From 1790a96d893f36aed72dde0a22183facda34a029 Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Sun, 1 Feb 2026 15:34:23 -0800
Subject: [PATCH] refactor(network-proxy): align MITM blocked request metadata

---
 codex-rs/network-proxy/README.md     |  5 +++--
 codex-rs/network-proxy/src/config.rs |  1 +
 codex-rs/network-proxy/src/mitm.rs   | 17 +++++++++--------
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/codex-rs/network-proxy/README.md b/codex-rs/network-proxy/README.md
index 111978d074..4f6fd3fe1e 100644
--- a/codex-rs/network-proxy/README.md
+++ b/codex-rs/network-proxy/README.md
@@ -89,8 +89,9 @@ When a request is blocked, the proxy responds with `403` and includes:
   - `blocked-by-method-policy`
   - `blocked-by-policy`
 
-In "limited" mode, only `GET`, `HEAD`, and `OPTIONS` are allowed. HTTPS `CONNECT` and SOCKS5 are
-blocked because they would bypass method enforcement.
+In "limited" mode, only `GET`, `HEAD`, and `OPTIONS` are allowed. HTTPS `CONNECT` requests require
+MITM to enforce limited-mode method policy; otherwise they are blocked. SOCKS5 remains blocked in
+limited mode.
 
 ## Library API
 
diff --git a/codex-rs/network-proxy/src/config.rs b/codex-rs/network-proxy/src/config.rs
index 7664e39485..f626695734 100644
--- a/codex-rs/network-proxy/src/config.rs
+++ b/codex-rs/network-proxy/src/config.rs
@@ -76,6 +76,7 @@ impl Default for NetworkProxySettings {
 pub enum NetworkMode {
     /// Limited (read-only) access: only GET/HEAD/OPTIONS are allowed for HTTP. HTTPS CONNECT is
     /// blocked unless MITM is enabled so the proxy can enforce method policy on inner requests.
+    /// SOCKS5 remains blocked in limited mode.
     Limited,
     /// Full network access: all HTTP methods are allowed, and HTTPS CONNECTs are tunneled without
     /// MITM interception.
diff --git a/codex-rs/network-proxy/src/mitm.rs b/codex-rs/network-proxy/src/mitm.rs
index 0c90d0c474..7eecf47f89 100644
--- a/codex-rs/network-proxy/src/mitm.rs
+++ b/codex-rs/network-proxy/src/mitm.rs
@@ -5,6 +5,7 @@ use crate::reasons::REASON_METHOD_NOT_ALLOWED;
 use crate::responses::blocked_text_response;
 use crate::responses::text_response;
 use crate::state::BlockedRequest;
+use crate::state::BlockedRequestArgs;
 use crate::state::NetworkProxyState;
 use crate::upstream::UpstreamClient;
 use anyhow::Context as _;
@@ -239,14 +240,14 @@ async fn forward_request(req: Request) -> Result<Response> {
 
     if !mode.allows_method(&method) {
         let _ = app_state
-            .record_blocked(BlockedRequest::new(
-                target_host.clone(),
-                REASON_METHOD_NOT_ALLOWED.to_string(),
-                client.clone(),
-                Some(method.clone()),
-                Some(mode),
-                "https".to_string(),
-            ))
+            .record_blocked(BlockedRequest::new(BlockedRequestArgs {
+                host: target_host.clone(),
+                reason: REASON_METHOD_NOT_ALLOWED.to_string(),
+                client: client.clone(),
+                method: Some(method.clone()),
+                mode: Some(mode),
+                protocol: "https".to_string(),
+            }))
             .await;
         warn!(
             "MITM blocked by method policy (host={target_host}, method={method}, path={path}, mode={mode:?}, allowed_methods=GET, HEAD, OPTIONS)"