openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-06 20:20:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Run sandbox integrity checks before commands and filesystem operations (#51843)

Browse Source 
## What changed

Wire existing sandbox integrity checks into local command preparation, exec-server process preparation, and sandboxed filesystem helper and file-open operations. Make execution request preparation asynchronous so callers can await the checks.

The checks remain observational: failures and timeouts do not prevent command execution.

## Testing

Add regression tests that launch a real command after checker preparation fails or exceeds its timeout, verifying successful output and exit status.

GitOrigin-RevId: a82399f8aeb8b08f9965e6121b4c7f460552af3f
This commit is contained in:
iceweasel-oai
2026-10-07 21:52:43 +00:00
committed by copyberry
parent c2eb1f42a0
commit cba716c0f1
15 changed files with 151 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/unified_exec/process_manager.rs
+4 -2
View File
@@ -1268,9 +1268,11 @@ impl UnifiedExecProcessManager {
environment: &codex_exec_server::Environment,
) -> Result<UnifiedExecProcess, ToolError> {
let mut request = if environment.is_remote() || shell_snapshot.is_some() {
attempt.env_for_exec_server(command, options)
attempt.env_for_exec_server(command, options).await
} else {
attempt.env_for(command, options, network, environment_id)
attempt
.env_for(command, options, network, environment_id)
.await
}
.map_err(ToolError::Codex)?;
let network_policy_decider = network_proxy_launch