fix: tolerate windows trust path aliases

Co-authored-by: Codex noreply@openai.com

Author: viyatb-oai

codex-rs/core/src/config/mod.rs

@@ -1691,48 +1691,49 @@ impl ConfigToml {
     /// Resolves the cwd to an existing project, or returns None if ConfigToml
     /// does not contain a project corresponding to cwd or a git repo for cwd
     pub fn get_active_project(&self, resolved_cwd: &Path) -> Option<ProjectConfig> {
-        let projects = self
-            .projects
-            .clone()
-            .unwrap_or_default()
-            .into_iter()
-            .map(|(key, project_config)| {
-                let key_path = Path::new(&key);
-                let normalized_key = if key_path.is_absolute() {
-                    Self::normalized_project_lookup_key(key_path)
-                } else {
-                    Self::normalize_project_lookup_key_string(key)
-                };
-                (normalized_key, project_config)
-            })
-            .collect::<HashMap<_, _>>();
-
-        let normalized_cwd = Self::normalized_project_lookup_key(resolved_cwd);
+        let mut projects = HashMap::new();
+        for (key, project_config) in self.projects.clone().unwrap_or_default() {
+            for normalized_key in Self::normalized_project_lookup_keys(Path::new(&key)) {
+                projects.insert(normalized_key, project_config.clone());
+            }
+        }
 
-        if let Some(project_config) = projects.get(&normalized_cwd) {
-            return Some(project_config.clone());
+        for normalized_cwd in Self::normalized_project_lookup_keys(resolved_cwd) {
+            if let Some(project_config) = projects.get(&normalized_cwd) {
+                return Some(project_config.clone());
+            }
         }
 
         // If cwd lives inside a git repo/worktree, check whether the root git project
         // (the primary repository working directory) is trusted. This lets
         // worktrees inherit trust from the main project.
         if let Some(repo_root) = resolve_root_git_project_for_trust(resolved_cwd)
-            && let Some(project_config_for_root) =
-                projects.get(&Self::normalized_project_lookup_key(&repo_root))
         {
-            return Some(project_config_for_root.clone());
+            for normalized_repo_root in Self::normalized_project_lookup_keys(&repo_root) {
+                if let Some(project_config_for_root) = projects.get(&normalized_repo_root) {
+                    return Some(project_config_for_root.clone());
+                }
+            }
         }
 
         None
     }
 
-    fn normalized_project_lookup_key(path: &Path) -> String {
-        Self::normalize_project_lookup_key_string(
+    fn normalized_project_lookup_keys(path: &Path) -> Vec<String> {
+        let normalized_path = Self::normalize_project_lookup_key_string(
+            path.to_string_lossy().to_string(),
+        );
+        let normalized_canonical_path = Self::normalize_project_lookup_key_string(
             normalize_path(path)
                 .unwrap_or_else(|_| path.to_path_buf())
                 .to_string_lossy()
                 .to_string(),
-        )
+        );
+        if normalized_path == normalized_canonical_path {
+            vec![normalized_path]
+        } else {
+            vec![normalized_path, normalized_canonical_path]
+        }
     }
 
     fn normalize_project_lookup_key_string(key: String) -> String {

codex-rs/core/src/config_loader/mod.rs

@@ -532,7 +532,9 @@ async fn load_requirements_from_legacy_scheme(
 struct ProjectTrustContext {
     project_root: AbsolutePathBuf,
     project_root_key: String,
+    project_root_lookup_keys: Vec<String>,
     repo_root_key: Option<String>,
+    repo_root_lookup_keys: Option<Vec<String>>,
     projects_trust: std::collections::HashMap<String, TrustLevel>,
     user_config_file: AbsolutePathBuf,
 }
@@ -555,28 +557,33 @@ impl ProjectTrustDecision {
 
 impl ProjectTrustContext {
     fn decision_for_dir(&self, dir: &AbsolutePathBuf) -> ProjectTrustDecision {
-        let dir_key = normalized_project_trust_key(dir.as_path());
-        if let Some(trust_level) = self.projects_trust.get(&dir_key).copied() {
-            return ProjectTrustDecision {
-                trust_level: Some(trust_level),
-                trust_key: dir_key,
-            };
+        for dir_key in normalized_project_trust_keys(dir.as_path()) {
+            if let Some(trust_level) = self.projects_trust.get(&dir_key).copied() {
+                return ProjectTrustDecision {
+                    trust_level: Some(trust_level),
+                    trust_key: dir_key,
+                };
+            }
         }
 
-        if let Some(trust_level) = self.projects_trust.get(&self.project_root_key).copied() {
-            return ProjectTrustDecision {
-                trust_level: Some(trust_level),
-                trust_key: self.project_root_key.clone(),
-            };
+        for project_root_key in &self.project_root_lookup_keys {
+            if let Some(trust_level) = self.projects_trust.get(project_root_key).copied() {
+                return ProjectTrustDecision {
+                    trust_level: Some(trust_level),
+                    trust_key: project_root_key.clone(),
+                };
+            }
         }
 
-        if let Some(repo_root_key) = self.repo_root_key.as_ref()
-            && let Some(trust_level) = self.projects_trust.get(repo_root_key).copied()
-        {
-            return ProjectTrustDecision {
-                trust_level: Some(trust_level),
-                trust_key: repo_root_key.clone(),
-            };
+        if let Some(repo_root_lookup_keys) = self.repo_root_lookup_keys.as_ref() {
+            for repo_root_key in repo_root_lookup_keys {
+                if let Some(trust_level) = self.projects_trust.get(repo_root_key).copied() {
+                    return ProjectTrustDecision {
+                        trust_level: Some(trust_level),
+                        trust_key: repo_root_key.clone(),
+                    };
+                }
+            }
         }
 
         ProjectTrustDecision {
@@ -641,45 +648,71 @@ async fn project_trust_context(
     let project_root = find_project_root(cwd, project_root_markers).await?;
     let projects = project_trust_config.projects.unwrap_or_default();
 
-    let project_root_key = normalized_project_trust_key(project_root.as_path());
+    let project_root_lookup_keys = normalized_project_trust_keys(project_root.as_path());
+    let project_root_key = project_root_lookup_keys
+        .first()
+        .cloned()
+        .unwrap_or_else(|| normalized_project_trust_key(project_root.as_path()));
     let repo_root = resolve_root_git_project_for_trust(cwd.as_path());
-    let repo_root_key = repo_root
+    let repo_root_lookup_keys = repo_root
         .as_ref()
-        .map(|root| normalized_project_trust_key(root));
+        .map(|root| normalized_project_trust_keys(root));
+    let repo_root_key = repo_root_lookup_keys
+        .as_ref()
+        .and_then(|keys| keys.first().cloned());
 
     let projects_trust = projects
         .into_iter()
-        .filter_map(|(key, project)| {
-            project
-                .trust_level
-                .map(|trust_level| (normalized_project_trust_key_str(&key), trust_level))
+        .flat_map(|(key, project)| {
+            project.trust_level.into_iter().flat_map(move |trust_level| {
+                normalized_project_trust_key_strs(&key)
+                    .into_iter()
+                    .map(move |normalized_key| (normalized_key, trust_level))
+            })
         })
         .collect();
 
     Ok(ProjectTrustContext {
         project_root,
         project_root_key,
+        project_root_lookup_keys,
         repo_root_key,
+        repo_root_lookup_keys,
         projects_trust,
         user_config_file: user_config_file.clone(),
     })
 }
 
 fn normalized_project_trust_key(path: &Path) -> String {
-    normalize_project_trust_lookup_key(
+    normalized_project_trust_keys(path)
+        .into_iter()
+        .next()
+        .unwrap_or_else(|| normalize_project_trust_lookup_key(path.to_string_lossy().to_string()))
+}
+
+fn normalized_project_trust_keys(path: &Path) -> Vec<String> {
+    let normalized_path = normalize_project_trust_lookup_key(path.to_string_lossy().to_string());
+    let normalized_canonical_path = normalize_project_trust_lookup_key(
         normalize_path(path)
             .unwrap_or_else(|_| path.to_path_buf())
             .to_string_lossy()
             .to_string(),
-    )
+    );
+    if normalized_path == normalized_canonical_path {
+        vec![normalized_path]
+    } else {
+        vec![normalized_path, normalized_canonical_path]
+    }
 }
 
-fn normalized_project_trust_key_str(path: &str) -> String {
+fn normalized_project_trust_key_strs(path: &str) -> Vec<String> {
     let path = Path::new(path);
     if path.is_absolute() {
-        normalized_project_trust_key(path)
+        normalized_project_trust_keys(path)
     } else {
-        normalize_project_trust_lookup_key(path.to_string_lossy().to_string())
+        vec![normalize_project_trust_lookup_key(
+            path.to_string_lossy().to_string(),
+        )]
     }
 }