mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Michael Bolin
1af2a37ada
## Why
`codex-rs/core/src/lib.rs` re-exported a broad set of types and modules
from `codex-protocol` and `codex-shell-command`. That made it easy for
workspace crates to import those APIs through `codex-core`, which in
turn hides dependency edges and makes it harder to reduce compile-time
coupling over time.
This change removes those public re-exports so call sites must import
from the source crates directly. Even when a crate still depends on
`codex-core` today, this makes dependency boundaries explicit and
unblocks future work to drop `codex-core` dependencies where possible.
## What Changed
- Removed public re-exports from `codex-rs/core/src/lib.rs` for:
- `codex_protocol::protocol` and related protocol/model types (including
`InitialHistory`)
- `codex_protocol::config_types` (`protocol_config_types`)
- `codex_shell_command::{bash, is_dangerous_command, is_safe_command,
parse_command, powershell}`
- Migrated workspace Rust call sites to import directly from:
- `codex_protocol::protocol`
- `codex_protocol::config_types`
- `codex_protocol::models`
- `codex_shell_command`
- Added explicit `Cargo.toml` dependencies (`codex-protocol` /
`codex-shell-command`) in crates that now import those crates directly.
- Kept `codex-core` internal modules compiling by using `pub(crate)`
aliases in `core/src/lib.rs` (internal-only, not part of the public
API).
- Updated the two utility crates that can already drop a `codex-core`
dependency edge entirely:
- `codex-utils-approval-presets`
- `codex-utils-cli`
## Verification
- `cargo test -p codex-utils-approval-presets`
- `cargo test -p codex-utils-cli`
- `cargo check --workspace --all-targets`
- `just clippy`
89 lines
3.0 KiB
Rust
89 lines
3.0 KiB
Rust
use codex_protocol::protocol::NetworkAccess;
|
|
use codex_protocol::protocol::SandboxPolicy;
|
|
|
|
pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
|
|
match sandbox_policy {
|
|
SandboxPolicy::DangerFullAccess => "danger-full-access".to_string(),
|
|
SandboxPolicy::ReadOnly { .. } => "read-only".to_string(),
|
|
SandboxPolicy::ExternalSandbox { network_access } => {
|
|
let mut summary = "external-sandbox".to_string();
|
|
if matches!(network_access, NetworkAccess::Enabled) {
|
|
summary.push_str(" (network access enabled)");
|
|
}
|
|
summary
|
|
}
|
|
SandboxPolicy::WorkspaceWrite {
|
|
writable_roots,
|
|
network_access,
|
|
exclude_tmpdir_env_var,
|
|
exclude_slash_tmp,
|
|
read_only_access: _,
|
|
} => {
|
|
let mut summary = "workspace-write".to_string();
|
|
|
|
let mut writable_entries = Vec::<String>::new();
|
|
writable_entries.push("workdir".to_string());
|
|
if !*exclude_slash_tmp {
|
|
writable_entries.push("/tmp".to_string());
|
|
}
|
|
if !*exclude_tmpdir_env_var {
|
|
writable_entries.push("$TMPDIR".to_string());
|
|
}
|
|
writable_entries.extend(
|
|
writable_roots
|
|
.iter()
|
|
.map(|p| p.to_string_lossy().to_string()),
|
|
);
|
|
|
|
summary.push_str(&format!(" [{}]", writable_entries.join(", ")));
|
|
if *network_access {
|
|
summary.push_str(" (network access enabled)");
|
|
}
|
|
summary
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use codex_utils_absolute_path::AbsolutePathBuf;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn summarizes_external_sandbox_without_network_access_suffix() {
|
|
let summary = summarize_sandbox_policy(&SandboxPolicy::ExternalSandbox {
|
|
network_access: NetworkAccess::Restricted,
|
|
});
|
|
assert_eq!(summary, "external-sandbox");
|
|
}
|
|
|
|
#[test]
|
|
fn summarizes_external_sandbox_with_enabled_network() {
|
|
let summary = summarize_sandbox_policy(&SandboxPolicy::ExternalSandbox {
|
|
network_access: NetworkAccess::Enabled,
|
|
});
|
|
assert_eq!(summary, "external-sandbox (network access enabled)");
|
|
}
|
|
|
|
#[test]
|
|
fn workspace_write_summary_still_includes_network_access() {
|
|
let root = if cfg!(windows) { "C:\\repo" } else { "/repo" };
|
|
let writable_root = AbsolutePathBuf::try_from(root).unwrap();
|
|
let summary = summarize_sandbox_policy(&SandboxPolicy::WorkspaceWrite {
|
|
writable_roots: vec![writable_root.clone()],
|
|
read_only_access: Default::default(),
|
|
network_access: true,
|
|
exclude_tmpdir_env_var: true,
|
|
exclude_slash_tmp: true,
|
|
});
|
|
assert_eq!(
|
|
summary,
|
|
format!(
|
|
"workspace-write [workdir, {}] (network access enabled)",
|
|
writable_root.to_string_lossy()
|
|
)
|
|
);
|
|
}
|
|
}
|