87cce88f48
- Added the new codex-windows-sandbox crate that builds both a library
entry point (run_windows_sandbox_capture) and a CLI executable to launch
commands inside a Windows restricted-token sandbox, including ACL
management, capability SID provisioning, network lockdown, and output
capture
(windows-sandbox-rs/src/lib.rs:167, windows-sandbox-rs/src/main.rs:54).
- Introduced the experimental WindowsSandbox feature flag and wiring so
Windows builds can opt into the sandbox:
SandboxType::WindowsRestrictedToken, the in-process execution path, and
platform sandbox selection now honor the flag (core/src/features.rs:47,
core/src/config.rs:1224, core/src/safety.rs:19,
core/src/sandboxing/mod.rs:69, core/src/exec.rs:79,
core/src/exec.rs:172).
- Updated workspace metadata to include the new crate and its
Windows-specific dependencies so the core crate can link against it
(codex-rs/
Cargo.toml:91, core/Cargo.toml:86).
- Added a PowerShell bootstrap script that installs the Windows
toolchain, required CLI utilities, and builds the workspace to ease
development
on the platform (scripts/setup-windows.ps1:1).
- Landed a Python smoke-test suite that exercises
read-only/workspace-write policies, ACL behavior, and network denial for
the Windows sandbox
binary (windows-sandbox-rs/sandbox_smoketests.py:1).
122 lines
3.6 KiB
TOML
122 lines
3.6 KiB
TOML
[package]
|
|
edition = "2024"
|
|
name = "codex-core"
|
|
version = { workspace = true }
|
|
|
|
[lib]
|
|
doctest = false
|
|
name = "codex_core"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
askama = { workspace = true }
|
|
async-channel = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
base64 = { workspace = true }
|
|
bytes = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-apply-patch = { workspace = true }
|
|
codex-async-utils = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-git = { workspace = true }
|
|
codex-keyring-store = { workspace = true }
|
|
codex-otel = { workspace = true, features = ["otel"] }
|
|
codex-protocol = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-utils-pty = { workspace = true }
|
|
codex-utils-readiness = { workspace = true }
|
|
codex-utils-string = { workspace = true }
|
|
codex-utils-tokenizer = { workspace = true }
|
|
dirs = { workspace = true }
|
|
dunce = { workspace = true }
|
|
env-flags = { workspace = true }
|
|
eventsource-stream = { workspace = true }
|
|
futures = { workspace = true }
|
|
http = { workspace = true }
|
|
indexmap = { workspace = true }
|
|
keyring = { workspace = true, features = [
|
|
"apple-native",
|
|
"crypto-rust",
|
|
"linux-native-async-persistent",
|
|
"windows-native",
|
|
] }
|
|
libc = { workspace = true }
|
|
mcp-types = { workspace = true }
|
|
os_info = { workspace = true }
|
|
rand = { workspace = true }
|
|
regex-lite = { workspace = true }
|
|
reqwest = { workspace = true, features = ["json", "stream"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha1 = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
shlex = { workspace = true }
|
|
similar = { workspace = true }
|
|
strum_macros = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
test-log = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true, features = [
|
|
"formatting",
|
|
"parsing",
|
|
"local-offset",
|
|
"macros",
|
|
] }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tokio-util = { workspace = true, features = ["rt"] }
|
|
toml = { workspace = true }
|
|
toml_edit = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
tree-sitter = { workspace = true }
|
|
tree-sitter-bash = { workspace = true }
|
|
uuid = { workspace = true, features = ["serde", "v4"] }
|
|
which = { workspace = true }
|
|
wildmatch = { workspace = true }
|
|
codex_windows_sandbox = { package = "codex-windows-sandbox", path = "../windows-sandbox-rs" }
|
|
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
landlock = { workspace = true }
|
|
seccompiler = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
core-foundation = "0.9"
|
|
|
|
# Build OpenSSL from source for musl builds.
|
|
[target.x86_64-unknown-linux-musl.dependencies]
|
|
openssl-sys = { workspace = true, features = ["vendored"] }
|
|
|
|
# Build OpenSSL from source for musl builds.
|
|
[target.aarch64-unknown-linux-musl.dependencies]
|
|
openssl-sys = { workspace = true, features = ["vendored"] }
|
|
|
|
[dev-dependencies]
|
|
assert_cmd = { workspace = true }
|
|
assert_matches = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
escargot = { workspace = true }
|
|
image = { workspace = true, features = ["jpeg", "png"] }
|
|
maplit = { workspace = true }
|
|
predicates = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
serial_test = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio-test = { workspace = true }
|
|
tracing-test = { workspace = true, features = ["no-env-filter"] }
|
|
walkdir = { workspace = true }
|
|
wiremock = { workspace = true }
|
|
|
|
[package.metadata.cargo-shear]
|
|
ignored = ["openssl-sys"]
|