From 248ed486d231126cf510596f49ecc0f844895f08 Mon Sep 17 00:00:00 2001
From: Winston Howes <winston@openai.com>
Date: Sun, 14 Jun 2026 19:40:15 -0700
Subject: [PATCH] Revert "Expose child MITM CA env preparation"

This reverts commit 3d8d0102dddcf74b4af8c822b7dfe1d60a8eeef8.
---
 codex-rs/network-proxy/src/proxy.rs | 38 -----------------------------
 1 file changed, 38 deletions(-)

diff --git a/codex-rs/network-proxy/src/proxy.rs b/codex-rs/network-proxy/src/proxy.rs
index c8c7fe5194..61b0639cf1 100644
--- a/codex-rs/network-proxy/src/proxy.rs
+++ b/codex-rs/network-proxy/src/proxy.rs
@@ -13,7 +13,6 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::net::TcpListener as StdTcpListener;
-use std::path::Path;
 use std::sync::Arc;
 use std::sync::Mutex;
 use std::sync::RwLock;
@@ -688,43 +687,6 @@ impl NetworkProxy {
         );
     }
 
-    /// Rewrites readable child-selected CA bundles into immutable managed MITM bundles.
-    pub fn prepare_child_env<F>(
-        &self,
-        env: &mut HashMap<String, String>,
-        cwd: &Path,
-        can_read_path: F,
-    ) -> Vec<AbsolutePathBuf>
-    where
-        F: Fn(&Path) -> bool,
-    {
-        let runtime_settings = self.runtime_settings();
-        apply_proxy_env_overrides(
-            env,
-            self.http_addr,
-            self.socks_addr,
-            self.socks_enabled,
-            runtime_settings.allow_local_binding,
-            runtime_settings.mitm_ca_trust_bundle.as_ref(),
-        );
-        let startup_ca_env_keys_present_in_child = ca_env_keys()
-            .filter(|&key| is_tracked_startup_ca_env_key(env, key))
-            .collect::<Vec<_>>();
-        env.remove(STARTUP_CA_ENV_KEYS_PRESENT_ENV_KEY);
-        runtime_settings.mitm_ca_trust_bundle.as_ref().map_or_else(
-            Vec::new,
-            |mitm_ca_trust_bundle| {
-                crate::child_ca::prepare_mitm_ca_trust_bundle_env(
-                    mitm_ca_trust_bundle,
-                    env,
-                    cwd,
-                    &startup_ca_env_keys_present_in_child,
-                    can_read_path,
-                )
-            },
-        )
-    }
-
     pub async fn replace_config_state(&self, new_state: ConfigState) -> Result<()> {
         let current_cfg = self.state.current_cfg().await?;
         anyhow::ensure!(