zeekay
901a81abe9
The docs read as OpenAI's Codex CLI: a getting-started page titled for it, `codex --enable skills` and `code sandbox macos` for commands that do not exist, defaults given as gpt-5.1-codex-max/openai when they are zen5-coder/hanzo, a Homebrew page describing a formula we do not publish. Removed three tui-stream-chunking notes and the execpolicy page: they document modules and a subcommand that live only in the vendored upstream copy. There is no execpolicy subcommand and no .codexpolicy loader in code-rs; the page told users to run something the binary does not have. Rewrote tui-alternate-screen against the source. It described an auto/always/never enum and a --no-alt-screen flag; the shipped behavior is a tui.alternate_screen bool with Ctrl+T, which replays the transcript into scrollback on the way out — a better answer to Zellij than the one written down. Genuine openai-provider documentation stays.
2.0 KiB
Platform sandboxing details
The mechanism Dev uses to enforce sandboxing varies by OS.
macOS 12+
- Uses Apple Seatbelt via
sandbox-execwith a profile that matches the selected--sandboxmode.
Linux
- Uses Landlock plus seccomp to apply the configured sandbox policy.
- In containerized environments (e.g., Docker) the host must support these APIs. If it does not, configure the container to provide the isolation you need and run Dev with
--sandbox danger-full-access(or--dangerously-bypass-approvals-and-sandbox) inside that container instead.
Windows
Dev launches commands with a restricted Windows token and an allowlist tied to declared workspace roots. Writes are blocked outside those roots (and %TEMP% when workspace-write is requested); common escape vectors like alternate data streams, UNC paths, and device handles are proactively denied. The CLI also inserts stub executables (for example, wrapping ssh) ahead of the host PATH to intercept risky tools before they escape the sandbox.
Known limitations (smoketests)
Running python windows-sandbox-rs/sandbox_smoketests.py with full filesystem and network access currently passes 37/41 cases. The remaining high-value gaps are:
| Test | Purpose |
|---|---|
| ADS write denied (#32) | Alternate data streams can still be written inside the workspace (should be blocked). |
| Protected path case-variation denied (#33) | .GiT bypasses protections meant for .git. Case variants should be rejected. |
| PATH stub bypass denied (#35) | A workspace ssh.bat shim placed first on PATH is not reliably executed, so interception cannot be proven. |
| Start-Process https denied (#41) | Start-Process 'https://…' succeeds in read-only runs because Explorer handles the ShellExecute outside the sandbox. |
How to help
If you can iterate on Windows sandboxing, aim to close the four smoketest failures above and rerun python windows-sandbox-rs/sandbox_smoketests.py until all 41/41 pass.