mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
7c9731c9af
## Summary In https://github.com/openai/codex/pull/21584, we disabled doctests for crates that lack any doctests. We can enforce that property via `cargo shear --deny-warnings`: crates that lack doctests will be flagged if doctests are enabled, and crates with doctests will be flagged if doctests are disabled. A few additional notes: - By adding `--deny-warnings`, `cargo shear` also flagged a number of modules that were not reachable at all. Some of those have been removed. - This PR removes a usage of `windows_modules!` (since `cargo shear` and `rustfmt` couldn't see through it) in favor of simple `#[cfg(target_os = "windows")]` macros. As a consequence, many of these files exhibit churn in this PR, since they weren't being formatted by `rustfmt` at all on main. - Again, to make the code more analyzable, this PR also removes some usages of `#[path = "cwd_junction.rs"]` in favor of a more standard module structure. The bin sidecar structure is still retained, but, e.g., `windows-sandbox-rs/src/bin/command_runner.rs` was moved to `windows-sandbox-rs/src/bin/command_runner/main.rs`, and so on. --------- Co-authored-by: Codex <noreply@openai.com>
62 lines
1.9 KiB
Rust
62 lines
1.9 KiB
Rust
use anyhow::Result;
|
|
pub use codex_protocol::protocol::SandboxPolicy;
|
|
|
|
pub fn parse_policy(value: &str) -> Result<SandboxPolicy> {
|
|
match value {
|
|
"read-only" => Ok(SandboxPolicy::new_read_only_policy()),
|
|
"workspace-write" => Ok(SandboxPolicy::new_workspace_write_policy()),
|
|
"danger-full-access" | "external-sandbox" => {
|
|
anyhow::bail!("DangerFullAccess and ExternalSandbox are not supported for sandboxing")
|
|
}
|
|
other => {
|
|
let parsed: SandboxPolicy = serde_json::from_str(other)?;
|
|
if matches!(
|
|
parsed,
|
|
SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
|
|
) {
|
|
anyhow::bail!(
|
|
"DangerFullAccess and ExternalSandbox are not supported for sandboxing"
|
|
);
|
|
}
|
|
Ok(parsed)
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn rejects_external_sandbox_preset() {
|
|
let err = parse_policy("external-sandbox").unwrap_err();
|
|
assert!(
|
|
err.to_string()
|
|
.contains("DangerFullAccess and ExternalSandbox are not supported")
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn rejects_external_sandbox_json() {
|
|
let payload =
|
|
serde_json::to_string(&codex_protocol::protocol::SandboxPolicy::ExternalSandbox {
|
|
network_access: codex_protocol::protocol::NetworkAccess::Enabled,
|
|
})
|
|
.unwrap();
|
|
let err = parse_policy(&payload).unwrap_err();
|
|
assert!(
|
|
err.to_string()
|
|
.contains("DangerFullAccess and ExternalSandbox are not supported")
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn parses_read_only_policy() {
|
|
assert_eq!(
|
|
parse_policy("read-only").unwrap(),
|
|
SandboxPolicy::new_read_only_policy()
|
|
);
|
|
}
|
|
}
|