Skip to content

fix(sandbox): normalize apply_patch paths as POSIX - #4437

Merged
seratch merged 19 commits into
openai:mainfrom
sylvesterkaczmarek:fix/apply-patch-posix-path-normalization
Aug 15, 2026
Merged

seratch merged 19 commits into
openai:mainfrom
sylvesterkaczmarek:fix/apply-patch-posix-path-normalization

Conversation

@sylvesterkaczmarek

@sylvesterkaczmarek sylvesterkaczmarek commented Aug 15, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Keep apply_patch path handling independent of the SDK host operating system and ensure approval policy sees the same canonical paths that execution uses.

Raw model-provided string paths now go directly through the existing WorkspacePathPolicy instead of first being converted with host-native pathlib.Path. This normalizes backslashes consistently to the sandbox's POSIX path semantics while preserving root/escape validation.

Before needs_approval is evaluated, both path and move_to are canonicalized with the same workspace policy. The canonical operation is also passed into execution, preventing path-sensitive approval rules from being bypassed with alternate separators.

Test plan

Regression coverage includes:

  • string path normalization for create/update/delete operations
  • move_to normalization
  • Windows-safe path assertions
  • approval callbacks receiving canonical path
  • approval callbacks receiving canonical move_to

The focused path tests, lint, formatting, typecheck, and full repository verification passed before the approval-path follow-up. The new approval regression coverage is pushed and awaiting the repository CI rerun.

No public API shape changes.

Copy link
Copy Markdown
Contributor Author

@codex review

1 similar comment

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 01a943421f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 01a943421f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@sylvesterkaczmarek
sylvesterkaczmarek marked this pull request as ready for review August 15, 2026 11:52

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ed98e21e3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tests/sandbox/test_apply_patch.py Resolved

Copy link
Copy Markdown
Contributor Author

Fixed the Windows-specific test assertion. Focused test_apply_patch.py, Ruff lint, and Ruff format now pass on both windows-latest and ubuntu-latest; the temporary verification workflow has been removed. @codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 586630fc34

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 586630fc34

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Comment thread src/agents/sandbox/apply_patch.py Resolved

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 591da42fe6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 38bd2b47a7

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@seratch seratch left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the follow-up. The runtime direction now looks good: approval callbacks and execution use the same canonical paths, and the full operation batch is validated before any filesystem mutation.

Before merging, please run the repository formatter and push the resulting change. The current lint job fails during "Verify formatting", and ruff format --check reproduces the failure in src/agents/sandbox/capabilities/tools/apply_patch_tool.py on the _parse_and_normalize_input list comprehension. After that, please let the remaining CI checks complete. I do not have further runtime changes to request from this review.

Copy link
Copy Markdown
Contributor Author

@codex address that feedback

@chatgpt-codex-connector

Copy link
Copy Markdown

Note

To use Codex here, create an environment for this repo.

Copy link
Copy Markdown
Contributor Author

Applied the requested formatter-only change to _parse_and_normalize_input and synchronized the branch with current main. The PR is mergeable again; the new workflow run is awaiting repository authorization.

@seratch seratch added this to the 0.21.x milestone Aug 15, 2026
@seratch
seratch enabled auto-merge (squash) August 15, 2026 23:21
@seratch
seratch merged commit 05c789f into openai:main Aug 15, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants