codex

mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00

Files

T

iceweasel-oai 1f4c47343a Apply remote platform semantics to exec safety checks (#42113 )

## Why

Unified exec can run commands on an OS that differs from the Codex host. Using
host path and shell semantics for approval checks can therefore miss dangerous
Windows and PowerShell commands sent to a remote executor.

## What changed

- Thread the executor platform through command parsing, executable-name
  normalization, and dangerous-command classification. Legacy executors fall
  back to the host platform, while unknown reported platforms use Windows rules
  conservatively.
- Bound model-facing `exec_command` rejection messages and avoid echoing the
  rejected command into the error.
- Keep deterministic process IDs reserved after release so rejected test
  commands cannot reuse an earlier ID.

## Testing

- Add coverage that a long dangerous PowerShell command targeting a remote
  Windows executor is rejected with a bounded response.
- Verify deterministic process IDs advance after release.

GitOrigin-RevId: a26b4a63ea3d6df7140032b88b3e7aec0b85b948

2026-09-01 18:24:56 +00:00

snapshots

Track window and fork positions in turn metadata (#40987 )

2026-08-26 22:37:59 +00:00

abort_tasks.rs

Add per-turn cyber access program selection (#40687 )

2026-08-25 19:54:52 +00:00

additional_context.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

agent_execution.rs

Honor environment-resolved workspace roots (#40912 )

2026-08-26 16:28:35 +00:00

agent_websocket.rs

Make the update_plan tool opt-in (#41744 )

2026-08-31 00:53:30 +00:00

agents_md.rs

Gate content item kinds behind a feature flag (#40450 )

2026-08-24 18:22:13 +00:00

apply_patch_cli.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

apply_patch_serialization.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

approvals.rs

Add credential brokering to network proxy feature config (#40466 )

2026-08-24 19:52:27 +00:00

audio_truncation.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

auto_review.rs

Make Ultra reasoning fallback model-aware (#41206 )

2026-08-27 21:03:09 +00:00

catalog_permission_messages.rs

Source async user message descriptions from the model catalog (#41461 )

2026-08-29 03:44:01 +00:00

cli_stream.rs

Sanitize credentials from Git remote metadata (#40713 )

2026-08-25 21:34:05 +00:00

client_websockets.rs

Preserve raw response usage metadata (#41980 )

2026-09-01 05:17:11 +00:00

client.rs

Remove selected core test cases (#42066 )

2026-09-01 14:43:27 +00:00

cloud_config.rs

Preserve managed deny-read rules across permission updates (#40004 )

2026-08-21 20:15:23 +00:00

code_mode_elicitation.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

code_mode.rs

Omit undersized WAV output from Code Mode (#41934 )

2026-08-31 23:36:04 +00:00

codex_delegate.rs

Preserve MCP tool output as content items (#40737 )

2026-08-25 23:42:50 +00:00

collaboration_instructions.rs

Remove selected core test cases (#42066 )

2026-09-01 14:43:27 +00:00

compact_remote_parity.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

compact_remote.rs

Persist response token usage in rollout history (#41912 )

2026-08-31 21:15:38 +00:00

compact_resume_fork.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

compact.rs

Persist response token usage in rollout history (#41912 )

2026-08-31 21:15:38 +00:00

context_annotations.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

current_time_reminder.rs

Add configurable gating for the sleep tool (#41243 )

2026-08-28 02:09:07 +00:00

cyber_access_program.rs

Add per-turn cyber access program selection (#40687 )

2026-08-25 19:54:52 +00:00

cyber_exec_policy.rs

Standardize shell execution on unified exec (#39772 )

2026-08-20 18:29:35 +00:00

daybreak_access.rs

Attach verified access context to eligible plugin MCP calls (#41005 )

2026-08-27 00:02:26 +00:00

deprecation_notice.rs

Standardize shell execution on unified exec (#39772 )

2026-08-20 18:29:35 +00:00

exec_policy.rs

Honor environment-resolved workspace roots (#40912 )

2026-08-26 16:28:35 +00:00

exec.rs

Add network environment ID plumbing (#28766 )

2026-06-18 14:09:38 +02:00

extension_sandbox.rs

Expand extension permission regression coverage (#41946 )

2026-09-01 00:42:19 +00:00

external_auth.rs

Surface model provider authentication recovery progress (#41239 )

2026-08-28 01:14:02 +00:00

fork_thread.rs

Restore thread cwd from owned settings snapshots (#41567 )

2026-08-29 19:57:06 +00:00

git_enrichment.rs

Sanitize credentials from Git remote metadata (#40713 )

2026-08-25 21:34:05 +00:00

guardian_authorization.rs

Preserve Guardian authorization across history compaction (#41660 )

2026-08-30 11:56:24 +00:00

guardian_history.rs

Preserve Guardian history across thread reconstruction (#42065 )

2026-09-01 14:33:58 +00:00

guardian_mcp_elicitation.rs

Attribute nested REPL reviews to their tool calls (#42082 )

2026-09-01 15:34:03 +00:00

guardian_review_cancellation.rs

Cancel Guardian reviews with their tool calls (#40021 )

2026-08-21 21:51:12 +00:00

guardian_review.rs

Improve Guardian report diagnostics (#42033 )

2026-09-01 11:14:20 +00:00

guardian_subagent_authorization.rs

Improve Guardian report diagnostics (#42033 )

2026-09-01 11:14:20 +00:00

hooks_executor.rs

Support app targets in executor plugin hooks (#41456 )

2026-08-29 03:14:35 +00:00

hooks_mcp.rs

Set working directories for environment MCP tests (#41683 )

2026-08-30 14:04:06 +00:00

hooks.rs

Treat bundled cleanup hooks as built-ins (#42110 )

2026-09-01 18:02:27 +00:00

image_rollout.rs

Annotate user input and contextual fragments with content kinds (#40196 )

2026-08-23 06:10:44 +00:00

injected_models_cache.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

interrupt_hooks.rs

Add hooks for interrupted turns (#40511 )

2026-08-25 01:27:18 +00:00

items.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

json_result.rs

Remove redundant test coverage (#42069 )

2026-09-01 15:04:11 +00:00

live_cli.rs

[codex] Use expect in integration tests (#28441 )

2026-06-15 21:53:47 -07:00

mcp_auth_elicitation.rs

Preserve MCP tool output as content items (#40737 )

2026-08-25 23:42:50 +00:00

mcp_auth_refresh.rs

Attach verified access context to eligible plugin MCP calls (#41005 )

2026-08-27 00:02:26 +00:00

mcp_optional_startup_grace.rs

Make the optional MCP startup grace configurable (#41199 )

2026-08-27 20:31:40 +00:00

mcp_refresh_cleanup.rs

Negotiate MCP extensions per app-server session (#36910 )

2026-08-04 15:23:43 +00:00

mcp_startup_refresh_http_proxy.rs

Honor environment-resolved workspace roots (#40912 )

2026-08-26 16:28:35 +00:00

mcp_tool_cache.rs

Set working directories for environment MCP tests (#41683 )

2026-08-30 14:04:06 +00:00

mcp_tool_exposure.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

mcp_turn_metadata.rs

Honor app link settings for MCP tool approvals (#42056 )

2026-09-01 13:43:27 +00:00

mod.rs

Allow per-call sideband endpoints for existing realtime calls (#41923 )

2026-08-31 22:29:40 +00:00

model_overrides.rs

[5 of 7] Replace OverrideTurnContext with ThreadSettings (#22508 )

2026-05-18 21:03:51 -07:00

model_runtime_selectors.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

model_switching.rs

Make Ultra reasoning fallback model-aware (#41206 )

2026-08-27 21:03:09 +00:00

model_visible_layout.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

models_cache_ttl.rs

Source async user message descriptions from the model catalog (#41461 )

2026-08-29 03:44:01 +00:00

models_etag_responses.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

multi_agent_mode.rs

Source proactive multi-agent instructions from the model catalog (#41457 )

2026-08-29 03:28:19 +00:00

multi_agent_resume.rs

Wait for turn completion events in multi-agent resume tests (#39702 )

2026-08-20 11:57:32 +00:00

multi_exec_server_sandbox.rs

Attach verified access context to eligible plugin MCP calls (#41005 )

2026-08-27 00:02:26 +00:00

network_approval.rs

Require approval for input to escalated terminals (#40978 )

2026-08-26 21:39:05 +00:00

openai_file_mcp.rs

Preserve MCP tool output as content items (#40737 )

2026-08-25 23:42:50 +00:00

otel.rs

Remove selected core test cases (#42066 )

2026-09-01 14:43:27 +00:00

override_updates.rs

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

pending_input.rs

Persist response token usage in rollout history (#41912 )

2026-08-31 21:15:38 +00:00

permissions_messages.rs

Source async user message descriptions from the model catalog (#41461 )

2026-08-29 03:44:01 +00:00

personality.rs

Make the update_plan tool opt-in (#41744 )

2026-08-31 00:53:30 +00:00

plugins.rs

Prefer remote Sites over the bundled plugin (#42100 )

2026-09-01 16:58:54 +00:00

prompt_cache_key.rs

Use session IDs for prompt cache keys (#33035 )

2026-07-14 10:37:23 +00:00

prompt_caching.rs

Make the update_plan tool opt-in (#41744 )

2026-08-31 00:53:30 +00:00

prompt_debug_tests.rs

Enable git attribution across Codex entry points (#34819 )

2026-07-22 20:23:35 +00:00

quota_exceeded.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

realtime_conversation.rs

Record realtime conversation history in Core (#41924 )

2026-08-31 22:38:23 +00:00

realtime_initial_items.rs

Add a realtime delegation acknowledgement control (#36413 )

2026-08-01 01:17:26 +00:00

realtime_sideband_endpoint.rs

Allow per-call sideband endpoints for existing realtime calls (#41923 )

2026-08-31 22:29:40 +00:00

remote_env.rs

Match Windows shell guidance to the executor platform (#41368 )

2026-08-28 17:09:22 +00:00

remote_models.rs

Make the update_plan tool opt-in (#41744 )

2026-08-31 00:53:30 +00:00

request_compression.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

request_permissions_tool.rs

Make permission transforms aware of executor path context (#41909 )

2026-08-31 20:50:44 +00:00

request_permissions.rs

Make permission transforms aware of executor path context (#41909 )

2026-08-31 20:50:44 +00:00

request_plugin_install.rs

Set working directories for environment MCP tests (#41683 )

2026-08-30 14:04:06 +00:00

request_user_input.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

responses_api_proxy_headers.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

responses_lite.rs

Give Responses Lite prefix items stable IDs (#40962 )

2026-08-26 19:44:12 +00:00

responses_system_proxy.rs

Migrate login HTTP construction to HttpClient (#34643 )

2026-07-22 00:50:28 +00:00

resume_warning.rs

Persist response token usage in rollout history (#41912 )

2026-08-31 21:15:38 +00:00

resume.rs

Use turn environment settings for sandbox execution (#40771 )

2026-08-26 03:28:57 +00:00

retry_after.rs

Decouple HTTP retry backoff from overload integration testing (#41313 )

2026-08-28 10:39:10 +00:00

review.rs

Allow models to enable token budgeting by default (#41803 )

2026-08-31 08:31:23 +00:00

rmcp_client.rs

Support package-style MCP server names (#41700 )

2026-08-30 16:45:34 +00:00

rollout_budget.rs

Annotate user input and contextual fragments with content kinds (#40196 )

2026-08-23 06:10:44 +00:00

rollout_compression.rs

Include shared histories in rollout compression (#42039 )

2026-09-01 12:23:20 +00:00

rollout_list_find.rs

Honor the configured SQLite home across state consumers (#34994 )

2026-07-23 19:19:35 +00:00

safety_buffering.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

safety_check_downgrade.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

search_tool.rs

Set working directories for environment MCP tests (#41683 )

2026-08-30 14:04:06 +00:00

send_user_message_async.rs

Source async user message descriptions from the model catalog (#41461 )

2026-08-29 03:44:01 +00:00

settings_commits.rs

Restore thread cwd from owned settings snapshots (#41567 )

2026-08-29 19:57:06 +00:00

settings_constraints.rs

Validate step settings against proposed permissions (#40647 )

2026-08-25 17:27:04 +00:00

shell_snapshot.rs

Support configurable timeouts for thread shell commands (#41384 )

2026-08-28 18:07:40 +00:00

skill_approval.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

skills_extension.rs

Expand extension permission regression coverage (#41946 )

2026-09-01 00:42:19 +00:00

skills.rs

Reduce skill catalog prompts with path aliases (#41011 )

2026-08-27 01:22:23 +00:00

spawn_agent_description.rs

Make Ultra reasoning fallback model-aware (#41206 )

2026-08-27 21:03:09 +00:00

sqlite_state.rs

Track window and fork positions in turn metadata (#40987 )

2026-08-26 22:37:59 +00:00

step_settings_snapshots.rs

Snapshot resolved settings for each model step (#40651 )

2026-08-25 17:41:22 +00:00

step_settings.rs

Allow models to enable token budgeting by default (#41803 )

2026-08-31 08:31:23 +00:00

stream_error_allows_next_turn.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

stream_no_completed.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

subagent_notifications.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

subagent_service_tier.rs

Make subagents follow the root service tier (#41308 )

2026-08-28 09:48:13 +00:00

token_budget.rs

Allow models to enable token budgeting by default (#41803 )

2026-08-31 08:31:23 +00:00

token_usage_rollout.rs

Persist response token usage in rollout history (#41912 )

2026-08-31 21:15:38 +00:00

tool_harness.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

tool_lifecycle.rs

Set working directories for environment MCP tests (#41683 )

2026-08-30 14:04:06 +00:00

tool_parallelism.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

tools.rs

Update tests for default-enabled update_plan (#41630 )

2026-08-30 07:40:36 +00:00

truncation.rs

Set working directories for environment MCP tests (#41683 )

2026-08-30 14:04:06 +00:00

turn_input_submission.rs

Add per-turn cyber access program selection (#40687 )

2026-08-25 19:54:52 +00:00

turn_state.rs

Standardize shell execution on unified exec (#39757 )

2026-08-20 17:46:05 +00:00

unified_exec_process_events.rs

Apply remote platform semantics to exec safety checks (#42113 )

2026-09-01 18:24:56 +00:00

unified_exec_stdin_approval.rs

Review terminal input against retained permissions (#41328 )

2026-08-28 11:38:03 +00:00

unified_exec_stdin_review_size.rs

Reject NUL bytes in reviewed terminal input (#41354 )

2026-08-28 15:44:48 +00:00

unified_exec_zsh_fork_approvals.rs

Require approval for input to escalated terminals (#40978 )

2026-08-26 21:39:05 +00:00

unified_exec.rs

Preserve one-shot exec when unified exec is disabled (#41393 )

2026-08-28 19:04:54 +00:00

unstable_features_warning.rs

Extract persisted history types into a dedicated crate (#37871 )

2026-08-10 19:26:52 +00:00

user_notification.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

user_shell_cmd.rs

Support configurable timeouts for thread shell commands (#41384 )

2026-08-28 18:07:40 +00:00

view_image.rs

Make Ultra reasoning fallback model-aware (#41206 )

2026-08-27 21:03:09 +00:00

web_search.rs

Add an Amazon Bedrock Runtime provider (#38470 )

2026-08-14 01:23:59 +00:00

websocket_fallback.rs

Unify turn input submission and routing (#38275 )

2026-08-13 00:00:16 +00:00

window_headers.rs

Track window and fork positions in turn metadata (#40987 )

2026-08-26 22:37:59 +00:00

windows_sandbox.rs

Preserve Windows root reads with deny-read rules (#40441 )

2026-08-24 17:29:21 +00:00

workspace_roots.rs

Honor environment-resolved workspace roots (#40912 )

2026-08-26 16:28:35 +00:00

worktree_trust.rs

Validate linked worktrees before inheriting project trust (#39616 )

2026-08-20 06:29:32 +00:00