codex - 💡(How to fix) Fix Feature request: allow approved outbound connections to non-HTTP development services in Codex Cloud

Summary

Please consider adding a secure, admin-approved way for Codex Cloud tasks to connect to development and test infrastructure that does not speak HTTP/HTTPS.

Use case

Backend projects often need integration tests against managed or self-hosted services such as databases, queues, and search systems. Today, Codex Cloud internet access appears oriented around HTTP/HTTPS domain allowlists and HTTP method controls, which makes it difficult to test backend-heavy projects against these services directly.

One concrete example is running tests against a Couchbase development cluster. A user may have a secured development endpoint and still need the Codex Cloud environment to reach the service using its native client protocol rather than an HTTPS proxy API.

Expected behavior

A workspace or repository admin could explicitly approve outbound access rules for a narrow host and service port list, for example:

• Host: db.example.com
• Protocol: TCP
• Ports: a small explicit allowlist
• Optional TLS-only requirement
• Audit log entry when a task uses the rule

Actual behavior

Codex Cloud does not appear to clearly support these non-HTTP development service connections today, so users have to create custom HTTPS proxy APIs or run Codex locally instead.

Why this matters

This would make Codex Cloud much more useful for backend and full-stack projects that rely on realistic integration tests. It would also avoid pushing users toward ad-hoc proxy layers just to let Codex exercise normal test infrastructure.

Security note

This should stay disabled by default and require explicit approval at the workspace, repository, or environment level. A minimal first version could support only exact host plus port allowlists with logging, not broad outbound network access.