feat(tui): render structured network approval prompts in approval overlay by viyatb-oai · Pull Request #11674 · openai/codex

viyatb-oai · 2026-02-13T01:52:55Z

Description

Summary

Adds the TUI UX layer for structured network approvals

What changed

Updated approval overlay to display network-specific approval context (host/protocol).
Added/updated TUI wiring so approval prompts show correct network messaging.
Added tests covering the new approval overlay behavior.

Why

Core orchestration can now request structured network approvals; this ensures users see clear, contextual prompts in the TUI.

Notes

UX behavior activates only when network approval context is present.

…elation hardening

dylan-hurd-oai

generally looks good once previous prs in the stack clear!

codex-rs/core/src/tools/orchestrator.rs

codex-rs/tui/src/bottom_pane/approval_overlay.rs

…atb/pr-c-network-core-orchestration

…x/viyatb/pr-d-network-tui-ux

…/pr-b-network-core-plumbing

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Align PR-B callsites and structs with the branch's current network approval plumbing surface so workspace clippy passes cleanly. - Remove partially wired C-layer runtime/orchestrator fields from B-level code paths - Fill required protocol/error fields with compatibility defaults - Update remaining start_proxy callsites to current signature Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Update ExecApprovalRequestEvent test fixtures to include network_approval_context now that the protocol field is required on this branch. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…nd retry flow (#11673) ### Description #### Summary Integrates structured network approvals into the core orchestration path. #### What changed - Wired structured network approval handling into tool orchestration/retry paths. - Integrated approval outcomes into command execution lifecycle. - Added orchestration-level handling for allow-once/session approval behavior. - Connected core session/delegate surfaces required for end-to-end approval flow. - Updated related core test coverage for orchestration behavior. #### Why With plumbing in place from parent, this PR makes network approvals operational in core command execution flow. #### Notes - Gated behavior remains aligned with managed network requirements and sandbox policy. --------- Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

- only construct inline network policy decider when network proxy config is enabled - map proxy protocol tag "http-connect" to HTTPS approval context Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Reuse decision/source constants from codex-network-proxy in network policy parsing to avoid duplicated string literals and drift. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Parse network policy payload decision/source into typed proxy enums with custom deserializers, and remove string comparisons from approval gating logic. Also switch internal exec attempt IDs to UUID in ExecParams, converting to string only at proxy env boundaries. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…nfig When unified-exec sees delayed user denial, terminate the process and explicitly release process state + unregister the network attempt in the watcher path. Also inline policy-decider builder configuration in NetworkProxySpec::start_proxy and remove the separate builder-returning helper. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Inline the restricted-sandbox match at callsite and remove a single-use helper to keep start_proxy flow linear. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Use Self::stdout_stream(ctx) instead of ShellRuntime::stdout_stream(ctx) for consistency with impl-local helper calls. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Move network approval attempt/session state into a dedicated service, wire structured blocked-request callbacks from the managed proxy, and route unified-exec cleanup through service APIs so approval flow no longer depends on proxy telemetry lookups. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Rename and centralize managed network decider/observer construction in network_approval to keep codex session startup wiring minimal, and remove the extra unified-exec delayed-denial debug log. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…dex/viyatb/pr-d-network-tui-ux

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 79a66635eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/codex.rs

…val types Regenerate app-server protocol JSON/TypeScript schema fixtures so they include the network approval context/protocol types referenced by approval events. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

- add Config::managed_network_requirements_enabled() and use it in core, app-server, and debug_sandbox - extract managed proxy startup flow in Session helper - move unified-exec delayed network denial watcher into async_watcher and gate it by managed requirements - simplify network policy protocol parsing by using serde enum aliases instead of a custom deserializer Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

- avoid consuming non-user network outcomes in the unified-exec denial watcher - add take_user_denial_outcome so policy denials remain available for deferred reporting - gate managed proxy startup outside the awaited helper call in Session setup Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Use a chained if-let to make the early-return guard in unregister_network_attempt_for_entry more compact, matching reviewer suggestion. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…lumbing' into codex/viyatb/pr-d-network-tui-ux

…work-tui-ux

joshka-oai · 2026-02-14T06:37:51Z

codex-rs/tui/src/bottom_pane/approval_overlay.rs

+fn exec_options(
+    proposed_execpolicy_amendment: Option<ExecPolicyAmendment>,
+    network_approval_context: Option<&NetworkApprovalContext>,
+) -> Vec<ApprovalOption> {
+    if network_approval_context.is_some() {
+        return vec![


nit: Given the pattern - fn (a, b) { if a.is_some() { return ... } ... }, you might find that in general, the code reads much nicer as:

fn_a(a) { ... } fn_b(b) { ... } let x = if a.is_some() { fn_a(a) } else { fn_b(b) }

(where a and b are network_approval_context and proposed_execpolicy_amendment)

You've got that pattern almost already below (exec_options, patch_options)

viyatb-oai added 15 commits February 12, 2026 16:09

feat(network-proxy): add structured policy signaling and attempt corr…

0b3ad56

…elation hardening

fix(network-proxy): keep violation logging debug-only

1ac6227

refactor(network-proxy): rename attempt metadata module

5cc1ec4

refactor(network-proxy): remove cursor-based blocked telemetry APIs

507ad8b

feat(core): add structured network approval plumbing

7968de2

feat(core): wire structured network approvals through orchestration

642169f

feat(tui): render structured network approval prompts

809f658

fix(network-proxy): avoid codespell false positive on hop header

9ff8aec

docs(network-proxy): clarify te header byte literal

8338c28

refactor(network-proxy): remove unused temporary-host and drain APIs

0f56d56

refactor(network-proxy): remove unused temporary-host and drain APIs

7532de8

refactor(network-proxy): remove unused temporary-host and drain APIs

1e4645a

refactor(core): drop unreachable temporary-host retry path

535cfb4

refactor(network-proxy): remove unused temporary-host and drain APIs

7e652eb

refactor(core): drop unreachable temporary-host retry path

f484323

dylan-hurd-oai reviewed Feb 13, 2026

View reviewed changes

codex-rs/core/src/tools/orchestrator.rs Outdated Show resolved Hide resolved

codex-rs/tui/src/bottom_pane/approval_overlay.rs Outdated Show resolved Hide resolved

viyatb-oai and others added 7 commits February 12, 2026 19:41

Merge branch 'codex/viyatb/pr-b-network-core-plumbing' into codex/viy…

cdc3ccf

…atb/pr-c-network-core-orchestration

Merge branch 'codex/viyatb/pr-c-network-core-orchestration' into code…

9061688

…x/viyatb/pr-d-network-tui-ux

Merge branch 'codex/viyatb/pr-a-network-proxy-only' into codex/viyatb…

4d3d8ba

…/pr-b-network-core-plumbing

style(tui): reword one-time network approval option

79a6663

refactor(core): align unified exec process manager with main flow

cc618ba

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): extract shell network denial lookup helper

4f41521

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

viyatb-oai force-pushed the codex/viyatb/pr-c-network-core-orchestration branch from cdc3ccf to b010edf Compare February 13, 2026 06:29

viyatb-oai and others added 2 commits February 12, 2026 22:58

Base automatically changed from codex/viyatb/pr-c-network-core-orchestration to codex/viyatb/pr-b-network-core-plumbing February 13, 2026 07:21

viyatb-oai and others added 3 commits February 12, 2026 23:36

chore(core): remove accidental local artifacts from PR branch

66cd808

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): use network-proxy decision constants

04acf2d

Reuse decision/source constants from codex-network-proxy in network policy parsing to avoid duplicated string literals and drift. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

viyatb-oai and others added 13 commits February 13, 2026 08:59

style(core): inline sandbox ask-mode check in proxy startup

5f6e156

Inline the restricted-sandbox match at callsite and remove a single-use helper to keep start_proxy flow linear. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

style(core): prefer Self:: for shell runtime helper call

a4ceb85

Use Self::stdout_stream(ctx) instead of ShellRuntime::stdout_stream(ctx) for consistency with impl-local helper calls. Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

docs(protocol): add websocket TODO to network approval protocol

dfb4870

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

fix(core): support typed socks network approval protocols

b3ad882

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): type network policy payload protocol

5c1d0b6

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

refactor(core): remove case-insensitive network policy parsing

d830760

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

test(core): use example.com in network approval tests

8bad4cb

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

fix(core): gate network approval flow on managed requirements

e0ad0f6

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

merge: origin/main into codex/viyatb/pr-b-network-core-plumbing

b68c750

fix(linux-sandbox): update landlock tests for exec field changes

702a79b

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

viyatb-oai marked this pull request as ready for review February 13, 2026 20:04

viyatb-oai and others added 2 commits February 13, 2026 12:08

Merge branch 'origin/codex/viyatb/pr-b-network-core-plumbing' into co…

e2085ee

…dex/viyatb/pr-d-network-tui-ux

chatgpt-codex-connector bot reviewed Feb 13, 2026

View reviewed changes

codex-rs/core/src/codex.rs Outdated Show resolved Hide resolved

codex-rs/core/src/codex.rs Outdated Show resolved Hide resolved

viyatb-oai and others added 6 commits February 13, 2026 12:22

fix(tui): remove duplicate network approval fields in tests

58b0f8e

Co-Authored-By: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Merge remote-tracking branch 'origin/codex/viyatb/pr-b-network-core-p…

3e779d9

…lumbing' into codex/viyatb/pr-d-network-tui-ux

Base automatically changed from codex/viyatb/pr-b-network-core-plumbing to main February 14, 2026 04:18

Merge remote-tracking branch 'origin/main' into codex/viyatb/pr-d-net…

f60fa11

…work-tui-ux

viyatb-oai enabled auto-merge (squash) February 14, 2026 05:01

joshka-oai approved these changes Feb 14, 2026

View reviewed changes

viyatb-oai merged commit 3164670 into main Feb 14, 2026
33 checks passed

viyatb-oai deleted the codex/viyatb/pr-d-network-tui-ux branch February 14, 2026 06:38

github-actions bot locked and limited conversation to collaborators Feb 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(tui): render structured network approval prompts in approval overlay#11674

feat(tui): render structured network approval prompts in approval overlay#11674
viyatb-oai merged 62 commits intomainfrom
codex/viyatb/pr-d-network-tui-ux

viyatb-oai commented Feb 13, 2026

Uh oh!

dylan-hurd-oai left a comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

Uh oh!

joshka-oai Feb 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

viyatb-oai commented Feb 13, 2026

Description

Summary

What changed

Why

Notes

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

joshka-oai Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants