mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
Michael Bolin
421e159888
In order to expose Codex via an MCP server, I realized that we should be taking `cwd` as a parameter rather than assuming `std::env::current_dir()` as the `cwd`. Specifically, the user may want to start a session in a directory other than the one where the MCP server has been started. This PR makes `cwd: PathBuf` a required field of `Session` and threads it all the way through, though I think there is still an issue with not honoring `workdir` for `apply_patch`, which is something we also had to fix in the TypeScript version: https://github.com/openai/codex/pull/556. This also adds `-C`/`--cd` to change the cwd via the command line. To test, I ran: ``` cargo run --bin codex -- exec -C /tmp 'show the output of ls' ``` and verified it showed the contents of my `/tmp` folder instead of `$PWD`.
39 lines
1.3 KiB
Rust
39 lines
1.3 KiB
Rust
//! `debug landlock` implementation for the Codex CLI.
|
|
//!
|
|
//! On Linux the command is executed inside a Landlock + seccomp sandbox by
|
|
//! calling the low-level `exec_linux` helper from `codex_core::linux`.
|
|
|
|
use codex_core::protocol::SandboxPolicy;
|
|
use std::os::unix::process::ExitStatusExt;
|
|
use std::process;
|
|
use std::process::Command;
|
|
use std::process::ExitStatus;
|
|
|
|
/// Execute `command` in a Linux sandbox (Landlock + seccomp) the way Codex
|
|
/// would.
|
|
pub fn run_landlock(command: Vec<String>, sandbox_policy: SandboxPolicy) -> anyhow::Result<()> {
|
|
if command.is_empty() {
|
|
anyhow::bail!("command args are empty");
|
|
}
|
|
|
|
// Spawn a new thread and apply the sandbox policies there.
|
|
let handle = std::thread::spawn(move || -> anyhow::Result<ExitStatus> {
|
|
let cwd = std::env::current_dir()?;
|
|
codex_core::linux::apply_sandbox_policy_to_current_thread(sandbox_policy, &cwd)?;
|
|
let status = Command::new(&command[0]).args(&command[1..]).status()?;
|
|
Ok(status)
|
|
});
|
|
let status = handle
|
|
.join()
|
|
.map_err(|e| anyhow::anyhow!("Failed to join thread: {e:?}"))??;
|
|
|
|
// Use ExitStatus to derive the exit code.
|
|
if let Some(code) = status.code() {
|
|
process::exit(code);
|
|
} else if let Some(signal) = status.signal() {
|
|
process::exit(128 + signal);
|
|
} else {
|
|
process::exit(1);
|
|
}
|
|
}
|