mirror of https://github.com/openai/codex.git synced 2026-09-05 15:18:41 +00:00

Files

viyatb-oai 85fd52f7e4 Enforce configured network proxy in codex sandbox (#27035 )

## Why

`codex sandbox` can start a network proxy from a configured permission
profile. Previously, sandbox-level containment was tied to managed
network requirements rather than whether a proxy was actually active.
This meant config-driven proxy policies were not consistently enforced
as the sandbox's only network path.

## What changed

- Enable proxy-only network containment whenever `codex sandbox` starts
a network proxy.
- Apply the same active-proxy check to the macOS and Linux sandbox
paths.
- Add a Linux regression test that verifies a sandboxed command cannot
establish a direct connection while the configured proxy is active.

## Test plan

- `just test -p codex-cli debug_sandbox::tests`
- `sandbox_with_network_proxy_blocks_direct_loopback_access` runs on
Linux to cover the config-driven proxy path end to end.

2026-06-08 14:03:37 -07:00

.cargo

Ignore proc-macro-error2 advisory (#26974 )

2026-06-08 11:39:08 +02:00

.config

Fan out rust-ci-full nextest by platform (#23358 )

2026-05-19 17:54:41 -07:00

.github/workflows

Uprev Rust toolchain pins to 1.95.0 (#24684 )

2026-05-26 20:59:47 -07:00

agent-graph-store

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

agent-identity

…

analytics

[codex-analytics] report compaction analytics details (#26680 )

2026-06-08 10:52:31 -07:00

ansi-escape

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

app-server

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

app-server-client

Switch runtime to cloud config bundle (#24622 )

2026-06-02 13:18:59 -07:00

app-server-daemon

Report app-server version in codex doctor (#24311 )

2026-05-25 09:41:12 -07:00

app-server-protocol

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

app-server-test-client

[codex] Add user input client ids (#24653 )

2026-05-28 14:54:39 -07:00

app-server-transport

fix(remote-control): preserve enrollment on generic websocket 404s (#26741 )

2026-06-05 22:54:57 -07:00

apply-patch

[codex] Consolidate shared prompts in codex-prompts (#25151 )

2026-06-01 18:45:07 +00:00

arg0

cli: add package path from install context (#26189 )

2026-06-03 19:08:19 -07:00

async-utils

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

aws-auth

feat: enable AWS login credentials for Bedrock auth (#21623 )

2026-05-08 04:07:59 +00:00

backend-client

feat(app-server): expose account token usage [1 of 2] (#25344 )

2026-06-05 14:43:44 +00:00

bwrap

fix(bwrap): emit libcap after standalone archive (#21285 )

2026-05-05 22:22:01 -07:00

chatgpt

[codex-rs] support v2 personal access tokens (#25731 )

2026-06-05 17:36:18 -07:00

cli

Enforce configured network proxy in codex sandbox (#27035 )

2026-06-08 14:03:37 -07:00

cloud-config

Allow EDU accounts to fetch cloud config bundles (#25963 )

2026-06-02 16:41:48 -07:00

cloud-tasks

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

cloud-tasks-client

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

cloud-tasks-mock-client

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

code-mode

Add saved image path hint to standalone image generation (#25947 )

2026-06-04 09:39:20 -07:00

codex-api

[codex] Enable standalone web search in code mode (#26719 )

2026-06-07 23:18:23 -07:00

codex-backend-openapi-models

feat: show enterprise monthly credit limits in status (#24812 )

2026-06-01 21:25:42 -07:00

codex-client

Uprev Rust toolchain pins to 1.95.0 (#24684 )

2026-05-26 20:59:47 -07:00

codex-experimental-api-macros

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

codex-mcp

[app-server][core] Add connector-level Guardian reviewer overrides (#25167 )

2026-06-02 17:04:11 +02:00

collaboration-mode-templates

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

config

fix: preserve auto review across config and delegation (#26230 )

2026-06-08 18:59:50 +00:00

connectors

Seed prompt history from resumed messages (#24298 )

2026-05-28 22:08:05 -07:00

context-fragments

skills: resolve per-turn catalogs from turn input context (#26106 )

2026-06-03 13:32:55 +02:00

core

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

core-api

Route AGENTS.md loading through environment filesystems (#26205 )

2026-06-04 12:43:07 -07:00

core-plugins

fix(core-plugins): send Codex product SKU to plugin-service (#26804 )

2026-06-06 14:03:00 -07:00

core-skills

Bridge host-loaded skills into the skills extension (#26172 )

2026-06-04 15:28:06 +02:00

docs

protocol: remove submission-side serde from Op (#26674 )

2026-06-05 15:41:13 -07:00

exec

Make runtime workspace roots absolute in app-server API (#26552 )

2026-06-05 11:36:53 -07:00

exec-server

[codex] Add environment shell info (#26480 )

2026-06-04 22:36:25 -07:00

execpolicy

deps: update starlark to 0.14.2 (#24820 )

2026-06-07 17:35:33 -07:00

execpolicy-legacy

deps: update starlark to 0.14.2 (#24820 )

2026-06-07 17:35:33 -07:00

ext

[codex] Exclude external tool output from memories (#26821 )

2026-06-08 16:53:04 +00:00

external-agent-migration

external-agent-migration: avoid mixed MCP transport configs (#26435 )

2026-06-04 14:16:03 -04:00

external-agent-sessions

[codex] Speed up external agent session imports (#26637 )

2026-06-08 14:16:32 -04:00

features

[codex] Gate terminal visualization instructions in TUI (#26013 )

2026-06-05 17:23:45 -07:00

feedback

Attach Windows sandbox log to feedback reports (#24623 )

2026-05-26 15:59:25 -07:00

file-search

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

file-system

exec-server: canonicalize bound filesystem paths (#25149 )

2026-06-01 11:53:31 -07:00

file-watcher

Fix fs/watch debounce batching (#24716 )

2026-05-28 23:09:55 -07:00

git-utils

Fix remote turn diff display roots (#23261 )

2026-05-18 10:53:49 -07:00

hooks

Switch runtime to cloud config bundle (#24622 )

2026-06-02 13:18:59 -07:00

install-context

cli: add package path from install context (#26189 )

2026-06-03 19:08:19 -07:00

keyring-store

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

linux-sandbox

[codex] Allow socketpair in proxy-routed Linux sandbox (#26625 )

2026-06-05 09:34:36 -07:00

lmstudio

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

[codex-rs] support v2 personal access tokens (#25731 )

2026-06-05 17:36:18 -07:00

mcp-server

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

memories

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

message-history

Optimize unbounded byte scans with memchr (#26265 )

2026-06-04 09:53:08 -04:00

model-provider

[codex-rs] support v2 personal access tokens (#25731 )

2026-06-05 17:36:18 -07:00

model-provider-info

[codex-rs] support v2 personal access tokens (#25731 )

2026-06-05 17:36:18 -07:00

models-manager

[codex-rs] support v2 personal access tokens (#25731 )

2026-06-05 17:36:18 -07:00

network-proxy

Wire managed MITM CA trust into child env (#22668 )

2026-06-01 23:23:59 +00:00

ollama

Optimize unbounded byte scans with memchr (#26265 )

2026-06-04 09:53:08 -04:00

otel

[codex-rs] support v2 personal access tokens (#25731 )

2026-06-05 17:36:18 -07:00

plugin

fix: Allow plugin skills to share plugin-level icon assets (#23776 )

2026-05-21 16:11:59 -07:00

process-hardening

fix(process-hardening): preserve macos malloc diagnostics (#24479 )

2026-05-25 17:26:10 -03:00

prompts

skills: resolve per-turn catalogs from turn input context (#26106 )

2026-06-03 13:32:55 +02:00

protocol

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

realtime-webrtc

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

response-debug-context

…

responses-api-proxy

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

rmcp-client

fix(rmcp): refresh expired OAuth tokens before startup (#26482 )

2026-06-05 02:31:06 +00:00

rollout

[codex] Forward turn moderation metadata through app-server (#25710 )

2026-06-05 02:41:06 -07:00

rollout-trace

[codex] Forward turn moderation metadata through app-server (#25710 )

2026-06-05 02:41:06 -07:00

sandboxing

Enforce configured network proxy in codex sandbox (#27035 )

2026-06-08 14:03:37 -07:00

scripts

Uprev Rust toolchain pins to 1.95.0 (#24684 )

2026-05-26 20:59:47 -07:00

secrets

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

shell-command

[codex] Add /usr/bin/bash shell fallback (#26538 )

2026-06-05 09:38:26 -07:00

shell-escalation

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

skills

[codex] Update OpenAI Docs skill (#24914 )

2026-05-28 15:11:11 +00:00

state

[codex] Support model-defined reasoning efforts (#26444 )

2026-06-04 13:36:24 -07:00

stdio-to-uds

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

terminal-detection

feat(cli): add codex doctor diagnostics (#22336 )

2026-05-13 21:23:19 +00:00

test-binary-support

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

thread-manager-sample

Pair thread environment settings (#26687 )

2026-06-08 13:55:15 -07:00

thread-store

[codex] Support model-defined reasoning efforts (#26444 )

2026-06-04 13:36:24 -07:00

tools

[codex] Exclude external tool output from memories (#26821 )

2026-06-08 16:53:04 +00:00

tui

fix: preserve auto review across config and delegation (#26230 )

2026-06-08 18:59:50 +00:00

uds

Disable empty Cargo test targets (#21584 )

2026-05-07 15:44:17 -07:00

utils

[codex] Support model-defined reasoning efforts (#26444 )

2026-06-04 13:36:24 -07:00

v8-poc

CI: Customize v8 building (#22086 )

2026-05-18 21:33:05 -07:00

vendor

vendor: update bubblewrap to 0.11.2 (#21389 )

2026-05-06 18:10:30 +00:00

windows-sandbox-rs

Improve Windows sandbox setup refresh diagnostics (#26471 )

2026-06-04 16:52:10 -07:00

.gitignore

…

BUILD.bazel

…

Cargo.lock

deps: update starlark to 0.14.2 (#24820 )

2026-06-07 17:35:33 -07:00

Cargo.toml

[codex] Restore release symbol artifacts with line tables (#26202 )

2026-06-08 17:16:36 +00:00

clippy.toml

…

config.md

…

default.nix

…

deny.toml

Ignore proc-macro-error2 advisory (#26974 )

2026-06-08 11:39:08 +02:00

README.md

Simplify Codex CLI README (#26313 )

2026-06-04 09:16:03 -07:00

rust-toolchain.toml

Uprev Rust toolchain pins to 1.95.0 (#24684 )

2026-05-26 20:59:47 -07:00

rustfmt.toml

…

README.md

Codex CLI

Codex CLI Documentation