Run exec-server fs operations through sandbox helper (#17294)

## Summary
- run exec-server filesystem RPCs requiring sandboxing through a
`codex-fs` arg0 helper over stdin/stdout
- keep direct local filesystem execution for `DangerFullAccess` and
external sandbox policies
- remove the standalone exec-server binary path in favor of top-level
arg0 dispatch/runtime paths
- add sandbox escape regression coverage for local and remote filesystem
paths

## Validation
- `just fmt`
- `git diff --check`
- remote devbox: `cd codex-rs && bazel test --bes_backend=
--bes_results_url= //codex-rs/exec-server:all` (6/6 passed)

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/exec-server/src/server/file_system_handler.rs

@@ -6,9 +6,11 @@ use codex_app_server_protocol::JSONRPCErrorError;
 
 use crate::CopyOptions;
 use crate::CreateDirectoryOptions;
+use crate::ExecServerRuntimePaths;
 use crate::ExecutorFileSystem;
 use crate::RemoveOptions;
 use crate::local_file_system::LocalFileSystem;
+use crate::protocol::FS_WRITE_FILE_METHOD;
 use crate::protocol::FsCopyParams;
 use crate::protocol::FsCopyResponse;
 use crate::protocol::FsCreateDirectoryParams;
@@ -28,19 +30,25 @@ use crate::rpc::internal_error;
 use crate::rpc::invalid_request;
 use crate::rpc::not_found;
 
-#[derive(Clone, Default)]
+#[derive(Clone)]
 pub(crate) struct FileSystemHandler {
     file_system: LocalFileSystem,
 }
 
 impl FileSystemHandler {
+    pub(crate) fn new(runtime_paths: ExecServerRuntimePaths) -> Self {
+        Self {
+            file_system: LocalFileSystem::with_runtime_paths(runtime_paths),
+        }
+    }
+
     pub(crate) async fn read_file(
         &self,
         params: FsReadFileParams,
     ) -> Result<FsReadFileResponse, JSONRPCErrorError> {
         let bytes = self
             .file_system
-            .read_file_with_sandbox_policy(&params.path, params.sandbox_policy.as_ref())
+            .read_file(&params.path, params.sandbox.as_ref())
             .await
             .map_err(map_fs_error)?;
         Ok(FsReadFileResponse {
@@ -54,11 +62,11 @@ impl FileSystemHandler {
     ) -> Result<FsWriteFileResponse, JSONRPCErrorError> {
         let bytes = STANDARD.decode(params.data_base64).map_err(|err| {
             invalid_request(format!(
-                "fs/writeFile requires valid base64 dataBase64: {err}"
+                "{FS_WRITE_FILE_METHOD} requires valid base64 dataBase64: {err}"
             ))
         })?;
         self.file_system
-            .write_file_with_sandbox_policy(&params.path, bytes, params.sandbox_policy.as_ref())
+            .write_file(&params.path, bytes, params.sandbox.as_ref())
             .await
             .map_err(map_fs_error)?;
         Ok(FsWriteFileResponse {})
@@ -68,13 +76,12 @@ impl FileSystemHandler {
         &self,
         params: FsCreateDirectoryParams,
     ) -> Result<FsCreateDirectoryResponse, JSONRPCErrorError> {
+        let recursive = params.recursive.unwrap_or(true);
         self.file_system
-            .create_directory_with_sandbox_policy(
+            .create_directory(
                 &params.path,
-                CreateDirectoryOptions {
-                    recursive: params.recursive.unwrap_or(true),
-                },
-                params.sandbox_policy.as_ref(),
+                CreateDirectoryOptions { recursive },
+                params.sandbox.as_ref(),
             )
             .await
             .map_err(map_fs_error)?;
@@ -87,7 +94,7 @@ impl FileSystemHandler {
     ) -> Result<FsGetMetadataResponse, JSONRPCErrorError> {
         let metadata = self
             .file_system
-            .get_metadata_with_sandbox_policy(&params.path, params.sandbox_policy.as_ref())
+            .get_metadata(&params.path, params.sandbox.as_ref())
             .await
             .map_err(map_fs_error)?;
         Ok(FsGetMetadataResponse {
@@ -104,33 +111,30 @@ impl FileSystemHandler {
     ) -> Result<FsReadDirectoryResponse, JSONRPCErrorError> {
         let entries = self
             .file_system
-            .read_directory_with_sandbox_policy(&params.path, params.sandbox_policy.as_ref())
+            .read_directory(&params.path, params.sandbox.as_ref())
             .await
-            .map_err(map_fs_error)?;
-        Ok(FsReadDirectoryResponse {
-            entries: entries
-                .into_iter()
-                .map(|entry| FsReadDirectoryEntry {
-                    file_name: entry.file_name,
-                    is_directory: entry.is_directory,
-                    is_file: entry.is_file,
-                })
-                .collect(),
-        })
+            .map_err(map_fs_error)?
+            .into_iter()
+            .map(|entry| FsReadDirectoryEntry {
+                file_name: entry.file_name,
+                is_directory: entry.is_directory,
+                is_file: entry.is_file,
+            })
+            .collect();
+        Ok(FsReadDirectoryResponse { entries })
     }
 
     pub(crate) async fn remove(
         &self,
         params: FsRemoveParams,
     ) -> Result<FsRemoveResponse, JSONRPCErrorError> {
+        let recursive = params.recursive.unwrap_or(true);
+        let force = params.force.unwrap_or(true);
         self.file_system
-            .remove_with_sandbox_policy(
+            .remove(
                 &params.path,
-                RemoveOptions {
-                    recursive: params.recursive.unwrap_or(true),
-                    force: params.force.unwrap_or(true),
-                },
-                params.sandbox_policy.as_ref(),
+                RemoveOptions { recursive, force },
+                params.sandbox.as_ref(),
             )
             .await
             .map_err(map_fs_error)?;
@@ -142,13 +146,13 @@ impl FileSystemHandler {
         params: FsCopyParams,
     ) -> Result<FsCopyResponse, JSONRPCErrorError> {
         self.file_system
-            .copy_with_sandbox_policy(
+            .copy(
                 &params.source_path,
                 &params.destination_path,
                 CopyOptions {
                     recursive: params.recursive,
                 },
-                params.sandbox_policy.as_ref(),
+                params.sandbox.as_ref(),
             )
             .await
             .map_err(map_fs_error)?;
@@ -157,11 +161,68 @@ impl FileSystemHandler {
 }
 
 fn map_fs_error(err: io::Error) -> JSONRPCErrorError {
-    if err.kind() == io::ErrorKind::NotFound {
-        not_found(err.to_string())
-    } else if err.kind() == io::ErrorKind::InvalidInput {
-        invalid_request(err.to_string())
-    } else {
-        internal_error(err.to_string())
+    match err.kind() {
+        io::ErrorKind::NotFound => not_found(err.to_string()),
+        io::ErrorKind::InvalidInput | io::ErrorKind::PermissionDenied => {
+            invalid_request(err.to_string())
+        }
+        _ => internal_error(err.to_string()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use codex_protocol::protocol::NetworkAccess;
+    use codex_protocol::protocol::SandboxPolicy;
+    use codex_utils_absolute_path::AbsolutePathBuf;
+    use pretty_assertions::assert_eq;
+
+    use super::*;
+    use crate::FileSystemSandboxContext;
+    use crate::protocol::FsReadFileParams;
+    use crate::protocol::FsWriteFileParams;
+
+    #[tokio::test]
+    async fn no_platform_sandbox_policies_do_not_require_configured_sandbox_helper() {
+        let temp_dir = tempfile::tempdir().expect("tempdir");
+        let runtime_paths = ExecServerRuntimePaths::new(
+            std::env::current_exe().expect("current exe"),
+            /*codex_linux_sandbox_exe*/ None,
+        )
+        .expect("runtime paths");
+        let handler = FileSystemHandler::new(runtime_paths);
+
+        for (file_name, sandbox_policy) in [
+            ("danger.txt", SandboxPolicy::DangerFullAccess),
+            (
+                "external.txt",
+                SandboxPolicy::ExternalSandbox {
+                    network_access: NetworkAccess::Restricted,
+                },
+            ),
+        ] {
+            let path =
+                AbsolutePathBuf::from_absolute_path(temp_dir.path().join(file_name).as_path())
+                    .expect("absolute path");
+
+            handler
+                .write_file(FsWriteFileParams {
+                    path: path.clone(),
+                    data_base64: STANDARD.encode("ok"),
+                    sandbox: Some(FileSystemSandboxContext::new(sandbox_policy.clone())),
+                })
+                .await
+                .expect("write file");
+
+            let response = handler
+                .read_file(FsReadFileParams {
+                    path,
+                    sandbox: Some(FileSystemSandboxContext::new(sandbox_policy)),
+                })
+                .await
+                .expect("read file");
+
+            assert_eq!(response.data_base64, STANDARD.encode("ok"));
+        }
     }
 }