viyatb-oai 636cdcb7ec Bind final-message output before running sandboxed tools (#58974) ...

## Why

`codex exec --output-last-message` wrote through a pathname after tools finished, allowing sandbox activity to redirect the final write by replacing that path with a symlink. The related risk is described in https://github.com/openai/codex/pull/25956.

## What changed

- Open the destination before starting the agent and retain its handle until the final write.
- Reject symlinks, Windows reparse points, and multiply linked files; verify that the pathname still identifies the bound file before truncating and after writing.
- Propagate output errors so the command fails when the destination cannot be opened or written safely.
- Preserve inherited Unix output streams, FIFOs, devices, and Windows `NUL` support, while avoiding duplicate final answers when human output targets stdout.

## Testing

Add regression coverage for sandbox-created symlinks across consecutive invocations, redirected stdout, delayed truncation, hard links, replaced paths, and Windows stream binding and filesystem identity checks.

GitOrigin-RevId: 4a31bd28a5eb2d0a9e200cb658eb7d19dc93e933

2026-11-02 20:36:39 +00:00

..

add_dir.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

agents_md.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

apply_patch.rs

Record OAuth provenance and login identity for account tokens (#55397)

2026-10-19 22:21:13 +00:00

approval_policy.rs

Add an --approve-for-me CLI flag (#36373)

2026-07-31 18:26:04 +00:00

auth_env.rs

Apply shared network policy throughout embedded Codex startup (#47411)

2026-09-23 00:49:19 +00:00

completion_backfill_tests.rs

Backfill exec completion items through paginated history (#57800)

2026-10-28 18:03:57 +00:00

cyber_access_program_tests.rs

Add per-turn Cyber access program selection to exec and the SDK (#49939)

2026-10-01 08:57:53 +00:00

daybreak.rs

Allow providers to opt into Cyber access programs (#58190)

2026-10-29 23:24:52 +00:00

ephemeral.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

hooks.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

mcp_required_exit.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

mod.rs

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00

originator.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

output_last_message.rs

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00

output_schema.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

prompt_stdin.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

resume.rs

Set explicit turn triggers for exec and TUI requests (#46569)

2026-09-19 01:58:19 +00:00

sandbox.rs

Remove the patched zsh shell execution backend (#52160)

2026-10-08 16:19:09 +00:00

seatbelt.rs

Allow trusted symlinks beneath CODEX_HOME on macOS (#42716)

2026-09-04 10:12:03 +00:00

server_error_exit.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

worktree.rs

Retire worktree and voice feature flags (#54175)

2026-10-15 03:48:33 +00:00