Subagent persistent network-policy amendments mutate the parent exec policy

Codex CLI version

codex-cli 0.147.0 (source checkout: fa5d5ae047)

Subscription plan

Not available. This report is based on source tracing from a local openai/codex checkout.

Model

Not applicable to the source-level reproduction.

Platform

Darwin 25.6.0 arm64 arm

Terminal / multiplexer

Not applicable to the source-level reproduction.

What issue are you seeing?

A spawned subagent can persist a network allow/deny rule into the parent agent's mutable ExecPolicyManager.

When parent and child have matching exec-policy configuration layers, AgentControl::inherited_exec_policy_for_source passes the child an Arc clone of parent_thread.session.services.exec_policy:

Some(Arc::clone(&parent_thread.session.services.exec_policy))

The child's Session::persist_network_policy_amendment then calls append_network_rule_and_update, which both appends to the policy file and updates that shared in-memory manager. A child-side Deny amendment therefore becomes part of the parent's effective exec policy.

Each session has its own managed proxy. The amendment updates the child's running proxy, but does not refresh the parent's proxy. On the parent's subsequent managed-proxy refresh or new session startup, the proxy is rebuilt from the now-mutated shared exec policy, so the parent begins denying network access that originated in the child.

Reproduction steps

1. Start a parent session with multi-agent enabled, managed network policy enabled, and ordinary matching exec-policy config layers.
2. Have the parent spawn a child agent.
3. From the child, handle a network-approval request using a persistent network-policy amendment that denies a host.
4. Return to the parent and trigger a managed-network-proxy refresh (for example, a permission-profile change) or start a fresh parent session using the persisted policy.
5. Observe the parent's access to that host fail under the child's deny rule.

This is source-traced; I have not yet built an end-to-end automated reproduction.

Expected behavior

A child may inherit the parent's baseline policy, but a child-scoped network decision must not mutate the parent's live or persisted policy. Parent and child policy amendments should be independently scoped, or persistent mutation should require an explicit parent-level action.

Additional information

Relevant source paths:

• codex-rs/core/src/agent/control.rs: inherited_exec_policy_for_source
• codex-rs/core/src/exec_policy.rs: append_network_rule_and_update
• codex-rs/core/src/session/mod.rs: persist_network_policy_amendment and refresh_managed_network_proxy_for_current_permission_profile

Related but not duplicates:

• #14357 reports parent-to-child runtime/network-policy inheritance problems.
• #15305 reports a subagent using stale runtime sandbox configuration.

This report is specifically about child-to-parent mutation through the shared ExecPolicyManager and the resulting stale-parent-proxy mismatch.

Start by tracing inherited_exec_policy_for_source in codex-rs/core/src/agent/control.rs into append_network_rule_and_update in codex-rs/core/src/exec_policy.rs, then follow persist_network_policy_amendment and refresh_managed_network_proxy_for_current_permission_profile in codex-rs/core/src/session/mod.rs. Done means a child network amendment does not mutate the parent’s live or persisted policy, and the parent’s managed proxy remains unaffected.