feat: support sandbox extra path grants#2920
Conversation
qiyaoq-oai
commented
Apr 17, 2026
qiyaoq-oai
commented
- Add SandboxPathGrant manifest support for explicit access to absolute paths outside sandbox workspace.
- Centralize path handling in WorkspacePathPolicy.normalize_path(...), including extra grant matching, symlink-aware host validation, and most-specific grant selection.
- Harden access boundaries by rejecting filesystem-root grants, // root aliases, and grants that resolve to /.
- Preserve nested grant semantics, including writable parent + read-only child cases through remote symlink targets and macOS exec confinement.
- Update sandbox provider integrations to use shared path policy across Docker, Unix-local, Runloop, Vercel, Cloudflare, E2B, Modal, Daytona, and Blaxel.
github-actions
bot
added
documentation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2da3f45ba3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
seratch
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c9deeda4d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
qiyaoq-oai
force-pushed
the
feat/allow-extra-path
branch
from
c9deeda to
b3ed127
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b3ed127e50
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Validate Daytona read paths via remote realpath helper
DaytonaSandboxSession.read() still uses lexical self.normalize_path(path) instead of _validate_path_access. A workspace symlink (for example link/secret.txt) can resolve outside /workspace and still be downloaded via fs.download_file, bypassing extra_path_grants confinement for SDK reads. This leaves ungranted filesystem reads possible through symlink targets.
Validate Blaxel read paths via remote realpath helper
BlaxelSandboxSession.read() also calls lexical self.normalize_path(path) and then fs.read_binary. If a path inside the workspace traverses a symlink to an ungranted location, the read can still succeed, so read boundaries do not match the new extra-grant model. Use _validate_path_access (remote realpath check) before invoking the file API.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review again please |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 926cd4c7db
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3 participants
