74af2496c9
## Why MXC's native host-loopback access is bidirectional, so it cannot enforce `allow_local_binding = false`. Treating an omitted setting as `false` prevents managed networking from working with the default configuration. ## What changed - Preserve an omitted `allow_local_binding` until the executor's sandbox policy is known. Default to `true` for Windows MXC and `false` elsewhere, including remote execution. - Reject an effective `false` for MXC managed networking after applying policy restrictions, without enabling disabled networking. - Use the executor's resolved value for remote network approval decisions while preserving explicit controller restrictions. - Document that local binding permits local servers and direct host-loopback connections and skips additional private-network destination checks; proxy domain rules still apply. ## Testing Add coverage for per-executor defaults, explicit values, MXC rejection of `false`, and remote network review cleanup with the resolved policy. GitOrigin-RevId: 0fa7c1eaec68bebada2b8f7af45688315eea70a9
Native Windows MXC sandbox
This crate routes a command through the current Codex executable and directly
into Microsoft's MXC BaseContainerRunner. It requires a working Windows
process security environment (PSEC). It never invokes MXC's AppContainer
dispatcher, edits host ACLs, creates sandbox users, runs setup, or requests
elevation. The existing Codex Windows sandboxes remain separate backends.
Windows executors record codex.windows_mxc.available once per process with an
available=true|false tag. This measures runtime availability independently of
selection. Unsupported Windows executors reject MXC requests before execution.
is_available() uses MXC's cached create/close probe, rather than an OS build
number or the SDK's broad platform_support() result. The latter also reports
older AppContainer backends as supported. A requested deny path additionally
requires the native PSE_SUPPORT_FS_DENY capability; otherwise the command
fails before launch.
The wrapper inherits the command's pipes or ConPTY console. MXC creates its child suspended, assigns a kill-on-close job before resuming it, and retains the native policy through workload completion. Filesystem permissions come from the canonical Codex permission profile, including protected metadata carveouts. Supported managed network access allows IPv4 and IPv6 loopback clients and servers, including the dedicated proxy listeners, while denying direct non-loopback egress and general inbound network access. Win32k calls and desktop handles remain available for PowerShell startup; clipboard, input-injection, and desktop/system-control restrictions remain.
Launch contract
create_command_args() wraps the command like the Seatbelt backend, using the
executor's Codex executable as the native SDK helper. It carries one typed
request: the canonical PermissionProfile, policy cwd, proxy context, and exact
argv. The helper inherits command cwd, environment, and stdio from the shared
process path; policy cwd can differ from command cwd.
The request uses launcher-only environment chunks to leave Windows' command-line
budget to the workload. Payloads are limited to 1,000,000 UTF-8 bytes and chunks
to 4096 bytes; the helper removes them before native process creation. Use
codex sandbox windows to debug through the same preparation path as execution.
Limits and Windows validation
- Deny globs use the existing Windows sandbox resolver to expand matching files and directories into concrete paths before launch. This has the same snapshot semantics and scan limits as the existing Windows sandbox.
- Native deny paths depend on the host's capability probe. An installed Windows update alone is not treated as evidence that every policy feature is enabled.
- When MXC is the executor's selected backend, managed networking defaults
allow_local_bindingtotrue. An effectivefalseafter applying managed requirements is a configuration error: native host-loopback access is bidirectional, and MXC's proxy-peer identity mode is not integrated here.truepermits local servers and direct host-loopback connections and removes the proxy's additional private-network destination checks. Proxy domain rules still apply to proxied traffic; direct DNS remains denied. This default also applies to remote Windows executors and does not enable disabled networking. - Windows volume-root grants do not recurse. The adapter grants the root and its immediate children; directories added or newly mounted during a running command are not implicitly granted.
- The native API represents paths and environment values as Unicode strings. Non-Unicode values fail instead of undergoing lossy conversion.
- An explicitly empty child environment is rejected: the SDK replaces an empty environment list with profile defaults and has no explicit-empty option.
- The upstream runner terminates remaining descendants when the foreground process exits, as well as on cancellation. Both existing Windows backends preserve descendants after normal exit, so detached servers currently lose that behavior under MXC. Retaining descendants safely requires a longer-lived owner for the native policy and job.
- The command itself remains subject to Windows' command-line length limit.
- Portable tests validate policy translation and wrapper arguments. Actual
enforcement, nested access overrides, alternate path encodings, junctions
and hardlinks, protected metadata, ConPTY behavior, process-tree cancellation,
proxy isolation, and
comparison with the existing Windows and Unix sandboxes require the smoke
suite on supported Windows and the corresponding platform hosts.
Test the normal
powershell.exeandpwsh.execommand paths, not onlycmd.exe.
The MXC git revision is pinned with the workspace dependencies. Native launch errors are returned without dumping the SDK's diagnostic buffer, which may contain command or environment data.