Project network allowlist changes are silently ignored by the active task

Codex App version

26.721.31836 (build 5828)

CLI: codex-cli 0.145.0

Subscription

ChatGPT Pro

Platform

macOS 27.0 (26A5388g), Apple Silicon

What happened?

A valid project-scoped network allowlist change was not applied to the managed proxy of an already-running task.

After adding this file to the project root:

# Project-scoped access needed to download crates pinned by Cargo.lock.
[features.network_proxy]
enabled = true
domains = { "static.crates.io" = "allow" }
allow_local_binding = false

the TOML parsed successfully, but rerunning:

cargo clippy --all-targets --locked --all-features -- -D warnings

in the same task still failed:

error: failed to download from `https://static.crates.io/crates/atomic-waker/1.1.2/download`

Caused by:
  [56] Failure when receiving data from the peer
  (CONNECT tunnel failed, response 403)

There was no indication that the active task was still using an earlier network-policy snapshot or that a new task was required.

Steps to reproduce

1. Open a trusted project in Codex App.
2. Start a task before static.crates.io is allowed.
3. Run a command that downloads from static.crates.io and observe the proxy 403.
4. Add the valid project .codex/config.toml shown above.
5. Rerun the command in the same task.
6. Observe the same 403.

Expected behavior

Valid project network-domain changes should either:

1. update the active task's managed proxy for reloadable settings such as domain permissions; or
2. produce a clear message that the proxy retains its original policy and the task must be restarted.

The configuration should not validate successfully and then be silently ineffective.

Additional information

The behavior appears consistent with the current implementation, although this is source analysis rather than confirmed root-cause proof:

• StaticNetworkProxyReloader::maybe_reload() currently returns no update.
• refresh_runtime_config() does not refresh the project network-proxy configuration.
• PR #23548 proposed watching proxy-related override files, but was closed with runtime network-proxy watching explicitly left out of scope.
• PR #17040 added a narrower live proxy refresh when the sandbox mode changes.
• PR #33446 later removed the unused standalone network-proxy loader and its mtime-based reloader.

I did not find an existing issue specifically tracking project network-allowlist hot reload for active tasks.