codex

mirror of https://github.com/openai/codex.git synced 2026-10-20 17:38:45 +00:00

Files

T

jif 3bae578af3 Protect metadata writes through macOS case aliases (#54273 )

## Why

On case-insensitive macOS filesystems, paths such as `.GIT/config` refer to protected `.git/config` metadata but can pass case-sensitive write permission checks.

## What changed

Check native filesystem case sensitivity when matching protected metadata paths, including case aliases in workspace roots. Recheck both the target and policy entries with normalized aliases so explicit metadata grants and narrower restrictions retain their precedence. Return errors when filesystem case sensitivity cannot be established.

## Testing

Add macOS coverage for metadata and workspace-root case aliases, explicit grants, narrower restrictions, and missing directories. Strengthen the patch regression test to assert the approval rejection message for both direct `apply_patch` calls and shell interception.

GitOrigin-RevId: 8ae2eb97ce6ec71c51bead130515b9ce6c1cdfab

2026-10-15 12:01:04 +00:00

common

Keep discovered Apps tools available during startup recovery (#53672 )

2026-10-13 13:59:41 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493 )

2026-10-06 22:39:32 +00:00

suite

Protect metadata writes through macOS case aliases (#54273 )

2026-10-15 12:01:04 +00:00

all.rs

[codex] Use expect in integration tests (#28441 )