codex

12,519 Commits 4,708 Branches 1,508 Tags

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
jackz	1d804e91b7	Protect `.aws` directories under sandbox writable roots (#48176 ) ## Why AWS profiles can select credential helpers that the application executes. Granting write access to a containing directory should therefore keep `.aws` protected by default. ## What changed Add `.aws` to the protected metadata paths alongside `.git`, `.agents`, and `.codex`, including workspace roots and additional writable roots. Preserve explicit user rules that override the default protection. ## Testing Extend policy and sandbox tests to cover `.aws` protection. Add macOS coverage for existing and absent `.aws` directories, deletion and replacement attempts, and symlink targets. Verify that Linux sandbox writes to protected configuration files fail while sibling files remain writable. GitOrigin-RevId: 31ea287bd0dd9b13aff893783fba9ca3aed0c89d	2026-09-25 19:14:31 +00:00
aionescu-oai	a92ccbde53	Preserve Git directory protections across writable roots (#47974 ) ## Why A `.git` pointer can resolve to a Git directory inside another writable root. Broader Seatbelt grants or later bubblewrap mounts can leave that directory writable despite its metadata protections. ## What changed Include resolved Git directories in read-only exclusions for broader writable roots on Linux and macOS. Resolve symlink aliases when locating exclusion targets and retain explicit policy overrides. ## Testing Add regression tests for Git directories reached directly or through symlink aliases in another writable root, and for linked worktree metadata under the macOS temporary directory. Verify that metadata writes are denied while ordinary files in the surrounding writable root remain writable. GitOrigin-RevId: 6971f1cf35008d23eaeb0d02a9c61bee7cf83b12	2026-09-25 00:29:26 +00:00
jif	8bbe8f8702	Fix read-only metadata mount ordering for nested writable roots (#47623 ) ## Why Nested writable roots must allow the Linux sandbox to start while preserving read-only metadata protections, including when a writable directory sits beneath a read-only `.codex` directory. ## What changed Defer read-only subpath mounts shared with a deeper writable root until that root is bound. Keep symlink target remapping and writable-symlink validation for deferred paths so mount ordering does not bypass those checks. ## Testing Add regression coverage for mounting `.git`, `.agents`, and `.codex` metadata exactly once after the nested writable bind. Add sandbox integration cases for ordinary and symlinked roots, using both parent and nested working directories, to verify startup, allowed writes, metadata protection, and temporary mountpoint cleanup. GitOrigin-RevId: 45e439eaf537e10bfa8b839bad816b0401fb65aa	2026-09-23 18:51:35 +00:00

1d804e91b7

Protect .aws directories under sandbox writable roots (#48176 )

## Why

AWS profiles can select credential helpers that the application executes. Granting write access to a containing directory should therefore keep `.aws` protected by default.

## What changed

Add `.aws` to the protected metadata paths alongside `.git`, `.agents`, and `.codex`, including workspace roots and additional writable roots. Preserve explicit user rules that override the default protection.

## Testing

Extend policy and sandbox tests to cover `.aws` protection. Add macOS coverage for existing and absent `.aws` directories, deletion and replacement attempts, and symlink targets. Verify that Linux sandbox writes to protected configuration files fail while sibling files remain writable.

GitOrigin-RevId: 31ea287bd0dd9b13aff893783fba9ca3aed0c89d

2026-09-25 19:14:31 +00:00

aionescu-oai

a92ccbde53

Preserve Git directory protections across writable roots (#47974 )

## Why

A `.git` pointer can resolve to a Git directory inside another writable root. Broader Seatbelt grants or later bubblewrap mounts can leave that directory writable despite its metadata protections.

## What changed

Include resolved Git directories in read-only exclusions for broader writable roots on Linux and macOS. Resolve symlink aliases when locating exclusion targets and retain explicit policy overrides.

## Testing

Add regression tests for Git directories reached directly or through symlink aliases in another writable root, and for linked worktree metadata under the macOS temporary directory. Verify that metadata writes are denied while ordinary files in the surrounding writable root remain writable.

GitOrigin-RevId: 6971f1cf35008d23eaeb0d02a9c61bee7cf83b12

2026-09-25 00:29:26 +00:00

jif

8bbe8f8702

Fix read-only metadata mount ordering for nested writable roots (#47623 )

## Why

Nested writable roots must allow the Linux sandbox to start while preserving read-only metadata protections, including when a writable directory sits beneath a read-only `.codex` directory.

## What changed

Defer read-only subpath mounts shared with a deeper writable root until that root is bound. Keep symlink target remapping and writable-symlink validation for deferred paths so mount ordering does not bypass those checks.

## Testing

Add regression coverage for mounting `.git`, `.agents`, and `.codex` metadata exactly once after the nested writable bind. Add sandbox integration cases for ordinary and symlinked roots, using both parent and nested working directories, to verify startup, allowed writes, metadata protection, and temporary mountpoint cleanup.

GitOrigin-RevId: 45e439eaf537e10bfa8b839bad816b0401fb65aa

2026-09-23 18:51:35 +00:00