openai/codex · error · anyhow::Error

MITM hook hosts must be exact hosts and cannot contain wildc

Error message

MITM hook hosts must be exact hosts and cannot contain wildcards

What it means

MITM hooks are stored in a BTreeMap keyed by the request's normalized host, so each hook needs one exact host. normalize_hook_host therefore rejects any host containing '*' after normalization with 'MITM hook hosts must be exact hosts and cannot contain wildcards' — unlike allow/block host policy, hook hosts cannot be globbed.

Source

Thrown at codex-rs/network-proxy/src/mitm_hook.rs:542

    builder
        .backslash_escape(true)
        .literal_separator(literal_separator);
    builder
        .build()
        .map(|glob| CompiledGlobMatcher {
            pattern: pattern.to_string(),
            matcher: glob.compile_matcher(),
        })
        .map_err(|err| anyhow!("invalid glob pattern {pattern:?}: {err}"))
}

fn normalize_hook_host(host: &str) -> Result<String> {
    let normalized = normalize_host(host);
    if normalized.is_empty() {
        return Err(anyhow!("host must not be empty"));
    }
    if normalized.contains('*') {
        return Err(anyhow!(
            "MITM hook hosts must be exact hosts and cannot contain wildcards"
        ));
    }
    Ok(normalized)
}

fn normalize_methods(methods: &[String]) -> Result<Vec<String>> {
    methods
        .iter()
        .map(|method| {
            let normalized = method.trim().to_ascii_uppercase();
            if normalized.is_empty() {
                return Err(anyhow!("methods must not contain empty entries"));
            }
            Ok(normalized)
        })
        .collect()
}

View on GitHub (pinned to 339751715c)

Solutions

Replace the wildcard with one exact host per hook, e.g. host = "api.example.com"
Duplicate (or generate) the hook block for each subdomain you need to intercept
Keep wildcard matching in the host allow/block policy, where it is supported, and reserve hooks for exact hosts

Example fix

# before
[[network.mitm_hooks]]
host = "*.example.com"

# after — one hook per exact host
[[network.mitm_hooks]]
host = "api.example.com"

[[network.mitm_hooks]]
host = "cdn.example.com"

Defensive patterns

Strategy: validation

Validate before calling

// Rust — hook hosts must be exact
for (i, hook) in config.mitm_hooks.iter().enumerate() {
    if hook.host.contains('*') {
        return Err(anyhow!("network.mitm_hooks[{i}].host must be an exact host"));
    }
}

Type guard

fn hook_host_is_exact(hook: &MitmHookConfig) -> bool {
    !hook.host.contains('*')
}

Try / catch

match validate_mitm_hook_config(&config) {
    Ok(()) => {}
    Err(err) => eprintln!("{err:#}"), // 'invalid network.mitm_hooks[i].host: MITM hook hosts must be exact hosts...'
}

Prevention

Expand wildcard hosts into one hook per subdomain at config-generation time
Keep wildcard matching in allow/block policy, not hook config
Spell out the exact hosts you need to intercept when writing hooks

When it happens

Trigger: host = "*.example.com", host = "api.*", or any host whose normalized form still contains '*' in a [[network.mitm_hooks]] entry; raised from validate_mitm_hook_config (context 'invalid network.mitm_hooks[i].host') and compile_mitm_hooks_with_resolvers.

Common situations: Reusing wildcard host patterns from network allowlist policy in hook config; trying to cover many subdomains with a single hook; porting config from tools that allow wildcard vhosts.

Related errors

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/6ce380e69cd14c91. Report an issue: GitHub.