viyatb-oai 28c0089060 fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368) ...

## Summary
Adds support for a Unix socket escape hatch so we can bypass socket
allowlisting when explicitly enabled.

## Description
* added a new flag, `network.dangerously_allow_all_unix_sockets` as an
explicit escape hatch
* In codex-network-proxy, enabling that flag now allows any absolute
Unix socket path from x-unix-socket instead of requiring each path to be
explicitly allowlisted. Relative paths are still rejected.
* updated the macOS seatbelt path in core so it enforces the same Unix
socket behavior:
  * allowlisted sockets generate explicit network* subpath rules
  * allow-all generates a broad network* (subpath "/") rule

---------

Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

28c0089060 · 2026-02-20 10:56:57 -08:00

History

..

schema

fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368)

2026-02-20 10:56:57 -08:00

src

fix(network-proxy): add unix socket allow-all and update seatbelt rules (#11368)

2026-02-20 10:56:57 -08:00

tests

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

BUILD.bazel

feat: vendor app-server protocol schema fixtures (#10371)

2026-02-01 23:38:43 -08:00

Cargo.toml

app-server: improve thread resume rejoin flow (#11776)

2026-02-20 05:29:05 +00:00