## Why
Managed runtime package registration errors lacked the terminal status, separate async and deployment error codes, and deployment activity ID needed to diagnose failures.
## What changed
Include these diagnostics in registration errors and distinguish failures in `GetResults`, the `ExtendedErrorCode` getter, and deployment itself. Preserve the original completion error; failures to read diagnostic fields do not turn successful registration into failure. Keep free-form Windows error text out of diagnostic summaries.
## Testing
Add unit tests for distinct async and deployment errors, failed or canceled result retrieval, and diagnostic getter failures, including preservation of native error codes and omission of free-form diagnostic text.
GitOrigin-RevId: 7f3a46741304ef04f5c3e2aa575bcfc4392dff62
## Why
Equivalent local source paths can fail to match an already-added marketplace, and redirected managed roots can lose their managed classification on Windows.
## What changed
- Compare local marketplace sources after filesystem normalization.
- Reuse the resolved request path when locating an existing local marketplace so retargeting a configured junction does not switch the returned root.
- Accept both the configured managed root and its canonical target on Windows while continuing to reject unowned aliases to that target.
## Testing
Add Windows regression tests for canonical and legacy path spellings, retargeted local-source junctions, and redirected managed roots with unowned aliases.
GitOrigin-RevId: f1ae46e8e7384075ed1baa6b33b2821f795e17f8
## Why
A credential mismatch can trigger setup that rotates both sandbox account passwords. Before allowing repair, validate the account that logged on successfully and ensure that neither account has been replaced or has an unowned runtime registration.
## What changed
- Validate runtime records and successful logon tokens, checking account SIDs, rejecting administrators, and requiring enabled `CodexSandboxUsers` membership.
- Before repair, verify recorded account SIDs and reject existing same-family package registrations for unrecorded accounts. Propagate package-query failures while allowing initial migration when no registrations exist.
## Testing
Add tests for malformed records and unrelated logon errors, plus an ignored disposable Windows Sandbox fixture covering successful logons, group membership, SID changes, migration, and unowned registrations.
GitOrigin-RevId: bafedb52cf9bd484250ccac3b163d2041891283f
## Why
Executor config reads omitted the startup `features.prefer_mxc` override, so clients could not see the CLI sandbox preference.
## What changed
- Include the explicit CLI `features.prefer_mxc` value in `environmentConfig/read` as a `session-flags` layer, above project config and below legacy managed file and MDM config.
- Retain only this preference from startup overrides.
- Expose `windows_mxc_allowed_by_config` to share MXC eligibility checks after callers resolve the active permission profile.
## Testing
Add CLI and remote executor coverage for preference propagation and filtering, plus a unit test verifying that both legacy managed config sources retain precedence.
GitOrigin-RevId: 5ac6f5257f1e807c2f197dcf5dcb2385cedca0ea
## Why
Windows temp grants could fall back to host `TEMP`/`TMP` values and bypass read-only or denied subpaths. Sandbox permissions must match the environment passed to the child process.
## What changed
- Resolve `:tmpdir` from absolute `TEMP`/`TMP` paths in the completed workload environment, preserving access modes and missing-path rules without falling back to host values.
- Deduplicate Windows environment keys case-insensitively in a deterministic order so permission resolution and the child environment select the same value.
- Use the resolved temp policy for elevated sandbox overrides across core execution, exec-server, and direct spawning.
- Launch direct-spawn sandbox wrappers with the supplied Codex executable, materializing an inner helper only when it is that executable.
## Testing
Add Windows regression coverage for temp-only writes, read-only and denied carveouts, mixed-case and duplicate environment keys, unavailable temp paths, and empty or missing write-root overrides. Exercise core execution and direct spawning, and extend exec-server RPC coverage to the elevated backend with temp values set through the environment policy.
GitOrigin-RevId: 16b8bd4702cc434fd743a08c75a3e4515780bff3
## Why
On Windows 10, strict native opens can reject the DOS drive alias itself as a reparse point, preventing no-follow filesystem operations on ordinary drive-letter paths.
## What changed
Retry rejected drive-letter opens relative to a verified local volume root. Require the root to resolve to a physical disk volume directory without reparse attributes, and retain `OBJ_DONT_REPARSE` for paths beneath it so junctions remain blocked.
## Testing
Add Windows tests for file creation and reading through the volume fallback, opening the drive root, and rejecting junction traversal and creation. Validate accepted volume-root names and verify that named pipes are rejected without establishing a client connection.
GitOrigin-RevId: 51ffde4f77d2af45d18dfc4cb026d73a0e69b061
## Why
A native launcher can pass PowerShell 7 module paths to Windows PowerShell, preventing `Get-FileHash` from loading and blocking archive checksum verification.
## What changed
Update `scripts/install/install.ps1` to compute SHA-256 directly with .NET APIs after resolving the archive path. Dispose the file stream and hash provider, and retain the existing checksum mismatch error.
GitOrigin-RevId: 86e6232bd83c888811fc3b76fcad0aaf046f4bf8
## Why
A stopped provisioning service is treated as unavailable by the connection path, preventing registered Core setup from provisioning the sandbox.
## What changed
Start a stopped Windows sandbox service before provisioning during explicit registered Core setup. Request service-start permission through the Windows Service Control Manager and tolerate the service already running if another caller starts it concurrently. Preserve existing unavailable-service handling when the service is missing or marked for deletion.
GitOrigin-RevId: fab87c10dfabd4324f631077262f7e0dccc170f6
## Why
Malformed `deny_read_acl_state.json` previously caused deny-read ACL reconciliation to fail. Recovery must restore bookkeeping without removing unknown existing restrictions or modifying a linked file's contents.
## What changed
- Retry malformed reads for up to two seconds, then rebuild bookkeeping only after excluding active writers and successfully applying current deny-read ACLs. Preserve unknown historical denies and continue propagating I/O errors.
- Validate the opened state file before reading or writing, rejecting reparse points and files with multiple hard links.
- Write state in place without truncating before validation, preserving file identity and permissions. Retry sharing violations during writes while preventing replacement through delete access.
## Testing
Add Windows tests for corrupt-state recovery, linked-file rejection, concurrent writer and delete-handle behavior, file identity and ACL preservation, and subsequent permission-profile changes. Extend the elevated sandbox integration test to verify that denied reads remain blocked after recovery while allowed writes and deletes succeed.
GitOrigin-RevId: 4aca32df00d015df3763fdc447ffdfbe3fd6cec0
## What changed
Persist the service's last reported lifecycle reason and numeric HRESULT in the existing service registry key. Distinguish requested stops, shutdown, owner removal, startup failure, broker failure, and interrupted registration, and reset the record on startup. Recording is best-effort and does not affect the service lifecycle.
Emit `codex.windows_sandbox.service_stopped` when a provisioning client observes a stopped service, including the recorded reason, HRESULT, and Windows service exit codes. Recheck the service status and registry record before emitting to avoid pairing inconsistent evidence during a concurrent restart. The metric counts observations, not unique outages; the recorded reason is advisory.
Update the cached service status only after `SetServiceStatus` succeeds. Extract diagnostic error codes from typed errors without collecting error text or user data.
## Testing
Add a test covering Win32-to-HRESULT conversion, preservation of Windows HRESULTs through error context, and a zero fallback for untyped error text.
GitOrigin-RevId: d0d39d091410e2b5499a0803475804d12235f836
## Why
Registration-only refreshes retain the existing sandbox, so package maintenance should not require another cloud-policy fetch.
## What changed
Skip managed configuration loading when a provisioning request has both `registered_core` and `refresh_only` set. The registered-runtime transaction still checks the existing owner, accounts, and unchanged settings under the setup lock. Other provisioning requests continue to enforce managed policy.
## Testing
Update the invalid-impersonation-token test to cover all four flag combinations, verifying that only registered refreshes succeed without loading configuration.
GitOrigin-RevId: e65ba1359be65e6314fa483b24fb66ed57a444ac
## What changed
Capture each environment's effective Windows sandbox backend in the MCP runtime and include it as `useMxc` in sandbox state metadata for supporting servers. Use the server's captured environment selection, including local fallback, so the local MXC preference does not leak into attached environments. Default missing backend information to `false`.
## Testing
Extend tests to cover MXC metadata handoff, attachment isolation, local fallback without a selected local environment, and preservation of captured backend settings across runtime refreshes.
GitOrigin-RevId: f559bffeff383838334e5a475b1eab608d571fa1
## Why
`CreateProcessWithLogonW` failures with `ERROR_SERVICE_ALREADY_RUNNING` (1056) previously aborted sandbox startup without retrying. At this stage, neither the runner nor the user command has started, so retrying does not replay the command.
## What changed
Retry runner creation once with the same sandbox credentials when logon returns error 1056. Propagate a second failure without refreshing credentials, and keep child startup errors with the same code ineligible for this retry.
## Testing
Add regression tests for recovery, the two-attempt limit, and exclusion of child startup failures. Add a unified exec test that injects a logon failure, verifies that the retry preserves the original request and credentials, and checks that the command runs exactly once.
GitOrigin-RevId: 78def6cdb93bf32f9b4a3e398cd16de83286fec4
## Why
Restoring the error mode with `SetErrorMode` can overwrite the failure code from `CreateProcessWithLogonW`, causing `RunnerLogonError` to report the wrong error.
## What changed
Capture `GetLastError()` immediately after a failed runner launch, before restoring the previous error mode, and use the saved code for `RunnerLogonError`.
GitOrigin-RevId: c0f4267232306be4d06e7e8accd60f7b77b8d6f3
## Why
Remote controllers cannot resolve a sandbox-compatible PowerShell executable on the execution host.
## What changed
Apply the existing PowerShell fallback during exec-server request preparation for the `Elevated` and `Mxc` Windows sandbox backends. Match `pwsh` and `powershell` executable names case-insensitively and replace inaccessible Store PowerShell paths when a compatible executable is available.
## Testing
Add Windows RPC regression tests for lowercase and mixed-case PowerShell aliases with a restricted server `PATH`, verifying successful command execution in the `Mxc` sandbox.
GitOrigin-RevId: 365541af2f026a662b1988429f5d182c98e4a236
## Why
Configuration parser errors can include entire configuration lines containing credentials. Persistent policy-rejection events must avoid recording those values.
## What changed
Replace free-form error text in Windows sandbox provisioning policy-rejection events with known stage labels and typed cloud, HTTP, I/O, and Win32 error codes. Use fixed fallback labels when the stage or cause is unrecognized.
## Testing
Add regression coverage using malformed requirements and cloud configuration fragments containing a synthetic secret. Verify that diagnostics exclude parser values while retaining safe error codes, and that unknown errors produce fixed fallback text.
GitOrigin-RevId: 4f2fa5f6f602c34451776ec31381a102213660b8
## Why
Allow the provisioning service time to start without holding up desktop readiness checks for the full provisioning timeout.
## What changed
- Poll service status while startup is pending, waiting up to five seconds within the caller's deadline. Treat absent, deletion-pending, or other non-running service states as unavailable.
- Preserve the original provisioning deadline for pipe availability and request processing, and reject requests whose deadline expires during server authentication.
- Recheck service status when the pipe disappears while waiting for an available instance.
GitOrigin-RevId: ea89175cb41749b9768ac5915083bbfd8ad32713
Identify the failing setup step when starting, completing, or verifying managed runtime package registration, granting metadata permissions, or persisting the completed registration. Preserve the underlying errors with `anyhow::Context`.
GitOrigin-RevId: 85f712faf2519e95704d7e8cea15d2deeed0d51e
## Why
Detached Windows daemons can inherit the launcher's output pipes, leaving callers waiting for EOF after the launcher exits.
## What changed
Clear inheritance flags on the launcher's standard handles before spawning managed Windows processes. Leave the flags cleared to protect concurrent launches while preserving the child's configured stdio, and tolerate missing or already-closed handles.
## Testing
- Add a Windows regression test verifying that captured launcher output closes while the detached child remains alive and writes to its configured log.
- Give optional MCP startup grace tests more time to complete on slow runners while keeping the pending server's startup timeout longer than the turn timeout.
GitOrigin-RevId: 053e0417793db3c961e738476a05c7467978f339
Set `CREATE_NO_WINDOW` when launching the code-mode host on Windows so the
child process does not create a console window.
GitOrigin-RevId: ce0d04d7f516d137bcaf5206140aaeaa23334022
## Why
Elevated Windows sandbox setup rejected `danger-full-access` as an incompatible permission profile before registered Core could reach the provisioning service.
## What changed
Allow `PermissionProfile::Disabled` to reach service provisioning when registered Core is requested. Keep legacy full-access setup on the shared setup path and retain permission validation before provisioning for restricted profiles.
## Testing
Add Windows-only regression cases covering full-access and supported restricted profiles reaching the service, unsupported restricted permissions failing before provisioning, and legacy full-access setup skipping the service. Each case checks the completion error and verifies that the configuration file remains unchanged.
GitOrigin-RevId: 5ba190da6f8b1c6ef665015acdb9428718a724dc
## Why
Registered Windows sandbox setup could appear complete even when Windows rejected the stored account passwords. Checking account flags alone did not detect these failures before runtime logon.
## What changed
- Check stored credentials for both offline and online accounts before reusing completed setup during non-refresh provisioning.
- Classify logon failure, expired-password, and password-change-required errors as `SandboxAccountCredentialMismatch`, preserving the underlying Windows error.
- Trigger full setup to rotate credentials only after verifying that recorded account SIDs still match. Propagate credential-file and policy errors without triggering password repair, and skip credential checks for refresh-only requests.
## Testing
Add tests for native error classification, missing credential files, healthy credentials, password failures on either account, policy failures, and rejection of repair when account ownership validation fails.
GitOrigin-RevId: b3aa02f82841dd2605b0c3585ec93144727721e6
## Why
Incomplete setup for the installed app reported the same error as an owner mismatch or removal in progress, obscuring the need to retry sandbox setup.
## What changed
- Distinguish owner mismatch, Codex home mismatch, removal in progress, and incomplete setup when authorizing the registered runner receipt.
- Tell users to retry sandbox setup when the receipt is not ready for the installed app.
- Add operation and account context to provisioning failures, including account logon, profile preparation, package queries, alias resolution, and registration persistence.
## Testing
Add a unit test covering distinct authorization errors and their precedence, acceptance of a ready receipt, and rejection after the app package changes.
GitOrigin-RevId: 4e7620c4670e8b02a411a176cc89bd72dcd6e478
## Why
Windows 10 rejects the Object Manager drive-letter link when opening a directory with `OBJ_DONT_REPARSE`, preventing ordinary local-drive paths from opening successfully.
## What changed
Resolve drive-letter aliases with `QueryDosDeviceW` before calling `NtCreateFile`. Accept only direct disk-volume mappings, rejecting other devices and volume subpaths. Leave filesystem components unresolved so `OBJ_DONT_REPARSE` continues to reject filesystem reparse points.
## Testing
Add tests for drive-root opens and NT path construction using ordinary and verbatim drive paths, plus validation of accepted disk-volume mappings and rejected device or subpath mappings.
GitOrigin-RevId: 2fe81913a7ac8d0122ec423db5750e80241def56
## Why
Package context propagation was limited to verified `codex-command-runner.exe` processes, preventing other packaged callers from passing their OS-assigned identity to sandboxed children.
## What changed
Use the current process's OS package identity to decide whether to preserve desktop app context in both regular and ConPTY sandbox launches. Remove executable-name and staged-runner verification from this decision.
Reject callers without package identity when `CODEX_WINDOWS_REGISTERED_CORE=1`; otherwise, unpackaged callers continue without preserving app context.
GitOrigin-RevId: 52eb2fe33c8746d898b5d7ebf53bd001a55b5506
## What changed
- Use the installed provisioning service regardless of the onboarding feature gate. Fall back to the elevated helper only when the service is unavailable; propagate service errors.
- Pass the effective proxy settings and filter listener ports to match them, including when preserving saved settings.
- Remove stale credentials before repairing missing, disabled, or password-expired sandbox accounts so older services cannot mistake them for completed setup.
- Select helper fallback when workload-identity environment variables are present, since service requests do not carry that environment. Continue rejecting helper fallback for registered Core.
## Testing
Extend account-repair tests to cover stale credential removal, missing and disabled accounts, and repeated setup checks. Add subprocess tests for workload-identity routing with and without registered Core.
GitOrigin-RevId: 1041ae76e9b0893ad60f30a5cdc506748be52552
## Why
An ACL refresh cannot rotate expired sandbox account passwords or update stored credentials. Accounts marked with `UF_PASSWORD_EXPIRED` need full setup before logon.
## What changed
- Trigger full setup when either sandbox account has an expired password, then reload credentials and report an error if either password remains expired.
- Treat expired passwords as incomplete setup in service provisioning and reject them during registration-only refreshes.
## Testing
Add coverage for expiration on either account, a single repair attempt, credential reload, and unsuccessful repair. Add an ignored Windows test requiring administrator rights to verify that resetting an expired password preserves other account flags.
GitOrigin-RevId: cd6e86f226bea52243d37bd7c7becf7378ba8721
## What changed
Extend the sandbox directory ACL test to verify that the real user retains
`WRITE_DAC` on `.sandbox-bin` so its DACL can be refreshed, while the sandbox
group lacks that permission. Cover both `Full` and `ProvisionOnly` setup modes.
GitOrigin-RevId: cff32956ea308803536a47d8cdfc256184346553
## Why
Registering the service-bearing package can restart the provisioning service once for each managed sandbox account. A restart can interrupt the response after runtime readiness has been revoked, preventing the refresh from completing.
## What changed
- Retry registered sandbox refresh requests after response pipe disconnections, allowing up to two service restarts within the original deadline. Require a different service process ID and authenticate it against the running service before resending.
- Allow refresh to resume without `ready_package` when account ownership is complete, teardown is not underway, and the existing owner, package family, live account SIDs, and settings checks pass. Runtime execution still requires readiness for the current package.
- Keep authentication failures, failed writes, explicit replies, and protocol errors outside the retry path.
## Testing
Add regression tests for disconnect classification, the two-restart budget, deadline expiry, and authentication failure before writing. Extend ownership tests to distinguish resumable registration from runtime readiness and reject incomplete accounts or retirement state.
GitOrigin-RevId: d932f179b31752fe918297b7b12e5077c17b19e5
## What changed
- Capture `CODEX_WINDOWS_REGISTERED_CORE=1` at startup and propagate the selected runtime to sandbox wrappers.
- Launch registered runners through service-recorded execution aliases, validating ownership, OS package identity, and the staged runner image before sending commands. Require service provisioning without falling back to copied helpers or `PATH` lookup.
- Preserve package context for sandboxed child processes and descendants so they can launch executables from the protected package directory.
- Refresh stale package registrations during readiness checks without blocking unrelated RPCs, and reconcile effective proxy settings through the service.
- Resolve setup ownership from the process token and avoid treating the server directory as a writable workspace when setup omits `cwd`.
- Record startup and command outcomes by runtime.
## Testing
Add coverage for runtime selection, package query validation, helper resolution, setup roots, proxy reconciliation, and command result reporting. Add an ignored integration test for environment forwarding, output, and exit status that requires an installed test MSIX and service provisioning in a Windows VM.
GitOrigin-RevId: 976d64039d611be4406c3d0e354820775f8eb6e4
## What changed
- Add an explicit `registered_core` provisioning mode that registers the app package for both managed sandbox accounts and records their runner aliases. Authenticate callers against the service's package family and installed version.
- Persist runtime ownership and publish readiness only after both registrations and AppData metadata grants succeed. Prevent legacy setup or another owner from replacing registered sandbox accounts, and restrict `refresh_only` requests to an existing ready setup.
- Scope service and pipe names by package identity.
- Preserve registrations across package updates and clean them up when the owner uninstalls the app. Fence provisioning during teardown and defer package removal until native cleanup succeeds and the service exits.
## Testing
Add tests for registration opt-in, ownership and readiness checks, legacy setup isolation, metadata ACL preservation, listener shutdown handling, and the cleanup finalizer's commit barrier and UTF-8 input.
GitOrigin-RevId: 69e52f7463285b51f3bef831f071245f0eca0838
## What changed
- Share process package-family queries, token user SID extraction, and account-name lookup through `codex_windows_sandbox`, and use them in the provisioning service.
- Bound token query sizes and validate SID pointers, revisions, and lengths before copying SIDs into owned storage.
- Use a drop guard to balance firewall COM initialization, and track the package lifecycle directory guard separately so cleanup releases it while keeping ancestor and home handles pinned.
## Testing
Add tests that verify copied SIDs outlive their query buffers and reject truncated token data, malformed SIDs, and invalid SID pointers.
GitOrigin-RevId: 2b893e4524d3e00cb114df05215beef7b9eebbe9
Add `base64` and `serde_json` as workspace dependencies of
`codex-windows-sandbox-service` and update `Cargo.lock`. Temporarily exclude
both dependencies from `cargo-shear` checks until they are used.
GitOrigin-RevId: f77a0ba13cfa9ba2315dcf00a80163afff32d0b4
The provider requirement change test asserts that no traffic reaches the
replacement provider. Start a dedicated server with
`MockServer::builder().start()` and include unexpected request methods and
URL paths in assertion failures.
GitOrigin-RevId: 4020c43c0ec0472fe54d4003bff120349ddd5597
## Why
The analytics test helper returned the first analytics request, which could contain unrelated events. Plugin-install assertions need to select the expected event even when it arrives in a later request or shares a batch with other events.
## What changed
Update `wait_for_plugin_analytics_payload` to accept an event type, scan requests until matching events appear, and return the payload with only those events. Update callers to request `codex_plugin_installed` or `codex_plugin_install_failed` as appropriate.
## Testing
Add a regression test that sends an unrelated analytics request followed by a mixed batch and verifies that the helper returns only the expected plugin-install failure event.
GitOrigin-RevId: 41290c63ea1c2a3da1efa78b81222b8da76bcbff
## What changed
- Update `rustls` from 0.23.36 to 0.23.45 and `rustls-webpki` from 0.103.13 to 0.103.15.
- Update `aws-lc-rs` from 1.16.2 to 1.18.1 and `aws-lc-sys` from 0.39.0 to 0.45.0, including its new `pkg-config` dependency.
- Refresh the corresponding dependency metadata in `MODULE.bazel.lock`.
GitOrigin-RevId: 7b37b3cea5485c0b5bd11d229b2949aec399afd9
## What changed
- Extract helper copying, token-user SID queries, provisioning pipe ownership, and service runtime lifecycle into dedicated modules.
- Simplify command-runner resolution and extract setup configuration loading, payload execution, provisioning request exchange, and response handling into helpers.
- Parameterize installation-record registry access and return the saved installation record from authenticated user registration.
## Testing
Add tests for explicit setup `cwd` selection and effective workspace roots, plus valid and invalid token-user SID queries. Move existing helper-copy and freshness tests alongside the extracted copy implementation.
GitOrigin-RevId: ffb39adae7611baa95e85c89f9a31ef7a779e217
## Why
Logon SID lookup previously walked token group entries and SID pointers without checking that they fit within the returned buffer.
## What changed
Add a shared `token_groups` helper with a caller-supplied size limit. Validate the group layout, SID bounds, revision, and length before copying SIDs into owned `TokenGroup` values, preserving group order, duplicates, and attributes. Use this helper for logon SID lookup.
## Testing
Add Windows tests for owned SID storage, preserved order and attributes, truncated layouts, malformed and out-of-buffer SIDs, query size limits, and current-token logon SID lookup.
GitOrigin-RevId: f51ff6aa5266b6c73fe07968015e462c888a95e4
## What changed
Expose `prepare_packaged_windows_sandbox_cleanup` to disable sandbox accounts and stop their processes before returning a `PreparedWindowsSandboxCleanup` guard that retains the setup lock. Its `finish` method removes resources and protections; dropping it only releases the lock, leaving accounts disabled and protections intact.
Keep `clean_up_packaged_windows_sandbox` as a wrapper around both phases, and extract the service's existing package cleanup logic into a dedicated module.
GitOrigin-RevId: a32663171bce027f771f738d71b0c46404edbedc
## What changed
- Move the setup helper implementation and its existing tests into `codex-windows-sandbox`, with the binary delegating to `setup_helper_main`.
- Expose installation record types and storage operations from the library, preserving the registry key, size limit, and serialization format. Reuse them in the service and remove its direct `serde` dependencies.
- Extract service provisioning from IPC handling into a dedicated module, preserving authentication and machine-policy checks before provisioning and retaining directory handles through helper execution.
GitOrigin-RevId: dd1ea015aff901d5dfe39b395de1971ee0f2d33f
## Why
The latest `openssl-src` 300.x crate still bundles OpenSSL 3.6.3. Build the 3.6.4 security release directly while preserving the existing 3.x ABI.
## What changed
- Build static OpenSSL libraries with the musl compiler for `x86_64` and `aarch64`, verifying the source archive's SHA-256 checksum.
- Set target-specific OpenSSL overrides to bypass vendored builds without affecting host build dependencies.
- Add `perl` and `make` to the musl build prerequisites and reuse completed OpenSSL installations.
GitOrigin-RevId: 4276c7d6cf30c31c8554246cea2f406dfbf7568b
## Why
When local binding is enabled, the Windows sandbox has no port-specific loopback rules. Changing proxy listeners therefore does not require an elevated firewall setup.
## What changed
Ignore proxy port differences when both stored and requested settings enable `allow_local_binding`. Continue refreshing ACLs, and still require full setup when local binding changes or proxy ports change with local binding disabled.
## Testing
Add credential orchestration coverage using real setup markers and DPAPI credentials with injected setup and account lookup callbacks. Verify refresh versus full setup selection, returned credentials, and preservation of the setup marker.
GitOrigin-RevId: ffb0c019f3931915b3c1cf522315565df37c582b
## Why
Requirements layers may use either `features` or its `feature_requirements`
alias. Treating those names as separate tables prevents feature settings from
merging consistently across layers.
## What changed
Normalize `feature_requirements` to `features` after validating each layer so
mixed aliases share one merge path and retain layer precedence.
## Testing
Add coverage for both alias orderings across low- and high-priority layers.
GitOrigin-RevId: e23ad3e0853b8b49ca10447875f33706de39bcfe
## Why
Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.
## What changed
Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.
## Testing
Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.
GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d
## Why
`ShellExecuteExW` needs `SystemRoot` to elevate the Windows sandbox setup helper.
## What changed
Add `SYSTEMROOT` to the environment variables copied from the host for wrapper
setup. Keep the serialized inner command environment unchanged so the host value
is available only to the wrapper.
## Testing
Extend Windows sandbox manager tests to cover case-insensitive replacement of
`SystemRoot` and verify that it is excluded from the inner command environment.
GitOrigin-RevId: c69f9f92665e97a178e2de488fbb9fd6b7ff7ac6
## What changed
- Load doctor configuration through the cloud-aware CLI configuration path while preserving invocation overrides such as `--cd`.
- Report configuration load time and clarify that diagnostics cover invocation configuration, including cloud-managed policy, but not active thread overrides.
- Add redacted filesystem sandbox diagnostics for denied-read rule counts, glob rule counts, glob scan depth, and the managed policy source.
## Testing
Add an integration test that verifies valid cloud-managed filesystem requirements are reported without exposing denied paths, and invalid requirements fail the configuration check.
GitOrigin-RevId: 65c3c9ad3fd42c1579ca0c9d8e209066f98e5407
## What changed
- Add the under-development `powershell_shell_version` feature flag.
- When enabled for a single local PowerShell environment, query the selected
shell executable and include its major/minor version in
`<environment_context>`.
- Cache version lookups, bound command execution and output, and report when a
previously visible version becomes unavailable.
## Testing
- Cover environment-context diffs when the shell version appears or disappears.
- Verify on Windows that the version is model-visible only when the feature is
enabled.
GitOrigin-RevId: 3ec8e80425ec3c193134dc1b69f61ef09ede375e
## Why
Microsoft Store PowerShell executables under `WindowsApps` can be inaccessible to the dedicated elevated sandbox account.
## What changed
- For local elevated sandbox commands that target Store PowerShell, select the first compatible `pwsh.exe` or `powershell.exe` from `PATH` or the standard fallback locations.
- Continue adding `-NoProfile`, and preserve the selected shell for remote execution and other sandbox modes.
## Testing
Added unit coverage for Store-path filtering, fallback ordering, local replacement, and remote-path preservation.
GitOrigin-RevId: 8ab3d0db925e886879701445040f13902fb1ad24
## Why
Windows filesystem operations can complete while their helper process remains
alive, and elevated sandbox processes must not survive a disconnected control
pipe.
## What changed
- Read newline-delimited filesystem helper responses without imposing an
operation deadline, then bound the time spent reaping the helper.
- Drain helper stderr concurrently, retain a bounded diagnostic on failure, and
kill helpers that do not exit after responding.
- Terminate the elevated runner's job or process when its input pipe closes or
fails.
## Testing
Added coverage for delayed responses, noisy stderr, stuck helpers, duplicated
file handles, and termination of elevated descendants after a control-pipe
disconnect.
GitOrigin-RevId: c0d3d5d76e13318de17638df4db71fcfb9a7397f
## Why
Windows batch aliases can fail to invoke Codex when the executable path contains
characters that are not representable in the active console code page.
## What changed
- Generate same-volume executable paths relative to the batch file using `%~dp0`.
- Keep absolute paths as a fallback when the executable and alias are on different
volumes.
## Testing
Added Windows tests covering a Unicode profile path under code page 437 and an
executable on a different volume.
GitOrigin-RevId: 10093bbc9f19e4fbe2e22d9397e211a113302f45
## What changed
- Detect readable symbolic `:root` entries separately from effective full-disk access so narrower deny-read rules do not disable the Windows sandbox's broad-read setup.
- Add explicit readable roots to that setup while omitting the filesystem root itself, and prevent read roots at or below denied paths from being granted access.
## Testing
- Extend the elevated Windows sandbox integration test to verify that an allowed bundled skill under the user profile remains readable while exact and glob-based secrets stay denied.
GitOrigin-RevId: 8f6f267b78718b9e8609a9205c489f253f478491
## What changed
- Recognize percent-encoded drive colons when inferring Windows paths, rendering
native path strings, and resolving same-drive relative joins.
- Reject Windows file URIs with percent-encoded `/` or `\` separators before
converting them to native absolute paths, so decoding cannot reinterpret URI
segment boundaries.
## Testing
- Cover uppercase and lowercase encodings for drive colons and path separators,
including local-drive and UNC file URIs.
GitOrigin-RevId: ecb6c92f4ef1af73f85e57a135abf6bc5bb968dc
## Why
Sandbox setup runs on a Tokio worker thread without a Windows message loop, so
`ShellExecuteExW` requires synchronous activation when launching the elevated
setup helper.
## What changed
Add `SEE_MASK_NOASYNC` to the shell execution flags while retaining
`SEE_MASK_NOCLOSEPROCESS` for helper process tracking.
GitOrigin-RevId: 875cc1d49bb19f92f940633b6315711143beeae7
## What changed
- Add `WINDIR` to the Windows core environment variable allowlist.
- Extend the Windows core-inheritance test to verify that a case-variant
`WinDir` entry is retained.
GitOrigin-RevId: 0305d8fa882ba2705a7ce7661098cedac1339c43
## Why
Installer `bin` directories can be junctions, so looking for bundled helpers
relative to the apparent executable path can miss the package's
`codex-resources` directory.
## What changed
Retry bundled executable lookup from the canonical executable path when lookup
from the original path fails.
## Testing
Add a Windows regression test that creates a `bin` junction and verifies that
the sandbox setup helper is resolved from the package resources directory.
GitOrigin-RevId: f2f20ce1ccfa95ae65171a03a986d10e2560e696
## What changed
- Apply the sandbox read/execute ACL to the local Codex application root so it
inherits across its contents, while continuing to handle the managed runtime
cache separately.
- Skip missing paths, non-directories, and directory reparse points before
inspecting or updating ACLs.
- Update the runtime path test to expect the application root.
GitOrigin-RevId: 34f2946d2140f8ea2b76c449b0e5542b99cb6f70
## What changed
- Add the stable, default-enabled `in_app_updates` requirements-only feature.
- Allow administrators to disable in-app updates through `[features]` in `requirements.toml`.
- Expose the policy through `configRequirements/read` and include it in the config schema.
## Testing
- Verify that in-app updates are enabled by default and disabled by the managed requirement.
- Verify that `configRequirements/read` returns the configured policy.
GitOrigin-RevId: e9c7074b516fe58385fdf7dc8420c0109c0c3df6
## What changed
- Add a console mode to the Windows sandbox process launcher.
- Launch `--codex-run-as-fs-helper` subprocesses with `CREATE_NO_WINDOW`.
- Preserve inherited-console behavior for regular sandboxed commands.
GitOrigin-RevId: 927be36b82903b6a5fb1a243ba7f406f9ed85f3f
zm-oai