mirror of
https://github.com/openai/codex.git
synced 2026-09-04 15:08:45 +00:00
2926014075
## Why Filesystem policies can describe paths using a convention that differs from the host running Codex. Native path comparisons can therefore mis-handle cases such as case-variant Windows paths or ambiguous encoded components. ## What changed - Resolve policy entries and special roots as `PathUri` values using the executor's path convention. - Use validated URI components for containment, overlap, and precedence, and fail closed when component boundaries are ambiguous. - Restrict relative joins to descendants and apply the same matching rules to protected metadata paths and permission-profile intersections. ## Testing Added coverage for Windows case variants, encoded and opaque paths, repeated separators, descendant joins, special roots, metadata protection, and preserved deny entries. GitOrigin-RevId: fb09d44d11df25faaac806fe00457e6f6b0d8596