[napetrov]

Summary

docs/coding-harnesses.md, "Network policy"
  allowlist: HTTPS via CONNECT proxy
             plain HTTP: forwarded to an allowed host;
               refused (403) when it would be chained through the host proxy
  verifier running apt-get on a plain-HTTP mirror behind a host proxy
    -> --network verify=public  (or allow_internet = true in task.toml)
       or the mirror host in NO_PROXY

Evidence

• Before: the section lists the allowlist mode without saying what plain HTTP does.
  After: the paragraph is checked against dokimi/harnesses/egress_proxy.py (plain-HTTP branch, _record(... "plain HTTP is not chained through the upstream proxy ...")).
• pytest tests/test_docs_links.py tests/test_docs_code_refs.py: 64 passed.

Merge Danger

Door: two-way. Docs only.

Blast Radius: none on behaviour; readers of the network-policy section.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

There are no active review issues blocking this documentation-only clarification of allowlist proxy behavior and plain-HTTP mirror workarounds.

No open issues 🎉

What changed in this PR

0 new findings; nothing to fix.

This documentation-only PR clarifies how the coding harness’s allowlist network mode handles HTTPS and plain HTTP.

Changes:

• Explains that HTTPS uses the sidecar’s CONNECT proxy, while plain HTTP requiring the host proxy is refused with a 403.
• Documents verifier workarounds for plain-HTTP mirrors: public networking or the mirror host in NO_PROXY.

File	Description
dokimi/​docs/​coding-harnesses.md	Clarifies allowlist proxy behavior and plain-HTTP mirror workarounds.

_{Review effort: Balanced}

[exai-bot]

✅ OpenCodeReview: Review complete: 0 finding(s) across 1 selected item(s).

Review details

• Commit reviewed: dd5daef against merge base 93a5062
• Coverage: 1 files in 1 groups
• Engine: OpenCodeReview v1.13.3, us.openai.gpt-6.1-sol
• Usage: 32k tokens (15k from cache), 7s
• Tool calls: 6 (3 file_read, 2 code_search, 1 file_find)
• dokimi/docs/coding-harnesses.md: 1 file

[antonwolfy]

The paragraph matches the sidecar's behaviour on HTTPS, the 403 for plain HTTP chained through a host proxy, and the verify=public / allow_internet fallbacks. One thing is worth fixing before merge: the NO_PROXY workaround as written still fails for a stock allowlist.

What I ran, on a Linux review host at f45482a:

• make ci-local: 30 passed, 0 failed, 7 skipped (docs-only change)
• a reproduction of the finding against the egress proxy, with the network mocked

Checked, no issues

• Claims vs code: egress_proxy.py tunnels CONNECT only for allowlisted entries and returns 403 in _forward_http when _upstream(..., "http") is set. verify=public parses in network_policy.py, and allow_internet = true maps to public.
• Rest of the page: the existing "Plain HTTP" bullet and the public-mode notes agree with the new paragraph.
• Commit: signed off.

[antonwolfy]

The NO_PROXY workaround alone does not make a plain-HTTP mirror work under allowlist. _forward_http (egress_proxy.py:279-285) checks self.allowed(host, port) first, and a bare allowlist entry means host:443 (the page says so in the egress bullet above). A request to http://mirror.example/ goes to port 80, which is not listed.

Repro with the allowlist mirror.example, mirror.example in NO_PROXY and HTTP_PROXY set: the sidecar answers HTTP/1.1 403 Forbidden and records {'host': 'mirror.example', 'port': 80, 'decision': 'denied', 'reason': 'not on the allowlist'}. A reader who follows the paragraph gets the same 403 it describes.

Suggestion: say that the mirror also needs a host:80 entry in the allowlist (for example environment.egress), in addition to NO_PROXY, and that NO_PROXY is only needed when a host proxy is configured.

[napetrov]

Fixed in dd5daef. The paragraph now says a bare entry is host:443, so a plain-HTTP mirror needs its host:80 entry as well as the host in NO_PROXY. It gives the --network verify=allowlist:mirror.corp,mirror.corp:80 example. Docs only: the network and egress tests pass (333 passed). Changelog unchanged.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.29%. Comparing base (93a5062) to head (dd5daef).
⚠️ Report is 10 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #353      +/-   ##
==========================================
+ Coverage   94.06%   94.29%   +0.23%     
==========================================
  Files         297      308      +11     
  Lines       38018    39322    +1304     
  Branches     6424     6651     +227     
==========================================
+ Hits        35760    37079    +1319     
+ Misses       1451     1430      -21     
- Partials      807      813       +6     

see 40 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.