{"record":{"id":"369fe3dd17e18234","repo":"openai/codex","slug":"network-credential-broker-requires-network-mitm","errorCode":null,"errorMessage":"network.credential_broker requires network.mitm = true","messagePattern":"network\\.credential_broker requires network\\.mitm = true","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/network-proxy/src/state.rs","lineNumber":78,"sourceCode":"pub fn build_config_state(\n    mut config: NetworkProxyConfig,\n    constraints: NetworkProxyConstraints,\n) -> anyhow::Result<ConfigState> {\n    if constraints.enabled == Some(false) {\n        config.credential_broker = false;\n    }\n    let brokerage_created_proxy = config.credential_broker && !config.enabled;\n    let brokerage_created_default_allowlist = brokerage_created_proxy\n        && config.allowed_domains().is_none()\n        && constraints.allowed_domains.is_none();\n    if brokerage_created_proxy {\n        config.enabled = true;\n    }\n    if brokerage_created_default_allowlist {\n        config.set_allowed_domains(vec![\"*\".to_string()]);\n    }\n    crate::config::validate_unix_socket_allowlist_paths(&config)?;\n    anyhow::ensure!(\n        !config.credential_broker || config.mitm,\n        \"network.credential_broker requires network.mitm = true\"\n    );\n    let allowed_domains = config.allowed_domains().unwrap_or_default();\n    let denied_domains = config.denied_domains().unwrap_or_default();\n    validate_non_global_wildcard_domain_patterns(\"network.denied_domains\", &denied_domains)\n        .map_err(NetworkProxyConstraintError::into_anyhow)?;\n    let deny_set = compile_denylist_globset(&denied_domains)?;\n    let allow_set = compile_allowlist_globset(&allowed_domains)?;\n    let mitm_hooks = compile_mitm_hooks(&config)?;\n    let mitm = if config.mitm {\n        Some(Arc::new(MitmState::new(MitmUpstreamConfig {\n            allow_upstream_proxy: config.allow_upstream_proxy,\n        })?))\n    } else {\n        None\n    };\n    Ok(ConfigState {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/network-proxy/src/state.rs#L60-L96","documentation":"Error \"network.credential_broker requires network.mitm = true\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/network-proxy/src/state.rs:78 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}