## What changed
- Verify that freeform `apply_patch` calls and shell-intercepted patches cannot modify `.git/config` through `.GIT/config` when approvals are disabled, while an ordinary workspace file remains writable.
- Add macOS Seatbelt coverage for uppercase protected metadata paths, including absent directories, existing directories with either casing, and case variants of the workspace root. Assert that metadata creation and modification are denied while sibling workspace writes succeed.
The tests skip filesystems that do not support the case-insensitive aliases they exercise.
GitOrigin-RevId: 5cf6b0c36eee348e1ba0db0bc2d3bff072458364
## Why
PSEC API symbols can be present on transitional Windows builds where MXC is not enabled. Availability detection needs to verify that a native process security environment can actually be created.
## What changed
- Replace `mxc-sdk` with pinned `appcontainer_common`, `learning_mode_windows`, and `wxc_common` dependencies, and update Cargo and Bazel dependency metadata.
- Use MXC's cached create/close probe for `is_available()` and query native deny-path support through `SecurityEnvironmentApi` before launching requests with denied paths.
- Adapt request construction and the existing policy test to the vector-based environment field, and update the sandbox documentation.
GitOrigin-RevId: e8cc6a35d46884d0a069b747d33e711512ec1596
## What changed
Export `run_integrity_checks` from `exec-server` to check whether the effective filesystem policy permits writing containment dependencies on Linux, macOS, and Windows. Run preparation and checks on a blocking worker, limit waiting to five seconds, and keep results observational without affecting execution.
Skip mismatched sandbox backends, full-disk-write policies, and `EscalatedSandboxWithRestrictions` overrides. Continue checking ordinary configured policies with root write access and deny restrictions.
Record check outcomes, preparation time, and total duration with bounded metric tags that omit filesystem paths.
## Testing
Add coverage for findings, clean results, missing dependencies, preparation errors, eligibility rules, and timeouts. Verify that timed-out workers emit no late results and that metrics contain no filesystem paths.
GitOrigin-RevId: a234f4a2f629f9bb090da622cea352c99456cb00
## What changed
Add Linux dependency discovery and policy preparation to `exec-server`'s sandbox integrity module. Inventory bundled and system `bwrap` candidates and the deny-glob scanner using the launcher's location and the command's `PATH` and working directory.
Resolve `:tmpdir` and tilde-prefixed deny globs using the command's `TMPDIR` and `HOME`, with account home-directory fallback. Reuse Linux sandbox helpers to expand deny globs in the command's explicit environment.
## Testing
Add Linux tests covering symlinked launchers, relative and empty `PATH` entries, and empty, relative, and tilde-prefixed `TMPDIR` values alongside home-relative deny globs.
GitOrigin-RevId: fe404fa4be77ece677b22d52d77a7234dbf0cffe
## What changed
Export `FileContentsChecker` and structured integrity findings from `codex-rs/sandboxing` to identify existing containment dependency files whose contents are writable under a prepared filesystem policy. Findings include the requested target, its resolved path, and the write roots that permit modification.
Resolve symlinks in targets, write roots, and read-only carveouts, and respect protected metadata paths and deny globs matching resolved contents. Missing targets produce no finding; non-file targets return an error. Callers remain responsible for dependency inventory, reporting, enforcement, and handling full-disk write access.
## Testing
Add unit tests covering write grants, read-only and denied carveouts, overlapping grants, deny globs, symlink resolution, protected metadata, and missing targets.
GitOrigin-RevId: 4f52faed822a1bbb4ed33a9975af0718a5f85662
## What changed
- Replace the separate MXC crates with the pinned `mxc-sdk` 1.0.0 dependency and update Cargo and Bazel lockfiles.
- Use the cached PSEC API-set check for availability and the SDK's native deny-path capability check before launch. Native creation and request-specific capabilities are validated at launch.
- Map empty environments to `None` to retain Windows user-profile defaults, while keeping nonempty environments explicit. Document the SDK's `SystemRoot` and `LOCALAPPDATA` requirements.
- Configure Bazel's LLVM resource compiler for Windows GNU builds, document Cargo's `RC_PATH` requirement, and add `libproc` and `libsandbox` to the macOS SDK libraries.
## Testing
Update the request-building test to verify that nonempty environments remain explicit and empty environments become `None`.
GitOrigin-RevId: f3ccbb92ceaa71f16c5d6cb185a7602a5bb8da53
## What changed
Move `SandboxOverride` into the shared protocol and carry the controller's selection through tool attempts, execution requests, and exec-server process and filesystem sandbox preparation. Include it as `sandboxOverride` in filesystem sandbox contexts for observation without granting broader permissions or altering sandbox commands.
Default missing values to `NoOverride` and omit that value when serializing to preserve compatibility with existing requests.
## Testing
Extend tests to cover override propagation, wire round-trips for all three variants, and deserialization of requests without `sandboxOverride`.
GitOrigin-RevId: 2f438cf4aef1134e3149959d14aa731682168ae5
## Why
Resolving unapproved hostnames discloses them to DNS even when the proxy ultimately rejects the request. Allowing local binding in a managed macOS sandbox also granted direct outbound access to port `53`.
## What changed
- Require an allowlist match or policy approval before resolving a hostname for address checks.
- Recheck baseline restrictions after local and remote policy approval so approval cannot bypass explicit denies or local/private address restrictions.
- Preserve DNS checks for inner HTTPS requests after an approved CONNECT, including hosts without a persisted allowlist entry.
- Remove the Seatbelt allowance for external DNS while retaining local binding and loopback proxy access.
## Testing
Add regression tests for zero DNS lookups on unapproved hosts, private-address rejection after approval, local and remote approval ordering, and DNS checks after approved CONNECT requests. Add a macOS Seatbelt child test that verifies external UDP and TCP port `53` access is denied while local binding and proxy connectivity remain available.
GitOrigin-RevId: 490790462c51928e831dd8375ac098bc3a257bac
## Why
Windows temp grants could fall back to host `TEMP`/`TMP` values and bypass read-only or denied subpaths. Sandbox permissions must match the environment passed to the child process.
## What changed
- Resolve `:tmpdir` from absolute `TEMP`/`TMP` paths in the completed workload environment, preserving access modes and missing-path rules without falling back to host values.
- Deduplicate Windows environment keys case-insensitively in a deterministic order so permission resolution and the child environment select the same value.
- Use the resolved temp policy for elevated sandbox overrides across core execution, exec-server, and direct spawning.
- Launch direct-spawn sandbox wrappers with the supplied Codex executable, materializing an inner helper only when it is that executable.
## Testing
Add Windows regression coverage for temp-only writes, read-only and denied carveouts, mixed-case and duplicate environment keys, unavailable temp paths, and empty or missing write-root overrides. Exercise core execution and direct spawning, and extend exec-server RPC coverage to the elevated backend with temp values set through the environment policy.
GitOrigin-RevId: 16b8bd4702cc434fd743a08c75a3e4515780bff3
## Why
Bubblewrap discovery probes executables before confinement. Excluding only the command's current directory leaves candidates in other writable roots eligible to run outside the sandbox.
## What changed
- Filter canonical `PATH` candidates using the filesystem policy and effective user permissions, including writable ancestors, symlinked roots, and full-disk write access. Preserve protected system installations while rejecting replaceable paths.
- Select the launcher with the command's permissions before the proc-mount preflight, retaining the bundled bubblewrap fallback.
- Use the effective permission profile and policy working directory for startup warning probes.
## Testing
Add unit coverage for writable roots, symlinks, read-only carveouts, replaceable parents, and full-disk policies. Add Linux integration tests showing writable `bwrap` candidates are neither probed nor launched, including when the command runs in a workspace subdirectory or uses managed networking with full-disk write access.
GitOrigin-RevId: 188c9f45e727eaace062f5abb1205dc23fdf3c51
## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
System libcurl needs access to `com.apple.TrustEvaluationAgent` for TLS, but Seatbelt network profiles did not allow lookup of this service.
## What changed
Allow `mach-lookup` for this service when unrestricted networking is enabled or a restricted profile permits proxy ports or local binding. Keep access denied for network-disabled, Unix-socket-only, and managed profiles without usable endpoints.
## Testing
Add macOS regression tests that apply Seatbelt policies and check trust-service access and loopback connections without external network dependencies. Cover managed-network overrides and verify that unrelated service lookups and connections to unapproved ports remain denied.
GitOrigin-RevId: 8b190d6181fe1321186837557caa379275abfaee
## Why
AWS profiles can select credential helpers that the application executes. Granting write access to a containing directory should therefore keep `.aws` protected by default.
## What changed
Add `.aws` to the protected metadata paths alongside `.git`, `.agents`, and `.codex`, including workspace roots and additional writable roots. Preserve explicit user rules that override the default protection.
## Testing
Extend policy and sandbox tests to cover `.aws` protection. Add macOS coverage for existing and absent `.aws` directories, deletion and replacement attempts, and symlink targets. Verify that Linux sandbox writes to protected configuration files fail while sibling files remain writable.
GitOrigin-RevId: 31ea287bd0dd9b13aff893783fba9ca3aed0c89d
## Why
When a container denies fresh `/proc` mounts, the existing sandbox fallback retains the caller's `/proc` while creating a new PID namespace. Process IDs inside the sandbox can then differ from those exposed by `/proc`, breaking process lookups.
## What changed
- Add `codex exec-server --linux-sandbox-pid-namespace=inherit` to reuse the caller's PID namespace and `/proc` for both process and filesystem helpers. Repository config and command environment variables cannot enable it.
- Keep `isolate` as the default, preserving the existing mount fallback and compatibility with older helpers. Inheritance requires an updated helper and omits `--unshare-pid` and `--as-pid-1`.
- Preserve other sandbox restrictions. With `:minimal`, bind the inherited `/proc` read-only with its container masks and apply explicit filesystem denials afterward.
Inheritance is intended for dedicated environments: it allows sandboxed commands to signal other same-UID processes, including the executor.
## Testing
Add unit and integration coverage for namespace flags, denied proc mounts, consistent process IDs, retained sandbox restrictions, and startup-only selection across process and filesystem helpers.
GitOrigin-RevId: dd13f2b9286d7edcf366b3a42a455f4d78daaf27
## Why
A `.git` pointer can resolve to a Git directory inside another writable root. Broader Seatbelt grants or later bubblewrap mounts can leave that directory writable despite its metadata protections.
## What changed
Include resolved Git directories in read-only exclusions for broader writable roots on Linux and macOS. Resolve symlink aliases when locating exclusion targets and retain explicit policy overrides.
## Testing
Add regression tests for Git directories reached directly or through symlink aliases in another writable root, and for linked worktree metadata under the macOS temporary directory. Verify that metadata writes are denied while ordinary files in the surrounding writable root remain writable.
GitOrigin-RevId: 6971f1cf35008d23eaeb0d02a9c61bee7cf83b12
## Why
Global deny globs such as `/**/.env` unnecessarily block directory renames and removals on macOS. Moving an ancestor does not let a matching basename escape these rules.
## What changed
Skip ancestor unlink restrictions for root-anchored recursive globs with a literal basename. Keep matching files protected and extend the deny to descendants of matching directories. Preserve ancestor protection for scoped, multi-component, and nonliteral patterns.
## Testing
Add Seatbelt tests covering directory moves and removals, continued protection after moves, symlink access, matching directory descendants, and files created after policy generation. Verify that scoped and nonliteral deny patterns still block ancestor moves.
GitOrigin-RevId: 4e8ea601e8ea98c4da5e3a3fe0d8ce2c63013bc5
## Why
Expanded recursive deny lists can exceed the Windows command-line limit, preventing sandbox wrappers and setup helpers from launching.
## What changed
- Use chunked environment transport for wrapper and non-elevating setup payloads above 24,000 UTF-16 code units, preserving the existing argument protocol for smaller requests.
- Share the transport with the MXC launcher, supporting payloads up to 16 MiB with Unicode-safe chunking and validation.
- Keep transport variables out of the workload environment and remove inherited chunks before launching setup helpers.
## Testing
Add coverage for transport boundaries, Unicode round trips, malformed payload rejection, environment cleanup, and large payloads crossing Windows process creation. Extend the elevated sandbox integration test with 1,000 nested denied files to verify read restrictions and `AGENTS.md` discovery with a payload exceeding the command-line limit.
GitOrigin-RevId: 8ef92fdc7d534143f0eac76036a2173a6f585d08
## Why
Local `apply_patch` permission checks can treat a macOS system alias and its canonical spelling as different locations, sending writes covered by temporary-directory grants for unnecessary approval.
## What changed
- Normalize trusted top-level aliases in local policy roots and patch targets, reusing a prepared matcher for permission requests and patch safety checks.
- Share alias normalization with Seatbelt and the macOS executor sandbox while preserving mutable symlinks and missing descendants.
- Preserve read-only and deny precedence, protected metadata restrictions, and remote URI matching. Propagate normalization failures from fallible permission checks.
## Testing
Add macOS regressions for multi-file patches with missing parent directories through both direct `apply_patch` calls and shell interception, asserting automatic approval and file contents. Add unit coverage for alias restriction precedence, mutable symlink preservation, missing descendants, and remote permission isolation.
GitOrigin-RevId: 0822ff951eaab728cb1ad91281745fa1b8809f15
## Why
Passing extra descriptors to a PTY previously selected behavior intended for inherited escalation sockets: no EOF on stdin close, different signal exit statuses, and no default `SHELL`. Launch attachments need ordinary PTY behavior and must survive execution even when marked `FD_CLOEXEC`.
## What changed
- Add `ChildFds::Attached` alongside `ChildFds::Inherited` to distinguish launch attachments from legacy inherited descriptors.
- Preserve ordinary EOF, default `SHELL`, and signal exit status behavior for PTY attachments.
- Allow explicitly supplied close-on-exec descriptors through pipe and PTY launches without changing the parent's descriptor flags, using child-side flag updates and macOS spawn inheritance actions.
- Update existing callers to use `ChildFds::Inherited`.
## Testing
Add Unix coverage for attachment accessibility, unchanged parent descriptor flags, default `SHELL`, and signal exit statuses. Extend the PTY stdin-draining test to cover attachments and EOF delivery.
GitOrigin-RevId: 864aedc6c5717d8b43c9d71057c9f54409834509
## Why
Detached work can keep request spans open beyond response enqueueing. Record explicit phase timings to distinguish request handling from the full span lifetime.
## What changed
- Record server dispatch and response enqueue offsets from request receipt, plus a response enqueue event for HTTP responses that bypass the dispatcher.
- Emit client request enqueue and response receipt events, including success or server-error outcomes and reader-to-caller delay. Carry completion timestamps to the awaiting task so receipt events retain its tracing context.
- Add spans for process startup, sandbox preparation, shell snapshot preparation and capture, and process spawning. Record process identifiers only when nonempty and at most 64 bytes long.
GitOrigin-RevId: 237db898b3284fe8a6a36cb0055b3c7991d8e8a4
## Why
Implicit temporary-directory grants can bypass filesystem restrictions and
protected project metadata. Moving an ancestor can also relocate protected
paths beyond their pathname exclusions.
## What changed
- Route process scratch access through the normal Seatbelt exclusion rules so
it respects unreadable paths, read-only paths, and protected project metadata.
- Protect the parents of both logical symlink paths and their resolved targets
against relocation.
- Apply privileged daemon socket protections after all grants, deny access to
the socket directory itself, and prevent ancestor removal or renaming while
allowing sibling writes.
GitOrigin-RevId: f4cbcf5867e204b0cded0812aac1851b3d444328
## What changed
- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.
## Testing
Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.
GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4
## Why
`F_MAKECOMPRESSED` and `F_TRANSFEREXTENTS` can mutate files through read-only descriptors, bypassing `file-write*` and `file-ioctl` restrictions. Even a deny-default Seatbelt policy needs an explicit denial for these operations.
## What changed
Deny `system-fcntl` commands `80` and `110` whenever the filesystem sandbox policy lacks full disk write access.
## Testing
Add macOS regression tests that run Seatbelt children under read-only and workspace-write policies, assert both operations fail with `EPERM`, and verify file contents and metadata remain unchanged. An unrestricted positive control verifies the mutations, allowing for unsupported extent transfers.
GitOrigin-RevId: 7a7a5ef30f9ff658a86071b51f1f7b4952d5cdad
## What changed
- Add `Platform` to `codex-utils-path-uri` with metadata parsing, native platform detection, and path convention mapping. Preserve missing or unrecognized metadata as `Unknown`.
- Replace `NetworkProxyExecutorOs` with the shared type and keep executor-specific socket path validation in the network proxy.
- Extract `effective_sandbox_mode` with explicit platform and Windows sandbox level inputs, preserving the native Windows fallback from `workspace-write` to `read-only` when the sandbox is disabled.
## Testing
Add unit tests for platform metadata, path conventions, native platform detection, and sandbox mode selection across platforms and Windows sandbox levels.
GitOrigin-RevId: 4fe0972e3a91040e35f2a6dfa5bcdf6c9a29be88
## Why
A controller and its executor can run different operating systems. Validating socket paths against the controller's OS can reject absolute paths that are valid on the executor, such as Windows paths on a Linux controller.
## What changed
- Thread `NetworkProxyExecutorOs` through network policy validation, proxy construction, and policy updates.
- Require allowed socket paths to be NUL-free and absolute for the executor OS, while preserving deny entries unchanged.
- Accept either Unix or Windows absolute syntax when executor metadata omits the OS, then validate against the executor's own OS at launch.
- Keep native path normalization and socket support checks at execution time.
## Testing
Add coverage for cross-platform absolute path syntax, invalid allow entries, preserved deny entries, and remote policy round trips that retain executor semantics through domain edits and proxy construction.
GitOrigin-RevId: 1ebc09cbce7138f60ec5fd62875591a3df52d067
## What changed
- Accept `windows.sandbox = "mxc"` and preserve the selected backend through environment configuration, command execution, patch writes, and sandbox metadata.
- Treat MXC as enabled in the TUI and report Windows sandbox readiness as `ready`, avoiding legacy setup prompts.
- Keep `allowed_sandbox_implementations` scoped to the legacy elevated and unelevated backends without restricting MXC.
- Default `windows.sandbox_private_desktop` to `false` for MXC while retaining `true` for legacy sandboxes.
## Testing
Add coverage for MXC configuration precedence, legacy requirement handling, sandbox selection, and TUI state. Add a Wine integration test that verifies command and patch routing fails when native MXC is unavailable and reports `windows_mxc` in turn metadata.
GitOrigin-RevId: e2162447d0750f60753864c92a20e02a7f297bca
## Why
An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.
## What changed
- Preserve omission of `dangerously_allow_all_unix_sockets` separately from `false`, and retain explicitly empty `unix_sockets` maps.
- Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
- Resolve omitted values to `false` for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
- Add debug logging for effective environment and remote execution network policies.
## Testing
Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.
GitOrigin-RevId: 98a88d01cbb91aea1faaa03b3c414ef3be7af398
## Why
Network access and Unix-socket allowlists must not let commands with filesystem restrictions reach the privileged app-server RPC transport.
## What changed
- Bind Unix control sockets in a fixed, user-owned directory with mode `0700`, independent of environment settings, and expose the advertised paths as symlinks. Preserve existing parent permissions, reject unsafe parents, and serialize socket setup and publication.
- Mask the socket directory in Linux bubblewrap sandboxes after each bind that exposes it. Reject host mount aliases and nested mounts that compromise isolation.
- Deny access to the directory and outbound connections to its sockets in macOS Seatbelt policies, including when network access or Unix-socket allowlists grant broader access.
- Require bubblewrap for filesystem-restricted Linux execution. Users with `features.use_legacy_landlock` enabled must disable it for these policies.
## Testing
Add regression coverage for direct and symlink socket access, hardlink attempts, Linux host-process links and bind-mount aliases, and continued use of unrelated and sandbox-local sockets. Add transport coverage for parent permissions, concurrent restart after a stale symlink, and cleanup that preserves a replacement at the advertised path.
GitOrigin-RevId: 53372c27eea278d964f2cf68aed24323ef3b7082
## Why
MXC is a sandbox implementation, not a restricted-token sandbox level. Executor requests need to represent that choice separately from `WindowsSandboxLevel`.
## What changed
- Introduce `WindowsSandboxSelection` for executor sandbox contexts and remove `Mxc` from `WindowsSandboxLevel`.
- Preserve the `windowsSandboxLevel` wire field and its serialized values for compatibility.
- Share sandbox selection between executor process launches and filesystem helpers, and use the new selection in capability discovery and skill reads.
- Disable Windows sandbox selection for executor paths that do not use Windows path conventions.
## Testing
Extend coverage for MXC wire serialization, Windows skill-read sandbox checks, and capability discovery with distinct permissions. Exercise remote filesystem write restrictions with both restricted-token and MXC sandboxes, including rejection when native MXC is unavailable.
GitOrigin-RevId: 266211377bcb138a0dc75861e9ff2225fa37a53d
## What changed
- Capture `CODEX_WINDOWS_REGISTERED_CORE=1` at startup and propagate the selected runtime to sandbox wrappers.
- Launch registered runners through service-recorded execution aliases, validating ownership, OS package identity, and the staged runner image before sending commands. Require service provisioning without falling back to copied helpers or `PATH` lookup.
- Preserve package context for sandboxed child processes and descendants so they can launch executables from the protected package directory.
- Refresh stale package registrations during readiness checks without blocking unrelated RPCs, and reconcile effective proxy settings through the service.
- Resolve setup ownership from the process token and avoid treating the server directory as a writable workspace when setup omits `cwd`.
- Record startup and command outcomes by runtime.
## Testing
Add coverage for runtime selection, package query validation, helper resolution, setup roots, proxy reconciliation, and command result reporting. Add an ignored integration test for environment forwarding, output, and exit status that requires an installed test MSIX and service provisioning in a Windows VM.
GitOrigin-RevId: 976d64039d611be4406c3d0e354820775f8eb6e4
## Why
Seatbelt ignored Unix socket permissions in `ManagedNetworkSandboxContext`, which could omit allowed sockets or inherit a live proxy's broader permissions.
## What changed
Use the prepared context's `allow_unix_sockets` and `dangerously_allow_all_unix_sockets` settings when present, falling back to the live proxy only when no prepared context exists. Normalize allowlisted paths and preserve explicit extra socket allowances.
## Testing
Add regression coverage for prepared-policy precedence, empty allowlists, invalid relative paths, and explicit extra allowances. Extend macOS exec-server tests to cover prepared and executor-local proxy socket permissions, including explicit allow-all behavior without unrestricted network access.
GitOrigin-RevId: 3372e1f2f1b161e60bde585db8d70b4e3a0b1854
## Why
Linux proxy-routed sandboxing denied standalone Unix sockets even when the effective network policy enabled `dangerously_allow_all_unix_sockets`.
## What changed
- Carry Unix socket permissions in `ManagedNetworkSandboxContext` and pass the prepared context through Linux sandbox launches with `--managed-network`.
- Allow `AF_UNIX` socket creation in proxy-routed mode when `dangerously_allow_all_unix_sockets` is enabled, while preserving network namespace isolation and restrictions on other socket families.
- Keep standalone Unix sockets denied by default and for path-only grants. Default missing fields in older serialized contexts to restrictive values.
## Testing
Add coverage for policy preparation and transport, legacy deserialization, and malformed policy rejection. Add a Linux integration test covering default denial, path-only denial, and explicit allow-all access, while checking that direct TCP access and `AF_NETLINK`/`AF_VSOCK` sockets remain blocked.
GitOrigin-RevId: 2695b945ad3e59fcb3faf7662d852a26650af16c
## What changed
- Add explicit MXC backend selection and carry its identity through exec-server process reporting and sandbox violation classification.
- Launch MXC through the Codex executable with the effective permission profile and command environment.
- Reject exec-server MXC requests when native MXC is unavailable or when they request a TTY, an `arg0` override, or managed networking. Reject private desktop isolation during MXC preparation.
- Allow an explicitly empty child environment and avoid exposing request payload values in launcher decode errors.
## Testing
Add coverage for sandbox selection and unsupported-request rejection, plus Windows RPC tests for stdin writes and temporary-directory permissions derived from the command environment. Native MXC tests skip when MXC is unavailable.
GitOrigin-RevId: 3626ff0f9ad7f9b812ce09b68c31ea9a5a9c72b1
## What changed
- Dispatch `--__codex-windows-mxc` before normal CLI parsing, launch the decoded request, and propagate the child exit code.
- Build the native request from the helper's environment and working directory, discovered Windows platform directories, and volume roots, including UNC working-directory roots. Reject non-Unicode environment values and empty child environments.
- Allow Win32k calls and desktop handles needed for PowerShell startup while retaining clipboard, input-injection, and desktop/system-control restrictions.
- Keep policy, transport, and native launch internals private, and report an explicit error when the helper is invoked outside Windows.
## Testing
Add a wrapper regression test covering exact argument preservation, Windows quoting, separate policy and command working directories, and explicit environment forwarding.
GitOrigin-RevId: 674d0d61a3265bd517b77da9f9de2cd9fad62917
## Why
Private desktops owned by short-lived sandbox wrappers disappear when those wrappers exit, preventing reuse across filesystem helper requests.
## What changed
- Select and cache private desktops in the calling process, keeping desktops separate for different sandbox permissions.
- Pass the desktop name through the wrapper to the restricted-token and elevated backends so helpers reuse the selected desktop.
- Separate sandbox account preparation from filesystem ACL refresh so desktop selection does not perform the wrapper's refresh.
- Propagate desktop preparation errors and require a desktop name when the wrapper's private desktop flag is set.
## Testing
Add a Windows filesystem regression test covering desktop survival and reuse across reads, writes, metadata queries, and streaming reads, plus separate read-only permissions and rejected writes. Extend wrapper argument tests to cover named desktops and rejection of a missing desktop name.
GitOrigin-RevId: 05a1cb829a902732248bfa7f4ad7470d911fa9f6
## What changed
- Add `codex-mxc-sandbox` with native MXC availability detection and a launcher that inherits standard I/O and waits for the sandboxed process.
- Reject unsupported learning-mode and fallback policies, and verify deny-path support before launch.
- Route the existing Windows MXC availability metric through the new crate and move its Windows linking dependencies alongside the adapter.
GitOrigin-RevId: e2a220b85718e00b0e710c30bbe66b6c56958176
## Why
`ShellExecuteExW` needs `SystemRoot` to elevate the Windows sandbox setup helper.
## What changed
Add `SYSTEMROOT` to the environment variables copied from the host for wrapper
setup. Keep the serialized inner command environment unchanged so the host value
is available only to the wrapper.
## Testing
Extend Windows sandbox manager tests to cover case-insensitive replacement of
`SystemRoot` and verify that it is excluded from the inner command environment.
GitOrigin-RevId: c69f9f92665e97a178e2de488fbb9fd6b7ff7ac6
## What changed
- Add the macOS-only `allow_symlinked_codex_home` user setting. When enabled in the execution host's `$CODEX_HOME/config.toml`, writable roots at or beneath that home may traverse symlinks.
- Keep the exception disabled by default and prevent project config, command-line overrides, and ignored user config from enabling it. Other writable roots remain subject to symlink checks.
- Propagate the resolved setting through local, interactive, and exec-server sandbox paths, including `CODEX_HOME` aliases.
- Explain the opt-out in symlink rejection errors, including that it trusts targets outside `CODEX_HOME` and targets that change between commands.
## Testing
- Add macOS coverage for shell commands, patches, filesystem helpers, process execution, and interactive startup with enabled, disabled, aliased, and out-of-scope homes.
GitOrigin-RevId: 99fcdf611200c9e1b7713cf06f7fdea5bfa7f089
## What changed
Increment the `codex.windows_sandbox.private_desktop` counter when preparing a
Windows restricted-token sandbox execution, tagging it with whether private
desktop isolation is enabled.
GitOrigin-RevId: 1eb5e183b57e19753dc133dbe152eabe23dd2a23
## What changed
- Pass the selected executor's `PathUri` through user command approval requests instead of converting the working directory to a host-native path.
- Make native-path permission helpers explicitly local and require executor-aware permission transforms to receive a `FileSystemSandboxPolicyContext`.
- Cover approved remote commands to verify that the approval request reports the selected remote working directory and execution resumes after approval.
GitOrigin-RevId: 0aa3042f2d7594af6c7d0abf31d7f99cf67d5556
## Why
`request_permissions` paths and grants need to be evaluated against the selected executor environment, including its path convention, home directory, workspace roots, and temporary directories.
## What changed
- Resolve relative and home-relative permission paths using the executor context, reject mismatched path conventions and lossy paths, and support legacy `read` and `write` path lists.
- Move grant intersection into core so requested and granted permissions use the originating environment's sandbox context. Preserve deny entries conservatively when a special path cannot be resolved.
- Keep the full originating environment with pending permission requests so delayed responses are normalized against the same context.
## Testing
- Cover POSIX, Windows, UNC, relative, and home-relative path resolution and invalid path contexts.
- Verify end-to-end app-server grants are limited to the requested workspace scope and unresolved temporary-directory denies are preserved.
GitOrigin-RevId: 730a2aacd391262e92a6314f3a5b6c262e3dca10
## What changed
- Probe whether the native Windows MXC process security environment is usable
when selecting a sandbox.
- Emit `codex.windows_mxc.available` at most once per process, labeled with the
probe result.
- Add the MXC workspace dependencies for Cargo and Bazel, and pin
`tracelogging` to a version compatible with the GNU Windows toolchain.
GitOrigin-RevId: d7cfeed6f0333feda5764e1ee44fe5bbd50f9a58
## Why
Permission grants can belong to an executor whose path convention differs from
the local host, such as a Windows remote environment. Matching those grants
against a host-native working directory can reject valid permissions.
## What changed
- Normalize, materialize, and compare additional filesystem permissions using
the selected executor's URI-based sandbox context.
- Apply the same context-aware preapproval flow to `exec_command`,
`apply_patch`, and extension tools.
- Fail closed when symbolic temporary-directory or project-root permissions
cannot be resolved from executor metadata, while accepting opaque working
directory URIs when requested paths use the executor's convention.
## Testing
- Added coverage for reusing a Windows permission grant from a non-Windows
host, resolving symbolic temporary-directory grants, and normalizing paths
with an opaque Windows working directory.
GitOrigin-RevId: aee54350a25430a0443f8319e2bb0bbdc4f44282
## What changed
- Add context-aware normalization, materialization, and intersection helpers for additional filesystem permissions.
- Resolve project roots, home-relative deny globs, temporary directories, and filesystem roots from the executor's `FileSystemSandboxPolicyContext` while preserving URI path conventions and symlinked paths.
- Keep deny constraints when intersecting grants across POSIX, Windows, and UNC paths, and reject incompatible path conventions when executor context is available.
## Testing
- Cover cross-convention validation, empty temporary-directory contexts, home-relative deny globs, and rooted deny globs for POSIX, Windows, and UNC paths.
GitOrigin-RevId: 14fd866a17a0ac4a595aa4f0e2fb82bfae1a8838
## Why
Programs running in a PTY can block while waiting for replies to terminal
queries.
## What changed
- Intercept device-status, window-size, cursor-position, and DEC private-mode
queries from TTY subprocess output and write bounded responses to the
subprocess input.
- Remove handled queries from the output stream while preserving other escape
sequences and output, including queries split across chunks.
- Apply the responder to both direct and driver-backed TTY process spawning.
## Testing
Added tests for driver-backed query handling and for a PTY subprocess that
waits for a cursor-position response before exiting.
GitOrigin-RevId: de92e06d183647271ef49024da9c30f01699f886
## Why
Filesystem policies can describe paths using a convention that differs from the
host running Codex. Native path comparisons can therefore mis-handle cases such
as case-variant Windows paths or ambiguous encoded components.
## What changed
- Resolve policy entries and special roots as `PathUri` values using the
executor's path convention.
- Use validated URI components for containment, overlap, and precedence, and
fail closed when component boundaries are ambiguous.
- Restrict relative joins to descendants and apply the same matching rules to
protected metadata paths and permission-profile intersections.
## Testing
Added coverage for Windows case variants, encoded and opaque paths, repeated
separators, descendant joins, special roots, metadata protection, and preserved
deny entries.
GitOrigin-RevId: fb09d44d11df25faaac806fe00457e6f6b0d8596
## Why
Filesystem helpers should not inherit access to system scratch directories beyond the paths granted by their filesystem policy, while ordinary processes still need scratch access for compatibility.
## What changed
- Move the `/tmp` and `/var/tmp` read/write grants, including their `/private` aliases, from the shared platform defaults into the process-only Seatbelt defaults.
- Keep process access to `/Applications` alongside the scratch-directory grants.
## Testing
Add a macOS Seatbelt test that verifies the generated policies and, when nested Seatbelt execution is available, confirms process scratch access, helper denial, and helper access to an approved project path.
GitOrigin-RevId: 26d83f09c131c1f1d000163b2f8929f601749719
jif