mirror of https://github.com/openai/codex.git synced 2026-10-19 17:28:46 +00:00

Files

T

open-matt b8d5e3f12e Allow exec-server to proxy permitted private IPs upstream (#48568 )

## Why

Private IP destinations always bypassed inherited upstream proxies, preventing their use for private networks reachable through an upstream VPN proxy.

## What changed

- Add `codex exec-server --proxy-private-ips-via-upstream`, also configurable with `CODEX_EXEC_SERVER_PROXY_PRIVATE_IPS_VIA_UPSTREAM=true`. The setting defaults to disabled.
- Allow permitted RFC 1918, carrier-grade NAT, and IPv6 unique-local destinations to use an applicable upstream proxy. Loopback and link-local destinations retain direct routing, and destination access policy still applies.
- Keep connections direct when no valid upstream proxy applies or `allow_upstream_proxy=false`. Errors after selecting an upstream proxy do not trigger a direct retry.
- Rename `ExecServerRuntimePaths` to `ExecServerRuntimeOptions` and carry the routing setting from executor startup into the managed network proxy.

## Testing

Add routing coverage for private address ranges, special-use addresses, and public targets with the option enabled and disabled. Verify that HTTP and CONNECT requests still enforce destination allowlists and denylists, and update the CLI help snapshot.

GitOrigin-RevId: b7c9cc7da0e0f545694a6521b74c9b36b7b92769

2026-09-26 23:17:41 +00:00

src

Allow exec-server to proxy permitted private IPs upstream (#48568 )

2026-09-26 23:17:41 +00:00

BUILD.bazel

Add ThreadManager sample crate (#20141 )

2026-04-29 11:21:06 -07:00

Cargo.toml

Move item event mapping into app-server-protocol (#20299 )

2026-04-30 11:02:13 -07:00

README.md

Respect configured authentication in the thread manager sample (#48004 )

2026-09-25 05:14:07 +00:00

README.md

ThreadManager Sample

Small one-shot binary that starts a Codex thread with ThreadManager from codex-core-api, submits a single user turn, and prints the final assistant message.

Authentication uses the configured credential storage under CODEX_HOME, including cli_auth_credentials_store, mcp_oauth_credentials_store, and features.secret_auth_storage. Local managed authentication requirements and auth routing settings are respected. This also applies to cargo run builds. Other execution settings remain the sample's built-in configuration.

cargo run -p codex-thread-manager-sample -- "Say hello"

Use --model to override the configured default model:

cargo run -p codex-thread-manager-sample -- --model gpt-5.2 "Say hello"

The prompt can also be piped through stdin:

printf 'Say hello\n' | cargo run -p codex-thread-manager-sample