document codex network sandbox

README.md

@@ -130,6 +130,26 @@ for more details.
 - Only use State of the Art (SOTA) models. Weak models can be tricked into
   revealing secrets more easily.
 
+### Internet access
+
+Buddy does not restrict Codex's internet access by default. An experimental,
+opt-in [`requirements.toml`](docs/codex/requirements.toml) is available for
+evaluation. It defines these profiles:
+
+- `:workspace` is the default profile. It can edit mounted projects but cannot
+  make network requests from commands.
+- `buddy-observability` adds command-line network access to Datadog and Fastly
+  only. Select it for tasks that need those services.
+- `:read-only` remains available, but `:danger-full-access` is not allowed.
+- Web search is limited to cached results rather than live browsing.
+
+There is no general-purpose "read-only internet" security boundary. Blocking
+HTTP write methods would not prevent data exfiltration: a secret can be placed
+in a URL, header, DNS query, or other nominally read-only request. The
+`buddy-observability` profile therefore restricts destinations rather than HTTP
+methods. Datadog and Fastly can still receive data sent to their allowed
+domains, so use the offline `:workspace` profile unless a task needs them.
+
 ### Passwordless sudo
 
 The template explicitly sets `user.passwordlessSudo: true`, which is

docs/codex/requirements.toml

@@ -0,0 +1,29 @@
+# Buddy keeps Codex offline by default and does not allow the unrestricted
+# full-access profile. Select buddy-observability only for tasks that need the
+# read-only Datadog or Fastly credentials installed in the guest.
+default_permissions = ":workspace"
+allowed_sandbox_modes = ["read-only", "workspace-write"]
+allowed_web_search_modes = ["cached"]
+
+[allowed_permission_profiles]
+":read-only" = true
+":workspace" = true
+buddy-observability = true
+
+[permissions.buddy-observability]
+description = "Workspace access with network access limited to Datadog and Fastly."
+extends = ":workspace"
+
+[permissions.buddy-observability.network]
+enabled = true
+
+[permissions.buddy-observability.network.domains]
+"**.datadoghq.com" = "allow"
+"api.fastly.com" = "allow"
+
+# Keep the administrator-owned allowlist exclusive even if a user adds network
+# rules in their own Codex configuration.
+[experimental_network]
+enabled = true
+allowed_domains = ["**.datadoghq.com", "api.fastly.com"]
+managed_allowed_domains_only = true