[codex] Tighten unified exec sandbox setup

[bookholt-oai]

Summary

• tighten unified exec sandbox initialization
• preserve the requested process workdir independently from sandbox setup
• add regression coverage for the updated invariant

Validation

• Ran /tmp/cargo-tools/bin/just fmt.
• Ran focused codex-core regression tests successfully.
• Ran cargo test -p codex-core; it did not complete cleanly because unrelated existing agent/config-loader tests failed and the run later aborted on a stack overflow in tools::handlers::multi_agents::tests::tool_handlers_cascade_close_and_resume_and_keep_explicitly_closed_subtrees_closed.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[bookholt-oai]

I have read the CLA Document and I hereby sign the CLA

[bookholt-oai]

recheck

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/core/src/tools/runtimes/unified_exec.rs

Lines 280 to 284 in afec29e

	let mut exec_env = attempt
	.env_for(command, options, managed_network)
	.map_err(|err| ToolError::Codex(err.into()))?;
	exec_env.exec_server_env_config = req.exec_server_env_config.clone();
	match zsh_fork_backend::maybe_prepare_unified_exec(

Keep zsh-fork interception on the selected environment cwd

The zsh-fork path passes an ExecRequest whose policy cwd now comes from the orchestrator default. For a non-primary environment_id, intercepted execs in the long-lived shell are evaluated against the primary cwd rather than the environment actually running the process, so later subcommands can be incorrectly allowed, prompted, or escalated.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[evawong-oai]

Approved based on macOS validation.

Validated PR head ca2e4bbca18cb814776d0aca0a6038c3eb65269e.

1. macOS: full report shaped validation passed on the macOS validation host. The model supplied workdir no longer becomes the sandbox policy root, and the outside marker write is denied.

2. Windows: same report shaped validation still reproduces on the Windows validation host. Base and PR head both allowed the outside marker write. This looks like a Windows specific remaining gap, because the Windows sandbox setup still grants write access to the command cwd for workspace write. I am treating that as next PR scope, not a blocker for this macOS scoped fix.

This approval is for the macOS fix in this PR. Windows should be handled in a follow up PR.