openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-06 15:29:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Store Windows wrapper requests under sandbox secrets

Browse Source
This commit is contained in:
David Wiesen
2026-06-11 16:39:42 -07:00
parent 803880c354
commit 85e99b5090
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
codex-rs/exec-server/src/fs_sandbox.rs
View File

@@ -497,7 +497,7 @@ impl WindowsSandboxWrapperRequestFile {
codex_home: &std::path::Path,
request: &codex_windows_sandbox::WindowsSandboxWrapperRequest,
) -> Result<Self, JSONRPCErrorError> {
let request_dir = codex_windows_sandbox::sandbox_dir(codex_home);
let request_dir = windows_sandbox_wrapper_request_dir(codex_home);
std::fs::create_dir_all(&request_dir).map_err(|err| {
internal_error(format!(
"failed to create windows fs sandbox wrapper request dir {}: {err}",
@@ -529,6 +529,11 @@ impl WindowsSandboxWrapperRequestFile {
}
}
#[cfg(target_os = "windows")]
fn windows_sandbox_wrapper_request_dir(codex_home: &std::path::Path) -> std::path::PathBuf {
codex_windows_sandbox::sandbox_secrets_dir(codex_home).join("wrapper-requests")
}
#[cfg(target_os = "windows")]
impl Drop for WindowsSandboxWrapperRequestFile {
fn drop(&mut self) {
@@ -573,6 +578,8 @@ mod tests {
use super::helper_env_key_is_allowed;
use super::helper_read_roots;
use super::sandbox_cwd;
#[cfg(target_os = "windows")]
use super::windows_sandbox_wrapper_request_dir;
#[test]
fn helper_permissions_enable_minimal_reads_for_restricted_profile() {
@@ -737,6 +744,18 @@ mod tests {
);
}
#[cfg(target_os = "windows")]
#[test]
fn windows_wrapper_request_dir_uses_sandbox_secrets() {
let codex_home = std::env::temp_dir().join("codex-home");
let sandbox_dir = codex_windows_sandbox::sandbox_dir(&codex_home);
let secrets_dir = codex_windows_sandbox::sandbox_secrets_dir(&codex_home);
let request_dir = windows_sandbox_wrapper_request_dir(&codex_home);
assert!(!request_dir.starts_with(sandbox_dir));
assert!(request_dir.starts_with(secrets_dir));
}
#[test]
fn sandbox_exec_request_carries_helper_env() {
let Some((path_key, path)) = std::env::vars_os().find(|(key, _)| {