feat: include [experimental_network] in <environment_context>

[bolinfest]

If NetworkConstraints is set, then include the relevant settings on <environment_context>. Example:

<environment_context>
  <cwd>/repo</cwd>
  <shell>bash</shell>
  <network enabled="true">
    <allowed>api.example.com</allowed>
    <allowed>*.openai.com</allowed>
    <denied>blocked.example.com</denied>
  </network>
</environment_context>

[viyatb-oai]

I wonder if we should add the proxy enable flag through the env context as an escape hatch (not a good idea if the model uses it every time though). everything else looks good.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 51292e7415

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Respect disabled network constraints in environment_context

NetworkConstraints includes an enabled flag (e.g., enabled = false in requirements), but the new XML always emits <network enabled="true"> whenever any network constraints are present. That means a configuration that explicitly disables network access will still be reported as enabled to the model, which can mislead behavior or safety gating. Consider propagating the actual enabled value (or omitting the <network> block when enabled == false) instead of hardcoding true here.

Useful? React with 👍 / 👎.