feat(minimal2): add --network and --ingress flags to activate by norrietaylor · Pull Request #570 · gominimal/minimal

norrietaylor · 2026-06-24T22:39:08Z

Summary

minimal activate hardcoded NetworkMode::default() (HostNet) and an empty policy, so NoNet/OwnIp and ingress port mappings had no CLI surface — they were reachable only via the netns proofs that construct a Record directly (crates/minimald/src/rpc.rs:675). This adds the activate flags.

Changes

crates/minimal2/src/main.rs:

--network <no-net|host-net|own-ip> (default host-net; no-flag behavior unchanged) via a local CliNetworkMode ValueEnum + From<CliNetworkMode> for sessions::NetworkMode, keeping the sessions crate free of a clap dependency.
--ingress EXT:INT[/PROTO] (repeatable; PROTO defaults tcp) parsed into sessions::PortMapping. Malformed specs and non-tcp/udp protocols are rejected at parse time.
Surface the daemon's typed CreateSession validation error (e.g. ingress on a non-own-ip session, privileged host port) instead of the generic returned an error from the daemon line.

Options:
  -n, --name <NAME>                Optional session name
      --network <NETWORK>          Network mode: no-net, host-net (default), or own-ip [default: host-net] [possible values: no-net, host-net, own-ip]
      --ingress <EXT:INT[/PROTO]>  Static ingress port mapping `EXT:INT[/PROTO]` (PROTO = tcp|udp, default tcp). Repeatable. Requires `--network own-ip`

Scope

Default behavior is unchanged: a flag-less minimal activate still creates a HostNet session with empty policy.
Daemon-side Record::validate_policy is the enforcement point and is unchanged — the CLI builds the Record and surfaces the daemon's verdict.
No egress flag (egress allow-list enforcement is deferred to Unit 2 follow-up: R2.2 egress enforcement (relay-layer frame inspection) + R2.4 dynamic port-mapping #553); --ingress sets static port_mappings only, not dynamic_allowed_range.

Verification

Docker rust:1.95 + protobuf-compiler, --locked, CARGO_INCREMENTAL=0:

cargo fmt --all -- --check — clean
cargo clippy -p minimal2 --all-targets -- -D warnings — clean
cargo test -p minimal2 — 6 passed (3 new parser tests: tcp default, explicit proto, malformed/bad-proto rejection)
minimal activate --help renders the flags above

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added support for selecting a session network mode when running minimal activate.
- Added static ingress port mappings via a repeatable --ingress EXT:INT[/PROTO] flag, including protocol selection.
Bug Fixes
- Activation now surfaces the daemon’s exact error message instead of a generic failure.
Tests
- Added unit tests for ingress parsing, covering default TCP, explicit UDP, and invalid or unsupported specifications.

`minimal activate` hardcoded NetworkMode::default() (HostNet) with empty policy, so NoNet/OwnIp and ingress port mappings had no CLI surface and were reachable only via the netns proofs constructing a Record directly. - `--network <no-net|host-net|own-ip>` (default host-net; no-flag behavior unchanged) via a local CliNetworkMode ValueEnum, keeping the sessions crate free of a clap dependency. - `--ingress EXT:INT[/PROTO]` (repeatable; PROTO defaults tcp) parsed into sessions::PortMapping; non-tcp/udp and malformed specs rejected at parse time. - Surface the daemon's typed CreateSession validation error (e.g. ingress on a non-own-ip session) instead of a generic failure line. Daemon-side validate_policy is unchanged and remains the enforcement point. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

coderabbitai · 2026-06-24T22:39:21Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 05a23417-664a-4d20-8ca9-e7e737416ec0

📥 Commits

Reviewing files that changed from the base of the PR and between da39e86 and 5031d29.

📒 Files selected for processing (1)

crates/minimal2/src/main.rs

🚧 Files skipped from review as they are similar to previous changes (1)

crates/minimal2/src/main.rs

📝 Walkthrough

Walkthrough

The minimal activate command now accepts a session network mode, parses repeatable ingress port mappings with optional protocols, uses them when creating session policy and records, and prints daemon validation errors directly from CreateSession responses.

Changes

Minimal activate networking

Layer / File(s)	Summary
CLI contract and ingress parsing `crates/minimal2/src/main.rs`	`ActivateArgs` adds `--network` and repeatable `--ingress` input, and `parse_ingress_mapping` validates `EXT:INT[/PROTO]` values with TCP as the default protocol. Unit tests cover default TCP, explicit UDP, and invalid inputs.
Session policy and network wiring `crates/minimal2/src/main.rs`	`cmd_activate` parses ingress specs into port mappings, builds `SessionPolicy.ingress` only when mappings exist, and sets the created session record’s network mode from the selected CLI value.
CreateSession error reporting `crates/minimal2/src/main.rs`	`CreateSession` handling now matches `minimald_rpc::Errorable::{Ok, Err}` and prints the daemon’s validation error message from the error variant.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐇 I hopped through ports with joyful cheer,
TCP and UDP both crystal clear.
I picked my network, stout and neat,
Then listened to the daemon speak.
Hop, hop — the session’s on its feet!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding --network and --ingress flags to minimal activate.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

norrietaylor · 2026-06-25T04:43:15Z

@coderabbitai review

coderabbitai · 2026-06-25T04:43:21Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

norrietaylor · 2026-06-25T04:55:17Z

@coderabbitai review

coderabbitai · 2026-06-25T04:55:23Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

norrietaylor changed the title ~~feat(minimal2): add --network and --ingress flags to activate~~ [WIP] feat(minimal2): add --network and --ingress flags to activate Jun 24, 2026

norrietaylor marked this pull request as draft June 24, 2026 23:39

norrietaylor mentioned this pull request Jun 25, 2026

[WIP] feat(minimald,minvmd): seeded cache disk + workspace upload for offline session compose #573

Closed

norrietaylor marked this pull request as ready for review June 25, 2026 07:48

norrietaylor changed the title ~~[WIP] feat(minimal2): add --network and --ingress flags to activate~~ feat(minimal2): add --network and --ingress flags to activate Jun 25, 2026

norrietaylor mentioned this pull request Jun 25, 2026

[WIP] feat(minimald): run attach --command inside the session PTask sandbox (DM2) #575

Closed

Merge branch 'main' into feat/activate-network-ingress-flags

5031d29

norrietaylor closed this Jun 26, 2026

norrietaylor deleted the feat/activate-network-ingress-flags branch June 26, 2026 07:16

norrietaylor mentioned this pull request Jun 26, 2026

feat(minimald,minvmd,minimal2): end-to-end VM/guest/session networking integration #581

Merged

Navigation Menu

Uh oh!

feat(minimal2): add --network and --ingress flags to activate - #570

feat(minimal2): add --network and --ingress flags to activate#570
norrietaylor wants to merge 2 commits into
mainfrom
feat/activate-network-ingress-flags

norrietaylor commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

norrietaylor commented Jun 25, 2026

Uh oh!

coderabbitai Bot commented Jun 25, 2026 •

edited

Loading

Uh oh!

norrietaylor commented Jun 25, 2026

Uh oh!

coderabbitai Bot commented Jun 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

norrietaylor commented Jun 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Scope

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

norrietaylor commented Jun 25, 2026

Uh oh!

coderabbitai Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

norrietaylor commented Jun 25, 2026

Uh oh!

coderabbitai Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

norrietaylor commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading

coderabbitai Bot commented Jun 25, 2026 •

edited

Loading

coderabbitai Bot commented Jun 25, 2026 •

edited

Loading