feat: enforce Windows sandbox and signed runtimes
3 months ago
60 files changed
- .github/workflows/ci.yml+37−5
- .github/workflows/desktop-release.yml+51−20
- apps/desktop/README.md+1−1
- apps/desktop/electron-builder.yml+3−1
- apps/desktop/electron/services/diagnostics.ts+9−0
- apps/desktop/electron/services/serverManager.ts+232−6
- apps/desktop/electron/services/windowsSandboxReadiness.ts+70−0
- apps/desktop/package.json+1−1
- apps/desktop/scripts/afterPack.cjs+57−0
- apps/desktop/test/after-pack.test.ts+53−0
- apps/desktop/test/server-manager.test.ts+134−3
- crates/cowork-win-sandbox/Cargo.lock+6434−35
- crates/cowork-win-sandbox/Cargo.toml+31−15
- crates/cowork-win-sandbox/UPSTREAM.md+18−0
- crates/cowork-win-sandbox/build.rs+40−0
- crates/cowork-win-sandbox/codex-windows-sandbox-setup.manifest+10−0
- crates/cowork-win-sandbox/src/bin/codex-command-runner/main.rs+12−0
- crates/cowork-win-sandbox/src/bin/codex-command-runner/win.rs+653−0
- crates/cowork-win-sandbox/src/bin/codex-command-runner/win/cwd_junction.rs+140−0
- crates/cowork-win-sandbox/src/bin/codex-windows-sandbox-setup/main.rs+12−0
- crates/cowork-win-sandbox/src/bin/codex-windows-sandbox-setup/win.rs+1192−0
- crates/cowork-win-sandbox/src/bin/codex-windows-sandbox-setup/win/firewall.rs+605−0
- crates/cowork-win-sandbox/src/bin/codex-windows-sandbox-setup/win/read_acl_mutex.rs+61−0
- crates/cowork-win-sandbox/src/bin/codex-windows-sandbox-setup/win/sandbox_users.rs+585−0
- crates/cowork-win-sandbox/src/bin/codex-windows-sandbox-setup/win/setup_runtime_bin.rs+97−0
- crates/cowork-win-sandbox/src/main.rs+463−253
- crates/cowork-win-sandbox/vendor/codex-utils-pty/Cargo.toml+23−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/README.cowork.md+11−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/lib.rs+39−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/pipe.rs+308−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/process.rs+456−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/process_group.rs+189−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/pty.rs+507−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/win/conpty.rs+192−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/win/mod.rs+175−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/win/procthreadattr.rs+91−0
- crates/cowork-win-sandbox/vendor/codex-utils-pty/src/win/psuedocon.rs+377−0
- docs/sandbox.md+34−30
- scripts/build_desktop_resources.ts+99−19
- src/coworkRuntime/ensureReady.ts+80−15
- src/coworkRuntime/index.ts+1−0
- src/coworkRuntime/install.ts+8−0
- src/coworkRuntime/integrity.ts+452−0
- src/coworkRuntime/manifest.ts+17−1
- src/coworkRuntime/runtime.ts+72−4
- src/coworkRuntime/trustedKeys.ts+12−0
- src/coworkRuntime/types.ts+33−1
- src/platform/sandbox/detect.ts+191−1
- src/platform/sandbox/index.ts+60−23
- src/platform/sandbox/windows.ts+17−18
- src/platform/shell.ts+21−2
- src/tools/bash.ts+49−26
- test/build-desktop-resources.test.ts+59−10
- test/ci.workflow.test.ts+12−4
- test/coworkRuntime.e2e.integration.test.ts+62−0
- test/coworkRuntime.test.ts+146−2
- test/desktop-release.workflow.test.ts+21−5
- test/platform/sandbox.enforcement.integration.test.ts+224−21
- test/platform/sandbox.test.ts+59−7
- test/tools/tools.bash.test.ts+82−15
