mirror of https://github.com/openai/codex.git synced 2026-09-20 12:47:38 +00:00

Files

jif 02de49f718 Harden Seatbelt writable root path binding (#39706 )

## Why

Resolving attacker-mutable path components while preparing a Seatbelt profile can let a writable root be rebound to a different location before the sandbox is applied. File roots also need to remain confined to the file itself rather than granting access to descendants after replacement.

## What changed

- Preserve mutable components of writable-root paths until Seatbelt binds them, while still normalizing trusted top-level aliases such as `/tmp`.
- Use literal grants for existing file and device roots, and subpath grants for directories and missing roots.
- Exclude both logical and resolved forms of protected subpaths so symlinked metadata directories remain read-only.

## Testing

Add coverage for ancestor rebinding, file-root symlink and directory replacement, missing directory roots, top-level aliases, and symlinked metadata carveouts.

GitOrigin-RevId: 63c00e44dd30766e873b8acdad09d6657657fad9

2026-08-20 12:08:35 +00:00

src

Harden Seatbelt writable root path binding (#39706 )

2026-08-20 12:08:35 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125 )

2026-06-13 21:43:39 -07:00

Cargo.toml

Enforce environment-specific command policies (#38942 )

2026-08-17 04:37:50 +00:00

README.md

fix: separate codex mcp into codex mcp-server and codex app-server (#4471 )

2025-09-30 07:06:18 +00:00

README.md

codex-protocol

This crate defines the "types" for the protocol used by Codex CLI, which includes both "internal types" for communication between codex-core and codex-tui, as well as "external types" used with codex app-server.

This crate should have minimal dependencies.

Ideally, we should avoid "material business logic" in this crate, as we can always introduce Ext-style traits to add functionality to types in other crates.