feat: Declare Named Worker Project Environments - #209
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc0be48a6c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current PR head c6b542e. Please confirm the full reviewed commit. Findings addressed: reject hard links and unsafe owners/permissions/ACLs and in-workspace symlink control paths; skip setup during maintenance reset; clear actions when command support is negotiated out. Focused regressions and real native-sandbox CLI tests pass. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c6b542ebad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review current exact head bc17658. Completed a cross-boundary audit: trusted file traversal now reuses the existing component-wise verifier and preserves all intermediate symlinks, opens nonblocking/no-follow, reads bounded complete snapshots, validates UTF-8 command bytes, and matches executor environment metadata. All five latest findings have focused regression coverage. Please confirm this exact head. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc176581c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review current exact head dc57e12. Root-path traversal now uses the same component-wise trust inventory as definition paths and rejects cross-workspace-controlled components. UTF-8 decoding is fatal and explicitly disabled default-workspace is accepted. Focused regressions and all three real native startup/reset checks pass. Please confirm this exact head. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc57e12f10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review current exact head 19c8968. Root traversal now rejects writable descendants in every registered workspace, including the owning workspace; only its canonical root directory itself is exempted. The self-alias regression, prior trust-boundary tests, and real native startup/reset checks pass. Please confirm this exact head. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review current exact head 700e875. The previously missed bind-mount alias finding is now addressed by bounded cached filesystem-identity comparisons between registered roots and definition/root traversal entries, in addition to path checks. Focused identity-alias and native startup regressions pass. Please verify this exact head. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 700e875a35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review exact head efe1aa1. Completed the mount-alias architecture pass: Linux startup maps paths into filesystem coordinates using the process mount namespace and includes mounted descendants of grants. Both bind directions and mounted files are covered; ambiguous stacked mappings fail closed. Table size, exposed mount boundaries, parsing and coordinate caching are bounded; no command hot-path overhead. Focused mount topology tests and real Mac native startup checks pass. Please confirm this exact head. |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review exact head 5bea52e. Linux CI exposed unrelated stacked mounts; the checker now conservatively includes potential backing mappings rather than rejecting the entire namespace. Mount table/coordinate/exposure bounds and caching remain. Platform-specific rejection tests now accept the earlier mount-isolation rejection. Please verify this exact head. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Operators can start a paired worker with repeatable
--environmentYAML files that declare named workspace roots, optional repository/ref metadata, bounded startup setup, and fixed named actions.Setup runs through the native sandbox before registration and uses the durable mutation guard. A failed setup prevents readiness; uncertain interruption retains quarantine. Definitions remain outside all coding roots and are hashed into worker policy identity. Public registration includes metadata and action names, without host paths or command source.
Named actions travel through ordinary command admission with a definition fingerprint. The worker rejects unknown names, stale definitions and changed working directories, then resolves the command locally. Existing principal binding, command permissions, cancellation and quarantine still apply.
Companion: danny-avila/LibreChat#15943. Deploy the LibreChat consumer and updated Code API to all replicas before enabling
--environment; existing workers retain their wire format. Repository/ref values describe an existing directory and do not implicitly clone or checkout a repository. Setup must be idempotent across worker restarts.Definition loading rejects hard links, unsafe ownership/permissions, invalid UTF-8 and special files. Component-wise traversal prevents workspace-controlled aliases from redirecting either definitions or roots on restart. Reads are bounded and complete; setup/actions obey the protocol byte and time limits. Maintenance resets do not run setup.
Validation