From afc19347e2ae821cb9cdcf6da03047618995cc93 Mon Sep 17 00:00:00 2001 From: Winston Howes Date: Fri, 15 May 2026 10:19:13 -0700 Subject: [PATCH] Fix managed proxy start params --- codex-rs/core/src/session/mod.rs | 29 +++++++--- codex-rs/core/src/session/session.rs | 21 ++++--- codex-rs/core/src/session/tests.rs | 86 +++++++++++++++------------- 3 files changed, 80 insertions(+), 56 deletions(-) diff --git a/codex-rs/core/src/session/mod.rs b/codex-rs/core/src/session/mod.rs index 4bd61f7ab3..db17f81432 100644 --- a/codex-rs/core/src/session/mod.rs +++ b/codex-rs/core/src/session/mod.rs @@ -875,6 +875,17 @@ async fn thread_title_from_thread_store( (!title.is_empty() && thread.preview.trim() != title).then(|| title.to_string()) } +struct ManagedNetworkProxyStartParams<'a> { + spec: &'a crate::config::NetworkProxySpec, + credentialed_routes: &'a [codex_backend_client::ResolvedCredentialRoute], + exec_policy: &'a codex_execpolicy::Policy, + permission_profile: &'a PermissionProfile, + network_policy_decider: Option>, + blocked_request_observer: Option>, + managed_network_requirements_enabled: bool, + audit_metadata: NetworkProxyAuditMetadata, +} + impl Session { pub(crate) async fn app_server_client_metadata(&self) -> AppServerClientMetadata { let state = self.state.lock().await; @@ -938,14 +949,16 @@ impl Session { } async fn start_managed_network_proxy( - spec: &crate::config::NetworkProxySpec, - credentialed_routes: &[codex_backend_client::ResolvedCredentialRoute], - exec_policy: &codex_execpolicy::Policy, - permission_profile: &PermissionProfile, - network_policy_decider: Option>, - blocked_request_observer: Option>, - managed_network_requirements_enabled: bool, - audit_metadata: NetworkProxyAuditMetadata, + ManagedNetworkProxyStartParams { + spec, + credentialed_routes, + exec_policy, + permission_profile, + network_policy_decider, + blocked_request_observer, + managed_network_requirements_enabled, + audit_metadata, + }: ManagedNetworkProxyStartParams<'_>, ) -> anyhow::Result<(StartedNetworkProxy, SessionNetworkProxyRuntime)> { debug!( credentialed_routes = credentialed_routes.len(), diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs index 3cf4fc416d..2d9fda49b2 100644 --- a/codex-rs/core/src/session/session.rs +++ b/codex-rs/core/src/session/session.rs @@ -818,14 +818,19 @@ impl Session { .await; let current_exec_policy = exec_policy.current(); let (network_proxy, session_network_proxy) = Self::start_managed_network_proxy( - spec, - &credentialed_routes, - current_exec_policy.as_ref(), - config.permissions.permission_profile(), - network_policy_decider.as_ref().map(Arc::clone), - blocked_request_observer.as_ref().map(Arc::clone), - managed_network_requirements_configured, - network_proxy_audit_metadata, + ManagedNetworkProxyStartParams { + spec, + credentialed_routes: &credentialed_routes, + exec_policy: current_exec_policy.as_ref(), + permission_profile: config.permissions.permission_profile(), + network_policy_decider: network_policy_decider.as_ref().map(Arc::clone), + blocked_request_observer: blocked_request_observer + .as_ref() + .map(Arc::clone), + managed_network_requirements_enabled: + managed_network_requirements_configured, + audit_metadata: network_proxy_audit_metadata, + }, ) .instrument(info_span!( "session_init.network_proxy", diff --git a/codex-rs/core/src/session/tests.rs b/codex-rs/core/src/session/tests.rs index c2980e5ab4..03d4f7ac38 100644 --- a/codex-rs/core/src/session/tests.rs +++ b/codex-rs/core/src/session/tests.rs @@ -683,16 +683,18 @@ async fn start_managed_network_proxy_applies_execpolicy_network_rules() -> anyho /*justification*/ None, )?; - let (started_proxy, _) = Session::start_managed_network_proxy( - &spec, - /*credentialed_routes*/ &[], - &exec_policy, - &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()), - /*network_policy_decider*/ None, - /*blocked_request_observer*/ None, - /*managed_network_requirements_enabled*/ false, - crate::config::NetworkProxyAuditMetadata::default(), - ) + let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams { + spec: &spec, + credentialed_routes: &[], + exec_policy: &exec_policy, + permission_profile: &permission_profile_for_sandbox_policy( + &SandboxPolicy::new_workspace_write_policy(), + ), + network_policy_decider: None, + blocked_request_observer: None, + managed_network_requirements_enabled: false, + audit_metadata: crate::config::NetworkProxyAuditMetadata::default(), + }) .await?; let current_cfg = started_proxy.proxy().current_cfg().await?; @@ -728,16 +730,18 @@ async fn start_managed_network_proxy_ignores_invalid_execpolicy_network_rules() /*justification*/ None, )?; - let (started_proxy, _) = Session::start_managed_network_proxy( - &spec, - /*credentialed_routes*/ &[], - &exec_policy, - &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()), - /*network_policy_decider*/ None, - /*blocked_request_observer*/ None, - /*managed_network_requirements_enabled*/ false, - crate::config::NetworkProxyAuditMetadata::default(), - ) + let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams { + spec: &spec, + credentialed_routes: &[], + exec_policy: &exec_policy, + permission_profile: &permission_profile_for_sandbox_policy( + &SandboxPolicy::new_workspace_write_policy(), + ), + network_policy_decider: None, + blocked_request_observer: None, + managed_network_requirements_enabled: false, + audit_metadata: crate::config::NetworkProxyAuditMetadata::default(), + }) .await?; let current_cfg = started_proxy.proxy().current_cfg().await?; @@ -768,16 +772,18 @@ async fn managed_network_proxy_decider_survives_full_access_start() -> anyhow::R } }); - let (started_proxy, _) = Session::start_managed_network_proxy( - &spec, - /*credentialed_routes*/ &[], - &exec_policy, - &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess), - Some(network_policy_decider), - /*blocked_request_observer*/ None, - /*managed_network_requirements_enabled*/ true, - crate::config::NetworkProxyAuditMetadata::default(), - ) + let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams { + spec: &spec, + credentialed_routes: &[], + exec_policy: &exec_policy, + permission_profile: &permission_profile_for_sandbox_policy( + &SandboxPolicy::DangerFullAccess, + ), + network_policy_decider: Some(network_policy_decider), + blocked_request_observer: None, + managed_network_requirements_enabled: true, + audit_metadata: crate::config::NetworkProxyAuditMetadata::default(), + }) .await?; let spec = spec.recompute_for_permission_profile(&permission_profile_for_sandbox_policy( @@ -841,16 +847,16 @@ async fn new_turn_refreshes_managed_network_proxy_for_sandbox_change() -> anyhow Some(requirements), &permission_profile_for_sandbox_policy(&initial_policy), )?; - let (started_proxy, _) = Session::start_managed_network_proxy( - &spec, - /*credentialed_routes*/ &[], - &Policy::empty(), - &permission_profile_for_sandbox_policy(&initial_policy), - /*network_policy_decider*/ None, - /*blocked_request_observer*/ None, - /*managed_network_requirements_enabled*/ false, - crate::config::NetworkProxyAuditMetadata::default(), - ) + let (started_proxy, _) = Session::start_managed_network_proxy(ManagedNetworkProxyStartParams { + spec: &spec, + credentialed_routes: &[], + exec_policy: &Policy::empty(), + permission_profile: &permission_profile_for_sandbox_policy(&initial_policy), + network_policy_decider: None, + blocked_request_observer: None, + managed_network_requirements_enabled: false, + audit_metadata: crate::config::NetworkProxyAuditMetadata::default(), + }) .await?; assert_eq!( started_proxy