From 3ec84bd3cdee9f6fb71f9caa3befd77565a96993 Mon Sep 17 00:00:00 2001 From: Winston Howes Date: Tue, 26 May 2026 12:34:08 -0700 Subject: [PATCH 1/2] Fix managed proxy restart call --- codex-rs/core/src/session/mod.rs | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/codex-rs/core/src/session/mod.rs b/codex-rs/core/src/session/mod.rs index fbf753b2ce..9faaf4a830 100644 --- a/codex-rs/core/src/session/mod.rs +++ b/codex-rs/core/src/session/mod.rs @@ -1003,19 +1003,20 @@ impl Session { return; } - match Self::start_managed_network_proxy( - &spec, - current_exec_policy.as_ref(), - &session_configuration.permission_profile(), - /*network_policy_decider*/ None, - self.services - .managed_network_requirements_configured - .then(|| { - build_blocked_request_observer(Arc::clone(&self.services.network_approval)) - }), - self.services.managed_network_requirements_configured, - self.services.network_proxy_audit_metadata.clone(), - ) + match Self::start_managed_network_proxy(ManagedNetworkProxyStartParams { + spec: &spec, + credentialed_routes: &[], + exec_policy: current_exec_policy.as_ref(), + permission_profile: &session_configuration.permission_profile(), + network_policy_decider: None, + blocked_request_observer: self.services.managed_network_requirements_configured.then( + || build_blocked_request_observer(Arc::clone(&self.services.network_approval)), + ), + managed_network_requirements_enabled: self + .services + .managed_network_requirements_configured, + audit_metadata: self.services.network_proxy_audit_metadata.clone(), + }) .await { Ok((started_proxy, _session_network_proxy)) => { From 672045c2f02af79b25821c0dd4471382d1aa6744 Mon Sep 17 00:00:00 2001 From: Winston Howes Date: Tue, 26 May 2026 13:18:18 -0700 Subject: [PATCH 2/2] Clean up MITM CA env wiring --- .../src/config/external_agent_config.rs | 9 ++- codex-rs/network-proxy/src/certs.rs | 6 +- codex-rs/network-proxy/src/proxy.rs | 57 +++++++------------ 3 files changed, 30 insertions(+), 42 deletions(-) diff --git a/codex-rs/app-server/src/config/external_agent_config.rs b/codex-rs/app-server/src/config/external_agent_config.rs index 0670224dd7..18c276f07d 100644 --- a/codex-rs/app-server/src/config/external_agent_config.rs +++ b/codex-rs/app-server/src/config/external_agent_config.rs @@ -1491,11 +1491,10 @@ fn json_object_to_env_toml_table( object: &serde_json::Map, ) -> toml::map::Map { let mut table = toml::map::Map::new(); - for (key, value) in object - .iter() - .filter_map(|(key, value)| json_env_value_to_string(value).map(|value| (key, value))) - { - table.insert(key.clone(), TomlValue::String(value)); + for (key, value) in object { + if let Some(value) = json_env_value_to_string(value) { + table.insert(key.clone(), TomlValue::String(value)); + } } table } diff --git a/codex-rs/network-proxy/src/certs.rs b/codex-rs/network-proxy/src/certs.rs index 63dcb9762b..8497f1f1d2 100644 --- a/codex-rs/network-proxy/src/certs.rs +++ b/codex-rs/network-proxy/src/certs.rs @@ -100,7 +100,9 @@ const MANAGED_MITM_CA_CERT: &str = "ca.pem"; const MANAGED_MITM_CA_KEY: &str = "ca.key"; const MANAGED_MITM_CA_TRUST_BUNDLE: &str = "ca-bundle.pem"; -const CUSTOM_CA_ENV_KEYS: &[&str] = &[ +// Best-effort compatibility set for common child toolchains that accept a CA bundle path. +// This is intentionally curated rather than pretending to cover every TLS client. +pub(crate) const CUSTOM_CA_ENV_KEYS: [&str; 10] = [ "CODEX_CA_CERTIFICATE", "SSL_CERT_FILE", "REQUESTS_CA_BUNDLE", @@ -163,7 +165,7 @@ fn build_managed_ca_trust_bundle( let mut custom_ca_paths = Vec::new(); for key in CUSTOM_CA_ENV_KEYS { - let Some(path) = env.get(*key).filter(|path| !path.is_empty()) else { + let Some(path) = env.get(key).filter(|path| !path.is_empty()) else { continue; }; let path = PathBuf::from(path); diff --git a/codex-rs/network-proxy/src/proxy.rs b/codex-rs/network-proxy/src/proxy.rs index 18e09b485d..deef932b0b 100644 --- a/codex-rs/network-proxy/src/proxy.rs +++ b/codex-rs/network-proxy/src/proxy.rs @@ -378,7 +378,7 @@ const ELECTRON_GET_USE_PROXY_ENV_KEY: &str = "ELECTRON_GET_USE_PROXY"; const NODE_USE_ENV_PROXY_ENV_KEY: &str = "NODE_USE_ENV_PROXY"; #[cfg(any(target_os = "macos", test))] const GIT_SSH_COMMAND_ENV_KEY: &str = "GIT_SSH_COMMAND"; -pub const PROXY_ENV_KEYS: &[&str] = &[ +const BASE_PROXY_ENV_KEYS: [&str; 35] = [ PROXY_ACTIVE_ENV_KEY, ALLOW_LOCAL_BINDING_ENV_KEY, ELECTRON_GET_USE_PROXY_ENV_KEY, @@ -414,17 +414,8 @@ pub const PROXY_ENV_KEYS: &[&str] = &[ "all_proxy", "FTP_PROXY", "ftp_proxy", - "CODEX_CA_CERTIFICATE", - "SSL_CERT_FILE", - "REQUESTS_CA_BUNDLE", - "CURL_CA_BUNDLE", - "NODE_EXTRA_CA_CERTS", - "GIT_SSL_CAINFO", - "PIP_CERT", - "BUNDLE_SSL_CA_CERT", - "npm_config_cafile", - "NPM_CONFIG_CAFILE", ]; +pub const PROXY_ENV_KEYS: &[&str] = &concat_proxy_env_keys(); #[cfg(target_os = "macos")] pub const PROXY_GIT_SSH_COMMAND_ENV_KEY: &str = GIT_SSH_COMMAND_ENV_KEY; @@ -479,6 +470,24 @@ fn set_env_keys(env: &mut HashMap, keys: &[&str], value: &str) { } } +const fn concat_proxy_env_keys() +-> [&'static str; BASE_PROXY_ENV_KEYS.len() + crate::certs::CUSTOM_CA_ENV_KEYS.len()] { + let mut keys = [""; BASE_PROXY_ENV_KEYS.len() + crate::certs::CUSTOM_CA_ENV_KEYS.len()]; + let mut index = 0; + while index < BASE_PROXY_ENV_KEYS.len() { + keys[index] = BASE_PROXY_ENV_KEYS[index]; + index += 1; + } + + let mut custom_ca_index = 0; + while custom_ca_index < crate::certs::CUSTOM_CA_ENV_KEYS.len() { + keys[index + custom_ca_index] = crate::certs::CUSTOM_CA_ENV_KEYS[custom_ca_index]; + custom_ca_index += 1; + } + + keys +} + #[cfg(target_os = "macos")] fn codex_proxy_git_ssh_command(socks_addr: SocketAddr) -> String { format!("{CODEX_PROXY_GIT_SSH_COMMAND_PREFIX}{socks_addr}{CODEX_PROXY_GIT_SSH_COMMAND_SUFFIX}") @@ -581,18 +590,7 @@ fn apply_proxy_env_overrides( let mitm_ca_trust_bundle_path = mitm_ca_trust_bundle_path.to_string_lossy(); set_env_keys( env, - &[ - "CODEX_CA_CERTIFICATE", - "SSL_CERT_FILE", - "REQUESTS_CA_BUNDLE", - "CURL_CA_BUNDLE", - "NODE_EXTRA_CA_CERTS", - "GIT_SSL_CAINFO", - "PIP_CERT", - "BUNDLE_SSL_CA_CERT", - "npm_config_cafile", - "NPM_CONFIG_CAFILE", - ], + &crate::certs::CUSTOM_CA_ENV_KEYS, &mitm_ca_trust_bundle_path, ); } @@ -1110,18 +1108,7 @@ mod tests { Some(mitm_ca_trust_bundle_path), ); - for key in [ - "CODEX_CA_CERTIFICATE", - "SSL_CERT_FILE", - "REQUESTS_CA_BUNDLE", - "CURL_CA_BUNDLE", - "NODE_EXTRA_CA_CERTS", - "GIT_SSL_CAINFO", - "PIP_CERT", - "BUNDLE_SSL_CA_CERT", - "npm_config_cafile", - "NPM_CONFIG_CAFILE", - ] { + for key in crate::certs::CUSTOM_CA_ENV_KEYS { assert_eq!( env.get(key), Some(&mitm_ca_trust_bundle_path.display().to_string())