clone/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-04-26 15:45:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address exec-server sandbox review feedback

Browse Source 
Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
starr-openai
2026-04-07 10:19:15 -07:00
parent 21ae6e9b3b
commit 2fb1b2de43
13 changed files with 212 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
codex-rs/exec-server/tests/process.rs
View File

@@ -7,7 +7,6 @@ use codex_app_server_protocol::JSONRPCResponse;
use codex_exec_server::ExecResponse;
use codex_exec_server::InitializeParams;
use codex_exec_server::ProcessId;
use codex_sandboxing::SandboxType;
use common::exec_server::exec_server;
use pretty_assertions::assert_eq;
@@ -38,16 +37,6 @@ async fn initialize_server(
Ok(())
}
fn sandbox_wire_test_mode() -> (&'static str, SandboxType) {
if cfg!(target_os = "macos") {
("require", SandboxType::MacosSeatbelt)
} else if cfg!(target_os = "linux") {
("disabled", SandboxType::None)
} else {
unreachable!("unix exec-server tests only run on macOS and Linux");
}
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn exec_server_starts_process_over_websocket() -> anyhow::Result<()> {
let mut server = exec_server().await?;
@@ -83,68 +72,6 @@ async fn exec_server_starts_process_over_websocket() -> anyhow::Result<()> {
process_start_response,
ExecResponse {
process_id: ProcessId::from("proc-1"),
sandbox_type: SandboxType::None,
}
);
server.shutdown().await?;
Ok(())
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn exec_server_starts_sandboxed_process_over_websocket() -> anyhow::Result<()> {
let mut server = exec_server().await?;
initialize_server(&mut server).await?;
let cwd = std::env::current_dir()?;
let (sandbox_mode, expected_sandbox_type) = sandbox_wire_test_mode();
let process_start_id = server
.send_request(
"process/start",
serde_json::json!({
"processId": "proc-sandbox",
"argv": ["true"],
"cwd": cwd,
"env": {},
"tty": false,
"arg0": null,
"sandbox": {
"mode": sandbox_mode,
"policy": {
"type": "danger-full-access"
},
"fileSystemPolicy": {
"kind": "unrestricted",
"entries": []
},
"networkPolicy": "enabled",
"sandboxPolicyCwd": cwd,
"enforceManagedNetwork": false,
"windowsSandboxLevel": "disabled",
"windowsSandboxPrivateDesktop": false,
"useLegacyLandlock": false
}
}),
)
.await?;
let response = server
.wait_for_event(|event| {
matches!(
event,
JSONRPCMessage::Response(JSONRPCResponse { id, .. }) if id == &process_start_id
)
})
.await?;
let JSONRPCMessage::Response(JSONRPCResponse { id, result }) = response else {
panic!("expected process/start response");
};
assert_eq!(id, process_start_id);
let process_start_response: ExecResponse = serde_json::from_value(result)?;
assert_eq!(
process_start_response,
ExecResponse {
process_id: ProcessId::from("proc-sandbox"),
sandbox_type: expected_sandbox_type,
}
);