mirror of
https://github.com/openai/codex.git
synced 2026-11-01 19:33:35 +00:00
iceweasel-oai
4aa94dce27
## Why PSEC API symbols can be present on transitional Windows builds where MXC is not enabled. Availability detection needs to verify that a native process security environment can actually be created. ## What changed - Replace `mxc-sdk` with pinned `appcontainer_common`, `learning_mode_windows`, and `wxc_common` dependencies, and update Cargo and Bazel dependency metadata. - Use MXC's cached create/close probe for `is_available()` and query native deny-path support through `SecurityEnvironmentApi` before launching requests with denied paths. - Adapt request construction and the existing policy test to the vector-based environment field, and update the sandbox documentation. GitOrigin-RevId: e8cc6a35d46884d0a069b747d33e711512ec1596
23 lines
837 B
Rust
23 lines
837 B
Rust
//! Native Windows MXC capability discovery and availability metrics.
|
|
//! Probing is cached upstream; reporting happens at most once per process.
|
|
|
|
use std::sync::atomic::AtomicBool;
|
|
use std::sync::atomic::Ordering;
|
|
|
|
static AVAILABILITY_RECORDED: AtomicBool = AtomicBool::new(false);
|
|
|
|
pub(super) fn record_availability_once() {
|
|
// Probe actual PSEC create/close support; symbol presence alone also
|
|
// succeeds on transitional Windows builds where MXC is not enabled.
|
|
let available = codex_mxc_sandbox::is_available();
|
|
if let Some(metrics) = codex_otel::global()
|
|
&& !AVAILABILITY_RECORDED.swap(true, Ordering::Relaxed)
|
|
{
|
|
let _ = metrics.counter(
|
|
"codex.windows_mxc.available",
|
|
/*inc*/ 1,
|
|
&[("available", if available { "true" } else { "false" })],
|
|
);
|
|
}
|
|
}
|