feat(core): add structured network approval plumbing and policy decision model by viyatb-oai · Pull Request #11672 · openai/codex

viyatb-oai · 2026-02-13T01:51:18Z

Description

Summary

Introduces the core plumbing required for structured network approvals

What changed

Added structured network policy decision modeling in core.
Added approval payload/context types needed for network approval semantics.
Wired shell/unified-exec runtime plumbing to consume structured decisions.
Updated related core error/event surfaces for structured handling.
Updated protocol plumbing used by core approval flow.
Included small CLI debug sandbox compatibility updates needed by this layer.

Why

establishes the minimal backend foundation for network approvals without yet changing high-level orchestration or TUI behavior.

Notes

Behavior remains constrained by existing requirements/config gating.
Follow-up PRs in the stack handle orchestration, UX, and app-server integration.

…elation hardening

dylan-hurd-oai

I'm pretty concerned about the number of changes going into process_manager that are not gated behind a feature flag. will cc @jif-oai for visibility but I would love if we could figure out a way to test this without refactoring our load-bearing command executable path

codex-rs/core/src/tools/runtimes/shell.rs

codex-rs/core/src/unified_exec/process_manager.rs

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7532de8bd7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/unified_exec/process_manager.rs

…/pr-b-network-core-plumbing

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f4152143e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/network_policy_decision.rs

Align PR-B callsites and structs with the branch's current network approval plumbing surface so workspace clippy passes cleanly. - Remove partially wired C-layer runtime/orchestrator fields from B-level code paths - Fill required protocol/error fields with compatibility defaults - Update remaining start_proxy callsites to current signature Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Update ExecApprovalRequestEvent test fixtures to include network_approval_context now that the protocol field is required on this branch. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…nd retry flow (#11673) ### Description #### Summary Integrates structured network approvals into the core orchestration path. #### What changed - Wired structured network approval handling into tool orchestration/retry paths. - Integrated approval outcomes into command execution lifecycle. - Added orchestration-level handling for allow-once/session approval behavior. - Connected core session/delegate surfaces required for end-to-end approval flow. - Updated related core test coverage for orchestration behavior. #### Why With plumbing in place from parent, this PR makes network approvals operational in core command execution flow. #### Notes - Gated behavior remains aligned with managed network requirements and sandbox policy. --------- Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

- only construct inline network policy decider when network proxy config is enabled - map proxy protocol tag "http-connect" to HTTPS approval context Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Reuse decision/source constants from codex-network-proxy in network policy parsing to avoid duplicated string literals and drift. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Restore the single combined guard clause in is_likely_sandbox_denied for minimal diff churn with no behavior change. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Move shell runtime network-approval bookkeeping into a dedicated helper and add targeted comments for inline network decider wiring and attempt-scoped proxy env handling. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Extract policy decider builder setup into a helper and remove temporary debug logging in orchestrator to reduce noise and keep flow readable. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…ry behavior Preserve the original orchestrator flow/comments and restore required network retry approval semantics (network context extraction, OnRequest network prompt path, and retry approval bypass guard). Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Restore process_manager control-flow closer to original shape while preserving required network approval behavior (attempt tracking, policy-denial handling, and delayed denial termination). Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Reduce shape churn in refresh_process_state while preserving async-safe network attempt cleanup for exited processes. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Keep refresh_process_state close to original structure while preserving exited-process network attempt cleanup. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Move attempt registration/cleanup and approval outcome handling into a shared tools/network_approval module, then wire shell and unified-exec runtimes through ToolOrchestrator-managed context. This removes duplicate network-attempt plumbing from process_manager and shell runtime, while preserving deferred handling for long-lived unified-exec sessions. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Drop low-value tests that only mirror the mode match logic in should_ask_on_allowlist_miss. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Parse network policy payload decision/source into typed proxy enums with custom deserializers, and remove string comparisons from approval gating logic. Also switch internal exec attempt IDs to UUID in ExecParams, converting to string only at proxy env boundaries. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…nfig When unified-exec sees delayed user denial, terminate the process and explicitly release process state + unregister the network attempt in the watcher path. Also inline policy-decider builder configuration in NetworkProxySpec::start_proxy and remove the separate builder-returning helper. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Inline the restricted-sandbox match at callsite and remove a single-use helper to keep start_proxy flow linear. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Use Self::stdout_stream(ctx) instead of ShellRuntime::stdout_stream(ctx) for consistency with impl-local helper calls. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Move network approval attempt/session state into a dedicated service, wire structured blocked-request callbacks from the managed proxy, and route unified-exec cleanup through service APIs so approval flow no longer depends on proxy telemetry lookups. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Rename and centralize managed network decider/observer construction in network_approval to keep codex session startup wiring minimal, and remove the extra unified-exec delayed-denial debug log. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…val types Regenerate app-server protocol JSON/TypeScript schema fixtures so they include the network approval context/protocol types referenced by approval events. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

dylan-hurd-oai

This is a lot cleaner - some additional comments to address

codex-rs/app-server/src/codex_message_processor.rs

codex-rs/cli/src/debug_sandbox.rs

codex-rs/core/src/unified_exec/process_manager.rs

dylan-hurd-oai · 2026-02-13T21:42:00Z

codex-rs/core/src/unified_exec/process_manager.rs

+        if let Some(pruned_entry) = pruned_entry {
+            Self::unregister_network_attempt_for_entry(&pruned_entry).await;
+            pruned_entry.process.terminate();
+        }


Is there some lifecycle-related reason that we need to move the terminate call out of prune_processes_if_needed? Could we just call unregister_network_attempt_for_entry at the existing terminate callsite?

codex-rs/core/src/unified_exec/process_manager.rs

codex-rs/core/src/codex.rs

codex-rs/core/src/network_policy_decision.rs

- add Config::managed_network_requirements_enabled() and use it in core, app-server, and debug_sandbox - extract managed proxy startup flow in Session helper - move unified-exec delayed network denial watcher into async_watcher and gate it by managed requirements - simplify network policy protocol parsing by using serde enum aliases instead of a custom deserializer Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

dylan-hurd-oai

so close! Also, codex had this to say:

The new denial watcher drops non-user network outcomes, which can suppress deferred policy-denial errors for long-lived unified-exec processes. That behavior
  is a functional regression in network-approval handling.

  Review comment:

  - [P2] Preserve non-user network outcomes in denial watcher — /Users/dylan.hurd/code/codex-3/codex-rs/core/src/unified_exec/async_watcher.rs:163-166
    The watcher consumes approval outcomes with take_outcome() on every poll, but only acts when the value is DeniedByUser. If a long-lived unified-exec
    process records DeniedByPolicy, this code silently drops that outcome and continues, so later calls cannot surface the policy rejection message (the
    outcome was already removed). This is reproducible when a running process hits a deny-only host after startup; the proxy blocks it, but the deferred
    rejection signal is lost

codex-rs/core/src/codex.rs

- avoid consuming non-user network outcomes in the unified-exec denial watcher - add take_user_denial_outcome so policy denials remain available for deferred reporting - gate managed proxy startup outside the awaited helper call in Session setup Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

codex-rs/core/src/unified_exec/process_manager.rs

codex-rs/core/src/codex.rs

Use a chained if-let to make the early-return guard in unregister_network_attempt_for_entry more compact, matching reviewer suggestion. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

got Dylan's stamp

viyatb-oai added 9 commits February 12, 2026 16:09

feat(network-proxy): add structured policy signaling and attempt corr…

0b3ad56

…elation hardening

fix(network-proxy): keep violation logging debug-only

1ac6227

refactor(network-proxy): rename attempt metadata module

5cc1ec4

refactor(network-proxy): remove cursor-based blocked telemetry APIs

507ad8b

feat(core): add structured network approval plumbing

7968de2

fix(network-proxy): avoid codespell false positive on hop header

9ff8aec

docs(network-proxy): clarify te header byte literal

8338c28

refactor(network-proxy): remove unused temporary-host and drain APIs

0f56d56

refactor(network-proxy): remove unused temporary-host and drain APIs

7532de8

dylan-hurd-oai requested changes Feb 13, 2026

View reviewed changes

chatgpt-codex-connector bot reviewed Feb 13, 2026

View reviewed changes

codex-rs/core/src/unified_exec/process_manager.rs Outdated Show resolved Hide resolved

Merge branch 'codex/viyatb/pr-a-network-proxy-only' into codex/viyatb…

4d3d8ba

…/pr-b-network-core-plumbing

viyatb-oai requested a review from jif-oai February 13, 2026 05:10

viyatb-oai and others added 2 commits February 12, 2026 21:26

refactor(core): align unified exec process manager with main flow

cc618ba

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): extract shell network denial lookup helper

4f41521

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

viyatb-oai marked this pull request as ready for review February 13, 2026 05:43

chatgpt-codex-connector bot reviewed Feb 13, 2026

View reviewed changes

codex-rs/core/src/network_policy_decision.rs Outdated Show resolved Hide resolved

viyatb-oai and others added 13 commits February 12, 2026 22:17

chore(core): remove accidental local artifacts from PR branch

66cd808

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): use network-proxy decision constants

04acf2d

Reuse decision/source constants from codex-network-proxy in network policy parsing to avoid duplicated string literals and drift. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): collapse sandbox denial early-return guard

feeaa87

Restore the single combined guard clause in is_likely_sandbox_denied for minimal diff churn with no behavior change. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): simplify network decider wiring

2336c6d

Extract policy decider builder setup into a helper and remove temporary debug logging in orchestrator to reduce noise and keep flow readable. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): simplify unified exec process state refresh

2f45bbb

Reduce shape churn in refresh_process_state while preserving async-safe network attempt cleanup for exited processes. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): restore unified exec refresh_process_state shape

5779f05

Keep refresh_process_state close to original structure while preserving exited-process network attempt cleanup. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

viyatb-oai and others added 17 commits February 13, 2026 08:47

chore(core): remove trivial network proxy sandbox mode tests

6ad65e6

Drop low-value tests that only mirror the mode match logic in should_ask_on_allowlist_miss. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

style(core): inline sandbox ask-mode check in proxy startup

5f6e156

Inline the restricted-sandbox match at callsite and remove a single-use helper to keep start_proxy flow linear. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

style(core): prefer Self:: for shell runtime helper call

a4ceb85

Use Self::stdout_stream(ctx) instead of ShellRuntime::stdout_stream(ctx) for consistency with impl-local helper calls. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

docs(protocol): add websocket TODO to network approval protocol

dfb4870

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

fix(core): support typed socks network approval protocols

b3ad882

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): type network policy payload protocol

5c1d0b6

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): remove case-insensitive network policy parsing

d830760

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

test(core): use example.com in network approval tests

8bad4cb

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

fix(core): gate network approval flow on managed requirements

e0ad0f6

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

merge: origin/main into codex/viyatb/pr-b-network-core-plumbing

b68c750

fix(linux-sandbox): update landlock tests for exec field changes

702a79b

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

dylan-hurd-oai reviewed Feb 13, 2026

View reviewed changes

viyatb-oai enabled auto-merge (squash) February 13, 2026 23:04

dylan-hurd-oai reviewed Feb 14, 2026

View reviewed changes

codex-rs/core/src/codex.rs Outdated Show resolved Hide resolved

dylan-hurd-oai reviewed Feb 14, 2026

View reviewed changes

codex-rs/core/src/unified_exec/process_manager.rs Outdated Show resolved Hide resolved

dylan-hurd-oai reviewed Feb 14, 2026

View reviewed changes

codex-rs/core/src/codex.rs Show resolved Hide resolved

dylan-hurd-oai approved these changes Feb 14, 2026

View reviewed changes

viyatb-oai merged commit b527ee2 into main Feb 14, 2026
33 checks passed

viyatb-oai deleted the codex/viyatb/pr-b-network-core-plumbing branch February 14, 2026 04:18

github-actions bot locked and limited conversation to collaborators Feb 14, 2026

Conversation

viyatb-oai commented Feb 13, 2026

Description

Summary

What changed

Why

Notes

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dylan-hurd-oai Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants