core: allow restricting subagent environments#31662
Conversation
3a39a35 to
3967f0d
Compare
5bacd5e to
57cdf8b
Compare
| parent_thread_id: Some(session.thread_id), | ||
| environments: Some(turn.environments.to_selections()), | ||
| environments: Some(environments), | ||
| restricted_environment_ids: args.environment_ids.clone(), |
There was a problem hiding this comment.
Can we persist this selection before exposing it? V2 normally unloads completed agents, and a later follow-up reloads them from default environment selections. A ["windows"] child for example therefore regains local during ordinary use, which defeats the restriction
There was a problem hiding this comment.
Done — child environment selections are now persisted in SessionMeta and restored by the internal V2 reload path. Legacy rollouts without the field still fall back to defaults. Added coverage that unloads/reloads a restricted child and verifies it stays restricted.
| .await?; | ||
| apply_spawn_agent_runtime_overrides(&mut config, turn.as_ref())?; | ||
| let environments = | ||
| spawn_agent_environment_selections(turn.as_ref(), args.environment_ids.as_deref())?; |
There was a problem hiding this comment.
Can we validate environment_ids before emitting the v1 InProgress item
There was a problem hiding this comment.
Done — environment selection validation now happens before emitting the v1 InProgress item. Added a test asserting an unknown environment returns an error without emitting a started event.
| .get_thread(child_thread_id) | ||
| .await | ||
| .expect("child thread should be registered"); | ||
| assert_eq!( |
There was a problem hiding this comment.
Can we cover this through an actual child model step? This assertion checks the stored vector, but not that fork-retained skills/MCP context from the omitted environment disappears from the outbound child request
There was a problem hiding this comment.
Done — added an app-server integration test that actually spawns a restricted child with fork_turns: "all" and captures its outbound model request. It asserts omitted selected skill catalog/body content and MCP tools are absent. I also filter stale fork-retained <skills_instructions> and <skill> fragments for omitted roots.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e708ed6c92
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| turn: &TurnContext, | ||
| environment_ids: Option<&[String]>, | ||
| ) -> Result<Vec<TurnEnvironmentSelection>, FunctionCallError> { | ||
| let parent_selections = turn.environments.to_selections(); |
There was a problem hiding this comment.
When deferred_executor is enabled, a turn can gain a ready environment after the turn starts; capture_step_context already refreshes step_context.environments for later model requests, but this new filtering snapshots turn.environments from the original turn. In that same-turn attach flow, the model can see and use the newly available environment/tooling, but spawn_agent({"environment_ids":[...]}) rejects it as “not a ready parent-turn environment” or omits it from the child. Pass the current step environment snapshot into this helper instead of reading the stale turn snapshot.
Useful? React with 👍 / 👎.
| && !matches!( | ||
| item, | ||
| RolloutItem::ResponseItem(response_item) | ||
| if is_omitted_selected_skill_message(response_item) |
There was a problem hiding this comment.
When a parent turn injected selected skills from both an allowed and an omitted environment, those user skill fragments are batched into a single ResponseItem with multiple content entries. This predicate removes the entire message as soon as any content item matches an omitted root, so a restricted full-history fork loses the allowed skill body as well and the child cannot recover that prior selected-skill context unless it explicitly re-mentions the skill. Filter the message content items instead of dropping the whole response item.
Useful? React with 👍 / 👎.
| }, | ||
| dynamic_tools: Vec::new(), | ||
| selected_capability_roots: Vec::new(), | ||
| environment_selections: Vec::new(), |
There was a problem hiding this comment.
For external-agent session imports, this now writes environmentSelections: [] into the imported rollout's session metadata; resume treats Some(empty) as an explicit environment set, so these imported threads reopen with no local/default environment and lose shell/filesystem tools even though they still have a cwd. This path should seed the same default environment selections used for normal thread creation (or avoid persisting an explicit empty list) so imported sessions continue to resume with an executable environment.
AGENTS.md reference: AGENTS.md:L102-L110
Useful? React with 👍 / 👎.
2 participants
Summary
environment_idsto v1 and v2spawn_agent.Why
A root thread with both local and remote environments currently passes every selected environment to each child. That means a child intended to work only on Windows can still explicitly target
local.This MVP lets the parent spawn a child with, for example,
environment_ids: ["windows"]. While that child is loaded, tool calls naming an omitted environment are rejected.Known limitation
This is a spawn-time, loaded-session restriction. Environment selections are not yet persisted for cold resume; a V2 residency reload or later cold resume reconstructs the thread from default environment selections, so
include_localmay reattach local. Persisting the subset across resume is a follow-up.Validation
just test -p codex-core spawn_agent_environment_ids(5 passed)just test -p codex-core spawn_agent_tool_v(2 passed)just test -p codex-core --lib spawn_agent_restricted_fork_filters_selected_capability_roots(1 passed)just test -p codex-core --test all spawned_agent_can_restrict_inherited_environments(1 passed locally; body is guarded when no remote fixture is available)just fix -p codex-corejust fmtgit diff --checkI also ran the full
just test -p codex-coresuite earlier: 2813 passed, 137 failed, and 18 skipped. The failures were unrelated local-host fixture failures such as missingcodex-code-mode-host/test_stdio_serverand sandbox/PTY environment failures.