40 Commits

• fix: clean up remaining Windows argument-comment-lint violations (#16071)

  ## Why
  
  The initial `argument-comment-lint` rollout left Windows on
  default-target coverage because there were still Windows-only callsites
  failing under `--all-targets`. This follow-up cleans up those remaining
  Windows-specific violations so the Windows CI lane can enforce the same
  stricter coverage, leaving Linux as the remaining platform-specific
  follow-up.
  
  ## What changed
  
  - switched the Windows `rust-ci` argument-comment-lint step back to the
  default wrapper invocation so it runs full-target coverage again
  - added the required `/*param_name*/` annotations at Windows-gated
  literal callsites in:
    - `codex-rs/windows-sandbox-rs/src/lib.rs`
    - `codex-rs/windows-sandbox-rs/src/elevated_impl.rs`
    - `codex-rs/tui_app_server/src/multi_agents.rs`
    - `codex-rs/network-proxy/src/proxy.rs`
  
  ## Validation
  
  - Windows `argument comment lint` CI on this PR

  Michael Bolin · 2026-03-27 20:48:21 -07:00
  e02fd6e1d3
• chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

  ## Why
  
  `argument-comment-lint` was green in CI even though the repo still had
  many uncommented literal arguments. The main gap was target coverage:
  the repo wrapper did not force Cargo to inspect test-only call sites, so
  examples like the `latest_session_lookup_params(true, ...)` tests in
  `codex-rs/tui_app_server/src/lib.rs` never entered the blocking CI path.
  
  This change cleans up the existing backlog, makes the default repo lint
  path cover all Cargo targets, and starts rolling that stricter CI
  enforcement out on the platform where it is currently validated.
  
  ## What changed
  
  - mechanically fixed existing `argument-comment-lint` violations across
  the `codex-rs` workspace, including tests, examples, and benches
  - updated `tools/argument-comment-lint/run-prebuilt-linter.sh` and
  `tools/argument-comment-lint/run.sh` so non-`--fix` runs default to
  `--all-targets` unless the caller explicitly narrows the target set
  - fixed both wrappers so forwarded cargo arguments after `--` are
  preserved with a single separator
  - documented the new default behavior in
  `tools/argument-comment-lint/README.md`
  - updated `rust-ci` so the macOS lint lane keeps the plain wrapper
  invocation and therefore enforces `--all-targets`, while Linux and
  Windows temporarily pass `-- --lib --bins`
  
  That temporary CI split keeps the stricter all-targets check where it is
  already cleaned up, while leaving room to finish the remaining Linux-
  and Windows-specific target-gated cleanup before enabling
  `--all-targets` on those runners. The Linux and Windows failures on the
  intermediate revision were caused by the wrapper forwarding bug, not by
  additional lint findings in those lanes.
  
  ## Validation
  
  - `bash -n tools/argument-comment-lint/run.sh`
  - `bash -n tools/argument-comment-lint/run-prebuilt-linter.sh`
  - shell-level wrapper forwarding check for `-- --lib --bins`
  - shell-level wrapper forwarding check for `-- --tests`
  - `just argument-comment-lint`
  - `cargo test` in `tools/argument-comment-lint`
  - `cargo test -p codex-terminal-detection`
  
  ## Follow-up
  
  - Clean up remaining Linux-only target-gated callsites, then switch the
  Linux lint lane back to the plain wrapper invocation.
  - Clean up remaining Windows-only target-gated callsites, then switch
  the Windows lint lane back to the plain wrapper invocation.

  Michael Bolin · 2026-03-27 19:00:44 -07:00
  61dfe0b86c
• chore: refactor network permissions to use explicit domain and unix socket rule maps (#15120)

  ## Summary
  
  This PR replaces the legacy network allow/deny list model with explicit
  rule maps for domains and unix sockets across managed requirements,
  permissions profiles, the network proxy config, and the app server
  protocol.
  
  Concretely, it:
  
  - introduces typed domain (`allow` / `deny`) and unix socket permission
  (`allow` / `none`) entries instead of separate `allowed_domains`,
  `denied_domains`, and `allow_unix_sockets` lists
  - updates config loading, managed requirements merging, and exec-policy
  overlays to read and upsert rule entries consistently
  - exposes the new shape through protocol/schema outputs, debug surfaces,
  and app-server config APIs
  - rejects the legacy list-based keys and updates docs/tests to reflect
  the new config format
  
  ## Why
  
  The previous representation split related network policy across multiple
  parallel lists, which made merging and overriding rules harder to reason
  about. Moving to explicit keyed permission maps gives us a single source
  of truth per host/socket entry, makes allow/deny precedence clearer, and
  gives protocol consumers access to the full rule state instead of
  derived projections only.
  
  ## Backward Compatibility
  
  ### Backward compatible
  
  - Managed requirements still accept the legacy
  `experimental_network.allowed_domains`,
  `experimental_network.denied_domains`, and
  `experimental_network.allow_unix_sockets` fields. They are normalized
  into the new canonical `domains` and `unix_sockets` maps internally.
  - App-server v2 still deserializes legacy `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` payloads, so older clients can
  continue reading managed network requirements.
  - App-server v2 responses still populate `allowedDomains`,
  `deniedDomains`, and `allowUnixSockets` as legacy compatibility views
  derived from the canonical maps.
  - `managed_allowed_domains_only` keeps the same behavior after
  normalization. Legacy managed allowlists still participate in the same
  enforcement path as canonical `domains` entries.
  
  ### Not backward compatible
  
  - Permissions profiles under `[permissions.<profile>.network]` no longer
  accept the legacy list-based keys. Those configs must use the canonical
  `[domains]` and `[unix_sockets]` tables instead of `allowed_domains`,
  `denied_domains`, or `allow_unix_sockets`.
  - Managed `experimental_network` config cannot mix canonical and legacy
  forms in the same block. For example, `domains` cannot be combined with
  `allowed_domains` or `denied_domains`, and `unix_sockets` cannot be
  combined with `allow_unix_sockets`.
  - The canonical format can express explicit `"none"` entries for unix
  sockets, but those entries do not round-trip through the legacy
  compatibility fields because the legacy fields only represent allow/deny
  lists.
  ## Testing
  `/target/debug/codex sandbox macos --log-denials /bin/zsh -c 'curl
  https://www.example.com' ` gives 200 with config
  ```
  [permissions.workspace.network.domains]
  "www.example.com" = "allow"
  ```
  and fails when set to deny: `curl: (56) CONNECT tunnel failed, response
  403`.
  
  Also tested backward compatibility path by verifying that adding the
  following to `/etc/codex/requirements.toml` works:
  ```
  [experimental_network]
  allowed_domains = ["www.example.com"]
  ```

  Celia Chen · 2026-03-27 06:17:59 +00:00
  dd30c8eedd
• feat(windows-sandbox): add network proxy support (#12220)

  ## Summary
  
  This PR makes Windows sandbox proxying enforceable by routing proxy-only
  runs through the existing `offline` sandbox user and reserving direct
  network access for the existing `online` sandbox user.
  
  In brief:
  
  - if a Windows sandbox run should be proxy-enforced, we run it as the
  `offline` user
  - the `offline` user gets firewall rules that block direct outbound
  traffic and only permit the configured localhost proxy path
  - if a Windows sandbox run should have true direct network access, we
  run it as the `online` user
  - no new sandbox identity is introduced
  
  This brings Windows in line with the intended model: proxy use is not
  just env-based, it is backed by OS-level egress controls. Windows
  already has two sandbox identities:
  
  - `offline`: intended to have no direct network egress
  - `online`: intended to have full network access
  
  This PR makes proxy-enforced runs use that model directly.
  
  ### Proxy-enforced runs
  
  When proxy enforcement is active:
  
  - the run is assigned to the `offline` identity
  - setup extracts the loopback proxy ports from the sandbox env
  - Windows setup programs firewall rules for the `offline` user that:
    - block all non-loopback outbound traffic
    - block loopback UDP
    - block loopback TCP except for the configured proxy ports
  - optionally allow broader localhost access when `allow_local_binding=1`
  
  So the sandboxed process can only talk to the local proxy. It cannot
  open direct outbound sockets or do local UDP-based DNS on its own.The
  proxy then performs the real outbound network access outside that
  restricted sandbox identity.
  
  ### Direct-network runs
  
  When proxy enforcement is not active and full network access is allowed:
  
  - the run is assigned to the `online` identity
  - no proxy-only firewall restrictions are applied
  - the process gets normal direct network access
  
  ### Unelevated vs elevated
  
  The restricted-token / unelevated path cannot enforce per-identity
  firewall policy by itself.
  
  So for Windows proxy-enforced runs, we transparently use the logon-user
  sandbox path under the hood, even if the caller started from the
  unelevated mode. That keeps enforcement real instead of best-effort.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  viyatb-oai · 2026-03-26 17:27:38 -07:00
  81fa04783a
• fix(network-proxy): fail closed on network-proxy DNS lookup errors (#15909)

  ## Summary
  
  Fail closed when the network proxy's local/private IP pre-check hits a
  DNS lookup error or timeout, instead of treating the hostname as public
  and allowing the request.
  
  ## Root cause
  
  `host_resolves_to_non_public_ip()` returned `false` on resolver failure,
  which created a fail-open path in the `allow_local_binding = false`
  boundary. The eventual connect path performs its own DNS resolution
  later, so a transient pre-check failure is not evidence that the
  destination is public.
  
  ## Changes
  
  - Treat DNS lookup errors/timeouts as local/private for blocking
  purposes
  - Add a regression test for an allowlisted hostname that fails DNS
  resolution
  
  ## Validation
  
  - `cargo test -p codex-network-proxy`
  - `cargo clippy -p codex-network-proxy --all-targets -- -D warnings`
  - `just fmt`
  - `just argument-comment-lint`

  viyatb-oai · 2026-03-26 23:18:04 +00:00
  aea82c63ea
• Add wildcard in the middle test coverage (#15813)

  ## Summary
  Add a focused codex network proxy unit test for the denylist pattern
  with wildcard in the middle `region*.some.malicious.tunnel.com`. This
  does not change how existing code works, just ensure that behavior stays
  the same and we got CI guards to guard existin behavior.
  
  ## Why
  The managed Codex denylist update relies on this mid label glob form,
  and the existing tests only covered exact hosts, `*.` subdomains, and
  `**.` apex plus subdomains.
  
  ## Validation
  `cargo test -p codex-network-proxy
  compile_globset_supports_mid_label_wildcards`
  `cargo test -p codex-network-proxy`
  `./tools/argument-comment-lint/run-prebuilt-linter.sh -p
  codex-network-proxy`

  evawong-oai · 2026-03-26 17:53:31 +00:00
  0bd34c28c7
• Allow global network allowlist wildcard (#15549)

  ## Problem
  
  Today `codex-network-proxy` rejects a global `*` in
  `network.allowed_domains`, so there is no static way to configure a
  denylist-only posture for public hosts. Users have to enumerate broad
  allowlist patterns instead.
  
  ## Approach
  
  - Make global wildcard acceptance field-specific: `allowed_domains` can
  use `*`, while `denied_domains` still rejects a global wildcard.
  - Keep the existing evaluation order, so explicit denies still win first
  and local/private protections still apply unless separately enabled.
  - Add coverage for the denylist-only behavior and update the README to
  document it.
  
  ## Validation
  
  - `just fmt`
  - `cargo test -p codex-network-proxy` (full run had one unrelated flaky
  telemetry test:
  `network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event`;
  reran in isolation and it passed)
  - `cargo test -p codex-network-proxy
  network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event
  -- --exact --nocapture`
  - `just fix -p codex-network-proxy`
  - `just argument-comment-lint`

  rreichel3-oai · 2026-03-24 10:43:46 -04:00
  1db6cb9789
• Apply argument comment lint across codex-rs (#14652)

  ## Why
  
  Once the repo-local lint exists, `codex-rs` needs to follow the
  checked-in convention and CI needs to keep it from drifting. This commit
  applies the fallback `/*param*/` style consistently across existing
  positional literal call sites without changing those APIs.
  
  The longer-term preference is still to avoid APIs that require comments
  by choosing clearer parameter types and call shapes. This PR is
  intentionally the mechanical follow-through for the places where the
  existing signatures stay in place.
  
  After rebasing onto newer `main`, the rollout also had to cover newly
  introduced `tui_app_server` call sites. That made it clear the first cut
  of the CI job was too expensive for the common path: it was spending
  almost as much time installing `cargo-dylint` and re-testing the lint
  crate as a representative test job spends running product tests. The CI
  update keeps the full workspace enforcement but trims that extra
  overhead from ordinary `codex-rs` PRs.
  
  ## What changed
  
  - keep a dedicated `argument_comment_lint` job in `rust-ci`
  - mechanically annotate remaining opaque positional literals across
  `codex-rs` with exact `/*param*/` comments, including the rebased
  `tui_app_server` call sites that now fall under the lint
  - keep the checked-in style aligned with the lint policy by using
  `/*param*/` and leaving string and char literals uncommented
  - cache `cargo-dylint`, `dylint-link`, and the relevant Cargo
  registry/git metadata in the lint job
  - split changed-path detection so the lint crate's own `cargo test` step
  runs only when `tools/argument-comment-lint/*` or `rust-ci.yml` changes
  - continue to run the repo wrapper over the `codex-rs` workspace, so
  product-code enforcement is unchanged
  
  Most of the code changes in this commit are intentionally mechanical
  comment rewrites or insertions driven by the lint itself.
  
  ## Verification
  
  - `./tools/argument-comment-lint/run.sh --workspace`
  - `cargo test -p codex-tui-app-server -p codex-tui`
  - parsed `.github/workflows/rust-ci.yml` locally with PyYAML
  
  ---
  
  * -> #14652
  * #14651

  Michael Bolin · 2026-03-16 16:48:15 -07:00
  b77fe8fefe
• fix(network-proxy): serve HTTP proxy listener as HTTP/1 (#14395)

  ## Summary
  - switch the local HTTP proxy listener from Rama's auto server to
  explicit HTTP/1 so CONNECT clients skip the version-sniffing pre-read
  path
  - move rustls crypto-provider bootstrap into the HTTP proxy runner so
  direct callers do not need hidden global init
  - add a regression test that exercises a plain HTTP/1 CONNECT request
  against a live loopback listener

  viyatb-oai · 2026-03-11 14:35:44 -07:00
  5259e5e236
• Add guardian approval MVP (#13692)

  ## Summary
  - add the guardian reviewer flow for `on-request` approvals in command,
  patch, sandbox-retry, and managed-network approval paths
  - keep guardian behind `features.guardian_approval` instead of exposing
  a public `approval_policy = guardian` mode
  - route ordinary `OnRequest` approvals to the guardian subagent when the
  feature is enabled, without changing the public approval-mode surface
  
  ## Public model
  - public approval modes stay unchanged
  - guardian is enabled via `features.guardian_approval`
  - when that feature is on, `approval_policy = on-request` keeps the same
  approval boundaries but sends those approval requests to the guardian
  reviewer instead of the user
  - `/experimental` only persists the feature flag; it does not rewrite
  `approval_policy`
  - CLI and app-server no longer expose a separate `guardian` approval
  mode in this PR
  
  ## Guardian reviewer
  - the reviewer runs as a normal subagent and reuses the existing
  subagent/thread machinery
  - it is locked to a read-only sandbox and `approval_policy = never`
  - it does not inherit user/project exec-policy rules
  - it prefers `gpt-5.4` when the current provider exposes it, otherwise
  falls back to the parent turn's active model
  - it fail-closes on timeout, startup failure, malformed output, or any
  other review error
  - it currently auto-approves only when `risk_score < 80`
  
  ## Review context and policy
  - guardian mirrors `OnRequest` approval semantics rather than
  introducing a separate approval policy
  - explicit `require_escalated` requests follow the same approval surface
  as `OnRequest`; the difference is only who reviews them
  - managed-network allowlist misses that enter the approval flow are also
  reviewed by guardian
  - the review prompt includes bounded recent transcript history plus
  recent tool call/result evidence
  - transcript entries and planned-action strings are truncated with
  explicit `<guardian_truncated ... />` markers so large payloads stay
  bounded
  - apply-patch reviews include the full patch content (without
  duplicating the structured `changes` payload)
  - the guardian request layout is snapshot-tested using the same
  model-visible Responses request formatter used elsewhere in core
  
  ## Guardian network behavior
  - the guardian subagent inherits the parent session's managed-network
  allowlist when one exists, so it can use the same approved network
  surface while reviewing
  - exact session-scoped network approvals are copied into the guardian
  session with protocol/port scope preserved
  - those copied approvals are now seeded before the guardian's first turn
  is submitted, so inherited approvals are available during any immediate
  review-time checks
  
  ## Out of scope / follow-ups
  - the sandbox-permission validation split was pulled into a separate PR
  and is not part of this diff
  - a future follow-up can enable `serde_json` preserve-order in
  `codex-core` and then simplify the guardian action rendering further
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Charley Cunningham · 2026-03-07 05:40:10 -08:00
  e84ee33cc0
• fix: support managed network allowlist controls (#12752)

  ## Summary
  - treat `requirements.toml` `allowed_domains` and `denied_domains` as
  managed network baselines for the proxy
  - in restricted modes by default, build the effective runtime policy
  from the managed baseline plus user-configured allowlist and denylist
  entries, so common hosts can be pre-approved without blocking later user
  expansion
  - add `experimental_network.managed_allowed_domains_only = true` to pin
  the effective allowlist to managed entries, ignore user allowlist
  additions, and hard-deny non-managed domains without prompting
  - apply `managed_allowed_domains_only` anywhere managed network
  enforcement is active, including full access, while continuing to
  respect denied domains from all sources
  - add regression coverage for merged-baseline behavior, managed-only
  behavior, and full-access managed-only enforcement
  
  ## Behavior
  Assuming `requirements.toml` defines both
  `experimental_network.allowed_domains` and
  `experimental_network.denied_domains`.
  
  ### Default mode
  - By default, the effective allowlist is
  `experimental_network.allowed_domains` plus user or persisted allowlist
  additions.
  - By default, the effective denylist is
  `experimental_network.denied_domains` plus user or persisted denylist
  additions.
  - Allowlist misses can go through the network approval flow.
  - Explicit denylist hits and local or private-network blocks are still
  hard-denied.
  - When `experimental_network.managed_allowed_domains_only = true`, only
  managed `allowed_domains` are respected, user allowlist additions are
  ignored, and non-managed domains are hard-denied without prompting.
  - Denied domains continue to be respected from all sources.
  
  ### Full access
  - With managed requirements present, the effective allowlist is pinned
  to `experimental_network.allowed_domains`.
  - With managed requirements present, the effective denylist is pinned to
  `experimental_network.denied_domains`.
  - There is no allowlist-miss approval path in full access.
  - Explicit denylist hits are hard-denied.
  - `experimental_network.managed_allowed_domains_only = true` now also
  applies in full access, so managed-only behavior remains in effect
  anywhere managed network enforcement is active.

  viyatb-oai · 2026-03-06 17:52:54 -08:00
  25fa974166
• config: add initial support for the new permission profile config language in config.toml (#13434)

  ## Why
  
  `SandboxPolicy` currently mixes together three separate concerns:
  
  - parsing layered config from `config.toml`
  - representing filesystem sandbox state
  - carrying basic network policy alongside filesystem choices
  
  That makes the existing config awkward to extend and blocks the new TOML
  proposal where `[permissions]` becomes a table of named permission
  profiles selected by `default_permissions`. (The idea is that if
  `default_permissions` is not specified, we assume the user is opting
  into the "traditional" way to configure the sandbox.)
  
  This PR adds the config-side plumbing for those profiles while still
  projecting back to the legacy `SandboxPolicy` shape that the current
  macOS and Linux sandbox backends consume.
  
  It also tightens the filesystem profile model so scoped entries only
  exist for `:project_roots`, and so nested keys must stay within a
  project root instead of using `.` or `..` traversal.
  
  This drops support for the short-lived `[permissions.network]` in
  `config.toml` because now that would be interpreted as a profile named
  `network` within `[permissions]`.
  
  ## What Changed
  
  - added `PermissionsToml`, `PermissionProfileToml`,
  `FilesystemPermissionsToml`, and `FilesystemPermissionToml` so config
  can parse named profiles under `[permissions.<profile>.filesystem]`
  - added top-level `default_permissions` selection, validation for
  missing or unknown profiles, and compilation from a named profile into
  split `FileSystemSandboxPolicy` and `NetworkSandboxPolicy` values
  - taught config loading to choose between the legacy `sandbox_mode` path
  and the profile-based path without breaking legacy users
  - introduced `codex-protocol::permissions` for the split filesystem and
  network sandbox types, and stored those alongside the legacy projected
  `sandbox_policy` in runtime `Permissions`
  - modeled `FileSystemSpecialPath` so only `ProjectRoots` can carry a
  nested `subpath`, matching the intended config syntax instead of
  allowing invalid states for other special paths
  - restricted scoped filesystem maps to `:project_roots`, with validation
  that nested entries are non-empty descendant paths and cannot use `.` or
  `..` to escape the project root
  - kept existing runtime consumers working by projecting
  `FileSystemSandboxPolicy` back into `SandboxPolicy`, with an explicit
  error for profiles that request writes outside the workspace root
  - loaded proxy settings from top-level `[network]`
  - regenerated `core/config.schema.json`
  
  ## Verification
  
  - added config coverage for profile deserialization,
  `default_permissions` selection, top-level `[network]` loading, network
  enablement, rejection of writes outside the workspace root, rejection of
  nested entries for non-`:project_roots` special paths, and rejection of
  parent-directory traversal in `:project_roots` maps
  - added protocol coverage for the legacy bridge rejecting non-workspace
  writes
  
  ## Docs
  
  - update the Codex config docs on developers.openai.com/codex to
  document named `[permissions.<profile>]` entries, `default_permissions`,
  scoped `:project_roots` syntax, the descendant-path restriction for
  nested `:project_roots` entries, and top-level `[network]` proxy
  configuration
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13434).
  * #13453
  * #13452
  * #13451
  * #13449
  * #13448
  * #13445
  * #13440
  * #13439
  * __->__ #13434

  Michael Bolin · 2026-03-06 15:39:13 -08:00
  f82678b2a4
• fix: reject global wildcard network proxy domains (#13789)

  ## Summary
  - reject the global `*` domain pattern in proxy allow/deny lists and
  managed constraints introduced for testing earlier
  - keep exact hosts plus scoped wildcards like `*.example.com` and
  `**.example.com`
  - update docs and regression tests for the new invalid-config behavior

  viyatb-oai · 2026-03-06 21:06:24 +00:00
  9a4787c240
• refactor: remove proxy admin endpoint (#13687)

  ## Summary
  - delete the network proxy admin server and its runtime listener/task
  plumbing
  - remove the admin endpoint config, runtime, requirement, protocol,
  schema, and debug-surface fields
  - update proxy docs to reflect the remaining HTTP and SOCKS listeners
  only

  viyatb-oai · 2026-03-05 22:03:16 -08:00
  6a79ed5920
• fix(network-proxy): reject mismatched host headers (#13275)

  ## Summary
  - reject plain HTTP absolute-form requests whose Host header does not
  match the request target authority
  - add host/port-aware Host header validation for non-default ports
  - add regression coverage for mismatched Host forwarding and validator
  edge cases

  viyatb-oai · 2026-03-03 15:12:06 -08:00
  24a2d0c696
• feat(network-proxy): add embedded OTEL policy audit logging (#12046)

  **PR Summary**
  
  This PR adds embedded-only OTEL policy audit logging for
  `codex-network-proxy` and threads audit metadata from `codex-core` into
  managed proxy startup.
  
  ### What changed
  - Added structured audit event emission in `network_policy.rs` with
  target `codex_otel.network_proxy`.
  - Emitted:
  - `codex.network_proxy.domain_policy_decision` once per domain-policy
  evaluation.
    - `codex.network_proxy.block_decision` for non-domain denies.
  - Added required policy/network fields, RFC3339 UTC millisecond
  `event.timestamp`, and fallback defaults (`http.request.method="none"`,
  `client.address="unknown"`).
  - Added non-domain deny audit emission in HTTP/SOCKS handlers for
  mode-guard and proxy-state denies, including unix-socket deny paths.
  - Added `REASON_UNIX_SOCKET_UNSUPPORTED` and used it for unsupported
  unix-socket auditing.
  - Added `NetworkProxyAuditMetadata` to runtime/state, re-exported from
  `lib.rs` and `state.rs`.
  - Added `start_proxy_with_audit_metadata(...)` in core config, with
  `start_proxy()` delegating to default metadata.
  - Wired metadata construction in `codex.rs` from session/auth context,
  including originator sanitization for OTEL-safe tagging.
  - Updated `network-proxy/README.md` with embedded-mode audit schema and
  behavior notes.
  - Refactored HTTP block-audit emission to a small local helper to reduce
  duplication.
  - Preserved existing unix-socket proxy-disabled host/path behavior for
  responses and blocked history while using an audit-only endpoint
  override (`server.address="unix-socket"`, `server.port=0`).
  
  ### Explicit exclusions
  - No standalone proxy OTEL startup work.
  - No `main.rs` binary wiring.
  - No `standalone_otel.rs`.
  - No standalone docs/tests.
  
  ### Tests
  - Extended `network_policy.rs` tests for event mapping, metadata
  propagation, fallbacks, timestamp format, and target prefix.
  - Extended HTTP tests to assert unix-socket deny block audit events.
  - Extended SOCKS tests to cover deny emission from handler deny
  branches.
  - Added/updated core tests to verify audit metadata threading into
  managed proxy state.
  
  ### Validation run
  - `just fmt`
  - `cargo test -p codex-network-proxy` ✅
  - `cargo test -p codex-core` ran with one unrelated flaky timeout
  (`shell_snapshot::tests::snapshot_shell_does_not_inherit_stdin`), and
  the test passed when rerun directly ✅
  
  ---------
  
  Co-authored-by: viyatb-oai <viyatb@openai.com>

  mcgrew-oai · 2026-02-25 11:46:37 -05:00
  9a393c9b6f
• feat(network-proxy): add MITM support and gate limited-mode CONNECT (#9859)

  ## Description
  - Adds MITM support (CA load/issue, TLS termination, optional body
  inspection).
  - Adds `codex-network-proxy init` to create
  `CODEX_HOME/network_proxy/mitm`.
  - Enforces limited-mode HTTPS correctly: `CONNECT` requires MITM,
  otherwise blocked with `mitm_required`.
  - Keeps `origin/main` layering/reload semantics (managed layers included
  in reload checks).
  - Centralizes block reasons (`REASON_MITM_REQUIRED`) and removes
  `println!`.
  - Scope is MITM-only (no SOCKS changes).
  
  gated by `mitm=false` (default)

  viyatb-oai · 2026-02-24 18:15:15 +00:00
  8d3d58f992
• feat(core): persist network approvals in execpolicy (#12357)

  ## Summary
  Persist network approval allow/deny decisions as `network_rule(...)`
  entries in execpolicy (not proxy config)
  
  It adds `network_rule` parsing + append support in `codex-execpolicy`,
  including `decision="prompt"` (parse-only; not compiled into proxy
  allow/deny lists)
  - compile execpolicy network rules into proxy allow/deny lists and
  update the live proxy state on approval
  - preserve requirements execpolicy `network_rule(...)` entries when
  merging with file-based execpolicy
  - reject broad wildcard hosts (for example `*`) for persisted
  `network_rule(...)`

  viyatb-oai · 2026-02-23 21:37:46 -08:00
  c3048ff90a
• fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368)

  ## Summary
  Adds support for a Unix socket escape hatch so we can bypass socket
  allowlisting when explicitly enabled.
  
  ## Description
  * added a new flag, `network.dangerously_allow_all_unix_sockets` as an
  explicit escape hatch
  * In codex-network-proxy, enabling that flag now allows any absolute
  Unix socket path from x-unix-socket instead of requiring each path to be
  explicitly allowlisted. Relative paths are still rejected.
  * updated the macOS seatbelt path in core so it enforces the same Unix
  socket behavior:
    * allowlisted sockets generate explicit network* subpath rules
    * allow-all generates a broad network* (subpath "/") rule
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-20 10:56:57 -08:00
  28c0089060
• Refactor network approvals to host/protocol/port scope (#12140)

  ## Summary
  Simplify network approvals by removing per-attempt proxy correlation and
  moving to session-level approval dedupe keyed by (host, protocol, port).
  Instead of encoding attempt IDs into proxy credentials/URLs, we now
  treat approvals as a destination policy decision.
  
  - Concurrent calls to the same destination share one approval prompt.
  - Different destinations (or same host on different ports) get separate
  prompts.
  - Allow once approves the current queued request group only.
  - Allow for session caches that (host, protocol, port) and auto-allows
  future matching requests.
  - Never policy continues to deny without prompting.
  
  Example:
  - 3 calls: 
    - a.com (line 443)
    - b.com (line 443)
    - a.com (line 443)
  => 2 prompts total (a, b), second a waits on the first decision.
  - a.com:80 is treated separately from a.com line 443
  
  ## Testing
  - `just fmt` (in `codex-rs`)
  - `cargo test -p codex-core tools::network_approval::tests`
  - `cargo test -p codex-core` (unit tests pass; existing
  integration-suite failures remain in this environment)

  viyatb-oai · 2026-02-20 10:39:55 -08:00
  e8afaed502
• feat(network-proxy): add websocket proxy env support (#11784)

  ## Summary
  - add managed proxy env wiring for websocket-specific variables
  (`WS_PROXY`/`WSS_PROXY`, including lowercase)
  - keep websocket proxy vars aligned with the existing managed HTTP proxy
  endpoint
  - add CONNECT regression tests to cover allowlist and denylist decisions
  (websocket tunnel path)
  - document websocket proxy usage and CONNECT policy behavior in the
  network proxy README
  
  ## Testing
  - just fmt
  - cargo test -p codex-network-proxy
  - cargo clippy -p codex-network-proxy
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-17 13:49:43 -08:00
  f2ad519a87
• feat(core): add structured network approval plumbing and policy decision model (#11672)

  ### Description
  #### Summary
  Introduces the core plumbing required for structured network approvals
  
  #### What changed
  - Added structured network policy decision modeling in core.
  - Added approval payload/context types needed for network approval
  semantics.
  - Wired shell/unified-exec runtime plumbing to consume structured
  decisions.
  - Updated related core error/event surfaces for structured handling.
  - Updated protocol plumbing used by core approval flow.
  - Included small CLI debug sandbox compatibility updates needed by this
  layer.
  
  #### Why
  establishes the minimal backend foundation for network approvals without
  yet changing high-level orchestration or TUI behavior.
  
  #### Notes
  - Behavior remains constrained by existing requirements/config gating.
  - Follow-up PRs in the stack handle orchestration, UX, and app-server
  integration.
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-14 04:18:12 +00:00
  b527ee2890
• feat(network-proxy): structured policy signaling and attempt correlation to core (#11662)

  ## Summary
  When network requests were blocked, downstream code often had to infer
  ask vs deny from free-form response text. That was brittle and led to
  incorrect approval behavior.
  This PR fixes the proxy side so blocked decisions are structured and
  request metadata survives reliably.
  
  ## Description
  - Blocked proxy responses now carry consistent structured policy
  decision data.
  - Request attempt metadata is preserved across proxy env paths
  (including ALL_PROXY flows).
  - Header stripping was tightened so we still remove unsafe forwarding
  headers, but keep metadata needed for policy handling.
  - Block messages were clarified (for example, allowlist miss vs explicit
  deny).
  - Added unified violation log entries so policy failures can be
  inspected in one place.
  - Added/updated tests for these behaviors.
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

  viyatb-oai · 2026-02-13 09:01:11 +00:00
  2bced810da
• Enable SOCKS defaults for common local network proxy use cases (#11362)

  ## Summary
  - enable local-use defaults in network proxy settings: SOCKS5 on, SOCKS5
  UDP on, upstream proxying on, and local binding on
  - add a regression test that asserts the full
  `NetworkProxySettings::default()` baseline
  - Fixed managed listener reservation behavior.
  Before: we always reserved a loopback SOCKS listener, even when
  enable_socks5 = false.
  Now: SOCKS listener is only reserved when SOCKS is enabled.
  - Fixed /debug-config env output for SOCKS-disabled sessions.
  ALL_PROXY now shows the HTTP proxy URL when SOCKS is disabled (instead
  of incorrectly showing socks5h://...).
  
  
  ## Validation
  - just fmt
  - cargo test -p codex-network-proxy
  - cargo clippy -p codex-network-proxy --all-targets

  viyatb-oai · 2026-02-10 15:13:52 -08:00
  1d47927aa0
• feat: retain NetworkProxy, when appropriate (#11207)

  As of this PR, `SessionServices` retains a
  `Option<StartedNetworkProxy>`, if appropriate.
  
  Now the `network` field on `Config` is `Option<NetworkProxySpec>`
  instead of `Option<NetworkProxy>`.
  
  Over in `Session::new()`, we invoke `NetworkProxySpec::start_proxy()` to
  create the `StartedNetworkProxy`, which is a new struct that retains the
  `NetworkProxy` as well as the `NetworkProxyHandle`. (Note that `Drop` is
  implemented for `NetworkProxyHandle` to ensure the proxies are shutdown
  when it is dropped.)
  
  The `NetworkProxy` from the `StartedNetworkProxy` is threaded through to
  the appropriate places.
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/11207).
  * #11285
  * __->__ #11207

  Michael Bolin · 2026-02-10 02:09:23 -08:00
  44ebf4588f
• chore: put crypto provider logic in a shared crate (#11294)

  Ensures a process-wide rustls crypto provider is installed.
  
  Both the `codex-network-proxy` and `codex-api` crates need this.

  Michael Bolin · 2026-02-10 01:04:31 -08:00
  8e240a13be
• feat(sandbox): enforce proxy-aware network routing in sandbox (#11113)

  ## Summary
  - expand proxy env injection to cover common tool env vars
  (`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`/`NO_PROXY` families +
  tool-specific variants)
  - harden macOS Seatbelt network policy generation to route through
  inferred loopback proxy endpoints and fail closed when proxy env is
  malformed
  - thread proxy-aware Linux sandbox flags and add minimal bwrap netns
  isolation hook for restricted non-proxy runs
  - add/refresh tests for proxy env wiring, Seatbelt policy generation,
  and Linux sandbox argument wiring

  viyatb-oai · 2026-02-10 07:44:21 +00:00
  3391e5ea86
• feat: reserve loopback ephemeral listeners for managed proxy (#11269)

  Codex may run many per-thread proxy instances, so hardcoded proxy ports
  are brittle and conflict-prone. The previous "ephemeral" approach still
  had a race: `build()` read `local_addr()` from temporary listeners and
  dropped them before `run()` rebound the ports. That left a
  [TOCTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use)
  window where the OS (or another process) could reuse the same port,
  causing intermittent `EADDRINUSE` and partial proxy startup.
  
  Change the managed proxy path to reserve real listener sockets up front
  and keep them alive until startup:
  
  - add `ReservedListeners` on `NetworkProxy` to hold HTTP/SOCKS/admin std
  listeners allocated during `build()`
  - in managed mode, bind `127.0.0.1:0` for each listener and carry those
  bound sockets into `run()` instead of rebinding by address later
  - add `run_*_with_std_listener` entry points for HTTP, SOCKS5, and admin
  servers so `run()` can start services from already-reserved sockets
  - keep static/configured ports only when `managed_by_codex(false)`,
  including explicit `socks_addr` override support
  - remove fallback synthetic port allocation and add tests for managed
  ephemeral loopback binding and unmanaged configured-port behavior
  
  This makes managed startup deterministic, avoids port collisions, and
  preserves the intended distinction between Codex-managed ephemeral ports
  and externally managed fixed ports.

  Michael Bolin · 2026-02-10 06:11:02 +00:00
  503186b31f
• chore: change ConfigState so it no longer depends on a single config.toml file for reloading (#11262)

  If anything, it should depend on `ConfigLayerStack`.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/11262).
  * #11207
  * __->__ #11262

  Michael Bolin · 2026-02-09 19:26:39 -08:00
  862ab63071
• feat: include NetworkConfig through ExecParams (#11105)

  This PR adds the following field to `Config`:
  
  ```rust
  pub network: Option<NetworkProxy>,
  ```
  
  Though for the moment, it will always be initialized as `None` (this
  will be addressed in a subsequent PR).
  
  This PR does the work to thread `network` through to `execute_exec_env()`, `process_exec_tool_call()`, and `UnifiedExecRuntime.run()` to ensure it is available whenever we span a process.

  Michael Bolin · 2026-02-09 03:32:17 +00:00
  383b45279e
• chore: reverse the codex-network-proxy -> codex-core dependency (#11121)
  Michael Bolin · 2026-02-08 17:03:24 -08:00
  ff74aaae21
• chore: refactor network-proxy so that ConfigReloader is injectable behavior (#11114)

  Currently, `codex-network-proxy` depends on `codex-core`, but this
  should be the other way around. As a first step, refactor out
  `ConfigReloader`, which should make it easier to move
  `codex-rs/network-proxy/src/state.rs` to `codex-core` in a subsequent
  commit.

  Michael Bolin · 2026-02-08 22:28:20 +00:00
  ef5d26e586
• feat: enable premessage-deflate for websockets (#10966)

  note:
  unfortunately, tokio-tungstenite / tungstenite upgrade triggers some
  problems with linker of rama-tls-boring with openssl:
  ```
  error: linking with `/Users/apanasenko/Library/Caches/cargo-zigbuild/0.20.1/zigcc-x86_64-unknown-linux-musl-ff6a.sh` failed: exit status: 1
    |
    = note:  "/Users/apanasenko/Library/Caches/cargo-zigbuild/0.20.1/zigcc-x86_64-unknown-linux-musl-ff6a.sh" "-m64" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/rcrt1.o" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crti.o" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crtbeginS.o" "<1 object files omitted>" "-Wl,--as-needed" "-Wl,-Bstatic" "/var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/{liblzma_sys-662a82316f96ec30,libbzip2_sys-bf78a2d58d5cbce6,liblibsqlite3_sys-6c004987fd67a36a,libtree_sitter_bash-220b99a97d331ab7,libtree_sitter-858f0a1dbfea58bd,libzstd_sys-6eb237deec748c5b,libring-2a87376483bf916f,libopenssl_sys-7c189e68b37fe2bb,liblibz_sys-4344eef4345520b1,librama_boring_sys-0414e98115015ee0}.rlib" "-lc++" "-lc++abi" "-lunwind" "-lc" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/libcompiler_builtins-*.rlib" "-L" "/var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/raw-dylibs" "-Wl,-Bdynamic" "-Wl,--eh-frame-hdr" "-Wl,-z,noexecstack" "-nostartfiles" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/libz-sys-ff5ea50d88c28ffb/out/lib" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/ring-bdec3dddc19f5a5e/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/openssl-sys-96e0870de3ca22bc/out/openssl-build/install/lib" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/zstd-sys-0cc37a5da1481740/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/tree-sitter-72d2418073317c0f/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/tree-sitter-bash-bfd293a9f333ce6a/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/libsqlite3-sys-b78b2cfb81a330fc/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/bzip2-sys-69a145cc859ef275/out/lib" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/lzma-sys-07e92d0b6baa6fd4/out" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/crypto/" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/ssl/" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/" "-L" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build" "-L" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained" "-L" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib" "-o" "/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/deps/codex_network_proxy-d08268b863517761" "-Wl,--gc-sections" "-static-pie" "-Wl,-z,relro,-z,now" "-Wl,-O1" "-Wl,--strip-all" "-nodefaultlibs" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crtendS.o" "<sysroot>/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/crtn.o"
    = note: some arguments are omitted. use `--verbose` to show all linker arguments
    = note: warning: ignoring deprecated linker optimization setting '1'
            warning: unable to open library directory '/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/build/crypto/': FileNotFound
            ld.lld: error: duplicate symbol: SSL_export_keying_material
            >>> defined at ssl_lib.c:3816 (ssl/ssl_lib.c:3816)
            >>>            libssl-lib-ssl_lib.o:(SSL_export_keying_material) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/libopenssl_sys-7c189e68b37fe2bb.rlib
            >>> defined at t1_enc.cc:205 (/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/boringssl/ssl/t1_enc.cc:205)
            >>>            t1_enc.cc.o:(.text.SSL_export_keying_material+0x0) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/librama_boring_sys-0414e98115015ee0.rlib
  
            ld.lld: error: duplicate symbol: d2i_ASN1_TIME
            >>> defined at a_time.c:27 (crypto/asn1/a_time.c:27)
            >>>            libcrypto-lib-a_time.o:(d2i_ASN1_TIME) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/libopenssl_sys-7c189e68b37fe2bb.rlib
            >>> defined at a_time.cc:34 (/Users/apanasenko/code/codex/codex-rs/target/x86_64-unknown-linux-musl/release/build/rama-boring-sys-0bc2dfbf669addc4/out/boringssl/crypto/asn1/a_time.cc:34)
            >>>            a_time.cc.o:(.text.d2i_ASN1_TIME+0x0) in archive /var/folders/kt/52y_g75x3ng8ktvk3rfwm6400000gp/T/rustcyGQdYm/librama_boring_sys-0414e98115015ee0.rlib
  ``` 
  
  that force me to migrate away from rama-tls-boring to rama-tls-rustls
  and pin `ring` for rustls.

  Anton Panasenko · 2026-02-07 17:59:34 -08:00
  a94505a92a
• refactor(network-proxy): flatten network config under [network] (#10965)

  Summary:
  - Rename config table from network_proxy to network.
  - Flatten allowed_domains, denied_domains, allow_unix_sockets, and
  allow_local_binding onto NetworkProxySettings.
  - Update runtime, state constraints, tests, and README to the new config
  shape.

  viyatb-oai · 2026-02-07 05:22:44 +00:00
  8cd46ebad6
• feat(network-proxy): add structured policy decision to blocked errors (#10420)

  ## Summary
  Add explicit, model-visible network policy decision metadata to blocked
  proxy responses/errors.
  
  Introduces a standardized prefix line: `CODEX_NETWORK_POLICY_DECISION
  {json}`
  
  and wires it through blocked paths for:
  - HTTP requests
  - HTTPS CONNECT
  - SOCKS5 TCP/UDP denials
  
  ## Why
  The model should see *why* a request was blocked
  (reason/source/protocol/host/port) so it can choose the correct next
  action.
  
  ## Notes
  - This PR is intentionally independent of config-layering/network-rule
  runtime integration.
  - Focus is blocked decision surface only.

  viyatb-oai · 2026-02-06 10:46:50 -08:00
  db0d8710d5
• Wire up cloud reqs in exec, app-server (#10241)

  We're fetching cloud requirements in TUI in
  https://github.com/openai/codex/pull/10167.
  
  This adds the same fetching in exec and app-server binaries also.

  gt-oai · 2026-01-30 23:53:41 +00:00
  a046481ad9
• Fetch Requirements from cloud (#10167)

  Load requirements from Codex Backend. It only does this for enterprise
  customers signed in with ChatGPT.
  
  Todo in follow-up PRs:
  * Add to app-server and exec too
  * Switch from fail-open to fail-closed on failure

  gt-oai · 2026-01-30 12:03:29 +00:00
  e85d019daa
• chore: introduce *Args types for new() methods (#10009)

  Constructors with long param lists can be hard to reason about when a
  number of the args are `None`, in practice. Introducing a struct to use
  as the args type helps make things more self-documenting.

  Michael Bolin · 2026-01-27 19:15:38 +00:00
  700a29e157
• feat(network-proxy): add a SOCKS5 proxy with policy enforcement (#9803)

  ### Summary
  - Adds an optional SOCKS5 listener via `rama-socks5`
  - SOCKS5 is disabled by default and gated by config
  - Reuses existing policy enforcement and blocked-request recording
  - Blocks SOCKS5 in limited mode to prevent method-policy bypass
  - Applies bind clamping to the SOCKS5 listener
  
  ### Config
  New/used fields under `network_proxy`:
  - `enable_socks5`
  - `socks_url`
  - `enable_socks5_udp`
  
  ### Scope
  - Changes limited to `codex-rs/network-proxy` (+ `codex-rs/Cargo.lock`)
  
  ### Testing
  ```bash
  cd codex-rs
  just fmt
  cargo test -p codex-network-proxy --offline

  viyatb-oai · 2026-01-27 10:09:39 -08:00
  877b76bb9d
• feat: introducing a network sandbox proxy (#8442)

  This add a new crate, `codex-network-proxy`, a local network proxy
  service used by Codex to enforce fine-grained network policy (domain
  allow/deny) and to surface blocked network events for interactive
  approvals.
  
  - New crate: `codex-rs/network-proxy/` (`codex-network-proxy` binary +
  library)
  - Core capabilities:
    - HTTP proxy support (including CONNECT tunneling)
    - SOCKS5 proxy support (in the later PR)
  - policy evaluation (allowed/denied domain lists; denylist wins;
  wildcard support)
    - small admin API for polling/reload/mode changes
  - optional MITM support for HTTPS CONNECT to enforce “limited mode”
  method restrictions (later PR)
  
  Will follow up integration with codex in subsequent PRs.
  
  ## Testing
  
  - `cd codex-rs && cargo build -p codex-network-proxy`
  - `cd codex-rs && cargo run -p codex-network-proxy -- proxy`

  viyatb-oai · 2026-01-23 17:47:09 -08:00
  77222492f9