openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-29 19:08:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

windows-sandbox: remove SandboxPolicy runner plumbing

Browse Source
This commit is contained in:
Michael Bolin
2026-05-20 20:36:10 -07:00
parent 0b4f86095c
commit d41c5da300
22 changed files with 470 additions and 773 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/tui/src/app/event_dispatch.rs
+12 -39
View File
@@ -872,8 +872,8 @@ impl App {
#[cfg(target_os = "windows")]
{
let permission_profile = preset.permission_profile.clone();
let policy_cwd = self.config.cwd.clone();
let command_cwd = policy_cwd.clone();
let permission_profile_cwd = self.config.cwd.clone();
let command_cwd = permission_profile_cwd.clone();
let env_map: std::collections::HashMap<String, String> =
std::env::vars().collect();
let codex_home = self.config.codex_home.clone();
@@ -894,22 +894,10 @@ impl App {
self.chat_widget.show_windows_sandbox_setup_status();
self.windows_sandbox.setup_started_at = Some(Instant::now());
let session_telemetry = self.session_telemetry.clone();
let Ok(policy) = permission_profile
.to_legacy_sandbox_policy(policy_cwd.as_path())
.inspect_err(|err| {
tracing::error!(
%err,
"approval preset permissions cannot be projected for elevated Windows sandbox setup"
);
})
else {
tx.send(AppEvent::OpenWindowsSandboxFallbackPrompt { preset });
return Ok(AppRunControl::Continue);
};
tokio::task::spawn_blocking(move || {
let result = crate::legacy_core::windows_sandbox::run_elevated_setup(
&policy,
policy_cwd.as_path(),
&permission_profile,
permission_profile_cwd.as_path(),
command_cwd.as_path(),
&env_map,
codex_home.as_path(),
@@ -970,8 +958,8 @@ impl App {
#[cfg(target_os = "windows")]
{
let permission_profile = preset.permission_profile.clone();
let policy_cwd = self.config.cwd.clone();
let command_cwd = policy_cwd.clone();
let permission_profile_cwd = self.config.cwd.clone();
let command_cwd = permission_profile_cwd.clone();
let env_map: std::collections::HashMap<String, String> =
std::env::vars().collect();
let codex_home = self.config.codex_home.clone();
@@ -979,23 +967,11 @@ impl App {
let session_telemetry = self.session_telemetry.clone();
self.chat_widget.show_windows_sandbox_setup_status();
let Ok(policy) = permission_profile
.to_legacy_sandbox_policy(policy_cwd.as_path())
.inspect_err(|err| {
tracing::error!(
%err,
"approval preset permissions cannot be projected for legacy Windows sandbox setup"
);
})
else {
tx.send(AppEvent::OpenWindowsSandboxFallbackPrompt { preset });
return Ok(AppRunControl::Continue);
};
tokio::task::spawn_blocking(move || {
if let Err(err) =
crate::legacy_core::windows_sandbox::run_legacy_setup_preflight(
&policy,
policy_cwd.as_path(),
&permission_profile,
permission_profile_cwd.as_path(),
command_cwd.as_path(),
&env_map,
codex_home.as_path(),
@@ -1031,11 +1007,8 @@ impl App {
/*hint*/ None,
));
let policy = self
.config
.permissions
.legacy_sandbox_policy(self.config.cwd.as_path());
let policy_cwd = self.config.cwd.clone();
let permission_profile = self.config.permissions.effective_permission_profile();
let permission_profile_cwd = self.config.cwd.clone();
let command_cwd = self.config.cwd.clone();
let env_map: std::collections::HashMap<String, String> =
std::env::vars().collect();
@@ -1045,8 +1018,8 @@ impl App {
tokio::task::spawn_blocking(move || {
let requested_path = PathBuf::from(path);
let event = match crate::legacy_core::grant_read_root_non_elevated(
&policy,
policy_cwd.as_path(),
&permission_profile,
permission_profile_cwd.as_path(),
command_cwd.as_path(),
&env_map,
codex_home.as_path(),
codex-rs/tui/src/app/platform_actions.rs
+14 -8
View File
@@ -21,20 +21,26 @@ impl App {
permission_profile: PermissionProfile,
tx: AppEventSender,
) {
let Ok(sandbox_policy) = permission_profile.to_legacy_sandbox_policy(cwd.as_path()) else {
let Ok(permissions) =
codex_windows_sandbox::ResolvedWindowsSandboxPermissions::try_from_permission_profile_for_cwd(
&permission_profile,
cwd.as_path(),
)
else {
send_world_writable_scan_failed(&tx);
return;
};
tokio::task::spawn_blocking(move || {
let logs_base_dir_path = logs_base_dir.as_path();
let result = codex_windows_sandbox::apply_world_writable_scan_and_denies(
logs_base_dir_path,
cwd.as_path(),
&env_map,
&sandbox_policy,
Some(logs_base_dir_path),
);
let result =
codex_windows_sandbox::apply_world_writable_scan_and_denies_for_permissions(
logs_base_dir_path,
cwd.as_path(),
&env_map,
&permissions,
Some(logs_base_dir_path),
);
if result.is_err() {
// Scan failed: warn without examples.
send_world_writable_scan_failed(&tx);
codex-rs/tui/src/chatwidget/windows_sandbox_prompts.rs
+11 -3
View File
@@ -15,12 +15,20 @@ impl ChatWidget {
}
let cwd = self.config.cwd.clone();
let env_map: std::collections::HashMap<String, String> = std::env::vars().collect();
let policy = self.config.legacy_sandbox_policy();
match codex_windows_sandbox::apply_world_writable_scan_and_denies(
let permission_profile = self.config.permissions.effective_permission_profile();
let Ok(permissions) =
codex_windows_sandbox::ResolvedWindowsSandboxPermissions::try_from_permission_profile_for_cwd(
&permission_profile,
cwd.as_path(),
)
else {
return Some((Vec::new(), 0, true));
};
match codex_windows_sandbox::apply_world_writable_scan_and_denies_for_permissions(
self.config.codex_home.as_path(),
cwd.as_path(),
&env_map,
&policy,
&permissions,
Some(self.config.codex_home.as_path()),
) {
Ok(_) => None,