viyatb-oai 0edcc4b94e fix(config): resolve cloud requirements deny-read globs (#23729) ...

## Why

Cloud-managed `requirements.toml` contents were deserialized without an
`AbsolutePathBuf` base directory. Relative managed
`permissions.filesystem.deny_read` glob entries therefore failed while
the equivalent local system requirements path succeeded under its
`AbsolutePathBufGuard`. This follows the `codex_home` base path
convention clarified in https://github.com/openai/codex/pull/15707.

## What changed

- Resolve cloud requirements TOML under an `AbsolutePathBufGuard` rooted
at `codex_home`.
- Reuse the same base for cloud requirements loaded from the signed
cache.
- Add a regression test for a relative cloud-managed `deny_read` glob.

## Validation

- `just fmt`
- `cargo test -p codex-cloud-requirements`
- `cargo clippy -p codex-cloud-requirements --all-targets --no-deps`
- `just bazel-lock-update`
- `just bazel-lock-check`
- `git diff --check`

2026-05-20 12:15:44 -07:00

..

src

fix(config): resolve cloud requirements deny-read globs (#23729)

2026-05-20 12:15:44 -07:00

BUILD.bazel

Fetch Requirements from cloud (#10167)

2026-01-30 12:03:29 +00:00

Cargo.toml

fix(config): resolve cloud requirements deny-read globs (#23729)

2026-05-20 12:15:44 -07:00