Temporarily ignore new aws-lc-sys advisories

Co-authored-by: Codex <noreply@openai.com>

codex-rs/deny.toml

@@ -73,8 +73,11 @@ ignore = [
     { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" },
     { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" },
     { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via ratatui/rmcp/starlark used by tui/execpolicy; no fixed release yet" },
-    # TODO(joshka, nornagon): remove this exception when once we update the ratatui fork to a version that uses lru 0.13+.
-    { id = "RUSTSEC-2026-0002", reason = "lru 0.12.5 is pulled in via ratatui fork; cannot upgrade until the fork is updated" },
+    { id = "RUSTSEC-2026-0044", reason = "aws-lc-sys 0.37.0 is pulled in via aws-lc-rs; upgrading to 0.39.0 needs a Bazel patch migration, so ignore temporarily on this branch" },
+    { id = "RUSTSEC-2026-0045", reason = "aws-lc-sys 0.37.0 is pulled in via aws-lc-rs; upgrading to 0.39.0 needs a Bazel patch migration, so ignore temporarily on this branch" },
+    { id = "RUSTSEC-2026-0046", reason = "aws-lc-sys 0.37.0 is pulled in via aws-lc-rs; upgrading to 0.39.0 needs a Bazel patch migration, so ignore temporarily on this branch" },
+    { id = "RUSTSEC-2026-0047", reason = "aws-lc-sys 0.37.0 is pulled in via aws-lc-rs; upgrading to 0.39.0 needs a Bazel patch migration, so ignore temporarily on this branch" },
+    { id = "RUSTSEC-2026-0048", reason = "aws-lc-sys 0.37.0 is pulled in via aws-lc-rs; upgrading to 0.39.0 needs a Bazel patch migration, so ignore temporarily on this branch" },
     # TODO(fcoury): remove this exception when syntect drops yaml-rust and bincode, or updates to versions that have fixed the vulnerabilities.
     { id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },
     { id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },

codex-rs/exec-server/tests/exec_process.rs

@@ -10,6 +10,7 @@ use codex_exec_server::ExecParams;
 use codex_exec_server::ExecProcess;
 use codex_exec_server::ExecResponse;
 use codex_exec_server::ReadParams;
+use codex_exec_server::TerminateResponse;
 use pretty_assertions::assert_eq;
 use test_case::test_case;
 
@@ -85,3 +86,113 @@ async fn assert_exec_process_starts_and_exits(use_remote: bool) -> Result<()> {
 async fn exec_process_starts_and_exits(use_remote: bool) -> Result<()> {
     assert_exec_process_starts_and_exits(use_remote).await
 }
+
+async fn assert_exec_process_terminates_running_process(use_remote: bool) -> Result<()> {
+    let context = create_process_context(use_remote).await?;
+    let response = context
+        .process
+        .start(ExecParams {
+            process_id: "proc-io".to_string(),
+            argv: vec!["sleep".to_string(), "60".to_string()],
+            cwd: std::env::current_dir()?,
+            env: Default::default(),
+            tty: false,
+            arg0: None,
+        })
+        .await?;
+    assert_eq!(
+        response,
+        ExecResponse {
+            process_id: "proc-io".to_string(),
+        }
+    );
+
+    let terminate = context.process.terminate("proc-io").await?;
+    assert_eq!(terminate, TerminateResponse { running: true });
+
+    let mut next_seq = 0;
+    loop {
+        let read = context
+            .process
+            .read(ReadParams {
+                process_id: "proc-io".to_string(),
+                after_seq: Some(next_seq),
+                max_bytes: None,
+                wait_ms: Some(100),
+            })
+            .await?;
+        next_seq = read.next_seq;
+        if read.exited {
+            break;
+        }
+    }
+
+    let terminate_after_exit = context.process.terminate("proc-io").await?;
+    assert_eq!(terminate_after_exit, TerminateResponse { running: false });
+
+    Ok(())
+}
+
+#[test_case(false ; "local")]
+#[test_case(true ; "remote")]
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_process_terminates_running_process(use_remote: bool) -> Result<()> {
+    assert_exec_process_terminates_running_process(use_remote).await
+}
+
+async fn assert_exec_process_read_returns_one_chunk_when_max_bytes_is_zero(
+    use_remote: bool,
+) -> Result<()> {
+    let context = create_process_context(use_remote).await?;
+    let response = context
+        .process
+        .start(ExecParams {
+            process_id: "proc-truncate".to_string(),
+            argv: vec!["sh".to_string(), "-c".to_string(), "printf a".to_string()],
+            cwd: std::env::current_dir()?,
+            env: Default::default(),
+            tty: false,
+            arg0: None,
+        })
+        .await?;
+    assert_eq!(
+        response,
+        ExecResponse {
+            process_id: "proc-truncate".to_string(),
+        }
+    );
+
+    let mut read = None;
+    for _ in 0..20 {
+        let candidate = context
+            .process
+            .read(ReadParams {
+                process_id: "proc-truncate".to_string(),
+                after_seq: Some(0),
+                max_bytes: Some(0),
+                wait_ms: Some(100),
+            })
+            .await?;
+        if !candidate.chunks.is_empty() {
+            read = Some(candidate);
+            break;
+        }
+    }
+    let Some(read) = read else {
+        anyhow::bail!("timed out waiting for retained output with max_bytes = 0");
+    };
+    assert_eq!(read.chunks.len(), 1);
+    assert_eq!(read.chunks[0].chunk.0, b"a");
+    assert_eq!(read.next_seq, 2);
+
+    Ok(())
+}
+
+#[test_case(false ; "local")]
+#[test_case(true ; "remote")]
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_process_read_returns_one_chunk_when_max_bytes_is_zero(
+    use_remote: bool,
+) -> Result<()> {
+    assert_exec_process_read_returns_one_chunk_when_max_bytes_is_zero(use_remote).await
+}