Consider using 'bwrap' dynamically instead of a fixed "/usr/bin/bwrap" path

What version of Codex CLI is running?

codex-cli 0.116.0

What subscription do you have?

Pro

Which model were you using?

gpt-5.4

What platform is your computer?

Linux (Ubuntu 22.04, x86_64)

What terminal emulator and version are you using (if applicable)?

bash

What issue are you seeing?

In codex-rs/linux-sandbox/src/launcher.rs , SYSTEM_BWRAP_PATH is hardcoded to /usr/bin/bwrap. As a result, even when a newer bwrap is installed at /usr/local/bin/bwrap, it is not used.

This leads to errors such as:

bwrap: Unknown option --argv0

when running sandboxed tools like apply_patch or exec_command.

It may be helpful to resolve the bwrap path dynamically instead of relying on a fixed path. For example:

const PRIMARY_SYSTEM_BWRAP_PATH: &str = "/usr/local/bin/bwrap";
const FALLBACK_SYSTEM_BWRAP_PATH: &str = "/usr/bin/bwrap";

fn system_bwrap_path() -> &'static Path {
    if Path::new(PRIMARY_SYSTEM_BWRAP_PATH).is_file() {
        Path::new(PRIMARY_SYSTEM_BWRAP_PATH)
    } else {
        Path::new(FALLBACK_SYSTEM_BWRAP_PATH)
    }
}

What steps can reproduce the bug?

bwrap: Unknown option --argv0 error occurs even with latest bwrap in /usr/local/bin path.

What is the expected behavior?

_No response_

Additional information

_No response_