Backplane.
Copy Markdown
Canonical, symlink-aware containment for Codex workspace paths.
Write authorization also rejects multiply linked regular targets. These checks inspect the current filesystem; they do not provide race-free OS isolation. Hosts requiring protection from concurrent hostile filesystem changes must use an operating-system sandbox in addition to these checks.
Summary
Functions
Checks containment and the current regular-file link count before a write.
Functions
@spec authorize(binary(), binary()) :: {:ok, binary()} | {:error, Backplane.AgentRuntime.Error.t()}
@spec authorize_write(binary(), binary()) :: {:ok, binary()} | {:error, Backplane.AgentRuntime.Error.t()}
Checks containment and the current regular-file link count before a write.