From dbe5006ddd1abce9ad7828f506b1dd1f8f22742a Mon Sep 17 00:00:00 2001
From: Winston Howes <winston@openai.com>
Date: Thu, 18 Jun 2026 16:10:59 -0700
Subject: [PATCH] Serialize test MITM CA state creation

---
 codex-rs/network-proxy/src/socks5.rs |  9 ---------
 codex-rs/network-proxy/src/state.rs  | 11 +++++++++++
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/codex-rs/network-proxy/src/socks5.rs b/codex-rs/network-proxy/src/socks5.rs
index a4f36db562..a1f670d6c8 100644
--- a/codex-rs/network-proxy/src/socks5.rs
+++ b/codex-rs/network-proxy/src/socks5.rs
@@ -729,11 +729,6 @@ mod tests {
     use std::net::IpAddr;
     use std::net::Ipv4Addr;
     use std::sync::Arc;
-    use std::sync::Mutex;
-
-    // Managed MITM CA files live under the shared test CODEX_HOME, so MITM-enabled config state
-    // must be materialized one test at a time.
-    static MITM_CONFIG_STATE_LOCK: Mutex<()> = Mutex::new(());
 
     #[derive(Clone)]
     struct StaticReloader {
@@ -756,10 +751,6 @@ mod tests {
 
     fn state_for_settings(network: NetworkProxySettings) -> Arc<NetworkProxyState> {
         let config = NetworkProxyConfig { network };
-        let _mitm_config_state_guard = config
-            .network
-            .mitm
-            .then(|| MITM_CONFIG_STATE_LOCK.lock().unwrap());
         let state = build_config_state(config, NetworkProxyConstraints::default()).unwrap();
         let reloader = Arc::new(StaticReloader {
             state: state.clone(),
diff --git a/codex-rs/network-proxy/src/state.rs b/codex-rs/network-proxy/src/state.rs
index 32cdfab149..bd2f89e400 100644
--- a/codex-rs/network-proxy/src/state.rs
+++ b/codex-rs/network-proxy/src/state.rs
@@ -15,6 +15,8 @@ use crate::runtime::ConfigState;
 use serde::Deserialize;
 use std::collections::HashSet;
 use std::sync::Arc;
+#[cfg(test)]
+use std::sync::Mutex;
 
 pub use crate::runtime::BlockedRequest;
 pub use crate::runtime::BlockedRequestArgs;
@@ -23,6 +25,10 @@ pub use crate::runtime::NetworkProxyState;
 #[cfg(test)]
 pub(crate) use crate::runtime::network_proxy_state_for_policy;
 
+// Managed MITM CA files live under the shared test CODEX_HOME.
+#[cfg(test)]
+static MITM_CONFIG_STATE_LOCK: Mutex<()> = Mutex::new(());
+
 #[derive(Debug, Default, Clone, PartialEq, Eq)]
 pub struct NetworkProxyConstraints {
     pub enabled: Option<bool>,
@@ -65,6 +71,11 @@ pub fn build_config_state(
     config: NetworkProxyConfig,
     constraints: NetworkProxyConstraints,
 ) -> anyhow::Result<ConfigState> {
+    #[cfg(test)]
+    let _mitm_config_state_guard = config
+        .network
+        .mitm
+        .then(|| MITM_CONFIG_STATE_LOCK.lock().unwrap());
     crate::config::validate_unix_socket_allowlist_paths(&config)?;
     let allowed_domains = config.network.allowed_domains().unwrap_or_default();
     let denied_domains = config.network.denied_domains().unwrap_or_default();