openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-28 18:58:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

codex: preserve relative cwd sandbox projection

Browse Source
This commit is contained in:
pakrym-oai
2026-04-07 12:14:28 -07:00
parent c8b38bde0f
commit 3dd4d75624
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/protocol/src/permissions.rs
+5 -5
View File
@@ -279,7 +279,7 @@ impl FileSystemSandboxPolicy {
}
});
if let Ok(cwd_root) = AbsolutePathBuf::from_absolute_path(cwd) {
if let Ok(cwd_root) = AbsolutePathBuf::relative_to_current_dir(cwd) {
for protected_path in default_read_only_subpaths_for_writable_root(
&cwd_root, /*protect_missing_dot_codex*/ true,
) {
@@ -476,7 +476,7 @@ impl FileSystemSandboxPolicy {
.iter()
.filter(|path| normalize_effective_absolute_path((*path).clone()) == root)
.collect();
let protect_missing_dot_codex = AbsolutePathBuf::from_absolute_path(cwd)
let protect_missing_dot_codex = AbsolutePathBuf::relative_to_current_dir(cwd)
.ok()
.is_some_and(|cwd| normalize_effective_absolute_path(cwd) == root);
let mut read_only_subpaths: Vec<AbsolutePathBuf> =
@@ -562,7 +562,7 @@ impl FileSystemSandboxPolicy {
return Vec::new();
}
let root = AbsolutePathBuf::from_absolute_path(cwd)
let root = AbsolutePathBuf::relative_to_current_dir(cwd)
.ok()
.map(|cwd| absolute_root_path_for_cwd(&cwd));
@@ -604,7 +604,7 @@ impl FileSystemSandboxPolicy {
}
}
FileSystemSandboxKind::Restricted => {
let cwd_absolute = AbsolutePathBuf::from_absolute_path(cwd).ok();
let cwd_absolute = AbsolutePathBuf::relative_to_current_dir(cwd).ok();
let mut include_platform_defaults = false;
let mut has_full_disk_read_access = false;
let mut has_full_disk_write_access = false;
@@ -744,7 +744,7 @@ impl FileSystemSandboxPolicy {
}
fn resolved_entries_with_cwd(&self, cwd: &Path) -> Vec<ResolvedFileSystemEntry> {
let cwd_absolute = AbsolutePathBuf::from_absolute_path(cwd).ok();
let cwd_absolute = AbsolutePathBuf::relative_to_current_dir(cwd).ok();
self.entries
.iter()
.filter_map(|entry| {
codex-rs/protocol/src/protocol.rs
+3 -3
View File
@@ -772,7 +772,7 @@ impl ReadOnlyAccess {
ReadOnlyAccess::FullAccess => return Vec::new(),
ReadOnlyAccess::Restricted { readable_roots, .. } => {
let mut roots = readable_roots.clone();
match AbsolutePathBuf::from_absolute_path(cwd) {
match AbsolutePathBuf::relative_to_current_dir(cwd) {
Ok(cwd_root) => roots.push(cwd_root),
Err(err) => {
error!("Ignoring invalid cwd {cwd:?} for sandbox readable root: {err}");
@@ -1023,7 +1023,7 @@ impl SandboxPolicy {
// Always include defaults: cwd, /tmp (if present on Unix), and
// on macOS, the per-user TMPDIR unless explicitly excluded.
// TODO(mbolin): cwd param should be AbsolutePathBuf.
let cwd_absolute = AbsolutePathBuf::from_absolute_path(cwd);
let cwd_absolute = AbsolutePathBuf::relative_to_current_dir(cwd);
match cwd_absolute {
Ok(cwd) => {
roots.push(cwd);
@@ -1071,7 +1071,7 @@ impl SandboxPolicy {
}
// For each root, compute subpaths that should remain read-only.
let cwd_root = AbsolutePathBuf::from_absolute_path(cwd).ok();
let cwd_root = AbsolutePathBuf::relative_to_current_dir(cwd).ok();
roots
.into_iter()
.map(|writable_root| {