mirror of
https://github.com/openai/codex.git
synced 2026-10-21 17:48:44 +00:00
iceweasel-oai
8b78600dc8
## What changed - Accept `windows.sandbox = "mxc"` and preserve the selected backend through environment configuration, command execution, patch writes, and sandbox metadata. - Treat MXC as enabled in the TUI and report Windows sandbox readiness as `ready`, avoiding legacy setup prompts. - Keep `allowed_sandbox_implementations` scoped to the legacy elevated and unelevated backends without restricting MXC. - Default `windows.sandbox_private_desktop` to `false` for MXC while retaining `true` for legacy sandboxes. ## Testing Add coverage for MXC configuration precedence, legacy requirement handling, sandbox selection, and TUI state. Add a Wine integration test that verifies command and patch routing fails when native MXC is unavailable and reports `windows_mxc` in turn metadata. GitOrigin-RevId: e2162447d0750f60753864c92a20e02a7f297bca
37 lines
1.5 KiB
Rust
37 lines
1.5 KiB
Rust
//! Resolves an executor sandbox context to a concrete local sandbox implementation.
|
|
|
|
use codex_file_system::FileSystemSandboxContext;
|
|
use codex_file_system::WindowsSandboxSelection;
|
|
use codex_protocol::config_types::WindowsSandboxLevel;
|
|
use codex_protocol::models::PermissionProfile;
|
|
use codex_sandboxing::SandboxManager;
|
|
use codex_sandboxing::SandboxType;
|
|
use codex_sandboxing::SandboxablePreference;
|
|
|
|
pub(crate) fn select_sandbox(
|
|
manager: &SandboxManager,
|
|
permission_profile: &PermissionProfile,
|
|
sandbox_context: &FileSystemSandboxContext,
|
|
has_managed_network_requirements: bool,
|
|
) -> (SandboxType, Option<WindowsSandboxLevel>) {
|
|
let windows_sandbox_level = match sandbox_context.windows_sandbox_selection {
|
|
WindowsSandboxSelection::Disabled => WindowsSandboxLevel::Disabled,
|
|
WindowsSandboxSelection::RestrictedToken => WindowsSandboxLevel::RestrictedToken,
|
|
WindowsSandboxSelection::Elevated => WindowsSandboxLevel::Elevated,
|
|
WindowsSandboxSelection::Mxc => return (SandboxType::WindowsMxc, None),
|
|
};
|
|
let windows_sandbox_type = match windows_sandbox_level {
|
|
WindowsSandboxLevel::Disabled => SandboxType::None,
|
|
WindowsSandboxLevel::RestrictedToken | WindowsSandboxLevel::Elevated => {
|
|
SandboxType::WindowsRestrictedToken
|
|
}
|
|
};
|
|
let sandbox_type = manager.select_initial(
|
|
permission_profile,
|
|
SandboxablePreference::Require,
|
|
windows_sandbox_type,
|
|
has_managed_network_requirements,
|
|
);
|
|
(sandbox_type, Some(windows_sandbox_level))
|
|
}
|