vrr/claude-code-router
2
0
Fork 0
mirror of https://github.com/musistudio/claude-code-router.git synced 2026-07-09 17:18:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(codex-middleware): stop forcing sandbox_mode=workspace-write to avoid repeated COM+ setup failures

Browse source 
When Codex runs through the ccr middleware, every command execution
fails with three repeated Windows error dialogs:

  codex-windows-sandbox-setup.exe
  COM+ 注册表数据库检测到一个系统错误
  (COM+ registry database system error)

Root cause: the middleware's config/read handler hard-coded
`sandbox_mode: "workspace-write"` in the virtual config returned to
Codex (codex-cli-middleware-runtime.ts configRead). Unlike the
`elevated` mode Codex reads from its own config.toml when run directly
(or via tools that only swap config like cc-switch), `workspace-write`
triggers `codex-windows-sandbox-setup.exe` setup refresh on every
command. On systems where the COM+ catalog is unavailable (COMSysApp
stopped or the catalog itself misbehaves — see openai/codex#29332),
that refresh fails and surfaces as the repeated error dialogs.

Empirically verified across the three legal sandbox_mode values:

  - read-only          : does not trigger setup, but cannot write files
  - workspace-write    : triggers setup refresh every command -> fails
                         on affected systems (this bug)
  - danger-full-access : does not trigger setup, can write files, but
                         has no isolation

Forcing workspace-write therefore both overrides the user's own
config.toml preference AND guarantees the failure on affected systems.

Fix: omit sandbox_mode from the virtual config entirely, letting Codex
read it from its own config.toml ([windows] sandbox / sandbox_mode) —
matching the behavior of config-only tools like cc-switch. The user
keeps full control: those who want isolation set workspace-write (and
must ensure their COM+ works); those on affected systems set
danger-full-access.

This is a one-line removal plus an explanatory comment; configValues
was already empty ({}), so Codex now falls back to its config file
exactly as it does without any middleware.

Refs: openai/codex#29332
This commit is contained in:
jesieleo 2026-07-04 18:52:04 +08:00
parent ee44357a34
commit daf745ac3f
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/main/codex-cli-middleware-runtime.ts
View file

@ -2355,8 +2355,12 @@ function configRead(params, values) {
model: agentEnv(runtimeAgent, "MODEL") || DEFAULT_MODEL,
model_catalog_json: JSON.stringify(modelCatalogConfigValue()),
model_provider: agentEnv(runtimeAgent, "MODEL_PROVIDER") || "claude-code",
approval_policy: "default",
sandbox_mode: "workspace-write"
approval_policy: "default"
// sandbox_mode intentionally omitted: let Codex read it from its own
// config.toml (e.g. [windows] sandbox) instead of forcing workspace-write.
// Forcing workspace-write triggers codex-windows-sandbox-setup.exe on every
// command, which fails on systems where the COM+ catalog is unavailable
// (see openai/codex#29332), surfacing as repeated error dialogs.
}
};
}