Repository navigation
feat(codex): add read-only local storage mounts - #5575
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c32cabdcd
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Requesting changes for the existing cross-grant hard-link finding, independently confirmed against this commit. Mount validation checks directory overlap, but mounted file identities can still be writable through another granted root. Please reject those aliases before admitting the mount, with regression coverage preserving caller-owned data. Existing discussion: #5575 (comment)
Reviewed declaration capture, native preflight and permission construction, private-state exclusions, writable-root replacement, restore policy receipts, cancellation, and caller-owned storage preservation. No additional actionable findings.
Native-only package qualification passed on Linux, macOS, and Windows; regular native snapshots and Rust CodeQL remain in progress. Static review only; I did not run candidate code or tests.
7c32cab to
87f639a
Compare
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
The hard-link blocker is fixed: preflight inspects mounted trees, compares multiply-linked file identities against canonical cwd/additional writable grants, and fails closed on required inspection errors. It also rejects FIFO/socket/device entries without opening them or following symlinks. Public-session regressions cover rejection before helper/model effects and caller-data preservation. The rebased prior feature patch is equivalent apart from its API baseline SHA.
Coordinator and independent static re-review found no additional actionable issue. No candidate code or tests executed locally. Hosted platform CI remains pending; keep the stated merge/release hold until validation completes.
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 87f639a32c
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@dpiet-oai The hard-link finding is fixed in Please confirm the fix and update your earlier change-request review when you have a chance. |
Summary
Agent tools need read access to directories that the caller manages outside their workspace. Add
LocalStorageMountand themountsoption onEnvironment.localfor explicit, read-onlylocal_bindmounts on Linux.Mounts use the existing permission profile and sandbox process lifecycle. Initial support requires canonical directory paths with identical source and destination. Validation rejects writable mounts, remapping, overlaps with writable or private paths, and unsupported executors. Preflight also rejects existing hard links shared with writable grants. Mounted trees may contain regular files, directories, and symlink entries; validation rejects special files such as named pipes and sockets. It fails if it cannot finish the required directory inspection. Restore checks the complete permission profile, and sessions reject writable-root replacement while mounts are active. The caller retains ownership of the storage. Applications must keep source paths and file topology stable for the session.
Add a guide and example, update the generated native API snapshot, and extend installed-wheel Linux qualification. Tests cover enforcement, restore with reordered mount declarations, cancellation, and preservation of caller storage.
Test plan
Issue number
None linked.
Checks
AGENTS.md, including.agents/skills/code-change-verification/scripts/run.shAGENTS.md