mirror of
https://github.com/openai/codex.git
synced 2026-10-19 08:16:48 +00:00
## What changed - Verify that freeform `apply_patch` calls and shell-intercepted patches cannot modify `.git/config` through `.GIT/config` when approvals are disabled, while an ordinary workspace file remains writable. - Add macOS Seatbelt coverage for uppercase protected metadata paths, including absent directories, existing directories with either casing, and case variants of the workspace root. Assert that metadata creation and modification are denied while sibling workspace writes succeed. The tests skip filesystems that do not support the case-insensitive aliases they exercise. GitOrigin-RevId: 5cf6b0c36eee348e1ba0db0bc2d3bff072458364