From ad41182ee85b1b0226135bdd6312f5e365e00c1c Mon Sep 17 00:00:00 2001 From: iceweasel-oai Date: Thu, 18 Dec 2025 11:52:32 -0800 Subject: [PATCH] grant read ACL to exe directory first so we can call the command runner (#8275) when granting read access to the sandbox user, grant the codex/command-runner exe directory first so commands can run before the entire read ACL process is finished. --- codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs index 8ac0157a6..a008fc721 100644 --- a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs +++ b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs @@ -195,6 +195,11 @@ fn canonical_existing(paths: &[PathBuf]) -> Vec { pub(crate) fn gather_read_roots(command_cwd: &Path, policy: &SandboxPolicy) -> Vec { let mut roots: Vec = Vec::new(); + if let Ok(exe) = std::env::current_exe() { + if let Some(dir) = exe.parent() { + roots.push(dir.to_path_buf()); + } + } for p in [ PathBuf::from(r"C:\Windows"), PathBuf::from(r"C:\Program Files"),