Run exec-server fs operations through sandbox helper by starr-openai · Pull Request #17294 · openai/codex

starr-openai · 2026-04-10T03:41:29Z

Summary

run exec-server filesystem RPCs requiring sandboxing through a codex-fs arg0 helper over stdin/stdout
keep direct local filesystem execution for DangerFullAccess and external sandbox policies
remove the standalone exec-server binary path in favor of top-level arg0 dispatch/runtime paths
add sandbox escape regression coverage for local and remote filesystem paths

Validation

just fmt
git diff --check
remote devbox: cd codex-rs && bazel test --bes_backend= --bes_results_url= //codex-rs/exec-server:all (6/6 passed)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41f0e9c405

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Discover exec-server arg0 helper paths from PATH for the default public server entrypoint, preserving sandboxed filesystem support when callers do not pass runtime paths explicitly. Co-authored-by: Codex <noreply@openai.com>

pakrym-oai · 2026-04-10T16:52:32Z

    pub codex_self_exe: Option<PathBuf>,
+    /// Path to the `codex-fs` helper alias used by exec-server filesystem
+    /// sandboxing.
+    pub codex_fs_exe: Option<PathBuf>,


isn't it the same as codex_self_exe ?

pakrym-oai · 2026-04-10T16:54:59Z


        #[cfg(windows)]
        {
+            let arg1 = if *filename == CODEX_FS_HELPER_ARG0 {


this seems wrong. we are not writing scripts for what's being invoked
we are writing scripts that allow us to invoke apply_patch

I'm also not sure we need a script for fs-helper at all.

pakrym-oai · 2026-04-10T16:55:51Z

+        codex_fs_exe: {
+            #[cfg(windows)]
+            {
+                Some(path.join(format!("{CODEX_FS_HELPER_ARG0}.bat")))


we don't need for helper to be invocable via shell, we can create the correct command line directly. can we avoid the entire bat business?

pakrym-oai · 2026-04-10T16:56:24Z

-        // Allow a bit more time to accommodate async startup work (e.g. config IO, tool discovery)
-        let ev = timeout(wait_time.max(Duration::from_secs(10)), codex.next_event())
+        // Allow extra time to accommodate async startup work (e.g. config IO,
+        // tool discovery). Windows CI can take longer to launch helper


this probably shouldn't be done in this pr.

pakrym-oai · 2026-04-10T16:58:18Z

+            Some(sandbox_policy) => {
+                self.run_sandboxed(
+                    sandbox_policy,
+                    enforce_read_access(&params.path, Some(sandbox_policy)),


why do we still have enforce_read_access?

pakrym-oai · 2026-04-10T17:03:59Z

+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "operation", rename_all = "camelCase")]
+pub(crate) enum FsHelperRequest {


can we reuse the same requests and responses we use for trait?

FsWriteFileParams/FsWriteFileResponse

pakrym-oai · 2026-04-10T17:05:46Z

+                    sandbox_policy,
+                    enforce_read_access(&params.path, Some(sandbox_policy)),
+                    FsHelperRequest::ReadFile { path: params.path },
+                    "readFile",


can we reuse op names?

fs/writeFile etc?

pakrym-oai · 2026-04-10T17:09:05Z

+        message.contains("is not permitted")
+            || message.contains("Operation not permitted")
+            || message.contains("Permission denied")
+            || message.contains("No such file"),


no such file is a bit sus

pakrym-oai · 2026-04-10T17:09:52Z


+use crate::ExecServerRuntimePaths;
+
 pub async fn run_main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {


we should probably drop all overloads that don't take runtime_paths to ensure they are always passed in correctly.

pakrym-oai · 2026-04-10T17:10:18Z

+    }
+}
+
+fn find_program_in_path(path_env: Option<&OsString>, program: &str) -> Option<PathBuf> {


this is wayy to much reimplementation that we don't do for any other commands.

pakrym-oai · 2026-04-10T17:10:36Z

 }

-fn enforce_read_access(
+pub(crate) fn enforce_read_access(


these all need to go

pakrym-oai · 2026-04-10T17:11:59Z

+
+    pub(crate) async fn run(
+        &self,
+        sandbox_policy: &SandboxPolicy,


is SandboxPolicy enough? for apply patch we include a bunch of other permission

codex/codex-rs/core/src/tools/handlers/apply_patch.rs

Lines 203 to 213 in 04fc208

let req = ApplyPatchRequest {

action: apply.action,

file_paths,

changes,

exec_approval_requirement: apply.exec_approval_requirement,

additional_permissions: effective_additional_permissions

.additional_permissions,

permissions_preapproved: effective_additional_permissions

.permissions_preapproved,

timeout_ms: None,

};

pakrym-oai · 2026-04-10T17:12:48Z

+            &helper_sandbox_policy,
+            cwd.as_path(),
+        );
+        let network_policy = NetworkSandboxPolicy::from(&helper_sandbox_policy);


network is always disabled

pakrym-oai · 2026-04-10T17:14:03Z

+    }
+
+    fn helper_program(&self) -> Result<PathBuf, JSONRPCErrorError> {
+        let helper = self.runtime_paths.codex_fs_exe.clone().ok_or_else(|| {


can codex_fs_exe be non optional?

pakrym-oai · 2026-04-10T17:14:22Z

+                    .to_string(),
+            )
+        })?;
+        if !helper.is_absolute() {


and use absolute path type?

pakrym-oai · 2026-04-10T17:15:17Z

+        Ok(helper)
+    }
+
+    fn helper_read_permissions(&self, helper_path: &Path) -> PermissionProfile {


this logic must exist somwhere already, otherwise how would apply_patch work today?

pakrym-oai · 2026-04-10T17:16:27Z

+            file_system_policy,
+            network_policy,
+            SandboxablePreference::Auto,
+            WindowsSandboxLevel::Disabled,


pakrym-oai

Directionally correct. Few things:

Can we reuse more of existing request/response types/ops
Remove "manual" sandboxing
Reduce amount of custom sandbox configuration logic and check whether we need more parameters to fully migrate something like apply_patch
Remove .bat support and ability to start fs-helper directly via shell.

starr-openai · 2026-04-10T21:19:34Z

Updated this PR to 60bb6343c0ab52127a744025592276a2c26c3daf.

Focused devbox validation passing:

//codex-rs/apply-patch:apply-patch-all-test
//codex-rs/apply-patch:apply-patch-unit-tests
//codex-rs/core:core-all-test --test_arg=suite::apply_patch_cli --test_arg=--test-threads=1
//codex-rs/core:core-all-test --test_arg=suite::view_image::view_image_tool --test_arg=--test-threads=1
//codex-rs/core:core-unit-tests --test_arg=--test-threads=1

I am digging into the remaining unfiltered core-all-test devbox failures separately; the focused apply_patch/view_image sandbox paths are green.

starr-openai · 2026-04-10T21:41:36Z

Follow-up validation: the unfiltered core aggregate passes on the devbox when Bazel receives the correct test environment.

Passing command:

cd /tmp/codex-worktrees/exec-server-fs-sandbox-arg0-20260409/codex-rs && \
  export PATH=$HOME/code/openai/project/dotslash-gen/bin:$HOME/.local/bin:$PATH && \
  bazel test --bes_backend= --bes_results_url= --test_output=errors \
    --test_env=CODEX_JS_REPL_NODE_PATH=/home/dev-user/.nvm/versions/node/v25.9.0/bin/node \
    --test_env=PATH \
    //codex-rs/core:core-all-test --test_arg=--test-threads=1

Result: //codex-rs/core:core-all-test PASSED in 340.2s.

The earlier broad failure was caused by Bazel test actions resolving /usr/bin/node (v18.19.1), below the JS REPL minimum v22.22.0, and by the test action not exposing PATH to the shell snapshot assertions. The focused apply_patch/view_image sandbox paths remained green.

pakrym-oai · 2026-04-10T21:54:14Z

+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "operation", content = "params")]
+pub(crate) enum FsHelperRequest {
+    #[serde(rename = "fs/readFile")]


super nit: reuse consts?

pakrym-oai · 2026-04-10T22:05:26Z

            .map_or_else(|| self.cwd.clone(), |path| self.cwd.join(path))
    }

+    pub(crate) fn file_system_sandbox_context(


codex/codex-rs/core/src/tools/handlers/apply_patch.rs

Lines 95 to 96 in 04fc208

async fn effective_patch_permissions(

session: &Session,

looks much more complicated that this.

ok to punt until we convert the main apply patch path

pakrym-oai · 2026-04-10T22:05:52Z

                "view_image is unavailable in this session".to_string(),
            ));
        };
+        let sandbox = environment


why only for remote? local too, right?

eh, let's keep it remote only so we don't break existing usage.

pakrym-oai · 2026-04-10T22:09:24Z

+        &self.runtime_paths.codex_self_exe
+    }
+
+    fn helper_permissions(


why doesn't apply_patch need to do this?

pakrym-oai · 2026-04-10T22:09:32Z

+            .map_err(|err| invalid_request(format!("failed to prepare fs sandbox: {err}")))
+    }
+
+    fn helper_program(&self) -> &AbsolutePathBuf {


nit: inline

Discover exec-server arg0 helper paths from PATH for the default public server entrypoint, preserving sandboxed filesystem support when callers do not pass runtime paths explicitly. Co-authored-by: Codex <noreply@openai.com>

Route sandboxed exec-server filesystem operations through the codex-fs arg0 helper over stdin/stdout, while keeping direct local execution for policies that do not require platform sandboxing. Co-authored-by: Codex <noreply@openai.com>

Discover exec-server arg0 helper paths from PATH for the default public server entrypoint, preserving sandboxed filesystem support when callers do not pass runtime paths explicitly. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

Windows CI can spend more than ten seconds launching helper processes inside the large core aggregate test binary, which makes apply-patch harness tests time out while the turn is still running. Keep the existing non-Windows floor and only raise the Windows floor. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

Collapse ExecutorFileSystem onto one optional-sandbox method per filesystem operation and update unsandboxed callers to pass an explicit None. Also replace helper response into_* demux helpers with expect_* variants that report the unexpected operation directly. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

Strip the implicit cwd grant from request-side filesystem preflight so absolute fs API calls cannot escape explicit readable roots only because Bazel/TMPDIR place test tempdirs under the process cwd. Add regression coverage for the cwd/TMPDIR overlap case that previously returned NotFound instead of an upfront sandbox denial. Co-authored-by: Codex <noreply@openai.com>

Back out the request-side preflight split until the failing absolute-path regression is reworked around the actual AbsolutePathBuf semantics. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

chatgpt-codex-connector bot reviewed Apr 10, 2026

View reviewed changes

Comment thread codex-rs/exec-server/src/server.rs Outdated

pakrym-oai reviewed Apr 10, 2026

View reviewed changes

pakrym-oai approved these changes Apr 10, 2026

View reviewed changes

starr-openai force-pushed the exec-server-fs-sandbox-arg0-20260409 branch from 2a0e0ff to d0f6dce Compare April 10, 2026 23:03

starr-openai force-pushed the exec-server-fs-sandbox-arg0-20260409 branch from 96279d4 to 1a252f0 Compare April 11, 2026 00:32

starr-openai and others added 18 commits April 10, 2026 17:36

codex: address PR review feedback (#17294)

6eaa4e3

Discover exec-server arg0 helper paths from PATH for the default public server entrypoint, preserving sandboxed filesystem support when callers do not pass runtime paths explicitly. Co-authored-by: Codex <noreply@openai.com>

Flush exec-server listen URL in tests

f674be6

Co-authored-by: Codex <noreply@openai.com>

Add sandboxed exec-server filesystem wrapper

f7d37f1

Co-authored-by: Codex <noreply@openai.com>

Simplify exec-server filesystem sandbox plumbing

d9fa593

Co-authored-by: Codex <noreply@openai.com>

Minimize arg0 fs helper dispatch change

31bd02b

Co-authored-by: Codex <noreply@openai.com>

Carry fs sandbox transform settings

4772d0c

Co-authored-by: Codex <noreply@openai.com>

Tighten fs helper sandbox reads

002c87e

Co-authored-by: Codex <noreply@openai.com>

Address fs sandbox review follow-ups

f2bed80

Co-authored-by: Codex <noreply@openai.com>

Refresh exec-server README

b47e4a0

Co-authored-by: Codex <noreply@openai.com>

Pass fs sandbox context to apply_patch and view_image

0852c5d

Co-authored-by: Codex <noreply@openai.com>

Fix exec-server sandboxed filesystem exports

13f7453

Co-authored-by: Codex <noreply@openai.com>

Fix remaining apply_patch sandbox callsite

be2ce03

Co-authored-by: Codex <noreply@openai.com>

Use config permissions for fs sandbox private desktop

b4c4764

Co-authored-by: Codex <noreply@openai.com>

Limit fs sandbox context to remote filesystem calls

12d6eea

Co-authored-by: Codex <noreply@openai.com>

Refine exec-server fs sandbox wiring

8f0c348

Co-authored-by: Codex <noreply@openai.com>

starr-openai force-pushed the exec-server-fs-sandbox-arg0-20260409 branch from 1a252f0 to 1059905 Compare April 11, 2026 00:38

fix exec-server CI failures

707c7cc

Co-authored-by: Codex <noreply@openai.com>

starr-openai force-pushed the exec-server-fs-sandbox-arg0-20260409 branch from 1059905 to 707c7cc Compare April 11, 2026 00:48

github-actions bot mentioned this pull request Apr 11, 2026

📊 AI CLI 工具社区动态日报 2026-04-11 gsscsd/big_model_radar#167

Open

starr-openai and others added 4 commits April 12, 2026 14:57

Revert fs sandbox request preflight follow-up

535cb9b

Back out the request-side preflight split until the failing absolute-path regression is reworked around the actual AbsolutePathBuf semantics. Co-authored-by: Codex <noreply@openai.com>

Adjust exec-server symlink parent-dotdot test expectations

3409e58

Co-authored-by: Codex <noreply@openai.com>

Normalize fs sandbox root aliases on macOS

4dd3c89

Co-authored-by: Codex <noreply@openai.com>

starr-openai merged commit d626dc3 into main Apr 13, 2026
26 of 30 checks passed

starr-openai deleted the exec-server-fs-sandbox-arg0-20260409 branch April 13, 2026 01:36

github-actions bot locked and limited conversation to collaborators Apr 13, 2026


		use crate::ExecServerRuntimePaths;

		pub async fn run_main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {

	let req = ApplyPatchRequest {
	action: apply.action,
	file_paths,
	changes,
	exec_approval_requirement: apply.exec_approval_requirement,
	additional_permissions: effective_additional_permissions
	.additional_permissions,
	permissions_preapproved: effective_additional_permissions
	.permissions_preapproved,
	timeout_ms: None,
	};

Conversation

starr-openai commented Apr 10, 2026

Summary

Validation

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pakrym-oai left a comment

Choose a reason for hiding this comment

Uh oh!

starr-openai commented Apr 10, 2026

Uh oh!

starr-openai commented Apr 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants