codex

mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00

Files

T

rreichel3-oai 1db6cb9789 Allow global network allowlist wildcard (#15549 )

## Problem

Today `codex-network-proxy` rejects a global `*` in
`network.allowed_domains`, so there is no static way to configure a
denylist-only posture for public hosts. Users have to enumerate broad
allowlist patterns instead.

## Approach

- Make global wildcard acceptance field-specific: `allowed_domains` can
use `*`, while `denied_domains` still rejects a global wildcard.
- Keep the existing evaluation order, so explicit denies still win first
and local/private protections still apply unless separately enabled.
- Add coverage for the denylist-only behavior and update the README to
document it.

## Validation

- `just fmt`
- `cargo test -p codex-network-proxy` (full run had one unrelated flaky
telemetry test:
`network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event`;
reran in isolation and it passed)
- `cargo test -p codex-network-proxy
network_policy::tests::emit_block_decision_audit_event_emits_non_domain_event
-- --exact --nocapture`
- `just fix -p codex-network-proxy`
- `just argument-comment-lint`

1db6cb9789 · 2026-03-24 10:43:46 -04:00

History

certs.rs

Apply argument comment lint across codex-rs (#14652 )

2026-03-16 16:48:15 -07:00

config.rs

Apply argument comment lint across codex-rs (#14652 )

2026-03-16 16:48:15 -07:00

http_proxy.rs

Apply argument comment lint across codex-rs (#14652 )

2026-03-16 16:48:15 -07:00

lib.rs