Prepare managed network sandbox context (#29456)

## Why

Managed network configures commands to use local HTTP and SOCKS proxies.
For commands delegated to the exec server, the proxy environment and the
sandbox policy were prepared separately. On macOS, that meant a command
could receive `HTTPS_PROXY=http://127.0.0.1:43123` while Seatbelt still
denied access to port `43123`.

## What changed

`NetworkProxy` now prepares the command environment and sandbox context
together from the same runtime snapshot:

```text
Prepared managed network
├── command environment: HTTPS_PROXY=http://127.0.0.1:43123
└── sandbox context: allow outbound to 127.0.0.1:43123
```

That context travels with remote exec requests. The exec server
preserves the managed proxy and CA environment, and macOS Seatbelt
allows only the prepared loopback proxy ports without enabling broad
network access or local binding.

The protocol field is optional and the existing enforcement flag remains
in place, preserving compatibility with callers that do not send the new
context.

codex-rs/exec-server/src/environment.rs

@@ -1162,6 +1162,7 @@ mod tests {
                 arg0: None,
                 sandbox: None,
                 enforce_managed_network: false,
+                managed_network: None,
             })
             .await
             .expect("start process");
@@ -1201,6 +1202,7 @@ mod tests {
                 arg0: None,
                 sandbox: Some(sandbox),
                 enforce_managed_network: false,
+                managed_network: None,
             })
             .await;
         let Err(err) = result else {

codex-rs/exec-server/src/fs_sandbox.rs

@@ -115,6 +115,7 @@ impl FileSystemSandboxRunner {
             args: vec![CODEX_FS_HELPER_ARG1.to_string()],
             cwd: cwd.uri.clone(),
             env: self.helper_env.clone(),
+            managed_network: None,
             additional_permissions: None,
         };
         let native_workspace_roots = sandbox_context

codex-rs/exec-server/src/local_process.rs

@@ -965,6 +965,7 @@ mod tests {
             arg0: None,
             sandbox: None,
             enforce_managed_network: false,
+            managed_network: None,
         }
     }
 

codex-rs/exec-server/src/process_sandbox.rs

@@ -1,6 +1,8 @@
 use std::collections::HashMap;
 
 use codex_app_server_protocol::JSONRPCErrorError;
+use codex_network_proxy::CUSTOM_CA_ENV_KEYS;
+use codex_network_proxy::is_managed_mitm_ca_trust_bundle_path;
 use codex_protocol::models::PermissionProfile;
 use codex_sandboxing::SandboxCommand;
 use codex_sandboxing::SandboxDirectSpawnTransformRequest;
@@ -8,6 +10,7 @@ use codex_sandboxing::SandboxManager;
 use codex_sandboxing::SandboxTransformRequest;
 use codex_sandboxing::SandboxType;
 use codex_sandboxing::SandboxablePreference;
+use codex_sandboxing::with_managed_mitm_ca_readable_root;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_path_uri::PathUri;
 
@@ -59,6 +62,20 @@ pub(crate) fn prepare_exec_request(
         native_workspace_roots.as_slice()
     };
     let permissions = permissions.materialize_project_roots_with_workspace_roots(workspace_roots);
+    let managed_mitm_ca_trust_bundle_path = params.managed_network.as_ref().and_then(|_| {
+        CUSTOM_CA_ENV_KEYS.iter().find_map(|key| {
+            let path = env.get(*key)?;
+            if !is_managed_mitm_ca_trust_bundle_path(path) {
+                return None;
+            }
+            AbsolutePathBuf::from_absolute_path(path).ok()
+        })
+    });
+    let permissions = with_managed_mitm_ca_readable_root(
+        permissions,
+        managed_mitm_ca_trust_bundle_path.as_ref(),
+        native_sandbox_policy_cwd.as_path(),
+    );
     let (file_system_policy, network_policy) = permissions.to_runtime_permissions();
     let sandbox_manager = SandboxManager::new();
     let sandbox = sandbox_manager.select_initial(
@@ -98,6 +115,7 @@ pub(crate) fn prepare_exec_request(
                     args: args.to_vec(),
                     cwd: params.cwd.clone(),
                     env,
+                    managed_network: params.managed_network.clone(),
                     additional_permissions: None,
                 },
                 permissions: &permissions,

codex-rs/exec-server/src/process_sandbox_tests.rs

@@ -1,5 +1,7 @@
 use std::collections::HashMap;
 
+#[cfg(target_os = "macos")]
+use codex_network_proxy::ManagedNetworkSandboxContext;
 #[cfg(unix)]
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -44,6 +46,7 @@ fn sandbox_request_wraps_native_argv_on_executor() {
         arg0: None,
         sandbox: Some(sandbox),
         enforce_managed_network: false,
+        managed_network: None,
     };
 
     let prepared = prepare_exec_request(&params, HashMap::new(), Some(&runtime_paths))
@@ -78,6 +81,49 @@ fn sandbox_request_wraps_native_argv_on_executor() {
     );
 }
 
+#[cfg(target_os = "macos")]
+#[test]
+fn sandbox_request_allows_prepared_managed_proxy_port() {
+    let cwd: AbsolutePathBuf = std::env::current_dir()
+        .expect("current directory")
+        .try_into()
+        .expect("absolute cwd");
+    let cwd_uri = PathUri::from_abs_path(&cwd);
+    let self_exe = std::env::current_exe().expect("current executable");
+    let runtime_paths =
+        ExecServerRuntimePaths::new(self_exe.clone(), Some(self_exe)).expect("runtime paths");
+    let sandbox = FileSystemSandboxContext::from_permission_profile_with_cwd(
+        PermissionProfile::workspace_write(),
+        cwd_uri.clone(),
+    );
+    let params = ExecParams {
+        process_id: ProcessId::from("process-managed-network"),
+        argv: vec!["/usr/bin/true".to_string()],
+        cwd: cwd_uri,
+        env_policy: None,
+        env: HashMap::new(),
+        tty: false,
+        pipe_stdin: false,
+        arg0: None,
+        sandbox: Some(sandbox),
+        enforce_managed_network: true,
+        managed_network: Some(ManagedNetworkSandboxContext {
+            loopback_ports: vec![43123],
+            allow_local_binding: false,
+        }),
+    };
+
+    let prepared = prepare_exec_request(&params, HashMap::new(), Some(&runtime_paths))
+        .expect("prepare managed-network sandbox request");
+    let policy = prepared
+        .command
+        .windows(2)
+        .find_map(|args| (args[0] == "-p").then_some(args[1].as_str()))
+        .expect("Seatbelt policy argument");
+
+    assert!(policy.contains("(allow network-outbound (remote ip \"localhost:43123\"))"));
+}
+
 #[test]
 fn native_request_preserves_native_launch_fields() {
     let cwd: AbsolutePathBuf = std::env::current_dir()
@@ -97,6 +143,7 @@ fn native_request_preserves_native_launch_fields() {
         arg0: Some("custom-arg0".to_string()),
         sandbox: None,
         enforce_managed_network: false,
+        managed_network: None,
     };
 
     let prepared = prepare_exec_request(&params, env.clone(), /*runtime_paths*/ None)

codex-rs/exec-server/src/protocol.rs

@@ -2,6 +2,7 @@ use std::collections::HashMap;
 
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use codex_file_system::FileSystemSandboxContext;
+use codex_network_proxy::ManagedNetworkSandboxContext;
 use codex_protocol::config_types::ShellEnvironmentPolicyInherit;
 use codex_utils_path_uri::PathUri;
 use serde::Deserialize;
@@ -109,6 +110,12 @@ pub struct ExecParams {
     /// Whether the eventual executor-side sandbox must enforce managed networking.
     #[serde(default)]
     pub enforce_managed_network: bool,
+    /// Optional details for enforcing managed networking without a live proxy object.
+    ///
+    /// When `enforce_managed_network` is true and these details are absent, the executor must
+    /// continue to fail closed. This preserves compatibility with older clients.
+    #[serde(default)]
+    pub managed_network: Option<ManagedNetworkSandboxContext>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -504,12 +511,60 @@ mod base64_bytes {
 
 #[cfg(test)]
 mod tests {
+    use super::ExecParams;
     use super::FsReadFileParams;
     use super::HttpRequestParams;
+    use super::ProcessId;
     use codex_file_system::FileSystemSandboxContext;
+    use codex_network_proxy::ManagedNetworkSandboxContext;
     use codex_protocol::models::PermissionProfile;
     use codex_utils_path_uri::PathUri;
     use pretty_assertions::assert_eq;
+    use std::collections::HashMap;
+
+    #[test]
+    fn exec_params_managed_network_context_round_trips_and_defaults_for_legacy_peers() {
+        let cwd =
+            PathUri::from_host_native_path(std::env::current_dir().expect("current directory"))
+                .expect("cwd URI");
+        let params = ExecParams {
+            process_id: ProcessId::from("managed-network"),
+            argv: vec!["true".to_string()],
+            cwd,
+            env_policy: None,
+            env: HashMap::new(),
+            tty: false,
+            pipe_stdin: false,
+            arg0: None,
+            sandbox: None,
+            enforce_managed_network: true,
+            managed_network: Some(ManagedNetworkSandboxContext {
+                loopback_ports: vec![43123, 48081],
+                allow_local_binding: false,
+            }),
+        };
+
+        let mut serialized = serde_json::to_value(&params).expect("serialize exec params");
+        assert_eq!(
+            serialized["managedNetwork"],
+            serde_json::json!({
+                "loopbackPorts": [43123, 48081],
+                "allowLocalBinding": false,
+            })
+        );
+        let round_trip: ExecParams =
+            serde_json::from_value(serialized.clone()).expect("deserialize exec params");
+        assert_eq!(round_trip, params);
+
+        serialized
+            .as_object_mut()
+            .expect("exec params object")
+            .remove("managedNetwork");
+        let legacy: ExecParams =
+            serde_json::from_value(serialized).expect("deserialize legacy exec params");
+        assert!(legacy.enforce_managed_network);
+        assert_eq!(legacy.managed_network, None);
+    }
 
     #[test]
     fn filesystem_protocol_accepts_legacy_absolute_paths_and_serializes_path_uris() {

codex-rs/exec-server/src/server/handler/tests.rs

@@ -36,6 +36,7 @@ fn exec_params_with_argv(process_id: &str, argv: Vec<String>) -> ExecParams {
         arg0: None,
         sandbox: None,
         enforce_managed_network: false,
+        managed_network: None,
     }
 }
 

codex-rs/exec-server/src/server/processor.rs

@@ -441,6 +441,7 @@ mod tests {
             arg0: None,
             sandbox: None,
             enforce_managed_network: false,
+            managed_network: None,
         }
     }