CodeVetter · Repo Unpack · Risk map
openai/codex
The highest-risk surfaces are command execution, the sandbox policy resolver, auth token storage, and the app-server stdio API that can drive all of the above. `codex-core` is an explicit blast-radius hotspot the repo asks contributors not to grow. Large orchestration files (`chatwidget.rs`, `app.rs`, `chat_composer.rs`, `codex.rs`) are fragile coupling points. History compaction and context fragments can invalidate the model prompt cache or exceed token caps. Sandbox escapes are the security property the project exists to protect; tests often skip them under nested sandbox. Legacy v1 app-server methods still exist and must not gain new surface.
- Shell-out is the primary security boundary. Tool handlers spawn user-model-supplied commands. Safety depends on `SandboxPolicy`, execpolicy allow/deny, and the platform sandbox all agreeing. A mismatch between the approval overlay and the spawn path is a command-execution bug.
- `danger-full-access` and approval `never` disable the sandbox and prompts. Config, CLI flags, and execpolicy can each select this. Any new flag that defaults toward this combination widens blast radius for every SDK and CI caller.
- Auth secrets live in `$CODEX_HOME/auth.json` (default `~/.codex/auth.json`) and may also be supplied by `CODEX_API_KEY`. The file contains access and refresh tokens. Log paths and debug traces that dump request headers would leak them.
- The macOS sandbox uses Seatbelt (`sandbox-exec`) profiles built in `sandboxing/src/seatbelt.rs`. Tests that themselves call Seatbelt exit early when `CODEX_SANDBOX=seatbelt`, so nested-agent runs do not exercise the real profile. Profile edits are easy to ship untested.
- Linux isolation depends on `codex-linux-sandbox` (bubblewrap) plus Landlock. If bwrap is missing, the core falls back according to config (`sandbox_mode` and network flags). A silent downgrade is a security bug; the code path is in `core/src/sandboxing/mod.rs`.
- Network access inside the sandbox is denied by default and selectively re-enabled. The env var `CODEX_SANDBOX_NETWORK_DISABLED` is also used by the agent harness to skip networked tests. AGENTS.md forbids modifying code related to `CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR` or `CODEX_SANDBOX_ENV_VAR`.
- App-server stdio is a local trust boundary, not a remote auth boundary. Any process that can spawn `codex app-server` can start turns, exec commands, and read thread history. Experimental methods are gated but still compiled in.
- TUI orchestration files are called out as high-touch and should not grow: `tui/src/app.rs`, `bottom_pane/chat_composer.rs`, `bottom_pane/footer.rs`, `chatwidget.rs`, `bottom_pane/mod.rs`. New behavior belongs in a new module. These files are the most likely merge-conflict and regression sites.
- Context rules are load-bearing for cost and correctness: no history rewrite, no unbounded injected items, hard cap, and a P0 review if a fragment can exceed 1k tokens. Compact and new system fragments are the usual way to violate this.
- File IO outside the repo is normal and expected: `CODEX_HOME` (`~/.codex`), session JSONL, shell cwd, and apply_patch targets. Workspace-write mode still allows writes anywhere inside the writable roots derived from cwd and config `writable_roots`. Path canonicalization bugs become arbitrary-write bugs.
- Change-size guidance caps non-mechanical diffs at about 800 lines and complex logic at 500. Oversized patches to `codex.rs` or `chatwidget.rs` are the usual review failure mode, not a compiler failure.