Make permission transforms aware of executor path context - #41909
Merged
copyberry[bot] merged 1 commit intoAug 31, 2026
Conversation
## What changed - Add context-aware normalization, materialization, and intersection helpers for additional filesystem permissions. - Resolve project roots, home-relative deny globs, temporary directories, and filesystem roots from the executor's `FileSystemSandboxPolicyContext` while preserving URI path conventions and symlinked paths. - Keep deny constraints when intersecting grants across POSIX, Windows, and UNC paths, and reject incompatible path conventions when executor context is available. ## Testing - Cover cross-convention validation, empty temporary-directory contexts, home-relative deny globs, and rooted deny globs for POSIX, Windows, and UNC paths. GitOrigin-RevId: 14fd866a17a0ac4a595aa4f0e2fb82bfae1a8838
copyberry
Bot
force-pushed
the
copyberry/codex-internal-to-codex-oss/14fd866a17a0ac4a595aa4f0e2fb82bfae1a8838
branch
from
August 31, 2026 20:51
3d5663c to
b51b077
Compare
copyberry
Bot
deleted the
copyberry/codex-internal-to-codex-oss/14fd866a17a0ac4a595aa4f0e2fb82bfae1a8838
branch
August 31, 2026 20:53
ADCOIndustries
temporarily deployed
to
issue-triage
August 31, 2026 20:58 — with 
GitHub Actions
Inactive
ADCOIndustries
temporarily deployed
to
issue-triage
August 31, 2026 20:58 — with
GitHub Actions
Inactive
ADCOIndustries
temporarily deployed
to
issue-triage
August 31, 2026 20:58 — with
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make permission transforms aware of executor path context
What changed
FileSystemSandboxPolicyContextwhile preserving URI path conventions and symlinked paths.Testing