Celia Chen 9eef2e91fc fix: allow restricted filesystem profiles to read helper executables (#15114) ...

## Summary

This PR fixes restricted filesystem permission profiles so Codex's
runtime-managed helper executables remain readable without requiring
explicit user configuration.

- add implicit readable roots for the configured `zsh` helper path and
the main execve wrapper
- allowlist the shared `$CODEX_HOME/tmp/arg0` root when the execve
wrapper lives there, so session-specific helper paths keep working
- dedupe injected paths and avoid adding duplicate read entries to the
sandbox policy
- add regression coverage for restricted read mode with helper
executable overrides

## Testing 
before this change: got this error when executing a shell command via
zsh fork:
```
"sandbox error: sandbox denied exec error, exit code: 127, stdout: , stderr: /etc/zprofile:11: operation not permitted: /usr/libexec/path_helper\nzsh:1: operation not permitted: .codex/skills/proxy-a/scripts/fetch_example.sh\n"
```

saw this change went away after this change, meaning the readable roots
and injected correctly.

9eef2e91fc · 2026-03-20 15:51:06 -07:00

History

..

prompts

Simplify permissions available in request permissions tool (#14529)

2026-03-12 21:13:17 -07:00

account.rs

add error messages for the go plan type (#10181)

2026-01-30 01:17:25 +00:00

agent_path.rs

feat: change multi-agent to use path-like system instead of uuids (#15313)

2026-03-20 18:23:48 +00:00

approvals.rs

Add Smart Approvals guardian review across core, app-server, and TUI (#13860)

2026-03-13 15:27:00 -07:00

config_types.rs

Add Smart Approvals guardian review across core, app-server, and TUI (#13860)

2026-03-13 15:27:00 -07:00

custom_prompts.rs

[app-server] remove serde(skip_serializing_if = "Option::is_none") annotations (#5939)

2025-10-30 18:18:53 +00:00

dynamic_tools.rs

dynamic tool calls: add param exposeToContext to optionally hide tool (#14501)

2026-03-14 01:58:43 -07:00

items.rs

[hooks] use a user message > developer message for prompt continuation (#14867)

2026-03-19 10:53:08 -07:00

lib.rs

feat: change multi-agent to use path-like system instead of uuids (#15313)

2026-03-20 18:23:48 +00:00

mcp.rs

feat: replace custom mcp-types crate with equivalents from rmcp (#10349)

2026-02-02 17:41:55 -08:00

memory_citation.rs

feat: add memory citation to agent message (#14821)

2026-03-18 10:03:38 +00:00

message_history.rs

Generate JSON schema for app-server protocol (#5063)

2025-10-20 11:45:11 -07:00

models.rs

Return image URL from view_image tool (#15072)

2026-03-18 13:58:20 -07:00

num_format.rs

Fix execpolicy parsing for multiline quoted args (#9565)

2026-01-22 22:16:53 -08:00

openai_models.rs

Prefer websockets when providers support them (#13592)

2026-03-17 19:46:44 -07:00

parse_command.rs

[app-server] remove serde(skip_serializing_if = "Option::is_none") annotations (#5939)

2025-10-30 18:18:53 +00:00

permissions.rs

fix: allow restricted filesystem profiles to read helper executables (#15114)

2026-03-20 15:51:06 -07:00

plan_tool.rs

Plan mode: stream proposed plans, emit plan items, and render in TUI (#9786)

2026-01-30 18:59:30 +00:00

protocol.rs

feat: change multi-agent to use path-like system instead of uuids (#15313)

2026-03-20 18:23:48 +00:00

request_permissions.rs

Simplify permissions available in request permissions tool (#14529)

2026-03-12 21:13:17 -07:00

request_user_input.rs

Better handling skill depdenencies on ENV VAR. (#9017)

2026-01-29 14:13:30 -05:00

thread_id.rs

feat: sqlite 1 (#10004)

2026-01-28 15:29:14 +01:00

user_input.rs

feat: structured plugin parsing (#13711)

2026-03-06 11:08:36 -08:00