acrognale-oai 9d4d34d436 Apply shared network policy throughout embedded Codex startup (#47411) ...

## Why

Application network restrictions need to cover clients created by the TUI and `codex exec` before embedded app-server startup, and remain effective when configuration is rebuilt.

## What changed

- Introduce `EmbeddedNetworkPolicy` to share live policy between caller-owned transports and the embedded app-server.
- Apply loaded requirements before creating telemetry, background HTTP clients, and executor connections. Limit authentication and cloud configuration bootstrap requests to exact endpoints under local policy.
- Preserve the shared policy across TUI session changes, permission-profile rebuilds, and worktree cloud loaders so existing clients observe policy reloads and failures.
- Document application network policy behavior and transport coverage.

## Testing

Add regression coverage for policy activation, reload failure and recovery, retained policy across TUI rebuilds, rejected OAuth and cloud-policy redirects, and workspace network restrictions with `CODEX_API_KEY`. Also cover retaining the caller-selected project during embedded startup.

GitOrigin-RevId: 629009f087b8cb21fc34a1ee7ea6fe95d9e0f2b5

2026-09-23 00:49:19 +00:00

..

lib.rs

Apply shared network policy throughout embedded Codex startup (#47411)

2026-09-23 00:49:19 +00:00

path.rs

[1 of 3] Support long raw TUI goal objectives (#27508)

2026-06-11 22:26:31 -07:00

remote.rs

Add explicit gateway OAuth sign-in to app-server (#47207)

2026-09-22 06:36:09 +00:00