mirror of https://github.com/openai/codex.git synced 2026-09-17 12:23:33 +00:00

Files

Michael Bolin 506948c80f chore: introduce SandboxPolicy::WorkspaceWrite::use_exact_writable_roots

Without this change, it is challenging to create integration tests to
verify that the folders not included in `writable_roots` in
`SandboxPolicy::WorkspaceWrite` are read-only because, by default,
`get_writable_roots_with_cwd()` includes `TMPDIR`, which is where most integrationt
tests do their work.

This introduces a `use_exact_writable_roots` option to disable the default
includes returned by `get_writable_roots_with_cwd()`.

2025-08-01 11:37:13 -07:00

src

fix: move arg0 handling out of codex-linux-sandbox and into its own crate (#1697 )

2025-07-28 08:31:24 -07:00

tests

chore: introduce SandboxPolicy::WorkspaceWrite::use_exact_writable_roots

2025-08-01 11:37:13 -07:00

Cargo.toml

Auto format toml (#1745 )

2025-07-30 18:37:00 -07:00

README.md

fix: overhaul how we spawn commands under seccomp/landlock on Linux (#1086 )

2025-05-23 11:37:07 -07:00

README.md

codex-linux-sandbox

This crate is responsible for producing:

a codex-linux-sandbox standalone executable for Linux that is bundled with the Node.js version of the Codex CLI
a lib crate that exposes the business logic of the executable as run_main() so that
- the codex-exec CLI can check if its arg0 is codex-linux-sandbox and, if so, execute as if it were codex-linux-sandbox
- this should also be true of the codex multitool CLI