| Phase | 3 — Execution & sandboxing |
| Status | Not started |
| Depends on | 02 |
| Size | L |
| Drop-in critical | ★ (proxy policy + env contract) |
Reimplement codex-network-proxy natively in Go: the per-turn HTTP + SOCKS5 proxy
that gives sandboxed commands policy-controlled network access, replacing the
Rust rama-based stack.
reference-codex/codex-rs/network-proxy/src/(NetworkProxyConfig,NetworkMode,NetworkPolicyDecider, MITM hooks, audit metadata, blocked-request observer).
- HTTP(S) forward proxy + SOCKS5 proxy listeners on loopback; emit the proxy URL
into the standard env vars consumed by the sandbox/command:
HTTP_PROXY,HTTPS_PROXY,ALL_PROXY,NO_PROXY,PROXY_ACTIVE, and the macOS git-ssh markerCODEX_PROXY_GIT_SSH_COMMAND_MARKER. - Policy enforcement (
NetworkPolicyDecider): allow/deny by domain/host and Unix-socket path perNetworkSandboxPolicy; default-deny posture matching Codex. - MITM hooks (
MitmHookConfig): header injection / response modification points with the same configuration surface. - Audit metadata + blocked-request observer for logging policy violations.
- Integrate with the sandbox bridge (spec 13's TCP↔UDS↔TCP path).
- Policy decisions (allow/deny per domain & socket) match Codex on a fixture policy set (differential).
- Env vars exported to the child process match Codex exactly (names + URL format).
- A blocked request is observed/logged with equivalent audit metadata.
- HTTP and SOCKS5 paths both proxy successfully to an allowed upstream.
ramaprovides a lot for free; in Go this isnet/http+ a SOCKS5 implementation- a TLS MITM layer — more assembly required.
- TLS interception (if used) needs a generated CA matching how Codex injects trust.
- The
responses-api-proxy(spec 45) is a separate, simpler forward proxy.