diff options
Diffstat (limited to 'src/detect')
| -rw-r--r-- | src/detect/manifest/tests.rs | 34 | ||||
| -rw-r--r-- | src/detect/manifests/codex.toml | 17 |
2 files changed, 48 insertions, 3 deletions
diff --git a/src/detect/manifest/tests.rs b/src/detect/manifest/tests.rs index 11c92f49..265dfa69 100644 --- a/src/detect/manifest/tests.rs +++ b/src/detect/manifest/tests.rs @@ -734,6 +734,40 @@ fn codex_osc_title_plain_is_idle() { } #[test] +fn codex_trust_directory_requires_live_top_region() { + let screen = "> You are in C:\\Users\\user\\project\n\n\ + Do you trust the contents of this\n\ + directory? Working with untrusted\n\ + contents comes with higher risk of\n\ + prompt injection. Trusting the\n\ + directory allows project-local config,\n\ + hooks, and exec policies to load.\n\n\ + › 1. Yes, continue\n\ + 2. No, quit\n\n\ + Press enter to continue\n"; + let result = osc_explain(Agent::Codex, screen, "project", ""); + + assert_eq!(result.state, AgentState::Blocked); + assert_eq!( + result.matched_rule.as_ref().map(|rule| rule.id.as_str()), + Some("trust_directory") + ); + assert!(result.visible_blocker); + + let transcript = "› > You are in C:\\Users\\user\\project\n\n\ + Do you trust the contents of this\n\ + directory? Working with untrusted contents comes with higher risk.\n"; + let result = osc_explain(Agent::Codex, transcript, "project", ""); + + assert_eq!(result.state, AgentState::Idle); + assert_ne!( + result.matched_rule.as_ref().map(|rule| rule.id.as_str()), + Some("trust_directory") + ); + assert!(!result.visible_blocker); +} + +#[test] fn codex_background_terminal_screen_does_not_override_osc_idle() { // Background terminal tasks can be long-lived helpers such as dev servers. // They should not make Codex look busy once the foreground turn is idle. diff --git a/src/detect/manifests/codex.toml b/src/detect/manifests/codex.toml index a4a4ca9f..9169e108 100644 --- a/src/detect/manifests/codex.toml +++ b/src/detect/manifests/codex.toml @@ -1,7 +1,7 @@ id = "codex" -version = "2026.07.18.1" -min_engine_version = 2 -updated_at = "2026-07-18T00:00:00Z" +version = "2026.08.09.1" +min_engine_version = 3 +updated_at = "2026-08-09T00:00:00Z" [[rules]] id = "osc_title_blocked" @@ -32,6 +32,17 @@ any = [ ] [[rules]] +id = "trust_directory" +state = "blocked" +priority = 950 +region = "top_non_empty_lines(20)" +visible_blocker = true +all = [ + { regex = ['\A> You are in [^\r\n]+(?:\r?\n|$)'] }, + { regex = ['(?s)Do\s+you\s+trust\s+the\s+contents\s+of\s+this\s+directory\?'] }, +] + +[[rules]] id = "live_strong_blocker" state = "blocked" priority = 900 |