refactor(policy): consolidate duplicated YAML struct hierarchies#97
Merged
johntmyers merged 2 commits intomainfrom Mar 4, 2026
Merged
Conversation
… navigator-policy Closes #96 Merge the Deserialize-only input structs and Serialize-only output structs into a single set of types in navigator-policy that derive both Serialize and Deserialize. This eliminates the duplicate PolicyYaml hierarchy in navigator-cli and fixes three round-trip issues: - filesystem_policy vs filesystem field name mismatch - allowed_ips silently dropped on proto-to-YAML conversion - network policy name field silently dropped on proto-to-YAML conversion Also adds api_patterns support to the inference YAML schema and switches network_policies from HashMap to BTreeMap for deterministic output ordering.
Align test_l4_non_connect_method_rejected with the proxy behavior change in 52b48d1 which intentionally returns 403 for non-CONNECT requests.
johntmyers
deleted the
refactor/96-consolidate-policy-yaml-structs/jomyers
branch
drew
pushed a commit
that referenced
this pull request
Mar 16, 2026
* refactor(policy): consolidate duplicated YAML struct hierarchies into navigator-policy Closes #96 Merge the Deserialize-only input structs and Serialize-only output structs into a single set of types in navigator-policy that derive both Serialize and Deserialize. This eliminates the duplicate PolicyYaml hierarchy in navigator-cli and fixes three round-trip issues: - filesystem_policy vs filesystem field name mismatch - allowed_ips silently dropped on proto-to-YAML conversion - network policy name field silently dropped on proto-to-YAML conversion Also adds api_patterns support to the inference YAML schema and switches network_policies from HashMap to BTreeMap for deterministic output ordering. * fix(e2e): update non-CONNECT test assertion from 405 to 403 Align test_l4_non_connect_method_rejected with the proxy behavior change in c06117e which intentionally returns 403 for non-CONNECT requests. --------- Co-authored-by: John Myers <johntmyers@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #96
Summary
Consolidate the Deserialize-only input structs and Serialize-only output structs into a single set of types in
navigator-policythat derive bothSerializeandDeserialize. This eliminates the duplicatePolicyYamlhierarchy innavigator-cliand fixes three round-trip bugs wherencl sandbox policy get --fulloutput could not be fed back as input.Changes Made
crates/navigator-policy/src/lib.rs: AddedSerializederive to all YAML serde structs, addedskip_serializing_ifattributes for clean output, switchedHashMaptoBTreeMapfor deterministic ordering, addedapi_patternsfield toInferenceDef, addedInferenceApiPatternDefstruct, addedpub fn serialize_sandbox_policy()for proto-to-YAML conversion, renamedconvert_policy()toto_proto(), addedfrom_proto()for the reverse direction, added 4 round-trip testscrates/navigator-cli/src/run.rs: Deleted 10 duplicate*Yamlstructs (~85 lines) andpolicy_to_yaml()function (~77 lines), replaced both call sites withnavigator_policy::serialize_sandbox_policy(), removed unuseduse serde::SerializeimportDeviations from Plan
None — implemented as planned.
Tests Added
navigator-policy/src/lib.rs:round_trip_default_policy— full round-trip ofdev-sandbox-policy.yamlserialized_yaml_uses_filesystem_policy_key— verifies canonical field nameround_trip_preserves_allowed_ips— verifies no data loss onallowed_ipsround_trip_preserves_policy_name— verifies no data loss on policynamefieldround_trip_preserves_api_patterns— verifiesapi_patternssurvives round-tripDocumentation Updated
architecture/security-policy.mdalready uses the correct canonical field namesVerification
tmp/network_checks.py), unrelated