Harden sandbox setup resilience#5
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR enhances sandbox setup resilience by introducing a registry hive fallback mechanism with diagnostics and optional cleanup, strengthening logging with rotation and transcript guards, migrating feature management to a DISM-based workflow with retry logic, streamlining preflight checks, verification steps, and WSB generation for unattended runs, and adding a SysWOW64 PowerShell stub for compatibility. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR adds a new PowerShell script for Windows Sandbox setup with advanced features including evasion techniques. The script is designed to enable Windows Sandbox, configure it with administrative capabilities, and implement various anti-analysis checks.
- Adds a production-grade PowerShell script for Windows Sandbox configuration
- Implements evasion techniques to detect virtualized/analysis environments
- Provides idempotent setup with registry markers and robust error handling
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
https://github.com/ib-bsb-br/codex-scratchpad/blob/02c826f159a20b904f2eb548248d0afb5da8b847/"b/C:\Windows\SysWOW64\pwsh.ps1"#L588-L606
When -NoShortcut is supplied the EnsureShortcut switch block returns immediately, but the code below still writes a "Completed" marker in the registry. Later, Invoke-Verification evaluates the step’s SystemTest (-not $NoShortcut -and (Test-Path $ShortcutLnk)) and inevitably fails because the shortcut was intentionally skipped even though the marker is present. The script therefore re‑executes the step and ultimately exits with code 2 whenever -NoShortcut is used. Either skip writing the completion marker when shortcuts are disabled or treat the step as satisfied when the flag is set so that a user opting out of shortcut creation can complete the run.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (all 1 issues)
Understand the root cause of the following 1 issues and fix them.
<file name=""b/C:\\Windows\\SysWOW64\\pwsh.ps1"">
<violation number="1" location=""b/C:\\Windows\\SysWOW64\\pwsh.ps1":804">
The EnsureShortcut step’s system test treats -NoShortcut as failure, so verification always exits 2 when the operator opts out of creating the shortcut. Please make the test succeed when -NoShortcut is supplied.</violation>
</file>
React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.
| @{ | ||
| Name = 'EnsureShortcut' | ||
| Weight = 100 | ||
| SystemTest = { -not $NoShortcut -and (Test-Path $ShortcutLnk) } |
There was a problem hiding this comment.
The EnsureShortcut step’s system test treats -NoShortcut as failure, so verification always exits 2 when the operator opts out of creating the shortcut. Please make the test succeed when -NoShortcut is supplied.
Prompt for AI agents
Address the following comment on "b/C:\\Windows\\SysWOW64\\pwsh.ps1" at line 804:
<comment>The EnsureShortcut step’s system test treats -NoShortcut as failure, so verification always exits 2 when the operator opts out of creating the shortcut. Please make the test succeed when -NoShortcut is supplied.</comment>
<file context>
@@ -0,0 +1,836 @@
+ @{
+ Name = 'EnsureShortcut'
+ Weight = 100
+ SystemTest = { -not $NoShortcut -and (Test-Path $ShortcutLnk) }
+ Undo = {
+ if (Test-Path $ShortcutLnk) {
</file context>
| SystemTest = { -not $NoShortcut -and (Test-Path $ShortcutLnk) } | |
| SystemTest = { $NoShortcut -or (Test-Path $ShortcutLnk) } |
Summary
Testing
https://chatgpt.com/codex/tasks/task_b_690654c59610832da1bea023fe40cec0
Summary by Sourcery
Harden sandbox setup resilience by introducing registry hive fallback, bolstering logging, and streamlining unattended configuration flows
New Features:
Enhancements: