Skip to content

Remove exec-server fs sandbox request preflight#17883

Merged
pakrym-oai merged 4 commits intomainfrom
pakrym/remove-fs-sandbox-preflight-full-ci
Apr 15, 2026
Merged

Remove exec-server fs sandbox request preflight#17883
pakrym-oai merged 4 commits intomainfrom
pakrym/remove-fs-sandbox-preflight-full-ci

Conversation

@pakrym-oai
Copy link
Copy Markdown
Collaborator

Summary

  • Remove the exec-server-side manual filesystem request path preflight before invoking the sandbox helper.
  • Keep sandbox helper policy construction and platform sandbox enforcement as the access boundary.
  • Add a portable local+remote regression for writing through an explicitly configured alias root.
  • Remove the metadata symlink-escape assertion that depended on the deleted manual preflight; no replacement metadata-specific access probe is added.

Tests

  • cargo test -p codex-exec-server --lib
  • cargo test -p codex-exec-server --test file_system
  • git diff --check

#[test_case(false ; "local")]
#[test_case(true ; "remote")]
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn file_system_get_metadata_rejects_symlink_escape(use_remote: bool) -> Result<()> {
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aligns with shell

@pakrym-oai pakrym-oai enabled auto-merge (squash) April 15, 2026 16:02
@pakrym-oai pakrym-oai disabled auto-merge April 15, 2026 16:28
@pakrym-oai pakrym-oai merged commit 1dead46 into main Apr 15, 2026
50 of 61 checks passed
@pakrym-oai pakrym-oai deleted the pakrym/remove-fs-sandbox-preflight-full-ci branch April 15, 2026 16:28
@github-actions github-actions bot locked and limited conversation to collaborators Apr 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants