Add hidden Windows sandbox wrapper entrypoint

codex-rs/arg0/Cargo.toml

@@ -26,5 +26,8 @@ dotenvy = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread"] }
 
+[target.'cfg(windows)'.dependencies]
+codex-windows-sandbox = { workspace = true }
+
 [dev-dependencies]
 pretty_assertions = { workspace = true }

codex-rs/arg0/src/lib.rs

@@ -9,6 +9,8 @@ use codex_exec_server::CODEX_FS_HELPER_ARG1;
 use codex_install_context::InstallContext;
 use codex_sandboxing::landlock::CODEX_LINUX_SANDBOX_ARG0;
 use codex_utils_home_dir::find_codex_home;
+#[cfg(target_os = "windows")]
+use codex_windows_sandbox::CODEX_WINDOWS_SANDBOX_ARG1;
 #[cfg(unix)]
 use std::os::unix::fs::symlink;
 use tempfile::TempDir;
@@ -99,6 +101,10 @@ pub fn arg0_dispatch() -> Option<Arg0PathEntryGuard> {
     if argv1 == CODEX_FS_HELPER_ARG1 {
         codex_exec_server::run_fs_helper_main();
     }
+    #[cfg(target_os = "windows")]
+    if argv1 == CODEX_WINDOWS_SANDBOX_ARG1 {
+        codex_windows_sandbox::run_windows_sandbox_wrapper_main();
+    }
     if argv1 == CODEX_CORE_APPLY_PATCH_ARG1 {
         let patch_arg = args.next().and_then(|s| s.to_str().map(str::to_owned));
         let exit_code = match patch_arg {

codex-rs/cli/src/debug_sandbox.rs

@@ -382,6 +382,7 @@ async fn run_command_under_windows_session(
         cwd: cwd.as_path(),
         env_map: env,
         windows_sandbox_level: WindowsSandboxLevel::from_config(config),
+        proxy_enforced: false,
         timeout_ms: None,
         read_roots_override: None,
         read_roots_include_platform_defaults: false,

codex-rs/core/src/unified_exec/process_manager.rs

@@ -935,6 +935,7 @@ impl UnifiedExecProcessManager {
                         request.command.clone(),
                         request.cwd.as_path(),
                         request.env.clone(),
+                        request.network.is_some(),
                         None,
                         elevated_read_roots_override.as_deref(),
                         elevated_read_roots_include_platform_defaults,

codex-rs/windows-sandbox-rs/src/lib.rs

@@ -109,6 +109,8 @@ mod stdio_bridge;
 
 #[cfg(target_os = "windows")]
 mod unified_exec;
+#[cfg(target_os = "windows")]
+mod wrapper;
 
 #[cfg(target_os = "windows")]
 pub(crate) use elevated::ipc_framed;
@@ -318,6 +320,12 @@ pub use winutil::string_from_sid_bytes;
 pub use winutil::to_wide;
 #[cfg(target_os = "windows")]
 pub use workspace_acl::is_command_cwd_root;
+#[cfg(target_os = "windows")]
+pub use wrapper::CODEX_WINDOWS_SANDBOX_ARG1;
+#[cfg(target_os = "windows")]
+pub use wrapper::create_windows_sandbox_command_args_for_permission_profile;
+#[cfg(target_os = "windows")]
+pub use wrapper::run_windows_sandbox_wrapper_main;
 
 #[cfg(not(target_os = "windows"))]
 pub use stub::CaptureResult;

codex-rs/windows-sandbox-rs/src/spawn_prep.rs

@@ -356,6 +356,7 @@ pub(crate) fn prepare_elevated_spawn_context_for_permissions(
     write_roots_override: Option<&[PathBuf]>,
     deny_read_paths_override: &[PathBuf],
     deny_write_paths_override: &[PathBuf],
+    proxy_enforced: bool,
 ) -> Result<ElevatedSpawnContext> {
     normalize_null_device_env(env_map);
     ensure_non_interactive_pager(env_map);
@@ -410,7 +411,7 @@ pub(crate) fn prepare_elevated_spawn_context_for_permissions(
         } else {
             deny_write_paths_override
         },
-        /*proxy_enforced*/ false,
+        proxy_enforced,
     )?;
     let caps = load_or_create_cap_sids(codex_home)?;
     let (psid_to_use, cap_sids) = if uses_write_capabilities {

codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs

@@ -31,6 +31,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil
     command: Vec<String>,
     cwd: &Path,
     mut env_map: HashMap<String, String>,
+    proxy_enforced: bool,
     timeout_ms: Option<u64>,
     read_roots_override: Option<&[PathBuf]>,
     read_roots_include_platform_defaults: bool,
@@ -65,6 +66,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil
         write_roots_override,
         &deny_read_paths_override,
         &deny_write_paths_override,
+        proxy_enforced,
     )?;
 
     let spawn_request = SpawnRequest {

codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs

@@ -30,6 +30,7 @@ pub struct WindowsSandboxSessionRequest<'a> {
     pub cwd: &'a Path,
     pub env_map: HashMap<String, String>,
     pub windows_sandbox_level: WindowsSandboxLevel,
+    pub proxy_enforced: bool,
     pub timeout_ms: Option<u64>,
     pub read_roots_override: Option<&'a [PathBuf]>,
     pub read_roots_include_platform_defaults: bool,
@@ -44,44 +45,44 @@ pub struct WindowsSandboxSessionRequest<'a> {
 pub async fn spawn_windows_sandbox_session_for_level(
     request: WindowsSandboxSessionRequest<'_>,
 ) -> Result<SpawnedProcess> {
-    match request.windows_sandbox_level {
-        WindowsSandboxLevel::Elevated => {
-            spawn_windows_sandbox_session_elevated_for_permission_profile(
-                request.permission_profile,
-                request.workspace_roots,
-                request.codex_home,
-                request.command,
-                request.cwd,
-                request.env_map,
-                request.timeout_ms,
-                request.read_roots_override,
-                request.read_roots_include_platform_defaults,
-                request.write_roots_override,
-                request.deny_read_paths_override,
-                request.deny_write_paths_override,
-                request.tty,
-                request.stdin_open,
-                request.use_private_desktop,
-            )
-            .await
-        }
-        WindowsSandboxLevel::RestrictedToken | WindowsSandboxLevel::Disabled => {
-            spawn_windows_sandbox_session_legacy(
-                request.permission_profile,
-                request.workspace_roots,
-                request.codex_home,
-                request.command,
-                request.cwd,
-                request.env_map,
-                request.timeout_ms,
-                request.deny_read_paths_override,
-                request.deny_write_paths_override,
-                request.tty,
-                request.stdin_open,
-                request.use_private_desktop,
-            )
-            .await
-        }
+    if request.proxy_enforced
+        || matches!(request.windows_sandbox_level, WindowsSandboxLevel::Elevated)
+    {
+        spawn_windows_sandbox_session_elevated_for_permission_profile(
+            request.permission_profile,
+            request.workspace_roots,
+            request.codex_home,
+            request.command,
+            request.cwd,
+            request.env_map,
+            request.proxy_enforced,
+            request.timeout_ms,
+            request.read_roots_override,
+            request.read_roots_include_platform_defaults,
+            request.write_roots_override,
+            request.deny_read_paths_override,
+            request.deny_write_paths_override,
+            request.tty,
+            request.stdin_open,
+            request.use_private_desktop,
+        )
+        .await
+    } else {
+        spawn_windows_sandbox_session_legacy(
+            request.permission_profile,
+            request.workspace_roots,
+            request.codex_home,
+            request.command,
+            request.cwd,
+            request.env_map,
+            request.timeout_ms,
+            request.deny_read_paths_override,
+            request.deny_write_paths_override,
+            request.tty,
+            request.stdin_open,
+            request.use_private_desktop,
+        )
+        .await
     }
 }
 
@@ -125,6 +126,7 @@ pub async fn spawn_windows_sandbox_session_elevated_for_permission_profile(
     command: Vec<String>,
     cwd: &Path,
     env_map: HashMap<String, String>,
+    proxy_enforced: bool,
     timeout_ms: Option<u64>,
     read_roots_override: Option<&[PathBuf]>,
     read_roots_include_platform_defaults: bool,
@@ -142,6 +144,7 @@ pub async fn spawn_windows_sandbox_session_elevated_for_permission_profile(
         command,
         cwd,
         env_map,
+        proxy_enforced,
         timeout_ms,
         read_roots_override,
         read_roots_include_platform_defaults,