mirror of https://github.com/openai/codex.git synced 2026-09-15 12:08:01 +00:00

Files

viyatb-oai e47d02ab27 Config surface

New config key: [network_proxy.policy].allow_unix_sockets (string array), stored/edited via network_proxy.rs.
Entries support:
SSH_AUTH_SOCK / ${SSH_AUTH_SOCK}
preset aliases: ssh-agent, ssh_auth_sock, ssh_auth_socket
Entries are resolved at runtime to canonical absolute socket paths before generating Seatbelt rules.
macOS Seatbelt integration

seatbelt.rs now:
allows only loopback proxy ports (localhost:<port>) + explicitly allowed unix socket paths
does not emit per-domain (remote tcp ...) rules (those break under sandbox-exec)
Unix socket allowlist resolution is done via network_proxy::resolve_unix_socket_allowlist(...).
Prompt-on-deny UX (TUI)

When an exec approval happens and the command appears to need the SSH agent socket (ssh/scp/sftp/ssh-add, or git with ssh-style remotes), and the socket isn’t already allowed:
TUI shows an approval modal for the unix socket.
Allow for session: writes the resolved socket path to config (and removes it on exit, like session domain approvals).
Allow always: writes SSH_AUTH_SOCK to allow_unix_sockets for portability across restarts.

2025-12-19 23:57:18 -08:00

2.0 KiB

Raw Blame History

Codex Network Proxy Quickstart (Local)

This is a compact guide to build and validate the Codex network proxy locally.

Build

From the Codex repo:

cd /Users/viyatb/code/codex/codex-rs
cargo build -p codex-network-proxy

For MITM support:

cargo build -p codex-network-proxy --features mitm

Configure

Add this to ~/.codex/config.toml:

[network_proxy]
enabled = true
proxy_url = "http://127.0.0.1:3128"
admin_url = "http://127.0.0.1:8080"
mode = "limited" # or "full"
prompt_on_block = true
poll_interval_ms = 1000

[network_proxy.policy]
allowed_domains = ["example.com", "*.github.com"]
denied_domains = ["metadata.google.internal", "169.254.*"]
# macOS only: allow specific local IPC when proxy-restricted.
allow_local_binding = false
# Example: allow SSH agent socket for git/ssh.
allow_unix_sockets = ["$SSH_AUTH_SOCK"]

[network_proxy.mitm]
enabled = false

Run the proxy

cd /Users/viyatb/code/codex/codex-rs
cargo run -p codex-network-proxy -- proxy

With MITM:

cargo run -p codex-network-proxy --features mitm -- proxy

Test with curl

HTTP/HTTPS via proxy:

export HTTP_PROXY="http://127.0.0.1:3128"
export HTTPS_PROXY="http://127.0.0.1:3128"
curl -sS https://example.com

Limited mode + HTTPS requires MITM. If MITM is on, trust the generated CA:

security add-trusted-cert -d -r trustRoot \
  -k ~/Library/Keychains/login.keychain-db \
  ~/.codex/network_proxy/mitm/ca.pem

Or pass the CA directly:

curl --cacert ~/.codex/network_proxy/mitm/ca.pem -sS https://example.com

Admin endpoints

Reload config after edits:

curl -fsS -X POST http://127.0.0.1:8080/reload

Switch modes:

curl -fsS -X POST http://127.0.0.1:8080/mode -d '{"mode":"full"}'

Codex integration sanity check

Start the proxy.
Launch Codex with the proxy enabled in config.
Run a network command (e.g., curl https://example.com).
Confirm you see the allow/deny prompt and that the proxy logs reflect the decision.

2.0 KiB Raw Blame History