mirror of
https://github.com/openai/codex.git
synced 2026-10-22 21:40:34 +00:00
Won Park
bf3c1972b7
## What changed - On session startup, remove exact `allow` entries from `rules/default.rules` for command prefixes that Codex no longer suggests as policy amendments. - Record the migration in `.sandbox_migration` so it runs only once, preserving rules created after the migration. - Skip the migration when user and project exec policy rules are ignored. - Expand the protected prefix list across shells, interpreters, package runners, and destructive or privilege-related commands. ## Testing - Cover selective removal, case-insensitive matching, one-time behavior, and the startup path with ignored policy rules. GitOrigin-RevId: a0c60e3f82b9630e621fd034b40462e3ab775102
33 lines
883 B
Rust
33 lines
883 B
Rust
pub(crate) mod amend;
|
|
pub(crate) mod decision;
|
|
pub(crate) mod error;
|
|
pub(crate) mod execpolicycheck;
|
|
mod executable_name;
|
|
pub(crate) mod parser;
|
|
pub(crate) mod policy;
|
|
pub mod rule;
|
|
mod sandbox_migration;
|
|
|
|
pub use amend::AmendError;
|
|
pub use amend::blocking_append_allow_prefix_rule;
|
|
pub use amend::blocking_append_network_rule;
|
|
pub use decision::Decision;
|
|
pub use error::Error;
|
|
pub use error::ErrorLocation;
|
|
pub use error::Result;
|
|
pub use error::TextPosition;
|
|
pub use error::TextRange;
|
|
pub use execpolicycheck::ExecPolicyCheckCommand;
|
|
pub use parser::PolicyParser;
|
|
pub use policy::Evaluation;
|
|
pub use policy::MatchOptions;
|
|
pub use policy::Policy;
|
|
pub use rule::NetworkRuleProtocol;
|
|
pub use rule::PatternToken;
|
|
pub use rule::PrefixPattern;
|
|
pub use rule::PrefixRule;
|
|
pub use rule::Rule;
|
|
pub use rule::RuleMatch;
|
|
pub use rule::RuleRef;
|
|
pub use sandbox_migration::prefix_rule_migration;
|