sayan-oai e0f05de6e0 Allow approved escalation with environment-owned network policies (#46499) ...

## Why

Environment-owned network policies rejected explicit sandbox escalation before command approval, and retained terminals that bypassed or no longer matched those policies required a new terminal.

## What changed

- Allow `require_escalated` commands through the normal approval flow and bypass managed network proxies when full escalation is permitted.
- Preserve denied-read restrictions, including the sandbox and network proxy needed to enforce them.
- Track the network restrictions bypassed at launch and require escalation review for terminal input when launch permissions or network settings warrant it, instead of rejecting input outright.

## Testing

Extend network approval coverage for approved and denied escalation, unproxied remote execution, and preserved denied-read restrictions. Add retained-terminal coverage verifying command and `write_stdin` approvals with restricted and unrestricted filesystems, and update the unit test for changed environment network policies to expect escalation review.

GitOrigin-RevId: 50524b1bc4e3df58447c3c92fb9e50e69ed50cf8

2026-09-18 23:06:48 +00:00

..

common

Add opt-in overhead timing to code-mode responses (#46288)

2026-09-17 19:34:45 +00:00

remote_env_windows

Apply remote platform semantics to exec safety checks (#42113)

2026-09-01 18:24:56 +00:00

suite

Allow approved escalation with environment-owned network policies (#46499)

2026-09-18 23:06:48 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Handle unknown error classifications and configure gateway OAuth (#46482)

2026-09-18 22:29:16 +00:00