mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
bf3c1972b7
## What changed - On session startup, remove exact `allow` entries from `rules/default.rules` for command prefixes that Codex no longer suggests as policy amendments. - Record the migration in `.sandbox_migration` so it runs only once, preserving rules created after the migration. - Skip the migration when user and project exec policy rules are ignored. - Expand the protected prefix list across shells, interpreters, package runners, and destructive or privilege-related commands. ## Testing - Cover selective removal, case-insensitive matching, one-time behavior, and the startup path with ignored policy rules. GitOrigin-RevId: a0c60e3f82b9630e621fd034b40462e3ab775102
35 lines
874 B
TOML
35 lines
874 B
TOML
[package]
|
|
name = "codex-execpolicy"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
description = "Codex exec policy: prefix-based Starlark rules for command decisions."
|
|
|
|
[lib]
|
|
name = "codex_execpolicy"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[[bin]]
|
|
name = "codex-execpolicy"
|
|
path = "src/main.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
multimap = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
shlex = { workspace = true }
|
|
starlark = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "io-util", "macros", "rt"] }
|
|
|
|
[dev-dependencies]
|
|
pretty_assertions = { workspace = true }
|