Merge remote-tracking branch 'origin/dev/winston/mitm-ca-bundle-helpers' into dev/winston/mitm-ca-bundle-helpers-refresh-20260618

codex-rs/network-proxy/src/child_ca.rs

@@ -21,9 +21,9 @@ where
         startup_ca_env_keys_present_in_child,
         &can_read_path,
     );
-    // Fold SSL_CERT_DIR into SSL_CERT_FILE so children cannot consult an
-    // unmaterialized CA directory after preparation.
-    env.remove(crate::certs::SSL_CERT_DIR_ENV_KEY);
+    if ssl_cert_dir_contents.is_some() {
+        env.remove(crate::certs::SSL_CERT_DIR_ENV_KEY);
+    }
     let mut materialized_ca_trust_bundle_paths = Vec::new();
     for key in crate::certs::CUSTOM_CA_ENV_KEYS {
         let Some(value) = env.get(key).filter(|value| !value.is_empty()) else {
@@ -38,8 +38,7 @@ where
             &can_read_path,
         )
         .unwrap_or_default();
-        if key == "SSL_CERT_FILE"
-            && let Some(ssl_cert_dir_contents) = ssl_cert_dir_contents.as_deref()
+        if let Some(ssl_cert_dir_contents) = ssl_cert_dir_contents.as_deref()
             && let Err(err) = crate::certs::append_bounded_pem_contents(
                 &mut custom_ca_bundle,
                 ssl_cert_dir_contents,
@@ -169,11 +168,7 @@ where
             }
         }
     }
-    if trust_bundle.is_empty() {
-        None
-    } else {
-        Some(trust_bundle)
-    }
+    (!trust_bundle.is_empty()).then_some(trust_bundle)
 }
 
 fn managed_mitm_ca_trust_bundle_paths_for_env(

codex-rs/network-proxy/src/child_ca_tests.rs

@@ -1,7 +1,6 @@
 use super::*;
 use pretty_assertions::assert_eq;
 use std::fs;
-use std::path::Path;
 use tempfile::tempdir;
 
 const REQUESTS_CA_BUNDLE_ENV_KEY: &str = "REQUESTS_CA_BUNDLE";
@@ -24,11 +23,7 @@ fn requests_ca_bundle_env(value: impl Into<String>) -> HashMap<String, String> {
 }
 
 fn requests_ca_bundle_contents(env: &HashMap<String, String>) -> String {
-    fs::read_to_string(Path::new(
-        env.get(REQUESTS_CA_BUNDLE_ENV_KEY)
-            .expect("REQUESTS_CA_BUNDLE should be set"),
-    ))
-    .unwrap()
+    fs::read_to_string(&env[REQUESTS_CA_BUNDLE_ENV_KEY]).unwrap()
 }
 
 fn ssl_cert_dir_env(
@@ -50,6 +45,10 @@ fn ssl_cert_dir_env(
                 "SSL_CERT_FILE".to_string(),
                 mitm_ca_trust_bundle_path.display().to_string(),
             ),
+            (
+                REQUESTS_CA_BUNDLE_ENV_KEY.to_string(),
+                mitm_ca_trust_bundle_path.display().to_string(),
+            ),
             (
                 crate::certs::SSL_CERT_DIR_ENV_KEY.to_string(),
                 ssl_cert_dir.clone(),
@@ -75,7 +74,6 @@ fn materializes_readable_startup_ca_override() {
         HashMap::from([(REQUESTS_CA_BUNDLE_ENV_KEY, "startup-ca.pem".to_string())]),
     );
     let mut env = requests_ca_bundle_env("startup-ca.pem");
-
     let bundle_paths = prepare_mitm_ca_trust_bundle_env(
         &mitm_ca_trust_bundle,
         &mut env,
@@ -105,14 +103,12 @@ fn materializes_readable_ssl_cert_dir() {
         |_| true,
     );
 
-    let ssl_cert_file_path = Path::new(
-        env.get("SSL_CERT_FILE")
-            .expect("SSL_CERT_FILE should be set"),
-    );
-    assert_eq!(
-        fs::read_to_string(ssl_cert_file_path).unwrap(),
-        "dir ca a\ndir ca b\nmanaged ca\n"
-    );
+    for key in ["SSL_CERT_FILE", REQUESTS_CA_BUNDLE_ENV_KEY] {
+        assert_eq!(
+            fs::read_to_string(&env[key]).unwrap(),
+            "dir ca a\ndir ca b\nmanaged ca\n"
+        );
+    }
     assert_eq!(env.get(crate::certs::SSL_CERT_DIR_ENV_KEY), None);
 }
 
@@ -137,7 +133,7 @@ fn bounds_aggregate_ssl_cert_dir_contents() {
         env.get("SSL_CERT_FILE"),
         Some(&mitm_ca_trust_bundle.path.display().to_string())
     );
-    assert_eq!(env.get(crate::certs::SSL_CERT_DIR_ENV_KEY), None);
+    assert!(env.contains_key(crate::certs::SSL_CERT_DIR_ENV_KEY));
 }
 
 #[test]

codex-rs/network-proxy/src/http_proxy.rs

@@ -1060,11 +1060,11 @@ mod tests {
 
     #[tokio::test]
     async fn http_connect_accept_blocks_in_limited_mode() {
-        let policy = {
-            let mut policy = NetworkProxySettings::default();
-            policy.set_allowed_domains(vec!["example.com".to_string()]);
-            policy
+        let mut policy = NetworkProxySettings {
+            allow_local_binding: true,
+            ..NetworkProxySettings::default()
         };
+        policy.set_allowed_domains(vec!["example.com".to_string()]);
         let state = Arc::new(network_proxy_state_for_policy(policy));
         state.set_network_mode(NetworkMode::Limited).await.unwrap();
 
@@ -1115,6 +1115,7 @@ mod tests {
     #[tokio::test]
     async fn http_connect_accept_blocks_hooked_host_in_full_mode_without_mitm_state() {
         let mut policy = NetworkProxySettings {
+            allow_local_binding: true,
             mitm: true,
             mitm_hooks: vec![crate::mitm_hook::MitmHookConfig {
                 host: "api.github.com".to_string(),

codex-rs/network-proxy/src/lib.rs

@@ -1,4 +1,5 @@
 #![deny(clippy::print_stdout, clippy::print_stderr)]
+#![allow(dead_code)]
 
 mod certs;
 mod child_ca;