38 Commits

• chore: refactor network permissions to use explicit domain and unix socket rule maps (#15120)

  ## Summary
  
  This PR replaces the legacy network allow/deny list model with explicit
  rule maps for domains and unix sockets across managed requirements,
  permissions profiles, the network proxy config, and the app server
  protocol.
  
  Concretely, it:
  
  - introduces typed domain (`allow` / `deny`) and unix socket permission
  (`allow` / `none`) entries instead of separate `allowed_domains`,
  `denied_domains`, and `allow_unix_sockets` lists
  - updates config loading, managed requirements merging, and exec-policy
  overlays to read and upsert rule entries consistently
  - exposes the new shape through protocol/schema outputs, debug surfaces,
  and app-server config APIs
  - rejects the legacy list-based keys and updates docs/tests to reflect
  the new config format
  
  ## Why
  
  The previous representation split related network policy across multiple
  parallel lists, which made merging and overriding rules harder to reason
  about. Moving to explicit keyed permission maps gives us a single source
  of truth per host/socket entry, makes allow/deny precedence clearer, and
  gives protocol consumers access to the full rule state instead of
  derived projections only.
  
  ## Backward Compatibility
  
  ### Backward compatible
  
  - Managed requirements still accept the legacy
  `experimental_network.allowed_domains`,
  `experimental_network.denied_domains`, and
  `experimental_network.allow_unix_sockets` fields. They are normalized
  into the new canonical `domains` and `unix_sockets` maps internally.
  - App-server v2 still deserializes legacy `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` payloads, so older clients can
  continue reading managed network requirements.
  - App-server v2 responses still populate `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` as legacy compatibility views
  derived from the canonical maps.
  - `managed_allowed_domains_only` keeps the same behavior after
  normalization. Legacy managed allowlists still participate in the same
  enforcement path as canonical `domains` entries.
  
  ### Not backward compatible
  
  - Permissions profiles under `[permissions.<profile>.network]` no longer
  accept the legacy list-based keys. Those configs must use the canonical
  `[domains]` and `[unix_sockets]` tables instead of `allowed_domains`,
  `denied_domains`, or `allow_unix_sockets`.
  - Managed `experimental_network` config cannot mix canonical and legacy
  forms in the same block. For example, `domains` cannot be combined with
  `allowed_domains` or `denied_domains`, and `unix_sockets` cannot be
  combined with `allow_unix_sockets`.
  - The canonical format can express explicit `"none"` entries for unix
  sockets, but those entries do not round-trip through the legacy
  compatibility fields because the legacy fields only represent allow/deny
  lists.
  ## Testing
  `/target/debug/codex sandbox macos --log-denials /bin/zsh -c 'curl
  https://www.example.com' ` gives 200 with config
  ```
  [permissions.workspace.network.domains]
  "www.example.com" = "allow"
  ```
  and fails when set to deny: `curl: (56) CONNECT tunnel failed, response
  403`.
  
  Also tested backward compatibility path by verifying that adding the
  following to `/etc/codex/requirements.toml` works:
  ```
  [experimental_network]
  allowed_domains = ["www.example.com"]
  ```

  Celia Chen · 2026-03-27 06:17:59 +00:00
  dd30c8eedd
• feat(windows-sandbox): add network proxy support (#12220)

  ## Summary
  
  This PR makes Windows sandbox proxying enforceable by routing proxy-only
  runs through the existing `offline` sandbox user and reserving direct
  network access for the existing `online` sandbox user.
  
  In brief:
  
  - if a Windows sandbox run should be proxy-enforced, we run it as the
  `offline` user
  - the `offline` user gets firewall rules that block direct outbound
  traffic and only permit the configured localhost proxy path
  - if a Windows sandbox run should have true direct network access, we
  run it as the `online` user
  - no new sandbox identity is introduced
  
  This brings Windows in line with the intended model: proxy use is not
  just env-based, it is backed by OS-level egress controls. Windows
  already has two sandbox identities:
  
  - `offline`: intended to have no direct network egress
  - `online`: intended to have full network access
  
  This PR makes proxy-enforced runs use that model directly.
  
  ### Proxy-enforced runs
  
  When proxy enforcement is active:
  
  - the run is assigned to the `offline` identity
  - setup extracts the loopback proxy ports from the sandbox env
  - Windows setup programs firewall rules for the `offline` user that:
    - block all non-loopback outbound traffic
    - block loopback UDP
    - block loopback TCP except for the configured proxy ports
  - optionally allow broader localhost access when `allow_local_binding=1`
  
  So the sandboxed process can only talk to the local proxy. It cannot
  open direct outbound sockets or do local UDP-based DNS on its own.The
  proxy then performs the real outbound network access outside that
  restricted sandbox identity.
  
  ### Direct-network runs
  
  When proxy enforcement is not active and full network access is allowed:
  
  - the run is assigned to the `online` identity
  - no proxy-only firewall restrictions are applied
  - the process gets normal direct network access
  
  ### Unelevated vs elevated
  
  The restricted-token / unelevated path cannot enforce per-identity
  firewall policy by itself.
  
  So for Windows proxy-enforced runs, we transparently use the logon-user
  sandbox path under the hood, even if the caller started from the
  unelevated mode. That keeps enforcement real instead of best-effort.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-03-26 17:27:38 -07:00
  81fa04783a
• fix(network-proxy): fail closed on network-proxy DNS lookup errors (#15909)

  ## Summary
  
  Fail closed when the network proxy's local/private IP pre-check hits a
  DNS lookup error or timeout, instead of treating the hostname as public
  and allowing the request.
  
  ## Root cause
  
  `host_resolves_to_non_public_ip()` returned `false` on resolver failure,
  which created a fail-open path in the `allow_local_binding = false`
  boundary. The eventual connect path performs its own DNS resolution
  later, so a transient pre-check failure is not evidence that the
  destination is public.
  
  ## Changes
  
  - Treat DNS lookup errors/timeouts as local/private for blocking
  purposes
  - Add a regression test for an allowlisted hostname that fails DNS
  resolution
  
  ## Validation
  
  - `cargo test -p codex-network-proxy`
  - `cargo clippy -p codex-network-proxy --all-targets -- -D warnings`
  - `just fmt`
  - `just argument-comment-lint`

  viyatb-oai · 2026-03-26 23:18:04 +00:00
  aea82c63ea
• Add wildcard in the middle test coverage (#15813)

  ## Summary
  Add a focused codex network proxy unit test for the denylist pattern
  with wildcard in the middle `region*.some.malicious.tunnel.com`. This
  does not change how existing code works, just ensure that behavior stays
  the same and we got CI guards to guard existin behavior.
  
  ## Why
  The managed Codex denylist update relies on this mid label glob form,
  and the existing tests only covered exact hosts, `*.` subdomains, and
  `**.` apex plus subdomains.
  
  ## Validation
  `cargo test -p codex-network-proxy
  compile_globset_supports_mid_label_wildcards`
  `cargo test -p codex-network-proxy`
  `./tools/argument-comment-lint/run-prebuilt-linter.sh -p
  codex-network-proxy`

  evawong-oai · 2026-03-26 17:53:31 +00:00
  0bd34c28c7
• Allow global network allowlist wildcard (#15549)

  ## Problem
  
  Today `codex-network-proxy` rejects a global `*` in
  `network.allowed_domains`, so there is no static way to configure a
  denylist-only posture for public hosts. Users have to enumerate broad
  allowlist patterns instead.
  
  ## Approach
  
  - Make global wildcard acceptance field-specific: `allowed_domains` can
  use `*`, while `denied_domains` still rejects a global wildcard.
  - Keep the existing evaluation order, so explicit denies still win first
  and local/private protections still apply unless separately enabled.
  - Add coverage for the denylist-only behavior and update the README to
  document it.
  
  ## Validation
  
  - `just fmt`
  - `cargo test -p codex-network-proxy` (full run had one unrelated flaky
  telemetry test:
  `network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event`;
  reran in isolation and it passed)
  - `cargo test -p codex-network-proxy
  network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event
  -- --exact --nocapture`
  - `just fix -p codex-network-proxy`
  - `just argument-comment-lint`

  rreichel3-oai · 2026-03-24 10:43:46 -04:00
  1db6cb9789
• Apply argument comment lint across codex-rs (#14652)

  ## Why
  
  Once the repo-local lint exists, `codex-rs` needs to follow the
  checked-in convention and CI needs to keep it from drifting. This commit
  applies the fallback `/*param*/` style consistently across existing
  positional literal call sites without changing those APIs.
  
  The longer-term preference is still to avoid APIs that require comments
  by choosing clearer parameter types and call shapes. This PR is
  intentionally the mechanical follow-through for the places where the
  existing signatures stay in place.
  
  After rebasing onto newer `main`, the rollout also had to cover newly
  introduced `tui_app_server` call sites. That made it clear the first cut
  of the CI job was too expensive for the common path: it was spending
  almost as much time installing `cargo-dylint` and re-testing the lint
  crate as a representative test job spends running product tests. The CI
  update keeps the full workspace enforcement but trims that extra
  overhead from ordinary `codex-rs` PRs.
  
  ## What changed
  
  - keep a dedicated `argument_comment_lint` job in `rust-ci`
  - mechanically annotate remaining opaque positional literals across
  `codex-rs` with exact `/*param*/` comments, including the rebased
  `tui_app_server` call sites that now fall under the lint
  - keep the checked-in style aligned with the lint policy by using
  `/*param*/` and leaving string and char literals uncommented
  - cache `cargo-dylint`, `dylint-link`, and the relevant Cargo
  registry/git metadata in the lint job
  - split changed-path detection so the lint crate's own `cargo test` step
  runs only when `tools/argument-comment-lint/*` or `rust-ci.yml` changes
  - continue to run the repo wrapper over the `codex-rs` workspace, so
  product-code enforcement is unchanged
  
  Most of the code changes in this commit are intentionally mechanical
  comment rewrites or insertions driven by the lint itself.
  
  ## Verification
  
  - `./tools/argument-comment-lint/run.sh --workspace`
  - `cargo test -p codex-tui-app-server -p codex-tui`
  - parsed `.github/workflows/rust-ci.yml` locally with PyYAML
  
  ---
  
  * -> #14652
  * #14651

  Michael Bolin · 2026-03-16 16:48:15 -07:00
  b77fe8fefe
• fix(network-proxy): serve HTTP proxy listener as HTTP/1 (#14395)

  ## Summary
  - switch the local HTTP proxy listener from Rama's auto server to
  explicit HTTP/1 so CONNECT clients skip the version-sniffing pre-read
  path
  - move rustls crypto-provider bootstrap into the HTTP proxy runner so
  direct callers do not need hidden global init
  - add a regression test that exercises a plain HTTP/1 CONNECT request
  against a live loopback listener

  viyatb-oai · 2026-03-11 14:35:44 -07:00
  5259e5e236
• Add guardian approval MVP (#13692)

  ## Summary
  - add the guardian reviewer flow for `on-request` approvals in command,
  patch, sandbox-retry, and managed-network approval paths
  - keep guardian behind `features.guardian_approval` instead of exposing
  a public `approval_policy = guardian` mode
  - route ordinary `OnRequest` approvals to the guardian subagent when the
  feature is enabled, without changing the public approval-mode surface
  
  ## Public model
  - public approval modes stay unchanged
  - guardian is enabled via `features.guardian_approval`
  - when that feature is on, `approval_policy = on-request` keeps the same
  approval boundaries but sends those approval requests to the guardian
  reviewer instead of the user
  - `/experimental` only persists the feature flag; it does not rewrite
  `approval_policy`
  - CLI and app-server no longer expose a separate `guardian` approval
  mode in this PR
  
  ## Guardian reviewer
  - the reviewer runs as a normal subagent and reuses the existing
  subagent/thread machinery
  - it is locked to a read-only sandbox and `approval_policy = never`
  - it does not inherit user/project exec-policy rules
  - it prefers `gpt-5.4` when the current provider exposes it, otherwise
  falls back to the parent turn's active model
  - it fail-closes on timeout, startup failure, malformed output, or any
  other review error
  - it currently auto-approves only when `risk_score < 80`
  
  ## Review context and policy
  - guardian mirrors `OnRequest` approval semantics rather than
  introducing a separate approval policy
  - explicit `require_escalated` requests follow the same approval surface
  as `OnRequest`; the difference is only who reviews them
  - managed-network allowlist misses that enter the approval flow are also
  reviewed by guardian
  - the review prompt includes bounded recent transcript history plus
  recent tool call/result evidence
  - transcript entries and planned-action strings are truncated with
  explicit `<guardian_truncated ... />` markers so large payloads stay
  bounded
  - apply-patch reviews include the full patch content (without
  duplicating the structured `changes` payload)
  - the guardian request layout is snapshot-tested using the same
  model-visible Responses request formatter used elsewhere in core
  
  ## Guardian network behavior
  - the guardian subagent inherits the parent session's managed-network
  allowlist when one exists, so it can use the same approved network
  surface while reviewing
  - exact session-scoped network approvals are copied into the guardian
  session with protocol/port scope preserved
  - those copied approvals are now seeded before the guardian's first turn
  is submitted, so inherited approvals are available during any immediate
  review-time checks
  
  ## Out of scope / follow-ups
  - the sandbox-permission validation split was pulled into a separate PR
  and is not part of this diff
  - a future follow-up can enable `serde_json` preserve-order in
  `codex-core` and then simplify the guardian action rendering further
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-07 05:40:10 -08:00
  e84ee33cc0
• fix: support managed network allowlist controls (#12752)

  ## Summary
  - treat `requirements.toml` `allowed_domains` and `denied_domains` as
  managed network baselines for the proxy
  - in restricted modes by default, build the effective runtime policy
  from the managed baseline plus user-configured allowlist and denylist
  entries, so common hosts can be pre-approved without blocking later user
  expansion
  - add `experimental_network.managed_allowed_domains_only = true` to pin
  the effective allowlist to managed entries, ignore user allowlist
  additions, and hard-deny non-managed domains without prompting
  - apply `managed_allowed_domains_only` anywhere managed network
  enforcement is active, including full access, while continuing to
  respect denied domains from all sources
  - add regression coverage for merged-baseline behavior, managed-only
  behavior, and full-access managed-only enforcement
  
  ## Behavior
  Assuming `requirements.toml` defines both
  `experimental_network.allowed_domains` and
  `experimental_network.denied_domains`.
  
  ### Default mode
  - By default, the effective allowlist is
  `experimental_network.allowed_domains` plus user or persisted allowlist
  additions.
  - By default, the effective denylist is
  `experimental_network.denied_domains` plus user or persisted denylist
  additions.
  - Allowlist misses can go through the network approval flow.
  - Explicit denylist hits and local or private-network blocks are still
  hard-denied.
  - When `experimental_network.managed_allowed_domains_only = true`, only
  managed `allowed_domains` are respected, user allowlist additions are
  ignored, and non-managed domains are hard-denied without prompting.
  - Denied domains continue to be respected from all sources.
  
  ### Full access
  - With managed requirements present, the effective allowlist is pinned
  to `experimental_network.allowed_domains`.
  - With managed requirements present, the effective denylist is pinned to
  `experimental_network.denied_domains`.
  - There is no allowlist-miss approval path in full access.
  - Explicit denylist hits are hard-denied.
  - `experimental_network.managed_allowed_domains_only = true` now also
  applies in full access, so managed-only behavior remains in effect
  anywhere managed network enforcement is active.

  viyatb-oai · 2026-03-06 17:52:54 -08:00
  25fa974166
• config: add initial support for the new permission profile config language in config.toml (#13434)

  ## Why
  
  `SandboxPolicy` currently mixes together three separate concerns:
  
  - parsing layered config from `config.toml`
  - representing filesystem sandbox state
  - carrying basic network policy alongside filesystem choices
  
  That makes the existing config awkward to extend and blocks the new TOML
  proposal where `[permissions]` becomes a table of named permission
  profiles selected by `default_permissions`. (The idea is that if
  `default_permissions` is not specified, we assume the user is opting
  into the "traditional" way to configure the sandbox.)
  
  This PR adds the config-side plumbing for those profiles while still
  projecting back to the legacy `SandboxPolicy` shape that the current
  macOS and Linux sandbox backends consume.
  
  It also tightens the filesystem profile model so scoped entries only
  exist for `:project_roots`, and so nested keys must stay within a
  project root instead of using `.` or `..` traversal.
  
  This drops support for the short-lived `[permissions.network]` in
  `config.toml` because now that would be interpreted as a profile named
  `network` within `[permissions]`.
  
  ## What Changed
  
  - added `PermissionsToml`, `PermissionProfileToml`,
  `FilesystemPermissionsToml`, and `FilesystemPermissionToml` so config
  can parse named profiles under `[permissions.<profile>.filesystem]`
  - added top-level `default_permissions` selection, validation for
  missing or unknown profiles, and compilation from a named profile into
  split `FileSystemSandboxPolicy` and `NetworkSandboxPolicy` values
  - taught config loading to choose between the legacy `sandbox_mode` path
  and the profile-based path without breaking legacy users
  - introduced `codex-protocol::permissions` for the split filesystem and
  network sandbox types, and stored those alongside the legacy projected
  `sandbox_policy` in runtime `Permissions`
  - modeled `FileSystemSpecialPath` so only `ProjectRoots` can carry a
  nested `subpath`, matching the intended config syntax instead of
  allowing invalid states for other special paths
  - restricted scoped filesystem maps to `:project_roots`, with validation
  that nested entries are non-empty descendant paths and cannot use `.` or
  `..` to escape the project root
  - kept existing runtime consumers working by projecting
  `FileSystemSandboxPolicy` back into `SandboxPolicy`, with an explicit
  error for profiles that request writes outside the workspace root
  - loaded proxy settings from top-level `[network]`
  - regenerated `core/config.schema.json`
  
  ## Verification
  
  - added config coverage for profile deserialization,
  `default_permissions` selection, top-level `[network]` loading, network
  enablement, rejection of writes outside the workspace root, rejection of
  nested entries for non-`:project_roots` special paths, and rejection of
  parent-directory traversal in `:project_roots` maps
  - added protocol coverage for the legacy bridge rejecting non-workspace
  writes
  
  ## Docs
  
  - update the Codex config docs on developers.openai.com/codex to
  document named `[permissions.<profile>]` entries, `default_permissions`,
  scoped `:project_roots` syntax, the descendant-path restriction for
  nested `:project_roots` entries, and top-level `[network]` proxy
  configuration
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13434).
  * #13453
  * #13452
  * #13451
  * #13449
  * #13448
  * #13445
  * #13440
  * #13439
  * __->__ #13434

  Michael Bolin · 2026-03-06 15:39:13 -08:00
  f82678b2a4
• fix: reject global wildcard network proxy domains (#13789)

  ## Summary
  - reject the global `*` domain pattern in proxy allow/deny lists and
  managed constraints introduced for testing earlier
  - keep exact hosts plus scoped wildcards like `*.example.com` and
  `**.example.com`
  - update docs and regression tests for the new invalid-config behavior

  viyatb-oai · 2026-03-06 21:06:24 +00:00
  9a4787c240
• refactor: remove proxy admin endpoint (#13687)

  ## Summary
  - delete the network proxy admin server and its runtime listener/task
  plumbing
  - remove the admin endpoint config, runtime, requirement, protocol,
  schema, and debug-surface fields
  - update proxy docs to reflect the remaining HTTP and SOCKS listeners
  only

  viyatb-oai · 2026-03-05 22:03:16 -08:00
  6a79ed5920
• fix(network-proxy): reject mismatched host headers (#13275)

  ## Summary
  - reject plain HTTP absolute-form requests whose Host header does not
  match the request target authority
  - add host/port-aware Host header validation for non-default ports
  - add regression coverage for mismatched Host forwarding and validator
  edge cases

  viyatb-oai · 2026-03-03 15:12:06 -08:00
  24a2d0c696
• feat(network-proxy): add embedded OTEL policy audit logging (#12046)

  **PR Summary**
  
  This PR adds embedded-only OTEL policy audit logging for
  `codex-network-proxy` and threads audit metadata from `codex-core` into
  managed proxy startup.
  
  ### What changed
  - Added structured audit event emission in `network_policy.rs` with
  target `codex_otel.network_proxy`.
  - Emitted:
  - `codex.network_proxy.domain_policy_decision` once per domain-policy
  evaluation.
    - `codex.network_proxy.block_decision` for non-domain denies.
  - Added required policy/network fields, RFC3339 UTC millisecond
  `event.timestamp`, and fallback defaults (`http.request.method="none"`,
  `client.address="unknown"`).
  - Added non-domain deny audit emission in HTTP/SOCKS handlers for
  mode-guard and proxy-state denies, including unix-socket deny paths.
  - Added `REASON_UNIX_SOCKET_UNSUPPORTED` and used it for unsupported
  unix-socket auditing.
  - Added `NetworkProxyAuditMetadata` to runtime/state, re-exported from
  `lib.rs` and `state.rs`.
  - Added `start_proxy_with_audit_metadata(...)` in core config, with
  `start_proxy()` delegating to default metadata.
  - Wired metadata construction in `codex.rs` from session/auth context,
  including originator sanitization for OTEL-safe tagging.
  - Updated `network-proxy/README.md` with embedded-mode audit schema and
  behavior notes.
  - Refactored HTTP block-audit emission to a small local helper to reduce
  duplication.
  - Preserved existing unix-socket proxy-disabled host/path behavior for
  responses and blocked history while using an audit-only endpoint
  override (`server.address="unix-socket"`, `server.port=0`).
  
  ### Explicit exclusions
  - No standalone proxy OTEL startup work.
  - No `main.rs` binary wiring.
  - No `standalone_otel.rs`.
  - No standalone docs/tests.
  
  ### Tests
  - Extended `network_policy.rs` tests for event mapping, metadata
  propagation, fallbacks, timestamp format, and target prefix.
  - Extended HTTP tests to assert unix-socket deny block audit events.
  - Extended SOCKS tests to cover deny emission from handler deny
  branches.
  - Added/updated core tests to verify audit metadata threading into
  managed proxy state.
  
  ### Validation run
  - `just fmt`
  - `cargo test -p codex-network-proxy` ✅
  - `cargo test -p codex-core` ran with one unrelated flaky timeout
  (`shell_snapshot::tests::snapshot_shell_does_not_inherit_stdin`), and
  the test passed when rerun directly ✅
  
  ---------
  
  Co-authored-by: viyatb-oai <viyatb@openai.com>

  mcgrew-oai · 2026-02-25 11:46:37 -05:00
  9a393c9b6f
• feat(network-proxy): add MITM support and gate limited-mode CONNECT (#9859)

  ## Description
  - Adds MITM support (CA load/issue, TLS termination, optional body
  inspection).
  - Adds `codex-network-proxy init` to create
  `CODEX_HOME/network_proxy/mitm`.
  - Enforces limited-mode HTTPS correctly: `CONNECT` requires MITM,
  otherwise blocked with `mitm_required`.
  - Keeps `origin/main` layering/reload semantics (managed layers included
  in reload checks).
  - Centralizes block reasons (`REASON_MITM_REQUIRED`) and removes
  `println!`.
  - Scope is MITM-only (no SOCKS changes).
  
  gated by `mitm=false` (default)

  viyatb-oai · 2026-02-24 18:15:15 +00:00
  8d3d58f992
• feat(core): persist network approvals in execpolicy (#12357)

  ## Summary
  Persist network approval allow/deny decisions as `network_rule(...)`
  entries in execpolicy (not proxy config)
  
  It adds `network_rule` parsing + append support in `codex-execpolicy`,
  including `decision="prompt"` (parse-only; not compiled into proxy
  allow/deny lists)
  - compile execpolicy network rules into proxy allow/deny lists and
  update the live proxy state on approval
  - preserve requirements execpolicy `network_rule(...)` entries when
  merging with file-based execpolicy
  - reject broad wildcard hosts (for example `*`) for persisted
  `network_rule(...)`

  viyatb-oai · 2026-02-23 21:37:46 -08:00
  c3048ff90a
• fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368)

  ## Summary
  Adds support for a Unix socket escape hatch so we can bypass socket
  allowlisting when explicitly enabled.
  
  ## Description
  * added a new flag, `network.dangerously_allow_all_unix_sockets` as an
  explicit escape hatch
  * In codex-network-proxy, enabling that flag now allows any absolute
  Unix socket path from x-unix-socket instead of requiring each path to be
  explicitly allowlisted. Relative paths are still rejected.
  * updated the macOS seatbelt path in core so it enforces the same Unix
  socket behavior:
    * allowlisted sockets generate explicit network* subpath rules
    * allow-all generates a broad network* (subpath "/") rule
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-20 10:56:57 -08:00
  28c0089060
• Refactor network approvals to host/protocol/port scope (#12140)

  ## Summary
  Simplify network approvals by removing per-attempt proxy correlation and
  moving to session-level approval dedupe keyed by (host, protocol, port).
  Instead of encoding attempt IDs into proxy credentials/URLs, we now
  treat approvals as a destination policy decision.
  
  - Concurrent calls to the same destination share one approval prompt.
  - Different destinations (or same host on different ports) get separate
  prompts.
  - Allow once approves the current queued request group only.
  - Allow for session caches that (host, protocol, port) and auto-allows
  future matching requests.
  - Never policy continues to deny without prompting.
  
  Example:
  - 3 calls: 
    - a.com (line 443)
    - b.com (line 443)
    - a.com (line 443)
  => 2 prompts total (a, b), second a waits on the first decision.
  - a.com:80 is treated separately from a.com line 443
  
  ## Testing
  - `just fmt` (in `codex-rs`)
  - `cargo test -p codex-core tools::network_approval::tests`
  - `cargo test -p codex-core` (unit tests pass; existing
  integration-suite failures remain in this environment)

  viyatb-oai · 2026-02-20 10:39:55 -08:00
  e8afaed502
• feat(network-proxy): add websocket proxy env support (#11784)

  ## Summary
  - add managed proxy env wiring for websocket-specific variables
  (`WS_PROXY`/`WSS_PROXY`, including lowercase)
  - keep websocket proxy vars aligned with the existing managed HTTP proxy
  endpoint
  - add CONNECT regression tests to cover allowlist and denylist decisions
  (websocket tunnel path)
  - document websocket proxy usage and CONNECT policy behavior in the
  network proxy README
  
  ## Testing
  - just fmt
  - cargo test -p codex-network-proxy
  - cargo clippy -p codex-network-proxy
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-17 13:49:43 -08:00
  f2ad519a87
• feat(core): add structured network approval plumbing and policy decision model (#11672)

  ### Description
  #### Summary
  Introduces the core plumbing required for structured network approvals
  
  #### What changed
  - Added structured network policy decision modeling in core.
  - Added approval payload/context types needed for network approval
  semantics.
  - Wired shell/unified-exec runtime plumbing to consume structured
  decisions.
  - Updated related core error/event surfaces for structured handling.
  - Updated protocol plumbing used by core approval flow.
  - Included small CLI debug sandbox compatibility updates needed by this
  layer.
  
  #### Why
  establishes the minimal backend foundation for network approvals without
  yet changing high-level orchestration or TUI behavior.
  
  #### Notes
  - Behavior remains constrained by existing requirements/config gating.
  - Follow-up PRs in the stack handle orchestration, UX, and app-server
  integration.
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-14 04:18:12 +00:00
  b527ee2890
• feat(network-proxy): structured policy signaling and attempt correlation to core (#11662)

  ## Summary
  When network requests were blocked, downstream code often had to infer
  ask vs deny from free-form response text. That was brittle and led to
  incorrect approval behavior.
  This PR fixes the proxy side so blocked decisions are structured and
  request metadata survives reliably.
  
  ## Description
  - Blocked proxy responses now carry consistent structured policy
  decision data.
  - Request attempt metadata is preserved across proxy env paths
  (including ALL_PROXY flows).
  - Header stripping was tightened so we still remove unsafe forwarding
  headers, but keep metadata needed for policy handling.
  - Block messages were clarified (for example, allowlist miss vs explicit
  deny).
  - Added unified violation log entries so policy failures can be
  inspected in one place.
  - Added/updated tests for these behaviors.
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-13 09:01:11 +00:00
  2bced810da
• Enable SOCKS defaults for common local network proxy use cases (#11362)

  ## Summary
  - enable local-use defaults in network proxy settings: SOCKS5 on, SOCKS5
  UDP on, upstream proxying on, and local binding on
  - add a regression test that asserts the full
  `NetworkProxySettings::default()` baseline
  - Fixed managed listener reservation behavior.
  Before: we always reserved a loopback SOCKS listener, even when
  enable_socks5 = false.
  Now: SOCKS listener is only reserved when SOCKS is enabled.
  - Fixed /debug-config env output for SOCKS-disabled sessions.
  ALL_PROXY now shows the HTTP proxy URL when SOCKS is disabled (instead
  of incorrectly showing socks5h://...).
  
  
  ## Validation
  - just fmt
  - cargo test -p codex-network-proxy
  - cargo clippy -p codex-network-proxy --all-targets

  viyatb-oai · 2026-02-10 15:13:52 -08:00
  1d47927aa0
• feat: retain NetworkProxy, when appropriate (#11207)

  As of this PR, `SessionServices` retains a
  `Option<StartedNetworkProxy>`, if appropriate.
  
  Now the `network` field on `Config` is `Option<NetworkProxySpec>`
  instead of `Option<NetworkProxy>`.
  
  Over in `Session::new()`, we invoke `NetworkProxySpec::start_proxy()` to
  create the `StartedNetworkProxy`, which is a new struct that retains the
  `NetworkProxy` as well as the `NetworkProxyHandle`. (Note that `Drop` is
  implemented for `NetworkProxyHandle` to ensure the proxies are shutdown
  when it is dropped.)
  
  The `NetworkProxy` from the `StartedNetworkProxy` is threaded through to
  the appropriate places.
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/11207).
  * #11285
  * __->__ #11207

  Michael Bolin · 2026-02-10 02:09:23 -08:00
  44ebf4588f
• chore: put crypto provider logic in a shared crate (#11294)

  Ensures a process-wide rustls crypto provider is installed.
  
  Both the `codex-network-proxy` and `codex-api` crates need this.

  Michael Bolin · 2026-02-10 01:04:31 -08:00
  8e240a13be
• feat(sandbox): enforce proxy-aware network routing in sandbox (#11113)

  ## Summary
  - expand proxy env injection to cover common tool env vars
  (`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`/`NO_PROXY` families +
  tool-specific variants)
  - harden macOS Seatbelt network policy generation to route through
  inferred loopback proxy endpoints and fail closed when proxy env is
  malformed
  - thread proxy-aware Linux sandbox flags and add minimal bwrap netns
  isolation hook for restricted non-proxy runs
  - add/refresh tests for proxy env wiring, Seatbelt policy generation,
  and Linux sandbox argument wiring

  viyatb-oai · 2026-02-10 07:44:21 +00:00
  3391e5ea86
• feat: reserve loopback ephemeral listeners for managed proxy (#11269)

  Codex may run many per-thread proxy instances, so hardcoded proxy ports
  are brittle and conflict-prone. The previous "ephemeral" approach still
  had a race: `build()` read `local_addr()` from temporary listeners and
  dropped them before `run()` rebound the ports. That left a
  [TOCTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use)
  window where the OS (or another process) could reuse the same port,
  causing intermittent `EADDRINUSE` and partial proxy startup.
  
  Change the managed proxy path to reserve real listener sockets up front
  and keep them alive until startup:
  
  - add `ReservedListeners` on `NetworkProxy` to hold HTTP/SOCKS/admin std
  listeners allocated during `build()`
  - in managed mode, bind `127.0.0.1:0` for each listener and carry those
  bound sockets into `run()` instead of rebinding by address later
  - add `run_*_with_std_listener` entry points for HTTP, SOCKS5, and admin
  servers so `run()` can start services from already-reserved sockets
  - keep static/configured ports only when `managed_by_codex(false)`,
  including explicit `socks_addr` override support
  - remove fallback synthetic port allocation and add tests for managed
  ephemeral loopback binding and unmanaged configured-port behavior
  
  This makes managed startup deterministic, avoids port collisions, and
  preserves the intended distinction between Codex-managed ephemeral ports
  and externally managed fixed ports.

  Michael Bolin · 2026-02-10 06:11:02 +00:00
  503186b31f
• chore: change ConfigState so it no longer depends on a single config.toml file for reloading (#11262)

  If anything, it should depend on `ConfigLayerStack`.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/11262).
  * #11207
  * __->__ #11262

  Michael Bolin · 2026-02-09 19:26:39 -08:00
  862ab63071
• feat: include NetworkConfig through ExecParams (#11105)

  This PR adds the following field to `Config`:
  
  ```rust
  pub network: Option<NetworkProxy>,
  ```
  
  Though for the moment, it will always be initialized as `None` (this
  will be addressed in a subsequent PR).
  
  This PR does the work to thread `network` through to `execute_exec_env()`, `process_exec_tool_call()`, and `UnifiedExecRuntime.run()` to ensure it is available whenever we span a process.

  Michael Bolin · 2026-02-09 03:32:17 +00:00
  383b45279e
• chore: reverse the codex-network-proxy -> codex-core dependency (#11121)
  Michael Bolin · 2026-02-08 17:03:24 -08:00
  ff74aaae21
• chore: refactor network-proxy so that ConfigReloader is injectable behavior (#11114)

  Currently, `codex-network-proxy` depends on `codex-core`, but this
  should be the other way around. As a first step, refactor out
  `ConfigReloader`, which should make it easier to move
  `codex-rs/network-proxy/src/state.rs` to `codex-core` in a subsequent
  commit.

  Michael Bolin · 2026-02-08 22:28:20 +00:00
  ef5d26e586
• feat: enable premessage-deflate for websockets (#10966)

  note:
  unfortunately, tokio-tungstenite / tungstenite upgrade triggers some
  problems with linker of rama-tls-boring with openssl:
  ```
  error: linking with `/Users/apanasenko/Library/Caches/cargo-zigbuild/0.20.1/zigcc-x86_64-unknown-linux-musl-ff6a.sh` failed: exit status: 1
    |
    = note:  "/Users/apanasenko/Library/Caches/cargo-zigbuild/0.20.1/zigcc-x86_64-unknown-linux-musl-ff6a.sh" "-m64" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/rcrt1.o" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crti.o" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crtbeginS.o" "<1 object files omitted>" "-Wl,--as-needed" "-Wl,-Bstatic" "/var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/{liblzma_sys-662a82316f96ec30,libbzip2_sys-bf78a2d58d5cbce6,liblibsqlite3_sys-6c004987fd67a36a,libtree_sitter_bash-220b99a97d331ab7,libtree_sitter-858f0a1dbfea58bd,libzstd_sys-6eb237deec748c5b,libring-2a87376483bf916f,libopenssl_sys-7c189e68b37fe2bb,liblibz_sys-4344eef4345520b1,librama_boring_sys-0414e98115015ee0}.rlib" "-lc++" "-lc++abi" "-lunwind" "-lc" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/libcompiler_builtins-*.rlib" "-L" "/var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/raw-dylibs" "-Wl,-Bdynamic" "-Wl,--eh-frame-hdr" "-Wl,-z,noexecstack" "-nostartfiles" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/libz-sys-ff5ea50d88c28ffb/out/lib" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/ring-bdec3dddc19f5a5e/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/openssl-sys-96e0870de3ca22bc/out/openssl-build/install/lib" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/zstd-sys-0cc37a5da1481740/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/tree-sitter-72d2418073317c0f/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/tree-sitter-bash-bfd293a9f333ce6a/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/libsqlite3-sys-b78b2cfb81a330fc/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/bzip2-sys-69a145cc859ef275/out/lib" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/lzma-sys-07e92d0b6baa6fd4/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/crypto/" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/ssl/" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build" "-L" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained" "-L" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib" "-o" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/deps/codex_network_proxy-d08268b863517761" "-Wl,--gc-sections" "-static-pie" "-Wl,-z,relro,-z,now" "-Wl,-O1" "-Wl,--strip-all" "-nodefaultlibs" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crtendS.o" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crtn.o"
    = note: some arguments are omitted. use `--verbose` to show all linker arguments
    = note: warning: ignoring deprecated linker optimization setting '1'
            warning: unable to open library directory '/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/crypto/': FileNotFound
            ld.lld: error: duplicate symbol: SSL_export_keying_material
            >>> defined at ssl_lib.c:3816 (ssl/ssl_lib.c:3816)
            >>>            libssl-lib-ssl_lib.o:(SSL_export_keying_material) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/libopenssl_sys-7c189e68b37fe2bb.rlib
            >>> defined at t1_enc.cc:205 (/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/boringssl/ssl/t1_enc.cc:205)
            >>>            t1_enc.cc.o:(.text.SSL_export_keying_material+0x0) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/librama_boring_sys-0414e98115015ee0.rlib
  
            ld.lld: error: duplicate symbol: d2i_ASN1_TIME
            >>> defined at a_time.c:27 (crypto/asn1/a_time.c:27)
            >>>            libcrypto-lib-a_time.o:(d2i_ASN1_TIME) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/libopenssl_sys-7c189e68b37fe2bb.rlib
            >>> defined at a_time.cc:34 (/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/boringssl/crypto/asn1/a_time.cc:34)
            >>>            a_time.cc.o:(.text.d2i_ASN1_TIME+0x0) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/librama_boring_sys-0414e98115015ee0.rlib
  ``` 
  
  that force me to migrate away from rama-tls-boring to rama-tls-rustls
  and pin `ring` for rustls.

  Anton Panasenko · 2026-02-07 17:59:34 -08:00
  a94505a92a
• refactor(network-proxy): flatten network config under [network] (#10965)

  Summary:
  - Rename config table from network_proxy to network.
  - Flatten allowed_domains, denied_domains, allow_unix_sockets, and
  allow_local_binding onto NetworkProxySettings.
  - Update runtime, state constraints, tests, and README to the new config
  shape.

  viyatb-oai · 2026-02-07 05:22:44 +00:00
  8cd46ebad6
• feat(network-proxy): add structured policy decision to blocked errors (#10420)

  ## Summary
  Add explicit, model-visible network policy decision metadata to blocked
  proxy responses/errors.
  
  Introduces a standardized prefix line: `CODEX_NETWORK_POLICY_DECISION
  {json}`
  
  and wires it through blocked paths for:
  - HTTP requests
  - HTTPS CONNECT
  - SOCKS5 TCP/UDP denials
  
  ## Why
  The model should see *why* a request was blocked
  (reason/source/protocol/host/port) so it can choose the correct next
  action.
  
  ## Notes
  - This PR is intentionally independent of config-layering/network-rule
  runtime integration.
  - Focus is blocked decision surface only.

  viyatb-oai · 2026-02-06 10:46:50 -08:00
  db0d8710d5
• Wire up cloud reqs in exec, app-server (#10241)

  We're fetching cloud requirements in TUI in
  https://github.com/openai/codex/pull/10167.
  
  This adds the same fetching in exec and app-server binaries also.

  gt-oai · 2026-01-30 23:53:41 +00:00
  a046481ad9
• Fetch Requirements from cloud (#10167)

  Load requirements from Codex Backend. It only does this for enterprise
  customers signed in with ChatGPT.
  
  Todo in follow-up PRs:
  * Add to app-server and exec too
  * Switch from fail-open to fail-closed on failure

  gt-oai · 2026-01-30 12:03:29 +00:00
  e85d019daa
• chore: introduce *Args types for new() methods (#10009)

  Constructors with long param lists can be hard to reason about when a
  number of the args are `None`, in practice. Introducing a struct to use
  as the args type helps make things more self-documenting.

  Michael Bolin · 2026-01-27 19:15:38 +00:00
  700a29e157
• feat(network-proxy): add a SOCKS5 proxy with policy enforcement (#9803)

  ### Summary
  - Adds an optional SOCKS5 listener via `rama-socks5`
  - SOCKS5 is disabled by default and gated by config
  - Reuses existing policy enforcement and blocked-request recording
  - Blocks SOCKS5 in limited mode to prevent method-policy bypass
  - Applies bind clamping to the SOCKS5 listener
  
  ### Config
  New/used fields under `network_proxy`:
  - `enable_socks5`
  - `socks_url`
  - `enable_socks5_udp`
  
  ### Scope
  - Changes limited to `codex-rs/network-proxy` (+ `codex-rs/Cargo.lock`)
  
  ### Testing
  ```bash
  cd codex-rs
  just fmt
  cargo test -p codex-network-proxy --offline

  viyatb-oai · 2026-01-27 10:09:39 -08:00
  877b76bb9d
• feat: introducing a network sandbox proxy (#8442)

  This add a new crate, `codex-network-proxy`, a local network proxy
  service used by Codex to enforce fine-grained network policy (domain
  allow/deny) and to surface blocked network events for interactive
  approvals.
  
  - New crate: `codex-rs/network-proxy/` (`codex-network-proxy` binary +
  library)
  - Core capabilities:
    - HTTP proxy support (including CONNECT tunneling)
    - SOCKS5 proxy support (in the later PR)
  - policy evaluation (allowed/denied domain lists; denylist wins;
  wildcard support)
    - small admin API for polling/reload/mode changes
  - optional MITM support for HTTPS CONNECT to enforce “limited mode”
  method restrictions (later PR)
  
  Will follow up integration with codex in subsequent PRs.
  
  ## Testing
  
  - `cd codex-rs && cargo build -p codex-network-proxy`
  - `cd codex-rs && cargo run -p codex-network-proxy -- proxy`

  viyatb-oai · 2026-01-23 17:47:09 -08:00
  77222492f9