network_proxy limited mode changes prefix_rule allow semantics by routing trusted commands through managed proxy

What version of Codex CLI is running?

codex-cli 0.144.1

What subscription do you have?

ChatGPT Pro

Which model were you using?

gpt-5.5

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Ghostty 1.3.1 (TERM=xterm-ghostty), no tmux, no zellij.

Codex doctor report

{
  "schemaVersion": 1,
  "overallStatus": "fail",
  "codexVersion": "0.144.1",
  "relevantChecks": {
    "config.load": {
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "/Users/user/.codex",
        "config.toml": "/Users/user/.codex/config.toml",
        "config.toml parse": "ok",
        "cwd": "/Users/user/Code/dotfiles",
        "model": "gpt-5.5",
        "model provider": "openai"
      }
    },
    "sandbox.helpers": {
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      }
    },
    "runtime.provenance": {
      "status": "ok",
      "summary": "running brew on macos-aarch64",
      "details": {
        "install method": "brew",
        "platform": "macos-aarch64",
        "version": "0.144.1"
      }
    }
  },
  "note": "The full doctor output also reported unrelated local state DB warnings and provider reachability failures from the same restricted network context. The issue below is specifically about managed network proxy behavior for execpolicy allow rules."
}

What issue are you seeing?

prefix_rule(..., decision="allow") has historically meant that a trusted command bypasses the sandbox execution path.

For example, with ordinary sandbox networking disabled/restricted, an explicitly allowed command such as:

prefix_rule(pattern=["gh", "issue", ["view", "list", "status"]], decision="allow")

can still run successfully because it is trusted by execpolicy and is not treated like an ordinary sandboxed command.

The new experimental managed network proxy changes that behavior.

With:

[features]
network_proxy = true

[permissions.dev_workspace.network]
enabled = true
mode = "limited"

a command matched by prefix_rule(..., decision="allow") is still launched with the managed proxy environment:

• HTTP_PROXY
• HTTPS_PROXY
• ALL_PROXY
• managed CA bundle env vars

As a result, the trusted command is routed through the limited managed proxy and is blocked unless every domain it contacts is also listed in permissions.<profile>.network.domains.

This is a regression in default execpolicy behavior caused by the new network_proxy feature: the allow rule still avoids the prompt / command approval path, but it no longer fully bypasses the sandboxed network path.

What steps can reproduce the bug?

Use a permission profile with managed limited network proxy enabled:

default_permissions = "dev_workspace"

[permissions.dev_workspace]
extends = ":workspace"

[permissions.dev_workspace.network]
enabled = true
mode = "limited"
allow_local_binding = false

[permissions.dev_workspace.network.domains]
"crates.io" = "allow"
"index.crates.io" = "allow"
"static.crates.io" = "allow"
"pypi.org" = "allow"
"files.pythonhosted.org" = "allow"
"registry.npmjs.org" = "allow"

[features]
network_proxy = true

Add an execpolicy allow rule:

prefix_rule(pattern=["gh", "issue", ["view", "list", "status"]], decision="allow")

Do not include api.github.com in permissions.<profile>.network.domains.

Run:

$ gh issue list --repo openai/codex
Post "https://api.github.com/graphql": Forbidden

A plain probe shows the same managed proxy block:

$ curl -sS https://api.github.com/rate_limit
curl: (56) CONNECT tunnel failed, response 403

api.github.com is intentionally not listed in network.domains. The bug is not that the domain is missing from the network allowlist; the bug is that a rules-allowed command is being routed through the managed proxy at all.

What is the expected behavior?

Commands matched by prefix_rule(..., decision="allow") should not use the managed network proxy.

If execpolicy trusts a command enough to bypass the sandbox execution path, network_proxy = true should not re-route that command through the limited proxy allowlist.

Concretely, for rules-allowed commands, Codex should not inject or preserve:

• HTTP_PROXY
• HTTPS_PROXY
• ALL_PROXY
• managed proxy CA env vars

unless there is an explicit separate setting that opts trusted commands into managed proxy enforcement.

Additional information

The command is trusted by execpolicy, but still receives managed proxy env and is filtered by permissions.<profile>.network.domains.

This forces users to duplicate trust policy in two places:

1. prefix_rule(..., decision="allow")
2. permissions.<profile>.network.domains

That changes the semantics of existing allow rules when the experimental network_proxy feature is enabled.

This is a regression introduced by a new/experimental feature. Existing default.rules allow entries have a clear behavior: trusted commands bypass the sandbox path. Enabling network_proxy = true should not silently weaken that behavior by keeping trusted commands behind the managed limited proxy.

Using network.domains as a workaround is not equivalent and is less safe. A domain allowlist grants access to every sandboxed command that can reach that domain, while prefix_rule(..., decision="allow") grants trust to one specific command shape.

For example, allowing api.github.com globally would let arbitrary sandboxed commands talk to the GitHub API. The intended policy is narrower: keep GitHub blocked for ordinary commands, but allow a known-safe gh issue list/view/status command to run outside the sandbox path.

Related, but not exact duplicates:

• #29141 — approved require_escalated command still has no network access with a custom permission profile.
• #15309 — approved escalated commands still inherit restricted network policy in interactive CLI sessions.
• #12919 — scheduled automations could not access GitHub API despite allowlisted gh api; closed, but contains a relevant root-cause hypothesis about trusted execpolicy bypassing sandbox while retaining network policy.
• #16242 — codex-network-proxy behavior with exec / interactive mode.
• #19262 — gh auth status can misleadingly report invalid auth inside a restricted Codex execution context.

This report is specifically about network_proxy = true changing prefix_rule(..., decision="allow") behavior: a rules-allowed command is still routed through the managed limited proxy.