Wire the Windows MXC sandbox into command execution (#45176)

## What changed

- Add explicit MXC backend selection and carry its identity through exec-server process reporting and sandbox violation classification.
- Launch MXC through the Codex executable with the effective permission profile and command environment.
- Reject exec-server MXC requests when native MXC is unavailable or when they request a TTY, an `arg0` override, or managed networking. Reject private desktop isolation during MXC preparation.
- Allow an explicitly empty child environment and avoid exposing request payload values in launcher decode errors.

## Testing

Add coverage for sandbox selection and unsupported-request rejection, plus Windows RPC tests for stdin writes and temporary-directory permissions derived from the command environment. Native MXC tests skip when MXC is unavailable.

GitOrigin-RevId: 3626ff0f9ad7f9b812ce09b68c31ea9a5a9c72b1

codex-rs/exec-server/src/fs_sandbox.rs

@@ -176,7 +176,11 @@ impl FileSystemSandboxRunner {
                     environment_id: None,
                     network: None,
                     sandbox_policy_cwd: &cwd.uri,
-                    codex_linux_sandbox_exe: self.runtime_paths.codex_linux_sandbox_exe.as_deref(),
+                    sandbox_exe: if cfg!(windows) {
+                        Some(self.runtime_paths.codex_self_exe.as_path())
+                    } else {
+                        self.runtime_paths.codex_linux_sandbox_exe.as_deref()
+                    },
                     use_legacy_landlock: sandbox_context.use_legacy_landlock,
                     windows_sandbox_level: sandbox_context.windows_sandbox_level,
                     windows_sandbox_private_desktop: sandbox_context

codex-rs/exec-server/src/local_process.rs

@@ -396,6 +396,7 @@ impl LocalProcess {
             SandboxType::MacosSeatbelt => Some(ProcessSandboxType::MacosSeatbelt),
             SandboxType::LinuxSeccomp => Some(ProcessSandboxType::LinuxSeccomp),
             SandboxType::WindowsRestrictedToken => Some(ProcessSandboxType::WindowsRestrictedToken),
+            SandboxType::WindowsMxc => Some(ProcessSandboxType::WindowsMxc),
         };
 
         let start = Arc::new(ProcessStart);

codex-rs/exec-server/src/process.rs

@@ -35,6 +35,7 @@ pub(crate) fn sandbox_type_from_protocol(
         Some(ProcessSandboxType::WindowsRestrictedToken) => {
             Some(SandboxType::WindowsRestrictedToken)
         }
+        Some(ProcessSandboxType::WindowsMxc) => Some(SandboxType::WindowsMxc),
     }
 }
 

codex-rs/exec-server/src/process_sandbox.rs

@@ -84,6 +84,28 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
     network_policy_audit_observer: Option<NetworkPolicyAuditObserver>,
     telemetry: &ProcessTelemetry,
 ) -> Result<PreparedExecRequest, JSONRPCErrorError> {
+    if let Some(sandbox) = params.sandbox.as_ref()
+        && sandbox.windows_sandbox_level == codex_protocol::config_types::WindowsSandboxLevel::Mxc
+    {
+        if params.tty || params.arg0.is_some() {
+            return Err(invalid_params(
+                "MXC currently supports ordinary pipe launches only".to_owned(),
+            ));
+        }
+        if params.enforce_managed_network
+            || params.managed_network.is_some()
+            || params.network_proxy.is_some()
+        {
+            return Err(invalid_params(
+                "MXC managed networking is not supported yet".to_owned(),
+            ));
+        }
+        if !codex_sandboxing::windows_mxc_available() {
+            return Err(invalid_params(
+                "native MXC is unavailable on this executor".to_owned(),
+            ));
+        }
+    }
     #[cfg(target_os = "windows")]
     let mut env = env;
     #[cfg(target_os = "windows")]
@@ -241,7 +263,11 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
             environment_id: None,
             network: None,
             sandbox_policy_cwd,
-            codex_linux_sandbox_exe: runtime_paths.codex_linux_sandbox_exe.as_deref(),
+            sandbox_exe: if cfg!(windows) {
+                Some(runtime_paths.codex_self_exe.as_path())
+            } else {
+                runtime_paths.codex_linux_sandbox_exe.as_deref()
+            },
             use_legacy_landlock: sandbox_context.use_legacy_landlock,
             windows_sandbox_level: sandbox_context.windows_sandbox_level,
             windows_sandbox_private_desktop: sandbox_context.windows_sandbox_private_desktop,

codex-rs/exec-server/src/process_sandbox_tests.rs

@@ -129,6 +129,33 @@ async fn sandbox_request_wraps_native_argv_on_executor() {
         prepared.command.first().map(String::as_str),
         Some("/usr/bin/sandbox-exec")
     );
+
+    let mut params = params;
+    params.sandbox.as_mut().unwrap().windows_sandbox_level =
+        codex_protocol::config_types::WindowsSandboxLevel::Mxc;
+    for (tty, managed, message) in [
+        (false, false, "native MXC is unavailable on this executor"),
+        (
+            true,
+            false,
+            "MXC currently supports ordinary pipe launches only",
+        ),
+        (false, true, "MXC managed networking is not supported yet"),
+    ] {
+        params.tty = tty;
+        params.enforce_managed_network = managed;
+        let error = prepare_exec_request(
+            &params,
+            HashMap::new(),
+            Some(&runtime_paths),
+            /*network_policy_decider*/ None,
+            /*network_policy_audit_observer*/ None,
+        )
+        .await
+        .err()
+        .expect("unsupported MXC must fail closed");
+        assert_eq!(error.message, message);
+    }
 }
 
 #[cfg(unix)]