refactor(network-proxy): align MITM blocked request metadata

codex-rs/network-proxy/README.md

@@ -89,8 +89,9 @@ When a request is blocked, the proxy responds with `403` and includes:
   - `blocked-by-method-policy`
   - `blocked-by-policy`
 
-In "limited" mode, only `GET`, `HEAD`, and `OPTIONS` are allowed. HTTPS `CONNECT` and SOCKS5 are
-blocked because they would bypass method enforcement.
+In "limited" mode, only `GET`, `HEAD`, and `OPTIONS` are allowed. HTTPS `CONNECT` requests require
+MITM to enforce limited-mode method policy; otherwise they are blocked. SOCKS5 remains blocked in
+limited mode.
 
 ## Library API
 

codex-rs/network-proxy/src/config.rs

@@ -76,6 +76,7 @@ impl Default for NetworkProxySettings {
 pub enum NetworkMode {
     /// Limited (read-only) access: only GET/HEAD/OPTIONS are allowed for HTTP. HTTPS CONNECT is
     /// blocked unless MITM is enabled so the proxy can enforce method policy on inner requests.
+    /// SOCKS5 remains blocked in limited mode.
     Limited,
     /// Full network access: all HTTP methods are allowed, and HTTPS CONNECTs are tunneled without
     /// MITM interception.

codex-rs/network-proxy/src/mitm.rs

@@ -5,6 +5,7 @@ use crate::reasons::REASON_METHOD_NOT_ALLOWED;
 use crate::responses::blocked_text_response;
 use crate::responses::text_response;
 use crate::state::BlockedRequest;
+use crate::state::BlockedRequestArgs;
 use crate::state::NetworkProxyState;
 use crate::upstream::UpstreamClient;
 use anyhow::Context as _;
@@ -239,14 +240,14 @@ async fn forward_request(req: Request) -> Result<Response> {
 
     if !mode.allows_method(&method) {
         let _ = app_state
-            .record_blocked(BlockedRequest::new(
-                target_host.clone(),
-                REASON_METHOD_NOT_ALLOWED.to_string(),
-                client.clone(),
-                Some(method.clone()),
-                Some(mode),
-                "https".to_string(),
-            ))
+            .record_blocked(BlockedRequest::new(BlockedRequestArgs {
+                host: target_host.clone(),
+                reason: REASON_METHOD_NOT_ALLOWED.to_string(),
+                client: client.clone(),
+                method: Some(method.clone()),
+                mode: Some(mode),
+                protocol: "https".to_string(),
+            }))
             .await;
         warn!(
             "MITM blocked by method policy (host={target_host}, method={method}, path={path}, mode={mode:?}, allowed_methods=GET, HEAD, OPTIONS)"