exec-server: start managed network proxy on executor - #31453
Conversation
Co-authored-by: Codex noreply@openai.com
Co-authored-by: Codex noreply@openai.com
| else { | ||
| return Ok((env, managed_network.cloned(), None)); | ||
| }; | ||
| let state = NetworkProxyState::from_static_config(proxy_config.into_network_proxy_config()) |
There was a problem hiding this comment.
This freezes managed-network policy for the whole remote process lifetime. Core updates the shared local proxy when the permission profile or domain policy changes, but an existing executor proxy keeps its launch-time access. We need an update path or a session-scoped proxy whose policy remains Core-owned
There was a problem hiding this comment.
[from Codex]: Agreed this needs an explicit update/reload boundary. Reload is intentionally out of scope for this stack, so I have not resolved this thread. The Guardian follow-up keeps Core-owned decisions for policy misses, but it does not claim to update already-materialized static executor policy.
Co-authored-by: Codex noreply@openai.com
Co-authored-by: Codex noreply@openai.com
| Some(ProcessEntry::Starting(_)) | None => (false, None), | ||
| } | ||
| }; | ||
| if let Some(network_proxy_handle) = network_proxy_handle |
There was a problem hiding this comment.
This ties the proxy lifetime to the direct child, but exec-server explicitly allows descendants to outlive it
Background commands inherit these proxy URLs, so leader exit removes their only sandbox-permitted egress while they’re still running. Is this expected?
|
|
||
| impl NetworkProxyState { | ||
| /// Builds immutable runtime state from an already-computed effective configuration. | ||
| pub fn from_static_config(config: NetworkProxyConfig) -> Result<Self> { |
There was a problem hiding this comment.
Can we remove this for now? I don't see callers after the launch config split
2 participants
Summary
Why
Core currently prepares orchestrator-local loopback endpoints for remote commands. The remote sandbox receives those ports, but exec-server never creates a reachable proxy on the executor, so managed networking fails closed without usable egress.
Stack follow-up: preserve inline Guardian network decisions across the exec-server transport.