Dylan Hurd de6e72addd Add opt-in Unicode canonical matching to exec policy rules (#59535) ...

## What changed

- Support `canonical_matching=True` in `prefix_rule` and `canonical_matching = true` in managed TOML prefix rules. Apply Unicode canonical caseless matching to every prefix token, including alternatives, while keeping exact matching as the default.
- Match case and canonically equivalent Unicode spellings, such as `bash` and `bAſh`, without resolving executables on the filesystem.
- Preserve managed restrictions when checking absolute-path rule amendments, and enforce applicable `host_executable` path allowlists during basename fallback.

## Testing

Add coverage for case folding, Unicode normalization, token alternatives, exact-match defaults, and host executable allowlists. Extend managed-policy and shell-execution tests to cover canonical matching.

GitOrigin-RevId: c2f79069dc38d55c77028c457b22beb468d5c571

2026-11-05 00:55:46 +00:00

..

loader

Deprecate the multi_agent feature flag (#59479)

2026-11-04 19:57:59 +00:00

requirements_layers

Support managed network requirements under permissions.network (#58182)

2026-10-29 22:36:06 +00:00

thread_config

Allow providers to opt into Cyber access programs (#58190)

2026-10-29 23:24:52 +00:00

application_requirements_tests.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

application_requirements.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

application_storage_requirements_tests.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

application_storage_requirements.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

auth_policy.rs

Enforce managed authentication requirements locally (#37132)

2026-08-05 18:09:26 +00:00

bedrock_runtime_tests.rs

Add AWS credential export commands for Amazon Bedrock (#44028)

2026-09-09 03:17:48 +00:00

browser_computer_use_requirements_tests.rs

Add browser extension request headers to config requirements (#51194)

2026-10-05 22:52:14 +00:00

browser_computer_use_requirements.rs

Add browser extension request headers to config requirements (#51194)

2026-10-05 22:52:14 +00:00

browser_use_tests.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

browser_use.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

cloud_config_bundle_tests.rs

Enforce Fast and Ultra Fast policies independently (#51253)

2026-10-06 03:35:55 +00:00

cloud_config_bundle.rs

Require managed configuration from the configured server (#56055)

2026-10-22 02:15:00 +00:00

cloud_config_layers_tests.rs

Clarify config layer iteration APIs (#36774)

2026-08-03 17:29:42 +00:00

cloud_config_layers.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

codex_home_symlink.rs

Allow trusted symlinks beneath CODEX_HOME on macOS (#42716)

2026-09-04 10:12:03 +00:00

computer_use_tests.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

computer_use.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

config_layer_source.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

config_requirements.rs

Support managed network requirements under permissions.network (#58182)

2026-10-29 22:36:06 +00:00

config_server.rs

Add managed configuration loaders for custom config servers (#56314)

2026-10-23 00:54:06 +00:00

config_toml.rs

Add opt-in reconsideration of Guardian denials (#59107)

2026-11-03 09:51:25 +00:00

constraint.rs

Enforce automatic review for managed models (#37511)

2026-08-07 23:43:14 +00:00

diagnostics.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

filesystem_constraints.rs

Resolve filesystem denials with explicit path context (#44669)

2026-09-10 23:08:23 +00:00

fingerprint_tests.rs

Simplify configuration fingerprint canonicalization (#49295)

2026-09-29 16:10:27 +00:00

fingerprint.rs

Simplify configuration fingerprint canonicalization (#49295)

2026-09-29 16:10:27 +00:00

guardian_tests.rs

Centralize Guardian policy resolution in config and protocol (#45957)

2026-09-16 14:56:47 +00:00

guardian.rs

Centralize Guardian policy resolution in config and protocol (#45957)

2026-09-16 14:56:47 +00:00

hook_config.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

hooks_tests.rs

Add observation-only model request lifecycle hooks (#55144)

2026-10-18 22:43:56 +00:00

host_name.rs

Add hostname to the configurable TUI status line (#39795)

2026-08-20 20:08:11 +00:00

in_app_browser_requirements_tests.rs

Expose managed policy for browser settings imports (#39720)

2026-08-20 14:13:56 +00:00

in_app_browser_requirements.rs

Expose managed policy for browser settings imports (#39720)

2026-08-20 14:13:56 +00:00

key_aliases.rs

Skip unrelated subtrees during config alias normalization (#50354)

2026-10-02 16:37:30 +00:00

lib.rs

Support managed OpenTelemetry configuration requirements (#57649)

2026-10-28 05:11:45 +00:00

marketplace_edit.rs

Keep marketplace upgrade state out of config (#39595)

2026-08-20 05:24:56 +00:00

mcp_edit.rs

Consolidate MCP config editing in codex-core (#36359)

2026-07-31 16:28:22 +00:00

mcp_ema_cancellation.rs

Preserve enterprise MCP authorization across runtime refreshes (#55696)

2026-10-20 23:03:56 +00:00

mcp_ema_tests.rs

Support confidential OAuth clients for enterprise-managed MCP auth (#56001)

2026-10-21 22:30:35 +00:00

mcp_ema.rs

Support confidential OAuth clients for enterprise-managed MCP auth (#56001)

2026-10-21 22:30:35 +00:00

mcp_requirements_tests.rs

Make MCP and Code Mode input schema budgets configurable (#47936)

2026-09-24 20:39:37 +00:00

mcp_requirements.rs

Move MCP policy types into codex-protocol (#39017)

2026-08-17 16:20:52 +00:00

mcp_types_tests.rs

Make MCP and Code Mode input schema budgets configurable (#47936)

2026-09-24 20:39:37 +00:00

mcp_types.rs

Preserve MCP disable reasons across runtime overlays (#56266)

2026-10-22 21:11:21 +00:00

merge_tests.rs

Add runtime assertion authentication modes and an auth provider (#55636)

2026-10-20 17:29:40 +00:00

merge.rs

Add runtime assertion authentication modes and an auth provider (#55636)

2026-10-20 17:29:40 +00:00

model_provider_defaults.rs

Allow configuring GCP project and location in provider settings (#56560)

2026-10-23 18:50:54 +00:00

model_provider_requirements_tests.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

model_provider_requirements.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

overrides.rs

Add credential brokering to network proxy feature config (#40466)

2026-08-24 19:52:27 +00:00

path_context_tests.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

path_context.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

permissions_toml_tests.rs

Add scoped request-body secret substitution to MITM hooks (#57174)

2026-10-26 18:14:26 +00:00

permissions_toml.rs

Add scoped request-body secret substitution to MITM hooks (#57174)

2026-10-26 18:14:26 +00:00

plugin_edit.rs

Move plugin out of core. (#20348)

2026-04-30 14:26:14 -07:00

profile_toml.rs

Defer unknown TUI config fields to the shared strict-config policy (#54766)

2026-10-17 02:27:35 +00:00

project_root_markers.rs

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

project_trust_tests.rs

Make project trust lookup paths explicit and defer root resolution (#47924)

2026-09-24 19:44:50 +00:00

project_trust.rs

Make project trust lookup paths explicit and defer root resolution (#47924)

2026-09-24 19:44:50 +00:00

requirements_exec_policy.rs

Add opt-in Unicode canonical matching to exec policy rules (#59535)

2026-11-05 00:55:46 +00:00

schema.rs

Add Guardian V3 feature configuration (#56459)

2026-10-23 12:16:36 +00:00

shell_environment_policy_tests.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

shell_environment_policy.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

skills_config_tests.rs

Use PathUri for skill identity and path matching (#51482)

2026-10-06 21:29:35 +00:00

skills_config.rs

Use PathUri for skill identity and path matching (#51482)

2026-10-06 21:29:35 +00:00

state_tests.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

state.rs

Support managed network requirements under permissions.network (#58182)

2026-10-29 22:36:06 +00:00

strict_config_tests.rs

Support managed network requirements under permissions.network (#58182)

2026-10-29 22:36:06 +00:00

strict_config.rs

Centralize TOML config deserialization (#58198)

2026-10-30 00:36:00 +00:00

test_support_tests.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

test_support.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

thread_config.rs

Add a credential file override for GCP provider authentication (#57188)

2026-10-26 18:33:05 +00:00

tui_effects.rs

Add independent controls for TUI visual effects (#46832)

2026-09-20 16:16:46 +00:00

tui_keymap_chord_tests.rs

Preserve validation errors for invalid TUI keybindings (#49910)

2026-10-01 06:59:13 +00:00

tui_keymap.rs

Add directional conversation focus shortcuts in workspace mode (#59287)

2026-11-04 01:40:12 +00:00

tui_mouse_scroll.rs

Make transcript mouse scroll speed configurable (#50209)

2026-10-02 06:50:10 +00:00

tui_rendering.rs

Render TUI Markdown lists with Unicode bullets and checkboxes (#47322)

2026-09-22 16:34:07 +00:00

types_tests.rs

Add remote plugin metadata to plugin configuration (#54424)

2026-10-15 21:44:12 +00:00

types.rs

Make side conversation panes resizable and interactive (#59527)

2026-11-05 00:19:26 +00:00