From 32f45394fd72e3247600c319b5653adeaba21335 Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Mon, 23 Feb 2026 12:46:49 -0800
Subject: [PATCH] refactor(linux-sandbox): inline nested proxy fallback
 predicate

---
 codex-rs/linux-sandbox/src/linux_run_main.rs  | 25 ++-----------------
 .../linux-sandbox/src/linux_run_main_tests.rs | 20 ---------------
 2 files changed, 2 insertions(+), 43 deletions(-)

diff --git a/codex-rs/linux-sandbox/src/linux_run_main.rs b/codex-rs/linux-sandbox/src/linux_run_main.rs
index 2f017a2b5c..34b791cc44 100644
--- a/codex-rs/linux-sandbox/src/linux_run_main.rs
+++ b/codex-rs/linux-sandbox/src/linux_run_main.rs
@@ -90,10 +90,8 @@ pub fn run_main() -> ! {
     }
     ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec, use_bwrap_sandbox);
 
-    let disable_nested_managed_proxy = should_disable_managed_proxy_for_nested_bwrap(
-        allow_network_for_proxy,
-        apply_seccomp_then_exec,
-    );
+    let disable_nested_managed_proxy =
+        allow_network_for_proxy && !apply_seccomp_then_exec && has_bwrap_ancestor();
     if disable_nested_managed_proxy {
         eprintln!(
             "codex-linux-sandbox: nested Codex bubblewrap sandbox detected; \
@@ -191,25 +189,6 @@ fn ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec: bool, use_bwrap_san
     }
 }
 
-fn should_disable_managed_proxy_for_nested_bwrap(
-    allow_network_for_proxy: bool,
-    apply_seccomp_then_exec: bool,
-) -> bool {
-    should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(
-        allow_network_for_proxy,
-        apply_seccomp_then_exec,
-        has_bwrap_ancestor(),
-    )
-}
-
-fn should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(
-    allow_network_for_proxy: bool,
-    apply_seccomp_then_exec: bool,
-    has_bwrap_ancestor: bool,
-) -> bool {
-    allow_network_for_proxy && !apply_seccomp_then_exec && has_bwrap_ancestor
-}
-
 fn has_bwrap_ancestor() -> bool {
     const MAX_ANCESTOR_DEPTH: usize = 32;
     let mut pid = match parent_pid_of(std::process::id()) {
diff --git a/codex-rs/linux-sandbox/src/linux_run_main_tests.rs b/codex-rs/linux-sandbox/src/linux_run_main_tests.rs
index 2abffc1b0c..11471afbe7 100644
--- a/codex-rs/linux-sandbox/src/linux_run_main_tests.rs
+++ b/codex-rs/linux-sandbox/src/linux_run_main_tests.rs
@@ -157,23 +157,3 @@ fn valid_inner_stage_modes_do_not_panic() {
     ensure_inner_stage_mode_is_valid(false, true);
     ensure_inner_stage_mode_is_valid(true, true);
 }
-
-#[test]
-fn nested_managed_proxy_fallback_only_applies_to_outer_stage() {
-    assert_eq!(
-        should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(true, false, true),
-        true
-    );
-    assert_eq!(
-        should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(true, true, true),
-        false
-    );
-    assert_eq!(
-        should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(true, false, false),
-        false
-    );
-    assert_eq!(
-        should_disable_managed_proxy_for_nested_bwrap_with_ancestor_bwrap(false, false, true),
-        false
-    );
-}