Michael Bolin dfb36573cd sandboxing: use OsString for SandboxCommand.program (#15897) ...

## Why

`SandboxCommand.program` represents an executable path, but keeping it
as `String` forced path-backed callers to run `to_string_lossy()` before
the sandbox layer ever touched the command. That loses fidelity earlier
than necessary and adds avoidable conversions in runtimes that already
have a `PathBuf`.

## What changed

- Changed `SandboxCommand.program` to `OsString`.
- Updated `SandboxManager::transform` to keep the program and argv in
`OsString` form until the `SandboxExecRequest` conversion boundary.
- Switched the path-backed `apply_patch` and `js_repl` runtimes to pass
`into_os_string()` instead of `to_string_lossy()`.
- Updated the remaining string-backed builders and tests to match the
new type while preserving the existing Linux helper `arg0` behavior.

## Verification

- `cargo test -p codex-sandboxing`
- `just argument-comment-lint -p codex-core -p codex-sandboxing`
- `cargo test -p codex-core` currently fails in unrelated existing
config tests: `config::tests::approvals_reviewer_*` and
`config::tests::smart_approvals_alias_*`

2026-03-26 20:38:33 +00:00

..

agent

fix: root as std agent (#15881)

2026-03-26 18:57:34 +01:00

apps

[apps][tool_suggest] Remove tool_suggest's dependency on tool search. (#14856)

2026-03-25 12:26:02 -07:00

bin

add generated jsonschema for config.toml (#8956)

2026-01-13 10:22:51 -08:00

codex

Use AbsolutePathBuf for cwd state (#15710)

2026-03-25 16:02:22 +00:00

config

fix: resolve bwrap from trusted PATH entry (#15791)

2026-03-26 12:13:51 -07:00

config_loader

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

context_manager

[codex] Defer fork context injection until first turn (#15699)

2026-03-24 18:34:44 -07:00

guardian

Use AbsolutePathBuf for cwd state (#15710)

2026-03-25 16:02:22 +00:00

instructions

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

mcp

skills: remove unused skill permission metadata (#15900)

2026-03-26 19:33:23 +00:00

memories

feat: replace askama by custom lib (#15784)

2026-03-26 10:33:25 +01:00

models_manager

Move string truncation helpers into codex-utils-string (#15572)

2026-03-24 15:45:40 -07:00

plugins

[plugins] Update the suggestable plugins list. (#15829)

2026-03-26 15:53:22 +00:00

sandboxing

fix: support split carveouts in windows restricted-token sandbox (#14172)

2026-03-24 22:54:18 -07:00

snapshots

[codex] Defer fork context injection until first turn (#15699)

2026-03-24 18:34:44 -07:00

state

core: remove special execve handling for skill scripts (#15812)

2026-03-26 07:46:04 -07:00

tasks

Use AbsolutePathBuf for cwd state (#15710)

2026-03-25 16:02:22 +00:00

tools

sandboxing: use OsString for SandboxCommand.program (#15897)

2026-03-26 20:38:33 +00:00

unified_exec

feat: use ProcessId in exec-server (#15866)

2026-03-26 16:45:36 +01:00

utils

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

api_bridge_tests.rs

Add auth 401 observability to client bug reports (#14611)

2026-03-14 15:38:51 -07:00

api_bridge.rs

[codex] import token_data from codex-login directly (#15903)

2026-03-26 13:34:02 -07:00

apply_patch_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

apply_patch.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

arc_monitor_tests.rs

[apps] Use ARC for yolo mode. (#15273)

2026-03-20 21:13:20 +00:00

arc_monitor.rs

[apps] Use ARC for yolo mode. (#15273)

2026-03-20 21:13:20 +00:00

auth_env_telemetry.rs

Gate realtime audio interruption logic to v2 (#14984)

2026-03-17 15:24:37 -07:00

client_common_tests.rs

Add notify to code-mode (#14842)

2026-03-18 09:37:13 -07:00

client_common.rs

Add notify to code-mode (#14842)

2026-03-18 09:37:13 -07:00

client_tests.rs

Prefer websockets when providers support them (#13592)

2026-03-17 19:46:44 -07:00

client.rs

Move auth code into login crate (#15150)

2026-03-19 18:58:17 -07:00

codex_delegate_tests.rs

Add Smart Approvals guardian review across core, app-server, and TUI (#13860)

2026-03-13 15:27:00 -07:00

codex_delegate.rs

Add cached environment manager for exec server URL (#15785)

2026-03-25 16:14:36 -07:00

codex_tests_guardian.rs

Add cached environment manager for exec server URL (#15785)

2026-03-25 16:14:36 -07:00

codex_tests.rs

Protect first-time project .codex creation across Linux and macOS sandboxes (#15067)

2026-03-26 16:06:53 -04:00

codex_thread.rs

Protect first-time project .codex creation across Linux and macOS sandboxes (#15067)

2026-03-26 16:06:53 -04:00

codex.rs

core: remove special execve handling for skill scripts (#15812)

2026-03-26 07:46:04 -07:00

command_canonicalization_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

command_canonicalization.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

commit_attribution_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

commit_attribution.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

compact_remote.rs

[hooks] use a user message > developer message for prompt continuation (#14867)

2026-03-19 10:53:08 -07:00

compact_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

compact.rs

Move string truncation helpers into codex-utils-string (#15572)

2026-03-24 15:45:40 -07:00

connectors_tests.rs

Split features into codex-features crate (#15253)

2026-03-19 20:12:07 -07:00

connectors.rs

[codex] import token_data from codex-login directly (#15903)

2026-03-26 13:34:02 -07:00

consequential_tool_message_templates.json

[elicitation] User-friendly tool call messages. (#14403)

2026-03-12 00:35:21 -07:00

contextual_user_message_tests.rs

Extract codex-instructions crate (#15744)

2026-03-25 10:43:49 -07:00

contextual_user_message.rs

Extract codex-instructions crate (#15744)

2026-03-25 10:43:49 -07:00

custom_prompts_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

custom_prompts.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

default_client_forwarding.rs

Move auth code into login crate (#15150)

2026-03-19 18:58:17 -07:00

environment_context_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

environment_context.rs

Use AbsolutePathBuf for cwd state (#15710)

2026-03-25 16:02:22 +00:00

error_tests.rs

Add auth 401 observability to client bug reports (#14611)

2026-03-14 15:38:51 -07:00

error.rs

[codex] import token_data from codex-login directly (#15903)

2026-03-26 13:34:02 -07:00

event_mapping_tests.rs

feat: structured multi-agent output (#15515)

2026-03-23 18:53:54 +00:00

event_mapping.rs

Trim pre-turn context updates during rollback (#15577)

2026-03-24 12:43:53 -07:00

exec_env_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

exec_env.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

exec_policy_tests.rs

chore(exec_policy) ExecPolicyRequirementScenario tests (#15415)

2026-03-22 08:07:43 -07:00

exec_policy.rs

fix(core) disable command_might_be_dangerous when unsandboxed (#15036)

2026-03-21 01:28:25 +00:00

exec_tests.rs

Protect first-time project .codex creation across Linux and macOS sandboxes (#15067)

2026-03-26 16:06:53 -04:00

exec.rs

sandboxing: use OsString for SandboxCommand.program (#15897)

2026-03-26 20:38:33 +00:00

external_agent_config_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

external_agent_config.rs

Apply argument comment lint across codex-rs (#14652)

2026-03-16 16:48:15 -07:00

file_watcher_tests.rs

core: Make FileWatcher reusable (#15093)

2026-03-24 11:04:47 -07:00

file_watcher.rs

core: Make FileWatcher reusable (#15093)

2026-03-24 11:04:47 -07:00

flags.rs

chore: drop unused values from env_flags (#4188)

2025-09-24 14:29:51 -07:00

function_tool.rs

nit: drop unused function call error (#8903)

2026-01-08 15:07:30 +00:00

git_info_tests.rs

Move git utilities into a dedicated crate (#15564)

2026-03-24 13:26:23 -07:00

hook_runtime.rs

[hooks] add non-streaming (non-stdin style) shell-only PostToolUse support (#15531)

2026-03-25 19:18:03 -07:00

landlock.rs

fix: fix old system bubblewrap compatibility without falling back to vendored bwrap (#15693)

2026-03-25 23:51:39 -07:00

lib.rs

[codex] import token_data from codex-login directly (#15903)

2026-03-26 13:34:02 -07:00

mcp_connection_manager_tests.rs

[mcp] Improve custom MCP elicitation (#15800)

2026-03-26 01:02:37 +00:00

mcp_connection_manager.rs

fix: keep rmcp-client env vars as OsString (#15363)

2026-03-24 23:32:31 +00:00

mcp_tool_approval_templates.rs

fix(core): preserve tool_params for elicitations (#14769)

2026-03-15 23:15:52 -07:00

mcp_tool_call_tests.rs

[mcp] Improve custom MCP elicitation (#15800)

2026-03-26 01:02:37 +00:00

mcp_tool_call.rs

Add MCP connector metrics (#15805)

2026-03-26 17:08:02 +00:00

memory_trace_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

memory_trace.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

mention_syntax.rs

Extract codex-utils-plugins crate (#15746)

2026-03-25 11:05:35 -07:00

message_history_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

message_history.rs

feat(tui): restore composer history in app-server tui (#14945)

2026-03-18 11:54:11 -06:00

model_provider_info_tests.rs

fix(core): prevent hanging turn/start due to websocket warming issues (#14838)

2026-03-17 10:07:46 -07:00

model_provider_info.rs

fix(core): prevent hanging turn/start due to websocket warming issues (#14838)

2026-03-17 10:07:46 -07:00

network_policy_decision_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

network_policy_decision.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

network_proxy_loader_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

network_proxy_loader.rs

Apply argument comment lint across codex-rs (#14652)

2026-03-16 16:48:15 -07:00

original_image_detail_tests.rs

Split features into codex-features crate (#15253)

2026-03-19 20:12:07 -07:00

original_image_detail.rs

Split features into codex-features crate (#15253)

2026-03-19 20:12:07 -07:00

otel_init.rs

Split features into codex-features crate (#15253)

2026-03-19 20:12:07 -07:00

personality_migration_tests.rs

feat: change multi-agent to use path-like system instead of uuids (#15313)

2026-03-20 18:23:48 +00:00

personality_migration.rs

Apply argument comment lint across codex-rs (#14652)

2026-03-16 16:48:15 -07:00

project_doc_tests.rs

Use AbsolutePathBuf for cwd state (#15710)

2026-03-25 16:02:22 +00:00

project_doc.rs

Use AbsolutePathBuf for cwd state (#15710)

2026-03-25 16:02:22 +00:00

realtime_context_tests.rs

feat: change multi-agent to use path-like system instead of uuids (#15313)

2026-03-20 18:23:48 +00:00

realtime_context.rs

Move string truncation helpers into codex-utils-string (#15572)

2026-03-24 15:45:40 -07:00

realtime_conversation_tests.rs

[stack 2/4] Align main realtime v2 wire and runtime flow (#14830)

2026-03-16 21:38:07 -07:00

realtime_conversation.rs

Handle realtime conversation end in the TUI (#14903)

2026-03-17 21:04:58 -07:00

response_debug_context.rs

Add auth 401 observability to client bug reports (#14611)

2026-03-14 15:38:51 -07:00

review_format.rs

Apply argument comment lint across codex-rs (#14652)

2026-03-16 16:48:15 -07:00

review_prompts.rs

Move git utilities into a dedicated crate (#15564)

2026-03-24 13:26:23 -07:00

rollout.rs

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

safety_tests.rs

Protect first-time project .codex creation across Linux and macOS sandboxes (#15067)

2026-03-26 16:06:53 -04:00

safety.rs

Extract sandbox manager and transforms into codex-sandboxing (#15603)

2026-03-24 08:20:57 -07:00

sandbox_tags_tests.rs

Extract sandbox manager and transforms into codex-sandboxing (#15603)

2026-03-24 08:20:57 -07:00

sandbox_tags.rs

Extract sandbox manager and transforms into codex-sandboxing (#15603)

2026-03-24 08:20:57 -07:00

seatbelt.rs

Move macOS sandbox builders into codex-sandboxing (#15593)

2026-03-23 21:26:35 -07:00

session_prefix.rs

feat: change multi-agent to use path-like system instead of uuids (#15313)

2026-03-20 18:23:48 +00:00

session_rollout_init_error.rs

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

session_startup_prewarm.rs

fix(core): prevent hanging turn/start due to websocket warming issues (#14838)

2026-03-17 10:07:46 -07:00

shell_detect.rs

chore: rename codex-command to codex-shell-command (#11378)

2026-02-10 17:03:46 -08:00

shell_snapshot_tests.rs

feat: add suffix to shell snapshot name (#14938)

2026-03-17 17:59:27 +00:00

shell_snapshot.rs

feat: add suffix to shell snapshot name (#14938)

2026-03-17 17:59:27 +00:00

shell_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

shell.rs

Apply argument comment lint across codex-rs (#14652)

2026-03-16 16:48:15 -07:00

skills_watcher.rs

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

skills.rs

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

spawn.rs

sandboxing: plumb split sandbox policies through runtime (#13439)

2026-03-07 02:30:21 +00:00

state_db_bridge.rs

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

stream_events_utils_tests.rs

changed save directory to codex_home (#15222)

2026-03-19 15:16:26 -07:00

stream_events_utils.rs

Feat/restore image generation history (#15223)

2026-03-19 22:57:16 -07:00

test_support.rs

Add cached environment manager for exec server URL (#15785)

2026-03-25 16:14:36 -07:00

text_encoding_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

text_encoding.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

thread_manager_tests.rs

Add cached environment manager for exec server URL (#15785)

2026-03-25 16:14:36 -07:00

thread_manager.rs

Add cached environment manager for exec server URL (#15785)

2026-03-25 16:14:36 -07:00

thread_rollout_truncation_tests.rs

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

thread_rollout_truncation.rs

Extract rollout into its own crate (#15548)

2026-03-24 18:10:53 -07:00

turn_diff_tracker_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

turn_diff_tracker.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

turn_metadata_tests.rs

Plumb MCP turn metadata through _meta (#15190)

2026-03-19 22:05:13 +00:00

turn_metadata.rs

Move git utilities into a dedicated crate (#15564)

2026-03-24 13:26:23 -07:00

turn_timing_tests.rs

feat: add memory citation to agent message (#14821)

2026-03-18 10:03:38 +00:00

turn_timing.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

user_shell_command_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

user_shell_command.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

util_tests.rs

Move auth code into login crate (#15150)

2026-03-19 18:58:17 -07:00

util.rs

Move auth code into login crate (#15150)

2026-03-19 18:58:17 -07:00

web_search.rs

add missing fields to WebSearchAction and update app-server types (#10276)

2026-01-30 16:37:56 -08:00

windows_sandbox_read_grants_tests.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

windows_sandbox_read_grants.rs

fix: move inline codex-rs/core unit tests into sibling files (#14444)

2026-03-12 08:16:36 -07:00

windows_sandbox_tests.rs

Split features into codex-features crate (#15253)

2026-03-19 20:12:07 -07:00

windows_sandbox.rs

Use released DotSlash package for argument-comment lint (#15199)

2026-03-20 03:19:22 +00:00