From c32b50beb7e44cc0787001cccbb2afb9b68f4290 Mon Sep 17 00:00:00 2001
From: David Wiesen <iceweasel@openai.com>
Date: Tue, 7 Jul 2026 12:11:02 -0700
Subject: [PATCH] Reject Windows proxies without elevated sandbox

---
 codex-rs/core/src/config/config_tests.rs | 26 ++++++++++++++----------
 codex-rs/core/src/config/mod.rs          |  2 +-
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/codex-rs/core/src/config/config_tests.rs b/codex-rs/core/src/config/config_tests.rs
index eb7e132f02..c59334c5d0 100644
--- a/codex-rs/core/src/config/config_tests.rs
+++ b/codex-rs/core/src/config/config_tests.rs
@@ -173,25 +173,29 @@ fn windows_network_proxy_requires_elevated_only_sandbox_requirement() {
 
 #[test]
 fn windows_network_proxy_requires_elevated_sandbox() {
-    let err = validate_windows_sandbox_network_proxy_compatibility_for_platform(
-        /*is_windows*/ true,
+    for windows_sandbox_level in [
+        WindowsSandboxLevel::Disabled,
         WindowsSandboxLevel::RestrictedToken,
-        /*network_proxy_configured*/ true,
-    )
-    .expect_err("unelevated Windows sandbox should reject configured network proxy");
+    ] {
+        let err = validate_windows_sandbox_network_proxy_compatibility_for_platform(
+            /*is_windows*/ true,
+            windows_sandbox_level,
+            /*network_proxy_configured*/ true,
+        )
+        .expect_err("non-elevated Windows sandbox should reject configured network proxy");
 
-    assert!(matches!(
-        err.get_ref()
-            .and_then(|source| source.downcast_ref::<ConstraintError>()),
-        Some(ConstraintError::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox)
-    ));
+        assert!(matches!(
+            err.get_ref()
+                .and_then(|source| source.downcast_ref::<ConstraintError>()),
+            Some(ConstraintError::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox)
+        ));
+    }
 }
 
 #[test]
 fn windows_network_proxy_compatibility_allows_valid_combinations() -> std::io::Result<()> {
     for (windows_sandbox_level, network_proxy_configured) in [
         (WindowsSandboxLevel::Disabled, false),
-        (WindowsSandboxLevel::Disabled, true),
         (WindowsSandboxLevel::RestrictedToken, false),
         (WindowsSandboxLevel::Elevated, false),
         (WindowsSandboxLevel::Elevated, true),
diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index 2708d0efe1..17ae38c94d 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -615,7 +615,7 @@ fn validate_windows_sandbox_network_proxy_compatibility_for_platform(
 ) -> std::io::Result<()> {
     if is_windows
         && network_proxy_configured
-        && windows_sandbox_level == WindowsSandboxLevel::RestrictedToken
+        && windows_sandbox_level != WindowsSandboxLevel::Elevated
     {
         return Err(ConstraintError::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox.into());
     }