changes

codex-rs/core/src/codex.rs

@@ -1219,6 +1219,7 @@ impl Session {
         Ok((network_proxy, session_network_proxy))
     }
 
+    #[cfg_attr(not(unix), allow(dead_code))]
     fn shared_skill_network_proxy_spec(
         &self,
         skill: &SkillMetadata,
@@ -1228,6 +1229,13 @@ impl Session {
         Some(base_spec.with_skill_managed_network_override(managed_network_override))
     }
 
+    /// Returns a shared managed network proxy for a skill-specific network override.
+    ///
+    /// This is currently only used by the Unix zsh-fork executable-level escalation
+    /// path. Non-Unix platforms fall back to the normal shell/unified-exec flows and
+    /// do not currently swap in per-skill managed proxies, so this helper is dead
+    /// code there by design.
+    #[cfg_attr(not(unix), allow(dead_code))]
     pub(crate) async fn get_or_start_skill_network_proxy(
         self: &Arc<Self>,
         skill: &SkillMetadata,

codex-rs/core/src/config/network_proxy_spec.rs

@@ -88,6 +88,7 @@ impl NetworkProxySpec {
         self.config.network.enable_socks5
     }
 
+    #[cfg_attr(not(unix), allow(dead_code))]
     pub(crate) fn with_skill_managed_network_override(
         &self,
         managed_network_override: &SkillManagedNetworkOverride,
@@ -104,6 +105,7 @@ impl NetworkProxySpec {
         spec
     }
 
+    #[cfg_attr(not(unix), allow(dead_code))]
     pub(crate) fn shared_skill_proxy_key(&self) -> SkillNetworkProxyKey {
         let mut normalized = self.clone();
         sort_string_list(&mut normalized.config.network.allowed_domains);
@@ -363,6 +365,18 @@ fn upsert_network_domains(
     target.extend(deduped_hosts);
 }
 
+#[cfg_attr(not(unix), allow(dead_code))]
+fn sort_string_list(values: &mut [String]) {
+    values.sort_unstable();
+}
+
+#[cfg_attr(not(unix), allow(dead_code))]
+fn sort_option_string_list(values: &mut Option<Vec<String>>) {
+    if let Some(values) = values.as_mut() {
+        sort_string_list(values);
+    }
+}
+
 #[cfg(test)]
 #[path = "network_proxy_spec_tests.rs"]
 mod tests;

codex-rs/core/src/skill_network_proxy_cache.rs

@@ -7,6 +7,7 @@ use tokio::sync::Mutex;
 
 #[derive(Default)]
 pub(crate) struct SkillNetworkProxyCache {
+    #[cfg_attr(not(unix), allow(dead_code))]
     proxies: Mutex<HashMap<SkillNetworkProxyKey, Arc<StartedNetworkProxy>>>,
 }
 
@@ -15,6 +16,7 @@ impl SkillNetworkProxyCache {
         Self::default()
     }
 
+    #[cfg_attr(not(unix), allow(dead_code))]
     pub(crate) async fn get_or_start<F, Fut>(
         &self,
         key: SkillNetworkProxyKey,

codex-rs/core/src/state/service.rs

@@ -58,6 +58,7 @@ pub(crate) struct SessionServices {
     pub(crate) mcp_manager: Arc<McpManager>,
     pub(crate) file_watcher: Arc<FileWatcher>,
     pub(crate) agent_control: AgentControl,
+    #[cfg_attr(not(unix), allow(dead_code))]
     pub(crate) network_proxy_spec: Option<Arc<NetworkProxySpec>>,
     pub(crate) network_proxy: Option<StartedNetworkProxy>,
     pub(crate) skill_network_proxy_cache: Arc<SkillNetworkProxyCache>,