enabling proxy access for tools in the environment?

[dannysauer]

I use some helm plugins (helm-schema) and pre-commit checks with repos. As part of my instructions, I want codex to run code through pre-commit and to validate the schema of helm charts before committing code. Unfortunately, it seems that the proxy variables aren't getting passed through to tools or something like that, because pre-commit can't get modules from github.com, helm can't download plugins, etc. I've configured the proxy allowlist properly, because the agent can fetch the URLs via curl just fine, but when a tool attempts to hit the web, I get 403 errors every time. I've asked the agent to export the http_proxy variables, and that doesn't work. :)

Am I just missing a setting somewhere, or is there a magic invocation required to allow tools running in the environment to reach the internet (github.com, in particular, via http) directly?

I'm running codex via the web when this happens, for whatever that's worth.

[krishkhinchi]

Hi @dannysauer,

You’re not missing a hidden flag. This is a real limitation of how Codex runs tools today.

When you run Codex in the web UI, network access is tightly sandboxed. Even if:

• proxy allowlisting is configured,
• curl works from the agent,
• and you export http_proxy / https_proxy,

those proxy vars are not reliably propagated to child tools like pre-commit, git, pip, or helm. Many of those tools spawn their own processes and bypass the agent’s fetch path, which results in the 403s you’re seeing.

Key points:

• Tool subprocesses do not get full outbound internet access.
• Proxy env vars are effectively ignored or stripped for safety.
• There’s no “magic invocation” to enable direct GitHub access for tools in the web environment.

Current workarounds:

• Vendor dependencies or plugins into the repo.
• Pre-run pre-commit / helm plugin install locally, then let Codex operate on the already-prepared workspace.
• Use Codex locally (CLI / self-hosted setup) where you control networking.

So yes, this is expected behavior today, not a misconfiguration on your side.

---

If this answer solve your all doubts so can you please mark my answer as solved
or if did not solved yet so please tell me your doubt