2025-04-24 17:14:47 -07:00
|
|
|
[package]
|
|
|
|
|
name = "codex-execpolicy"
|
2025-11-24 12:22:18 -08:00
|
|
|
version.workspace = true
|
|
|
|
|
edition.workspace = true
|
|
|
|
|
license.workspace = true
|
2025-11-19 19:14:10 -08:00
|
|
|
description = "Codex exec policy: prefix-based Starlark rules for command decisions."
|
2025-04-24 17:14:47 -07:00
|
|
|
|
|
|
|
|
[lib]
|
|
|
|
|
name = "codex_execpolicy"
|
|
|
|
|
path = "src/lib.rs"
|
|
|
|
|
|
2025-11-19 19:14:10 -08:00
|
|
|
[[bin]]
|
|
|
|
|
name = "codex-execpolicy"
|
|
|
|
|
path = "src/main.rs"
|
|
|
|
|
|
2025-05-08 09:46:18 -07:00
|
|
|
[lints]
|
|
|
|
|
workspace = true
|
|
|
|
|
|
2025-04-24 17:14:47 -07:00
|
|
|
[dependencies]
|
2025-09-22 18:47:01 +02:00
|
|
|
anyhow = { workspace = true }
|
|
|
|
|
clap = { workspace = true, features = ["derive"] }
|
execpolicy: add host_executable() path mappings (#12964)
## Why
`execpolicy` currently keys `prefix_rule()` matching off the literal
first token. That works for rules like `["/usr/bin/git"]`, but it means
shared basename rules such as `["git"]` do not help when a caller passes
an absolute executable path like `/usr/bin/git`.
This PR lays the groundwork for basename-aware matching without changing
existing callers yet. It adds typed host-executable metadata and an
opt-in resolution path in `codex-execpolicy`, so a follow-up PR can
adopt the new behavior in `unix_escalation.rs` and other call sites
without having to redesign the policy layer first.
## What Changed
- added `host_executable(name = ..., paths = [...])` to the execpolicy
parser and validated it with `AbsolutePathBuf`
- stored host executable mappings separately from prefix rules inside
`Policy`
- added `MatchOptions` and opt-in `*_with_options()` APIs that preserve
existing behavior by default
- implemented exact-first matching with optional basename fallback,
gated by `host_executable()` allowlists when present
- normalized executable names for cross-platform matching so Windows
paths like `git.exe` can satisfy `host_executable(name = "git", ...)`
- updated `match` / `not_match` example validation to exercise the
host-executable resolution path instead of only raw prefix-rule matching
- preserved source locations for deferred example-validation errors so
policy load failures still point at the right file and line
- surfaced `resolvedProgram` on `RuleMatch` so callers can tell when a
basename rule matched an absolute executable path
- preserved host executable metadata when requirements policies overlay
file-based policies in `core/src/exec_policy.rs`
- documented the new rule shape and CLI behavior in
`execpolicy/README.md`
## Verification
- `cargo test -p codex-execpolicy`
- added coverage in `execpolicy/tests/basic.rs` for parsing, precedence,
empty allowlists, basename fallback, exact-match precedence, and
host-executable-backed `match` / `not_match` examples
- added a regression test in `core/src/exec_policy.rs` to verify
requirements overlays preserve `host_executable()` metadata
- verified `cargo test -p codex-core --lib`, including source-rendering
coverage for deferred validation errors
2026-02-27 12:59:24 -08:00
|
|
|
codex-utils-absolute-path = { workspace = true }
|
2025-09-22 18:47:01 +02:00
|
|
|
multimap = { workspace = true }
|
|
|
|
|
serde = { workspace = true, features = ["derive"] }
|
|
|
|
|
serde_json = { workspace = true }
|
2025-11-19 19:14:10 -08:00
|
|
|
shlex = { workspace = true }
|
2025-09-22 18:47:01 +02:00
|
|
|
starlark = { workspace = true }
|
2025-11-19 19:14:10 -08:00
|
|
|
thiserror = { workspace = true }
|
2025-07-10 20:08:16 +02:00
|
|
|
|
|
|
|
|
[dev-dependencies]
|
2025-11-19 19:14:10 -08:00
|
|
|
pretty_assertions = { workspace = true }
|
2025-12-02 15:05:27 -05:00
|
|
|
tempfile = { workspace = true }
|