chore: vendor dfx-core identity/network resolution, drop external dfx-core dependency (#10640)

## Why

`ic-sns-cli` and `ic-sns-testing` depended on the external
[`dfx-core`](https://crates.io/crates/dfx-core) crate. `dfx-core`
re-exports
`ic-agent` in its public API, so its **major version is bumped in
lockstep with
`ic-agent`** — every `ic-agent` upgrade in this repo requires a matching
`dfx-core` release.

Once the [`dfinity/sdk`](https://github.com/dfinity/sdk) repo is
archived, those
`dfx-core` releases can no longer be cut, which would block this
monorepo from
upgrading `ic-agent` at all. It also drags in a pile of outdated
transitive deps
(`bip32 0.4`, `tiny-bip39`, `sec1 0.3`, `handlebars`, `byte-unit`, …)
that other
teams have hit while trying to upgrade their own dependencies.

SNS only uses a small, self-contained slice of `dfx-core`: resolving a
dfx
identity + network into an `ic_agent::Agent`, and resolving an identity
name to
a principal. This PR vendors just that slice as a new internal crate and
removes
the external `dfx-core` dependency.

This direction was approved by the NNS team, who own `ic-sns-cli`: <!--
TODO: NNS discussion link -->.

## What

- New crate **`rs/sns/dfx-core-vendored`** — a trimmed, in-tree subset
of
  `dfx-core 0.4.0` exposing two functions:
  - `get_agent(network, identity) -> Agent`
  - `get_identity_principal(name) -> Principal`
- `ic-sns-cli` and `ic-sns-testing` rewired onto it; the `dfx-core`
dependency
  removed from both crates and from the workspace (`Cargo.toml`,
  `bazel/rust.MODULE.bazel`, lockfiles).
- The keyring/encrypted-PEM deps `dfx-core` used to pull in
(`aes-gcm`, `argon2`, `dialoguer`, `keyring`, `security-framework`)
become
direct deps of the new crate; the unused ones (`bip32 0.4`,
`tiny-bip39`,
`sec1 0.3`, `handlebars`, `byte-unit`, `dunce`, `tar`, `flate2`, …) drop
out of
  the graph.

## Behaviour

No user-facing change. dfx identities are untouched
(`~/.config/dfx/identity/…`)
and the SNS CLI behaves as before for the supported cases:

- **Identities:** plaintext PEM, password-encrypted PEM, OS keyring, and
HSM —
  all still load exactly as dfx loads them.
- **Networks:** `ic` (mainnet), `local` (shared or project, honouring a
running
  replica's `webserver-port`), and explicit IC HTTP endpoint URLs (e.g.
  `sns-testing --network http://127.0.0.1:8080`).

Not vendored (unused by SNS): identity creation/rename/removal/export,
wallets,
the extension manager, playground networks, and general
`dfx.json`/`networks.json`
parsing beyond the `local` bind. `IdentityManager::new` no longer
auto-creates a
default identity for `InitializeIdentity::Allow` (that is dfx's job),
but SNS only
ever calls it with `Disallow`, so there is no behavioural change in
practice.

See `rs/sns/dfx-core-vendored/README.md` for how to verify the subset
against
upstream and the maintenance expectations (the crate is treated as
frozen
vendored code — the only expected changes are the mechanical adjustments
to track
future `ic-agent` majors, which is the whole reason it exists).

## Reviewing the vendored crate

The crate is derived from **`dfx-core 0.4.0`** (which itself depends on
`ic-agent 0.47`, this workspace's version). Most modules are copied at
the **same
relative path** as upstream and trimmed; two files (`network.rs`,
`lib.rs`) are
reimplementations. To confirm the copied modules really are a subset:

```sh
diff -ur sdk/src/dfx-core/src ic/rs/sns/dfx-core-vendored/src
```

That diff is ~2,530 lines, but the review surface is tiny:

| | Lines | Notes |
| --- | --- | --- |
| Deletions (trimmed-out code) | ~1,865 | Skim-only |
| `Only in …` notices for dropped files | 34 | ~60 dropped files/dirs,
collapsed to one line each |
| **Additions** | **~190** | The only lines to actually read |

Of the ~190 additions:

- **~150 are the two reimplementations** — `lib.rs` (+112) and
`network.rs`
(~300 lines, which shows only as `Only in …/vendored: network.rs`, so
review it
directly). These need normal code review; there is no upstream
counterpart to
  diff against.
- **~39 across all 19 copied modules**, and none of it is rustfmt noise:
~25 shortened `use` statements (each verifiably a subset of upstream's
imports,
since imports are dropped alongside the code that used them), 9
doc-comment
lines (two `Unlike upstream …` notes), and 5 code lines for the edits
those
notes describe (`_initialize_identity` ignored, the
`NoIdentityConfigurationFound`
early-return, and `password_prompt` dropping its `PromptMode` argument).

(Don't run `diff -urN`: it expands every dropped file into a full
deletion,
ballooning to ~11,000 lines for no benefit.)

## Testing

- `cargo build` + `cargo clippy` (`-D warnings`, per
`ci/scripts/rust-lint.sh`)
  on `dfx-core-vendored`, `ic-sns-cli`, `ic-sns-testing`.
- `bazel build` of the new crate and all `//rs/sns/cli/...` +
`//rs/sns/testing/...`
  targets.
- `bazel test`:
  - `//rs/sns/cli:sns_test`, `//rs/sns/cli:sns_doctest`,
    `//rs/sns/testing:sns_testing_test`
- `//rs/sns/testing:sns_testing_ci` (full PocketIC NNS + SNS lifecycle)
  - `//rs/nervous_system/integration_tests:sns_extension_test`
- After merging the latest `master`, the crate compiles cleanly against
the
upgraded `ic-agent` / `ic-identity-hsm 0.47`, with no `dfx-core` release
  required — a live confirmation of the decoupling.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: IDX GitHub Automation <infra+github-automation@dfinity.org>

Author: 3 people

Cargo.Bazel.json.lock

@@ -416,6 +416,7 @@ members = [
     "rs/rust_canisters/xrc_mock",
     "rs/sns/audit",
     "rs/sns/cli",
+    "rs/sns/dfx-core-vendored",
     "rs/sns/governance",
     "rs/sns/governance/api",
     "rs/sns/governance/api_helpers",
@@ -643,7 +644,6 @@ curve25519-dalek = { version = "4.1.3", features = [
 der = { version = "0.7", default-features = false, features = ["derive"] }
 derive-new = "0.7.0"
 devicemapper = "0.34"
-dfx-core = { version = "0.4.0" }
 ed25519-dalek = { version = "2.2.0", features = [
     "std",
     "zeroize",

Cargo.Bazel.toml.lock

@@ -64,6 +64,20 @@ crate.spec(
     package = "aide",
     version = "^0.14.2",
 )
+crate.spec(
+    features = [
+        "std",
+    ],
+    package = "aes-gcm",
+    version = "^0.10.3",
+)
+crate.spec(
+    features = [
+        "std",
+    ],
+    package = "argon2",
+    version = "^0.4",
+)
 crate.spec(
     package = "arbitrary",
     version = "^1.3.2",
@@ -393,8 +407,12 @@ crate.spec(
     version = "0.34",
 )
 crate.spec(
-    package = "dfx-core",
-    version = "^0.4.0",
+    package = "dialoguer",
+    version = "^0.11.0",
+)
+crate.spec(
+    package = "directories-next",
+    version = "^2.0.0",
 )
 crate.spec(
     package = "dyn-clone",
@@ -903,6 +921,17 @@ crate.spec(
     package = "k256",
     version = "^0.13.4",
 )
+crate.spec(
+    features = [
+        "apple-native",
+        "windows-native",
+        "linux-native",
+        "sync-secret-service",
+        "vendored",
+    ],
+    package = "keyring",
+    version = "^3",
+)
 crate.spec(
     package = "lazy_static",
     version = "^1.4.0",
@@ -1472,6 +1501,10 @@ crate.spec(
     package = "secp256k1",
     version = "^0.22",
 )
+crate.spec(
+    package = "security-framework",
+    version = "^3",
+)
 crate.spec(
     features = [
         "serde",

Cargo.lock

@@ -29,6 +29,7 @@ rust_library(
         "//rs/nns/constants",
         "//rs/nns/governance/api",
         "//rs/nns/sns-wasm",
+        "//rs/sns/dfx-core-vendored",
         "//rs/sns/governance",
         "//rs/sns/governance/api",
         "//rs/sns/init",
@@ -39,7 +40,6 @@ rust_library(
         "@crate_index//:base64",
         "@crate_index//:candid",
         "@crate_index//:clap",
-        "@crate_index//:dfx-core",
         "@crate_index//:futures",
         "@crate_index//:hex",
         "@crate_index//:ic-agent",
@@ -78,6 +78,7 @@ rust_binary(
         "//rs/nns/constants",
         "//rs/nns/governance/api",
         "//rs/nns/sns-wasm",
+        "//rs/sns/dfx-core-vendored",
         "//rs/sns/governance",
         "//rs/sns/governance/api",
         "//rs/sns/init",
@@ -88,7 +89,6 @@ rust_binary(
         "@crate_index//:base64",
         "@crate_index//:candid",
         "@crate_index//:clap",
-        "@crate_index//:dfx-core",
         "@crate_index//:futures",
         "@crate_index//:hex",
         "@crate_index//:ic-agent",
@@ -144,6 +144,7 @@ rust_test(
         "//rs/nns/constants",
         "//rs/nns/governance/api",
         "//rs/nns/sns-wasm",
+        "//rs/sns/dfx-core-vendored",
         "//rs/sns/governance",
         "//rs/sns/governance/api",
         "//rs/sns/init",
@@ -155,7 +156,6 @@ rust_test(
         "@crate_index//:base64",
         "@crate_index//:candid",
         "@crate_index//:clap",
-        "@crate_index//:dfx-core",
         "@crate_index//:futures",
         "@crate_index//:hex",
         "@crate_index//:ic-agent",

Cargo.toml

@@ -19,7 +19,7 @@ base64 = { workspace = true }
 candid = { workspace = true }
 candid-utils = { path = "../../nervous_system/candid_utils" }
 clap = { workspace = true }
-dfx-core = { workspace = true }
+dfx-core-vendored = { path = "../dfx-core-vendored" }
 futures = { workspace = true }
 hex = { workspace = true }
 ic-agent = { workspace = true }

bazel/rust.MODULE.bazel

@@ -1,6 +1,5 @@
 use anyhow::Context;
 use anyhow::Result;
-use dfx_core::interface::{builder::IdentityPicker, dfx::DfxInterface};
 use futures::{StreamExt, stream};
 use ic_agent::Agent;
 use ic_nervous_system_agent::sns::Sns;
@@ -10,34 +9,13 @@ use serde::{Deserialize, Serialize};
 /// Gets an agent for a given network and identity. This is similar to the code DFX uses internally to get an agent.
 /// If no identity is provided, it will use the identity currently selected in the DFX CLI.
 pub async fn get_agent(network_name: &str, identity: Option<String>) -> Result<Agent> {
-    let interface = dfx_interface(network_name, identity)
+    dfx_core_vendored::get_agent(network_name, identity.clone())
         .await
-        .context("Failed to get dfx interface")?;
-    Ok(interface.agent().clone())
-}
-
-/// Gets a dfx interface for a given network and identity. This is similar to the code DFX uses internally to build the interface.
-/// So this function allows the DFX SNS Extension to use the same interface as DFX itself.
-/// If no identity is provided, it will use the identity currently selected in the DFX CLI.
-pub async fn dfx_interface(network_name: &str, identity: Option<String>) -> Result<DfxInterface> {
-    let interface_builder = {
-        let identity = identity
-            .clone()
-            .map(IdentityPicker::Named)
-            .unwrap_or(IdentityPicker::Selected);
-        DfxInterface::builder()
-            .with_identity(identity)
-            .with_network_named(network_name)
-    };
-    let interface = interface_builder.build().await.context(format!(
-        "Failed to build dfx interface with network `{network_name}` and identity `{identity:?}`"
-    ))?;
-    if !interface.network_descriptor().is_ic {
-        interface.agent().fetch_root_key().await.context(format!(
-            "Failed to fetch root key from network `{network_name}`."
-        ))?;
-    }
-    Ok(interface)
+        .with_context(|| {
+            format!(
+                "Failed to build agent for network `{network_name}` and identity `{identity:?}`"
+            )
+        })
 }
 
 #[derive(Debug, Serialize, Deserialize)]

rs/sns/cli/BUILD.bazel

@@ -0,0 +1,37 @@
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = [
+    "//rs/sns/cli:__pkg__",
+    "//rs/sns/testing:__pkg__",
+])
+
+rust_library(
+    name = "dfx-core-vendored",
+    srcs = glob(["src/**/*.rs"]),
+    crate_name = "dfx_core_vendored",
+    version = "0.4.0",
+    deps = [
+        # Keep sorted.
+        "@crate_index//:aes-gcm",
+        "@crate_index//:argon2",
+        "@crate_index//:candid",
+        "@crate_index//:dialoguer",
+        "@crate_index//:directories-next",
+        "@crate_index//:hex",
+        "@crate_index//:ic-agent",
+        "@crate_index//:ic-identity-hsm",
+        "@crate_index//:keyring",
+        "@crate_index//:lazy_static",
+        "@crate_index//:reqwest",
+        "@crate_index//:serde",
+        "@crate_index//:serde_json",
+        "@crate_index//:slog",
+        "@crate_index//:thiserror",
+        "@crate_index//:url",
+    ] + select({
+        "@platforms//os:osx": [
+            "@crate_index//:security-framework",
+        ],
+        "//conditions:default": [],
+    }),
+)

rs/sns/cli/Cargo.toml

@@ -0,0 +1,36 @@
+[package]
+name = "dfx-core-vendored"
+# Tracks the upstream `dfx-core` release this crate was derived from, not the
+# workspace version, so the copied modules can be diffed against that release.
+version = "0.4.0"
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+aes-gcm = { version = "0.10.3", features = ["std"] }
+argon2 = { version = "0.4", features = ["std"] }
+candid = { workspace = true }
+dialoguer = { version = "0.11.0" }
+directories-next = { version = "2.0.0" }
+hex = { workspace = true }
+ic-agent = { workspace = true }
+lazy_static = { workspace = true }
+ic-identity-hsm = { workspace = true }
+keyring = { version = "3", features = [
+    "apple-native",
+    "windows-native",
+    "linux-native",
+    "sync-secret-service",
+    "vendored",
+] }
+reqwest = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+slog = { workspace = true }
+thiserror = { workspace = true }
+url = { workspace = true }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+security-framework = { version = "3" }