From 60eed433efd9195cba6b041fc70ee5f150435fd0 Mon Sep 17 00:00:00 2001 From: David Wiesen Date: Mon, 13 Apr 2026 09:16:25 -0700 Subject: [PATCH] Avoid WindowsApps read-root ACLs --- .../src/setup_orchestrator.rs | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs index 01d9e34f4a..6721909f6e 100644 --- a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs +++ b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs @@ -341,16 +341,9 @@ fn profile_read_roots(user_profile: &Path) -> Vec { } fn gather_helper_read_roots(codex_home: &Path) -> Vec { - let mut roots = Vec::new(); - if let Ok(exe) = std::env::current_exe() - && let Some(dir) = exe.parent() - { - roots.push(dir.to_path_buf()); - } let helper_dir = helper_bin_dir(codex_home); let _ = std::fs::create_dir_all(&helper_dir); - roots.push(helper_dir); - roots + vec![helper_dir] } fn gather_legacy_full_read_roots( @@ -1033,6 +1026,18 @@ mod tests { assert!(roots.contains(&expected)); } + #[test] + fn helper_read_roots_do_not_include_current_exe_dir() { + let tmp = TempDir::new().expect("tempdir"); + let codex_home = tmp.path().join("codex-home"); + + let roots = gather_helper_read_roots(&codex_home); + let expected = + dunce::canonicalize(helper_bin_dir(&codex_home)).expect("canonical helper dir"); + + assert_eq!(roots, vec![expected]); + } + #[test] fn restricted_read_roots_skip_platform_defaults_when_disabled() { let tmp = TempDir::new().expect("tempdir");