viyatb-oai 7194b21776 Add opt-in transparent TCP routing for Linux sandboxes (#61372) ...

## Why

Native TCP clients need to reach managed network destinations without implementing proxy support themselves.

## What changed

- Add `--transparent-tcp` to the Linux sandbox command, using a bundled TCP stack, private TUN interface, and DNS stub to route native IPv4 and IPv6 connections through the attributed managed SOCKS proxy.
- Preserve original hostnames for proxy policy checks and cancel pending approval connections when their native sockets close.
- Expose `--linux-sandbox-transparent-tcp` and `--tcp-upstream-proxy` on `codex exec-server` for transparent routing and a mandatory HTTP CONNECT next hop without direct fallback.
- Require private network and PID namespaces, private procfs, system `bwrap`, and access to `/dev/net/tun`; reject incompatible launcher options and untrusted proxy ports.

## Testing

Add integration coverage for native hostname and IPv6 connections, SOCKS attribution, pending connection cancellation, policy denials, and filesystem and host-loopback isolation. Extend launcher and executor tests for option validation and managed-policy propagation.

GitOrigin-RevId: 96bd7726e5369efceb65320face56aa85ae3deb8

2026-11-13 20:24:37 +00:00

..

src

Add opt-in transparent TCP routing for Linux sandboxes (#61372)

2026-11-13 20:24:37 +00:00

tests

Add stdin bearer authentication for exec-server registration (#59254)

2026-11-03 23:22:28 +00:00

BUILD.bazel

Ship the standalone executor in release packages (#57837)

2026-10-28 21:09:05 +00:00

Cargo.toml

Reload remote executor credentials safely across token rotation (#58251)

2026-10-30 05:30:20 +00:00