mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
jif
61e23bc6a1
## Why Asynchronous Guardian scoring omitted the target environment's denied-read restrictions, and cached score authorization did not include that permission context. A score from one environment could therefore be reused for an action in another environment with different restrictions. ## What changed - Share permission resolution between synchronous review and asynchronous scoring, including resolving `write_stdin` targets from the owning terminal session. - Include environment identity and denied-read paths/globs in async scoring context and cached score authorization. - Fall back to synchronous review when permission evidence cannot be resolved or exceeds the async limit of 3,000 bytes, rather than omitting restrictions. ## Testing Add regression coverage for rejecting cached scores with different environments or denied paths, passing the target environment's restrictions to the classifier, and rejecting oversized async permission evidence. GitOrigin-RevId: 14b6f3454bbea458be037560eb1da47d22874df1
35 lines
927 B
TOML
35 lines
927 B
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-extension-api"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_extension_api"
|
|
path = "src/lib.rs"
|
|
test = false
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
codex-api = { workspace = true }
|
|
futures = { workspace = true }
|
|
codex-guardian-context = { workspace = true }
|
|
codex-history = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-context-fragments = { workspace = true }
|
|
codex-exec-server-protocol = { workspace = true }
|
|
codex-file-system = { workspace = true }
|
|
codex-mcp = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-tools = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
pretty_assertions = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
|