1
00:00:00,000 --> 00:00:03,360
Thanks to Jellypod for helping make this
daily show a reality.

2
00:00:03,584 --> 00:00:08,800
Last time we were on Windows, we dug into
the sharing violation bug that broke

3
00:00:08,880 --> 00:00:09,920
sandbox startup.

4
00:00:10,053 --> 00:00:13,601
Today is the next problem you hit once the
sandbox does start.

5
00:00:13,840 --> 00:00:19,920
If you're evaluating the newer MXC backend
on Codex 0.162.1,

6
00:00:19,947 --> 00:00:25,040
there's a counterintuitive point: picking
MXC does not restrict your network by

7
00:00:25,109 --> 00:00:25,680
itself.

8
00:00:26,088 --> 00:00:29,348
That one matters because the name sounds
like a promise.

9
00:00:29,708 --> 00:00:32,948
You choose a sandbox, so you assume the
box is closed.

10
00:00:33,827 --> 00:00:36,148
What does the source say actually happens?

11
00:00:36,500 --> 00:00:40,900
The source is a review from Superpower
Daily, published October 9,

12
00:00:40,980 --> 00:00:42,100
2026.

13
00:00:42,228 --> 00:00:49,060
They traced the release tagged source for
stable 0.162.1, and compared selection

14
00:00:49,131 --> 00:00:54,740
controls against the 0.163.0 alpha 4
prerelease.

15
00:00:54,852 --> 00:00:58,900
Important qualifier up front: this was a
source review.

16
00:00:59,028 --> 00:01:04,260
They did not run Codex, they did not test
packets, and they did not confirm the

17
00:01:04,306 --> 00:01:06,820
tagged source matches the shipped
binaries.

18
00:01:07,060 --> 00:01:11,540
So this is about generated configuration,
not a demonstrated escape.

19
00:01:11,666 --> 00:01:14,340
Within that scope, the finding is clean.

20
00:01:14,500 --> 00:01:19,700
The policy translator takes your
permission profile and decides the network rules.

21
00:01:19,840 --> 00:01:22,580
The backend name is not what sets them.

22
00:01:22,720 --> 00:01:28,020
Two inputs matter: is networking enabled
in the profile, and is there a managed

23
00:01:28,100 --> 00:01:29,460
network context.

24
00:01:29,900 --> 00:01:33,320
So walk through the cases, because I think
people will want to map them to their own

25
00:01:33,400 --> 00:01:33,860
setups.

26
00:01:34,125 --> 00:01:40,205
Case one: a network disabled profile, say
read only, with no managed networking.

27
00:01:40,605 --> 00:01:46,205
MXC generates deny defaults for egress,
ingress, and host loopback.

28
00:01:46,381 --> 00:01:49,565
Host loopback means traffic back to the
same machine.

29
00:01:49,693 --> 00:01:51,965
That's the closed box people imagine.

30
00:01:52,157 --> 00:01:57,165
Case two: a network enabled profile
without managed networking.

31
00:01:57,365 --> 00:02:00,765
Now MXC generates allow defaults for all
three.

32
00:02:00,945 --> 00:02:05,565
Outbound is open, inbound is open, and
localhost is open.

33
00:02:05,685 --> 00:02:09,885
You're running in the MXC sandbox, and the
network is wide open.

34
00:02:10,177 --> 00:02:13,497
And to be fair, that doesn't mean MXC does
nothing.

35
00:02:14,017 --> 00:02:16,897
Filesystem permissions are translated
separately, right?

36
00:02:17,125 --> 00:02:17,685
Right.

37
00:02:17,805 --> 00:02:23,605
Writable paths, read only paths, denied
paths, including read only carveouts.

38
00:02:23,765 --> 00:02:29,285
The request also disables mutation of
discretionary access control lists.

39
00:02:29,498 --> 00:02:35,605
So the review is very specific: network
allow defaults describe one dimension of the

40
00:02:35,653 --> 00:02:36,725
generated policy.

41
00:02:36,853 --> 00:02:39,445
They are not unrestricted execution.

42
00:02:39,669 --> 00:02:45,765
Also, other operating system or
organizational controls could still restrict access

43
00:02:45,909 --> 00:02:48,885
even when MXC generates allow defaults.

44
00:02:49,085 --> 00:02:51,605
The review just can't speak to those.

45
00:02:51,985 --> 00:02:54,825
What about the third case, managed
networking?

46
00:02:55,545 --> 00:02:58,965
I'd guess that's the one teams reach for
when they want a proxy in the middle.

47
00:02:59,292 --> 00:03:01,612
It is, and it has a subtle edge.

48
00:03:01,740 --> 00:03:06,652
With managed networking, non loopback
traffic is denied by default.

49
00:03:06,732 --> 00:03:07,412
Good.

50
00:03:07,502 --> 00:03:12,012
But loopback is permitted across all
ports, both IPv4

51
00:03:12,332 --> 00:03:18,012
127.0.0.0/8 and IPv6

52
00:03:18,412 --> 00:03:19,452
::1.

53
00:03:19,599 --> 00:03:24,572
Setup validation does require an executor
local proxy context,

54
00:03:24,636 --> 00:03:29,772
dedicated nonzero proxy ports, and
allow_local_binding set to true.

55
00:03:29,952 --> 00:03:34,652
You'd read that and think the loopback
allowance is confined to those proxy ports.

56
00:03:34,839 --> 00:03:35,692
It isn't.

57
00:03:35,852 --> 00:03:39,772
The generated native filter does not
restrict loopback to them.

58
00:03:39,879 --> 00:03:44,972
Those ports are a setup requirement, not
the boundary for local network access.

59
00:03:45,172 --> 00:03:50,892
One thing the review explicitly left open:
how proxy destination filtering works.

60
00:03:51,036 --> 00:03:55,532
That was outside its scope, so don't read
this as a statement about what the proxy

61
00:03:55,612 --> 00:03:56,172
blocks.

62
00:03:56,548 --> 00:04:01,508
Practically, that means anything listening
on localhost, a dev database,

63
00:04:01,588 --> 00:04:06,948
an admin port, a debug server, is
reachable from inside a managed network operation.

64
00:04:07,428 --> 00:04:11,148
Though I'd flag that as my reading of the
loopback finding,

65
00:04:11,368 --> 00:04:12,748
not something the review tested.

66
00:04:13,208 --> 00:04:14,088
Fair framing.

67
00:04:14,221 --> 00:04:18,888
It's an implication to check against your
own machine, not a proven exploit.

68
00:04:19,277 --> 00:04:23,137
Now the part that I think catches people
in practice: selection.

69
00:04:23,477 --> 00:04:26,597
If I configure MXC, am I guaranteed to be
on it?

70
00:04:26,917 --> 00:04:27,397
No.

71
00:04:27,557 --> 00:04:34,477
In your config.toml, under the windows
table, you can set sandbox equal to mxc.

72
00:04:34,624 --> 00:04:41,157
Or you can use automatic selection with
prefer_mxc set to true under the features

73
00:04:41,210 --> 00:04:41,557
table.

74
00:04:41,677 --> 00:04:46,837
Automatic selection requires three things:
the preference is enabled,

75
00:04:46,857 --> 00:04:50,757
the configuration allows it, and the
native backend is available.

76
00:04:50,997 --> 00:04:56,677
An effective denial on local binding also
invalidates MXC eligibility.

77
00:04:56,890 --> 00:05:01,637
If any check fails, Codex silently keeps
its configured backend.

78
00:05:01,765 --> 00:05:04,757
That could be the legacy restricted token
engine.

79
00:05:04,877 --> 00:05:10,757
And the sandbox manager can choose no
sandbox at all under a Forbid setting.

80
00:05:10,890 --> 00:05:15,957
So a configured MXC backend does not prove
every operation used it.

81
00:05:16,438 --> 00:05:18,278
Silently is the word that worries me.

82
00:05:18,518 --> 00:05:20,198
No warning, no refusal.

83
00:05:20,458 --> 00:05:21,218
Right.

84
00:05:21,265 --> 00:05:22,858
There is one contrast.

85
00:05:22,970 --> 00:05:28,218
Once an operation explicitly enters the
WindowsMxc transformation branch,

86
00:05:28,271 --> 00:05:32,538
an unavailable native backend raises an
error instead of falling back.

87
00:05:32,678 --> 00:05:37,898
But that check sits downstream of
automatic selection, so it won't catch the silent

88
00:05:37,994 --> 00:05:38,458
case.

89
00:05:38,778 --> 00:05:41,138
So what do I actually do on Monday?

90
00:05:41,458 --> 00:05:42,258
Three steps.

91
00:05:42,438 --> 00:05:46,098
One, don't treat the backend as your
network policy.

92
00:05:46,285 --> 00:05:50,418
If you want isolation, lock the permission
profile directly.

93
00:05:50,565 --> 00:05:56,258
Under sandbox_workspace_write, set
network_access to false.

94
00:05:56,498 --> 00:06:02,098
Two, if you use managed networking, treat
all of loopback as reachable,

95
00:06:02,138 --> 00:06:07,378
and keep sensitive local services off that
machine or behind authentication.

96
00:06:07,471 --> 00:06:09,298
Three, audit.

97
00:06:09,365 --> 00:06:15,938
Check dot codex slash dot sandbox slash
sandbox.log to see what policy was

98
00:06:16,002 --> 00:06:20,258
generated, and verify whether managed
networking proxies are configured.

99
00:06:20,408 --> 00:06:25,618
Confirm which backend an operation really
used rather than assuming it from your

100
00:06:25,698 --> 00:06:26,258
config.

101
00:06:26,652 --> 00:06:32,972
Now the small stuff, because there are
three quality of life changes in 0.162.0 and

102
00:06:33,032 --> 00:06:35,472
0.162.1 worth knowing.

103
00:06:36,072 --> 00:06:41,212
First, instant interrupt is now on by
default, from PR 51812.

104
00:06:41,912 --> 00:06:46,792
New input immediately preempts model
responses or long running code mode calls.

105
00:06:47,332 --> 00:06:51,412
It's still marked under development, so if
you preferred the old behavior where

106
00:06:51,472 --> 00:06:56,432
input queued behind the response, set
instant_interrupt to false under the features

107
00:06:56,472 --> 00:06:56,772
table.

108
00:06:57,125 --> 00:07:02,805
Second, CRLF line endings are now
preserved in apply_patch universally,

109
00:07:02,837 --> 00:07:05,205
from PR 51203.

110
00:07:05,472 --> 00:07:10,325
If you work in Windows repos, patches stop
rewriting your line endings.

111
00:07:10,445 --> 00:07:16,485
The temporary
apply_patch_preserve_line_endings flag has been moved to removed,

112
00:07:16,538 --> 00:07:18,405
so you can delete it from your config.

113
00:07:18,578 --> 00:07:25,205
Third, PR 50209 adds mouse wheel scroll
speed tuning for the fullscreen

114
00:07:25,445 --> 00:07:26,565
TUI.

115
00:07:26,645 --> 00:07:33,365
Under the tui table in config.toml, set
mouse_scroll_speed to any

116
00:07:33,445 --> 00:07:34,965
finite positive number.

117
00:07:35,125 --> 00:07:40,485
The default is 1.0, and 1.5 makes it
noticeably faster.

118
00:07:40,725 --> 00:07:47,365
So the takeaway: with MXC, choose the
backend and the network policy as two separate

119
00:07:47,429 --> 00:07:50,565
decisions, then check the log to see what
you got.