fix: honor sandbox_workspace_write.network_access from user config - #613
Open
joscarras wants to merge 1 commit into
Open
fix: honor sandbox_workspace_write.network_access from user config#613joscarras wants to merge 1 commit into
joscarras wants to merge 1 commit into
Conversation
The app-server path sets the sandbox per thread, which overrides ~/.codex/config.toml — so a user's network_access = true is silently ignored and dispatched jobs get no network, even though codex exec honors the same config on the same machine. Read the effective config through the app-server's config/read and, when the user has explicitly enabled workspace-write network access, pass it through the thread config override on both thread/start and thread/resume. - config is read once per app-server client (cached promise, WeakMap) - the override is sent only when network_access is exactly true; disabled, absent, null, or unreadable config leaves params unchanged - tests cover start+resume with access enabled and every fall-through case (disabled / absent / null sandbox section / config read failure)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Codex jobs dispatched from Claude Code have no network access, even when the user's
~/.codex/config.tomlsets:Running
codex exec --sandbox workspace-writedirectly on the same machine with the same config does get network — so the setting works, it is just not honored on the plugin's app-server path.Root cause: the plugin sets the sandbox per thread in
thread/start/thread/resumeparams, which overrides the config file, and never passes the user's network setting through. The protocol already supports it:ThreadStartParamsandThreadResumeParamsboth accept a free-formconfigobject.Fix
config/read(same call shape the plugin already uses for auth status).sandbox_workspace_write.network_accessis exactlytrue, pass{ sandbox_workspace_write: { network_access: true } }as the threadconfigoverride on both start and resume.false, key absent, sectionnull, or the read failing — leaves the params byte-for-byte as before, so stock behavior is unchanged for everyone who hasn't opted in.config/readper broker process).No new dependencies, no TOML parsing — the app-server resolves the config, including project layers via
cwd.Tests
npm test: 93 pass / 0 fail. New coverage: start + resume with access enabled assert the override reaches the (fake) app-server; disabled / absent / null-section / read-failure each assert noconfigkey is sent.