From f2aab8f20975212b0e244835395ebb1288a82def Mon Sep 17 00:00:00 2001 From: iceweasel-oai Date: Fri, 3 Jul 2026 00:23:21 -0700 Subject: [PATCH] Avoid proxy env capture for preserved fs sandbox setup --- codex-rs/windows-sandbox-rs/src/identity.rs | 33 +++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/codex-rs/windows-sandbox-rs/src/identity.rs b/codex-rs/windows-sandbox-rs/src/identity.rs index 9ac3402be1..9c8ff50328 100644 --- a/codex-rs/windows-sandbox-rs/src/identity.rs +++ b/codex-rs/windows-sandbox-rs/src/identity.rs @@ -268,6 +268,12 @@ fn desired_offline_proxy_settings( { marker.offline_proxy_settings() } + (None, crate::WindowsSandboxProxySettingsMode::Preserve) => { + crate::setup::OfflineProxySettings { + proxy_ports: Vec::new(), + allow_local_binding: false, + } + } _ => offline_proxy_settings_from_env(env_map, network_identity), } } @@ -371,4 +377,31 @@ mod tests { vec![8080] ); } + + #[test] + fn preserving_proxy_settings_without_a_marker_does_not_capture_env_proxy_ports() { + let env_map = HashMap::from([ + ( + "HTTP_PROXY".to_string(), + "http://127.0.0.1:8080".to_string(), + ), + ( + "CODEX_NETWORK_ALLOW_LOCAL_BINDING".to_string(), + "1".to_string(), + ), + ]); + + assert_eq!( + desired_offline_proxy_settings( + None, + WindowsSandboxProxySettingsMode::Preserve, + &env_map, + SandboxNetworkIdentity::Offline, + ), + crate::setup::OfflineProxySettings { + proxy_ports: vec![], + allow_local_binding: false, + } + ); + } }