mirror of https://github.com/openai/codex.git synced 2026-08-23 13:09:46 +00:00

Files

Eric Traut 9ca99b5171 Preserve parent repository discovery through sandbox metadata mounts (#39629 )

## Why

The Linux sandbox represents missing protected metadata paths such as `.git`
with empty read-only directories. Repository and project discovery treated any
`.git` directory as a checkout root, so this synthetic directory could hide a
real parent repository and its trust configuration.

## What changed

- Treat a `.git` directory as repository metadata only when it contains
  `HEAD`, while continuing to recognize file-based `.git` entries.
- Protect missing `.git` paths with the same read-only synthetic mounts as
  other workspace metadata without disrupting parent-repository discovery.
- Canonicalize and read-only bind the synthetic-mount registry into the
  sandbox, and make protected-path cleanup handle read-only directory trees.

## Testing

Added coverage for repository, project-root, trust, synthetic-mount, and
Landlock behavior, including nested incomplete `.git` directories and a
redirected `TMPDIR`.

GitOrigin-RevId: 0724c54d56531143bb28011e4ca414cd3b0212be

2026-08-20 06:57:00 +00:00

src

Preserve parent repository discovery through sandbox metadata mounts (#39629 )

2026-08-20 06:57:00 +00:00

BUILD.bazel

…

Cargo.toml

Terminate timed-out Git process trees (#36793 )

2026-08-03 20:00:49 +00:00

README.md

Remove ghost snapshots (#19481 )

2026-04-27 18:48:57 -07:00

README.md

codex-git-utils

Helpers for interacting with git, including patch application. The crate also exposes a lightweight baseline API for internal directories that use git only as a resettable diff mechanism: ensure_git_baseline_repository preserves a usable root/.git baseline or creates one when it is missing or unusable, reset_git_repository replaces root/.git with a fresh one-commit baseline, and diff_since_latest_init returns structured file changes plus a unified diff from that baseline to the current directory contents.

use std::path::Path;

use codex_git_utils::{apply_git_patch, ApplyGitRequest};

let repo = Path::new("/path/to/repo");

// Apply a patch (omitted here) to the repository.
let request = ApplyGitRequest {
    cwd: repo.to_path_buf(),
    diff: String::from("...diff contents..."),
    revert: false,
    preflight: false,
};
let result = apply_git_patch(&request)?;