| Phase | 3 — Execution & sandboxing |
| Status | Not started |
| Depends on | 02, 09 |
| Size | M |
| Drop-in critical | partial (fs op protocol) |
Port codex-exec-server and codex-file-system: the process-execution service and
the sandbox-aware filesystem operations (read/write/create/remove/copy/metadata/
watch) that back both the agent and the app-server fs/* methods.
reference-codex/codex-rs/exec-server/src/(process exec, fs helper, env mgmt, axum/ws surface).reference-codex/codex-rs/file-system/src/(FileSystemtrait, ops).- Note: exec-server also runs as an arg0/argv1 helper (
FS_HELPER).
- Process execution service: spawn commands (PTY or pipe), stream stdout/stderr, enforce token/time budgets, propagate cancellation, collect aggregated output with truncation (spec 01 rules).
- Filesystem abstraction with the same operations and error mapping used by
fs/readFile,fs/writeFile,fs/createDirectory,fs/getMetadata,fs/readDirectory,fs/remove,fs/copy,fs/watch/fs/unwatch(watch via spec 20). - Environment management: per-
environment_idcwd/shell/env resolution; sticky session environments;ShellEnvironmentPolicyfiltering of inherited env. - Optional standalone exec-server mode (
--listen ws://…/--remote) for distributed execution.
fs/*operations produce responses matching the app-server schema (validated in spec 33) — metadata fields, error codes.- Environment policy filtering yields the same effective env as Codex for a set of policy configs.
- Aggregated output + truncation matches Codex for long-running command fixtures.
- The exec-server has both in-process and networked modes; keep the core logic transport-agnostic.
- Concurrent fs operations must be safe and ordered consistently.
- The sandbox confinement itself (12–14); the tool schema (16).