openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-21 17:48:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Run sandbox integrity checks before commands and filesystem operations (#51843)

Browse Source 
## What changed

Wire existing sandbox integrity checks into local command preparation, exec-server process preparation, and sandboxed filesystem helper and file-open operations. Make execution request preparation asynchronous so callers can await the checks.

The checks remain observational: failures and timeouts do not prevent command execution.

## Testing

Add regression tests that launch a real command after checker preparation fails or exceeds its timeout, verifying successful output and exit status.

GitOrigin-RevId: a82399f8aeb8b08f9965e6121b4c7f460552af3f
This commit is contained in:
iceweasel-oai
2026-10-07 21:52:43 +00:00
committed by copyberry
parent c2eb1f42a0
commit cba716c0f1
15 changed files with 151 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server/src/process_sandbox.rs
+1
View File
@@ -298,6 +298,7 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
}
.map_err(|err| invalid_params(format!("failed to prepare process sandbox: {err}")))?;
request.sandbox_override = sandbox_context.sandbox_override;
crate::run_integrity_checks(&request).await;
let windows_sandbox = if sandbox == SandboxType::WindowsRestrictedToken {
let windows_sandbox_level = windows_sandbox_level.ok_or_else(|| {
invalid_params("restricted token sandbox requires a sandbox level".to_string())