impel-cli 0.16.3 → 0.16.5

package/README.md

@@ -25,6 +25,32 @@ of the protected Store directory and launches it with tenant-specific Codex and
 browser profiles. Each approach keeps the user's normal app profile and
 signed-in account untouched.
 
+Every Impel-managed Claude Code, Codex CLI, Claude Desktop, and ChatGPT/Codex
+Desktop profile also installs tenant-scoped lifecycle hooks for cloud session
+persistence. Hook input is first written to a private local outbox, so an
+offline network, interrupted hook, force-quit, or client restart cannot make a
+provider turn fail. The next hook invocation retries any pending batches,
+including batches left by an older session. Remote payloads are stored as
+independent zstd frames by `impel-sessions`; the local collector sends bounded
+newline-complete transcript deltas and a compact lifecycle ledger. Pending data
+is capped at 256 MiB or 2,048 batches per session by default; corrupt or
+permanently invalid batches are quarantined so they cannot block later data.
+Set `IMPEL_SESSIONS_MAX_OUTBOX_BYTES` or `IMPEL_SESSIONS_MAX_OUTBOX_BATCHES` to
+lower those local limits.
+
+The service attributes each session to the PAT-resolved user and selected
+tenant and records the provider, CLI/desktop surface, provider session ID, and
+repository metadata. Set `IMPEL_TASK_ID` before launching a client to link new
+sessions explicitly to an Impel task for cross-device discovery. The collector
+never writes the configured PAT into hook configuration, and it redacts Impel
+PAT/tenant credentials found in hook input or transcript content before
+spooling. Task linkage is retried independently and cannot block payload
+persistence when the current PAT lacks the `tasks` scope.
+
+Codex hook trust is pinned to the exact generated handler and its array index.
+If you manually reorder the managed group in `hooks.json`, rerun `impel setup`,
+`impel app update`, or relaunch the isolated CLI to regenerate the trust entry.
+
 ## Gateway-only vendor package
 
 White-labelled gateway launchers import the deliberately narrow
@@ -551,10 +577,11 @@ impel codex exec --json "review the current diff"
 switch their native profiles in place; the isolated launchers are the safer
 default when personal and Impel sessions should coexist.
 
-Every Impel-managed Claude configuration uses the same strict sandbox defaults:
+Every Impel-managed Claude configuration uses the same strict sandbox defaults
+with unrestricted outbound network access:
 the isolated `impel claude` profile, each tenant's Claude Desktop Code profile,
 the native profile while `impel use gateway claude` is active, and branded
-gateway-only CLI profiles. App config version 14 also pins managed Claude
+gateway-only CLI profiles. App config version 15 also pins managed Claude
 Desktop profiles to third-party deployment mode, enables the 3P Chat tab so
 Code's "Back to Claude" route has a valid destination, and removes the unusable
 Claude.ai sign-in path. Existing tenant profiles refresh onto these policies
@@ -566,12 +593,16 @@ Turns **on** gateway mode for the given tool (default `all`). Requires `impel au
 first.
 
 **Claude Code** — merges into `~/.claude/settings.json` (creating it if needed,
-leaving permissions, hooks, other env vars, and custom sandbox filesystem/network
-rules untouched). Gateway mode enables Claude's strict auto-allow sandbox by
+leaving existing permission rules, hooks, other env vars, and custom sandbox
+filesystem/network rules intact). Gateway mode enables Claude's strict auto-allow sandbox by
 default: Bash runs inside the OS sandbox without routine prompts, the
 `dangerouslyDisableSandbox` escape hatch is disabled, and supported platforms
 fail closed if isolation cannot initialize. Native Windows keeps startup
 available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
+A global `WebFetch(domain:*)` allow rule opens every outbound destination for Bash commands
+while retaining filesystem isolation. Explicit deny rules remain authoritative.
+On macOS, `enableWeakerNetworkIsolation` lets Go-based network tools reach the
+system TLS trust service while remaining sandboxed.
 
 ```json
 {
@@ -579,12 +610,16 @@ available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
   "env": {
     "ANTHROPIC_BASE_URL": "https://gateway.useimpel.com/anthropic"
   },
+  "permissions": {
+    "allow": ["WebFetch(domain:*)"]
+  },
   "sandbox": {
     "enabled": true,
     "failIfUnavailable": true,
     "autoAllowBashIfSandboxed": true,
     "allowUnsandboxedCommands": false,
-    "excludedCommands": []
+    "excludedCommands": [],
+    "enableWeakerNetworkIsolation": true
   }
 }
 ```
@@ -596,7 +631,9 @@ available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
 as Claude Code's `apiKeyHelper`), so we reuse `impel token` there too instead of
 writing the PAT into `config.toml` or `~/.codex/auth.json`. The block written
 (fenced by markers, so everything else in your `config.toml` — other
-`model_providers`, `mcp_servers`, sandbox policy — is left alone):
+`model_providers`, `mcp_servers`, and unrelated sandbox policy — is left alone).
+Codex defaults to the `workspace-write` filesystem sandbox with unrestricted
+direct outbound access; its optional network proxy stays disabled:
 
 ```toml
 model_provider = "impel"
@@ -604,6 +641,9 @@ model_provider = "impel"
 # >>> impel-cli managed block (model_providers.impel) >>>
 # Generated by `impel use gateway codex`. Safe to re-run; do not hand-edit
 # the lines between the markers above/below, they'll be overwritten.
+sandbox_mode = "workspace-write"
+sandbox_workspace_write.network_access = true
+
 [model_providers.impel]
 name = "Impel Gateway"
 base_url = "https://gateway.useimpel.com/chatgpt_passthrough/backend-api/codex"
@@ -618,8 +658,9 @@ refresh_interval_ms = 300000
 ```
 
 Before overwriting anything, `impel` **backs up** what was there (any prior
-`apiKeyHelper`, `ANTHROPIC_BASE_URL`, Claude sandbox policy, and the prior Codex
-`model_provider` value) into `~/.config/impel/config.json`, so `impel use account`
+`apiKeyHelper`, `ANTHROPIC_BASE_URL`, Claude sandbox/permission policy, and the
+prior Codex `model_provider`, sandbox mode, and workspace network values) into
+`~/.config/impel/config.json`, so `impel use account`
 can restore it exactly. If `config.toml` already has a `[model_providers.impel]` table that
 wasn't written by this tool, `impel` refuses to touch the file and tells you to
 resolve it manually rather than risk emitting invalid/duplicate TOML.
@@ -632,11 +673,14 @@ removes **only** the Impel-added bits, never your own config:
 - **Claude Code** — removes `apiKeyHelper` only if it's `"impel token"`, and
   `env.ANTHROPIC_BASE_URL` only if it equals `<gateway>/anthropic`. Then restores
   whatever those keys held before gateway mode (from the backup). If there was
-  nothing before, they're deleted (and an emptied `env` is dropped).
+  nothing before, they're deleted (and an emptied `env` is dropped). It also
+  removes only the Impel-added global `WebFetch(domain:*)` allow rule.
 - **Codex** — removes the marker-fenced `[model_providers.impel]` block, and
   resets `model_provider` **only if it currently reads `"impel"`** — back to its
   backed-up prior value, or, if there was none, removes the line entirely so
-  Codex falls back to its built-in default. All other tables are untouched.
+  Codex falls back to its built-in default. The prior
+  `sandbox_mode` and `sandbox_workspace_write.network_access` values are
+  restored. All other tables are untouched.
 
 `impel use account` doesn't require the PAT and is safe to run repeatedly (if a
 tool is already in account mode it just says so and changes nothing).
@@ -929,8 +973,10 @@ impel status             # see where each tool stands right now
 ```
 
 How the clean revert is guaranteed: `impel on` records the pre-existing values
-(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL` / Claude sandbox policy, and Codex's prior
-`model_provider`) into `~/.config/impel/config.json` **before** overwriting them,
+(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL` / Claude sandbox and permission
+policy, and Codex's prior `model_provider`, sandbox mode, and workspace network
+value) into
+`~/.config/impel/config.json` **before** overwriting them,
 and only ever captures a real *account-mode* value (re-running `impel on` never
 clobbers the backup with Impel's own values). `impel off` removes only keys that
 still point at Impel and restores those backups — so a full `on` → `off`
@@ -939,9 +985,10 @@ they started, with all your unrelated keys and tables intact.
 
 If you'd rather revert by hand: delete `apiKeyHelper`, the Impel
 `ANTHROPIC_BASE_URL`, and the Impel-managed sandbox keys from
-`~/.claude/settings.json`; delete the block between the
+`~/.claude/settings.json`, plus the Impel-added `WebFetch(domain:*)` allow rule; delete the block between the
 `# >>> impel-cli managed block ... >>>` / `# <<< impel-cli managed block <<<`
-markers in `~/.codex/config.toml` and reset `model_provider`; and
+markers in `~/.codex/config.toml`, reset `model_provider`, and restore or remove
+`sandbox_mode` and `sandbox_workspace_write.network_access`; and
 `rm -rf ~/.config/impel` to forget the PAT + gateway entirely.
 
 ## Codex compatibility route
@@ -980,9 +1027,9 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
   `impel token` rather than copying it into their own config files — one token,
   one rotation path, no stale copies.
 - **The `config.toml` merge is intentionally narrow**, not a general TOML
-  parser: it only ever touches a single top-level `model_provider` line and its
-  own fenced `[model_providers.impel*]` block, leaving unrelated tables (other
-  providers, MCP servers, sandbox policy, etc.) untouched.
+  parser: it touches the top-level `model_provider`, sandbox mode, the
+  workspace-write network toggle, and its own fenced `[model_providers.impel*]` block, leaving unrelated
+  tables (other providers, MCP servers, sandbox policy, etc.) untouched.
 
 ## Sources consulted for the Codex config
 
@@ -995,7 +1042,7 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
 
 - https://code.claude.com/docs/en/settings#sandbox-settings
 - https://code.claude.com/docs/en/sandboxing#configure-the-sandbox-for-your-organization
-- https://github.com/anthropics/claude-code/blob/v2.1.205/examples/settings/settings-bash-sandbox.json
+- https://github.com/anthropics/claude-code/blob/v2.1.214/examples/settings/settings-bash-sandbox.json
 
 ## Sources consulted for concurrent tenant apps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.16.3",
+  "version": "0.16.5",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -12,6 +12,7 @@ import {
 import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation } from "./selfInvocation.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
+import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 
@@ -163,7 +164,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 14;
+export const CURRENT_CONFIG_VERSION = 16;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -617,8 +618,12 @@ export function installManagedAppFiles({
       writeClaudeDefaultApp(paths);
       writeClaudeCodeSettings(paths);
       writeClaudeConfig(paths, config, models);
+      ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
+    }
+    else {
+      writeChatGPTConfig(paths, config, models, vendorCodexModels, chatgptInvocations);
+      ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
     }
-    else writeChatGPTConfig(paths, config, models, vendorCodexModels, chatgptInvocations);
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app
     // to be closed (see quitBlockingApps), so those paths never attempt one.
@@ -1024,6 +1029,7 @@ function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocation
   const managedToml = [
     CHATGPT_CONFIG_START,
     "# Managed by `impel app update`. This profile is isolated from ~/.codex.",
+    "# Impel session-hook trust is pinned separately by exact handler hash.",
     `model = ${tomlString(selectedModel.slug)}`,
     'model_provider = "impel"',
     `chatgpt_base_url = ${tomlString(`${config.gatewayUrl}/chatgpt_passthrough/backend-api`)}`,

package/src/claudeSandbox.js

@@ -4,8 +4,11 @@ const MANAGED_SANDBOX_KEYS = Object.freeze([
   "autoAllowBashIfSandboxed",
   "allowUnsandboxedCommands",
   "excludedCommands",
+  "enableWeakerNetworkIsolation",
 ]);
 
+export const IMPEL_CLAUDE_NETWORK_PERMISSION = "WebFetch(domain:*)";
+
 function isJsonObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -28,24 +31,79 @@ export function impelClaudeSandboxPolicy(platform = process.platform) {
     autoAllowBashIfSandboxed: true,
     allowUnsandboxedCommands: false,
     excludedCommands: [],
+    ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+  };
+}
+
+function applyImpelClaudeNetworkPermission(permissions) {
+  const current = isJsonObject(permissions) ? permissions : {};
+  const allow = Array.isArray(current.allow) ? current.allow : [];
+  return {
+    ...current,
+    allow: [...new Set([...allow, IMPEL_CLAUDE_NETWORK_PERMISSION])],
   };
 }
 
 /** Apply the managed sandbox keys while preserving unrelated sandbox config. */
 export function applyImpelClaudeSandbox(settings, platform = process.platform) {
   const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
+  const policy = impelClaudeSandboxPolicy(platform);
   settings.sandbox = {
     ...current,
-    ...impelClaudeSandboxPolicy(platform),
+    ...policy,
   };
+  settings.permissions = applyImpelClaudeNetworkPermission(settings.permissions);
   return settings.sandbox;
 }
 
 /** Capture the exact pre-Impel value for reversible native-profile switching. */
 export function captureClaudeSandbox(settings) {
-  return Object.hasOwn(settings, "sandbox")
+  const snapshot = Object.hasOwn(settings, "sandbox")
     ? { present: true, value: settings.sandbox }
     : { present: false };
+  snapshot.permissions = Object.hasOwn(settings, "permissions")
+    ? { present: true, value: settings.permissions }
+    : { present: false };
+  return snapshot;
+}
+
+function restoreClaudeNetworkPermission(settings, snapshot) {
+  if (!Object.hasOwn(settings, "permissions")) return false;
+  const priorSnapshot = snapshot?.permissions;
+  const priorPresent = priorSnapshot?.present === true;
+  const priorValue = priorPresent ? priorSnapshot.value : undefined;
+  const appliedPrior = applyImpelClaudeNetworkPermission(priorValue);
+
+  if (sameJsonValue(settings.permissions, appliedPrior)) {
+    if (priorPresent) settings.permissions = priorValue;
+    else delete settings.permissions;
+    return true;
+  }
+  if (!isJsonObject(settings.permissions) || !Array.isArray(settings.permissions.allow)) {
+    return false;
+  }
+
+  const priorPermissions = isJsonObject(priorValue) ? priorValue : null;
+  const priorAllow = priorPermissions && Array.isArray(priorPermissions.allow)
+    ? priorPermissions.allow
+    : [];
+  if (priorAllow.includes(IMPEL_CLAUDE_NETWORK_PERMISSION)) return false;
+
+  const allow = settings.permissions.allow.filter(
+    (rule) => rule !== IMPEL_CLAUDE_NETWORK_PERMISSION,
+  );
+  if (sameJsonValue(allow, settings.permissions.allow)) return false;
+
+  const permissions = { ...settings.permissions };
+  if (allow.length > 0 || (priorPermissions && Object.hasOwn(priorPermissions, "allow"))) {
+    permissions.allow = allow;
+  } else {
+    delete permissions.allow;
+  }
+  if (Object.keys(permissions).length > 0) settings.permissions = permissions;
+  else if (priorPresent) settings.permissions = priorValue;
+  else delete settings.permissions;
+  return true;
 }
 
 /**
@@ -53,28 +111,33 @@ export function captureClaudeSandbox(settings) {
  * while gateway mode was active, plus unrelated filesystem/network keys, win.
  */
 export function restoreClaudeSandbox(settings, snapshot, platform = process.platform) {
-  if (!isJsonObject(settings.sandbox)) return false;
   const policy = impelClaudeSandboxPolicy(platform);
   const prior = snapshot?.present === true && isJsonObject(snapshot.value)
     ? snapshot.value
     : null;
-  const sandbox = { ...settings.sandbox };
   let changed = false;
 
-  for (const key of MANAGED_SANDBOX_KEYS) {
-    if (!Object.hasOwn(sandbox, key) || !sameJsonValue(sandbox[key], policy[key])) continue;
-    if (prior && Object.hasOwn(prior, key)) sandbox[key] = prior[key];
-    else delete sandbox[key];
-    changed = true;
-  }
+  if (isJsonObject(settings.sandbox)) {
+    const sandbox = { ...settings.sandbox };
+    let sandboxChanged = false;
+    for (const key of MANAGED_SANDBOX_KEYS) {
+      if (!Object.hasOwn(sandbox, key) || !sameJsonValue(sandbox[key], policy[key])) continue;
+      if (prior && Object.hasOwn(prior, key)) sandbox[key] = prior[key];
+      else delete sandbox[key];
+      sandboxChanged = true;
+    }
 
-  if (!changed) return false;
-  if (Object.keys(sandbox).length > 0 || (snapshot?.present === true && prior)) {
-    settings.sandbox = sandbox;
-  } else if (snapshot?.present === true) {
-    settings.sandbox = snapshot.value;
-  } else {
-    delete settings.sandbox;
+    if (sandboxChanged) {
+      if (Object.keys(sandbox).length > 0 || (snapshot?.present === true && prior)) {
+        settings.sandbox = sandbox;
+      } else if (snapshot?.present === true) {
+        settings.sandbox = snapshot.value;
+      } else {
+        delete settings.sandbox;
+      }
+      changed = true;
+    }
   }
-  return true;
+
+  return restoreClaudeNetworkPermission(settings, snapshot) || changed;
 }

package/src/cli.js

@@ -15,6 +15,7 @@ import { cmdAgents } from "./commands/agents.js";
 import { cmdTenant } from "./commands/tenant.js";
 import { cmdDoctor } from "./commands/doctor.js";
 import { cmdSetup } from "./commands/setup.js";
+import { cmdSessions } from "./commands/sessions.js";
 import { cmdUpdate } from "./commands/update.js";
 import { cmdExperimental } from "./commands/experimental.js";
 
@@ -121,6 +122,10 @@ export async function main(argv) {
     case "mcp":
       return cmdMcp(rest);
 
+    // Hidden transport used by managed Claude/Codex lifecycle hooks.
+    case "sessions":
+      return cmdSessions(rest);
+
     case "claude":
     case "codex":
       return cmdLaunch(cmd, rest);

package/src/cliProfiles.js

@@ -12,6 +12,7 @@ import { CONFIG_DIR } from "./config.js";
 import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation, impelMcpInvocation } from "./selfInvocation.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
+import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 
@@ -131,6 +132,7 @@ export function ensureImpelClaudeProfile(gatewayUrl, tenantId, { crossAppModels
 
   writePrivateFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`);
   writePrivateFile(userConfigPath, `${JSON.stringify(userConfig, null, 2)}\n`);
+  ensureClaudeSessionHooks(configDir, tenantId, "claude_cli");
 
   return { configDir, settingsPath, userConfigPath };
 }
@@ -203,9 +205,10 @@ export function ensureImpelCodexProfile(gatewayUrl, tenantId) {
 
   const { preamble, rest } = splitTomlPreamble(withoutManagedBlock);
   const providerLine = 'model_provider = "impel"';
-  const nextPreamble = CODEX_PROVIDER_LINE_RE.test(preamble)
+  let nextPreamble = CODEX_PROVIDER_LINE_RE.test(preamble)
     ? preamble.replace(CODEX_PROVIDER_LINE_RE, providerLine)
     : `${preamble.trimEnd()}${preamble.trim() ? "\n" : ""}${providerLine}\n`;
+  nextPreamble = nextPreamble.replace(/^bypass_hook_trust[ \t]*=[ \t]*(?:true|false)[ \t]*\n?/gm, "");
   const restText = rest.trim();
   const next = [nextPreamble.trimEnd(), codexManagedBlock(gatewayUrl, tenantId), restText]
     .filter(Boolean)
@@ -213,6 +216,7 @@ export function ensureImpelCodexProfile(gatewayUrl, tenantId) {
     .concat("\n");
 
   writePrivateFile(configPath, hardenManagedCodexToml(next, configPath));
+  ensureCodexSessionHooks(codexHome, tenantId, "codex_cli");
   secureManagedCodexHome(codexHome);
   return { codexHome, configPath };
 }

package/src/codexSecurity.js

@@ -80,19 +80,61 @@ function upsertManagedBoolean(toml, table, key, value, configPath) {
   return `${base}${base ? "\n\n" : ""}${MANAGED_COMMENT}\n[${table}]\n${key} = ${value}\n`;
 }
 
+function upsertManagedRootString(toml, key, value, configPath) {
+  const lines = String(toml || "").replace(/\r\n/gu, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/u.test(line));
+  const preambleEnd = firstTable === -1 ? lines.length : firstTable;
+  const pattern = new RegExp(`^(\\s*)${escapeRegex(key)}\\s*=.*$`, "u");
+  const indices = lines
+    .slice(0, preambleEnd)
+    .flatMap((line, index) => (pattern.test(line) ? [index] : []));
+  if (indices.length > 1) {
+    throw new Error(`${configPath} defines ${key} more than once; resolve it before re-running.`);
+  }
+  if (indices.length === 1) {
+    const index = indices[0];
+    const indent = lines[index].match(pattern)?.[1] || "";
+    lines[index] = `${indent}${key} = ${JSON.stringify(value)}`;
+  } else {
+    lines.splice(preambleEnd, 0, `${key} = ${JSON.stringify(value)}`, "");
+  }
+  return `${lines.join("\n").replace(/\s*$/u, "")}\n`;
+}
+
+/** Enable unrestricted outbound access while Codex remains in workspace-write. */
+export function enableManagedCodexNetworkAccess(
+  toml,
+  configPath = "managed Codex config",
+) {
+  const workspaceSandbox = upsertManagedRootString(
+    toml,
+    "sandbox_mode",
+    "workspace-write",
+    configPath,
+  );
+  return upsertManagedBoolean(
+    workspaceSandbox,
+    "sandbox_workspace_write",
+    "network_access",
+    "true",
+    configPath,
+  );
+}
+
 /**
  * Disable Codex shell snapshots and keep its default KEY/SECRET/TOKEN filter
  * enabled. Existing unrelated keys in either table are retained.
  */
 export function hardenManagedCodexToml(toml, configPath = "managed Codex config") {
   const withoutSnapshots = upsertManagedBoolean(toml, "features", "shell_snapshot", "false", configPath);
-  return upsertManagedBoolean(
+  const withoutCredentialSnapshots = upsertManagedBoolean(
     withoutSnapshots,
     "shell_environment_policy",
     "ignore_default_excludes",
     "false",
     configPath,
   );
+  return enableManagedCodexNetworkAccess(withoutCredentialSnapshots, configPath);
 }
 
 function assertSafeManagedPath(target, expectedType) {