- [new]
codex exec-serverandcodex exec-server forwardaccept--linux-sandbox-pid-namespace(isolate, the default, orinherit). Inherit allows signals to other processes with the same UID; enable it only when provisioning a dedicated environment. - [changed] Bash, fish, and zsh completions include
--linux-sandbox-pid-namespace.
Under the hood
- Added an
exclude_slash_tmpconfiguration option. - Exec-server sandboxing now carries PID-namespace policy so isolate vs inherit can be selected per server.
Upgrade notes
--linux-sandbox-pid-namespacedefaults toisolate(previous behavior). Useinheritonly in a dedicated environment; sandboxed processes can then signal other same-UID processes on the host.