From 9f9257e9cdb95f73ac6bba7e85cc64f007b6b191 Mon Sep 17 00:00:00 2001
From: Winston Howes <winston@openai.com>
Date: Wed, 3 Jun 2026 18:55:52 -0700
Subject: [PATCH] Restore managed MITM CA bundle accessor

---
 codex-rs/network-proxy/src/proxy.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/codex-rs/network-proxy/src/proxy.rs b/codex-rs/network-proxy/src/proxy.rs
index df49774b06..ed65571ebb 100644
--- a/codex-rs/network-proxy/src/proxy.rs
+++ b/codex-rs/network-proxy/src/proxy.rs
@@ -632,6 +632,17 @@ impl NetworkProxy {
         self.runtime_settings().dangerously_allow_all_unix_sockets
     }
 
+    /// Returns the generated MITM CA bundle path child sandboxes should expose to TLS clients.
+    pub fn managed_mitm_ca_trust_bundle_path(&self) -> Option<AbsolutePathBuf> {
+        self.runtime_settings()
+            .mitm_ca_trust_bundle
+            .and_then(|bundle| {
+                AbsolutePathBuf::from_absolute_path(bundle.path)
+                    .map_err(|err| warn!("managed MITM CA trust bundle path is invalid: {err}"))
+                    .ok()
+            })
+    }
+
     pub fn apply_to_env(&self, env: &mut HashMap<String, String>) {
         let runtime_settings = self.runtime_settings();
         // Enforce proxying for child processes. Proxy endpoint values are always rewritten;