valknar/llmx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add codex sandbox {linux|macos} (#4782)

Browse Source 
## Summary
- add a `codex sandbox` subcommand with macOS and Linux targets while
keeping the legacy `codex debug` aliases
- update documentation to highlight the new sandbox entrypoints and
point existing references to the new command
- clarify the core README about the linux sandbox helper alias

## Testing
- just fmt
- just fix -p codex-cli
- cargo test -p codex-cli


------
https://chatgpt.com/codex/tasks/task_i_68e2e00ca1e8832d8bff53aa0b50b49e
This commit is contained in:
Fouad Matin
2025-10-05 15:51:57 -07:00
committed by GitHub
parent 7fa5e95c1f
commit 77a8b7fdeb
4 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
codex-rs/README.md
View File

@@ -71,9 +71,13 @@ To test to see what happens when a command is run under the sandbox provided by
``` ```
# macOS # macOS
codex debug seatbelt [--full-auto] [COMMAND]... codex sandbox macos [--full-auto] [COMMAND]...
# Linux # Linux
codex sandbox linux [--full-auto] [COMMAND]...
# Legacy aliases
codex debug seatbelt [--full-auto] [COMMAND]...
codex debug landlock [--full-auto] [COMMAND]... codex debug landlock [--full-auto] [COMMAND]...
``` ```

23
codex-rs/cli/src/main.rs
View File

@@ -76,8 +76,9 @@ enum Subcommand {
/// Generate shell completion scripts. /// Generate shell completion scripts.
Completion(CompletionCommand), Completion(CompletionCommand),
/// Internal debugging commands. /// Run commands within a Codex-provided sandbox.
Debug(DebugArgs), #[clap(visible_alias = "debug")]
Sandbox(SandboxArgs),
/// Apply the latest diff produced by Codex agent as a `git apply` to your local working tree. /// Apply the latest diff produced by Codex agent as a `git apply` to your local working tree.
#[clap(visible_alias = "a")] #[clap(visible_alias = "a")]
@@ -121,18 +122,20 @@ struct ResumeCommand {
} }
#[derive(Debug, Parser)] #[derive(Debug, Parser)]
struct DebugArgs { struct SandboxArgs {
#[command(subcommand)] #[command(subcommand)]
cmd: DebugCommand, cmd: SandboxCommand,
} }
#[derive(Debug, clap::Subcommand)] #[derive(Debug, clap::Subcommand)]
enum DebugCommand { enum SandboxCommand {
/// Run a command under Seatbelt (macOS only). /// Run a command under Seatbelt (macOS only).
Seatbelt(SeatbeltCommand), #[clap(visible_alias = "seatbelt")]
Macos(SeatbeltCommand),
/// Run a command under Landlock+seccomp (Linux only). /// Run a command under Landlock+seccomp (Linux only).
Landlock(LandlockCommand), #[clap(visible_alias = "landlock")]
Linux(LandlockCommand),
} }
#[derive(Debug, Parser)] #[derive(Debug, Parser)]
@@ -341,8 +344,8 @@ async fn cli_main(codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()
); );
codex_cloud_tasks::run_main(cloud_cli, codex_linux_sandbox_exe).await?; codex_cloud_tasks::run_main(cloud_cli, codex_linux_sandbox_exe).await?;
} }
Some(Subcommand::Debug(debug_args)) => match debug_args.cmd { Some(Subcommand::Sandbox(sandbox_args)) => match sandbox_args.cmd {
DebugCommand::Seatbelt(mut seatbelt_cli) => { SandboxCommand::Macos(mut seatbelt_cli) => {
prepend_config_flags( prepend_config_flags(
&mut seatbelt_cli.config_overrides, &mut seatbelt_cli.config_overrides,
root_config_overrides.clone(), root_config_overrides.clone(),
@@ -353,7 +356,7 @@ async fn cli_main(codex_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()
) )
.await?; .await?;
} }
DebugCommand::Landlock(mut landlock_cli) => { SandboxCommand::Linux(mut landlock_cli) => {
prepend_config_flags( prepend_config_flags(
&mut landlock_cli.config_overrides, &mut landlock_cli.config_overrides,
root_config_overrides.clone(), root_config_overrides.clone(),

2
codex-rs/core/README.md
View File

@@ -12,7 +12,7 @@ Expects `/usr/bin/sandbox-exec` to be present.
### Linux ### Linux
Expects the binary containing `codex-core` to run the equivalent of `codex debug landlock` when `arg0` is `codex-linux-sandbox`. See the `codex-arg0` crate for details. Expects the binary containing `codex-core` to run the equivalent of `codex sandbox linux` (legacy alias: `codex debug landlock`) when `arg0` is `codex-linux-sandbox`. See the `codex-arg0` crate for details.
### All Platforms ### All Platforms

6
docs/sandbox.md
View File

@@ -69,9 +69,13 @@ To test to see what happens when a command is run under the sandbox provided by
``` ```
# macOS # macOS
codex debug seatbelt [--full-auto] [COMMAND]... codex sandbox macos [--full-auto] [COMMAND]...
# Linux # Linux
codex sandbox linux [--full-auto] [COMMAND]...
# Legacy aliases
codex debug seatbelt [--full-auto] [COMMAND]...
codex debug landlock [--full-auto] [COMMAND]... codex debug landlock [--full-auto] [COMMAND]...
``` ```