Uh oh!
There was an error while loading. Please reload this page.
fix(sandbox): preserve UTF-8 boundaries in Cloudflare SSE - #4707
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:54f9430aaf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Hughhhhcoder
commented
Aug 27, 2026
All prior review feedback has been addressed in the current head ( |
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
Cloudflare sandbox execution decoded each aiohttp byte chunk as UTF-8 before passing it to the SSE line decoder. A multi-byte UTF-8 code point split across network chunks therefore raised
UnicodeDecodeErrorinstead of being decoded after the bytes were reassembled.The network stream boundary was incorrectly treated as a text boundary even though UTF-8 character boundaries are independent of aiohttp byte-chunk boundaries. This change lets
_SSELineDecoderaccept byte chunks and decode only complete SSE lines with its incremental decoder, passes raw aiohttp chunks into the decoder, and adds deterministic regression coverage for split UTF-8 code points.No public API signatures change. SSE framing, CR/LF handling, event dispatch, and error propagation remain unchanged for complete text and byte chunks.
Test plan
pytest -q tests/extensions/sandbox/test_cloudflare.py -k 'utf8_split or sse_line_decoder'— 12 passed, 84 deselected.ruff check src/agents/extensions/sandbox/cloudflare/sandbox.py tests/extensions/sandbox/test_cloudflare.py— passed.ruff format --check src/agents/extensions/sandbox/cloudflare/sandbox.py tests/extensions/sandbox/test_cloudflare.py— passed.pyright src/agents/extensions/sandbox/cloudflare/sandbox.py— 0 errors, 0 warnings./usr/bin/env -u OPENAI_API_KEY OPENAI_AGENTS_TEST_IN_CODEX_SANDBOX=1 UV_DEFAULT_INDEX=https://pypi.org/simple bash .agents/skills/code-change-verification/scripts/run.sh— passed (make format,make lint,make typecheck, andmake tests).Issue number
N/A — independently reproduced bug with no pre-existing issue.
Checks
.agents/skills/code-change-verification/scripts/run.sh