16 Commits

• fix: prompt for unsafe commands on Windows (#9117)
  Michael Bolin · 2026-01-12 21:30:09 -08:00
  ddae70bd62
• feat: introduce ExternalSandbox policy (#8290)

  ## Description
  
  Introduced `ExternalSandbox` policy to cover use case when sandbox
  defined by outside environment, effectively it translates to
  `SandboxMode#DangerFullAccess` for file system (since sandbox configured
  on container level) and configurable `network_access` (either Restricted
  or Enabled by outside environment).
  
  as example you can configure `ExternalSandbox` policy as part of
  `sendUserTurn` v1 app_server API:
  
  ```
   {
              "conversationId": <id>,
              "cwd": <cwd>,
              "approvalPolicy": "never",
              "sandboxPolicy": {
                    "type": ""external-sandbox",
                    "network_access": "enabled"/"restricted"
              },
              "model": <model>,
              "effort": <effort>,
              ....
          }
  ```

  Anton Panasenko · 2025-12-18 17:02:03 -08:00
  3429de21b3
• fix: use PowerShell to parse PowerShell (#7607)

  Previous to this PR, we used a hand-rolled PowerShell parser in
  `windows_safe_commands.rs` to take a `&str` of PowerShell script see if
  it is equivalent to a list of `execvp(3)` invocations, and if so, we
  then test each using `is_safe_powershell_command()` to determine if the
  overall command is safe:
  
  
  https://github.com/openai/codex/blob/6e6338aa876bb4258abe25b02ac6417b8ea9dff0/codex-rs/core/src/command_safety/windows_safe_commands.rs#L89-L98
  
  Unfortunately, our PowerShell parser did not recognize `@(...)` as a
  special construct, so it was treated as an ordinary token. This meant
  that the following would erroneously be considered "safe:"
  
  ```powershell
  ls @(calc.exe)
  ```
  
  The fix introduced in this PR is to do something comparable what we do
  for Bash/Zsh, which is to use a "proper" parser to derive the list of
  `execvp(3)` calls. For Bash/Zsh, we rely on
  https://crates.io/crates/tree-sitter-bash, but there does not appear to
  be a crate of comparable quality for parsing PowerShell statically
  (https://github.com/airbus-cert/tree-sitter-powershell/ is the best
  thing I found).
  
  Instead, in this PR, we use a PowerShell script to parse the input
  PowerShell program to produce the AST.

  Michael Bolin · 2025-12-12 13:06:49 -08:00
  9009490357
• feat: more safe commands (#7728)
  jif-oai · 2025-12-12 11:48:25 +01:00
  49bf49c2fa
• Windows: flag some invocations that launch browsers/URLs as dangerous (#7111)

  Prevent certain Powershell/cmd invocations from reaching the sandbox
  when they are trying to launch a browser, or run a command with a URL,
  etc.

  iceweasel-oai · 2025-11-21 13:36:17 -08:00
  3bdcbc7292
• Support full powershell paths in is_safe_command (#7055)

  New shell implementation always uses full paths.

  pakrym-oai · 2025-11-20 19:29:15 -08:00
  830ab4ce20
• execpolicy2 core integration (#6641)

  This PR threads execpolicy2 into codex-core.
  
  activated via feature flag: exec_policy (on by default)
  
  reads and parses all .codexpolicy files in `codex_home/codex`
  
  refactored tool runtime API to integrate execpolicy logic
  
  ---------
  
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  zhao-oai · 2025-11-19 16:50:43 -08:00
  65c13f1ae7
• Revert "Revert "Overhaul shell detection and centralize command generation for unified exec"" (#6607)

  Reverts openai/codex#6606

  pakrym-oai · 2025-11-13 16:45:17 -08:00
  7b027e7536
• Revert "Overhaul shell detection and centralize command generation for unified exec" (#6606)

  Reverts openai/codex#6577

  pakrym-oai · 2025-11-13 08:43:00 -08:00
  e6995174c1
• Overhaul shell detection and centralize command generation for unified exec (#6577)

  This fixes command display for unified exec. All `cd`s and `ls`es are
  now parsed.
  
  <img width="452" height="237" alt="image"
  src="https://github.com/user-attachments/assets/ce92d81f-f74c-485a-9b34-1eaa29290ec6"
  />
  
  Deletes a ton of tests that were doing nothing from shell.rs.
  
  ---------
  
  Co-authored-by: Pavel Krymets <pavel@krymets.com>

  pakrym-oai · 2025-11-13 08:28:09 -08:00
  d28e912214
• Don't request approval for safe commands in unified exec (#6380)
  pakrym-oai · 2025-11-07 16:36:04 -08:00
  91b16b8682
• Treat zsh -lc like bash -lc (#5411)

  Without proper `zsh -lc` parsing, we lose some things like proper
  command parsing, turn diff tracking, safe command checks, and other
  things we expect from raw or `bash -lc` commands.

  Gabriel Peal · 2025-10-20 15:52:25 -07:00
  32d50bda94
• chore: rework tools execution workflow (#5278)

  Re-work the tool execution flow. Read `orchestrator.rs` to understand
  the structure

  jif-oai · 2025-10-20 20:57:37 +01:00
  5e4f3bbb0b
• implement command safety for PowerShell commands (#4269)

  Implement command safety for PowerShell commands on Windows
  
  This change adds a new Windows-specific command-safety module under
  `codex-rs/core/src/command_safety/windows_safe_commands.rs` to strictly
  sanitise PowerShell invocations. Key points:
  
  - Introduce `is_safe_command_windows()` to only allow explicitly
  read-only PowerShell calls.
  - Parse and split PowerShell invocations (including inline `-Command`
  scripts and pipelines).
  - Block unsafe switches (`-File`, `-EncodedCommand`, `-ExecutionPolicy`,
  unknown flags, call operators, redirections, separators).
  - Whitelist only read-only cmdlets (`Get-ChildItem`, `Get-Content`,
  `Select-Object`, etc.), safe Git subcommands (`status`, `log`, `show`,
  `diff`, `cat-file`), and ripgrep without unsafe options.
  - Add comprehensive unit tests covering allowed and rejected command
  patterns (nested calls, side effects, chaining, redirections).
  
  This ensures Codex on Windows can safely execute discover-only
  PowerShell workflows without risking destructive operations.

  iceweasel-oai · 2025-10-01 09:56:48 -07:00
  dde615f482
• core: add potentially dangerous command check (#4211)

  Certain shell commands are potentially dangerous, and we want to check
  for them.
  Unless the user has explicitly approved a command, we will *always* ask
  them for approval
  when one of these commands is encountered, regardless of whether they
  are in a sandbox, or what their approval policy is.
  
  The first (of probably many) such examples is `git reset --hard`. We
  will be conservative and check for any `git reset`

  iceweasel-oai · 2025-09-25 19:46:20 -07:00
  eb2b739d6a
• adds a windows-specific method to check if a command is safe (#4119)

  refactors command_safety files into its own package, so we can add
  platform-specific ones
  Also creates a windows-specific of `is_known_safe_command` that just
  returns false always, since that is what happens today.

  iceweasel-oai · 2025-09-24 14:03:43 -07:00
  0e58870634