feat: experimental env var: CODEX_SANDBOX_NETWORK_DISABLED

Previous to this change:

```
$ cargo run --bin codex -- debug seatbelt --full-auto -- cargo test
---- keeps_previous_response_id_between_tasks stdout ----

thread 'keeps_previous_response_id_between_tasks' panicked at /Users/mbolin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/wiremock-0.6.3/src/mock_server/builder.rs:107:46:
Failed to bind an OS port for a mock server.: Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    keeps_previous_response_id_between_tasks

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

error: test failed, to rerun pass `-p codex-core --test previous_response_id`
```

codex-rs/cli/src/landlock.rs

@@ -3,10 +3,11 @@
 //! On Linux the command is executed inside a Landlock + seccomp sandbox by
 //! calling the low-level `exec_linux` helper from `codex_core::linux`.
 
+use codex_core::exec::StdioPolicy;
+use codex_core::linux::spawn_command_under_landlock;
 use codex_core::protocol::SandboxPolicy;
 use std::os::unix::process::ExitStatusExt;
 use std::process;
-use std::process::Command;
 use std::process::ExitStatus;
 
 /// Execute `command` in a Linux sandbox (Landlock + seccomp) the way Codex
@@ -19,8 +20,10 @@ pub fn run_landlock(command: Vec<String>, sandbox_policy: SandboxPolicy) -> anyh
     // Spawn a new thread and apply the sandbox policies there.
     let handle = std::thread::spawn(move || -> anyhow::Result<ExitStatus> {
         let cwd = std::env::current_dir()?;
-        codex_core::linux::apply_sandbox_policy_to_current_thread(sandbox_policy, &cwd)?;
-        let status = Command::new(&command[0]).args(&command[1..]).status()?;
+        let mut child =
+            spawn_command_under_landlock(command, &sandbox_policy, cwd, StdioPolicy::Inherit)
+                .await?;
+        let status = child.wait().await?;
         Ok(status)
     });
     let status = handle

codex-rs/cli/src/main.rs

@@ -74,6 +74,7 @@ async fn main() -> anyhow::Result<()> {
             proto::run_main(proto_cli).await?;
         }
         Some(Subcommand::Debug(debug_args)) => match debug_args.cmd {
+            #[cfg(target_os = "macos")]
             DebugCommand::Seatbelt(SeatbeltCommand {
                 command,
                 sandbox,
@@ -82,6 +83,10 @@ async fn main() -> anyhow::Result<()> {
                 let sandbox_policy = create_sandbox_policy(full_auto, sandbox);
                 seatbelt::run_seatbelt(command, sandbox_policy).await?;
             }
+            #[cfg(not(target_os = "macos"))]
+            DebugCommand::Seatbelt(_) => {
+                anyhow::bail!("Seatbelt is only supported on macOS.");
+            }
             #[cfg(target_os = "linux")]
             DebugCommand::Landlock(LandlockCommand {
                 command,

codex-rs/cli/src/seatbelt.rs

@@ -1,18 +1,24 @@
-use codex_core::exec::create_seatbelt_command;
+use codex_core::exec::StdioPolicy;
+use codex_core::exec::spawn_command_under_seatbelt;
 use codex_core::protocol::SandboxPolicy;
+use std::os::unix::process::ExitStatusExt;
+use std::process;
 
 pub async fn run_seatbelt(
     command: Vec<String>,
     sandbox_policy: SandboxPolicy,
 ) -> anyhow::Result<()> {
     let cwd = std::env::current_dir().expect("failed to get cwd");
-    let seatbelt_command = create_seatbelt_command(command, &sandbox_policy, &cwd);
-    let status = tokio::process::Command::new(seatbelt_command[0].clone())
-        .args(&seatbelt_command[1..])
-        .spawn()
-        .map_err(|e| anyhow::anyhow!("Failed to spawn command: {}", e))?
-        .wait()
-        .await
-        .map_err(|e| anyhow::anyhow!("Failed to wait for command: {}", e))?;
-    std::process::exit(status.code().unwrap_or(1));
+    let mut child =
+        spawn_command_under_seatbelt(command, &sandbox_policy, cwd, StdioPolicy::Inherit).await?;
+    let status = child.wait().await?;
+
+    // Use ExitStatus to derive the exit code.
+    if let Some(code) = status.code() {
+        process::exit(code);
+    } else if let Some(signal) = status.signal() {
+        process::exit(128 + signal);
+    } else {
+        process::exit(1);
+    }
 }

codex-rs/core/src/exec.rs

@@ -42,6 +42,16 @@ const MACOS_SEATBELT_BASE_POLICY: &str = include_str!("seatbelt_base_policy.sbpl
 /// already has root access.
 const MACOS_PATH_TO_SEATBELT_EXECUTABLE: &str = "/usr/bin/sandbox-exec";
 
+/// Experimental environment variable that will be set to some non-empty value
+/// if both of the following are true:
+///
+/// 1. The process was spawned by Codex as part of a shell tool call.
+/// 2. SandboxPolicy.has_full_network_access() was false for the tool call.
+///
+/// We may try to have just one environment variable for all sandboxing
+/// attributes, so this may change in the future.
+pub const CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR: &str = "CODEX_SANDBOX_NETWORK_DISABLED";
+
 #[derive(Debug, Clone)]
 pub struct ExecParams {
     pub command: Vec<String>,
@@ -90,23 +100,21 @@ pub async fn process_exec_tool_call(
     let start = Instant::now();
 
     let raw_output_result = match sandbox_type {
-        SandboxType::None => exec(params, ctrl_c).await,
+        SandboxType::None => exec(params, sandbox_policy, ctrl_c).await,
         SandboxType::MacosSeatbelt => {
             let ExecParams {
                 command,
                 cwd,
                 timeout_ms,
             } = params;
-            let seatbelt_command = create_seatbelt_command(command, sandbox_policy, &cwd);
-            exec(
-                ExecParams {
-                    command: seatbelt_command,
-                    cwd,
-                    timeout_ms,
-                },
-                ctrl_c,
+            let child = spawn_command_under_seatbelt(
+                command,
+                sandbox_policy,
+                cwd,
+                StdioPolicy::RedirectForShellTool,
             )
-            .await
+            .await?;
+            consume_truncated_output(child, ctrl_c, timeout_ms).await
         }
         SandboxType::LinuxSeccomp => exec_linux(params, ctrl_c, sandbox_policy).await,
     };
@@ -151,7 +159,17 @@ pub async fn process_exec_tool_call(
     }
 }
 
-pub fn create_seatbelt_command(
+pub async fn spawn_command_under_seatbelt(
+    command: Vec<String>,
+    sandbox_policy: &SandboxPolicy,
+    cwd: PathBuf,
+    stdio_policy: StdioPolicy,
+) -> std::io::Result<Child> {
+    let seatbelt_command = create_seatbelt_command(command, sandbox_policy, &cwd);
+    spawn_child(seatbelt_command, cwd, sandbox_policy, stdio_policy).await
+}
+
+fn create_seatbelt_command(
     command: Vec<String>,
     sandbox_policy: &SandboxPolicy,
     cwd: &Path,
@@ -229,22 +247,47 @@ pub struct ExecToolCallOutput {
     pub duration: Duration,
 }
 
-pub async fn exec(
+async fn exec(
     ExecParams {
         command,
         cwd,
         timeout_ms,
     }: ExecParams,
+    sandbox_policy: &SandboxPolicy,
     ctrl_c: Arc<Notify>,
 ) -> Result<RawExecToolCallOutput> {
-    let child = spawn_child(command, cwd).await?;
+    let child = spawn_child(
+        command,
+        cwd,
+        sandbox_policy,
+        StdioPolicy::RedirectForShellTool,
+    )
+    .await?;
     consume_truncated_output(child, ctrl_c, timeout_ms).await
 }
 
+#[derive(Debug, Clone, Copy)]
+pub enum StdioPolicy {
+    RedirectForShellTool,
+    Inherit,
+}
+
 /// Spawns the appropriate child process for the ExecParams.
-async fn spawn_child(command: Vec<String>, cwd: PathBuf) -> std::io::Result<Child> {
+pub(crate) async fn spawn_child(
+    command: Vec<String>,
+    cwd: PathBuf,
+    sandbox_policy: &SandboxPolicy,
+    stdio_policy: StdioPolicy,
+) -> std::io::Result<Child> {
+    // For now, we take `SandboxPolicy` as a parameter to spawn_child() because
+    // we need to determine whether to set the
+    // `CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR` environment variable.
+    // Ultimately, we should be stricter about the environment variables that
+    // are set for the command (as we are when spawning an MCP server), so
+    // instead of SandboxPolicy, we should take the exact env to use for the
+    // Command (i.e., `env_clear().envs(env)`).
     if command.is_empty() {
-        return Err(std::io::Error::new(
+        return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
             "command args are empty",
         ));
@@ -254,21 +297,34 @@ async fn spawn_child(command: Vec<String>, cwd: PathBuf) -> std::io::Result<Chil
     cmd.args(&command[1..]);
     cmd.current_dir(cwd);
 
-    // Do not create a file descriptor for stdin because otherwise some
-    // commands may hang forever waiting for input. For example, ripgrep has
-    // a heuristic where it may try to read from stdin as explained here:
-    // https://github.com/BurntSushi/ripgrep/blob/e2362d4d5185d02fa857bf381e7bd52e66fafc73/crates/core/flags/hiargs.rs#L1101-L1103
-    cmd.stdin(Stdio::null());
+    if !sandbox_policy.has_full_network_access() {
+        cmd.env(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR, "1");
+    }
 
-    cmd.stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .kill_on_drop(true)
-        .spawn()
+    match stdio_policy {
+        StdioPolicy::RedirectForShellTool => {
+            // Do not create a file descriptor for stdin because otherwise some
+            // commands may hang forever waiting for input. For example, ripgrep has
+            // a heuristic where it may try to read from stdin as explained here:
+            // https://github.com/BurntSushi/ripgrep/blob/e2362d4d5185d02fa857bf381e7bd52e66fafc73/crates/core/flags/hiargs.rs#L1101-L1103
+            cmd.stdin(Stdio::null());
+
+            cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
+        }
+        StdioPolicy::Inherit => {
+            // Inherit stdin, stdout, and stderr from the parent process.
+            cmd.stdin(Stdio::inherit())
+                .stdout(Stdio::inherit())
+                .stderr(Stdio::inherit());
+        }
+    }
+
+    cmd.kill_on_drop(true).spawn()
 }
 
 /// Consumes the output of a child process, truncating it so it is suitable for
 /// use as the output of a `shell` tool call. Also enforces specified timeout.
-async fn consume_truncated_output(
+pub(crate) async fn consume_truncated_output(
     mut child: Child,
     ctrl_c: Arc<Notify>,
     timeout_ms: Option<u64>,

codex-rs/core/src/linux.rs

@@ -9,7 +9,9 @@ use crate::error::Result;
 use crate::error::SandboxErr;
 use crate::exec::ExecParams;
 use crate::exec::RawExecToolCallOutput;
-use crate::exec::exec;
+use crate::exec::StdioPolicy;
+use crate::exec::consume_truncated_output;
+use crate::exec::spawn_child;
 use crate::protocol::SandboxPolicy;
 
 use landlock::ABI;
@@ -49,8 +51,15 @@ pub async fn exec_linux(
             .expect("Failed to create runtime");
 
         rt.block_on(async {
-            apply_sandbox_policy_to_current_thread(sandbox_policy, &params.cwd)?;
-            exec(params, ctrl_c_copy).await
+            let ExecParams {
+                command,
+                cwd,
+                timeout_ms,
+            } = params;
+            let child =
+                spawn_command_under_landlock(command, &sandbox_policy, cwd, StdioPolicy::Inherit)
+                    .await?;
+            consume_truncated_output(child, ctrl_c_copy, timeout_ms).await
         })
     })
     .join();
@@ -65,10 +74,22 @@ pub async fn exec_linux(
     }
 }
 
+pub async fn spawn_command_under_landlock(
+    command: Vec<String>,
+    sandbox_policy: &SandboxPolicy,
+    cwd: PathBuf,
+    stdio_policy: StdioPolicy,
+) -> Result<tokio::process::Child> {
+    apply_sandbox_policy_to_current_thread(&sandbox_policy, &cwd)?;
+    spawn_child(command, cwd, &sandbox_policy, stdio_policy)
+        .await
+        .map_err(CodexErr::Io)
+}
+
 /// Apply sandbox policies inside this thread so only the child inherits
 /// them, not the entire CLI process.
-pub fn apply_sandbox_policy_to_current_thread(
-    sandbox_policy: SandboxPolicy,
+fn apply_sandbox_policy_to_current_thread(
+    sandbox_policy: &SandboxPolicy,
     cwd: &Path,
 ) -> Result<()> {
     if !sandbox_policy.has_full_network_access() {

codex-rs/core/tests/previous_response_id.rs

@@ -3,6 +3,7 @@ use std::time::Duration;
 use codex_core::Codex;
 use codex_core::ModelProviderInfo;
 use codex_core::config::Config;
+use codex_core::exec::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use serde_json::Value;
@@ -50,6 +51,13 @@ data: {{\"type\":\"response.completed\",\"response\":{{\"id\":\"{}\",\"output\":
 async fn keeps_previous_response_id_between_tasks() {
     #![allow(clippy::unwrap_used)]
 
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
+
     // Mock server
     let server = MockServer::start().await;
 

codex-rs/core/tests/stream_no_completed.rs

@@ -6,6 +6,7 @@ use std::time::Duration;
 use codex_core::Codex;
 use codex_core::ModelProviderInfo;
 use codex_core::config::Config;
+use codex_core::exec::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use codex_core::protocol::InputItem;
 use codex_core::protocol::Op;
 use tokio::time::timeout;
@@ -34,6 +35,13 @@ data: {{\"type\":\"response.completed\",\"response\":{{\"id\":\"{}\",\"output\":
 async fn retries_on_early_close() {
     #![allow(clippy::unwrap_used)]
 
+    if std::env::var(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR).is_ok() {
+        println!(
+            "Skipping test because it cannot execute when network is disabled in a Codex sandbox."
+        );
+        return;
+    }
+
     let server = MockServer::start().await;
 
     struct SeqResponder;

codex-rs/mcp-client/src/mcp_client.rs

@@ -81,6 +81,7 @@ impl McpClient {
     ) -> std::io::Result<Self> {
         let mut child = Command::new(program)
             .args(args)
+            .env_clear()
             .envs(create_env_for_mcp_server(env))
             .stdin(std::process::Stdio::piped())
             .stdout(std::process::Stdio::piped())