Codex 0.155.0 blocked Windows process escapes from restricted WSL sandboxes and hardened shell snapshots against credential exposure

GitHub·medium signalXBlueskyLinkedInCopy link

Three commits in the stable release close sandbox gaps: blocked Windows-process escapes from restricted WSL sandboxes (#44286), protected shell snapshots when credential brokerage is enabled (#43909), and preserved complete shell snapshot exports through filtering and replay (#44040, #43907). Related work adds canonical permission translation for MXC execution requests (#43853), extracts Windows deny-read glob scan planning into the protocol (#43903), and avoids Windows sandbox setup for irrelevant proxy port changes (#43930). WSL has been the soft edge of Codex's Windows sandbox story for several releases and this is the first stable that names the escape as fixed.