agentHost: use workspace-scoped Codex permission profiles

[Giuseppe Cianci (Giuspepe)]

Summary

• define VS Code-owned Codex permission profiles for Default and Auto-Review and apply them across thread starts, turns, forks, resumes, backing chats, multi-root workspaces, additional directories, and Agent Merge
• on macOS and Linux, deny arbitrary filesystem reads outside the active workspace roots while retaining Codex's required :minimal system/runtime reads and isolated temporary-directory access
• preserve Full Access as unrestricted, and keep additional writable directories separate from persisted workspace roots so clearing them revokes access
• describe Default and Auto-Review as platform-sandboxed rather than promising literal workspace-only reads

Related to #334925

Platform behavior

• macOS/Linux: Default and Auto-Review deny an ordinary user file outside the workspace; files included in Codex's :minimal runtime set can remain readable
• Windows: Codex's unelevated sandbox cannot enforce workspace-scoped read restrictions, so this change retains its supported fallback profile; elevated sandbox provisioning should be integrated separately before making the same guarantee there

Validation

• npm run compile
• npm run hygiene
• focused Codex launch/config tests: 14 passing
• git diff --check
• live Code OSS verification of all three picker modes:
  • Default: synthetic user file outside the workspace is denied
  • Auto-Review: the same outside file is denied
  • Full Access: the same outside file is readable
  • /etc/passwd remains readable in sandboxed modes because Codex includes required system/runtime paths in :minimal

[Copilot]

Copilot review overview

🟡 Changes recommended

Workspace-root handling can retain or persist additional-directory access after it should be revoked.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	src/​vs/​platform/​agentHost/​node/​codex/​codexAgent.ts — Mixing additional writable directories into runtimeWorkspaceRoots also makes them…

What changed in this PR

Restricts Codex’s default filesystem permissions to workspace-scoped profiles while preserving existing permission presets.

Changes:

• Defines VS Code-owned Codex permission profiles.
• Applies profiles across starts, turns, forks, and resumes.
• Expands focused permission and workspace-root tests.

File	Description
codexSessionConfigKeys.test.ts	Tests updated preset descriptions.
codexPrewarmEviction.test.ts	Tests profile propagation and workspace roots.
codexLaunchConfig.test.ts	Tests profile definitions and resume overrides.
codexLaunchConfig.ts	Defines and selects permission profiles.
codexAgent.ts	Applies profiles throughout session lifecycles.

Suppressed comments (1)

src/vs/platform/agentHost/node/codex/codexAgent.ts:1764

• runtimeWorkspaceRoots is sticky on turn/start (the protocol says this field replaces the roots only when supplied). For a single-root thread started in workspace-write mode with an additional directory, switching to read-only returns undefined here, so Codex retains the additional directory in :workspace_roots; the read-only profile can then still read outside the workspace. Always send the actual workspace roots when selecting read-only so prior additional roots are removed.

			: workingDirectories.length > 1 ? distinctAbsolutePaths(workingDirectories) : [];

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.