mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
iceweasel-oaiandGitHub
87cce88f48
- Added the new codex-windows-sandbox crate that builds both a library
entry point (run_windows_sandbox_capture) and a CLI executable to launch
commands inside a Windows restricted-token sandbox, including ACL
management, capability SID provisioning, network lockdown, and output
capture
(windows-sandbox-rs/src/lib.rs:167, windows-sandbox-rs/src/main.rs:54).
- Introduced the experimental WindowsSandbox feature flag and wiring so
Windows builds can opt into the sandbox:
SandboxType::WindowsRestrictedToken, the in-process execution path, and
platform sandbox selection now honor the flag (core/src/features.rs:47,
core/src/config.rs:1224, core/src/safety.rs:19,
core/src/sandboxing/mod.rs:69, core/src/exec.rs:79,
core/src/exec.rs:172).
- Updated workspace metadata to include the new crate and its
Windows-specific dependencies so the core crate can link against it
(codex-rs/
Cargo.toml:91, core/Cargo.toml:86).
- Added a PowerShell bootstrap script that installs the Windows
toolchain, required CLI utilities, and builds the workspace to ease
development
on the platform (scripts/setup-windows.ps1:1).
- Landed a Python smoke-test suite that exercises
read-only/workspace-write policies, ACL behavior, and network denial for
the Windows sandbox
binary (windows-sandbox-rs/sandbox_smoketests.py:1).
37 lines
1023 B
Rust
37 lines
1023 B
Rust
use anyhow::Result;
|
|
use serde::Deserialize;
|
|
use serde::Serialize;
|
|
|
|
#[derive(Clone, Debug, Serialize, Deserialize)]
|
|
pub struct PolicyJson {
|
|
pub mode: String,
|
|
#[serde(default)]
|
|
pub workspace_roots: Vec<String>,
|
|
}
|
|
|
|
#[derive(Clone, Debug)]
|
|
pub enum SandboxMode {
|
|
ReadOnly,
|
|
WorkspaceWrite,
|
|
}
|
|
|
|
#[derive(Clone, Debug)]
|
|
pub struct SandboxPolicy(pub SandboxMode);
|
|
|
|
impl SandboxPolicy {
|
|
pub fn parse(value: &str) -> Result<Self> {
|
|
match value {
|
|
"read-only" => Ok(SandboxPolicy(SandboxMode::ReadOnly)),
|
|
"workspace-write" => Ok(SandboxPolicy(SandboxMode::WorkspaceWrite)),
|
|
other => {
|
|
let pj: PolicyJson = serde_json::from_str(other)?;
|
|
Ok(match pj.mode.as_str() {
|
|
"read-only" => SandboxPolicy(SandboxMode::ReadOnly),
|
|
"workspace-write" => SandboxPolicy(SandboxMode::WorkspaceWrite),
|
|
_ => SandboxPolicy(SandboxMode::ReadOnly),
|
|
})
|
|
}
|
|
}
|
|
}
|
|
}
|