openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-21 17:48:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix managed proxy start params

Browse Source
This commit is contained in:
Winston Howes
2026-05-15 10:19:13 -07:00
parent 74316b3b86
commit afc19347e2
3 changed files with 80 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/session/mod.rs
+21 -8
View File
@@ -875,6 +875,17 @@ async fn thread_title_from_thread_store(
(!title.is_empty() && thread.preview.trim() != title).then(|| title.to_string())
}
struct ManagedNetworkProxyStartParams<'a> {
spec: &'a crate::config::NetworkProxySpec,
credentialed_routes: &'a [codex_backend_client::ResolvedCredentialRoute],
exec_policy: &'a codex_execpolicy::Policy,
permission_profile: &'a PermissionProfile,
network_policy_decider: Option<Arc<dyn codex_network_proxy::NetworkPolicyDecider>>,
blocked_request_observer: Option<Arc<dyn codex_network_proxy::BlockedRequestObserver>>,
managed_network_requirements_enabled: bool,
audit_metadata: NetworkProxyAuditMetadata,
}
impl Session {
pub(crate) async fn app_server_client_metadata(&self) -> AppServerClientMetadata {
let state = self.state.lock().await;
@@ -938,14 +949,16 @@ impl Session {
}
async fn start_managed_network_proxy(
spec: &crate::config::NetworkProxySpec,
credentialed_routes: &[codex_backend_client::ResolvedCredentialRoute],
exec_policy: &codex_execpolicy::Policy,
permission_profile: &PermissionProfile,
network_policy_decider: Option<Arc<dyn codex_network_proxy::NetworkPolicyDecider>>,
blocked_request_observer: Option<Arc<dyn codex_network_proxy::BlockedRequestObserver>>,
managed_network_requirements_enabled: bool,
audit_metadata: NetworkProxyAuditMetadata,
ManagedNetworkProxyStartParams {
spec,
credentialed_routes,
exec_policy,
permission_profile,
network_policy_decider,
blocked_request_observer,
managed_network_requirements_enabled,
audit_metadata,
}: ManagedNetworkProxyStartParams<'_>,
) -> anyhow::Result<(StartedNetworkProxy, SessionNetworkProxyRuntime)> {
debug!(
credentialed_routes = credentialed_routes.len(),
codex-rs/core/src/session/session.rs
+13 -8
View File
@@ -818,14 +818,19 @@ impl Session {
.await;
let current_exec_policy = exec_policy.current();
let (network_proxy, session_network_proxy) = Self::start_managed_network_proxy(
spec,
&credentialed_routes,
current_exec_policy.as_ref(),
config.permissions.permission_profile(),
network_policy_decider.as_ref().map(Arc::clone),
blocked_request_observer.as_ref().map(Arc::clone),
managed_network_requirements_configured,
network_proxy_audit_metadata,
ManagedNetworkProxyStartParams {
spec,
credentialed_routes: &credentialed_routes,
exec_policy: current_exec_policy.as_ref(),
permission_profile: config.permissions.permission_profile(),
network_policy_decider: network_policy_decider.as_ref().map(Arc::clone),
blocked_request_observer: blocked_request_observer
.as_ref()
.map(Arc::clone),
managed_network_requirements_enabled:
managed_network_requirements_configured,
audit_metadata: network_proxy_audit_metadata,
},
)
.instrument(info_span!(
"session_init.network_proxy",
codex-rs/core/src/session/tests.rs
+46 -40
View File
@@ -683,16 +683,18 @@ async fn start_managed_network_proxy_applies_execpolicy_network_rules() -> anyho
/*justification*/ None,
)?;
let (started_proxy, _) = Session::start_managed_network_proxy(
&spec,
/*credentialed_routes*/ &[],
&exec_policy,
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
/*network_policy_decider*/ None,
/*blocked_request_observer*/ None,
/*managed_network_requirements_enabled*/ false,
crate::config::NetworkProxyAuditMetadata::default(),
)
let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams {
spec: &spec,
credentialed_routes: &[],
exec_policy: &exec_policy,
permission_profile: &permission_profile_for_sandbox_policy(
&SandboxPolicy::new_workspace_write_policy(),
),
network_policy_decider: None,
blocked_request_observer: None,
managed_network_requirements_enabled: false,
audit_metadata: crate::config::NetworkProxyAuditMetadata::default(),
})
.await?;
let current_cfg = started_proxy.proxy().current_cfg().await?;
@@ -728,16 +730,18 @@ async fn start_managed_network_proxy_ignores_invalid_execpolicy_network_rules()
/*justification*/ None,
)?;
let (started_proxy, _) = Session::start_managed_network_proxy(
&spec,
/*credentialed_routes*/ &[],
&exec_policy,
&permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
/*network_policy_decider*/ None,
/*blocked_request_observer*/ None,
/*managed_network_requirements_enabled*/ false,
crate::config::NetworkProxyAuditMetadata::default(),
)
let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams {
spec: &spec,
credentialed_routes: &[],
exec_policy: &exec_policy,
permission_profile: &permission_profile_for_sandbox_policy(
&SandboxPolicy::new_workspace_write_policy(),
),
network_policy_decider: None,
blocked_request_observer: None,
managed_network_requirements_enabled: false,
audit_metadata: crate::config::NetworkProxyAuditMetadata::default(),
})
.await?;
let current_cfg = started_proxy.proxy().current_cfg().await?;
@@ -768,16 +772,18 @@ async fn managed_network_proxy_decider_survives_full_access_start() -> anyhow::R
}
});
let (started_proxy, _) = Session::start_managed_network_proxy(
&spec,
/*credentialed_routes*/ &[],
&exec_policy,
&permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
Some(network_policy_decider),
/*blocked_request_observer*/ None,
/*managed_network_requirements_enabled*/ true,
crate::config::NetworkProxyAuditMetadata::default(),
)
let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams {
spec: &spec,
credentialed_routes: &[],
exec_policy: &exec_policy,
permission_profile: &permission_profile_for_sandbox_policy(
&SandboxPolicy::DangerFullAccess,
),
network_policy_decider: Some(network_policy_decider),
blocked_request_observer: None,
managed_network_requirements_enabled: true,
audit_metadata: crate::config::NetworkProxyAuditMetadata::default(),
})
.await?;
let spec = spec.recompute_for_permission_profile(&permission_profile_for_sandbox_policy(
@@ -841,16 +847,16 @@ async fn new_turn_refreshes_managed_network_proxy_for_sandbox_change() -> anyhow
Some(requirements),
&permission_profile_for_sandbox_policy(&initial_policy),
)?;
let (started_proxy, _) = Session::start_managed_network_proxy(
&spec,
/*credentialed_routes*/ &[],
&Policy::empty(),
&permission_profile_for_sandbox_policy(&initial_policy),
/*network_policy_decider*/ None,
/*blocked_request_observer*/ None,
/*managed_network_requirements_enabled*/ false,
crate::config::NetworkProxyAuditMetadata::default(),
)
let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams {
spec: &spec,
credentialed_routes: &[],
exec_policy: &Policy::empty(),
permission_profile: &permission_profile_for_sandbox_policy(&initial_policy),
network_policy_decider: None,
blocked_request_observer: None,
managed_network_requirements_enabled: false,
audit_metadata: crate::config::NetworkProxyAuditMetadata::default(),
})
.await?;
assert_eq!(
started_proxy