Skip to content

fix(egress-gateway): start proxy with explicit arguments - #1774

Open
MakerFlyFly wants to merge 1 commit into
apache:mainfrom
MakerFlyFly:fix/egress-gateway-cli-upstream
Open

MakerFlyFly wants to merge 1 commit into
apache:mainfrom
MakerFlyFly:fix/egress-gateway-cli-upstream

Conversation

@MakerFlyFly

Copy link
Copy Markdown
Contributor

Summary

The documented egress-gateway command crashes before listening with locked proxy.py 2.4.10, because proxy.main(**opts) does not accept the launcher's positional argument list.

  • Start Proxy(input_args=...) as a context manager and call proxy.sleep_loop() without arguments, preserving compatibility with older 2.4.x releases.
  • Defer the parent package's existing export so --help also works when the proxy dependency is unavailable. Preserve the public host_allowed export.
  • Add isolated CLI startup, argument, default-service, and cleanup regressions; keep the README focused on setup, configuration, and automated/manual verification.

The default binding, allowlist policy, dependency bounds, and argument passthrough are unchanged.
The README explains the supported forward-proxy mode and the trust required for additional proxy.py arguments.

Type of change

  • Python package
  • Documentation

Test plan

  • Reproduced the original startup failure through both entrypoints on Windows and Linux. The new default-startup regression fails on the unmodified upstream source with the original TypeError.
  • All 37 package tests pass on Windows CPython 3.12.13 and Linux CPython 3.12.12 with locked proxy.py 2.4.10; Linux also passes pytest -n auto with two workers.
  • Package Ruff and format checks pass on both platforms. README shell examples and generated TOC checks pass on Linux.
  • Live module/installed-command checks on both platforms: allowed HTTP/CONNECT requests return 200, denied requests return 403, and the documented allowed PyPI request returns a final HTTP 200.
  • Linux live smoke tests directly launch both entrypoints; after startup, sending SIGINT or SIGTERM to the gateway process yields exit status 0 and releases workers and listeners. Windows uses an explicitly test-only SIGBREAK bridge in a hidden console.
  • prek run --all-files --skip workspace-pytest and the affected-package/dependent test gate pass on the new upstream baseline, including whole-tree links and applicable static checks.
  • zizmor --config .zizmor.yml . and Magpie pre-first-PR checks pass.

Live listening checks are local verification, separate from the committed tests.
Earlier startup-contract probes against real proxy.py 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, and 2.4.10 passed on Windows and Linux; the runtime source is unchanged from that verification.

RFC-AI-0004 compliance

  • Sandbox — preserve the default binding and allowlist policy.
  • Vendor neutrality — no new service, vendor setting, or dependency.

Linked issues

Closes #1773.

Notes for reviewers

Suggested labels: bug, family:tools, substrate:sandbox, capability:fix.

Generative AI disclosure: Implementation, tests, and documentation were prepared with Codex (GPT-6). The contributor has reviewed and approved the complete change.

Pass CLI arguments to Proxy(input_args=...) and use its context manager
with the zero-argument sleep loop supported by proxy.py 2.4.x.

Preserve dependency-free help through lazy package exports, add isolated
startup and lifecycle regressions, and document usage and verification.

Generated-by: Codex (GPT-6)
@github-actions github-actions Bot added family:tools tools/* family:docs Docs, MISSION.md, READMEs substrate:sandbox Tool substrate: agent isolation, egress control, settings audit labels Oct 23, 2026
@MakerFlyFly

Copy link
Copy Markdown
Contributor Author

While testing this change I found a few issues in the gateway CLI. They predate this fix (they were unreachable while startup was broken) and are outside its scope. I'll open issues for them later and link them here.

Comment on lines +154 to +155
"import sys\nsys.modules['proxy'] = None\n"
"from egress_gateway.cli import main\nmain(['--help'])\n",
import pytest
from proxy.http.proxy import HttpProxyPlugin

import egress_gateway
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

family:docs Docs, MISSION.md, READMEs family:tools tools/* substrate:sandbox Tool substrate: agent isolation, egress control, settings audit

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Egress gateway CLI crashes with locked proxy.py 2.4.10

2 participants