Address exec-server sandbox review comments

- preserve sandbox child environment variables from shared launch requests
- dispatch codex-exec-server through codex-arg0 so helper arg0 is executable
- send sandbox preference to remote servers and report the server-selected sandbox

Co-authored-by: Codex <noreply@openai.com>

codex-rs/core/src/exec.rs

@@ -284,7 +284,7 @@ pub fn build_exec_request(
         capture_policy,
     };
     let sandbox_launch_config = SandboxLaunchConfig {
-        sandbox: sandbox_type,
+        sandbox_preference: SandboxablePreference::from_selected_sandbox(sandbox_type),
         policy: sandbox_policy.clone(),
         file_system_policy: file_system_sandbox_policy.clone(),
         network_policy: network_sandbox_policy,

codex-rs/core/src/sandboxing/mod.rs

@@ -12,9 +12,6 @@ use crate::exec::ExecExpiration;
 use crate::exec::StdoutStream;
 use crate::exec::WindowsRestrictedTokenFilesystemOverlay;
 use crate::exec::execute_exec_request;
-#[cfg(target_os = "macos")]
-use crate::spawn::CODEX_SANDBOX_ENV_VAR;
-use crate::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use codex_network_proxy::NetworkProxy;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::exec_output::ExecToolCallOutput;
@@ -88,13 +85,14 @@ impl ExecRequest {
     }
 
     pub(crate) fn from_sandbox_exec_request(
-        request: SandboxExecRequest,
+        mut request: SandboxExecRequest,
         options: ExecOptions,
     ) -> Self {
+        request.prepare_env_for_spawn();
         let SandboxExecRequest {
             command,
             cwd,
-            mut env,
+            env,
             network,
             sandbox,
             windows_sandbox_level,
@@ -108,16 +106,6 @@ impl ExecRequest {
             expiration,
             capture_policy,
         } = options;
-        if !network_sandbox_policy.is_enabled() {
-            env.insert(
-                CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR.to_string(),
-                "1".to_string(),
-            );
-        }
-        #[cfg(target_os = "macos")]
-        if sandbox == SandboxType::MacosSeatbelt {
-            env.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());
-        }
         Self {
             command,
             cwd,

codex-rs/core/src/tools/js_repl/mod.rs

@@ -1059,7 +1059,7 @@ impl JsReplManager {
             capture_policy: ExecCapturePolicy::ShellTool,
         };
         let sandbox_launch_config = SandboxLaunchConfig {
-            sandbox: sandbox_type,
+            sandbox_preference: SandboxablePreference::from_selected_sandbox(sandbox_type),
             policy: turn.sandbox_policy.get().clone(),
             file_system_policy: turn.file_system_sandbox_policy.clone(),
             network_policy: turn.network_sandbox_policy,

codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs

@@ -836,7 +836,7 @@ impl CoreShellCommandExecutor {
             capture_policy: ExecCapturePolicy::ShellTool,
         };
         let sandbox_launch_config = SandboxLaunchConfig {
-            sandbox,
+            sandbox_preference: SandboxablePreference::from_selected_sandbox(sandbox),
             policy: sandbox_policy.clone(),
             file_system_policy: file_system_sandbox_policy.clone(),
             network_policy: network_sandbox_policy,

codex-rs/core/src/tools/runtimes/unified_exec.rs

@@ -87,12 +87,8 @@ fn build_remote_exec_sandbox_config(
     attempt: &SandboxAttempt<'_>,
     additional_permissions: Option<PermissionProfile>,
 ) -> SandboxLaunchConfig {
-    if matches!(attempt.sandbox, codex_sandboxing::SandboxType::None) {
-        return SandboxLaunchConfig::no_sandbox(attempt.sandbox_cwd.to_path_buf());
-    }
-
     SandboxLaunchConfig {
-        sandbox: attempt.sandbox,
+        sandbox_preference: SandboxablePreference::from_selected_sandbox(attempt.sandbox),
         policy: attempt.policy.clone(),
         file_system_policy: attempt.file_system_policy.clone(),
         network_policy: attempt.network_policy,

codex-rs/core/src/tools/sandboxing.rs

@@ -339,7 +339,7 @@ impl<'a> SandboxAttempt<'a> {
         network: Option<&NetworkProxy>,
     ) -> Result<crate::sandboxing::ExecRequest, SandboxTransformError> {
         let sandbox_launch_config = SandboxLaunchConfig {
-            sandbox: self.sandbox,
+            sandbox_preference: SandboxablePreference::from_selected_sandbox(self.sandbox),
             policy: self.policy.clone(),
             file_system_policy: self.file_system_policy.clone(),
             network_policy: self.network_policy,

codex-rs/core/src/unified_exec/process_manager.rs

@@ -615,8 +615,8 @@ impl UnifiedExecProcessManager {
                 })
                 .await
                 .map_err(|err| UnifiedExecError::create_process(err.to_string()))?;
-                return UnifiedExecProcess::from_remote_started(started, request.sandbox).await;
-            }
+            return UnifiedExecProcess::from_remote_started(started, request.sandbox).await;
+        }
 
         let spawn_result = if tty {
             codex_utils_pty::pty::spawn_process_with_inherited_fds(
@@ -651,12 +651,12 @@ impl UnifiedExecProcessManager {
         params: codex_exec_server::ExecParams,
         environment: &codex_exec_server::Environment,
     ) -> Result<UnifiedExecProcess, UnifiedExecError> {
-        let sandbox_type = params.sandbox.sandbox;
         let started = environment
             .get_exec_backend()
             .start(params)
             .await
             .map_err(|err| UnifiedExecError::create_process(err.to_string()))?;
+        let sandbox_type = started.sandbox_type;
         UnifiedExecProcess::from_remote_started(started, sandbox_type).await
     }