viyatb-oai

Add attributed exec process lifecycle telemetry (#42373) ## Why Exec-server process and network-policy events need stable attribution to the launching tool call and executor without recording process payloads. ## What changed - Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool call IDs from unified exec. - Emit bounded OpenTelemetry events for process start, spawn failure, sandbox denial, and exit. Correlate them with the launch trace and registry-issued executor identity while excluding arguments, paths, environment values, output, and error text. - Preserve launch attribution across long-running processes and reconnects, and attach the same metadata to network-policy audit events. - Keep the protocol backward compatible when metadata is omitted, and prevent invalid trace headers from inheriting an unrelated active span. ## Testing Add coverage for metadata serialization and propagation, lifecycle event fields, trace relationships, reconnect behavior, spawn failures, sandbox denials, and network-policy attribution. GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084

Bound inbound exec-server requests across client transports (#47362) ## What changed - Enforce an 8 KiB encoded-message limit for requests, unrecognized notifications, and malformed messages received by exec-server clients over stdio, WebSocket, relay, and Noise relay transports. - Allow process output, exit, close, and HTTP request body notifications up to 2 MiB. Keep responses and errors subject to existing transport limits, and preserve executor-side request limits. - Read stdio stderr in chunks of at most 8 KiB. - Drop outgoing server-request `tracestate` values larger than 512 bytes while preserving `traceparent`. ## Testing Add regression coverage for oversized requests across transports, malformed messages, requests wrapped in `RawValue`, fragmented Noise messages, large responses, streamed notifications, and trace-context preservation. GitOrigin-RevId: 3fb87b6dc334296985ef40983d7276acfe9b9796

Enforce automatic review for managed models (#37511) ## What changed - Add the managed `auto_review.required_on_models` requirement, unioning model slugs across requirement layers and exposing the result through `configRequirements/read`. - Force listed models to use `on-request` approvals with the `auto_review` reviewer. Downgrade Full Access to workspace-write when starting a protected session, and reject incompatible runtime overrides or use when automatic review is disabled. - Preserve these protections across thread starts, resumes, forks, model changes, turn overrides, MCP approvals, and TUI session attachment. ## Testing - Add coverage for layered model requirements and exact provider-alias matching. - Add app-server tests for protected thread lifecycle operations, unsafe setting overrides, legacy thread upgrades, disabled automatic review, and requirements API output. GitOrigin-RevId: c4b1d52c3b5b75e86880725412b8f0812e0dfcd9

Harden network approval cancellation and concurrency (#35267) ## What changed - Scope pending network approvals to a turn and execution while still coalescing duplicate requests within one execution. - Fail abandoned approval owners closed, cancel denied executions, resolve any waiting requests, and cancel in-flight Guardian reviews when their owner is dropped. - Serialize session policy updates with approval caches so concurrent allow and deny decisions cannot leave enforcement and cached decisions inconsistent. - Give user approval requests and permission hooks unique per-execution identifiers. ## Testing - Cover approval deduplication boundaries, abandoned-owner cleanup, cancellation outcomes, replacement requests, and Guardian cancellation events. GitOrigin-RevId: 11e184dd1c70294a99581b6ff0d4b6607d9ea1d9

Enable exec-server network policy callbacks (#34770) ## What changed - Let `exec-server` issue JSON-RPC requests to its client and correlate responses, with bounded concurrency, timeouts, and connection cleanup. - When `request_policy_decisions` is enabled, forward proxy policy requests with the process ID and network destination, then apply the client's allow, deny, or ask decision. - Fail closed for invalid inputs, unavailable or malformed responses, timeouts, process shutdown, and disconnects. Keep callbacks active while inherited process streams keep the proxy alive. ## Testing - Cover response correlation, request limits, timeouts, disconnect cleanup, validation boundaries, decision forwarding, and process lifecycle behavior. GitOrigin-RevId: 60e658102c50036589ca9de844760a8bffaa53b0

Launch managed network proxies on remote executors (#33906) ## Why Remote executions need managed-network proxy listeners in the executor so their loopback proxy addresses are reachable by the launched process. ## What changed - Add a capability-gated exec-server protocol field for executor-local proxy launch configuration, including network policy, audit metadata, and execution attribution. - Start the proxy while preparing a remote process, replace inherited proxy environment variables with its local addresses, and derive the sandbox context from its listeners. - Keep the proxy alive until inherited output streams close, then shut it down. - Reject unsupported remote settings such as MITM and credential injection. ## Testing - Cover configuration round trips and rejection of unsupported settings. - Verify executor-local startup, blocked-domain enforcement, protocol compatibility, and proxy lifetime through process closure. GitOrigin-RevId: c984f54e3e600aa9ebcbf8cf4574046e2c199d11

Record normalized sandbox violation events (#36207) ## Why Filesystem denials and managed-network blocks did not share a structured event shape, requiring downstream consumers to rediscover enforcement paths and parse backend-specific output. See https://github.com/openai/codex/pull/17573. ## What changed - Add normalized filesystem and network violation types in `codex-sandboxing` and emit them through a shared tracing seam. - Classify filesystem denials by backend and reason, retaining an optional path and bounded output snippet, and preserve managed-network block context. - Report the sandbox type through exec-server responses so unified exec can classify remote denials without guessing; omitted values remain compatible with older peers. - Record violations from exec, apply-patch, shell-escalation, unified-exec, and managed-network enforcement paths without changing denial behavior. ## Testing - Cover filesystem classification, path extraction, `SIGSYS`, network event conversion, protocol compatibility, and remote sandbox-type propagation. GitOrigin-RevId: d673173b4fa6bdf0a24421194a8a61c81fab9c96

[codex] Preserve reviewer when resuming threads (#30278) ## Why A thread resumed without an explicit reviewer could pick up the reviewer from the current config instead of preserving the reviewer already in use by the thread. After an app restart, this meant a thread running with auto review could silently switch back to user review, and the next turn could continue under the wrong reviewer. ## What changed Persist the effective reviewer with each turn and restore the latest persisted value when the thread resumes. If the resume request explicitly provides a reviewer, that value still takes precedence. ## Test plan - Added a regression test that starts a thread with auto review, records a turn, restarts with user review in config, resumes without an override, and verifies that auto review is preserved. - `just test -p codex-protocol` - `just test -p codex-state` - `just test -p codex-rollout` - `just test -p codex-app-server thread_resume_preserves_persisted_approvals_reviewer` - Clippy for the affected crates

Support caller-provided MITM CAs in the network proxy (#47132) ## What changed - Add optional `network.mitm_ca` configuration with `certificate_file` and `private_key_file` for trusted proxy configuration. Require MITM to be enabled and retain the generated CA when no external CA is configured. - Validate absolute paths, regular files, file sizes, certificate/key matching, and Unix private-key permissions. Reject symlinks on Unix, private keys embedded in certificate files, and external private keys on non-Unix platforms. - Store derived external-CA trust bundles in the proxy artifact directory, include only certificates, and skip inherited generated bundles to avoid retaining stale roots. - Preserve MITM for external CAs when disabling credential brokerage. Reject external CA configuration for remote execution, even when the proxy is disabled, and reject unknown fields in `NetworkProxyConfig`. - Default the upstream request version adapter to HTTP/1.1 and remove the request URI from upstream request failure context. ## Testing Add regression coverage for external CA configuration, mismatched keys, embedded private keys, non-Unix rejection, trust-bundle placement and contents, stale-root exclusion, credential-broker toggling, and remote configuration rejection. GitOrigin-RevId: cb209295c19fbe53a9fa0194f11ff06acccabef6

Forward executor network policy decisions for auditing (#38670) ## What changed - Add a best-effort `network/policyDecision` notification for final domain and non-domain policy decisions made by executor-local proxies. - Validate notifications against the active process on the controller and emit audit events with controller-trusted session and execution metadata. - Reserve outbound RPC capacity so audit notifications cannot block control messages, and expose valid `chatgpt-account-id` header values for audit attribution. ## Testing - Cover notification serialization, proxy decision capture, executor-to-controller delivery, trusted metadata handling, and reserved RPC capacity. GitOrigin-RevId: a39f96a6b3d9401c03d54eaef5b9a6d3fe0da78b