87cce88f48
- Added the new codex-windows-sandbox crate that builds both a library
entry point (run_windows_sandbox_capture) and a CLI executable to launch
commands inside a Windows restricted-token sandbox, including ACL
management, capability SID provisioning, network lockdown, and output
capture
(windows-sandbox-rs/src/lib.rs:167, windows-sandbox-rs/src/main.rs:54).
- Introduced the experimental WindowsSandbox feature flag and wiring so
Windows builds can opt into the sandbox:
SandboxType::WindowsRestrictedToken, the in-process execution path, and
platform sandbox selection now honor the flag (core/src/features.rs:47,
core/src/config.rs:1224, core/src/safety.rs:19,
core/src/sandboxing/mod.rs:69, core/src/exec.rs:79,
core/src/exec.rs:172).
- Updated workspace metadata to include the new crate and its
Windows-specific dependencies so the core crate can link against it
(codex-rs/
Cargo.toml:91, core/Cargo.toml:86).
- Added a PowerShell bootstrap script that installs the Windows
toolchain, required CLI utilities, and builds the workspace to ease
development
on the platform (scripts/setup-windows.ps1:1).
- Landed a Python smoke-test suite that exercises
read-only/workspace-write policies, ACL behavior, and network denial for
the Windows sandbox
binary (windows-sandbox-rs/sandbox_smoketests.py:1).
44 lines
1.0 KiB
TOML
44 lines
1.0 KiB
TOML
[package]
|
|
name = "codex-windows-sandbox"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[lib]
|
|
name = "codex_windows_sandbox"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
anyhow = "1.0"
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
[dependencies.rand]
|
|
version = "0.8"
|
|
default-features = false
|
|
features = ["std", "small_rng"]
|
|
[dependencies.dirs-next]
|
|
version = "2.0"
|
|
[dependencies.windows-sys]
|
|
version = "0.52"
|
|
features = [
|
|
"Win32_Foundation",
|
|
"Win32_System_Diagnostics_Debug",
|
|
"Win32_Security",
|
|
"Win32_Security_Authorization",
|
|
"Win32_System_Threading",
|
|
"Win32_System_JobObjects",
|
|
"Win32_System_SystemServices",
|
|
"Win32_System_Environment",
|
|
"Win32_System_Pipes",
|
|
"Win32_System_WindowsProgramming",
|
|
"Win32_System_IO",
|
|
"Win32_System_Memory",
|
|
"Win32_System_Kernel",
|
|
"Win32_System_Console",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_Diagnostics_ToolHelp",
|
|
"Win32_Networking_WinSock",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Com",
|
|
"Win32_Security_Authentication_Identity",
|
|
]
|