mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
c53f342fec
## Why Filesystem policies for remote execution need to interpret paths, home directories, and temporary directories using the execution host's context. ## What changed - Add context-based read-denial matching, read-access checks, glob resolution, and `PathUri` workspace-write constructors without consulting local paths or environment variables. - Share managed read-denial validation through `DenyReadValidator` and use it in core configuration, preserving required-entry checks, concrete grant validation, and constraint diagnostics. - Reject invalid or unresolvable denial paths when constructing a context-based matcher, and apply `/tmp` denials according to the execution host's path convention. - Preserve workspace-root symbols and protected metadata entries when materializing URI-based writable roots. ## Testing Add regression tests for POSIX, Windows, and UNC path matching; conflicting read and write grants; malformed or unresolvable denials; `/tmp` handling; and workspace metadata protection. GitOrigin-RevId: aa2b174288d1172ab52ff485f58d306236d27652
codex-protocol
This crate defines the "types" for the protocol used by Codex CLI, which includes both "internal types" for communication between codex-core and codex-tui, as well as "external types" used with codex app-server.
This crate should have minimal dependencies.
Ideally, we should avoid "material business logic" in this crate, as we can always introduce Ext-style traits to add functionality to types in other crates.