changes'

codex-rs/core/src/codex.rs

@@ -1219,6 +1219,7 @@ impl Session {
         Ok((network_proxy, session_network_proxy))
     }
 
+    #[cfg(unix)]
     fn shared_skill_network_proxy_spec(
         &self,
         skill: &SkillMetadata,
@@ -1228,6 +1229,9 @@ impl Session {
         Some(base_spec.with_skill_managed_network_override(managed_network_override))
     }
 
+    /// Unix-only because shared skill-managed network proxies are only used by
+    /// the zsh-fork/execve escalation path in the Unix shell runtime.
+    #[cfg(unix)]
     pub(crate) async fn get_or_start_skill_network_proxy(
         self: &Arc<Self>,
         skill: &SkillMetadata,
@@ -1251,9 +1255,9 @@ impl Session {
                 // disabled, and audit metadata falls back to the empty default.
                 spec.start_proxy(
                     &sandbox_policy,
-                    None,
-                    None,
-                    false,
+                    /*policy_decider*/ None,
+                    /*blocked_request_observer*/ None,
+                    /*enable_network_approval_flow*/ false,
                     NetworkProxyAuditMetadata::default(),
                 )
                 .await
@@ -1858,6 +1862,7 @@ impl Session {
             mcp_manager: Arc::clone(&mcp_manager),
             file_watcher,
             agent_control,
+            #[cfg(unix)]
             network_proxy_spec: config.permissions.network.clone().map(Arc::new),
             network_proxy,
             skill_network_proxy_cache,

codex-rs/core/src/codex_tests.rs

@@ -44,6 +44,7 @@ use crate::protocol::UserMessageEvent;
 use crate::rollout::policy::EventPersistenceMode;
 use crate::rollout::recorder::RolloutRecorder;
 use crate::rollout::recorder::RolloutRecorderParams;
+use crate::skill_network_proxy_cache::SkillNetworkProxyCache;
 use crate::state::TaskKind;
 use crate::tasks::SessionTask;
 use crate::tasks::SessionTaskContext;
@@ -2373,7 +2374,7 @@ async fn session_new_fails_when_zsh_fork_enabled_without_zsh_path() {
         plugins_manager,
         mcp_manager,
         Arc::new(FileWatcher::noop()),
-        Arc::new(crate::skill_network_proxy_cache::SkillNetworkProxyCache::new()),
+        Arc::new(SkillNetworkProxyCache::new()),
         AgentControl::default(),
     )
     .await;
@@ -2504,11 +2505,10 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         mcp_manager,
         file_watcher,
         agent_control,
+        #[cfg(unix)]
         network_proxy_spec: None,
         network_proxy: None,
-        skill_network_proxy_cache: Arc::new(
-            crate::skill_network_proxy_cache::SkillNetworkProxyCache::new(),
-        ),
+        skill_network_proxy_cache: Arc::new(SkillNetworkProxyCache::new()),
         network_approval: Arc::clone(&network_approval),
         state_db: None,
         model_client: ModelClient::new(
@@ -3302,11 +3302,10 @@ pub(crate) async fn make_session_and_context_with_dynamic_tools_and_rx(
         mcp_manager,
         file_watcher,
         agent_control,
+        #[cfg(unix)]
         network_proxy_spec: None,
         network_proxy: None,
-        skill_network_proxy_cache: Arc::new(
-            crate::skill_network_proxy_cache::SkillNetworkProxyCache::new(),
-        ),
+        skill_network_proxy_cache: Arc::new(SkillNetworkProxyCache::new()),
         network_approval: Arc::clone(&network_approval),
         state_db: None,
         model_client: ModelClient::new(

codex-rs/core/src/config/mod.rs

@@ -120,6 +120,7 @@ pub use codex_network_proxy::NetworkProxyAuditMetadata;
 
 pub use managed_features::ManagedFeatures;
 pub use network_proxy_spec::NetworkProxySpec;
+#[cfg(any(unix, test))]
 pub(crate) use network_proxy_spec::SkillNetworkProxyKey;
 pub use network_proxy_spec::StartedNetworkProxy;
 pub use permissions::FilesystemPermissionToml;

codex-rs/core/src/config/network_proxy_spec.rs

@@ -1,4 +1,5 @@
 use crate::config_loader::NetworkConstraints;
+#[cfg(any(unix, test))]
 use crate::skills::model::SkillManagedNetworkOverride;
 use async_trait::async_trait;
 use codex_execpolicy::Policy;
@@ -21,6 +22,7 @@ use codex_protocol::protocol::SandboxPolicy;
 use std::collections::HashSet;
 use std::sync::Arc;
 
+#[cfg(any(unix, test))]
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub(crate) struct SkillNetworkProxyKey(String);
 
@@ -88,6 +90,7 @@ impl NetworkProxySpec {
         self.config.network.enable_socks5
     }
 
+    #[cfg(any(unix, test))]
     pub(crate) fn with_skill_managed_network_override(
         &self,
         managed_network_override: &SkillManagedNetworkOverride,
@@ -104,6 +107,7 @@ impl NetworkProxySpec {
         spec
     }
 
+    #[cfg(any(unix, test))]
     pub(crate) fn shared_skill_proxy_key(&self) -> SkillNetworkProxyKey {
         let mut normalized = self.clone();
         sort_string_list(&mut normalized.config.network.allowed_domains);
@@ -363,10 +367,12 @@ fn upsert_network_domains(
     target.extend(deduped_hosts);
 }
 
+#[cfg(any(unix, test))]
 fn sort_string_list(values: &mut [String]) {
     values.sort_unstable();
 }
 
+#[cfg(any(unix, test))]
 fn sort_option_string_list(values: &mut Option<Vec<String>>) {
     if let Some(values) = values.as_mut() {
         sort_string_list(values);

codex-rs/core/src/skill_network_proxy_cache.rs

@@ -1,12 +1,19 @@
+#[cfg(unix)]
 use crate::config::SkillNetworkProxyKey;
+#[cfg(unix)]
 use crate::config::StartedNetworkProxy;
+#[cfg(unix)]
 use std::collections::HashMap;
+#[cfg(unix)]
 use std::future::Future;
+#[cfg(unix)]
 use std::sync::Arc;
+#[cfg(unix)]
 use tokio::sync::Mutex;
 
 #[derive(Default)]
 pub(crate) struct SkillNetworkProxyCache {
+    #[cfg(unix)]
     proxies: Mutex<HashMap<SkillNetworkProxyKey, Arc<StartedNetworkProxy>>>,
 }
 
@@ -15,6 +22,7 @@ impl SkillNetworkProxyCache {
         Self::default()
     }
 
+    #[cfg(unix)]
     pub(crate) async fn get_or_start<F, Fut>(
         &self,
         key: SkillNetworkProxyKey,

codex-rs/core/src/state/service.rs

@@ -5,6 +5,7 @@ use crate::RolloutRecorder;
 use crate::agent::AgentControl;
 use crate::analytics_client::AnalyticsEventsClient;
 use crate::client::ModelClient;
+#[cfg(unix)]
 use crate::config::NetworkProxySpec;
 use crate::config::StartedNetworkProxy;
 use crate::exec_policy::ExecPolicyManager;
@@ -58,6 +59,7 @@ pub(crate) struct SessionServices {
     pub(crate) mcp_manager: Arc<McpManager>,
     pub(crate) file_watcher: Arc<FileWatcher>,
     pub(crate) agent_control: AgentControl,
+    #[cfg(unix)]
     pub(crate) network_proxy_spec: Option<Arc<NetworkProxySpec>>,
     pub(crate) network_proxy: Option<StartedNetworkProxy>,
     pub(crate) skill_network_proxy_cache: Arc<SkillNetworkProxyCache>,