Repository navigation
Avoid fork when spawning macOS filesystem helpers - #46661
Merged
copyberry[bot] merged 1 commit intoSep 19, 2026
Merged
copyberry[bot] merged 1 commit into
copyberry[bot] merged 1 commit into
Conversation
## Why Filesystem helpers use a `pre_exec` callback to close inherited descriptors on macOS, forcing a fork before execution. Native spawning needs to preserve that isolation and support the socket used for file descriptor transfer. ## What changed - Launch filesystem helpers through `codex_utils_pty::Command`, using `posix_spawn` with `POSIX_SPAWN_CLOEXEC_DEFAULT` on macOS and returning native launch errors without a fork fallback. - Extend the shared command wrapper with explicit descriptor and fallback policies, socket-backed stdin, and custom `argv[0]` support. - Add `Child::wait_with_output` to drain stdout and stderr concurrently, retain kill-on-drop behavior on cancellation, and keep output pipes open until the child exits. ## Testing Add regression tests for fork-free sandboxed reads, writes, and file descriptor transfers; sandbox denial of outside paths and symlink escapes; descriptor isolation; bidirectional socket stdin; custom `argv[0]`; executable-format errors; and output-pipe lifetimes. GitOrigin-RevId: d49c00787f30ec0bc196f9e066a0770fc8151152
copyberry
Bot
force-pushed
the
copyberry/codex-internal-to-codex-oss/d49c00787f30ec0bc196f9e066a0770fc8151152
branch
from
September 19, 2026 15:15
d16a853 to
595cc91
Compare
copyberry
Bot
deleted the
copyberry/codex-internal-to-codex-oss/d49c00787f30ec0bc196f9e066a0770fc8151152
branch
September 19, 2026 15:15
cherokeemountainboy-rgb
deployed
to
issue-triage
September 19, 2026 16:21 — with 
GitHub Actions
Active
GitHub Actions
Active
cherokeemountainboy-rgb
deployed
to
issue-triage
September 19, 2026 16:21 — with
GitHub Actions
Active
GitHub Actions
Active
cherokeemountainboy-rgb
deployed
to
issue-triage
September 19, 2026 16:21 — with
GitHub Actions
Active
GitHub Actions
Active
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Avoid fork when spawning macOS filesystem helpers
Why
Filesystem helpers use a
pre_execcallback to close inherited descriptors on macOS, forcing a fork before execution. Native spawning needs to preserve that isolation and support the socket used for file descriptor transfer.What changed
codex_utils_pty::Command, usingposix_spawnwithPOSIX_SPAWN_CLOEXEC_DEFAULTon macOS and returning native launch errors without a fork fallback.argv[0]support.Child::wait_with_outputto drain stdout and stderr concurrently, retain kill-on-drop behavior on cancellation, and keep output pipes open until the child exits.Testing
Add regression tests for fork-free sandboxed reads, writes, and file descriptor transfers; sandbox denial of outside paths and symlink escapes; descriptor isolation; bidirectional socket stdin; custom
argv[0]; executable-format errors; and output-pipe lifetimes.