Michael Bolin 52b359b249 core: stop threading SandboxPolicy through exec (#25700) ...

## Why

#25450 attempts a broad `SandboxPolicy` removal across several unrelated
surfaces, which makes it hard to review and still leaves new helper code
moving legacy policies around. This PR is a narrower alternative:
migrate only the exec-side Windows sandbox plumbing so the review can
focus on one production path and one compatibility boundary.

The goal is to stop threading `SandboxPolicy` through exec code without
expanding the migration into app-server, protocol, telemetry, config, or
session behavior.

## What changed

- Removed `ExecRequest::compatibility_sandbox_policy()`.
- Changed the Windows restricted-token and elevated filesystem override
helpers to accept `PermissionProfile` plus the split filesystem/network
policies instead of a `SandboxPolicy`.
- Kept the remaining legacy projection local to the writable-root
comparison that still needs to compare split policy behavior against the
legacy Windows backend model.
- Rejected restricted split filesystem policies that still grant
full-disk writes before using the Windows restricted-token backend,
preserving the previous clear-failure behavior for profiles that project
to `ExternalSandbox`.
- Updated the Windows sandbox override tests to exercise the new call
shape and cover the full-write split-profile regression.

## Verification

- `just test -p codex-core windows_restricted_token`
- `just test -p codex-core windows_elevated`

52b359b249 · 2026-06-03 10:41:41 -07:00

History

..

src

core: stop threading SandboxPolicy through exec (#25700)

2026-06-03 10:41:41 -07:00

BUILD.bazel

Move macOS sandbox builders into codex-sandboxing (#15593)

2026-03-23 21:26:35 -07:00

Cargo.toml

Disable empty Cargo test targets (#21584)

2026-05-07 15:44:17 -07:00