codex

mirror of https://github.com/openai/codex.git synced 2026-10-19 16:17:49 +00:00

Files

T

johnl-oai 7e8878f605 Preserve PowerShell relative paths in the elevated Windows sandbox (#49690 )

## Why

An inaccessible user profile directory can prevent sandboxed PowerShell from preserving its working directory and resolving relative paths in a project beneath that profile.

## What changed

Pass `USERPROFILE` to elevated setup and refresh. When the command's working directory is beneath an absolute profile path, grant the sandbox group non-inheriting `FILE_READ_ATTRIBUTES` access to the profile directory.

Preserve existing permissions and deny ACEs during non-inheriting ACL updates without propagating changes to descendants. Expand generic deny masks when checking for conflicting permissions.

## Testing

Add a Windows regression test that checks PowerShell's working directory and reading `.\public.txt` beneath a protected profile. Add an ACL test that verifies a non-inheriting grant leaves an unprotected child's security descriptor unchanged.

GitOrigin-RevId: 7f142a7ffdee795c3255d4a6e79568fa9391c055

2026-09-30 17:50:58 +00:00