chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

## Why `argument-comment-lint` was green in CI even though the repo still had many uncommented literal arguments. The main gap was target coverage: the repo wrapper did not force Cargo to inspect test-only call sites, so examples like the `latest_session_lookup_params(true, ...)` tests in `codex-rs/tui_app_server/src/lib.rs` never entered the blocking CI path. This change cleans up the existing backlog, makes the default repo lint path cover all Cargo targets, and starts rolling that stricter CI enforcement out on the platform where it is currently validated. ## What changed - mechanically fixed existing `argument-comment-lint` violations across the `codex-rs` workspace, including tests, examples, and benches - updated `tools/argument-comment-lint/run-prebuilt-linter.sh` and `tools/argument-comment-lint/run.sh` so non-`--fix` runs default to `--all-targets` unless the caller explicitly narrows the target set - fixed both wrappers so forwarded cargo arguments after `--` are preserved with a single separator - documented the new default behavior in `tools/argument-comment-lint/README.md` - updated `rust-ci` so the macOS lint lane keeps the plain wrapper invocation and therefore enforces `--all-targets`, while Linux and Windows temporarily pass `-- --lib --bins` That temporary CI split keeps the stricter all-targets check where it is already cleaned up, while leaving room to finish the remaining Linux- and Windows-specific target-gated cleanup before enabling `--all-targets` on those runners. The Linux and Windows failures on the intermediate revision were caused by the wrapper forwarding bug, not by additional lint findings in those lanes. ## Validation - `bash -n tools/argument-comment-lint/run.sh` - `bash -n tools/argument-comment-lint/run-prebuilt-linter.sh` - shell-level wrapper forwarding check for `-- --lib --bins` - shell-level wrapper forwarding check for `-- --tests` - `just argument-comment-lint` - `cargo test` in `tools/argument-comment-lint` - `cargo test -p codex-terminal-detection` ## Follow-up - Clean up remaining Linux-only target-gated callsites, then switch the Linux lint lane back to the plain wrapper invocation. - Clean up remaining Windows-only target-gated callsites, then switch the Windows lint lane back to the plain wrapper invocation.
2026-11-02 08:19:52 +00:00 · 2026-03-27 19:00:44 -07:00
parent ed977b42ac
commit 61dfe0b86c
307 changed files with 7724 additions and 4710 deletions
@@ -6,8 +6,8 @@ use tempfile::tempdir;

 #[test]
 fn system_bwrap_warning_reports_missing_system_bwrap() {
-    let warning =
-        system_bwrap_warning_for_lookup(None).expect("missing system bwrap should emit a warning");
+    let warning = system_bwrap_warning_for_lookup(/*system_bwrap_path*/ None)
+        .expect("missing system bwrap should emit a warning");

    assert!(warning.contains("could not find system bubblewrap"));
 }
@@ -7,14 +7,25 @@ fn legacy_landlock_flag_is_included_when_requested() {
    let command_cwd = Path::new("/tmp/link");
    let cwd = Path::new("/tmp");

-    let default_bwrap =
-        create_linux_sandbox_command_args(command.clone(), command_cwd, cwd, false, false);
+    let default_bwrap = create_linux_sandbox_command_args(
+        command.clone(),
+        command_cwd,
+        cwd,
+        /*use_legacy_landlock*/ false,
+        /*allow_network_for_proxy*/ false,
+    );
    assert_eq!(
        default_bwrap.contains(&"--use-legacy-landlock".to_string()),
        false
    );

-    let legacy_landlock = create_linux_sandbox_command_args(command, command_cwd, cwd, true, false);
+    let legacy_landlock = create_linux_sandbox_command_args(
+        command,
+        command_cwd,
+        cwd,
+        /*use_legacy_landlock*/ true,
+        /*allow_network_for_proxy*/ false,
+    );
    assert_eq!(
        legacy_landlock.contains(&"--use-legacy-landlock".to_string()),
        true
@@ -27,7 +38,13 @@ fn proxy_flag_is_included_when_requested() {
    let command_cwd = Path::new("/tmp/link");
    let cwd = Path::new("/tmp");

-    let args = create_linux_sandbox_command_args(command, command_cwd, cwd, true, true);
+    let args = create_linux_sandbox_command_args(
+        command,
+        command_cwd,
+        cwd,
+        /*use_legacy_landlock*/ true,
+        /*allow_network_for_proxy*/ true,
+    );
    assert_eq!(
        args.contains(&"--allow-network-for-proxy".to_string()),
        true
@@ -50,8 +67,8 @@ fn split_policy_flags_are_included() {
        &file_system_sandbox_policy,
        network_sandbox_policy,
        cwd,
-        true,
-        false,
+        /*use_legacy_landlock*/ true,
+        /*allow_network_for_proxy*/ false,
    );

    assert_eq!(
@@ -73,6 +90,12 @@ fn split_policy_flags_are_included() {

 #[test]
 fn proxy_network_requires_managed_requirements() {
-    assert_eq!(allow_network_for_proxy(false), false);
-    assert_eq!(allow_network_for_proxy(true), true);
+    assert_eq!(
+        allow_network_for_proxy(/*enforce_managed_network*/ false),
+        false
+    );
+    assert_eq!(
+        allow_network_for_proxy(/*enforce_managed_network*/ true),
+        true
+    );
 }
@@ -31,7 +31,7 @@ fn danger_full_access_defaults_to_no_sandbox_without_network_requirements() {
        NetworkSandboxPolicy::Enabled,
        SandboxablePreference::Auto,
        WindowsSandboxLevel::Disabled,
-        false,
+        /*has_managed_network_requirements*/ false,
    );
    assert_eq!(sandbox, SandboxType::None);
 }
@@ -39,13 +39,14 @@ fn danger_full_access_defaults_to_no_sandbox_without_network_requirements() {
 #[test]
 fn danger_full_access_uses_platform_sandbox_with_network_requirements() {
    let manager = SandboxManager::new();
-    let expected = get_platform_sandbox(false).unwrap_or(SandboxType::None);
+    let expected =
+        get_platform_sandbox(/*windows_sandbox_enabled*/ false).unwrap_or(SandboxType::None);
    let sandbox = manager.select_initial(
        &FileSystemSandboxPolicy::unrestricted(),
        NetworkSandboxPolicy::Enabled,
        SandboxablePreference::Auto,
        WindowsSandboxLevel::Disabled,
-        true,
+        /*has_managed_network_requirements*/ true,
    );
    assert_eq!(sandbox, expected);
 }
@@ -53,7 +54,8 @@ fn danger_full_access_uses_platform_sandbox_with_network_requirements() {
 #[test]
 fn restricted_file_system_uses_platform_sandbox_without_managed_network() {
    let manager = SandboxManager::new();
-    let expected = get_platform_sandbox(false).unwrap_or(SandboxType::None);
+    let expected =
+        get_platform_sandbox(/*windows_sandbox_enabled*/ false).unwrap_or(SandboxType::None);
    let sandbox = manager.select_initial(
        &FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
            path: FileSystemPath::Special {
@@ -64,7 +66,7 @@ fn restricted_file_system_uses_platform_sandbox_without_managed_network() {
        NetworkSandboxPolicy::Enabled,
        SandboxablePreference::Auto,
        WindowsSandboxLevel::Disabled,
-        false,
+        /*has_managed_network_requirements*/ false,
    );
    assert_eq!(sandbox, expected);
 }
@@ -38,7 +38,11 @@ fn full_access_restricted_policy_skips_platform_sandbox_when_network_is_enabled(
    }]);

    assert_eq!(
-        should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Enabled, false),
+        should_require_platform_sandbox(
+            &policy,
+            NetworkSandboxPolicy::Enabled,
+            /*has_managed_network_requirements*/ false
+        ),
        false
    );
 }
@@ -64,7 +68,11 @@ fn root_write_policy_with_carveouts_still_uses_platform_sandbox() {
    ]);

    assert_eq!(
-        should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Enabled, false),
+        should_require_platform_sandbox(
+            &policy,
+            NetworkSandboxPolicy::Enabled,
+            /*has_managed_network_requirements*/ false
+        ),
        true
    );
 }
@@ -79,7 +87,11 @@ fn full_access_restricted_policy_still_uses_platform_sandbox_for_restricted_netw
    }]);

    assert_eq!(
-        should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Restricted, false),
+        should_require_platform_sandbox(
+            &policy,
+            NetworkSandboxPolicy::Restricted,
+            /*has_managed_network_requirements*/ false
+        ),
        true
    );
 }
@@ -363,7 +375,8 @@ fn effective_file_system_sandbox_policy_returns_base_policy_without_additional_p
        },
    ]);

-    let effective_policy = effective_file_system_sandbox_policy(&base_policy, None);
+    let effective_policy =
+        effective_file_system_sandbox_policy(&base_policy, /*additional_permissions*/ None);

    assert_eq!(effective_policy, base_policy);
 }
@@ -64,7 +64,7 @@ fn base_policy_allows_node_cpu_sysctls() {
 fn create_seatbelt_args_routes_network_through_proxy_ports() {
    let policy = dynamic_network_policy(
        &SandboxPolicy::new_read_only_policy(),
-        false,
+        /*enforce_managed_network*/ false,
        &ProxyPolicyInputs {
            ports: vec![43128, 48081],
            has_proxy_config: true,
@@ -116,8 +116,8 @@ fn explicit_unreadable_paths_are_excluded_from_full_disk_read_and_write_access()
        &file_system_policy,
        NetworkSandboxPolicy::Restricted,
        Path::new("/"),
-        false,
-        None,
+        /*enforce_managed_network*/ false,
+        /*network*/ None,
    );

    let policy = seatbelt_policy_arg(&args);
@@ -181,8 +181,8 @@ fn explicit_unreadable_paths_are_excluded_from_readable_roots() {
        &file_system_policy,
        NetworkSandboxPolicy::Restricted,
        Path::new("/"),
-        false,
-        None,
+        /*enforce_managed_network*/ false,
+        /*network*/ None,
    );

    let policy = seatbelt_policy_arg(&args);
@@ -219,7 +219,7 @@ fn seatbelt_args_without_extension_profile_keep_legacy_preferences_read_access()
        &SandboxPolicy::new_read_only_policy(),
        cwd.as_path(),
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );
    let policy = &args[1];
    assert!(policy.contains("(allow user-preference-read)"));
@@ -246,7 +246,7 @@ fn seatbelt_legacy_workspace_write_nested_readable_root_stays_writable() {
        },
        cwd.as_path(),
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );

    assert!(
@@ -267,7 +267,7 @@ fn seatbelt_legacy_workspace_write_nested_readable_root_stays_writable() {
 fn create_seatbelt_args_allows_local_binding_when_explicitly_enabled() {
    let policy = dynamic_network_policy(
        &SandboxPolicy::new_read_only_policy(),
-        false,
+        /*enforce_managed_network*/ false,
        &ProxyPolicyInputs {
            ports: vec![43128],
            has_proxy_config: true,
@@ -304,7 +304,7 @@ fn dynamic_network_policy_preserves_restricted_policy_when_proxy_config_without_
            exclude_tmpdir_env_var: false,
            exclude_slash_tmp: false,
        },
-        false,
+        /*enforce_managed_network*/ false,
        &ProxyPolicyInputs {
            ports: vec![],
            has_proxy_config: true,
@@ -337,7 +337,7 @@ fn dynamic_network_policy_preserves_restricted_policy_for_managed_network_withou
            exclude_tmpdir_env_var: false,
            exclude_slash_tmp: false,
        },
-        true,
+        /*enforce_managed_network*/ true,
        &ProxyPolicyInputs {
            ports: vec![],
            has_proxy_config: false,
@@ -360,7 +360,7 @@ fn dynamic_network_policy_preserves_restricted_policy_for_managed_network_withou
 fn create_seatbelt_args_allowlists_unix_socket_paths() {
    let policy = dynamic_network_policy(
        &SandboxPolicy::new_read_only_policy(),
-        false,
+        /*enforce_managed_network*/ false,
        &ProxyPolicyInputs {
            ports: vec![43128],
            has_proxy_config: true,
@@ -453,7 +453,7 @@ fn normalize_path_for_sandbox_rejects_relative_paths() {
 fn create_seatbelt_args_allows_all_unix_sockets_when_enabled() {
    let policy = dynamic_network_policy(
        &SandboxPolicy::new_read_only_policy(),
-        false,
+        /*enforce_managed_network*/ false,
        &ProxyPolicyInputs {
            ports: vec![43128],
            has_proxy_config: true,
@@ -490,7 +490,7 @@ fn create_seatbelt_args_full_network_with_proxy_is_still_proxy_only() {
            exclude_tmpdir_env_var: false,
            exclude_slash_tmp: false,
        },
-        false,
+        /*enforce_managed_network*/ false,
        &ProxyPolicyInputs {
            ports: vec![43128],
            has_proxy_config: true,
@@ -562,7 +562,7 @@ fn create_seatbelt_args_with_read_only_git_and_codex_subpaths() {
        &policy,
        &cwd,
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );

    let policy_text = seatbelt_policy_arg(&args);
@@ -676,7 +676,7 @@ fn create_seatbelt_args_with_read_only_git_and_codex_subpaths() {
        &policy,
        &cwd,
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );
    let output = Command::new(MACOS_PATH_TO_SEATBELT_EXECUTABLE)
        .args(&write_hooks_file_args)
@@ -712,7 +712,7 @@ fn create_seatbelt_args_with_read_only_git_and_codex_subpaths() {
        &policy,
        &cwd,
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );
    let output = Command::new(MACOS_PATH_TO_SEATBELT_EXECUTABLE)
        .args(&write_allowed_file_args)
@@ -832,7 +832,7 @@ fn create_seatbelt_args_with_read_only_git_pointer_file() {
        &policy,
        &cwd,
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );

    let output = Command::new(MACOS_PATH_TO_SEATBELT_EXECUTABLE)
@@ -868,7 +868,7 @@ fn create_seatbelt_args_with_read_only_git_pointer_file() {
        &policy,
        &cwd,
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );
    let output = Command::new(MACOS_PATH_TO_SEATBELT_EXECUTABLE)
        .args(&gitdir_args)
@@ -931,7 +931,7 @@ fn create_seatbelt_args_for_cwd_as_git_repo() {
        &policy,
        vulnerable_root.as_path(),
        /*enforce_managed_network*/ false,
-        None,
+        /*network*/ None,
    );

    let tmpdir_env_var = std::env::var("TMPDIR")