Linux sandbox: TypeScript 7 async API hangs under Bun in updateSnapshot

What version of Codex CLI is running?

codex-cli 0.149.1

What platform is your computer?

Ubuntu 24.04, linux-x86_64

What issue are you seeing?

TypeScript 7.0.2's async project API hangs indefinitely when it is hosted by Bun inside Codex's Linux workspace sandbox. The same one-file parse completes immediately outside the sandbox, and the identical script completes inside the sandbox when hosted by Node.

The hang occurs in the first API.updateSnapshot() call. There is no error or stderr output. The process waits in epoll_wait until killed externally.

This appears related to #24933: the sandbox denies sendto() even on a connected AF_UNIX socketpair. That can silently lose an event-loop wakeup. On the affected machine, this direct probe fails inside :workspace with PermissionError: [Errno 1] Operation not permitted:

python3 -c 'import socket; a,b=socket.socketpair(); a.send(b"x"); print(b.recv(1))'

Minimal reproduction

mkdir codex-ts7-repro
cd codex-ts7-repro
bun init -y
bun add typescript@7.0.2

Create input.ts:

export function hello(name: string): string {
  return `Hello, ${name}`;
}

Create repro.mjs:

import { API } from "typescript/unstable/async";

const cwd = process.cwd();
const file = `${cwd}/input.ts`;
const api = new API({ cwd });

console.log("before updateSnapshot");
const snapshot = await api.updateSnapshot({ openFiles: [file] });
console.log("after updateSnapshot", snapshot.getProjects().length);

await api.close();

Run the isolated case:

timeout 10s codex sandbox -P :workspace -C "$PWD" -- bun repro.mjs

Observed:

before updateSnapshot
# hangs until timeout; exit 124

Run the unrestricted control:

timeout 10s codex sandbox -P :danger-full-access -C "$PWD" -- bun repro.mjs

Observed:

before updateSnapshot
after updateSnapshot 1
# exit 0, about 0.2 seconds

Run the Node control inside the workspace sandbox:

timeout 10s codex sandbox -P :workspace -C "$PWD" -- node repro.mjs

Observed:

before updateSnapshot
after updateSnapshot 1
# exit 0, about 0.3 seconds

Expected behavior

The Bun-hosted TypeScript API should complete inside workspace-write, or a denied operation should fail promptly with an actionable error. A permitted local IPC/event-loop wakeup should not be silently converted into an indefinite hang.

Additional information

• codex doctor --all reports 19 ok, 0 warnings, and 0 failures.
• A direct Bun program works in the sandbox.
• Bun synchronously spawning another Bun process works in the sandbox.
• A Bun worker can post a message in the sandbox.
• Reducing the TypeScript input from hundreds of files to one does not change the hang.
• Related sandbox defects: #24933 (sendto denied on local socketpairs) and #8343 (tsx local IPC pipe denied).

Start by reproducing the codex sandbox -P :workspace commands with the Bun and Node controls, then read related issues #24933 and #8343. Trace the Linux workspace sandbox behavior around the denied socketpair sendto() operation and epoll_wait; done means the Bun-hosted TypeScript API completes or reports an actionable error without weakening unrelated sandbox restrictions.