viyatb-oai 85fd52f7e4 Enforce configured network proxy in codex sandbox (#27035) ...

## Why

`codex sandbox` can start a network proxy from a configured permission
profile. Previously, sandbox-level containment was tied to managed
network requirements rather than whether a proxy was actually active.
This meant config-driven proxy policies were not consistently enforced
as the sandbox's only network path.

## What changed

- Enable proxy-only network containment whenever `codex sandbox` starts
a network proxy.
- Apply the same active-proxy check to the macOS and Linux sandbox
paths.
- Add a Linux regression test that verifies a sandboxed command cannot
establish a direct connection while the configured proxy is active.

## Test plan

- `just test -p codex-cli debug_sandbox::tests`
- `sandbox_with_network_proxy_blocks_direct_loopback_access` runs on
Linux to cover the config-driven proxy path end to end.

85fd52f7e4 · 2026-06-08 14:03:37 -07:00

History

..

src

Enforce configured network proxy in codex sandbox (#27035)

2026-06-08 14:03:37 -07:00

tests

Enforce configured network proxy in codex sandbox (#27035)

2026-06-08 14:03:37 -07:00

BUILD.bazel

Enforce configured network proxy in codex sandbox (#27035)

2026-06-08 14:03:37 -07:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

Allow API-key auth for remote exec-server registration (#24666)

2026-05-27 21:17:38 +00:00