Add remote_sandbox_config to our config requirements (#18763)

## Why

Customers need finer-grained control over allowed sandbox modes based on
the host Codex is running on. For example, they may want stricter
sandbox limits on devboxes while keeping a different default elsewhere.

Our current cloud requirements can target user/account groups, but they
cannot vary sandbox requirements by host. That makes remote development
environments awkward because the same top-level `allowed_sandbox_modes`
has to apply everywhere.

## What

Adds a new `remote_sandbox_config` section to `requirements.toml`:

```toml
allowed_sandbox_modes = ["read-only"]

[[remote_sandbox_config]]
hostname_patterns = ["*.org"]
allowed_sandbox_modes = ["read-only", "workspace-write"]

[[remote_sandbox_config]]
hostname_patterns = ["*.sh", "runner-*.ci"]
allowed_sandbox_modes = ["read-only", "danger-full-access"]
```

During requirements resolution, Codex resolves the local host name once,
preferring the machine FQDN when available and falling back to the
cleaned kernel hostname. This host classification is best effort rather
than authenticated device proof.

Each requirements source applies its first matching
`remote_sandbox_config` entry before it is merged with other sources.
The shared merge helper keeps that `apply_remote_sandbox_config` step
paired with requirements merging so new requirements sources do not have
to remember the extra call.

That preserves source precedence: a lower-precedence requirements file
with a matching `remote_sandbox_config` cannot override a
higher-precedence source that already set `allowed_sandbox_modes`.

This also wires the hostname-aware resolution through app-server,
CLI/TUI config loading, config API reads, and config layer metadata so
they all evaluate remote sandbox requirements consistently.

## Verification

- `cargo test -p codex-config remote_sandbox_config`
- `cargo test -p codex-config host_name`
- `cargo test -p codex-core
load_config_layers_applies_matching_remote_sandbox_config`
- `cargo test -p codex-core
system_remote_sandbox_config_keeps_cloud_sandbox_modes`
- `cargo test -p codex-config`
- `cargo test -p codex-core` unit tests passed; `tests/all.rs`
integration matrix was intentionally stopped after the relevant focused
tests passed
- `just fix -p codex-config`
- `just fix -p codex-core`
- `cargo check -p codex-app-server`

codex-rs/core/src/config/config_tests.rs

@@ -2213,6 +2213,7 @@ async fn managed_config_overrides_oauth_store_mode() -> anyhow::Result<()> {
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
     let cfg =
@@ -2348,6 +2349,7 @@ async fn managed_config_wins_over_cli_overrides() -> anyhow::Result<()> {
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -5484,6 +5486,7 @@ async fn test_requirements_web_search_mode_allowlist_does_not_warn_when_unset()
         allowed_approval_policies: None,
         allowed_approvals_reviewers: None,
         allowed_sandbox_modes: None,
+        remote_sandbox_config: None,
         allowed_web_search_modes: Some(vec![
             crate::config_loader::WebSearchModeRequirement::Cached,
         ]),
@@ -6160,6 +6163,7 @@ async fn explicit_sandbox_mode_falls_back_when_disallowed_by_requirements() -> s
         allowed_approval_policies: None,
         allowed_approvals_reviewers: None,
         allowed_sandbox_modes: Some(vec![crate::config_loader::SandboxModeRequirement::ReadOnly]),
+        remote_sandbox_config: None,
         allowed_web_search_modes: None,
         feature_requirements: None,
         mcp_servers: None,

codex-rs/core/src/config/mod.rs

@@ -649,7 +649,7 @@ impl AuthManagerConfig for Config {
     }
 }
 
-#[derive(Clone, Default)]
+#[derive(Clone)]
 pub struct ConfigBuilder {
     codex_home: Option<PathBuf>,
     cli_overrides: Option<Vec<(String, TomlValue)>>,
@@ -658,6 +658,22 @@ pub struct ConfigBuilder {
     cloud_requirements: CloudRequirementsLoader,
     thread_config_loader: Option<Arc<dyn ThreadConfigLoader>>,
     fallback_cwd: Option<PathBuf>,
+    host_name: Option<String>,
+}
+
+impl Default for ConfigBuilder {
+    fn default() -> Self {
+        Self {
+            codex_home: None,
+            cli_overrides: None,
+            harness_overrides: None,
+            loader_overrides: None,
+            cloud_requirements: CloudRequirementsLoader::default(),
+            thread_config_loader: None,
+            fallback_cwd: None,
+            host_name: codex_config::host_name(),
+        }
+    }
 }
 
 impl ConfigBuilder {
@@ -699,6 +715,11 @@ impl ConfigBuilder {
         self
     }
 
+    pub fn host_name(mut self, host_name: Option<String>) -> Self {
+        self.host_name = host_name;
+        self
+    }
+
     pub async fn build(self) -> std::io::Result<Config> {
         let Self {
             codex_home,
@@ -708,6 +729,7 @@ impl ConfigBuilder {
             cloud_requirements,
             thread_config_loader,
             fallback_cwd,
+            host_name,
         } = self;
         let codex_home = match codex_home {
             Some(codex_home) => AbsolutePathBuf::from_absolute_path(codex_home)?,
@@ -732,6 +754,7 @@ impl ConfigBuilder {
             thread_config_loader
                 .as_deref()
                 .unwrap_or(&codex_config::NoopThreadConfigLoader),
+            host_name.as_deref(),
         )
         .await?;
         let merged_toml = config_layer_stack.effective_config();
@@ -911,6 +934,7 @@ pub async fn load_config_as_toml_with_cli_and_loader_overrides(
         loader_overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1083,6 +1107,7 @@ pub async fn load_global_mcp_servers(
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
     let merged_toml = config_layer_stack.effective_config();

codex-rs/core/src/config/service.rs

@@ -115,6 +115,7 @@ pub struct ConfigService {
     cli_overrides: Vec<(String, TomlValue)>,
     loader_overrides: LoaderOverrides,
     cloud_requirements: CloudRequirementsLoader,
+    host_name: Option<String>,
 }
 
 impl ConfigService {
@@ -123,12 +124,14 @@ impl ConfigService {
         cli_overrides: Vec<(String, TomlValue)>,
         loader_overrides: LoaderOverrides,
         cloud_requirements: CloudRequirementsLoader,
+        host_name: Option<String>,
     ) -> Self {
         Self {
             codex_home,
             cli_overrides,
             loader_overrides,
             cloud_requirements,
+            host_name,
         }
     }
 
@@ -138,6 +141,7 @@ impl ConfigService {
             cli_overrides: Vec::new(),
             loader_overrides: LoaderOverrides::default(),
             cloud_requirements: CloudRequirementsLoader::default(),
+            host_name: codex_config::host_name(),
         }
     }
 
@@ -148,6 +152,7 @@ impl ConfigService {
             Vec::new(),
             LoaderOverrides::without_managed_config_for_tests(),
             CloudRequirementsLoader::default(),
+            /*host_name*/ None,
         )
     }
 
@@ -166,6 +171,7 @@ impl ConfigService {
                     .loader_overrides(self.loader_overrides.clone())
                     .fallback_cwd(Some(cwd.to_path_buf()))
                     .cloud_requirements(self.cloud_requirements.clone())
+                    .host_name(self.host_name.clone())
                     .build()
                     .await
                     .map_err(|err| {
@@ -432,6 +438,7 @@ impl ConfigService {
             self.loader_overrides.clone(),
             self.cloud_requirements.clone(),
             &codex_config::NoopThreadConfigLoader,
+            self.host_name.as_deref(),
         )
         .await
     }

codex-rs/core/src/config/service_tests.rs

@@ -223,6 +223,7 @@ async fn read_includes_origins_and_layers() {
         vec![],
         LoaderOverrides::with_managed_config_path_for_tests(managed_path.clone()),
         CloudRequirementsLoader::default(),
+        /*host_name*/ None,
     );
 
     let response = service
@@ -301,6 +302,7 @@ writable_roots = ["~/code"]
         vec![],
         loader_overrides,
         CloudRequirementsLoader::default(),
+        /*host_name*/ None,
     );
 
     let response = service
@@ -341,6 +343,7 @@ async fn write_value_reports_override() {
         vec![],
         LoaderOverrides::with_managed_config_path_for_tests(managed_path.clone()),
         CloudRequirementsLoader::default(),
+        /*host_name*/ None,
     );
 
     let result = service
@@ -440,6 +443,7 @@ async fn invalid_user_value_rejected_even_if_overridden_by_managed() {
         vec![],
         LoaderOverrides::with_managed_config_path_for_tests(managed_path.clone()),
         CloudRequirementsLoader::default(),
+        /*host_name*/ None,
     );
 
     let error = service
@@ -507,6 +511,7 @@ async fn write_value_rejects_feature_requirement_conflict() {
                 ..Default::default()
             }))
         }),
+        /*host_name*/ None,
     );
 
     let error = service
@@ -553,6 +558,7 @@ async fn write_value_rejects_profile_feature_requirement_conflict() {
                 ..Default::default()
             }))
         }),
+        /*host_name*/ None,
     );
 
     let error = service
@@ -603,6 +609,7 @@ async fn read_reports_managed_overrides_user_and_session_flags() {
         cli_overrides,
         LoaderOverrides::with_managed_config_path_for_tests(managed_path.clone()),
         CloudRequirementsLoader::default(),
+        /*host_name*/ None,
     );
 
     let response = service
@@ -656,6 +663,7 @@ async fn write_value_reports_managed_override() {
         vec![],
         LoaderOverrides::with_managed_config_path_for_tests(managed_path.clone()),
         CloudRequirementsLoader::default(),
+        /*host_name*/ None,
     );
 
     let result = service

codex-rs/core/src/config_loader/README.md

@@ -10,7 +10,7 @@ This module is the canonical place to **load and describe Codex configuration la
 
 Exported from `codex_core::config_loader`:
 
-- `load_config_layers_state(fs, codex_home, cwd_opt, cli_overrides, overrides, cloud_requirements, thread_config_loader) -> ConfigLayerStack`
+- `load_config_layers_state(fs, codex_home, cwd_opt, cli_overrides, overrides, cloud_requirements, thread_config_loader, host_name) -> ConfigLayerStack`
 - `ConfigLayerStack`
   - `effective_config() -> toml::Value`
   - `origins() -> HashMap<String, ConfigLayerMetadata>`
@@ -41,9 +41,7 @@ computing the effective config and origins metadata. This is what
 Most callers want the effective config plus metadata:
 
 ```rust
-use codex_core::config_loader::{
-    CloudRequirementsLoader, LoaderOverrides, load_config_layers_state,
-};
+use codex_core::config_loader::{CloudRequirementsLoader, LoaderOverrides, load_config_layers_state};
 use codex_config::NoopThreadConfigLoader;
 use codex_exec_server::LOCAL_FS;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -59,6 +57,7 @@ let layers = load_config_layers_state(
     LoaderOverrides::default(),
     CloudRequirementsLoader::default(),
     &NoopThreadConfigLoader,
+    /*host_name*/ None,
 ).await?;
 
 let effective = layers.effective_config();

codex-rs/core/src/config_loader/macos.rs

@@ -1,6 +1,7 @@
 use super::ConfigRequirementsToml;
 use super::ConfigRequirementsWithSources;
 use super::RequirementSource;
+use super::merge_requirements_with_remote_sandbox_config;
 use base64::Engine;
 use base64::prelude::BASE64_STANDARD;
 use core_foundation::base::TCFType;
@@ -64,6 +65,7 @@ fn load_managed_admin_config() -> io::Result<Option<ManagedAdminConfigLayer>> {
 pub(crate) async fn load_managed_admin_requirements_toml(
     target: &mut ConfigRequirementsWithSources,
     override_base64: Option<&str>,
+    host_name: Option<&str>,
 ) -> io::Result<()> {
     if let Some(encoded) = override_base64 {
         let trimmed = encoded.trim();
@@ -71,9 +73,11 @@ pub(crate) async fn load_managed_admin_requirements_toml(
             return Ok(());
         }
 
-        target.merge_unset_fields(
+        merge_requirements_with_remote_sandbox_config(
+            target,
             managed_preferences_requirements_source(),
             parse_managed_requirements_base64(trimmed)?,
+            host_name,
         );
         return Ok(());
     }
@@ -81,7 +85,12 @@ pub(crate) async fn load_managed_admin_requirements_toml(
     match task::spawn_blocking(load_managed_admin_requirements).await {
         Ok(result) => {
             if let Some(requirements) = result? {
-                target.merge_unset_fields(managed_preferences_requirements_source(), requirements);
+                merge_requirements_with_remote_sandbox_config(
+                    target,
+                    managed_preferences_requirements_source(),
+                    requirements,
+                    host_name,
+                );
             }
             Ok(())
         }

codex-rs/core/src/config_loader/mod.rs

@@ -54,6 +54,7 @@ pub use codex_config::NetworkDomainPermissionsToml;
 pub use codex_config::NetworkRequirementsToml;
 pub use codex_config::NetworkUnixSocketPermissionToml;
 pub use codex_config::NetworkUnixSocketPermissionsToml;
+pub use codex_config::RemoteSandboxConfigToml;
 pub use codex_config::RequirementSource;
 pub use codex_config::ResidencyRequirement;
 pub use codex_config::SandboxModeRequirement;
@@ -122,6 +123,7 @@ pub(crate) async fn first_layer_config_error_from_entries(
 /// associated with it such that `cwd` should be `Some(...)`. Only for
 /// thread-agnostic config loading (e.g., for the app server's `/config`
 /// endpoint) should `cwd` be `None`.
+#[allow(clippy::too_many_arguments)]
 pub async fn load_config_layers_state(
     fs: &dyn ExecutorFileSystem,
     codex_home: &Path,
@@ -130,6 +132,7 @@ pub async fn load_config_layers_state(
     overrides: LoaderOverrides,
     cloud_requirements: CloudRequirementsLoader,
     thread_config_loader: &dyn ThreadConfigLoader,
+    host_name: Option<&str>,
 ) -> io::Result<ConfigLayerStack> {
     let ignore_user_config = overrides.ignore_user_config;
     let ignore_user_and_project_exec_policy_rules =
@@ -137,8 +140,12 @@ pub async fn load_config_layers_state(
     let mut config_requirements_toml = ConfigRequirementsWithSources::default();
 
     if let Some(requirements) = cloud_requirements.get().await.map_err(io::Error::other)? {
-        config_requirements_toml
-            .merge_unset_fields(RequirementSource::CloudRequirements, requirements);
+        merge_requirements_with_remote_sandbox_config(
+            &mut config_requirements_toml,
+            RequirementSource::CloudRequirements,
+            requirements,
+            host_name,
+        );
     }
 
     #[cfg(target_os = "macos")]
@@ -147,12 +154,19 @@ pub async fn load_config_layers_state(
         overrides
             .macos_managed_config_requirements_base64
             .as_deref(),
+        host_name,
     )
     .await?;
 
     // Honor the system requirements.toml location.
     let requirements_toml_file = system_requirements_toml_file()?;
-    load_requirements_toml(fs, &mut config_requirements_toml, &requirements_toml_file).await?;
+    load_requirements_toml(
+        fs,
+        &mut config_requirements_toml,
+        &requirements_toml_file,
+        host_name,
+    )
+    .await?;
 
     // Make a best-effort to support the legacy `managed_config.toml` as a
     // requirements specification.
@@ -161,6 +175,7 @@ pub async fn load_config_layers_state(
     load_requirements_from_legacy_scheme(
         &mut config_requirements_toml,
         loaded_config_layers.clone(),
+        host_name,
     )
     .await?;
 
@@ -413,6 +428,7 @@ async fn load_requirements_toml(
     fs: &dyn ExecutorFileSystem,
     config_requirements_toml: &mut ConfigRequirementsWithSources,
     requirements_toml_file: &AbsolutePathBuf,
+    host_name: Option<&str>,
 ) -> io::Result<()> {
     match fs
         .read_file_text(requirements_toml_file, /*sandbox*/ None)
@@ -439,11 +455,13 @@ async fn load_requirements_toml(
                         ),
                     )
                 })?;
-            config_requirements_toml.merge_unset_fields(
+            merge_requirements_with_remote_sandbox_config(
+                config_requirements_toml,
                 RequirementSource::SystemRequirementsToml {
                     file: requirements_toml_file.clone(),
                 },
                 requirements_config,
+                host_name,
             );
         }
         Err(e) => {
@@ -558,6 +576,7 @@ fn windows_program_data_dir_from_known_folder() -> io::Result<PathBuf> {
 async fn load_requirements_from_legacy_scheme(
     config_requirements_toml: &mut ConfigRequirementsWithSources,
     loaded_config_layers: LoadedConfigLayers,
+    host_name: Option<&str>,
 ) -> io::Result<()> {
     // In this implementation, earlier layers cannot be overwritten by later
     // layers, so list managed_config_from_mdm first because it has the highest
@@ -590,13 +609,27 @@ async fn load_requirements_from_legacy_scheme(
                 )
             })?;
 
-        let new_requirements_toml = ConfigRequirementsToml::from(legacy_config);
-        config_requirements_toml.merge_unset_fields(source, new_requirements_toml);
+        merge_requirements_with_remote_sandbox_config(
+            config_requirements_toml,
+            source,
+            ConfigRequirementsToml::from(legacy_config),
+            host_name,
+        );
     }
 
     Ok(())
 }
 
+pub(super) fn merge_requirements_with_remote_sandbox_config(
+    target: &mut ConfigRequirementsWithSources,
+    source: RequirementSource,
+    mut requirements: ConfigRequirementsToml,
+    host_name: Option<&str>,
+) {
+    requirements.apply_remote_sandbox_config(host_name);
+    target.merge_unset_fields(source, requirements);
+}
+
 struct ProjectTrustContext {
     project_root: AbsolutePathBuf,
     project_root_key: String,

codex-rs/core/src/config_loader/tests.rs

@@ -24,7 +24,6 @@ use codex_exec_server::LOCAL_FS;
 use codex_protocol::config_types::TrustLevel;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::protocol::AskForApproval;
-#[cfg(target_os = "macos")]
 use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
@@ -104,6 +103,7 @@ async fn returns_config_error_for_invalid_user_config_toml() {
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .expect_err("expected error");
@@ -136,6 +136,7 @@ async fn ignore_user_config_keeps_empty_user_layer() -> std::io::Result<()> {
         },
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -167,6 +168,7 @@ async fn ignore_rules_marks_config_stack_for_exec_policy_rule_skip() -> std::io:
         },
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -192,6 +194,7 @@ async fn returns_config_error_for_invalid_managed_config_toml() {
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .expect_err("expected error");
@@ -278,6 +281,7 @@ extra = true
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .expect("load config");
@@ -312,6 +316,7 @@ async fn returns_empty_when_all_layers_missing() {
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .expect("load layers");
@@ -380,6 +385,7 @@ async fn includes_thread_config_layers_in_stack() -> anyhow::Result<()> {
             features: BTreeMap::from([("plugins".to_string(), false)]),
             ..Default::default()
         })]),
+        /*host_name*/ None,
     )
     .await?;
 
@@ -456,6 +462,7 @@ flag = false
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .expect("load config");
@@ -559,6 +566,7 @@ allowed_sandbox_modes = ["read-only"]
         loader_overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -622,6 +630,7 @@ allowed_approval_policies = ["never"]
         loader_overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -663,6 +672,7 @@ personality = true
         LOCAL_FS.as_ref(),
         &mut config_requirements_toml,
         &requirements_file,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -764,6 +774,7 @@ allowed_approval_policies = ["on-request"]
                 allowed_approval_policies: Some(vec![AskForApproval::Never]),
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
+                remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -776,6 +787,7 @@ allowed_approval_policies = ["on-request"]
             }))
         }),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -818,6 +830,7 @@ allowed_approval_policies = ["on-request"]
             allowed_approval_policies: Some(vec![AskForApproval::Never]),
             allowed_approvals_reviewers: None,
             allowed_sandbox_modes: None,
+            remote_sandbox_config: None,
             allowed_web_search_modes: None,
             feature_requirements: None,
             mcp_servers: None,
@@ -833,6 +846,7 @@ allowed_approval_policies = ["on-request"]
         LOCAL_FS.as_ref(),
         &mut config_requirements_toml,
         &AbsolutePathBuf::try_from(requirements_file)?,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -854,6 +868,54 @@ allowed_approval_policies = ["on-request"]
     Ok(())
 }
 
+#[tokio::test(flavor = "current_thread")]
+async fn system_remote_sandbox_config_keeps_cloud_sandbox_modes() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let requirements_file = tmp.path().join("requirements.toml");
+    tokio::fs::write(
+        &requirements_file,
+        r#"
+[[remote_sandbox_config]]
+hostname_patterns = ["runner-*.ci.example.com"]
+allowed_sandbox_modes = ["read-only", "workspace-write"]
+"#,
+    )
+    .await?;
+
+    let cloud_source = RequirementSource::CloudRequirements;
+    let mut config_requirements_toml = ConfigRequirementsWithSources::default();
+    config_requirements_toml.merge_unset_fields(
+        cloud_source.clone(),
+        toml::from_str(
+            r#"
+allowed_sandbox_modes = ["read-only"]
+"#,
+        )?,
+    );
+    load_requirements_toml(
+        LOCAL_FS.as_ref(),
+        &mut config_requirements_toml,
+        &AbsolutePathBuf::try_from(requirements_file)?,
+        Some("runner-01.ci.example.com"),
+    )
+    .await?;
+    let config_requirements: ConfigRequirements = config_requirements_toml.try_into()?;
+
+    assert_eq!(
+        config_requirements
+            .sandbox_policy
+            .can_set(&SandboxPolicy::new_workspace_write_policy()),
+        Err(ConstraintError::InvalidValue {
+            field_name: "sandbox_mode",
+            candidate: "WorkspaceWrite".into(),
+            allowed: "[ReadOnly]".into(),
+            requirement_source: cloud_source,
+        })
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "current_thread")]
 async fn load_requirements_toml_resolves_deny_read_against_parent() -> anyhow::Result<()> {
     let tmp = tempdir()?;
@@ -875,6 +937,7 @@ deny_read = ["./sensitive", "../shared/secret.txt"]
         LOCAL_FS.as_ref(),
         &mut config_requirements_toml,
         &requirements_file,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -929,6 +992,7 @@ deny_read = ["./sensitive/**/*.txt"]
         LOCAL_FS.as_ref(),
         &mut config_requirements_toml,
         &requirements_file,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -974,6 +1038,7 @@ async fn load_config_layers_includes_cloud_requirements() -> anyhow::Result<()>
         allowed_approval_policies: Some(vec![AskForApproval::Never]),
         allowed_approvals_reviewers: None,
         allowed_sandbox_modes: None,
+        remote_sandbox_config: None,
         allowed_web_search_modes: None,
         feature_requirements: None,
         mcp_servers: None,
@@ -995,6 +1060,7 @@ async fn load_config_layers_includes_cloud_requirements() -> anyhow::Result<()>
         LoaderOverrides::default(),
         cloud_requirements,
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1018,6 +1084,53 @@ async fn load_config_layers_includes_cloud_requirements() -> anyhow::Result<()>
     Ok(())
 }
 
+#[tokio::test]
+async fn load_config_layers_applies_matching_remote_sandbox_config() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let codex_home = tmp.path().join("home");
+    tokio::fs::create_dir_all(&codex_home).await?;
+    let cwd = AbsolutePathBuf::from_absolute_path(tmp.path())?;
+
+    let requirements: ConfigRequirementsToml = toml::from_str(
+        r#"
+            allowed_sandbox_modes = ["read-only"]
+
+            [[remote_sandbox_config]]
+            hostname_patterns = ["runner-*.ci.example.com"]
+            allowed_sandbox_modes = ["read-only", "workspace-write"]
+        "#,
+    )?;
+    let cloud_requirements = CloudRequirementsLoader::new(async move { Ok(Some(requirements)) });
+    let layers = load_config_layers_state(
+        LOCAL_FS.as_ref(),
+        &codex_home,
+        Some(cwd),
+        &[] as &[(String, TomlValue)],
+        LoaderOverrides::default(),
+        cloud_requirements,
+        &codex_config::NoopThreadConfigLoader,
+        Some("runner-01.ci.example.com"),
+    )
+    .await?;
+
+    assert_eq!(
+        layers.requirements_toml().allowed_sandbox_modes,
+        Some(vec![
+            crate::config_loader::SandboxModeRequirement::ReadOnly,
+            crate::config_loader::SandboxModeRequirement::WorkspaceWrite,
+        ])
+    );
+    assert!(
+        layers
+            .requirements()
+            .sandbox_policy
+            .can_set(&SandboxPolicy::new_workspace_write_policy())
+            .is_ok()
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn load_config_layers_fails_when_cloud_requirements_loader_fails() -> anyhow::Result<()> {
     let tmp = tempdir()?;
@@ -1039,6 +1152,7 @@ async fn load_config_layers_fails_when_cloud_requirements_loader_fails() -> anyh
             ))
         }),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .expect_err("cloud requirements failure should fail closed");
@@ -1087,6 +1201,7 @@ async fn project_layers_prefer_closest_cwd() -> std::io::Result<()> {
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1233,6 +1348,7 @@ async fn project_layer_is_added_when_dot_codex_exists_without_config_toml() -> s
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1274,6 +1390,7 @@ async fn codex_home_is_not_loaded_as_project_layer_from_home_dir() -> std::io::R
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1332,6 +1449,7 @@ async fn codex_home_within_project_tree_is_not_double_loaded() -> std::io::Resul
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1404,6 +1522,7 @@ async fn project_layers_disabled_when_untrusted_or_unknown() -> std::io::Result<
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
     let project_layers_untrusted: Vec<_> = layers_untrusted
@@ -1444,6 +1563,7 @@ async fn project_layers_disabled_when_untrusted_or_unknown() -> std::io::Result<
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
     let project_layers_unknown: Vec<_> = layers_unknown
@@ -1511,6 +1631,7 @@ async fn project_trust_does_not_match_configured_alias_for_canonical_cwd() -> st
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1665,6 +1786,7 @@ async fn invalid_project_config_ignored_when_untrusted_or_unknown() -> std::io::
             LoaderOverrides::default(),
             CloudRequirementsLoader::default(),
             &codex_config::NoopThreadConfigLoader,
+            /*host_name*/ None,
         )
         .await?;
         let project_layers: Vec<_> = layers
@@ -1734,6 +1856,7 @@ async fn project_layer_without_config_toml_is_disabled_when_untrusted_or_unknown
             LoaderOverrides::default(),
             CloudRequirementsLoader::default(),
             &codex_config::NoopThreadConfigLoader,
+            /*host_name*/ None,
         )
         .await?;
         let project_layers: Vec<_> = layers
@@ -1795,6 +1918,7 @@ async fn cli_overrides_with_relative_paths_do_not_break_trust_check() -> std::io
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 
@@ -1839,6 +1963,7 @@ async fn project_root_markers_supports_alternate_markers() -> std::io::Result<()
         LoaderOverrides::default(),
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await?;
 

codex-rs/core/src/network_proxy_loader.rs

@@ -54,6 +54,7 @@ async fn build_config_state_with_mtimes() -> Result<(ConfigState, Vec<LayerMtime
         overrides,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
+        /*host_name*/ None,
     )
     .await
     .context("failed to load Codex config")?;

codex-rs/core/src/session/handlers.rs

@@ -546,6 +546,7 @@ pub async fn list_skills(sess: &Session, sub_id: String, cwds: Vec<PathBuf>, for
             LoaderOverrides::default(),
             CloudRequirementsLoader::default(),
             &codex_config::NoopThreadConfigLoader,
+            /*host_name*/ None,
         )
         .await
         {