Repository navigation
fix(egress-gateway): start proxy with explicit arguments - #1774
Conversation
Pass CLI arguments to Proxy(input_args=...) and use its context manager with the zero-argument sleep loop supported by proxy.py 2.4.x. Preserve dependency-free help through lazy package exports, add isolated startup and lifecycle regressions, and document usage and verification. Generated-by: Codex (GPT-6)
github-actions
Bot
added
family:tools
|
While testing this change I found a few issues in the gateway CLI. They predate this fix (they were unreachable while startup was broken) and are outside its scope. I'll open issues for them later and link them here. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Address two CodeQL quality findings, py/import-and-import-from and py/implicit-string-concatenation-in-list, by importing the CLI submodule explicitly and making the help script concatenation explicit. Preserve the script argument, dependency-free help, and package export coverage. Generated-by: Codex (GPT-6)
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
The fix is right: proxy.py 2.4.10's main(**opts) takes keyword options only and reads sys.argv itself, so the old positional call crashed before listening, and building Proxy(input_args=…) as a context manager around sleep_loop() is what main does internally. The lazy host_allowed export keeps --help working without the proxy dependency, and the new tests pin the defaults, the passthrough, and shutdown on every exit path. Keeping the older CLI issues you found while testing out of this PR, for separate issues, is the right call.
This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.More on how Apache Magpie handles maintainer review:
Contributing guide.
Summary
The documented egress-gateway command crashes before listening with locked
proxy.py 2.4.10, becauseproxy.main(**opts)does not accept the launcher's positional argument list.Proxy(input_args=...)as a context manager and callproxy.sleep_loop()without arguments, preserving compatibility with older 2.4.x releases.--helpalso works when the proxy dependency is unavailable. Preserve the publichost_allowedexport.The default binding, allowlist policy, dependency bounds, and argument passthrough are unchanged.
The README explains the supported forward-proxy mode and the trust required for additional proxy.py arguments.
Type of change
Test plan
Reproduced the original startup failure through both entrypoints on Windows and Linux. The new default-startup regression fails on the unmodified upstream source with the original
TypeError.All 37 package tests pass on Windows CPython 3.12.13 and Linux CPython 3.12.12 with locked proxy.py 2.4.10; Linux also passes
pytest -n autowith two workers.Package Ruff and format checks pass on both platforms. README shell examples and generated TOC checks pass on Linux.
Live module/installed-command checks on both platforms: allowed HTTP/CONNECT requests return 200, denied requests return 403, and the documented allowed PyPI request returns a final HTTP 200.
Linux live smoke tests directly launch both entrypoints; after startup, sending SIGINT or SIGTERM to the gateway process yields exit status 0 and releases workers and listeners. Windows uses an explicitly test-only SIGBREAK bridge in a hidden console.
prek run --all-files --skip workspace-pytestand the affected-package/dependent test gate pass on the new upstream baseline, including whole-tree links and applicable static checks.zizmor --config .zizmor.yml .and Magpie pre-first-PR checks pass.CodeQL review follow-up: explicit CLI imports and script concatenation preserve the existing tests; the two targeted queries from CodeQL 2.27.3 / python-queries 1.8.13 report no findings in
tests/test_cli.pyon the revised source. Windows/Linux package tests, Linux parallel tests, and the current repository gates pass.Live listening checks are local verification, separate from the committed tests.
Earlier startup-contract probes against real proxy.py 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, and 2.4.10 passed on Windows and Linux; the runtime source is unchanged from that verification.
RFC-AI-0004 compliance
Linked issues
Closes #1773.
Notes for reviewers
Suggested labels:
bug,family:tools,substrate:sandbox,capability:fix.Generative AI disclosure: Implementation, tests, and documentation were prepared with Codex (GPT-6). The contributor has reviewed and approved the complete change.