## Why
Windows sandbox setup diagnostics previously displayed only the outer error context, hiding native failure causes needed to diagnose ACL failures.
## What changed
Preserve full error chains in ACL refresh summaries, setup logs, and sandbox binary directory lock failure reports. Include the requested access rights in ACL update open errors, and retain recorded ACL failures even when writing their log entries fails.
## Testing
Add tests covering error chains for ACL checks, grants, and denies; preservation of accumulated failures when logging fails; and native directory-open errors surviving a structured setup report round trip on Windows.
GitOrigin-RevId: 0a44a56b13d13b52b92ec673aaa2da7bc6cf0753
## What changed
- Add `runtime_package` targets for combined, primary, app-server, and Windows helper bundles, plus per-binary release archives.
- Apply release settings automatically and retain unstripped binaries with macOS dSYM or Windows PDB symbols. Require platform-specific symbols and validate that dSYM bundles contain nonempty DWARF data.
- Support a `debug` build mode for faster package smoke builds and configure platform-specific release settings, including native Windows MSVC toolchains.
- Add a composite action that refreshes Cargo workspace metadata, builds the selected archive, and extracts writable files for existing signing and packaging steps.
GitOrigin-RevId: 21109875cde228aaef67b2ba9812b3e4854aee84
## What changed
Add Windows MXC backend helpers to inventory the Codex executable, sandbox
launcher, and available `rg` scanner when deny globs are configured. Prepare
filesystem policies for inspection by reusing MXC temporary-directory and volume
resolution and replacing deny globs with concrete path snapshots.
Allow Windows deny-glob resolution to run its scanner with an explicit command
environment and working directory, including an empty environment. The integrity
helpers are not yet invoked by an execution runner.
## Testing
Add a backend test verifying that deny-glob snapshots replace the original
patterns, including empty snapshots, and affect `FileContentsChecker` results.
GitOrigin-RevId: 409c527663d230d76d65be3bf0a37959f694d77e
## Why
Opening active EXE/DLL files with `MAXIMUM_ALLOWED` can request access that causes sharing violations during sandbox runtime ACL repair.
## What changed
Restrict `MAXIMUM_ALLOWED` opens to directories that need to suppress child ACL propagation. For files, request `READ_CONTROL | WRITE_DAC` only when an ACL update is needed.
Preserve the non-inheriting grant behavior from https://github.com/openai/codex/pull/49690, including existing permissions, deny ACEs, and null DACLs.
## Testing
Extend the Windows runtime repair regression test to hold `node.exe` open with `FILE_SHARE_READ` throughout repair and revalidation, while checking read/execute access and preserved denials.
GitOrigin-RevId: 2e087b51adc0221d0eda061fa0a34d2e98409662
## Why
Windows temp grants could fall back to host `TEMP`/`TMP` values and bypass read-only or denied subpaths. Sandbox permissions must match the environment passed to the child process.
## What changed
- Resolve `:tmpdir` from absolute `TEMP`/`TMP` paths in the completed workload environment, preserving access modes and missing-path rules without falling back to host values.
- Deduplicate Windows environment keys case-insensitively in a deterministic order so permission resolution and the child environment select the same value.
- Use the resolved temp policy for elevated sandbox overrides across core execution, exec-server, and direct spawning.
- Launch direct-spawn sandbox wrappers with the supplied Codex executable, materializing an inner helper only when it is that executable.
## Testing
Add Windows regression coverage for temp-only writes, read-only and denied carveouts, mixed-case and duplicate environment keys, unavailable temp paths, and empty or missing write-root overrides. Exercise core execution and direct spawning, and extend exec-server RPC coverage to the elevated backend with temp values set through the environment policy.
GitOrigin-RevId: 16b8bd4702cc434fd743a08c75a3e4515780bff3
## Why
A stopped provisioning service is treated as unavailable by the connection path, preventing registered Core setup from provisioning the sandbox.
## What changed
Start a stopped Windows sandbox service before provisioning during explicit registered Core setup. Request service-start permission through the Windows Service Control Manager and tolerate the service already running if another caller starts it concurrently. Preserve existing unavailable-service handling when the service is missing or marked for deletion.
GitOrigin-RevId: fab87c10dfabd4324f631077262f7e0dccc170f6
## Why
Malformed `deny_read_acl_state.json` previously caused deny-read ACL reconciliation to fail. Recovery must restore bookkeeping without removing unknown existing restrictions or modifying a linked file's contents.
## What changed
- Retry malformed reads for up to two seconds, then rebuild bookkeeping only after excluding active writers and successfully applying current deny-read ACLs. Preserve unknown historical denies and continue propagating I/O errors.
- Validate the opened state file before reading or writing, rejecting reparse points and files with multiple hard links.
- Write state in place without truncating before validation, preserving file identity and permissions. Retry sharing violations during writes while preventing replacement through delete access.
## Testing
Add Windows tests for corrupt-state recovery, linked-file rejection, concurrent writer and delete-handle behavior, file identity and ACL preservation, and subsequent permission-profile changes. Extend the elevated sandbox integration test to verify that denied reads remain blocked after recovery while allowed writes and deletes succeed.
GitOrigin-RevId: 4aca32df00d015df3763fdc447ffdfbe3fd6cec0
## What changed
Persist the service's last reported lifecycle reason and numeric HRESULT in the existing service registry key. Distinguish requested stops, shutdown, owner removal, startup failure, broker failure, and interrupted registration, and reset the record on startup. Recording is best-effort and does not affect the service lifecycle.
Emit `codex.windows_sandbox.service_stopped` when a provisioning client observes a stopped service, including the recorded reason, HRESULT, and Windows service exit codes. Recheck the service status and registry record before emitting to avoid pairing inconsistent evidence during a concurrent restart. The metric counts observations, not unique outages; the recorded reason is advisory.
Update the cached service status only after `SetServiceStatus` succeeds. Extract diagnostic error codes from typed errors without collecting error text or user data.
## Testing
Add a test covering Win32-to-HRESULT conversion, preservation of Windows HRESULTs through error context, and a zero fallback for untyped error text.
GitOrigin-RevId: d0d39d091410e2b5499a0803475804d12235f836
## What changed
Add `codex sandbox uninstall` to remove machine-wide legacy Windows sandbox accounts and network rules with administrator privileges. Run cleanup without loading configuration, preserving Codex home, sandbox directories, and filesystem permissions. Reject the command on other platforms.
Keep commands after `--` forwarded to the sandbox, including `codex sandbox -- uninstall --help`.
## Testing
Add parsing coverage for the uninstall subcommand and command separator. Add an integration test verifying that help and invalid arguments work with malformed configuration and leave configuration and credentials unchanged.
GitOrigin-RevId: d2b02ef7bc0a05742dd5eb3c47292ad517d46664
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
An inaccessible user profile directory can prevent sandboxed PowerShell from preserving its working directory and resolving relative paths in a project beneath that profile.
## What changed
Pass `USERPROFILE` to elevated setup and refresh. When the command's working directory is beneath an absolute profile path, grant the sandbox group non-inheriting `FILE_READ_ATTRIBUTES` access to the profile directory.
Preserve existing permissions and deny ACEs during non-inheriting ACL updates without propagating changes to descendants. Expand generic deny masks when checking for conflicting permissions.
## Testing
Add a Windows regression test that checks PowerShell's working directory and reading `.\public.txt` beneath a protected profile. Add an ACL test that verifies a non-inheriting grant leaves an unprotected child's security descriptor unchanged.
GitOrigin-RevId: 7f142a7ffdee795c3255d4a6e79568fa9391c055
## Why
Elevated sandbox tests share machine-local Windows accounts. Concurrent setup can rotate account passwords between another test's setup and logon.
## What changed
- Add a shared file-lock guard for elevated sandbox tests in `codex-core`, `codex-exec-server`, and `codex-windows-sandbox`, held through sandbox commands and cleanup.
- Queue these tests in a single-threaded Nextest group before their timeouts start, while retaining the file lock to coordinate other test processes.
- Limit account locking to tests that use elevated accounts and remove the sandbox crate's blanket Bazel `exclusive-if-local` tag.
GitOrigin-RevId: 26d4606cb1fdcac65926d29835bed4eac04c19c0
## Why
`CreateProcessWithLogonW` failures with `ERROR_SERVICE_ALREADY_RUNNING` (1056) previously aborted sandbox startup without retrying. At this stage, neither the runner nor the user command has started, so retrying does not replay the command.
## What changed
Retry runner creation once with the same sandbox credentials when logon returns error 1056. Propagate a second failure without refreshing credentials, and keep child startup errors with the same code ineligible for this retry.
## Testing
Add regression tests for recovery, the two-attempt limit, and exclusion of child startup failures. Add a unified exec test that injects a logon failure, verifies that the retry preserves the original request and credentials, and checks that the command runs exactly once.
GitOrigin-RevId: 78def6cdb93bf32f9b4a3e398cd16de83286fec4
## What changed
Use `ConsoleMode::NoWindow` for legacy Windows sandbox capture and non-TTY unified execution, enabling `CREATE_NO_WINDOW` for these piped processes.
## Testing
Extend the PowerShell interrupt and capture tests to assert that `GetConsoleWindow()` returns null before checking process termination and descendant survival.
GitOrigin-RevId: dcc3b5554986ab0280748e5fa7080d36ded3d673
## Why
Restoring the error mode with `SetErrorMode` can overwrite the failure code from `CreateProcessWithLogonW`, causing `RunnerLogonError` to report the wrong error.
## What changed
Capture `GetLastError()` immediately after a failed runner launch, before restoring the previous error mode, and use the saved code for `RunnerLogonError`.
GitOrigin-RevId: c0f4267232306be4d06e7e8accd60f7b77b8d6f3
## Why
Background helpers launched from a detached Windows process can allocate console windows. Job Object launches and containment fallbacks need to preserve console suppression as well.
## What changed
- Add `codex_utils_process::background_command` to set `CREATE_NO_WINDOW` on Windows, and use it across background subprocess launches, including Git, plugins, authentication, diagnostics, and sandbox helpers.
- Centralize console suppression in Job Object launches. Keep `CREATE_NO_WINDOW` when retrying without containment, and clear `CREATE_SUSPENDED` so the fallback child can run.
- Preserve console inheritance for interactive shell launches and interactive AWS authentication refreshes.
## Testing
Add Windows regression tests covering console-free launches from detached parents through standard and Tokio commands, stdout/stderr capture, successful containment, Job Object creation and assignment failures, and sandbox setup refresh helpers.
GitOrigin-RevId: b2c238fa7d4f9fbd868e5adf7d4be9958ff01e6c
## Why
Runtime ACL repair needs to handle nested files and directories beyond the legacy Windows path limit.
## What changed
Use Rust's `OpenOptions` for ACL reads and handle-based `SetSecurityInfo` for updates to support extended-length paths. Request ACL-write access only when grants need updating, and share allocation cleanup across success and error paths.
## Testing
Add a regression test covering long directory and file paths alongside a short-path control. Verify repeated repairs grant read/execute access without granting write, delete, or ACL-management rights, and that already-correct grants remain no-ops.
GitOrigin-RevId: 325c17085fa4379eebe982d49175dd2151b0681e
## Why
Allow the provisioning service time to start without holding up desktop readiness checks for the full provisioning timeout.
## What changed
- Poll service status while startup is pending, waiting up to five seconds within the caller's deadline. Treat absent, deletion-pending, or other non-running service states as unavailable.
- Preserve the original provisioning deadline for pipe availability and request processing, and reject requests whose deadline expires during server authentication.
- Recheck service status when the pipe disappears while waiting for an available instance.
GitOrigin-RevId: ea89175cb41749b9768ac5915083bbfd8ad32713
## Why
AWS profiles can select credential helpers that the application executes. Granting write access to a containing directory should therefore keep `.aws` protected by default.
## What changed
Add `.aws` to the protected metadata paths alongside `.git`, `.agents`, and `.codex`, including workspace roots and additional writable roots. Preserve explicit user rules that override the default protection.
## Testing
Extend policy and sandbox tests to cover `.aws` protection. Add macOS coverage for existing and absent `.aws` directories, deletion and replacement attempts, and symlink targets. Verify that Linux sandbox writes to protected configuration files fail while sibling files remain writable.
GitOrigin-RevId: 31ea287bd0dd9b13aff893783fba9ca3aed0c89d
## What changed
Remove the Windows sandbox audit module and its exported scan-and-deny helper, including the associated tests. Remove the config edit variant and builder method for acknowledging `hide_world_writable_warning`.
GitOrigin-RevId: c9cfc9b276d46c45d5788fe8d29b2bc4e422001c
## Why
Expanded recursive deny lists can exceed the Windows command-line limit, preventing sandbox wrappers and setup helpers from launching.
## What changed
- Use chunked environment transport for wrapper and non-elevating setup payloads above 24,000 UTF-16 code units, preserving the existing argument protocol for smaller requests.
- Share the transport with the MXC launcher, supporting payloads up to 16 MiB with Unicode-safe chunking and validation.
- Keep transport variables out of the workload environment and remove inherited chunks before launching setup helpers.
## Testing
Add coverage for transport boundaries, Unicode round trips, malformed payload rejection, environment cleanup, and large payloads crossing Windows process creation. Extend the elevated sandbox integration test with 1,000 nested denied files to verify read restrictions and `AGENTS.md` discovery with a payload exceeding the command-line limit.
GitOrigin-RevId: 8ef92fdc7d534143f0eac76036a2173a6f585d08
## Why
Registered Windows sandbox setup could appear complete even when Windows rejected the stored account passwords. Checking account flags alone did not detect these failures before runtime logon.
## What changed
- Check stored credentials for both offline and online accounts before reusing completed setup during non-refresh provisioning.
- Classify logon failure, expired-password, and password-change-required errors as `SandboxAccountCredentialMismatch`, preserving the underlying Windows error.
- Trigger full setup to rotate credentials only after verifying that recorded account SIDs still match. Propagate credential-file and policy errors without triggering password repair, and skip credential checks for refresh-only requests.
## Testing
Add tests for native error classification, missing credential files, healthy credentials, password failures on either account, policy failures, and rejection of repair when account ownership validation fails.
GitOrigin-RevId: b3aa02f82841dd2605b0c3585ec93144727721e6
## Why
Incomplete setup for the installed app reported the same error as an owner mismatch or removal in progress, obscuring the need to retry sandbox setup.
## What changed
- Distinguish owner mismatch, Codex home mismatch, removal in progress, and incomplete setup when authorizing the registered runner receipt.
- Tell users to retry sandbox setup when the receipt is not ready for the installed app.
- Add operation and account context to provisioning failures, including account logon, profile preparation, package queries, alias resolution, and registration persistence.
## Testing
Add a unit test covering distinct authorization errors and their precedence, acceptance of a ready receipt, and rejection after the app package changes.
GitOrigin-RevId: 4e7620c4670e8b02a411a176cc89bd72dcd6e478
## Why
Windows 10 rejects the Object Manager drive-letter link when opening a directory with `OBJ_DONT_REPARSE`, preventing ordinary local-drive paths from opening successfully.
## What changed
Resolve drive-letter aliases with `QueryDosDeviceW` before calling `NtCreateFile`. Accept only direct disk-volume mappings, rejecting other devices and volume subpaths. Leave filesystem components unresolved so `OBJ_DONT_REPARSE` continues to reject filesystem reparse points.
## Testing
Add tests for drive-root opens and NT path construction using ordinary and verbatim drive paths, plus validation of accepted disk-volume mappings and rejected device or subpath mappings.
GitOrigin-RevId: 2fe81913a7ac8d0122ec423db5750e80241def56
## Why
AWS credential discovery, analytics, and telemetry used clients that did not share the application's network policy. These requests need to honor destination restrictions and permission revocation.
## What changed
- Route AWS credential and region HTTP requests through the shared HTTP client, and check the signing destination before loading credentials. Skip discovery for static access keys with an explicit region.
- Apply account-scoped policy to Bedrock authentication. Require unrestricted policy for credential exporters and reauthentication commands, and cancel active work when permission is revoked. Document that AWS profile `credential_process` network traffic remains outside the application's HTTP policy.
- Send analytics through the authenticated account's HTTP client factory.
- Guard OTLP log, trace, and metric exports with revocable permits, disable them under destination restrictions, and make managed HTTP exports cancellable. Suppress global Statsig settings while managed policy is active.
## Testing
Add coverage for metadata credential request cancellation, allowed and denied SigV4 destinations, AWS credential precedence and endpoint configuration, and blocked credential exporter recovery. Update telemetry tests for account transitions and managed-policy Statsig suppression.
GitOrigin-RevId: d8a2018bfbbe971ec430699b0d3f86a7a9e1e072
## Why
Shared filesystem capabilities must not grant access to another logon session's processes, threads, or IPC objects. A shared account's implicit owner rights can also allow another logon to rewrite an object's DACL.
## What changed
- Grant full access in the token's default DACL only to the runner's logon SID, removing grants to Everyone and capability SIDs.
- Add an `OWNER RIGHTS` entry granting only `READ_CONTROL` to suppress the owner's implicit `WRITE_DAC` access.
- Close the new token handle if default DACL or privilege setup fails.
## Testing
Add a Windows `AccessCheck` regression test verifying that process memory, thread creation, termination, query, and DACL modification rights remain available to the creating logon but are denied to a simulated other logon sharing the same owner and capability.
GitOrigin-RevId: 94608466ee1b461fe10db1866e80b3988119bdfc
## Why
Package context propagation was limited to verified `codex-command-runner.exe` processes, preventing other packaged callers from passing their OS-assigned identity to sandboxed children.
## What changed
Use the current process's OS package identity to decide whether to preserve desktop app context in both regular and ConPTY sandbox launches. Remove executable-name and staged-runner verification from this decision.
Reject callers without package identity when `CODEX_WINDOWS_REGISTERED_CORE=1`; otherwise, unpackaged callers continue without preserving app context.
GitOrigin-RevId: 52eb2fe33c8746d898b5d7ebf53bd001a55b5506
## What changed
- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.
## Testing
Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.
GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4
## Why
Sandbox setup rotates machine-wide account passwords. The process-local test lock cannot prevent concurrent `exec-server` elevated filesystem tests from changing those passwords between setup and logon.
## What changed
- Add the Bazel `exclusive-if-local` test tag to `windows-sandbox-rs` to prevent this overlap during local test execution.
- Include the full error chain and sandbox log when the elevated non-TTY command test fails to spawn a session.
GitOrigin-RevId: bba87fc606ea60a35cf0451ed0ef68ef2eb14d3a
## Why
Cleanup needs fresh logon tokens for sandbox accounts that may already be disabled. Temporarily enabling those accounts must leave a durable obligation to disable them again if the service exits unexpectedly.
## What changed
- Persist `cleanup_logon_pending` before enabling an account, then disable it again after the logon attempt before clearing the marker.
- Recover pending account disables before owner restoration or IPC admission, validating account SIDs before restoration. Block runtime readiness and provisioning while recovery is pending, and defer retirement until cleanup logons are prepared.
- Include the blocking logon details in cleanup timeout errors and suppress repeated identical cleanup errors in the Windows event log.
## Testing
Add receipt tests covering backward-compatible defaults and pending cleanup state surviving serialization, blocking readiness and owner admission until cleared.
GitOrigin-RevId: 801bec408a27ac85ccdc3eb5ca2bdb2ccb3d5827
## Why
A runtime directory can have read/execute access while existing files and subdirectories lack inherited permissions. Checking only the runtime roots leaves those children inaccessible to sandbox users.
## What changed
- Walk the Codex app runtime tree and add missing read/execute grants for the sandbox group, validating access after changes.
- Use `GRANT_ACCESS` to preserve existing grants and skip additions that could override deny entries, including inherited denials for other trustees.
- Skip reparse points and trees with reparse-point ancestors, tolerate disappearing paths, and report repair failures through setup logging and refresh errors.
## Testing
Add Windows regression tests for repairing children beneath an already-readable root, repeated repairs, preserving read/write denials and other trustees' inherited file denials, avoiding write or ACL-management grants, and leaving junction targets untouched.
GitOrigin-RevId: 93d55dd9fca2b24eac157ae9be505982d07dd9b9
## What changed
- Use the installed provisioning service regardless of the onboarding feature gate. Fall back to the elevated helper only when the service is unavailable; propagate service errors.
- Pass the effective proxy settings and filter listener ports to match them, including when preserving saved settings.
- Remove stale credentials before repairing missing, disabled, or password-expired sandbox accounts so older services cannot mistake them for completed setup.
- Select helper fallback when workload-identity environment variables are present, since service requests do not carry that environment. Continue rejecting helper fallback for registered Core.
## Testing
Extend account-repair tests to cover stale credential removal, missing and disabled accounts, and repeated setup checks. Add subprocess tests for workload-identity routing with and without registered Core.
GitOrigin-RevId: 1041ae76e9b0893ad60f30a5cdc506748be52552
## Why
Provisioning errors omitted underlying causes, and removing a legacy installation record could leave an empty registry key behind.
## What changed
- Include error chains in provisioning responses and failure logs, retaining control-character replacement and the response byte limit.
- Attempt to delete the legacy installation registry key after removing and flushing its record, preserving any remaining values or subkeys.
## Testing
Add a regression test for nested error causes, control-character replacement, and UTF-8 truncation within the response byte limit.
GitOrigin-RevId: 8fccfb49c708be5f5d5be7180289cb74a66498a2
## Why
An ACL refresh cannot rotate expired sandbox account passwords or update stored credentials. Accounts marked with `UF_PASSWORD_EXPIRED` need full setup before logon.
## What changed
- Trigger full setup when either sandbox account has an expired password, then reload credentials and report an error if either password remains expired.
- Treat expired passwords as incomplete setup in service provisioning and reject them during registration-only refreshes.
## Testing
Add coverage for expiration on either account, a single repair attempt, credential reload, and unsuccessful repair. Add an ignored Windows test requiring administrator rights to verify that resetting an expired password preserves other account flags.
GitOrigin-RevId: cd6e86f226bea52243d37bd7c7becf7378ba8721
## What changed
Extend the sandbox directory ACL test to verify that the real user retains
`WRITE_DAC` on `.sandbox-bin` so its DACL can be refreshed, while the sandbox
group lacks that permission. Cover both `Full` and `ProvisionOnly` setup modes.
GitOrigin-RevId: cff32956ea308803536a47d8cdfc256184346553
## Why
Packaged uninstall could leave sandbox user profiles and desktop-created data behind. Cleanup also needs to handle a service stop before package removal completes without deleting data belonging to an update or reinstall.
## What changed
- Delete sandbox profiles before their accounts, preserving accounts for retry when profile deletion fails. Defer retained runtime accounts and the sandbox group until runtime registrations are removed and profiles unload.
- Allow cleanup while the exact retiring package is still registered, while preserving desktop data when a successor package is present.
- Remove desktop-created Codex homes during registered runtime cleanup, preserve existing CLI data, and prune empty home and cache directories. Keep directory pins through retries and avoid privileged traversal after releasing the home.
- Retry cleanup up to five attempts after a service stop, while retaining shutdown cancellation behavior.
- Report cleanup outcomes in the Windows Event Log and emit final completion after registered runtime cleanup finishes. Remove the empty installation registry parent.
## Testing
Add Windows tests for profile deletion retry and account preservation, service-stop retries versus system shutdown, and PowerShell finalizer parsing and native binding compilation. Extend retained-token coverage to check account SID matching.
GitOrigin-RevId: 1aefa969e6aff9bb8e77e2c9fe9ee772230fc4fb
## Why
Registering the service-bearing package can restart the provisioning service once for each managed sandbox account. A restart can interrupt the response after runtime readiness has been revoked, preventing the refresh from completing.
## What changed
- Retry registered sandbox refresh requests after response pipe disconnections, allowing up to two service restarts within the original deadline. Require a different service process ID and authenticate it against the running service before resending.
- Allow refresh to resume without `ready_package` when account ownership is complete, teardown is not underway, and the existing owner, package family, live account SIDs, and settings checks pass. Runtime execution still requires readiness for the current package.
- Keep authentication failures, failed writes, explicit replies, and protocol errors outside the retry path.
## Testing
Add regression tests for disconnect classification, the two-restart budget, deadline expiry, and authentication failure before writing. Extend ownership tests to distinguish resumable registration from runtime readiness and reject incomplete accounts or retirement state.
GitOrigin-RevId: d932f179b31752fe918297b7b12e5077c17b19e5
## What changed
- Capture `CODEX_WINDOWS_REGISTERED_CORE=1` at startup and propagate the selected runtime to sandbox wrappers.
- Launch registered runners through service-recorded execution aliases, validating ownership, OS package identity, and the staged runner image before sending commands. Require service provisioning without falling back to copied helpers or `PATH` lookup.
- Preserve package context for sandboxed child processes and descendants so they can launch executables from the protected package directory.
- Refresh stale package registrations during readiness checks without blocking unrelated RPCs, and reconcile effective proxy settings through the service.
- Resolve setup ownership from the process token and avoid treating the server directory as a writable workspace when setup omits `cwd`.
- Record startup and command outcomes by runtime.
## Testing
Add coverage for runtime selection, package query validation, helper resolution, setup roots, proxy reconciliation, and command result reporting. Add an ignored integration test for environment forwarding, output, and exit status that requires an installed test MSIX and service provisioning in a Windows VM.
GitOrigin-RevId: 976d64039d611be4406c3d0e354820775f8eb6e4
## What changed
- Add an explicit `registered_core` provisioning mode that registers the app package for both managed sandbox accounts and records their runner aliases. Authenticate callers against the service's package family and installed version.
- Persist runtime ownership and publish readiness only after both registrations and AppData metadata grants succeed. Prevent legacy setup or another owner from replacing registered sandbox accounts, and restrict `refresh_only` requests to an existing ready setup.
- Scope service and pipe names by package identity.
- Preserve registrations across package updates and clean them up when the owner uninstalls the app. Fence provisioning during teardown and defer package removal until native cleanup succeeds and the service exits.
## Testing
Add tests for registration opt-in, ownership and readiness checks, legacy setup isolation, metadata ACL preservation, listener shutdown handling, and the cleanup finalizer's commit barrier and UTF-8 input.
GitOrigin-RevId: 69e52f7463285b51f3bef831f071245f0eca0838
## What changed
- Share process package-family queries, token user SID extraction, and account-name lookup through `codex_windows_sandbox`, and use them in the provisioning service.
- Bound token query sizes and validate SID pointers, revisions, and lengths before copying SIDs into owned storage.
- Use a drop guard to balance firewall COM initialization, and track the package lifecycle directory guard separately so cleanup releases it while keeping ancestor and home handles pinned.
## Testing
Add tests that verify copied SIDs outlive their query buffers and reject truncated token data, malformed SIDs, and invalid SID pointers.
GitOrigin-RevId: 2b893e4524d3e00cb114df05215beef7b9eebbe9
## What changed
- Extract helper copying, token-user SID queries, provisioning pipe ownership, and service runtime lifecycle into dedicated modules.
- Simplify command-runner resolution and extract setup configuration loading, payload execution, provisioning request exchange, and response handling into helpers.
- Parameterize installation-record registry access and return the saved installation record from authenticated user registration.
## Testing
Add tests for explicit setup `cwd` selection and effective workspace roots, plus valid and invalid token-user SID queries. Move existing helper-copy and freshness tests alongside the extracted copy implementation.
GitOrigin-RevId: ffb39adae7611baa95e85c89f9a31ef7a779e217
## Why
Desktop uninstall cleanup needs an installation owner even when the user has not signed in or configured the Windows sandbox. Recording ownership only during provisioning leaves those installations unregistered.
## What changed
- Add an authenticated installation registration request and attempt it during Windows desktop stdio initialization, with a five-second timeout before the initialization response.
- Persist ownership independently of provisioning, preserve existing desktop ownership, and prevent another user or home from replacing the registered owner.
- Validate write authority and retain directory handles and guards to protect the registered home against junction conversion through privileged cleanup.
- Preserve existing CLI homes during desktop uninstall while removing their `CodexSandboxUsers` ACL entries. Report ACL revocation errors and avoid propagating unchanged ACLs.
- Grant the owner `WRITE_DAC` on `.sandbox-bin` and allow elevated-helper fallback when older permissions need repair or the service cannot establish an uninstall watcher.
## Testing
Add tests for installation registration without sandbox settings and for preserving a child's null DACL when revoking an absent SID from its parent.
GitOrigin-RevId: fb48923e9d76758d1bf5b50c7305aa60f91629db
## Why
Logon SID lookup previously walked token group entries and SID pointers without checking that they fit within the returned buffer.
## What changed
Add a shared `token_groups` helper with a caller-supplied size limit. Validate the group layout, SID bounds, revision, and length before copying SIDs into owned `TokenGroup` values, preserving group order, duplicates, and attributes. Use this helper for logon SID lookup.
## Testing
Add Windows tests for owned SID storage, preserved order and attributes, truncated layouts, malformed and out-of-buffer SIDs, query size limits, and current-token logon SID lookup.
GitOrigin-RevId: f51ff6aa5266b6c73fe07968015e462c888a95e4
## What changed
Expose `prepare_packaged_windows_sandbox_cleanup` to disable sandbox accounts and stop their processes before returning a `PreparedWindowsSandboxCleanup` guard that retains the setup lock. Its `finish` method removes resources and protections; dropping it only releases the lock, leaving accounts disabled and protections intact.
Keep `clean_up_packaged_windows_sandbox` as a wrapper around both phases, and extract the service's existing package cleanup logic into a dedicated module.
GitOrigin-RevId: a32663171bce027f771f738d71b0c46404edbedc
## What changed
- Move the setup helper implementation and its existing tests into `codex-windows-sandbox`, with the binary delegating to `setup_helper_main`.
- Expose installation record types and storage operations from the library, preserving the registry key, size limit, and serialization format. Reuse them in the service and remove its direct `serde` dependencies.
- Extract service provisioning from IPC handling into a dedicated module, preserving authentication and machine-policy checks before provisioning and retaining directory handles through helper execution.
GitOrigin-RevId: dd1ea015aff901d5dfe39b395de1971ee0f2d33f
## Why
Private desktops owned by short-lived sandbox wrappers disappear when those wrappers exit, preventing reuse across filesystem helper requests.
## What changed
- Select and cache private desktops in the calling process, keeping desktops separate for different sandbox permissions.
- Pass the desktop name through the wrapper to the restricted-token and elevated backends so helpers reuse the selected desktop.
- Separate sandbox account preparation from filesystem ACL refresh so desktop selection does not perform the wrapper's refresh.
- Propagate desktop preparation errors and require a desktop name when the wrapper's private desktop flag is set.
## Testing
Add a Windows filesystem regression test covering desktop survival and reuse across reads, writes, metadata queries, and streaming reads, plus separate read-only permissions and rejected writes. Extend wrapper argument tests to cover named desktops and rejection of a missing desktop name.
GitOrigin-RevId: 05a1cb829a902732248bfa7f4ad7470d911fa9f6
## Why
The offline sandbox's non-loopback firewall block covered only outbound traffic. Add a matching inbound block for the offline sandbox user.
## What changed
- Configure an inbound firewall rule scoped to the offline user's SID, blocking all protocols and ports for non-loopback remote addresses.
- Make firewall rule direction explicit while preserving the existing outbound rules.
- Remove the new inbound rule during uninstall.
## Testing
Extend the elevated Windows sandbox integration test to inspect effective inbound and outbound rules, asserting their uniqueness, direction, block action, enabled state, profiles, address and port filters, protocol, and user scope.
GitOrigin-RevId: cbc1ca0d8d08a31fc53da5ad5be6ee5d51afa63d
## Why
The elevated Windows sandbox requires effective `:root` read access and cannot safely enforce policies that deny reads at the filesystem root.
## What changed
- Validate root read access before elevated setup, service provisioning, and setup refresh, rejecting root-denying globs before expansion.
- Reject filesystem-root deny-read ACL targets after canonicalization and check the opened handle before applying an ACL, so aliases cannot bypass the root guard.
- Read and update deny ACLs through the same handle, and allow an existing deny ACE to be recognized when write access to the ACL is unavailable.
## Testing
Add regression coverage for default root denial, root-denying globs, allowed root reads with narrower deny rules, handle-based root detection, and reading existing deny ACEs without `WRITE_DAC`.
GitOrigin-RevId: b904e7cdbc09ee0147e1818c898b0382b5820c1b
## What changed
Probe the default Windows system config namespace at session start and record `codex.windows_system_config.namespace_squatting_probe` once per process when metrics are available.
When `config.toml` or `requirements.toml` exists, check the containing directories for expected ownership and broad standard-user mutation allow ACEs, including permissions inherited by child files. Report coarse results for missing files, expected directories, unexpected types or owners, mutation permissions, and check errors.
The probe is observational: it does not change configuration loading or enforce a trust decision.
GitOrigin-RevId: e1c79dca5548e16e83c7b84b44ab0de4e2643d0d
alishobeiri-oai