Merge branch 'main' into codex/remove-log-only-flag-and-add-request-log-zxb0tf

Resolved conflicts by keeping the dry-run and request-log features from HEAD branch

Author: ammario

.claude/settings.json

@@ -7,6 +7,10 @@
           {
             "type": "command",
             "command": "cargo fmt"
+          },
+          {
+            "type": "command",
+            "command": "cargo clippy --all-targets -- -D warnings"
           }
         ]
       }

README.md

@@ -23,7 +23,7 @@ cargo install httpjail
 ## MVP TODO
 
 - [ ] Update README to be more reflective of AI agent restrictions
-- [ ] Add a `--server` mode that runs the proxy server but doesn't execute the command
+- [x] Add a `--server` mode that runs the proxy server but doesn't execute the command
 - [ ] Expand test cases to include WebSockets
 
 ## Quick Start
@@ -44,6 +44,12 @@ httpjail -r "allow-get: api\.github\.com" -r "deny: .*" -- git pull
 
 # Use config file for complex rules
 httpjail --config rules.txt -- python script.py
+
+# Run as standalone proxy server (no command execution)
+httpjail --server -r "allow: .*"
+# Server defaults to ports 8080 (HTTP) and 8443 (HTTPS)
+# Configure your application:
+# HTTP_PROXY=http://localhost:8080 HTTPS_PROXY=http://localhost:8443
 ```
 
 ## Architecture Overview
@@ -167,14 +173,47 @@ httpjail --config rules.txt -- ./my-application
 ### Advanced Options
 
 ```bash
-# Dry run - log what would be blocked without blocking
-httpjail --dry-run --config rules.txt -- ./app
-
 # Verbose logging
 httpjail -vvv -r "allow: .*" -- curl https://example.com
 
+# Server mode - run as standalone proxy without executing commands
+httpjail --server -r "allow: github\.com" -r "deny: .*"
+# Server defaults to ports 8080 (HTTP) and 8443 (HTTPS)
+
+# Server mode with custom ports (format: port or ip:port)
+HTTPJAIL_HTTP_BIND=3128 HTTPJAIL_HTTPS_BIND=3129 httpjail --server -r "allow: .*"
+# Configure applications: HTTP_PROXY=http://localhost:3128 HTTPS_PROXY=http://localhost:3129
+
+# Bind to specific interface
+HTTPJAIL_HTTP_BIND=192.168.1.100:8080 httpjail --server -r "allow: .*"
+
 ```
 
+### Server Mode
+
+httpjail can run as a standalone proxy server without executing any commands. This is useful when you want to proxy multiple applications through the same httpjail instance. The server binds to localhost (127.0.0.1) only for security.
+
+```bash
+# Start server with default ports (8080 for HTTP, 8443 for HTTPS) on localhost
+httpjail --server -r "allow: github\.com" -r "deny: .*"
+# Output: Server running on ports 8080 (HTTP) and 8443 (HTTPS). Press Ctrl+C to stop.
+
+# Start server with custom ports using environment variables
+HTTPJAIL_HTTP_BIND=3128 HTTPJAIL_HTTPS_BIND=3129 httpjail --server -r "allow: .*"
+# Output: Server running on ports 3128 (HTTP) and 3129 (HTTPS). Press Ctrl+C to stop.
+
+# Bind to all interfaces (use with caution - exposes proxy to network)
+HTTPJAIL_HTTP_BIND=0.0.0.0:8080 HTTPJAIL_HTTPS_BIND=0.0.0.0:8443 httpjail --server -r "allow: .*"
+# Output: Server running on ports 8080 (HTTP) and 8443 (HTTPS). Press Ctrl+C to stop.
+
+# Configure your applications to use the proxy:
+export HTTP_PROXY=http://localhost:8080
+export HTTPS_PROXY=http://localhost:8443
+curl https://github.com  # This request will go through httpjail
+```
+
+**Note**: In server mode, httpjail does not create network isolation. Applications must be configured to use the proxy via environment variables or application-specific proxy settings.
+
 ## TLS Interception
 
 httpjail performs HTTPS interception using a locally-generated Certificate Authority (CA). The tool does not modify your system trust store. Instead, it configures the jailed process to trust the httpjail CA via environment variables.
@@ -201,16 +240,9 @@ How it works:
 
 Notes and limits:
 
-- Tools that ignore the above env vars will fail TLS verification when intercepted. For those, either add tool‑specific flags to point at `ca-cert.pem` or run with `--no-tls-intercept`.
+- Tools that ignore the above env vars will fail TLS verification when intercepted. For those, add tool‑specific flags to point at `ca-cert.pem`.
 - Long‑lived connections are supported: timeouts are applied only to protocol detection, CONNECT header reads, and TLS handshakes — not to proxied streams (e.g., gRPC/WebSocket).
 
-### Disable TLS Interception
-
-```bash
-# Only monitor/block HTTP traffic
-httpjail --no-tls-intercept --allow ".*" -- ./app
-```
-
 ## License
 
 This project is released into the public domain under the CC0 1.0 Universal license. See [LICENSE](LICENSE) for details.

src/jail/mod.rs

@@ -52,10 +52,6 @@ pub struct JailConfig {
     /// Port for HTTPS proxy
     pub https_proxy_port: u16,
 
-    /// Whether to use TLS interception
-    #[allow(dead_code)]
-    pub tls_intercept: bool,
-
     /// Unique identifier for this jail instance
     pub jail_id: String,
 
@@ -79,7 +75,6 @@ impl JailConfig {
         Self {
             http_proxy_port: 8040,
             https_proxy_port: 8043,
-            tls_intercept: true,
             jail_id,
             enable_heartbeat: true,
             heartbeat_interval_secs: 1,

src/main.rs

@@ -37,10 +37,6 @@ struct Args {
     #[arg(long = "request-log", value_name = "FILE")]
     request_log: Option<String>,
 
-    /// Disable HTTPS interception
-    #[arg(long = "no-tls-intercept")]
-    no_tls_intercept: bool,
-
     /// Interactive approval mode
     #[arg(long = "interactive")]
     interactive: bool,
@@ -65,8 +61,16 @@ struct Args {
     #[arg(long = "cleanup", hide = true)]
     cleanup: bool,
 
+    /// Run as standalone proxy server (without executing a command)
+    #[arg(
+        long = "server",
+        conflicts_with = "cleanup",
+        conflicts_with = "timeout"
+    )]
+    server: bool,
+
     /// Command and arguments to execute
-    #[arg(trailing_var_arg = true, required_unless_present = "cleanup")]
+    #[arg(trailing_var_arg = true, required_unless_present_any = ["cleanup", "server"])]
     command: Vec<String>,
 }
 
@@ -307,6 +311,11 @@ async fn main() -> Result<()> {
         return Ok(());
     }
 
+    // Handle server mode
+    if args.server {
+        info!("Starting httpjail in server mode");
+    }
+
     // Build rules from command line arguments
     let rules = build_rules(&args)?;
     let request_log = if let Some(path) = &args.request_log {
@@ -322,18 +331,50 @@ async fn main() -> Result<()> {
     };
     let rule_engine = RuleEngine::new(rules, args.dry_run, request_log);
 
-    // Get ports from env vars (optional)
-    let http_port = std::env::var("HTTPJAIL_HTTP_BIND")
-        .ok()
-        .and_then(|s| s.parse::<u16>().ok());
+    // Parse bind configuration from env vars
+    // Supports both "port" and "ip:port" formats
+    fn parse_bind_config(env_var: &str) -> (Option<u16>, Option<std::net::IpAddr>) {
+        if let Ok(val) = std::env::var(env_var) {
+            if let Some(colon_pos) = val.rfind(':') {
+                // Try to parse as ip:port
+                let ip_str = &val[..colon_pos];
+                let port_str = &val[colon_pos + 1..];
+
+                let port = port_str.parse::<u16>().ok();
+                let ip = ip_str.parse::<std::net::IpAddr>().ok();
+
+                if port.is_some() && ip.is_some() {
+                    return (port, ip);
+                }
+            }
 
-    let https_port = std::env::var("HTTPJAIL_HTTPS_BIND")
-        .ok()
-        .and_then(|s| s.parse::<u16>().ok());
+            // Try to parse as just a port number
+            if let Ok(port) = val.parse::<u16>() {
+                return (Some(port), None);
+            }
+        }
+        (None, None)
+    }
 
-    // Determine bind address based on platform and mode
-    let bind_address = if args.weak {
-        // In weak mode, bind to localhost only
+    let (http_port_env, http_bind_ip) = parse_bind_config("HTTPJAIL_HTTP_BIND");
+    let (https_port_env, https_bind_ip) = parse_bind_config("HTTPJAIL_HTTPS_BIND");
+
+    // Use env port or default to 8080/8443 in server mode
+    let http_port = http_port_env.or(if args.server { Some(8080) } else { None });
+    let https_port = https_port_env.or(if args.server { Some(8443) } else { None });
+
+    // Determine bind address based on configuration and mode
+    let bind_address = if let Some(ip) = http_bind_ip.or(https_bind_ip) {
+        // If user explicitly specified an IP, use it
+        match ip {
+            std::net::IpAddr::V4(ipv4) => Some(ipv4.octets()),
+            std::net::IpAddr::V6(_) => {
+                warn!("IPv6 addresses are not currently supported, falling back to IPv4");
+                None
+            }
+        }
+    } else if args.weak || args.server {
+        // In weak mode or server mode, bind to localhost only by default
         None
     } else {
         // For jailed mode on Linux, bind to all interfaces
@@ -357,11 +398,35 @@ async fn main() -> Result<()> {
         actual_http_port, actual_https_port
     );
 
+    // In server mode, just run the proxy server
+    if args.server {
+        // Use tokio::sync::Notify for real-time shutdown signaling
+        let shutdown_notify = Arc::new(tokio::sync::Notify::new());
+        let shutdown_notify_clone = shutdown_notify.clone();
+
+        ctrlc::set_handler(move || {
+            info!("Received interrupt signal, shutting down server...");
+            shutdown_notify_clone.notify_one();
+        })
+        .expect("Error setting signal handler");
+
+        info!(
+            "Server running on ports {} (HTTP) and {} (HTTPS). Press Ctrl+C to stop.",
+            actual_http_port, actual_https_port
+        );
+
+        // Wait for shutdown signal
+        shutdown_notify.notified().await;
+
+        info!("Server shutdown complete");
+        return Ok(());
+    }
+
+    // Normal mode: create jail and execute command
     // Create jail configuration with actual bound ports
     let mut jail_config = JailConfig::new();
     jail_config.http_proxy_port = actual_http_port;
     jail_config.https_proxy_port = actual_https_port;
-    jail_config.tls_intercept = !args.no_tls_intercept;
 
     // Create and setup jail
     let mut jail = create_jail(jail_config.clone(), args.weak)?;
@@ -398,21 +463,19 @@ async fn main() -> Result<()> {
     // Set up CA certificate environment variables for common tools
     let mut extra_env = Vec::new();
 
-    if !args.no_tls_intercept {
-        match httpjail::tls::CertificateManager::get_ca_env_vars() {
-            Ok(ca_env_vars) => {
-                debug!(
-                    "Setting {} CA certificate environment variables",
-                    ca_env_vars.len()
-                );
-                extra_env = ca_env_vars;
-            }
-            Err(e) => {
-                warn!(
-                    "Failed to set up CA certificate environment variables: {}",
-                    e
-                );
-            }
+    match httpjail::tls::CertificateManager::get_ca_env_vars() {
+        Ok(ca_env_vars) => {
+            debug!(
+                "Setting {} CA certificate environment variables",
+                ca_env_vars.len()
+            );
+            extra_env = ca_env_vars;
+        }
+        Err(e) => {
+            warn!(
+                "Failed to set up CA certificate environment variables: {}",
+                e
+            );
         }
     }
 
@@ -531,13 +594,13 @@ mod tests {
             config: Some(file.path().to_str().unwrap().to_string()),
             dry_run: false,
             request_log: None,
-            no_tls_intercept: false,
             interactive: false,
             weak: false,
             verbose: 0,
             timeout: None,
             no_jail_cleanup: false,
             cleanup: false,
+            server: false,
             command: vec![],
         };
 

src/proxy.rs

@@ -203,9 +203,11 @@ impl ProxyServer {
     pub async fn start(&mut self) -> Result<(u16, u16)> {
         // Start HTTP proxy
         let http_listener = if let Some(port) = self.http_port {
+            // If port is 0, let OS choose any available port
+            // Otherwise bind to the specified port
             TcpListener::bind(SocketAddr::from((self.bind_address, port))).await?
         } else {
-            // Find available port in 8000-8999 range
+            // No port specified, find available port in 8000-8999 range
             let listener = bind_to_available_port(8000, 8999, self.bind_address).await?;
             self.http_port = Some(listener.local_addr()?.port());
             listener
@@ -245,9 +247,11 @@ impl ProxyServer {
 
         // Start HTTPS proxy
         let https_listener = if let Some(port) = self.https_port {
+            // If port is 0, let OS choose any available port
+            // Otherwise bind to the specified port
             TcpListener::bind(SocketAddr::from((self.bind_address, port))).await?
         } else {
-            // Find available port in 8000-8999 range
+            // No port specified, find available port in 8000-8999 range
             let listener = bind_to_available_port(8000, 8999, self.bind_address).await?;
             self.https_port = Some(listener.local_addr()?.port());
             listener

tests/platform_test_macro.rs

@@ -32,12 +32,6 @@ macro_rules! platform_tests {
             system_integration::test_jail_request_log::<$platform>();
         }
 
-        #[test]
-        #[::serial_test::serial]
-        fn test_jail_dry_run_mode() {
-            system_integration::test_jail_dry_run_mode::<$platform>();
-        }
-
         #[test]
         #[::serial_test::serial]
         fn test_jail_requires_command() {

tests/system_integration.rs

@@ -238,34 +238,6 @@ pub fn test_jail_request_log<P: JailTestPlatform>() {
     assert!(contents.contains("- GET http://example.com"));
 }
 
-/// Test dry-run mode
-pub fn test_jail_dry_run_mode<P: JailTestPlatform>() {
-    P::require_privileges();
-
-    let mut cmd = httpjail_cmd();
-    cmd.arg("--dry-run")
-        .arg("-r")
-        .arg("deny: .*") // Deny everything
-        .arg("--");
-    curl_http_status_args(&mut cmd, "http://ifconfig.me");
-
-    let output = cmd.output().expect("Failed to execute httpjail");
-
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    if !stderr.is_empty() {
-        eprintln!("[{}] stderr: {}", P::platform_name(), stderr);
-    }
-
-    // In dry-run mode, even deny rules should not block
-    assert_eq!(
-        stdout.trim(),
-        "200",
-        "Request should be allowed in dry-run mode"
-    );
-    assert!(output.status.success());
-}
-
 /// Test that jail requires a command
 pub fn test_jail_requires_command<P: JailTestPlatform>() {
     // This test doesn't require root