openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-05 20:10:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(app-server): pass sandbox policy to managed proxy startup

Browse Source
This commit is contained in:
viyatb-oai
2026-02-12 16:31:45 -08:00
parent d1d19d8da2
commit 2a83f98ad7
2 changed files with 19 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server/src/codex_message_processor.rs
+18 -20
View File
@@ -1681,8 +1681,24 @@ impl CodexMessageProcessor {
let timeout_ms = params
.timeout_ms
.and_then(|timeout_ms| u64::try_from(timeout_ms).ok());
let started_network_proxy = match self.config.permissions.network.as_ref() {
Some(spec) => match spec.start_proxy().await {
let requested_policy = params.sandbox_policy.map(|policy| policy.to_core());
let effective_policy = match requested_policy {
Some(policy) => match self.config.sandbox_policy.can_set(&policy) {
Ok(()) => policy,
Err(err) => {
let error = JSONRPCErrorError {
code: INVALID_REQUEST_ERROR_CODE,
message: format!("invalid sandbox policy: {err}"),
data: None,
};
self.outgoing.send_error(request, error).await;
return;
}
},
None => self.config.sandbox_policy.get().clone(),
};
let started_network_proxy = match self.config.network.as_ref() {
Some(spec) => match spec.start_proxy(&effective_policy).await {
Ok(started) => Some(started),
Err(err) => {
let error = JSONRPCErrorError {
@@ -1710,24 +1726,6 @@ impl CodexMessageProcessor {
justification: None,
arg0: None,
};
let requested_policy = params.sandbox_policy.map(|policy| policy.to_core());
let effective_policy = match requested_policy {
Some(policy) => match self.config.permissions.sandbox_policy.can_set(&policy) {
Ok(()) => policy,
Err(err) => {
let error = JSONRPCErrorError {
code: INVALID_REQUEST_ERROR_CODE,
message: format!("invalid sandbox policy: {err}"),
data: None,
};
self.outgoing.send_error(request, error).await;
return;
}
},
None => self.config.permissions.sandbox_policy.get().clone(),
};
let codex_linux_sandbox_exe = self.config.codex_linux_sandbox_exe.clone();
let outgoing = self.outgoing.clone();
let request_for_task = request;
codex-rs/cli/src/debug_sandbox.rs
+1 -1
View File
@@ -216,7 +216,7 @@ async fn run_command_under_sandbox(
// This proxy should only live for the lifetime of the child process.
let network_proxy = match config.permissions.network.as_ref() {
Some(spec) => Some(
spec.start_proxy()
spec.start_proxy(config.sandbox_policy.get())
.await
.map_err(|err| anyhow::anyhow!("failed to start managed network proxy: {err}"))?,
),