 3, 2026
Merged

[codex] Default values from requirements if unset#10531
gt-oai merged 1 commit intomainfrom
gt/defaults

Conversation

@gt-oai
Copy link
Contributor

@gt-oai gt-oai commented Feb 3, 2026

If we don't set any explicit values for sandbox or approval policy, let's try to use a requirements-satisfying value.

@jif-oai
Copy link
Collaborator

jif-oai commented Feb 3, 2026

@codex review

Copy link
Contributor

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 906a731df6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines 1141 to 1145
forced_auto_mode_downgraded_on_windows = true;
}
if !sandbox_mode_was_explicit
&& let Some(constraint) = sandbox_policy_constraint
&& let Err(err) = constraint.can_set(&sandbox_policy)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve Windows downgrade when applying requirements fallback

On Windows, derive_sandbox_policy forces WorkspaceWrite to ReadOnly when the native sandbox is disabled, but the new requirements fallback runs after this and can overwrite the downgraded policy with the constraint’s required default. If cloud requirements only allow WorkspaceWrite (and no explicit sandbox mode was set), constraint.get() will re‑enable WorkspaceWrite, which is explicitly unsupported in this Windows configuration and leaves forced_auto_mode_downgraded_on_windows inconsistent with the returned policy. Consider re‑checking the Windows downgrade after applying the fallback, or refusing to replace a downgraded policy with an unsupported one.

Useful? React with 👍 / 👎.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will fix

Copy link
Collaborator

@jif-oai jif-oai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex is right, rest looks good

@gt-oai gt-oai merged commit 8406bd7 into main Feb 3, 2026
32 checks passed
@gt-oai gt-oai deleted the gt/defaults branch February 3, 2026 20:47
@github-actions github-actions bot locked and limited conversation to collaborators Feb 3, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants