Validate the Codex permission profile response

Validate the Codex permission profile response

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified lib/openagents/scv/executor/codex_app_server.ex
modified test/support/fake_codex_app_server.sh

Diff

2 files changed, +3 -5

    case Client.request(client, "thread/start", params, 30_000) do
      {:ok,
       %{
         "thread" => %{
           "id" => thread_id,
           "activePermissionProfile" => %{"id" => "scv-read-only"}
         },
         "thread" => %{"id" => thread_id},
         "activePermissionProfile" => %{"id" => "scv-read-only"},
         "model" => @model
       }}
      when is_binary(thread_id) ->

        grep -q '":minimal" = "read"' "${CODEX_HOME}/config.toml"
        if grep -q 'fixture-secret' "${CODEX_HOME}/config.toml"; then exit 43; fi
      fi
      printf '{"id":%s,"result":{"thread":{"id":"thr_fixture","turns":[],"activePermissionProfile":{"id":"scv-read-only","description":"SCV repository-scoped read access.","allowed":true}},"model":"gpt-5.6-luna"}}\n' "${id}"
      printf '{"id":%s,"result":{"thread":{"id":"thr_fixture","turns":[]},"model":"gpt-5.6-luna","activePermissionProfile":{"id":"scv-read-only","extends":null}}}\n' "${id}"
      printf '%s\n' '{"method":"thread/started","params":{"thread":{"id":"thr_fixture","turns":[]}}}'
      ;;
    *'"method":"turn/start"'*)

238	238		`case Client.request(client, "thread/start", params, 30_000) do`
239	239		`{:ok,`
240	240		`%{`
241		-	`"thread" => %{`
242		-	`"id" => thread_id,`
243		-	`"activePermissionProfile" => %{"id" => "scv-read-only"}`
244		-	`},`
	241	+	`"thread" => %{"id" => thread_id},`
	242	+	`"activePermissionProfile" => %{"id" => "scv-read-only"},`
245	243		`"model" => @model`
246	244		`}}`
247	245		`when is_binary(thread_id) ->`

53	53		`grep -q '":minimal" = "read"' "${CODEX_HOME}/config.toml"`
54	54		`if grep -q 'fixture-secret' "${CODEX_HOME}/config.toml"; then exit 43; fi`
55	55		`fi`
56		-	`printf '{"id":%s,"result":{"thread":{"id":"thr_fixture","turns":[],"activePermissionProfile":{"id":"scv-read-only","description":"SCV repository-scoped read access.","allowed":true}},"model":"gpt-5.6-luna"}}\n' "${id}"`
	56	+	`printf '{"id":%s,"result":{"thread":{"id":"thr_fixture","turns":[]},"model":"gpt-5.6-luna","activePermissionProfile":{"id":"scv-read-only","extends":null}}}\n' "${id}"`
57	57		`printf '%s\n' '{"method":"thread/started","params":{"thread":{"id":"thr_fixture","turns":[]}}}'`
58	58		`;;`
59	59		`'"method":"turn/start"')`