mirror of
https://github.com/openai/codex.git
synced 2026-05-15 16:53:05 +00:00
6862b9c745
## Summary
- adds first-class filesystem policy entries for deny-read glob patterns
- parses config such as :project_roots { "**/*.env" = "none" } into
pattern entries
- enforces deny-read patterns in direct read/list helpers
- fails closed for sandbox execution until platform backends enforce
glob patterns in #18096
- preserves split filesystem policy in turn context only when it cannot
be reconstructed from legacy sandbox policy
## Stack
1. This PR - glob deny-read policy/config/direct-tool support
2. #18096 - macOS and Linux sandbox enforcement
3. #17740 - managed deny-read requirements
## Verification
- just fmt
- cargo check -p codex-core -p codex-sandboxing --tests
---------
Co-authored-by: Codex <noreply@openai.com>
64 lines
1.9 KiB
TOML
64 lines
1.9 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-protocol"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_protocol"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
chardetng = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-async-utils = { workspace = true }
|
|
codex-execpolicy = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-network-proxy = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-image = { workspace = true }
|
|
codex-utils-string = { workspace = true }
|
|
codex-utils-template = { workspace = true }
|
|
encoding_rs = { workspace = true }
|
|
globset = { workspace = true }
|
|
icu_decimal = { workspace = true }
|
|
icu_locale_core = { workspace = true }
|
|
icu_provider = { workspace = true, features = ["sync"] }
|
|
quick-xml = { workspace = true, features = ["serialize"] }
|
|
reqwest = { workspace = true }
|
|
schemars = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
serde_with = { workspace = true, features = ["macros", "base64"] }
|
|
strum = { workspace = true }
|
|
strum_macros = { workspace = true }
|
|
sys-locale = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tracing = { workspace = true }
|
|
ts-rs = { workspace = true, features = [
|
|
"uuid-impl",
|
|
"serde-json-impl",
|
|
"no-serde-warnings",
|
|
] }
|
|
uuid = { workspace = true, features = ["serde", "v7", "v4"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
landlock = { workspace = true }
|
|
seccompiler = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
http = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
|
|
[package.metadata.cargo-shear]
|
|
# Required because:
|
|
# `icu_provider`: contains a required `sync` feature for `icu_decimal`
|
|
# `strum`: as strum_macros in non-nightly builds
|
|
ignored = ["icu_provider", "strum"]
|