openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-22 17:58:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

windows-sandbox: pass workspace roots to runner

Browse Source
This commit is contained in:
Michael Bolin
2026-05-22 15:11:50 -07:00
parent 7d9b80b4df
commit 2de7224229
32 changed files with 446 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/cli/src/debug_sandbox.rs
+12 -12
View File
@@ -197,10 +197,11 @@ async fn run_command_under_sandbox(
// In practice, this should be `std::env::current_dir()` because this CLI
// does not support `--cwd`, but let's use the config value for consistency.
let cwd = config.cwd.clone();
// For now, we always use the same cwd for both the command and the
// permission profile. In the future, we could add a CLI option to set them
// separately.
let permission_profile_cwd = cwd.clone();
// Non-Windows sandbox launchers still materialize profile-relative entries
// against the command cwd.
let sandbox_policy_cwd = cwd.clone();
#[cfg(target_os = "windows")]
let workspace_roots = config.effective_workspace_roots();
let env = create_env(
&config.permissions.shell_environment_policy,
@@ -211,8 +212,7 @@ async fn run_command_under_sandbox(
if let SandboxType::Windows = sandbox_type {
#[cfg(target_os = "windows")]
{
run_command_under_windows_session(&config, command, cwd, permission_profile_cwd, env)
.await;
run_command_under_windows_session(&config, command, cwd, workspace_roots, env).await;
}
#[cfg(not(target_os = "windows"))]
{
@@ -255,7 +255,7 @@ async fn run_command_under_sandbox(
command,
file_system_sandbox_policy: &file_system_sandbox_policy,
network_sandbox_policy,
sandbox_policy_cwd: permission_profile_cwd.as_path(),
sandbox_policy_cwd: sandbox_policy_cwd.as_path(),
enforce_managed_network: false,
network: network.as_ref(),
extra_allow_unix_sockets: allow_unix_sockets,
@@ -287,7 +287,7 @@ async fn run_command_under_sandbox(
command,
cwd.as_path(),
&config.permissions.effective_permission_profile(),
permission_profile_cwd.as_path(),
sandbox_policy_cwd.as_path(),
use_legacy_landlock,
allow_network_for_proxy(managed_network_requirements_enabled),
);
@@ -339,7 +339,7 @@ async fn run_command_under_windows_session(
config: &Config,
command: Vec<String>,
cwd: AbsolutePathBuf,
permission_profile_cwd: AbsolutePathBuf,
workspace_roots: Vec<AbsolutePathBuf>,
env: std::collections::HashMap<String, String>,
) -> ! {
use codex_core::windows_sandbox::WindowsSandboxLevelExt;
@@ -357,7 +357,7 @@ async fn run_command_under_windows_session(
let spawned = if use_elevated {
spawn_windows_sandbox_session_elevated_for_permission_profile(
&permission_profile,
permission_profile_cwd.as_path(),
workspace_roots.as_slice(),
config.codex_home.as_path(),
command,
cwd.as_path(),
@@ -376,7 +376,7 @@ async fn run_command_under_windows_session(
} else {
spawn_windows_sandbox_session_legacy(
&permission_profile,
permission_profile_cwd.as_path(),
workspace_roots.as_slice(),
config.codex_home.as_path(),
command,
cwd.as_path(),
@@ -1013,7 +1013,7 @@ mod tests {
}
#[tokio::test]
async fn debug_sandbox_uses_explicit_profile_cwd() -> anyhow::Result<()> {
async fn debug_sandbox_uses_explicit_cwd() -> anyhow::Result<()> {
let codex_home = TempDir::new()?;
let cwd = TempDir::new()?;