mirror of https://github.com/openai/codex.git synced 2026-09-28 08:43:01 +08:00

Files

T

History

open-matt b8d5e3f12e Allow exec-server to proxy permitted private IPs upstream (#48568 )

## Why

Private IP destinations always bypassed inherited upstream proxies, preventing their use for private networks reachable through an upstream VPN proxy.

## What changed

- Add `codex exec-server --proxy-private-ips-via-upstream`, also configurable with `CODEX_EXEC_SERVER_PROXY_PRIVATE_IPS_VIA_UPSTREAM=true`. The setting defaults to disabled.
- Allow permitted RFC 1918, carrier-grade NAT, and IPv6 unique-local destinations to use an applicable upstream proxy. Loopback and link-local destinations retain direct routing, and destination access policy still applies.
- Keep connections direct when no valid upstream proxy applies or `allow_upstream_proxy=false`. Errors after selecting an upstream proxy do not trigger a direct retry.
- Rename `ExecServerRuntimePaths` to `ExecServerRuntimeOptions` and carry the routing setting from executor startup into the managed network proxy.

## Testing

Add routing coverage for private address ranges, special-use addresses, and public targets with the option enabled and disabled. Verify that HTTP and CONNECT requests still enforce destination allowlists and denylists, and update the CLI help snapshot.

GitOrigin-RevId: b7c9cc7da0e0f545694a6521b74c9b36b7b92769

2026-09-26 23:17:41 +00:00

BUILD.bazel

Launch Linux pipe processes through a fresh setup helper (#47612 )

2026-09-23 18:25:07 +00:00

exec_server.rs

Allow exec-server to proxy permitted private IPs upstream (#48568 )

2026-09-26 23:17:41 +00:00

README.md

[codex] Add hermetic Wine exec-server test (#27937 )

2026-06-12 20:20:23 -07:00

wine_exec_server.rs

core: load AGENTS.md from foreign environments (#28958 )

2026-06-18 15:06:23 -07:00

wine_remote_test_runner.rs

Test repository-wide Rust formatter discovery (#41925 )

2026-08-31 22:47:53 +00:00

README.md

Windows exec-server fixture

This directory contains the small Windows exec-server binary used by foreign-OS tests. It links only codex-exec-server because the full Codex Windows graph does not yet cross-build with Bazel.