From 20ae699cbbdd83bfc2d9f2e54c84947d27a11779 Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Sun, 25 Jan 2026 11:49:48 -0500
Subject: [PATCH] network-proxy: store MITM certs under CODEX_HOME/proxy

---
 codex-rs/network-proxy/README.md     |  9 +++++++++
 codex-rs/network-proxy/src/config.rs |  4 ++--
 codex-rs/network-proxy/src/init.rs   | 10 ++++------
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/codex-rs/network-proxy/README.md b/codex-rs/network-proxy/README.md
index 3a8d20eb80..111978d074 100644
--- a/codex-rs/network-proxy/README.md
+++ b/codex-rs/network-proxy/README.md
@@ -35,6 +35,15 @@ dangerously_allow_non_loopback_proxy = false
 dangerously_allow_non_loopback_admin = false
 mode = "full" # default when unset; use "limited" for read-only mode
 
+[network.mitm]
+# When enabled, HTTPS CONNECT can be terminated so limited-mode method policy still applies.
+# CA cert/key paths are relative to CODEX_HOME by default.
+enabled = false
+ca_cert_path = "proxy/ca.pem"
+ca_key_path = "proxy/ca.key"
+# Maximum size of request/response bodies MITM will buffer for inspection.
+max_body_bytes = 1048576
+
 # Hosts must match the allowlist (unless denied).
 # If `allowed_domains` is empty, the proxy blocks requests until an allowlist is configured.
 allowed_domains = ["*.openai.com"]
diff --git a/codex-rs/network-proxy/src/config.rs b/codex-rs/network-proxy/src/config.rs
index fbc6c94abd..7664e39485 100644
--- a/codex-rs/network-proxy/src/config.rs
+++ b/codex-rs/network-proxy/src/config.rs
@@ -131,11 +131,11 @@ fn default_socks_url() -> String {
 }
 
 fn default_ca_cert_path() -> PathBuf {
-    PathBuf::from("network_proxy/mitm/ca.pem")
+    PathBuf::from("proxy/ca.pem")
 }
 
 fn default_ca_key_path() -> PathBuf {
-    PathBuf::from("network_proxy/mitm/ca.key")
+    PathBuf::from("proxy/ca.key")
 }
 
 fn default_mitm_max_body_bytes() -> usize {
diff --git a/codex-rs/network-proxy/src/init.rs b/codex-rs/network-proxy/src/init.rs
index 5d0c6ef9f7..8d21d957b3 100644
--- a/codex-rs/network-proxy/src/init.rs
+++ b/codex-rs/network-proxy/src/init.rs
@@ -6,13 +6,11 @@ use tracing::info;
 
 pub fn run_init() -> Result<()> {
     let codex_home = find_codex_home().context("failed to resolve CODEX_HOME")?;
-    let root = codex_home.join("network_proxy");
-    let mitm_dir = root.join("mitm");
+    let proxy_dir = codex_home.join("proxy");
 
-    fs::create_dir_all(&root).with_context(|| format!("failed to create {}", root.display()))?;
-    fs::create_dir_all(&mitm_dir)
-        .with_context(|| format!("failed to create {}", mitm_dir.display()))?;
+    fs::create_dir_all(&proxy_dir)
+        .with_context(|| format!("failed to create {}", proxy_dir.display()))?;
 
-    info!("ensured {}", mitm_dir.display());
+    info!("ensured {}", proxy_dir.display());
     Ok(())
 }