agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,543 Commits 2 Branches 0 Tags
7e5c343ef5cfccafcfda8dcca8c04869da97affe
Commit Graph

27 Commits

  • feat: introduce ExternalSandbox policy (#8290) 
    ## Description

Introduced `ExternalSandbox` policy to cover use case when sandbox
defined by outside environment, effectively it translates to
`SandboxMode#DangerFullAccess` for file system (since sandbox configured
on container level) and configurable `network_access` (either Restricted
or Enabled by outside environment).

as example you can configure `ExternalSandbox` policy as part of
`sendUserTurn` v1 app_server API:

```
 {
            "conversationId": <id>,
            "cwd": <cwd>,
            "approvalPolicy": "never",
            "sandboxPolicy": {
                  "type": ""external-sandbox",
                  "network_access": "enabled"/"restricted"
            },
            "model": <model>,
            "effort": <effort>,
            ....
        }
```
    Anton Panasenko · 2025-12-18 17:02:03 -08:00
    3429de21b3
  • add a default dacl to restricted token to enable reading of pipes (#8280) 
    this fixes sandbox errors (legacy and elevated) for commands that
include pipes, which the model often favors.
    iceweasel-oai · 2025-12-18 12:59:52 -08:00
    6395430220
  • grant read ACL to exe directory first so we can call the command runner (#8275) 
    when granting read access to the sandbox user, grant the
codex/command-runner exe directory first so commands can run before the
entire read ACL process is finished.
    iceweasel-oai · 2025-12-18 19:52:32 +00:00
    ad41182ee8
  • speed and reliability improvements for setting reads ACLs (#8216) 
    - Batch read ACL creation for online/offline sandbox user
- creates a new ACL helper process that is long-lived and runs in the
background
- uses a mutex so that only one helper process is running at a time.
    iceweasel-oai · 2025-12-17 15:27:52 -08:00
    25ecd0c2e4
  • bug fixes and perf improvements for elevated sandbox setup (#8094) 
    a few fixes based on testing feedback:
* ensure cap_sid file is always written by elevated setup.
* always log to same file whether using elevated sandbox or not
* process potentially slow ACE write operations in parallel
* dedupe write roots so we don't double process any
* don't try to create read/write ACEs on the same directories, due to
race condition
    iceweasel-oai · 2025-12-16 09:48:29 -08:00
    3d14da9728
  • fix: introduce AbsolutePathBuf as part of sandbox config (#7856) 
    Changes the `writable_roots` field of the `WorkspaceWrite` variant of
the `SandboxPolicy` enum from `Vec<PathBuf>` to `Vec<AbsolutePathBuf>`.
This is helpful because now callers can be sure the value is an absolute
path rather than a relative one. (Though when using an absolute path in
a Seatbelt config policy, we still have to _canonicalize_ it first.)

Because `writable_roots` can be read from a config file, it is important
that we are able to resolve relative paths properly using the parent
folder of the config file as the base path.
    Michael Bolin · 2025-12-12 15:25:22 -08:00
    642b7566df
  • Elevated Sandbox 4 (#7889)
    iceweasel-oai · 2025-12-12 12:30:38 -08:00
    677732ff65
  • Elevated Sandbox 3 (#7809) 
    dedicated sandbox command runner exe.
    iceweasel-oai · 2025-12-11 13:51:27 -08:00
    3e81ed4b91
  • Elevated Sandbox 2 (#7792) 
    - DPAPI helpers for storing Sandbox user passwords securely
- creation of Offline/Online sandbox users
- ACL setup for sandbox users
- firewall rule setup
    iceweasel-oai · 2025-12-10 21:23:16 -08:00
    13c0919bff
  • Elevated Sandbox 1 (#7788) 
    - updating helpers, refactoring some functions that will be used in the
elevated sandbox
- better logging
- better and faster handling of ACL checks/writes
- No functional change—legacy restricted-token sandbox
remains the only path.
    iceweasel-oai · 2025-12-09 19:00:33 -08:00
    fc4249313b
  • Windows Sandbox: treat <workspace_root>/.git as read-only in workspace-write mode (#7142) 
    this functionality is
[supported](https://github.com/openai/codex/blob/main/codex-rs/protocol/src/protocol.rs#L421-L422)
in the MacOs sandbox as well. Adding it to Windows for parity

This PR also changes `rust-ci.yaml` to work around a github `hashFiles`
issue. Others have done something
[similar](https://github.com/openai/superassistant/pull/32156) today
    iceweasel-oai · 2025-11-24 12:41:21 -08:00
    99e5340c54
  • chore: add cargo-deny configuration (#7119) 
    - add GitHub workflow running cargo-deny on push/PR
- document cargo-deny allowlist with workspace-dep notes and advisory
ignores
- align workspace crates to inherit version/edition/license for
consistent checks
    Josh McKinney · 2025-11-24 12:22:18 -08:00
    ec49b56874
  • consolidate world-writable-directories scanning. (#7234) 
    clean up the code for scanning for world writable directories

One path (selecting a sandbox mode from /approvals) was using an
incorrect method that did not use the new method of creating deny aces
to prevent writing to those directories. Now all paths are the same.
    iceweasel-oai · 2025-11-24 09:51:58 -08:00
    486b1c4d9d
  • Windows Sandbox: support network_access and exclude_tmpdir_env_var (#7030)
    iceweasel-oai · 2025-11-20 22:59:55 -08:00
    f4af6e389e
  • add deny ACEs for world writable dirs (#7022) 
    Our Restricted Token contains 3 SIDs (Logon, Everyone, {WorkspaceWrite
Capability || ReadOnly Capability})

because it must include Everyone, that left us vulnerable to directories
that allow writes to Everyone. Even though those directories do not have
ACEs that enable our capability SIDs to write to them, they could still
be written to even in ReadOnly mode, or even in WorkspaceWrite mode if
they are outside of a writable root.

A solution to this is to explicitly add *Deny* ACEs to these
directories, always for the ReadOnly Capability SID, and for the
WorkspaceWrite SID if the directory is outside of a workspace root.

Under a restricted token, Windows always checks Deny ACEs before Allow
ACEs so even though our restricted token would allow a write to these
directories due to the Everyone SID, it fails first because of the Deny
ACE on the capability SID
    iceweasel-oai · 2025-11-20 14:50:33 -08:00
    3f92ad4190
  • stop over-reporting world-writable directories (#6936) 
    Fix world-writable audit false positives by expanding generic
permissions with MapGenericMask and then checking only concrete write
bits. The earlier check looked for FILE_GENERIC_WRITE/generic masks
directly, which shares bits with read permissions and could flag an
Everyone read ACE as writable.
    iceweasel-oai · 2025-11-19 13:59:17 -08:00
    2fde03b4a0
  • have world_writable_warning_details accept cwd as a param (#6913) 
    this enables app-server to pass in the correct workspace cwd for the
current conversation
    iceweasel-oai · 2025-11-19 10:10:03 -08:00
    b3d320433f
  • smoketest for browser vuln, rough draft of Windows security doc (#6822)
    iceweasel-oai · 2025-11-18 16:43:34 -08:00
    b952bd2649
  • windows sandbox: support multiple workspace roots (#6854) 
    The Windows sandbox did not previously support multiple workspace roots
via config. Now it does
    iceweasel-oai · 2025-11-18 16:35:00 -08:00
    cf57320b9f
  • Prompt to turn on windows sandbox when auto mode selected. (#6618) 
    - stop prompting users to install WSL 
- prompt users to turn on Windows sandbox when auto mode requested.

<img width="1660" height="195" alt="Screenshot 2025-11-17 110612"
src="https://github.com/user-attachments/assets/c67fc239-a227-417e-94bb-599a8ed8f11e"
/>
<img width="1684" height="168" alt="Screenshot 2025-11-17 110637"
src="https://github.com/user-attachments/assets/d18c3370-830d-4971-8746-04757ae2f709"
/>
<img width="1655" height="293" alt="Screenshot 2025-11-17 110719"
src="https://github.com/user-attachments/assets/d21f6ce9-c23e-4842-baf6-8938b77c16db"
/>
    iceweasel-oai · 2025-11-18 11:38:18 -08:00
    4bada5a84d
  • move cap_sid file into ~/.codex so the sandbox cannot overwrite it (#6798) 
    The `cap_sid` file contains the IDs of the two custom SIDs that the
Windows sandbox creates/manages to implement read-only and
workspace-write sandbox policies.

It previously lived in `<cwd>/.codex` which means that the sandbox could
write to it, which could degrade the efficacy of the sandbox. This
change moves it to `~/.codex/` (or wherever `CODEX_HOME` points to) so
that it is outside the workspace.
    iceweasel-oai · 2025-11-17 15:49:41 -08:00
    e032d338f2
  • fix codex detection, add new security-focused smoketests. (#6682) 
    Fix 'codex' detection to look for debug build, then release build, then
installed.

Adds more smoketests around security from @viyatb-oai
    iceweasel-oai · 2025-11-14 12:08:59 -08:00
    abb7b79701
  • more world-writable warning improvements (#6389) 
    3 improvements:
1. show up to 3 actual paths that are world-writable
2. do the scan/warning for Read-Only mode too, because it also applies
there
3. remove the "Cancel" option since it doesn't always apply (like on
startup)
    iceweasel-oai · 2025-11-08 11:35:43 -08:00
    a47181e471
  • Improve world-writable scan (#6381) 
    1. scan many more directories since it's much faster than the original
implementation
2. limit overall scan time to 2s
3. skip some directories that are noisy - ApplicationData, Installer,
etc.
    iceweasel-oai · 2025-11-07 21:28:55 -08:00
    917f39ec12
  • Windows Sandbox: Show Everyone-writable directory warning (#6283) 
    Show a warning when Auto Sandbox mode becomes enabled, if we detect
Everyone-writable directories, since they cannot be protected by the
current implementation of the Sandbox.

This PR also includes changes to how we detect Everyone-writable to be
*much* faster
    iceweasel-oai · 2025-11-06 10:44:42 -08:00
    871d442b8e
  • log sandbox commands to $CODEX_HOME instead of cwd (#6171) 
    Logging commands in the Windows Sandbox is temporary, but while we are
doing it, let's always write to CODEX_HOME instead of dirtying the cwd.
    iceweasel-oai · 2025-11-03 13:12:33 -08:00
    07b7d28937
  • Windows Sandbox - Alpha version (#4905) 
    - Added the new codex-windows-sandbox crate that builds both a library
entry point (run_windows_sandbox_capture) and a CLI executable to launch
commands inside a Windows restricted-token sandbox, including ACL
management, capability SID provisioning, network lockdown, and output
capture
(windows-sandbox-rs/src/lib.rs:167, windows-sandbox-rs/src/main.rs:54).
- Introduced the experimental WindowsSandbox feature flag and wiring so
Windows builds can opt into the sandbox:
SandboxType::WindowsRestrictedToken, the in-process execution path, and
platform sandbox selection now honor the flag (core/src/features.rs:47,
core/src/config.rs:1224, core/src/safety.rs:19,
core/src/sandboxing/mod.rs:69, core/src/exec.rs:79,
core/src/exec.rs:172).
- Updated workspace metadata to include the new crate and its
Windows-specific dependencies so the core crate can link against it
(codex-rs/
    Cargo.toml:91, core/Cargo.toml:86).
- Added a PowerShell bootstrap script that installs the Windows
toolchain, required CLI utilities, and builds the workspace to ease
development
    on the platform (scripts/setup-windows.ps1:1).
- Landed a Python smoke-test suite that exercises
read-only/workspace-write policies, ACL behavior, and network denial for
the Windows sandbox
    binary (windows-sandbox-rs/sandbox_smoketests.py:1).
    iceweasel-oai · 2025-10-30 15:51:57 -07:00
    87cce88f48