From 2bda01552a43a13845eaf4175b5c13d14bfc962c Mon Sep 17 00:00:00 2001 From: viyatb-oai Date: Fri, 6 Mar 2026 10:03:52 -0800 Subject: [PATCH] refactor: drop top-level network proxy loader config --- codex-rs/core/src/config/mod.rs | 1 - codex-rs/core/src/config/permissions.rs | 66 ----------------------- codex-rs/core/src/network_proxy_loader.rs | 59 ++++---------------- 3 files changed, 10 insertions(+), 116 deletions(-) diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs index 4136e48d1a..27d1d63f49 100644 --- a/codex-rs/core/src/config/mod.rs +++ b/codex-rs/core/src/config/mod.rs @@ -109,7 +109,6 @@ pub use codex_network_proxy::NetworkProxyAuditMetadata; pub use managed_features::ManagedFeatures; pub use network_proxy_spec::NetworkProxySpec; pub use network_proxy_spec::StartedNetworkProxy; -pub use permissions::NetworkToml; pub use permissions::PermissionsNetworkToml; pub use permissions::PermissionsToml; pub use service::ConfigService; diff --git a/codex-rs/core/src/config/permissions.rs b/codex-rs/core/src/config/permissions.rs index 07ff12b784..4681c8b327 100644 --- a/codex-rs/core/src/config/permissions.rs +++ b/codex-rs/core/src/config/permissions.rs @@ -31,25 +31,6 @@ pub struct PermissionsNetworkToml { pub allow_local_binding: Option, } -#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)] -#[schemars(deny_unknown_fields)] -pub struct NetworkToml { - pub enabled: Option, - pub proxy_url: Option, - pub enable_socks5: Option, - pub socks_url: Option, - pub enable_socks5_udp: Option, - pub allow_upstream_proxy: Option, - pub dangerously_allow_non_loopback_proxy: Option, - pub dangerously_allow_all_unix_sockets: Option, - #[schemars(with = "Option")] - pub mode: Option, - pub allowed_domains: Option>, - pub denied_domains: Option>, - pub allow_unix_sockets: Option>, - pub allow_local_binding: Option, -} - #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, JsonSchema)] #[serde(rename_all = "lowercase")] enum NetworkModeSchema { @@ -57,53 +38,6 @@ enum NetworkModeSchema { Full, } -impl NetworkToml { - pub(crate) fn apply_to_network_proxy_config(&self, config: &mut NetworkProxyConfig) { - if let Some(enabled) = self.enabled { - config.network.enabled = enabled; - } - if let Some(proxy_url) = self.proxy_url.as_ref() { - config.network.proxy_url = proxy_url.clone(); - } - if let Some(enable_socks5) = self.enable_socks5 { - config.network.enable_socks5 = enable_socks5; - } - if let Some(socks_url) = self.socks_url.as_ref() { - config.network.socks_url = socks_url.clone(); - } - if let Some(enable_socks5_udp) = self.enable_socks5_udp { - config.network.enable_socks5_udp = enable_socks5_udp; - } - if let Some(allow_upstream_proxy) = self.allow_upstream_proxy { - config.network.allow_upstream_proxy = allow_upstream_proxy; - } - if let Some(dangerously_allow_non_loopback_proxy) = - self.dangerously_allow_non_loopback_proxy - { - config.network.dangerously_allow_non_loopback_proxy = - dangerously_allow_non_loopback_proxy; - } - if let Some(dangerously_allow_all_unix_sockets) = self.dangerously_allow_all_unix_sockets { - config.network.dangerously_allow_all_unix_sockets = dangerously_allow_all_unix_sockets; - } - if let Some(mode) = self.mode { - config.network.mode = mode; - } - if let Some(allowed_domains) = self.allowed_domains.as_ref() { - config.network.allowed_domains = allowed_domains.clone(); - } - if let Some(denied_domains) = self.denied_domains.as_ref() { - config.network.denied_domains = denied_domains.clone(); - } - if let Some(allow_unix_sockets) = self.allow_unix_sockets.as_ref() { - config.network.allow_unix_sockets = allow_unix_sockets.clone(); - } - if let Some(allow_local_binding) = self.allow_local_binding { - config.network.allow_local_binding = allow_local_binding; - } - } -} - impl PermissionsNetworkToml { pub(crate) fn apply_to_network_proxy_config(&self, config: &mut NetworkProxyConfig) { config.network.enabled = true; diff --git a/codex-rs/core/src/network_proxy_loader.rs b/codex-rs/core/src/network_proxy_loader.rs index 88be6a3b59..9edbc06246 100644 --- a/codex-rs/core/src/network_proxy_loader.rs +++ b/codex-rs/core/src/network_proxy_loader.rs @@ -1,4 +1,3 @@ -use crate::config::NetworkToml; use crate::config::PermissionsNetworkToml; use crate::config::PermissionsToml; use crate::config::find_codex_home; @@ -119,9 +118,6 @@ fn network_constraints_from_trusted_layers( } let parsed = network_tables_from_toml(&layer.config)?; - if let Some(network) = parsed.network { - apply_network_constraints(network, &mut constraints); - } if let Some(network) = parsed .permissions .and_then(|permissions| permissions.network) @@ -132,38 +128,6 @@ fn network_constraints_from_trusted_layers( Ok(constraints) } -fn apply_network_constraints(network: NetworkToml, constraints: &mut NetworkProxyConstraints) { - if let Some(enabled) = network.enabled { - constraints.enabled = Some(enabled); - } - if let Some(mode) = network.mode { - constraints.mode = Some(mode); - } - if let Some(allow_upstream_proxy) = network.allow_upstream_proxy { - constraints.allow_upstream_proxy = Some(allow_upstream_proxy); - } - if let Some(dangerously_allow_non_loopback_proxy) = network.dangerously_allow_non_loopback_proxy - { - constraints.dangerously_allow_non_loopback_proxy = - Some(dangerously_allow_non_loopback_proxy); - } - if let Some(dangerously_allow_all_unix_sockets) = network.dangerously_allow_all_unix_sockets { - constraints.dangerously_allow_all_unix_sockets = Some(dangerously_allow_all_unix_sockets); - } - if let Some(allowed_domains) = network.allowed_domains { - constraints.allowed_domains = Some(allowed_domains); - } - if let Some(denied_domains) = network.denied_domains { - constraints.denied_domains = Some(denied_domains); - } - if let Some(allow_unix_sockets) = network.allow_unix_sockets { - constraints.allow_unix_sockets = Some(allow_unix_sockets); - } - if let Some(allow_local_binding) = network.allow_local_binding { - constraints.allow_local_binding = Some(allow_local_binding); - } -} - fn apply_permissions_network_constraints( network: PermissionsNetworkToml, constraints: &mut NetworkProxyConstraints, @@ -198,7 +162,6 @@ fn apply_permissions_network_constraints( #[derive(Debug, Clone, Default, Deserialize)] struct NetworkTablesToml { - network: Option, permissions: Option, } @@ -210,9 +173,6 @@ fn network_tables_from_toml(value: &toml::Value) -> Result { } fn apply_network_tables(config: &mut NetworkProxyConfig, parsed: NetworkTablesToml) { - if let Some(network) = parsed.network { - network.apply_to_network_proxy_config(config); - } if let Some(network) = parsed .permissions .and_then(|permissions| permissions.network) @@ -343,7 +303,7 @@ mod tests { use pretty_assertions::assert_eq; #[test] - fn higher_precedence_network_table_beats_lower_permissions_network_table() { + fn top_level_network_table_is_ignored() { let lower_permissions: toml::Value = toml::from_str( r#" [permissions.network] @@ -369,7 +329,7 @@ allowed_domains = ["higher.example.com"] network_tables_from_toml(&higher_network).expect("higher layer should deserialize"), ); - assert_eq!(config.network.allowed_domains, vec!["higher.example.com"]); + assert_eq!(config.network.allowed_domains, vec!["lower.example.com"]); } #[test] @@ -412,21 +372,22 @@ allowed_domains = ["higher.example.com"] } #[test] - fn apply_network_constraints_includes_allow_all_unix_sockets_flag() { + fn apply_permissions_network_constraints_includes_allow_all_unix_sockets_flag() { let config: toml::Value = toml::from_str( r#" -[network] +[permissions.network] dangerously_allow_all_unix_sockets = true "#, ) - .expect("network table should parse"); + .expect("permissions.network table should parse"); let network = network_tables_from_toml(&config) - .expect("network table should deserialize") - .network - .expect("network table should be present"); + .expect("permissions.network table should deserialize") + .permissions + .and_then(|permissions| permissions.network) + .expect("permissions.network table should be present"); let mut constraints = NetworkProxyConstraints::default(); - apply_network_constraints(network, &mut constraints); + apply_permissions_network_constraints(network, &mut constraints); assert_eq!(constraints.dangerously_allow_all_unix_sockets, Some(true)); }