core-agent-ide/codex-rs/protocol/src
Michael Bolin bef36f4ae7
feat: if .codex is a sub-folder of a writable root, then make it read-only to the sandbox (#8088)
In preparation for in-repo configuration support, this updates
`WritableRoot::get_writable_roots_with_cwd()` to include the `.codex`
subfolder in `WritableRoot.read_only_subpaths`, if it exists, as we
already do for `.git`.

As noted, currently, like `.git`, `.codex` will only be read-only under
macOS Seatbelt, but we plan to bring support to other OSes, as well.

Updated the integration test in `seatbelt.rs` so that it actually
attempts to run the generated Seatbelt commands, verifying that:

- trying to write to `.codex/config.toml` in a writable root fails
- trying to write to `.git/hooks/pre-commit` in a writable root fails
- trying to write to the writable root containing the `.codex` and
`.git` subfolders succeeds
2025-12-15 22:54:43 -08:00
..
account.rs fix: move account struct to app-server-protocol and use camelCase (#5829) 2025-10-27 14:06:13 -07:00
approvals.rs Removed experimental "command risk assessment" feature (#7799) 2025-12-10 09:48:11 -08:00
config_types.rs Migrate model preset (#7542) 2025-12-03 20:30:43 +00:00
conversation_id.rs Generate JSON schema for app-server protocol (#5063) 2025-10-20 11:45:11 -07:00
custom_prompts.rs [app-server] remove serde(skip_serializing_if = "Option::is_none") annotations (#5939) 2025-10-30 18:18:53 +00:00
items.rs [app-server] small fixes for JSON schema export and one-of types (#6614) 2025-11-13 16:25:17 -08:00
lib.rs Migrate model preset (#7542) 2025-12-03 20:30:43 +00:00
message_history.rs Generate JSON schema for app-server protocol (#5063) 2025-10-20 11:45:11 -07:00
models.rs Remote compact for API-key users (#7835) 2025-12-12 10:05:02 -08:00
num_format.rs Auto compact at ~90% (#5292) 2025-10-20 11:29:49 -07:00
openai_models.rs Update Model Info (#7853) 2025-12-11 14:06:07 -08:00
parse_command.rs [app-server] remove serde(skip_serializing_if = "Option::is_none") annotations (#5939) 2025-10-30 18:18:53 +00:00
plan_tool.rs [app-server] remove serde(skip_serializing_if = "Option::is_none") annotations (#5939) 2025-10-30 18:18:53 +00:00
protocol.rs feat: if .codex is a sub-folder of a writable root, then make it read-only to the sandbox (#8088) 2025-12-15 22:54:43 -08:00
user_input.rs Inject SKILL.md when it's explicitly mentioned. (#7763) 2025-12-10 13:59:17 -08:00