mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
a482e65b86
## Why Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions. ## What changed Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup. ## Testing Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works. GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d
53 lines
1.9 KiB
Python
53 lines
1.9 KiB
Python
load("//:defs.bzl", "codex_rust_crate")
|
|
|
|
codex_rust_crate(
|
|
name = "core",
|
|
compile_data = glob(["assets/**"]),
|
|
crate_name = "codex_core",
|
|
extra_binaries = [
|
|
"//codex-rs/bwrap:bwrap",
|
|
"//codex-rs/code-mode-host:codex-code-mode-host",
|
|
"//codex-rs/linux-sandbox:codex-linux-sandbox",
|
|
"//codex-rs/rmcp-client:test_stdio_server",
|
|
"//codex-rs/rmcp-client:test_streamable_http_server",
|
|
"//codex-rs/cli:codex",
|
|
"//codex-rs/windows-sandbox-rs:codex-command-runner",
|
|
"//codex-rs/windows-sandbox-rs:codex-windows-managed-deny-probe",
|
|
"//codex-rs/windows-sandbox-rs:codex-windows-sandbox-setup",
|
|
],
|
|
integration_compile_data_extra = glob(["assets/**"]),
|
|
integration_test_timeout = "long",
|
|
run_tests_with_wine_exec = True,
|
|
rustc_env = {
|
|
# Keep manifest-root path lookups inside the Bazel execroot for code
|
|
# that relies on env!("CARGO_MANIFEST_DIR").
|
|
"CARGO_MANIFEST_DIR": "codex-rs/core",
|
|
},
|
|
test_data_extra = [
|
|
"config.schema.json",
|
|
] + glob([
|
|
"src/**/snapshots/**",
|
|
"tests/fixtures/**",
|
|
]) + [
|
|
# This is a bit of a hack, but empirically, some of our integration tests
|
|
# are relying on the presence of this file as a repo root marker. When
|
|
# running tests locally, this "just works," but in remote execution,
|
|
# the working directory is different and so the file is not found unless it
|
|
# is explicitly added as test data.
|
|
#
|
|
# TODO(aibrahim): Update the tests so that `just bazel-remote-test`
|
|
# succeeds without this workaround.
|
|
"//:AGENTS.md",
|
|
],
|
|
test_shard_counts = {
|
|
"core-all-test": 16,
|
|
"core-unit-tests": 8,
|
|
},
|
|
test_tags = ["no-sandbox"],
|
|
test_threads = select({
|
|
"@platforms//os:macos": 1,
|
|
"//conditions:default": 0,
|
|
}),
|
|
unit_test_timeout = "long",
|
|
)
|