viyatb-oai 3a08af44b2 Handle exec-server network policy requests in the client (#35359) ...

## What changed

- Add client-side handling for exec-server network policy requests, including request validation, per-process decision routing, and allow, deny, or ask responses.
- Bound concurrent callbacks and fail closed when requests are invalid, exceed capacity, time out, or outlive their process session.
- Replace the callback opt-in flag with a launch-level `policyDecisionTimeoutMs` value and include transport overhead in the executor timeout.
- Preserve callback admission limits across connection recovery and clean up policy state when process startup is abandoned or a session ends.

## Testing

- Cover decision forwarding, invalid and excess requests, cancellation during process cleanup, abandoned starts, timeout propagation, and launch-config serialization.

GitOrigin-RevId: 6ee2a0139e0f8170cf1a5cdd646bd811b7d3c1f6

2026-07-25 16:03:00 +00:00

..

client

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

noise_relay

exec-server: use virtual time in Noise relay test (#31344)

2026-07-06 20:25:33 -07:00

proto

exec-server: add Noise relay transport (#26242)

2026-06-15 16:39:41 -07:00

remote

Route environment registry requests through the shared HTTP client (#35034)

2026-07-23 23:25:53 +00:00

server

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

arg0_exec_helper.rs

Preserve custom arg0 for sandboxed exec-server processes (#34497)

2026-07-21 08:59:41 +00:00

capability_discovery_cache.rs

Add batched executor capability discovery (#33852)

2026-07-17 15:45:48 +00:00

capability_discovery.rs

Add batched executor capability discovery (#33852)

2026-07-17 15:45:48 +00:00

client_api.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

client_recovery_tests.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

client_recovery.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

client_transport_tests.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

client_transport.rs

Trace remote exec-server connection setup (#35275)

2026-07-25 01:39:17 +00:00

client.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

connection.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

environment_bootstrap_tests.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

environment_bootstrap.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

environment_provider.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

environment_registry_tests.rs

feat(exec-server): add Noise rendezvous environment (#28774)

2026-06-17 17:20:53 -07:00

environment_registry.rs

feat(exec-server): add Noise rendezvous environment (#28774)

2026-06-17 17:20:53 -07:00

environment_toml.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

environment.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

file_read.rs

[codex] exec-server: stream files in chunks (#28354)

2026-06-16 09:50:55 -07:00

fs_helper_main.rs

Run exec-server fs operations through sandbox helper (#17294)

2026-04-12 18:36:03 -07:00

fs_helper.rs

Add a bounded filesystem walk RPC (#29841)

2026-06-24 16:05:43 +01:00

fs_sandbox.rs

Skip missing paths in filesystem sandbox entries (#34598)

2026-07-21 19:17:18 +00:00

lib.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

local_file_system_path_uri_tests.rs

[codex] migrate ExecutorFileSystem paths to PathUri (#27424)

2026-06-11 18:44:18 +00:00

local_file_system.rs

Add a bounded filesystem walk RPC (#29841)

2026-06-24 16:05:43 +01:00

local_process.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

network_policy_decisions_tests.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

network_policy_decisions.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

noise_channel_tests.rs

exec-server: default remote transport to Noise (#26245)

2026-06-15 17:39:00 -07:00

noise_channel.rs

Size Noise handshake buffers to their messages (#34544)

2026-07-21 13:39:33 +00:00

process_sandbox_tests.rs

Preserve Windows sandbox proxy settings in guardian sessions (#35036)

2026-07-23 23:35:29 +00:00

process_sandbox.rs

Preserve Windows sandbox proxy settings in guardian sessions (#35036)

2026-07-23 23:35:29 +00:00

process.rs

[codex] consume pushed exec-server process events (#30273)

2026-06-26 18:05:52 -07:00

regular_file.rs

[codex] exec-server: stream files in chunks (#28354)

2026-06-16 09:50:55 -07:00

relay_noise_tests.rs

[codex] bound Rendezvous WebSocket liveness (#30643)

2026-07-01 14:15:34 -07:00

relay_proto.rs

exec-server: default remote transport to Noise (#26245)

2026-06-15 17:39:00 -07:00

relay.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

remote_file_stream.rs

[codex] exec-server: stream files in chunks (#28354)

2026-06-16 09:50:55 -07:00

remote_file_system_path_uri_tests.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

remote_file_system.rs

Skip missing paths in filesystem sandbox entries (#34598)

2026-07-21 19:17:18 +00:00

remote_process.rs

Resume exec-server sessions after disconnect (#28512)

2026-06-17 10:20:39 +02:00

remote.rs

Trace remote exec-server connection setup (#35275)

2026-07-25 01:39:17 +00:00

resolved_capability.rs

Remove unused Rust helpers (#34345)

2026-07-20 13:45:29 +00:00

rpc_server_requests_tests.rs

Enable exec-server network policy callbacks (#34770)

2026-07-22 15:22:21 +00:00

rpc_server_requests.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

rpc.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

runtime_paths.rs

Run exec-server fs operations through sandbox helper (#17294)

2026-04-12 18:36:03 -07:00

sandboxed_file_system_path_uri_tests.rs

[codex] migrate ExecutorFileSystem paths to PathUri (#27424)

2026-06-11 18:44:18 +00:00

sandboxed_file_system.rs

Add a bounded filesystem walk RPC (#29841)

2026-06-24 16:05:43 +01:00

server.rs

Route exec-server HTTP through configured proxy policy (#35023)

2026-07-23 22:39:28 +00:00

telemetry.rs

[codex] Observe remote exec-server lifecycle (#27470)

2026-06-25 13:42:40 -07:00

trace_context_tests.rs

[codex] Observe remote exec-server lifecycle (#27470)

2026-06-25 13:42:40 -07:00

trace_context.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

websocket_pong_watchdog_tests.rs

[codex] bound Rendezvous WebSocket liveness (#30643)

2026-07-01 14:15:34 -07:00

websocket_pong_watchdog.rs

[codex] bound Rendezvous WebSocket liveness (#30643)

2026-07-01 14:15:34 -07:00