codex

mirror of https://github.com/openai/codex.git synced 2026-11-07 20:30:33 +00:00

Files

T

viyatb-oai b7d2321ef7 Derive MCP network policy and preserve saved denials (#60046 )

## Why

Stale saved grants or malformed rules can cause valid network denials to be discarded. A failed rule write can also leave the in-memory policy inconsistent with native enforcement.

## What changed

- Add a helper to derive MCP network policy from controller and environment policies, permission profiles, approval settings, and saved rules. Preserve managed restrictions and conservatively deny traffic that requires review, request hooks, or DNS checks the metadata cannot express.
- Retain valid saved denials when grants violate managed constraints or a rule batch is malformed.
- Serialize runtime updates and persistence, publishing denials before the write so they remain effective if saving fails. Publish saved grants after a successful write.
- Extract validation of listener settings for running proxy updates.

## Testing

Add coverage for policy composition, mixed-executor local binding, native proxy denial parity, stale grants, malformed denials, failed persistence, and compatibility with trusted MCP servers without policy negotiation support.

GitOrigin-RevId: ef00632acb48a51fc582f18d20a3e713f953a191

2026-11-07 03:06:33 +00:00

context_snapshot

Render host-owned V2 subagent rosters in environment context (#59531 )

2026-11-05 00:39:39 +00:00

apps_test_server.rs

Use runtime authentication for OpenAI MCP and app requests (#59749 )

2026-11-05 22:03:29 +00:00

BUILD.bazel

Unify context snapshots and group requests into windows (#44932 )

2026-09-11 22:55:38 +00:00

Cargo.toml

Extend runtime auth to account, plugin, and file requests (#59564 )