core: allow restricting subagent environments#31662
Draft
frantic-openai wants to merge 4 commits into
Draft
Conversation
frantic-openai
force-pushed
the
codex/subagent-environment-ids
branch
from
3a39a35 to
3967f0d
Compare
frantic-openai
added a commit
that referenced
this pull request
Jul 9, 2026
frantic-openai
added a commit
that referenced
this pull request
Jul 9, 2026
frantic-openai
force-pushed
the
codex/subagent-environment-ids
branch
from
5bacd5e to
57cdf8b
Compare
jif-oai
reviewed
Jul 9, 2026
| parent_thread_id: Some(session.thread_id), | ||
| environments: Some(turn.environments.to_selections()), | ||
| environments: Some(environments), | ||
| restricted_environment_ids: args.environment_ids.clone(), |
Contributor
There was a problem hiding this comment.
Can we persist this selection before exposing it? V2 normally unloads completed agents, and a later follow-up reloads them from default environment selections. A ["windows"] child for example therefore regains local during ordinary use, which defeats the restriction
| .await?; | ||
| apply_spawn_agent_runtime_overrides(&mut config, turn.as_ref())?; | ||
| let environments = | ||
| spawn_agent_environment_selections(turn.as_ref(), args.environment_ids.as_deref())?; |
Contributor
There was a problem hiding this comment.
Can we validate environment_ids before emitting the v1 InProgress item
| .get_thread(child_thread_id) | ||
| .await | ||
| .expect("child thread should be registered"); | ||
| assert_eq!( |
Contributor
There was a problem hiding this comment.
Can we cover this through an actual child model step? This assertion checks the stored vector, but not that fork-retained skills/MCP context from the omitted environment disappears from the outbound child request
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
environment_idsto v1 and v2spawn_agent.Why
A root thread with both local and remote environments currently passes every selected environment to each child. That means a child intended to work only on Windows can still explicitly target
local.This MVP lets the parent spawn a child with, for example,
environment_ids: ["windows"]. While that child is loaded, tool calls naming an omitted environment are rejected.Known limitation
This is a spawn-time, loaded-session restriction. Environment selections are not yet persisted for cold resume; a V2 residency reload or later cold resume reconstructs the thread from default environment selections, so
include_localmay reattach local. Persisting the subset across resume is a follow-up.Validation
just test -p codex-core spawn_agent_environment_ids(5 passed)just test -p codex-core spawn_agent_tool_v(2 passed)just test -p codex-core --lib spawn_agent_restricted_fork_filters_selected_capability_roots(1 passed)just test -p codex-core --test all spawned_agent_can_restrict_inherited_environments(1 passed locally; body is guarded when no remote fixture is available)just fix -p codex-corejust fmtgit diff --checkI also ran the full
just test -p codex-coresuite earlier: 2813 passed, 137 failed, and 18 skipped. The failures were unrelated local-host fixture failures such as missingcodex-code-mode-host/test_stdio_serverand sandbox/PTY environment failures.