Merge remote-tracking branch 'origin/main' into nornagon/sandbox-refactor

codex-rs/core/src/exec.rs

@@ -19,6 +19,7 @@ use tokio_util::sync::CancellationToken;
 use crate::error::CodexErr;
 use crate::error::Result;
 use crate::error::SandboxErr;
+use crate::get_platform_has_sandbox;
 use crate::protocol::Event;
 use crate::protocol::EventMsg;
 use crate::protocol::ExecCommandOutputDeltaEvent;
@@ -113,12 +114,14 @@ pub struct StdoutStream {
 
 pub async fn process_exec_tool_call(
     params: ExecParams,
-    sandboxed: bool,
     sandbox_policy: &SandboxPolicy,
     sandbox_cwd: &Path,
     codex_linux_sandbox_exe: &Option<PathBuf>,
     stdout_stream: Option<StdoutStream>,
 ) -> Result<ExecToolCallOutput> {
+    let sandboxed =
+        !matches!(sandbox_policy, SandboxPolicy::DangerFullAccess) && get_platform_has_sandbox();
+
     let ExecParams {
         command,
         cwd,
@@ -853,7 +856,6 @@ mod tests {
         });
         let result = process_exec_tool_call(
             params,
-            false,
             &SandboxPolicy::DangerFullAccess,
             cwd.as_path(),
             &None,