mirror of
https://github.com/openai/codex.git
synced 2026-10-20 00:18:49 +00:00
jif
3bae578af3
## Why On case-insensitive macOS filesystems, paths such as `.GIT/config` refer to protected `.git/config` metadata but can pass case-sensitive write permission checks. ## What changed Check native filesystem case sensitivity when matching protected metadata paths, including case aliases in workspace roots. Recheck both the target and policy entries with normalized aliases so explicit metadata grants and narrower restrictions retain their precedence. Return errors when filesystem case sensitivity cannot be established. ## Testing Add macOS coverage for metadata and workspace-root case aliases, explicit grants, narrower restrictions, and missing directories. Strengthen the patch regression test to assert the approval rejection message for both direct `apply_patch` calls and shell interception. GitOrigin-RevId: 8ae2eb97ce6ec71c51bead130515b9ce6c1cdfab
73 lines
2.2 KiB
TOML
73 lines
2.2 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-protocol"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_protocol"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
chardetng = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-async-utils = { workspace = true }
|
|
codex-execpolicy = { workspace = true }
|
|
codex-extension-items = { workspace = true }
|
|
codex-http-client = { workspace = true }
|
|
codex-network-proxy = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-image = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
codex-utils-redacted-string = { workspace = true }
|
|
codex-utils-string = { workspace = true }
|
|
derive_more = { workspace = true, features = ["debug"] }
|
|
encoding_rs = { workspace = true }
|
|
gix-url = { workspace = true }
|
|
globset = { workspace = true }
|
|
http = { workspace = true }
|
|
icu_decimal = { workspace = true }
|
|
icu_locale_core = { workspace = true }
|
|
icu_provider = { workspace = true, features = ["sync"] }
|
|
quick-xml = { workspace = true, features = ["serialize"] }
|
|
schemars = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
serde_with = { workspace = true, features = ["macros", "base64"] }
|
|
strum = { workspace = true }
|
|
strum_macros = { workspace = true }
|
|
sys-locale = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tracing = { workspace = true }
|
|
ts-rs = { workspace = true, features = [
|
|
"uuid-impl",
|
|
"serde-json-impl",
|
|
"no-serde-warnings",
|
|
] }
|
|
uuid = { workspace = true, features = ["serde", "v7", "v4"] }
|
|
wildmatch = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
landlock = { workspace = true }
|
|
seccompiler = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
libc = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["test-util"] }
|
|
|
|
[package.metadata.cargo-shear]
|
|
# Required because:
|
|
# `icu_provider`: contains a required `sync` feature for `icu_decimal`
|
|
# `strum`: is referenced by generated `EnumIter` derive implementations
|
|
ignored = ["icu_provider", "strum"]
|