mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-15 02:49:33 +01:00
docs(codex): say what Allow network access leaves alone
The owner's answer to the PR's open question: the switch does not also pass --sandbox workspace-write. Settings, wiki, skill and release note now state the consequence: a folder Codex runs read-only keeps the network closed and asks per command. A golden test pins the decision by name, and the stale launch-defaults comments now name networkAccess. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Codeman maintainer committed
1 parent
35ff4e886c
commit
131a12d195
11 files changed
+45
-19
No files matched your search
@@ -2,4 +2,4 @@
|
||||
"aicodeman": minor
|
||||
---
|
||||
|
||||
**Codex sessions can drive other sessions through the Codeman skill.** A new opt-in Codex setting, **Allow network access** (App Settings, Codex, off by default), starts Codex with `sandbox_workspace_write.network_access=true`, so the skill's calls to this server are no longer blocked by Codex's sandbox; the sandbox and approval prompts stay on, it applies where Codex runs the folder workspace-write, and it is forced off for users without the privileged-commands grant in multi-user mode. Codex 0.162 and later now also starts with `--no-daemon`, so each session runs its own Codex app server: a shared background server (another version's included) no longer stops a launch on an "incompatible feature settings" dialog, and commands inside Codex see their own session's `CODEMAN_*` variables. Version gates in the CLI registry are now measured against that CLI's own version instead of Claude's. The skill falls back to its `curl` path when `codeman` is not on PATH, and asks Codex to re-run a blocked call with approval instead of giving up.
|
||||
**Codex sessions can drive other sessions through the Codeman skill.** A new opt-in Codex setting, **Allow network access** (App Settings, Codex, off by default), starts Codex with `sandbox_workspace_write.network_access=true`, so the skill's calls to this server are no longer blocked by Codex's sandbox; the sandbox and approval prompts stay on, and it is forced off for users without the privileged-commands grant in multi-user mode. It applies where Codex runs the folder workspace-write and does not change Codex's sandbox mode: a folder Codex runs read-only keeps the network closed and asks per command. Codex 0.162 and later now also starts with `--no-daemon`, so each session runs its own Codex app server: a shared background server (another version's included) no longer stops a launch on an "incompatible feature settings" dialog, and commands inside Codex see their own session's `CODEMAN_*` variables. Version gates in the CLI registry are now measured against that CLI's own version instead of Claude's. The skill falls back to its `curl` path when `codeman` is not on PATH, and asks Codex to re-run a blocked call with approval instead of giving up.
|
||||
@@ -140,6 +140,11 @@ Explicit `codexConfig.model` / `codexConfig.reasoningEffort` values take precede
|
||||
Custom model endpoints, Docker containers and remote host command overrides keep their own settings.
|
||||
Changing a default affects new sessions and does not edit Codex configuration files.
|
||||
|
||||
**Allow network access** reaches the same local launches. It opens the network only where
|
||||
Codex runs the folder in its workspace-write sandbox and does not change Codex's sandbox
|
||||
mode: a folder Codex runs read-only keeps the network closed, and Codex asks per command.
|
||||
See [The Codeman Skill](Codeman-Skill#when-the-agent-is-codex).
|
||||
|
||||
Two behaviours that are deliberate and worth knowing:
|
||||
|
||||
- **Predictive echo instead of buffered echo.** Codex's composer reacts to every keystroke,
|
||||
|
||||
@@ -145,10 +145,11 @@ Two things to know:
|
||||
drive others. It applies to Codex sessions started after you switch it on, and it keeps
|
||||
Codex's sandbox and approval prompts. It opens the network only where Codex runs the
|
||||
folder in its workspace-write sandbox, which is what Codex does for a project you
|
||||
trusted. In a folder Codex runs read-only (a new case that is not a git repository, for
|
||||
one), Codex asks you to approve each call to Codeman instead; `/permissions` in Codex
|
||||
switches that session to workspace-write. **Bypass approvals and sandbox** works
|
||||
everywhere, but removes the sandbox and the approval prompts.
|
||||
trusted. It does not change Codex's sandbox mode: a folder Codex runs read-only (a new
|
||||
case that is not a git repository, for one) keeps the network closed, and Codex asks you
|
||||
to approve each call to Codeman. Trust the project in Codex, or use `/permissions` in
|
||||
Codex for that session, to get workspace-write there. **Bypass approvals and sandbox**
|
||||
works everywhere, but removes the sandbox and the approval prompts.
|
||||
- Codex 0.162 runs its commands in a shared background process, whose Codeman variables can
|
||||
belong to the session that started it. Codeman starts Codex 0.162 and later with
|
||||
`--no-daemon`, so each session runs its own; with an older Codex the skill notices and
|
||||
|
||||
@@ -208,7 +208,7 @@ instead of its native cloud backend. See [Custom Model Endpoints](Custom-Model-E
|
||||
| Default Codex model | Model for new local Codex sessions; empty uses Codex's own config. Letters, digits, `.` `_` `-` `/` only. |
|
||||
| Default Codex reasoning effort | Reasoning level for new local Codex sessions; empty uses Codex's own config. |
|
||||
| Bypass approvals and sandbox | Starts new Codex sessions with `--dangerously-bypass-approvals-and-sandbox`. Read [Agent CLIs](Agent-CLIs) before enabling. |
|
||||
| Allow network access | Starts new Codex sessions with `sandbox_workspace_write.network_access=true`, so commands in Codex's workspace-write sandbox can use the network. The [Codeman Skill](Codeman-Skill) needs it to reach this server from a Codex session. It applies where Codex runs the folder in workspace-write (a project you trusted in Codex); in a folder Codex runs read-only, Codex asks for approval per command instead. The sandbox and approval prompts stay on. Synced, off by default; forced off for users without the privileged-commands grant in multi-user mode. |
|
||||
| Allow network access | Starts new local Codex sessions with `sandbox_workspace_write.network_access=true`, so commands in Codex's workspace-write sandbox can use the network. The [Codeman Skill](Codeman-Skill) needs it to reach this server from a Codex session. It applies where Codex runs the folder in workspace-write (a project you trusted in Codex) and does not change Codex's sandbox mode: a folder Codex runs read-only keeps the network closed, and Codex asks for approval per command. The sandbox and approval prompts stay on. Synced, off by default; forced off for users without the privileged-commands grant in multi-user mode. |
|
||||
| Animated status effects | Cosmetic. |
|
||||
| MCP server sync | Copies the MCP servers each installed, enabled CLI (Claude, Codex, Gemini, OpenCode, Antigravity) and GitHub Copilot CLI has into the others' own config files. Synced, off by default, admin only in multi-user mode. Turn it on and **Apply** or **Save** (Apply keeps Settings open), then **Preview** shows what would change and **Sync now** applies it. It only adds missing servers, keeps the previous file as `.codeman-bak`, and leaves a file that receives env values or headers readable by you only. A config dir moved by `CODEX_HOME`, `CLAUDE_CONFIG_DIR`, `XDG_CONFIG_HOME`, `GEMINI_CLI_HOME` or `COPILOT_HOME` in Codeman's own environment is followed. |
|
||||
|
||||
|
||||
@@ -78,9 +78,10 @@ retrying.
|
||||
command** once that way, never a different one; if the user declines, stop. For lasting
|
||||
access in Codex, the user turns on **Allow network access** (Codeman App Settings,
|
||||
Codex) and starts a new Codex session: it opens the network wherever Codex runs the
|
||||
folder workspace-write, and keeps the sandbox and approvals. A folder Codex runs
|
||||
read-only still needs the per-command approval (or `/permissions`). **Bypass approvals
|
||||
and sandbox** works everywhere but drops the sandbox and approvals.
|
||||
folder workspace-write, and keeps the sandbox and approvals. It does not change the
|
||||
sandbox mode: a folder Codex runs read-only keeps the network closed, so each call
|
||||
still needs the per-command approval (or `/permissions`). **Bypass approvals and
|
||||
sandbox** works everywhere but drops the sandbox and approvals.
|
||||
- **`"${CURL[@]}" -o /dev/null -w '%{http_code}' "$API/api/v1/sessions/$SELF"` prints
|
||||
`404`.** The commands you run do not carry this session's environment: Codex can run them in a shared background
|
||||
process another session started, so `$CODEMAN_SESSION_ID` (and with it `$SELF` and
|
||||
|
||||
@@ -78,9 +78,10 @@ retrying.
|
||||
command** once that way, never a different one; if the user declines, stop. For lasting
|
||||
access in Codex, the user turns on **Allow network access** (Codeman App Settings,
|
||||
Codex) and starts a new Codex session: it opens the network wherever Codex runs the
|
||||
folder workspace-write, and keeps the sandbox and approvals. A folder Codex runs
|
||||
read-only still needs the per-command approval (or `/permissions`). **Bypass approvals
|
||||
and sandbox** works everywhere but drops the sandbox and approvals.
|
||||
folder workspace-write, and keeps the sandbox and approvals. It does not change the
|
||||
sandbox mode: a folder Codex runs read-only keeps the network closed, so each call
|
||||
still needs the per-command approval (or `/permissions`). **Bypass approvals and
|
||||
sandbox** works everywhere but drops the sandbox and approvals.
|
||||
- **`"${CURL[@]}" -o /dev/null -w '%{http_code}' "$API/api/v1/sessions/$SELF"` prints
|
||||
`404`.** The commands you run do not carry this session's environment: Codex can run them in a shared background
|
||||
process another session started, so `$CODEMAN_SESSION_ID` (and with it `$SELF` and
|
||||
|
||||
@@ -674,8 +674,9 @@ const CODEX: CliEntry = {
|
||||
// a live pane): loopback stays blocked under workspace-write until this is set.
|
||||
// ⚠️ Workspace-write ONLY: a folder codex runs read-only (one it does not trust,
|
||||
// such as a fresh non-git case) keeps the network closed and asks per command.
|
||||
// Deliberately not paired with `--sandbox workspace-write`, which would also
|
||||
// grant write access to a folder codex itself chose not to trust.
|
||||
// Deliberately not paired with `--sandbox workspace-write` (owner decision,
|
||||
// 2026-11-06), which would also grant write access to a folder codex itself chose
|
||||
// not to trust, under a label that only says "network".
|
||||
{
|
||||
flag: '--config',
|
||||
value: 'sandbox_workspace_write.network_access=true',
|
||||
|
||||
@@ -439,8 +439,10 @@ export interface CodexConfig {
|
||||
dangerouslyBypassApprovals?: boolean;
|
||||
/**
|
||||
* Let commands in codex's workspace-write sandbox use the network, Codeman's loopback API
|
||||
* included (passes --config sandbox_workspace_write.network_access=true). Filled from the
|
||||
* synced `codexNetworkAccess` setting when unset; clamped off for a non-granted owner.
|
||||
* included (passes --config sandbox_workspace_write.network_access=true). Never changes the
|
||||
* sandbox mode: a folder codex runs read-only keeps the network closed and asks per command.
|
||||
* Filled from the synced `codexNetworkAccess` setting when unset; clamped off for a
|
||||
* non-granted owner.
|
||||
*/
|
||||
networkAccess?: boolean;
|
||||
/** Enable Codex's decorative TUI animations. Disable to reduce remote terminal redraws. */
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* @fileoverview Launch-time defaults from synced App Settings, driven by registry data.
|
||||
*
|
||||
* A CLI entry declares `capabilities.launchDefaults` (launch param -> settings key; today
|
||||
* only codex, `{ model: 'codexModel', reasoningEffort: 'codexReasoningEffort' }`), and
|
||||
* only codex: `model`, `reasoningEffort` and `networkAccess`), and
|
||||
* `applyLaunchDefaults()` fills those settings into the entry's `launch.legacyConfigField`
|
||||
* object, setting ONLY the fields the caller left unset. Persisted values are re-validated
|
||||
* with `SettingsUpdateSchema`, so a hand-edited settings.json can never smuggle an
|
||||
@@ -39,7 +39,7 @@ export async function applyLaunchDefaults<T extends object>(
|
||||
const defaults: Record<string, unknown> = {};
|
||||
for (const [param, settingKey] of Object.entries(declared)) {
|
||||
const parsed = SettingsUpdateSchema.shape[settingKey].safeParse(settings[settingKey]);
|
||||
// '' is the settings' "leave it to the CLI" value, the same as unset.
|
||||
// '' and an off switch are the settings' "leave it to the CLI" value, the same as unset.
|
||||
const value = parsed.success ? parsed.data || undefined : undefined;
|
||||
const wireKey = aliases[param] ?? param;
|
||||
if (value !== undefined && (current?.[wireKey] ?? undefined) === undefined) defaults[wireKey] = value;
|
||||
|
||||
@@ -3048,7 +3048,7 @@
|
||||
<div class="set-row" data-search="codex network access sandbox loopback codeman skill orchestrate spawn">
|
||||
<div class="set-row-text">
|
||||
<span class="set-row-label">Allow network access</span>
|
||||
<span class="set-row-desc">Lets commands in Codex's workspace-write sandbox use the network, which the Codeman skill needs to reach this server. A folder Codex runs read-only (one it does not trust) still asks per command. The sandbox and approvals stay on. Applies to new Codex sessions.</span>
|
||||
<span class="set-row-desc">Lets commands in Codex's workspace-write sandbox use the network, which the Codeman skill needs to reach this server. It does not change Codex's sandbox mode: a folder Codex runs read-only (one it does not trust) keeps the network closed and asks per command. The sandbox and approvals stay on. Applies to new local Codex sessions.</span>
|
||||
</div>
|
||||
<label class="switch switch-sm"><input type="checkbox" id="appSettingsCodexNetworkAccess"><span class="slider"></span></label>
|
||||
</div>
|
||||
|
||||
@@ -197,6 +197,21 @@ describe('codex', () => {
|
||||
expect(cx({ networkAccess: false })).toBe('codex');
|
||||
});
|
||||
|
||||
it('never pairs network access with a sandbox mode (owner decision, 2026-11-06)', () => {
|
||||
// A folder codex runs read-only must stay read-only: it keeps the network closed and asks
|
||||
// per command. `--sandbox workspace-write` here would also grant write access to it.
|
||||
for (const version of ['0.162.0', null]) {
|
||||
const command = render({
|
||||
mode: 'codex',
|
||||
sessionId: SID,
|
||||
codexConfig: { networkAccess: true },
|
||||
claudeCliVersion: version,
|
||||
});
|
||||
expect(command).not.toContain('--sandbox');
|
||||
expect(command).not.toContain('-s ');
|
||||
}
|
||||
});
|
||||
|
||||
// The `claudeCliVersion` option is the version every gate of THIS entry is measured
|
||||
// against (the name predates a second gated CLI); undefined probes codex itself.
|
||||
const cxv = (version: string | null, codexConfig?: SpawnBridgeOptions['codexConfig']) =>
|
||||
|
||||
Reference in new issue
Block a user