Add exec-server network policy callback types (#34620)

## What changed

- Define the `network/policyRequest` RPC payloads for associating a network request with a process and returning an `allow`, `deny`, or `ask` decision.
- Cover HTTP, HTTPS CONNECT, and SOCKS5 TCP/UDP requests, with shared size limits for callback fields.
- Add the backward-compatible `requestPolicyDecisions` remote proxy option so executors can opt in to sending policy decisions to clients.
- Re-export the new protocol types from `codex-exec-server`.

## Testing

- Verify the request and decision JSON shapes.
- Verify that the proxy opt-in is omitted and defaults to `false` for legacy configurations, while an enabled value round-trips.

GitOrigin-RevId: 65b0a0723d1abb6e4f504a41d3a0dd41f5f21bf7

codex-rs/exec-server-protocol/src/lib.rs

@@ -1,7 +1,9 @@
+mod network_policy;
 mod process_id;
 mod protocol;
 pub mod rpc;
 
+pub use network_policy::*;
 pub use process_id::ProcessId;
 pub use protocol::*;
 pub use rpc::*;

codex-rs/exec-server-protocol/src/network_policy.rs

@@ -0,0 +1,51 @@
+use serde::Deserialize;
+use serde::Serialize;
+
+use crate::ProcessId;
+
+pub const NETWORK_POLICY_REQUEST_METHOD: &str = "network/policyRequest";
+pub const MAX_NETWORK_POLICY_HOST_BYTES: usize = 253;
+pub const MAX_NETWORK_POLICY_PROCESS_ID_BYTES: usize = 256;
+pub const MAX_NETWORK_POLICY_REASON_BYTES: usize = 1024;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct NetworkPolicyRequestParams {
+    pub process_id: ProcessId,
+    pub request: ExecServerNetworkPolicyRequest,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExecServerNetworkPolicyRequest {
+    pub protocol: ExecServerNetworkProtocol,
+    pub host: String,
+    pub port: u16,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ExecServerNetworkProtocol {
+    Http,
+    HttpsConnect,
+    Socks5Tcp,
+    Socks5Udp,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct NetworkPolicyRequestResponse {
+    pub decision: ExecServerNetworkPolicyDecision,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum ExecServerNetworkPolicyDecision {
+    Allow,
+    Deny { reason: String },
+    Ask { reason: String },
+}
+
+#[cfg(test)]
+#[path = "network_policy_tests.rs"]
+mod tests;

codex-rs/exec-server-protocol/src/network_policy_tests.rs

@@ -0,0 +1,75 @@
+use pretty_assertions::assert_eq;
+
+use super::ExecServerNetworkPolicyDecision;
+use super::ExecServerNetworkPolicyRequest;
+use super::ExecServerNetworkProtocol;
+use super::NetworkPolicyRequestParams;
+use super::NetworkPolicyRequestResponse;
+use crate::ProcessId;
+
+#[test]
+fn network_policy_request_uses_stable_json_shapes() {
+    let request = NetworkPolicyRequestParams {
+        process_id: ProcessId::from("process-1"),
+        request: ExecServerNetworkPolicyRequest {
+            protocol: ExecServerNetworkProtocol::HttpsConnect,
+            host: "example.com".to_string(),
+            port: 443,
+        },
+    };
+    let request_json = serde_json::json!({
+        "processId": "process-1",
+        "request": {
+            "protocol": "https_connect",
+            "host": "example.com",
+            "port": 443,
+        },
+    });
+    assert_eq!(
+        serde_json::to_value(&request).expect("serialize policy request"),
+        request_json
+    );
+    let decoded_request: NetworkPolicyRequestParams =
+        serde_json::from_value(request_json.clone()).expect("deserialize policy request");
+    assert_eq!(
+        serde_json::to_value(decoded_request).expect("reserialize policy request"),
+        request_json
+    );
+
+    let decision = NetworkPolicyRequestResponse {
+        decision: ExecServerNetworkPolicyDecision::Allow,
+    };
+    let decision_json = serde_json::json!({
+        "decision": {"type": "allow"},
+    });
+    assert_eq!(
+        serde_json::to_value(&decision).expect("serialize policy decision"),
+        decision_json
+    );
+    assert_eq!(
+        serde_json::from_value::<NetworkPolicyRequestResponse>(decision_json)
+            .expect("deserialize policy decision"),
+        decision
+    );
+
+    for (decision, decision_json) in [
+        (
+            ExecServerNetworkPolicyDecision::Deny {
+                reason: "not_allowed".to_string(),
+            },
+            serde_json::json!({"type": "deny", "reason": "not_allowed"}),
+        ),
+        (
+            ExecServerNetworkPolicyDecision::Ask {
+                reason: "not_allowed".to_string(),
+            },
+            serde_json::json!({"type": "ask", "reason": "not_allowed"}),
+        ),
+    ] {
+        let response = NetworkPolicyRequestResponse { decision };
+        assert_eq!(
+            serde_json::to_value(&response).expect("serialize policy decision"),
+            serde_json::json!({"decision": decision_json})
+        );
+    }
+}

codex-rs/exec-server/src/lib.rs

@@ -126,6 +126,9 @@ pub use protocol::ExecOutputDeltaNotification;
 pub use protocol::ExecOutputStream;
 pub use protocol::ExecParams;
 pub use protocol::ExecResponse;
+pub use protocol::ExecServerNetworkPolicyDecision;
+pub use protocol::ExecServerNetworkPolicyRequest;
+pub use protocol::ExecServerNetworkProtocol;
 pub use protocol::FsCanonicalizeParams;
 pub use protocol::FsCanonicalizeResponse;
 pub use protocol::FsCloseParams;
@@ -158,6 +161,8 @@ pub use protocol::HttpRequestParams;
 pub use protocol::HttpRequestResponse;
 pub use protocol::InitializeParams;
 pub use protocol::InitializeResponse;
+pub use protocol::NetworkPolicyRequestParams;
+pub use protocol::NetworkPolicyRequestResponse;
 pub use protocol::ProcessOutputChunk;
 pub use protocol::ProcessSignal;
 pub use protocol::ReadParams;

codex-rs/network-proxy/src/remote_config.rs

@@ -66,6 +66,9 @@ pub struct RemoteNetworkProxyConfig {
     pub domains: Option<NetworkDomainPermissions>,
     pub unix_sockets: Option<NetworkUnixSocketPermissions>,
     pub allow_local_binding: bool,
+    /// Whether the executor sends domain policy decisions back to the client.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub request_policy_decisions: bool,
 }
 
 impl RemoteNetworkProxyConfig {
@@ -88,6 +91,7 @@ impl RemoteNetworkProxyConfig {
             domains: config.domains.clone(),
             unix_sockets: config.unix_sockets.clone(),
             allow_local_binding: config.allow_local_binding,
+            request_policy_decisions: false,
         })
     }
 

codex-rs/network-proxy/src/remote_config_tests.rs

@@ -118,3 +118,26 @@ fn launch_config_materializes_audit_and_execution_attribution() {
     assert_eq!(state.environment_id(), Some("remote"));
     assert_eq!(state.execution_id().as_deref(), Some("execution-1"));
 }
+
+#[test]
+fn policy_decision_callback_opt_in_is_backward_compatible() {
+    let mut config =
+        RemoteNetworkProxyConfig::from_effective_config(&NetworkProxyConfig::default())
+            .expect("supported remote config");
+    let legacy = serde_json::to_value(&config).expect("serialize legacy config");
+    assert_eq!(legacy.get("requestPolicyDecisions"), None);
+    assert!(
+        !serde_json::from_value::<RemoteNetworkProxyConfig>(legacy)
+            .expect("deserialize legacy remote config")
+            .request_policy_decisions
+    );
+
+    config.request_policy_decisions = true;
+    let enabled = serde_json::to_value(&config).expect("serialize callback-enabled config");
+    assert_eq!(enabled["requestPolicyDecisions"], true);
+    assert_eq!(
+        serde_json::from_value::<RemoteNetworkProxyConfig>(enabled)
+            .expect("deserialize callback-enabled config"),
+        config
+    );
+}