viyatb-oai 636cdcb7ec Bind final-message output before running sandboxed tools (#58974) ...

## Why

`codex exec --output-last-message` wrote through a pathname after tools finished, allowing sandbox activity to redirect the final write by replacing that path with a symlink. The related risk is described in https://github.com/openai/codex/pull/25956.

## What changed

- Open the destination before starting the agent and retain its handle until the final write.
- Reject symlinks, Windows reparse points, and multiply linked files; verify that the pathname still identifies the bound file before truncating and after writing.
- Propagate output errors so the command fails when the destination cannot be opened or written safely.
- Preserve inherited Unix output streams, FIFOs, devices, and Windows `NUL` support, while avoiding duplicate final answers when human output targets stdout.

## Testing

Add regression coverage for sandbox-created symlinks across consecutive invocations, redirected stdout, delayed truncation, hard links, replaced paths, and Windows stream binding and filesystem identity checks.

GitOrigin-RevId: 4a31bd28a5eb2d0a9e200cb658eb7d19dc93e933

2026-11-02 20:36:39 +00:00

..

src

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00

tests

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00

BUILD.bazel

Avoid recompiling Bazel integration tests for runtime fixture changes (#57742)

2026-10-28 13:55:51 +00:00

Cargo.toml

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00