Skip to content

Add workspace metadata shell preflight#19848

Closed
evawong-oai wants to merge 2 commits intomainfrom
codex/bugb15632-preserved-path-preflight
Closed

Add workspace metadata shell preflight#19848
evawong-oai wants to merge 2 commits intomainfrom
codex/bugb15632-preserved-path-preflight

Conversation

@evawong-oai
Copy link
Copy Markdown
Contributor

@evawong-oai evawong-oai commented Apr 27, 2026 •
edited
Loading

Summary

Add an early user facing check that explains simple literal shell redirections into protected project root metadata. The check uses FileSystemSandboxPolicy for the protected metadata names and message.

Scope

  1. Add a shared shell command helper for literal protected metadata redirection targets.
  2. Use that helper in debug sandbox, legacy shell, and UnifiedExec paths.
  3. Use the effective FileSystemSandboxPolicy after additional permissions are merged.
  4. Keep direct command creation attempts such as mkdir .codex enforced by FileSystemSandboxPolicy and the platform sandbox adapters instead of duplicating that policy in command preflight.

Reviewer Focus

  1. This PR improves the error message for simple parseable shell redirections such as printf data into .codex config.
  2. It does not weaken .git, .agents, or .codex protections. Security remains in FileSystemSandboxPolicy and the platform sandbox adapters.
  3. Command preflight is intentionally not a second security policy. Direct command attempts such as mkdir .codex should still be denied by sandbox enforcement rather than by a command name deny list.

Stack

  1. Policy primitive: [sandbox] Enforce protected workspace metadata paths #19846
  2. macOS Seatbelt adapter: Enforce workspace metadata protections in Seatbelt #19847
  3. Shell preflight UX: this PR
  4. Runtime profile propagation: Propagate runtime permission profiles #19849
  5. Linux bubblewrap adapter: Enforce workspace metadata protections in Linux sandbox #19852

Validation

  1. targeted core protected metadata preflight tests
  2. targeted shell command metadata detector tests
  3. Rust format check
  4. diff whitespace check

This was referenced Apr 27, 2026
Merged
Merged
Merged
Closed
Merged
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from 7a081ee to fe774aa Compare April 27, 2026 18:32
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from fca3989 to 1bc0b13 Compare April 27, 2026 18:32
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from fe774aa to 017761a Compare April 27, 2026 18:40
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch 2 times, most recently from 2b511ae to b0df7b1 Compare April 27, 2026 18:55
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from 017761a to 613fe13 Compare April 27, 2026 18:55
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from b0df7b1 to e76a989 Compare April 27, 2026 19:07
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch 2 times, most recently from 6e4de4c to 0b8c428 Compare April 27, 2026 19:48
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch 2 times, most recently from 6c3c566 to 669222a Compare April 27, 2026 20:52
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch 2 times, most recently from 6541b90 to c2bf30f Compare April 27, 2026 21:14
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from 669222a to a1666bf Compare April 27, 2026 21:14
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from c2bf30f to 5e3f0d4 Compare April 27, 2026 22:21
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch 2 times, most recently from 427c425 to 5259804 Compare April 28, 2026 00:10
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from 5e3f0d4 to ea88850 Compare April 28, 2026 00:10
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from 5259804 to f9a5bc4 Compare April 28, 2026 01:10
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from ea88850 to c008a8f Compare April 28, 2026 01:10
@evawong-oai evawong-oai changed the title Add preserved path shell preflight Add workspace metadata shell preflight Apr 28, 2026
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from c008a8f to a767cac Compare April 28, 2026 03:15
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from f9a5bc4 to e683055 Compare April 28, 2026 03:15
evawong-oai added a commit that referenced this pull request Apr 28, 2026
@evawong-oai
[sandbox] Enforce protected workspace metadata paths (#19846)
0156b1e 
## Summary

Make FileSystemSandboxPolicy the semantic source of truth for project
root metadata protection. Under writable roots, `.git`, `.codex`, and
`.agents` stay protected unless user policy grants an explicit write
rule for that metadata path.

## Scope

1. Add `protected_metadata_names` to `WritableRoot`.
2. Teach `FileSystemSandboxPolicy::can_write_path_with_cwd` to reject
protected metadata writes under writable roots unless explicitly
allowed.
3. Default workspace write profiles to protect `.git`, `.codex`, and
`.agents`.
4. Add the Linux fallback setup needed before Linux enforcement lands
later in the stack.

## Reviewer Focus

1. The policy decision belongs in FileSystemSandboxPolicy, not shell
command parsing.
2. Legacy SandboxPolicy remains a compatibility projection, not the
source of the new rule.
3. Explicit user write rules can still opt into these metadata paths.

## Stack

1. Policy primitive: this PR
2. macOS Seatbelt adapter: #19847
3. Shell preflight UX: #19848
4. Runtime profile propagation: #19849
5. Linux bubblewrap adapter: #19852

## Validation

1. codex protocol permissions tests
2. formatting for codex protocol and codex linux sandbox
3. diff whitespace check
@evawong-oai evawong-oai force-pushed the codex/bugb15632-seatbelt-preserved-paths branch from a767cac to 19909d3 Compare April 28, 2026 16:19
evawong-oai added a commit that referenced this pull request Apr 28, 2026
@evawong-oai
Enforce workspace metadata protections in Seatbelt (#19847)
0670d89 
## Summary

Translate FileSystemSandboxPolicy project root metadata carveouts into
macOS Seatbelt rules.

## Scope

1. Thread protected metadata names into Seatbelt access roots.
2. Ask FileSystemSandboxPolicy whether each metadata carveout is
writable.
3. Emit Seatbelt deny rules that block creating or replacing protected
metadata names under writable roots.
4. Add coverage for first time metadata creation and read only
carveouts.

## Reviewer Focus

1. This PR only covers the macOS sandbox adapter.
2. The policy decision comes from FileSystemSandboxPolicy.
3. Read only subpath carveouts and metadata protection checks should
compose cleanly.

## Stack

1. Policy primitive: #19846
2. macOS Seatbelt adapter: this PR
3. Shell preflight UX: #19848
4. Runtime profile propagation: #19849
5. Linux bubblewrap adapter: #19852

## Validation

1. formatting for codex sandboxing
2. codex sandboxing package tests
Base automatically changed from codex/bugb15632-seatbelt-preserved-paths to main April 28, 2026 17:13
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from e683055 to 74f29c7 Compare April 28, 2026 17:17
@evawong-oai evawong-oai marked this pull request as ready for review April 28, 2026 18:02
@evawong-oai evawong-oai requested a review from a team as a code owner April 28, 2026 18:02
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 28, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74f29c7e2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread codex-rs/cli/src/debug_sandbox.rs Outdated
Comment thread codex-rs/core/src/tools/handlers/shell.rs Outdated
viyatb-oai
viyatb-oai reviewed Apr 28, 2026
View reviewed changes
Comment thread codex-rs/core/src/tools/handlers/shell.rs Outdated
viyatb-oai
viyatb-oai reviewed Apr 28, 2026
View reviewed changes
Comment thread codex-rs/core/src/tools/handlers/shell.rs Outdated
viyatb-oai
viyatb-oai reviewed Apr 28, 2026
View reviewed changes
Comment thread codex-rs/cli/src/debug_sandbox.rs Outdated
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch 2 times, most recently from 9fcd271 to 9ee9e1c Compare April 28, 2026 21:29
bolinfest
bolinfest reviewed Apr 28, 2026
View reviewed changes
Comment thread codex-rs/core/src/tools/sandboxing_tests.rs Outdated
bolinfest
bolinfest reviewed Apr 28, 2026
View reviewed changes
Comment thread codex-rs/core/src/tools/sandboxing.rs Outdated
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch 2 times, most recently from 8d29c35 to 35e30b8 Compare April 28, 2026 22:00
@evawong-oai evawong-oai force-pushed the codex/bugb15632-preserved-path-preflight branch from 35e30b8 to 321204f Compare April 28, 2026 22:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bolinfest bolinfest bolinfest left review comments

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

@viyatb-oai viyatb-oai viyatb-oai left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@evawong-oai @bolinfest @viyatb-oai