Merge 193b96932b into sapling-pr-archive-bolinfest

codex-rs/windows-sandbox-rs/src/acl.rs

@@ -275,7 +275,12 @@ unsafe fn ensure_allow_mask_aces_with_inheritance_impl(
     let (p_dacl, p_sd) = fetch_dacl_handle(path)?;
     let mut entries: Vec<EXPLICIT_ACCESS_W> = Vec::new();
     for sid in sids {
-        if dacl_mask_allows(p_dacl, &[*sid], allow_mask, true) {
+        if dacl_mask_allows(
+            p_dacl,
+            &[*sid],
+            allow_mask,
+            /*require_all_bits*/ true,
+        ) {
             continue;
         }
         entries.push(EXPLICIT_ACCESS_W {

codex-rs/windows-sandbox-rs/src/audit.rs

@@ -81,7 +81,7 @@ unsafe fn path_has_world_write_allow(path: &Path) -> Result<bool> {
     let mut world = world_sid()?;
     let psid_world = world.as_mut_ptr() as *mut c_void;
     let write_mask = FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES;
-    path_mask_allows(path, &[psid_world], write_mask, false)
+    path_mask_allows(path, &[psid_world], write_mask, /*require_all_bits*/ false)
 }
 
 pub fn audit_everyone_writable(

codex-rs/windows-sandbox-rs/src/conpty/mod.rs

@@ -76,7 +76,9 @@ pub fn create_conpty(cols: i16, rows: i16) -> Result<ConptyInstance> {
         hpc: hpc as HANDLE,
         input_write: input_write as HANDLE,
         output_read: output_read as HANDLE,
-        _desktop: LaunchDesktop::prepare(false, None)?,
+        _desktop: LaunchDesktop::prepare(
+            /*use_private_desktop*/ false, /*logs_base_dir*/ None,
+        )?,
     })
 }
 
@@ -108,8 +110,8 @@ pub fn spawn_conpty_process_as_user(
     let desktop = LaunchDesktop::prepare(use_private_desktop, logs_base_dir)?;
     si.StartupInfo.lpDesktop = desktop.startup_info_desktop();
 
-    let conpty = create_conpty(80, 24)?;
-    let mut attrs = ProcThreadAttributeList::new(1)?;
+    let conpty = create_conpty(/*cols*/ 80, /*rows*/ 24)?;
+    let mut attrs = ProcThreadAttributeList::new(/*attr_count*/ 1)?;
     attrs.set_pseudoconsole(conpty.hpc)?;
     si.lpAttributeList = attrs.as_mut_ptr();
 

codex-rs/windows-sandbox-rs/src/env.rs

@@ -159,7 +159,7 @@ pub fn apply_no_network_to_env(env_map: &mut HashMap<String, String>) -> Result<
         .entry("GIT_ALLOW_PROTOCOLS".into())
         .or_insert_with(|| "".into());
 
-    let base = ensure_denybin(&["ssh", "scp"], None)?;
+    let base = ensure_denybin(&["ssh", "scp"], /*denybin_dir*/ None)?;
     for tool in ["curl", "wget"] {
         for ext in [".bat", ".cmd"] {
             let p = base.join(format!("{}{}", tool, ext));

codex-rs/windows-sandbox-rs/src/process.rs

@@ -229,7 +229,7 @@ pub fn spawn_process_with_pipes(
             argv,
             cwd,
             env_map,
-            None,
+            /*logs_base_dir*/ None,
             stdio,
             use_private_desktop,
         )

codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs

@@ -91,8 +91,8 @@ pub fn run_setup_refresh(
         command_cwd,
         env_map,
         codex_home,
-        None,
-        None,
+        /*read_roots_override*/ None,
+        /*write_roots_override*/ None,
     )
 }