Skip to content

Persist upstream Radar reviews #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yvette-carlisle merged 1 commit into from
Jun 8, 2026
Merged

Persist upstream Radar reviews #235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 141 additions & 0 deletions artifacts/github/bundles/openai-codex-pr-26307.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,141 @@
{
"analysis_mode": "pr_first",
"commits": [
{
"author": "iceweasel-oai",
"committed_at": "2026-06-04T04:19:31Z",
"message": "Respect Windows read-only sandbox in exec policy",
"sha": "1069e2b232186a41062acb09e6a8618bf38f39c0",
"url": "https://github.com/openai/codex/commit/1069e2b232186a41062acb09e6a8618bf38f39c0"
},
{
"author": "iceweasel-oai",
"committed_at": "2026-06-04T04:57:10Z",
"message": "Cover managed Windows sandbox profiles in exec policy",
"sha": "e81eeb17681260aa57a674008396a9f28c72b523",
"url": "https://github.com/openai/codex/commit/e81eeb17681260aa57a674008396a9f28c72b523"
},
{
"author": "iceweasel-oai",
"committed_at": "2026-06-04T14:38:10Z",
"message": "Fix Unix exec policy sandbox level plumbing",
"sha": "733bce9026a455d58beb3767aa1b776ebefb35b8",
"url": "https://github.com/openai/codex/commit/733bce9026a455d58beb3767aa1b776ebefb35b8"
},
{
"author": "iceweasel-oai",
"committed_at": "2026-06-04T15:49:21Z",
"message": "Remove stale intercepted exec policy cwd",
"sha": "a4ae296709b6b998f5084fdbd977165a59ef1f82",
"url": "https://github.com/openai/codex/commit/a4ae296709b6b998f5084fdbd977165a59ef1f82"
},
{
"author": "iceweasel-oai",
"committed_at": "2026-06-04T16:20:34Z",
"message": "Remove stale shell action provider cwd",
"sha": "ec258935d84587f16b1dd7ce7c6dfa986ad9a113",
"url": "https://github.com/openai/codex/commit/ec258935d84587f16b1dd7ce7c6dfa986ad9a113"
},
{
"author": "iceweasel-oai",
"committed_at": "2026-06-04T19:02:28Z",
"message": "Add Windows exec policy integration coverage",
"sha": "ca363cb953a62ef24d7b3e0ab845b77d8995c973",
"url": "https://github.com/openai/codex/commit/ca363cb953a62ef24d7b3e0ab845b77d8995c973"
},
{
"author": "iceweasel-oai",
"committed_at": "2026-06-05T17:29:04Z",
"message": "Address Windows sandbox assertion feedback",
"sha": "c86ad28615e8eff9a0e7bce6243093e2c645566e",
"url": "https://github.com/openai/codex/commit/c86ad28615e8eff9a0e7bce6243093e2c645566e"
}
],
"default_branch": "main",
"docs_refs": [],
"examples_refs": [],
"extracted_flags": [
"--sandbox",
"ENABLE_INTERCEPTED_EXEC_POLICY_SHELL_WRAPPER_PARSING"
],
"files": [
{
"additions": 16,
"deletions": 18,
"patch_excerpt": "@@ -20,6 +20,7 @@ use codex_execpolicy::RuleMatch;\n use codex_execpolicy::blocking_append_allow_prefix_rule;\n use codex_execpolicy::blocking_append_network_rule;\n use codex_protocol::approvals::ExecPolicyAmendment;\n+use codex_protocol::config_types::WindowsSandboxLevel;\n use codex_protocol::models::PermissionProfile;\n use codex_protocol::permissions::FileSystemSandboxKind;\n use codex_protocol::protocol::AskForApproval;\n@@ -120,7 +121,7 @@ pub(crate) enum ExecPolicyCommandOrigin {\n pub(crate) struct UnmatchedCommandContext<'a> {\n pub(crate) approval_policy: AskForApproval,\n pub(crate) permission_profile: &'a PermissionProfile,\n- pub(crate) sandbox_cwd: &'a Path,\n+ pub(crate) windows_sandbox_level: WindowsSandboxLevel,\n pub(crate) sandbox_permissions: SandboxPermissions,\n pub(crate) used_complex_parsing: bool,\n pub(crate) command_origin: ExecPolicyCommandOrigin,\n@...",
"path": "codex-rs/core/src/exec_policy.rs",
"status": "modified"
},
{
"additions": 41,
"deletions": 23,
"patch_excerpt": "@@ -15,6 +15,7 @@ use codex_config::Sourced;\n use codex_config::config_toml::ConfigToml;\n use codex_config::config_toml::ProjectConfig;\n use codex_protocol::config_types::TrustLevel;\n+use codex_protocol::config_types::WindowsSandboxLevel;\n use codex_protocol::models::PermissionProfile;\n use codex_protocol::permissions::FileSystemAccessMode;\n use codex_protocol::permissions::FileSystemPath;\n@@ -1088,7 +1089,7 @@ fn unmatched_granular_policy_still_prompts_for_restricted_sandbox_escalation() {\n mcp_elicitations: true,\n }),\n permission_profile: &PermissionProfile::read_only(),\n- sandbox_cwd: Path::new(\"/tmp\"),\n+ windows_sandbox_level: WindowsSandboxLevel::Disabled,\n sandbox_permissions: SandboxPermissions::RequireEscalated,\n used_complex_parsing: false,\n command_o...",
"path": "codex-rs/core/src/exec_policy_tests.rs",
"status": "modified"
},
{
"additions": 85,
"deletions": 2,
"patch_excerpt": "@@ -1,6 +1,5 @@\n use super::*;\n use pretty_assertions::assert_eq;\n-use std::path::Path;\n \n #[tokio::test]\n async fn evaluates_powershell_inner_commands_against_prompt_rules() {\n@@ -79,7 +78,7 @@ fn unmatched_safe_powershell_words_are_allowed() {\n UnmatchedCommandContext {\n approval_policy: AskForApproval::UnlessTrusted,\n permission_profile: &PermissionProfile::read_only(),\n- sandbox_cwd: Path::new(\"/tmp\"),\n+ windows_sandbox_level: WindowsSandboxLevel::Disabled,\n sandbox_permissions: SandboxPermissions::UseDefault,\n used_complex_parsing: false,\n command_origin: ExecPolicyCommandOrigin::PowerShell,\n@@ -88,6 +87,90 @@ fn unmatched_safe_powershell_words_are_allowed() {\n );\n }\n \n+#[test]\n+fn read_only_windows_sandbox_runs_unmatched_commands_under_sandbox() {\n+ let c...",
"path": "codex-rs/core/src/exec_policy_windows_tests.rs",
"status": "modified"
},
{
"additions": 1,
"deletions": 2,
"patch_excerpt": "@@ -10881,8 +10881,7 @@ async fn rejects_escalated_permissions_when_policy_not_on_request() {\n command: &command,\n approval_policy: turn_context.approval_policy.value(),\n permission_profile: turn_context.permission_profile(),\n- #[allow(deprecated)]\n- sandbox_cwd: turn_context.cwd.as_path(),\n+ windows_sandbox_level: turn_context.windows_sandbox_level,\n sandbox_permissions: SandboxPermissions::UseDefault,\n prefix_rule: None,\n })",
"path": "codex-rs/core/src/session/tests.rs",
"status": "modified"
},
{
"additions": 1,
"deletions": 2,
"patch_excerpt": "@@ -167,8 +167,7 @@ async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, Func\n command: &exec_params.command,\n approval_policy: turn.approval_policy.value(),\n permission_profile: turn.permission_profile(),\n- #[allow(deprecated)]\n- sandbox_cwd: turn.cwd.as_path(),\n+ windows_sandbox_level: turn.windows_sandbox_level,\n sandbox_permissions: if effective_additional_permissions.permissions_preapproved {\n codex_protocol::models::SandboxPermissions::UseDefault\n } else {",
"path": "codex-rs/core/src/tools/handlers/shell.rs",
"status": "modified"
},
{
"additions": 6,
"deletions": 10,
"patch_excerpt": "@@ -65,7 +65,6 @@ use codex_shell_escalation::ShellCommandExecutor;\n use codex_shell_escalation::Stopwatch;\n use codex_utils_absolute_path::AbsolutePathBuf;\n use std::collections::HashMap;\n-use std::path::Path;\n use std::path::PathBuf;\n use std::sync::Arc;\n use std::time::Duration;\n@@ -224,7 +223,6 @@ pub(super) async fn try_run_zsh_fork(\n approval_policy: ctx.turn.approval_policy.value(),\n permission_profile: command_executor.permission_profile.clone(),\n file_system_sandbox_policy: command_executor.file_system_sandbox_policy.clone(),\n- sandbox_policy_cwd: command_executor.sandbox_policy_cwd.clone(),\n sandbox_permissions: req.sandbox_permissions,\n approval_sandbox_permissions,\n prompt_permissions: req.additional_permissions.clone(),\n@@ -297,7 +295,6 @@ pub(crate) async fn prepare_unified_exec_zsh_fork(\n approval_policy: ctx.t...",
"path": "codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs",
"status": "modified"
},
{
"additions": 7,
"deletions": 14,
"patch_excerpt": "@@ -16,6 +16,7 @@ use codex_execpolicy::PolicyParser;\n use codex_execpolicy::RuleMatch;\n use codex_hooks::Hooks;\n use codex_hooks::HooksConfig;\n+use codex_protocol::config_types::WindowsSandboxLevel;\n use codex_protocol::models::AdditionalPermissionProfile;\n use codex_protocol::models::FileSystemPermissions;\n use codex_protocol::models::PermissionProfile;\n@@ -456,7 +457,6 @@ async fn execve_permission_request_hook_short_circuits_prompt() -> anyhow::Resul\n approval_policy: AskForApproval::OnRequest,\n permission_profile: PermissionProfile::read_only(),\n file_system_sandbox_policy: read_only_file_system_sandbox_policy(),\n- sandbox_policy_cwd: workdir.clone(),\n sandbox_permissions: SandboxPermissions::RequireEscalated,\n approval_sandbox_permissions: SandboxPermissions::RequireEscalated,\n prompt_permissions: None,\n@@ -508,7 +508,6 @@ fn e...",
"path": "codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs",
"status": "modified"
},
{
"additions": 1,
"deletions": 3,
"patch_excerpt": "@@ -1019,9 +1019,7 @@ impl UnifiedExecProcessManager {\n command: &request.command,\n approval_policy: context.turn.approval_policy.value(),\n permission_profile: context.turn.permission_profile(),\n- // The process cwd may be model-controlled. Policy resolution\n- // stays anchored to the selected turn environment cwd instead.\n- sandbox_cwd: request.sandbox_cwd.as_path(),\n+ windows_sandbox_level: context.turn.windows_sandbox_level,\n sandbox_permissions: if request.additional_permissions_preapproved {\n crate::sandboxing::SandboxPermissions::UseDefault\n } else {",
"path": "codex-rs/core/src/unified_exec/process_manager.rs",
"status": "modified"
},
{
"additions": 71,
"deletions": 0,
"patch_excerpt": "@@ -87,6 +87,77 @@ fn assert_no_matched_rules_invariant(output_item: &Value) {\n );\n }\n \n+#[cfg(windows)]\n+#[tokio::test]\n+async fn unified_exec_disabled_windows_sandbox_rejects_managed_read_only_command() -> Result<()> {\n+ let server = start_mock_server().await;\n+ let mut builder = test_codex().with_config(|config| {\n+ config\n+ .features\n+ .enable(Feature::UnifiedExec)\n+ .expect(\"test config should allow feature update\");\n+ config\n+ .features\n+ .disable(Feature::WindowsSandbox)\n+ .expect(\"test config should allow feature update\");\n+ config\n+ .features\n+ .disable(Feature::WindowsSandboxElevated)\n+ .expect(\"test config should allow feature update\");\n+ config.set_windows_sandbox_enabled(false);\n+ config.set_windows_elevated_sandbox_enabled(false);\n+...",
"path": "codex-rs/core/tests/suite/exec_policy.rs",
"status": "modified"
}
],
"linked_issues": [],
"notes": [
"Built from GitHub pull-request, commits, files, and repo endpoints."
],
"primary_pr": {
"body": "## Why\n\nWindows managed filesystem permissions can now be backed by a real Windows sandbox. `exec-policy` was still treating the managed read-only policy shape as if there were never a sandbox backend, so benign unmatched commands such as PowerShell directory listings could be rejected with `blocked by policy` even when `windows.sandbox` was enabled.\n\nThe inverse case still needs to stay conservative: when the Windows sandbox backend is disabled, managed filesystem restrictions are only configuration intent, not an enforced filesystem boundary. That applies to writable-root restricted profiles too, not just read-only profiles.\n\n## What Changed\n\n- Thread the effective `WindowsSandboxLevel` into exec-policy approval decisions for shell, unified exec, and intercepted shell exec paths.\n- Treat managed restricted filesystem profiles as lacking sandbox protection only on Windows when `WindowsSandboxLevel::Disabled`.\n- Exclude full-disk-write profiles from that no-backend path because they do not rely on filesystem sandbox enforcement.\n- Remove the cwd-sensitive read-only heuristic and the now-stale cwd plumbing from exec-policy approval contexts.\n- Add Windows coverage for both enabled-sandbox and disabled-backend behavior, including a writable-root managed profile.\n\n## Validation\n\n- Added/updated `exec_policy` coverage for managed filesystem restrictions, full-disk-write exclusion, enabled Windows sandbox behavior, and disabled-backend read-only/writable-root behavior.\n- `just test -p codex-core exec_policy` — 100 passed, 10 leaky\n- Empirical local `codex exec` probe with `--sandbox read-only -c 'windows.sandbox=\"unelevated\"'`: PowerShell directory listing completed successfully.\n- Disabled-backend control with Windows sandbox cleared: the same command was rejected with `blocked by policy`.",
"labels": [],
"merged_at": "2026-06-05T18:20:52Z",
"number": 26307,
"state": "merged",
"title": "[codex] Respect Windows sandbox backend in exec policy",
"url": "https://github.com/openai/codex/pull/26307"
},
"repo": "openai/codex",
"schema": "github_change_bundle/v1"
}
Loading