Enforce workspace metadata protections in Seatbelt#19847
Merged
evawong-oai merged 1 commit intomainfrom Apr 28, 2026
Merged
Conversation
This was referenced Apr 27, 2026
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
82c9632 to
1bbee67
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
2 times, most recently
from
fe774aa to
017761a
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
1bbee67 to
3353479
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
from
017761a to
613fe13
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
0cfa95f to
a99da8c
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
from
613fe13 to
6e4de4c
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
a99da8c to
5b59ee3
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
2 times, most recently
from
0b8c428 to
6541b90
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
2 times, most recently
from
01771db to
11fa852
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
from
6541b90 to
c2bf30f
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
11fa852 to
ab4b378
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
from
c2bf30f to
5e3f0d4
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
ab4b378 to
8e60a50
Compare
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
2 times, most recently
from
ea88850 to
c008a8f
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
8e60a50 to
0b263d0
Compare
evawong-oai
changed the title
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
from
c008a8f to
a767cac
Compare
evawong-oai
force-pushed
the
codex/bugb15632-policy-primitive
branch
from
0b263d0 to
3ed97f5
Compare
evawong-oai
added a commit
that referenced
this pull request
Apr 28, 2026
## Summary Make FileSystemSandboxPolicy the semantic source of truth for project root metadata protection. Under writable roots, `.git`, `.codex`, and `.agents` stay protected unless user policy grants an explicit write rule for that metadata path. ## Scope 1. Add `protected_metadata_names` to `WritableRoot`. 2. Teach `FileSystemSandboxPolicy::can_write_path_with_cwd` to reject protected metadata writes under writable roots unless explicitly allowed. 3. Default workspace write profiles to protect `.git`, `.codex`, and `.agents`. 4. Add the Linux fallback setup needed before Linux enforcement lands later in the stack. ## Reviewer Focus 1. The policy decision belongs in FileSystemSandboxPolicy, not shell command parsing. 2. Legacy SandboxPolicy remains a compatibility projection, not the source of the new rule. 3. Explicit user write rules can still opt into these metadata paths. ## Stack 1. Policy primitive: this PR 2. macOS Seatbelt adapter: #19847 3. Shell preflight UX: #19848 4. Runtime profile propagation: #19849 5. Linux bubblewrap adapter: #19852 ## Validation 1. codex protocol permissions tests 2. formatting for codex protocol and codex linux sandbox 3. diff whitespace check
evawong-oai
force-pushed
the
codex/bugb15632-seatbelt-preserved-paths
branch
from
a767cac to
19909d3
Compare
evawong-oai
requested review from
bolinfest and
viyatb-oai
and removed request for
bolinfest
viyatb-oai
approved these changes
Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Translate FileSystemSandboxPolicy project root metadata carveouts into macOS Seatbelt rules.
Scope
Reviewer Focus
Stack
Validation