From d34f104c22ae815fc213641b8a637c5947f14ac1 Mon Sep 17 00:00:00 2001 From: chess Date: Tue, 20 Oct 2026 14:41:40 +0000 Subject: [PATCH] Reject unpackaged Windows sandbox provisioning clients (#55593) Remove the exception that allowed clients without a package identity to connect when the provisioning service had one. Keep the debug foreground-mode exception. GitOrigin-RevId: def2d22a91575477d73e3d8c6ac14808a2ff3b2b --- codex-rs/windows-sandbox-service/src/package_identity.rs | 1 - 1 file changed, 1 deletion(-) diff --git a/codex-rs/windows-sandbox-service/src/package_identity.rs b/codex-rs/windows-sandbox-service/src/package_identity.rs index 69b7093912..03e2def3d1 100644 --- a/codex-rs/windows-sandbox-service/src/package_identity.rs +++ b/codex-rs/windows-sandbox-service/src/package_identity.rs @@ -71,7 +71,6 @@ pub(crate) fn authorize_client_process(pipe: HANDLE) -> Result bail!("provisioning service has no package identity"), }, - None if service_family.is_some() => {} #[cfg(debug_assertions)] None if FOREGROUND_MODE.load(Ordering::Acquire) => {} None => bail!("provisioning clients must run with an installed Codex package identity"),