From eb847ec5d6e3e896801dd5e8ed623a34f852bf99 Mon Sep 17 00:00:00 2001 From: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com> Date: Fri, 20 Mar 2026 17:12:46 +0000 Subject: [PATCH] Fix sandbox extraction follow-ups - trim leftover codex-core sandbox shims and retarget the remaining type plumbing - keep sandbox-related dependencies scoped to the crates and targets that actually use them Co-authored-by: Codex --- codex-rs/Cargo.lock | 2 +- codex-rs/core/src/error.rs | 15 +++++++++++++++ codex-rs/core/src/exec.rs | 1 - codex-rs/core/src/exec_tests.rs | 1 + codex-rs/core/src/landlock.rs | 3 --- codex-rs/core/src/lib.rs | 4 ---- codex-rs/core/src/sandboxing/mod.rs | 1 - codex-rs/core/src/spawn.rs | 3 --- codex-rs/core/src/tools/sandboxing.rs | 10 ++-------- codex-rs/core/src/windows_sandbox.rs | 17 ----------------- .../core/src/windows_sandbox_read_grants.rs | 1 - codex-rs/exec/Cargo.toml | 2 +- codex-rs/linux-sandbox/Cargo.toml | 1 + codex-rs/mcp-server/Cargo.toml | 4 ++-- codex-rs/sandbox/Cargo.toml | 1 - codex-rs/sandbox/src/exec.rs | 11 +++++++++++ 16 files changed, 34 insertions(+), 43 deletions(-) delete mode 100644 codex-rs/core/src/landlock.rs delete mode 100644 codex-rs/core/src/spawn.rs delete mode 100644 codex-rs/core/src/windows_sandbox.rs delete mode 100644 codex-rs/core/src/windows_sandbox_read_grants.rs diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock index 4e55feafa2..71167e5899 100644 --- a/codex-rs/Cargo.lock +++ b/codex-rs/Cargo.lock @@ -2159,6 +2159,7 @@ version = "0.0.0" dependencies = [ "cc", "clap", + "codex-core", "codex-protocol", "codex-sandbox", "codex-utils-absolute-path", @@ -2464,7 +2465,6 @@ dependencies = [ "libc", "pretty_assertions", "seccompiler", - "serde", "serde_json", "tempfile", "thiserror 2.0.18", diff --git a/codex-rs/core/src/error.rs b/codex-rs/core/src/error.rs index 08b2e49c31..f0f50e28f0 100644 --- a/codex-rs/core/src/error.rs +++ b/codex-rs/core/src/error.rs @@ -15,6 +15,7 @@ use codex_protocol::ThreadId; use codex_protocol::protocol::CodexErrorInfo; use codex_protocol::protocol::ErrorEvent; use codex_protocol::protocol::RateLimitSnapshot; +use codex_sandbox::SandboxTransformError; use reqwest::StatusCode; use serde_json; use std::io; @@ -234,6 +235,20 @@ impl From for CodexErr { } } +impl From for CodexErr { + fn from(err: SandboxTransformError) -> Self { + match err { + SandboxTransformError::MissingLinuxSandboxExecutable => { + CodexErr::LandlockSandboxExecutableNotProvided + } + #[cfg(not(target_os = "macos"))] + SandboxTransformError::SeatbeltUnavailable => CodexErr::UnsupportedOperation( + "seatbelt sandbox is only available on macOS".to_string(), + ), + } + } +} + impl CodexErr { pub fn is_retryable(&self) -> bool { match self { diff --git a/codex-rs/core/src/exec.rs b/codex-rs/core/src/exec.rs index 36edda4962..529447a4fb 100644 --- a/codex-rs/core/src/exec.rs +++ b/codex-rs/core/src/exec.rs @@ -10,7 +10,6 @@ pub(crate) use codex_sandbox::ExecCapturePolicy; pub(crate) use codex_sandbox::ExecExpiration; pub(crate) use codex_sandbox::ExecParams; pub(crate) use codex_sandbox::ExecToolCallOutput; -pub(crate) use codex_sandbox::IO_DRAIN_TIMEOUT_MS; pub(crate) use codex_sandbox::MAX_EXEC_OUTPUT_DELTAS_PER_CALL; pub(crate) use codex_sandbox::SandboxType; pub(crate) use codex_sandbox::StdoutStream; diff --git a/codex-rs/core/src/exec_tests.rs b/codex-rs/core/src/exec_tests.rs index fc312ec88e..50b7199acf 100644 --- a/codex-rs/core/src/exec_tests.rs +++ b/codex-rs/core/src/exec_tests.rs @@ -1,4 +1,5 @@ use super::*; +use codex_sandbox::IO_DRAIN_TIMEOUT_MS; use codex_protocol::config_types::WindowsSandboxLevel; use pretty_assertions::assert_eq; use std::collections::HashMap; diff --git a/codex-rs/core/src/landlock.rs b/codex-rs/core/src/landlock.rs deleted file mode 100644 index 296cb65639..0000000000 --- a/codex-rs/core/src/landlock.rs +++ /dev/null @@ -1,3 +0,0 @@ -pub(crate) use codex_sandbox::allow_network_for_proxy; -pub(crate) use codex_sandbox::create_linux_sandbox_command_args_for_policies; -pub(crate) use codex_sandbox::spawn_command_under_linux_sandbox; diff --git a/codex-rs/core/src/lib.rs b/codex-rs/core/src/lib.rs index 0cfc69ae13..6bbea1f05c 100644 --- a/codex-rs/core/src/lib.rs +++ b/codex-rs/core/src/lib.rs @@ -45,7 +45,6 @@ pub mod git_info; mod guardian; mod hook_runtime; pub mod instructions; -mod landlock; pub mod mcp; mod mcp_connection_manager; mod mcp_tool_approval_templates; @@ -78,8 +77,6 @@ mod text_encoding; pub use codex_login::token_data; mod truncate; mod unified_exec; -mod windows_sandbox; -mod windows_sandbox_read_grants; pub use client::X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER; pub use model_provider_info::DEFAULT_LMSTUDIO_PORT; pub use model_provider_info::DEFAULT_OLLAMA_PORT; @@ -125,7 +122,6 @@ mod seatbelt; pub mod shell; pub mod shell_snapshot; pub mod skills; -mod spawn; pub mod state_db; mod tools; pub mod turn_diff_tracker; diff --git a/codex-rs/core/src/sandboxing/mod.rs b/codex-rs/core/src/sandboxing/mod.rs index 2656a30804..4e9107006a 100644 --- a/codex-rs/core/src/sandboxing/mod.rs +++ b/codex-rs/core/src/sandboxing/mod.rs @@ -6,7 +6,6 @@ pub(crate) use codex_sandbox::CommandSpec; pub(crate) use codex_sandbox::ExecRequest; pub(crate) use codex_sandbox::SandboxManager; pub(crate) use codex_sandbox::SandboxPermissions; -pub(crate) use codex_sandbox::SandboxPreference; pub(crate) use codex_sandbox::SandboxTransformError; pub(crate) use codex_sandbox::effective_file_system_sandbox_policy; pub(crate) use codex_sandbox::intersect_permission_profiles; diff --git a/codex-rs/core/src/spawn.rs b/codex-rs/core/src/spawn.rs deleted file mode 100644 index aa30900cbc..0000000000 --- a/codex-rs/core/src/spawn.rs +++ /dev/null @@ -1,3 +0,0 @@ -pub(crate) use codex_sandbox::CODEX_SANDBOX_ENV_VAR; -pub(crate) use codex_sandbox::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR; -pub(crate) use codex_sandbox::StdioPolicy; diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs index bf386a12d0..f70d18928e 100644 --- a/codex-rs/core/src/tools/sandboxing.rs +++ b/codex-rs/core/src/tools/sandboxing.rs @@ -23,6 +23,7 @@ use codex_protocol::permissions::FileSystemSandboxPolicy; use codex_protocol::permissions::NetworkSandboxPolicy; use codex_protocol::protocol::AskForApproval; use codex_protocol::protocol::ReviewDecision; +use codex_sandbox::SandboxPreference; use futures::Future; use futures::future::BoxFuture; use serde::Serialize; @@ -280,14 +281,7 @@ pub(crate) trait Approvable { ) -> BoxFuture<'a, ReviewDecision>; } -#[derive(Clone, Copy, Debug, PartialEq, Eq)] -pub(crate) enum SandboxablePreference { - Auto, - #[allow(dead_code)] // Will be used by later tools. - Require, - #[allow(dead_code)] // Will be used by later tools. - Forbid, -} +pub(crate) type SandboxablePreference = SandboxPreference; pub(crate) trait Sandboxable { fn sandbox_preference(&self) -> SandboxablePreference; diff --git a/codex-rs/core/src/windows_sandbox.rs b/codex-rs/core/src/windows_sandbox.rs deleted file mode 100644 index 2277b42ea3..0000000000 --- a/codex-rs/core/src/windows_sandbox.rs +++ /dev/null @@ -1,17 +0,0 @@ -pub(crate) use codex_sandbox::ELEVATED_SANDBOX_NUX_ENABLED; -pub(crate) use codex_sandbox::WindowsSandboxLevelExt; -pub(crate) use codex_sandbox::WindowsSandboxMode; -pub(crate) use codex_sandbox::WindowsSandboxSetupMode; -pub(crate) use codex_sandbox::WindowsSandboxSetupRequest; -pub(crate) use codex_sandbox::elevated_setup_failure_details; -pub(crate) use codex_sandbox::elevated_setup_failure_metric_name; -pub(crate) use codex_sandbox::legacy_windows_sandbox_mode; -pub(crate) use codex_sandbox::legacy_windows_sandbox_mode_from_entries; -pub(crate) use codex_sandbox::resolve_windows_sandbox_mode; -pub(crate) use codex_sandbox::resolve_windows_sandbox_private_desktop; -pub(crate) use codex_sandbox::run_elevated_setup; -pub(crate) use codex_sandbox::run_legacy_setup_preflight; -pub(crate) use codex_sandbox::run_setup_refresh_with_extra_read_roots; -pub(crate) use codex_sandbox::run_windows_sandbox_setup; -pub(crate) use codex_sandbox::sandbox_setup_is_complete; -pub(crate) use codex_sandbox::windows_sandbox_mode_tag; diff --git a/codex-rs/core/src/windows_sandbox_read_grants.rs b/codex-rs/core/src/windows_sandbox_read_grants.rs deleted file mode 100644 index 2e6ae90e5a..0000000000 --- a/codex-rs/core/src/windows_sandbox_read_grants.rs +++ /dev/null @@ -1 +0,0 @@ -pub(crate) use codex_sandbox::grant_read_root_non_elevated; diff --git a/codex-rs/exec/Cargo.toml b/codex-rs/exec/Cargo.toml index cc9a64bf8c..08e86c7702 100644 --- a/codex-rs/exec/Cargo.toml +++ b/codex-rs/exec/Cargo.toml @@ -26,7 +26,6 @@ codex-core = { workspace = true } codex-feedback = { workspace = true } codex-otel = { workspace = true } codex-protocol = { workspace = true } -codex-sandbox = { workspace = true } codex-utils-absolute-path = { workspace = true } codex-utils-cli = { workspace = true } codex-utils-elapsed = { workspace = true } @@ -57,6 +56,7 @@ uuid = { workspace = true } [dev-dependencies] assert_cmd = { workspace = true } codex-apply-patch = { workspace = true } +codex-sandbox = { workspace = true } codex-utils-cargo-bin = { workspace = true } core_test_support = { workspace = true } libc = { workspace = true } diff --git a/codex-rs/linux-sandbox/Cargo.toml b/codex-rs/linux-sandbox/Cargo.toml index 060274ba82..65f0d07871 100644 --- a/codex-rs/linux-sandbox/Cargo.toml +++ b/codex-rs/linux-sandbox/Cargo.toml @@ -28,6 +28,7 @@ serde_json = { workspace = true } url = { workspace = true } [target.'cfg(target_os = "linux")'.dev-dependencies] +codex-core = { workspace = true } pretty_assertions = { workspace = true } tempfile = { workspace = true } tokio = { workspace = true, features = [ diff --git a/codex-rs/mcp-server/Cargo.toml b/codex-rs/mcp-server/Cargo.toml index cc2f3c4769..f05b060cbc 100644 --- a/codex-rs/mcp-server/Cargo.toml +++ b/codex-rs/mcp-server/Cargo.toml @@ -21,8 +21,6 @@ codex-arg0 = { workspace = true } codex-core = { workspace = true } codex-features = { workspace = true } codex-protocol = { workspace = true } -codex-sandbox = { workspace = true } -codex-shell-command = { workspace = true } codex-utils-cli = { workspace = true } codex-utils-json-to-toml = { workspace = true } rmcp = { workspace = true } @@ -41,6 +39,8 @@ tracing = { workspace = true, features = ["log"] } tracing-subscriber = { workspace = true, features = ["env-filter", "fmt"] } [dev-dependencies] +codex-sandbox = { workspace = true } +codex-shell-command = { workspace = true } core_test_support = { workspace = true } mcp_test_support = { workspace = true } os_info = { workspace = true } diff --git a/codex-rs/sandbox/Cargo.toml b/codex-rs/sandbox/Cargo.toml index 7cad7462e2..8df878a979 100644 --- a/codex-rs/sandbox/Cargo.toml +++ b/codex-rs/sandbox/Cargo.toml @@ -28,7 +28,6 @@ dirs = { workspace = true } dunce = { workspace = true } encoding_rs = { workspace = true } libc = { workspace = true } -serde = { workspace = true, features = ["derive"] } serde_json = { workspace = true } thiserror = { workspace = true } tokio = { workspace = true, features = [ diff --git a/codex-rs/sandbox/src/exec.rs b/codex-rs/sandbox/src/exec.rs index 4c7eff1a63..87c13837d7 100644 --- a/codex-rs/sandbox/src/exec.rs +++ b/codex-rs/sandbox/src/exec.rs @@ -192,6 +192,17 @@ pub enum SandboxType { WindowsRestrictedToken, } +impl SandboxType { + pub fn as_metric_tag(self) -> &'static str { + match self { + SandboxType::None => "none", + SandboxType::MacosSeatbelt => "seatbelt", + SandboxType::LinuxSeccomp => "seccomp", + SandboxType::WindowsRestrictedToken => "windows_restricted_token", + } + } +} + #[derive(Clone)] pub struct StdoutStream { pub sub_id: String,