agent/codex
2
0
Fork 0
mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make yolo skip managed-network tool enforcement (#18042)

Browse Source 
## Summary

This makes `DangerFullAccess` / yolo tool execution fully opt out of
managed-network enforcement.

Previously, yolo turns could have `turn.network` stripped while tool
orchestration still derived `enforce_managed_network=true` from
`requirements.toml.network`. That created an inconsistent state where
the turn had no managed proxy attached, but tool execution still behaved
like managed networking was active.

This updates the tool orchestration and JS REPL paths to treat managed
networking as active only when the current turn actually has
`turn.network`.

## Behavior

- Yolo / `DangerFullAccess`: no managed proxy, no managed-network
enforcement.
- Guardian / workspace-write with managed proxy: managed-network
enforcement still applies.
- Avoids the half-state where yolo has no proxy but still gets
managed-network sandbox behavior.

## Tests

- `just fmt`
- `cargo test -p codex-core
danger_full_access_tool_attempts_do_not_enforce_managed_network --
--nocapture`
- `cargo test -p codex-core danger_full_access -- --nocapture`
- `just fix -p codex-core`

Co-authored-by: jgershen-oai <jgershen@openai.com>
This commit is contained in:
Won Park
2026-04-16 09:06:10 -07:00
committed by GitHub
Unverified
parent 85203d8872
commit 3a4fa77ad7
4 changed files with 125 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/tools/js_repl/mod.rs
+3 -8
View File
@@ -1033,18 +1033,13 @@ impl JsReplManager {
}
let sandbox = SandboxManager::new();
let has_managed_network_requirements = turn
.config
.config_layer_stack
.requirements_toml()
.network
.is_some();
let managed_network_active = turn.network.is_some();
let sandbox_type = sandbox.select_initial(
&turn.file_system_sandbox_policy,
turn.network_sandbox_policy,
SandboxablePreference::Auto,
turn.windows_sandbox_level,
has_managed_network_requirements,
managed_network_active,
);
let command = SandboxCommand {
program: node_path.into_os_string(),
@@ -1067,7 +1062,7 @@ impl JsReplManager {
file_system_policy: &turn.file_system_sandbox_policy,
network_policy: turn.network_sandbox_policy,
sandbox: sandbox_type,
enforce_managed_network: has_managed_network_requirements,
enforce_managed_network: managed_network_active,
network: None,
sandbox_policy_cwd: &turn.cwd,
codex_linux_sandbox_exe: turn.codex_linux_sandbox_exe.as_deref(),
codex-rs/core/src/tools/network_approval.rs
+2 -2
View File
@@ -578,11 +578,11 @@ pub(crate) fn build_network_policy_decider(
pub(crate) async fn begin_network_approval(
session: &Session,
turn_id: &str,
has_managed_network_requirements: bool,
managed_network_active: bool,
spec: Option<NetworkApprovalSpec>,
) -> Option<ActiveNetworkApproval> {
let spec = spec?;
if !has_managed_network_requirements || spec.network.is_none() {
if !managed_network_active || spec.network.is_none() {
return None;
}
codex-rs/core/src/tools/orchestrator.rs
+9 -14
View File
@@ -55,7 +55,7 @@ impl ToolOrchestrator {
req: &Rq,
tool_ctx: &ToolCtx,
attempt: &SandboxAttempt<'_>,
has_managed_network_requirements: bool,
managed_network_active: bool,
) -> (Result<Out, ToolError>, Option<DeferredNetworkApproval>)
where
T: ToolRuntime<Rq, Out>,
@@ -63,7 +63,7 @@ impl ToolOrchestrator {
let network_approval = begin_network_approval(
&tool_ctx.session,
&tool_ctx.turn.sub_id,
has_managed_network_requirements,
managed_network_active,
tool.network_approval_spec(req, tool_ctx),
)
.await;
@@ -180,12 +180,7 @@ impl ToolOrchestrator {
}
// 2) First attempt under the selected sandbox.
let has_managed_network_requirements = turn_ctx
.config
.config_layer_stack
.requirements_toml()
.network
.is_some();
let managed_network_active = turn_ctx.network.is_some();
let initial_sandbox = match tool.sandbox_mode_for_first_attempt(req) {
SandboxOverride::BypassSandboxFirstAttempt => SandboxType::None,
SandboxOverride::NoOverride => self.sandbox.select_initial(
@@ -193,7 +188,7 @@ impl ToolOrchestrator {
turn_ctx.network_sandbox_policy,
tool.sandbox_preference(),
turn_ctx.windows_sandbox_level,
has_managed_network_requirements,
managed_network_active,
),
};
@@ -204,7 +199,7 @@ impl ToolOrchestrator {
policy: &turn_ctx.sandbox_policy,
file_system_policy: &turn_ctx.file_system_sandbox_policy,
network_policy: turn_ctx.network_sandbox_policy,
enforce_managed_network: has_managed_network_requirements,
enforce_managed_network: managed_network_active,
manager: &self.sandbox,
sandbox_cwd: &turn_ctx.cwd,
codex_linux_sandbox_exe: turn_ctx.codex_linux_sandbox_exe.as_ref(),
@@ -221,7 +216,7 @@ impl ToolOrchestrator {
req,
tool_ctx,
&initial_attempt,
has_managed_network_requirements,
managed_network_active,
)
.await;
match first_result {
@@ -236,7 +231,7 @@ impl ToolOrchestrator {
output,
network_policy_decision,
}))) => {
let network_approval_context = if has_managed_network_requirements {
let network_approval_context = if managed_network_active {
network_policy_decision
.as_ref()
.and_then(network_approval_context_from_payload)
@@ -341,7 +336,7 @@ impl ToolOrchestrator {
policy: &turn_ctx.sandbox_policy,
file_system_policy: &turn_ctx.file_system_sandbox_policy,
network_policy: turn_ctx.network_sandbox_policy,
enforce_managed_network: has_managed_network_requirements,
enforce_managed_network: managed_network_active,
manager: &self.sandbox,
sandbox_cwd: &turn_ctx.cwd,
codex_linux_sandbox_exe: None,
@@ -359,7 +354,7 @@ impl ToolOrchestrator {
req,
tool_ctx,
&escalated_attempt,
has_managed_network_requirements,
managed_network_active,
)
.await;
retry_result.map(|output| OrchestratorRunResult {