git: 9aded1bf63ab - main - misc/codex: Restore apply_patch functionality

The branch main has been updated by kbowling:

URL: https://cgit.FreeBSD.org/ports/commit/?id=9aded1bf63ab451c4d4084e7ac65a81bf8705dc4

commit 9aded1bf63ab451c4d4084e7ac65a81bf8705dc4
Author:     Kevin Bowling <kbowling@FreeBSD.org>
AuthorDate: 2026-08-25 00:03:12 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-08-25 00:03:12 +0000

    misc/codex: Restore apply_patch functionality
    
    There is no FreeBSD sandbox code for this, so enable symlinks as
    0.148.0 and prior used to for now.
    
    PR:             297802
    Approved by:    tagattie
---
 misc/codex/Makefile                                |  1 +
 ...codex-rs_core_src_tools_runtimes_apply_patch.rs | 52 ++++++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/misc/codex/Makefile b/misc/codex/Makefile
index 51ea982b49dc..274034a71cc9 100644
--- a/misc/codex/Makefile
+++ b/misc/codex/Makefile
@@ -1,6 +1,7 @@
 PORTNAME=	codex
 DISTVERSIONPREFIX=	rust-v
 DISTVERSION=	0.149.0
+PORTREVISION=	1
 CATEGORIES=	misc devel
 
 MAINTAINER=	tagattie@FreeBSD.org
diff --git a/misc/codex/files/patch-codex-rs_core_src_tools_runtimes_apply_patch.rs b/misc/codex/files/patch-codex-rs_core_src_tools_runtimes_apply_patch.rs
new file mode 100644
index 000000000000..6c3c72aa2d34
--- /dev/null
+++ b/misc/codex/files/patch-codex-rs_core_src_tools_runtimes_apply_patch.rs
@@ -0,0 +1,52 @@
+--- codex-rs/core/src/tools/runtimes/apply_patch.rs.orig
++++ codex-rs/core/src/tools/runtimes/apply_patch.rs
+@@ -91,6 +91,16 @@
+         if !attempt.sandbox_requested {
+             return None;
+         }
++        // LOCAL: the sandboxed fs helper requires Landlock/seatbelt/Windows
++        // sandboxing and fails closed on FreeBSD with
++        // "filesystem sandbox cannot be enforced on this executor".
++        if !cfg!(any(
++            target_os = "linux",
++            target_os = "macos",
++            target_os = "windows"
++        )) {
++            return None;
++        }
+ 
+         let permissions = effective_permission_profile(
+             attempt.exec_server_permissions,
+@@ -178,14 +188,24 @@
+             &req.action.patch,
+             ApplyPatchOptions {
+                 update_file_mode: req.action.update_file_mode(),
+-                // Only reject links when an otherwise-required sandbox was bypassed.
+-                // Executor-managed sandboxes can have SandboxType::None.
+-                follow_symlinks: attempt.sandbox_requested
+-                    || !attempt.manager.should_sandbox(
+-                        attempt.permissions,
+-                        self.sandbox_preference(),
+-                        attempt.enforce_managed_network,
+-                    ),
++                // Only reject links when an otherwise-required sandbox was
++                // bypassed. LOCAL: FreeBSD has no platform sandbox, so keep
++                // 0.148 follow-symlinks instead of no-follow (which rejects
++                // apply_patch with "require an absolute path").
++                follow_symlinks: if cfg!(any(
++                    target_os = "linux",
++                    target_os = "macos",
++                    target_os = "windows"
++                )) {
++                    attempt.sandbox_requested
++                        || !attempt.manager.should_sandbox(
++                            attempt.permissions,
++                            self.sandbox_preference(),
++                            attempt.enforce_managed_network,
++                        )
++                } else {
++                    true
++                },
+             },
+             &req.action.cwd,
+             &mut stdout,