codex

mirror of https://github.com/openai/codex.git synced 2026-08-23 13:09:46 +00:00

Files

Eric Traut 9ca99b5171 Preserve parent repository discovery through sandbox metadata mounts (#39629 )

## Why

The Linux sandbox represents missing protected metadata paths such as `.git`
with empty read-only directories. Repository and project discovery treated any
`.git` directory as a checkout root, so this synthetic directory could hide a
real parent repository and its trust configuration.

## What changed

- Treat a `.git` directory as repository metadata only when it contains
  `HEAD`, while continuing to recognize file-based `.git` entries.
- Protect missing `.git` paths with the same read-only synthetic mounts as
  other workspace metadata without disrupting parent-repository discovery.
- Canonicalize and read-only bind the synthetic-mount registry into the
  sandbox, and make protected-path cleanup handle read-only directory trees.

## Testing

Added coverage for repository, project-root, trust, synthetic-mount, and
Landlock behavior, including nested incomplete `.git` directories and a
redirected `TMPDIR`.

GitOrigin-RevId: 0724c54d56531143bb28011e4ca414cd3b0212be

2026-08-20 06:57:00 +00:00

bazel_bwrap.rs

linux-sandbox: use standalone bundled bwrap (#21255 )

2026-05-05 17:14:29 -07:00

bundled_bwrap.rs

Verify bundled bwrap in Bazel builds (#38494 )

2026-08-14 05:03:39 +00:00

bwrap.rs

Preserve parent repository discovery through sandbox metadata mounts (#39629 )

2026-08-20 06:57:00 +00:00

exec_util.rs

linux-sandbox: use standalone bundled bwrap (#21255 )