mirror of
https://github.com/openai/codex.git
synced 2026-09-20 12:47:38 +00:00
841b5490b2
## Why Removing the selected working directory can prevent filesystem sandbox helpers from launching, even when the requested absolute paths remain accessible. Permission rules must stay anchored to the selected directory while those operations continue. ## What changed - Require a policy `cwd` in `FileSystemSandboxContext` and launch filesystem helpers from the filesystem root while preserving the policy directory and workspace roots. - Carry explicit `policyContext` in filesystem RPCs, preserving legacy wire fields and resolving omitted directories from older clients at executor ingress. - Keep permission paths as executor file URIs and validate host compatibility where they are enforced. - Bind Windows relative denial globs to the policy directory before changing the helper's launch directory, preserving home-relative patterns. ## Testing Add regression coverage for `apply_patch` after working-directory removal, legacy RPC directory fallbacks, cross-platform permission URI transport, and Windows relative read denials. The patch regression verifies that an allowed file is updated while an explicitly denied file remains unreadable and unchanged. GitOrigin-RevId: b0f4db722b27cb72ec129fc297c85732afac11f7
52 lines
1.6 KiB
Python
52 lines
1.6 KiB
Python
load("//:defs.bzl", "codex_rust_crate")
|
|
load("//bazel/rules/testing/compat:exec_server_compat_test.bzl", "exec_server_compat_test")
|
|
|
|
exports_files(
|
|
["src/proto/codex.exec_server.relay.v1.rs"],
|
|
visibility = ["//codex-rs/exec-server/tests/support:__pkg__"],
|
|
)
|
|
|
|
codex_rust_crate(
|
|
name = "exec-server",
|
|
crate_name = "codex_exec_server",
|
|
crate_srcs = glob([
|
|
"src/**/*.rs",
|
|
"tests/unit/**/*.rs",
|
|
]),
|
|
deps_extra = [
|
|
"@crates//:opentelemetry",
|
|
"@crates//:opentelemetry_sdk",
|
|
"@crates//:toml",
|
|
],
|
|
extra_binaries = [
|
|
"//codex-rs/bwrap:bwrap",
|
|
"//codex-rs/windows-sandbox-rs:codex-command-runner",
|
|
"//codex-rs/windows-sandbox-rs:codex-windows-sandbox-setup",
|
|
],
|
|
integration_compile_data_extra = [
|
|
"src/proto/codex.exec_server.relay.v1.rs",
|
|
],
|
|
# Keep the crate's tests single-threaded under Bazel because they install
|
|
# process-global test-binary dispatch state, and the remote exec-server
|
|
# cases already rely on serialization around the full CLI path.
|
|
integration_test_args = ["--test-threads=1"],
|
|
test_tags = ["no-sandbox"],
|
|
unit_test_args = ["--test-threads=1"],
|
|
)
|
|
|
|
exec_server_compat_test(
|
|
name = "exec-server-current-version-test",
|
|
comparison_binary = "//codex-rs/cli:codex",
|
|
current_binary = "//codex-rs/cli:codex",
|
|
)
|
|
|
|
exec_server_compat_test(
|
|
name = "exec-server-stable-release-test",
|
|
release = "@codex_release_0.153.1_linux_x86_64",
|
|
)
|
|
|
|
exec_server_compat_test(
|
|
name = "exec-server-minimum-release-test",
|
|
release = "@codex_release_0.145.0_linux_x86_64",
|
|
)
|