iceweasel-oai 34e74fda0e Align deny-read matching with executor path semantics (#41209) ...

## Why

Read-deny policies must use the target executor's path convention so URI-based
policy checks and native filesystem enumeration enforce the same rules.

## What changed

- Prepare deny roots and glob matchers from `PathUri` policy context, including
  executor-relative working directories and home-relative patterns.
- Match Windows globs case-insensitively with normalized separators, while
  preserving byte-oriented POSIX matching for non-UTF-8 paths.
- Fail closed for malformed paths, incompatible path conventions, unresolved
  home-relative patterns, and invalid globs.
- Make Windows deny-read discovery use case-insensitive ripgrep glob matching.

## Testing

Added coverage for Windows URI conventions, executor home expansion,
case-insensitive `.env` discovery, malformed paths, non-UTF-8 names, and
canonical directory-link targets.

GitOrigin-RevId: 36001219a2e9b36acfce8972dc1d3bbc304271c5

2026-08-27 21:15:37 +00:00

..

src

Align deny-read matching with executor path semantics (#41209)

2026-08-27 21:15:37 +00:00

BUILD.bazel

Add typed file URIs (#26840)

2026-06-08 16:33:41 -07:00

Cargo.toml

[codex] make PathUri::from_abs_path infallible (#27976)

2026-06-12 16:58:42 -07:00