From b04590fc1ffd17a225c5ef2583bc7d377a4b4ea2 Mon Sep 17 00:00:00 2001 From: Edward Frazer Date: Fri, 17 Apr 2026 14:51:26 -0700 Subject: [PATCH] fix: skip .tsh in Windows sandbox profile read roots --- codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs index 4effc0b70d..06669fff92 100644 --- a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs +++ b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs @@ -42,6 +42,7 @@ const SECURITY_BUILTIN_DOMAIN_RID: u32 = 0x0000_0020; const DOMAIN_ALIAS_RID_ADMINS: u32 = 0x0000_0220; const USERPROFILE_READ_ROOT_EXCLUSIONS: &[&str] = &[ ".ssh", + ".tsh", ".gnupg", ".aws", ".azure", @@ -1031,11 +1032,13 @@ mod tests { let allowed_dir = user_profile.join("Documents"); let allowed_file = user_profile.join(".gitconfig"); let excluded_dir = user_profile.join(".ssh"); + let excluded_tsh_dir = user_profile.join(".tsh"); let excluded_case_variant = user_profile.join(".AWS"); fs::create_dir_all(&allowed_dir).expect("create allowed dir"); fs::write(&allowed_file, "safe").expect("create allowed file"); fs::create_dir_all(&excluded_dir).expect("create excluded dir"); + fs::create_dir_all(&excluded_tsh_dir).expect("create excluded tsh dir"); fs::create_dir_all(&excluded_case_variant).expect("create excluded case variant"); let roots = profile_read_roots(user_profile);