mirror of https://github.com/openai/codex.git synced 2026-10-20 17:38:45 +00:00

Files

T

jif 3bae578af3 Protect metadata writes through macOS case aliases (#54273 )

## Why

On case-insensitive macOS filesystems, paths such as `.GIT/config` refer to protected `.git/config` metadata but can pass case-sensitive write permission checks.

## What changed

Check native filesystem case sensitivity when matching protected metadata paths, including case aliases in workspace roots. Recheck both the target and policy entries with normalized aliases so explicit metadata grants and narrower restrictions retain their precedence. Return errors when filesystem case sensitivity cannot be established.

## Testing

Add macOS coverage for metadata and workspace-root case aliases, explicit grants, narrower restrictions, and missing directories. Strengthen the patch regression test to assert the approval rejection message for both direct `apply_patch` calls and shell interception.

GitOrigin-RevId: 8ae2eb97ce6ec71c51bead130515b9ce6c1cdfab

2026-10-15 12:01:04 +00:00

src

Protect metadata writes through macOS case aliases (#54273 )

2026-10-15 12:01:04 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125 )

2026-06-13 21:43:39 -07:00

Cargo.toml

Protect metadata writes through macOS case aliases (#54273 )

2026-10-15 12:01:04 +00:00

README.md

fix: separate codex mcp into codex mcp-server and codex app-server (#4471 )

2025-09-30 07:06:18 +00:00

README.md

codex-protocol

This crate defines the "types" for the protocol used by Codex CLI, which includes both "internal types" for communication between codex-core and codex-tui, as well as "external types" used with codex app-server.

This crate should have minimal dependencies.

Ideally, we should avoid "material business logic" in this crate, as we can always introduce Ext-style traits to add functionality to types in other crates.