feat(sandbox): add glob deny-read platform enforcement - #18096

Merged

viyatb-oai merged 12 commits into

mainfrom

codex/viyatb/deny-read-globs-sandbox

Apr 17, 2026

Commits on Apr 16, 2026

feat(sandbox): enforce glob deny-read on macOS and Linux

viyatb-oai
and
codex
committed
8424f88
fix(sandbox): use glob pattern filesystem path variant
viyatb-oai
committed
7be5a33
test(sandbox): cover glob deny-read integration
viyatb-oai
committed
2cb6091
fix(sandbox): stabilize glob deny-read CI

viyatb-oai
and
codex
committed
9c3d25e
docs(sandbox): document rg glob fallback

viyatb-oai
and
codex
committed
61b2477
docs(sandbox): simplify bubblewrap wording

viyatb-oai
and
codex
committed
304f142
docs(sandbox): avoid bubblewrap pipeline wording

viyatb-oai
and
codex
committed
b4db88a
fix(sandbox): preserve glob deny-read output

viyatb-oai
and
codex
committed
b29404d
fix(sandbox): address glob deny-read review comments

viyatb-oai
and
codex
committed
a3f3688
feat(sandbox): configure deny-read glob scan depth

viyatb-oai
and
codex
committed
8a8a447
fix(sandbox): fail closed on mutable symlink carveouts

viyatb-oai
and
codex
committed
8f0ebec

Commits on Apr 17, 2026

Merge branch 'main' into codex/viyatb/deny-read-globs-sandbox
viyatb-oai
authored
96f20cf