[Elliot (theelliotm)]

📖 Description

Fourth PR in the WSLC built-in proxy stack (#1625). The daemon stores runtimeConfig.networkProxy from a 1.1.0-alpha provision request and applies it to every exec in that container. Applies to bridged containers; isolated containers still reject a proxy.

• ProvisionConfig and ExecConfig gain network_proxy. PROTOCOL_VERSION goes from 9 to 10.
• The daemon now applies the proxy environment. The client sends the raw exec environment and the exec's own proxy URL.
• An exec may omit the proxy or name the same URL. A different URL is rejected with policy_validation. Error messages never include the URL.
• An exec with Replace env scope is rejected if the proxy it would use carries credentials, including one set at provision.
• A provision proxy must be a URL string, as on exec.
• Containers provisioned without a proxy behave as before.

🔗 References

Refs #1462
Spec: #1625
Stacked on #1717

🔍 Validation

On ARM64 with WSL 3.0.5:

• cargo fmt --all -- --check: passed
• cargo clippy -p mxc-sdk --features wslc --all-targets -- -D warnings: passed
• cargo test -p mxc-sdk --features wslc --lib wslc: passed (438)
• cargo test -p mxc-sdk --features wslc --bin wxc-wslc-daemon: passed (173)
• cargo test -p mxc-sdk --features wslc --test mxc_contract_v1_1_0_alpha --test wslc_daemon_ipc: passed (382; 1 passed, 3 ignored)
• tests\scripts\run_wslc_state_aware_tests.ps1 -WxcExecPath src\target\release\wxc-exec.exe: passed (147/147)

New state-aware scenario "CR" provisions with a proxy, checks an exec without runtimeConfig gets it (replacing caller-supplied proxy variables), and checks an exec naming a different proxy is rejected. Unit tests cover the omit/match/mismatch rule and the credential check on the provisioned URL.

Not run: x64. CI WSLC builds fail on this stack until 3.0.5 is on NuGet.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• For features or changes requiring a spec: linked the issue with maintainer-applied feature-accepted
• For implementation: linked the required approved and merged design/API spec, or explained why no spec is required
• Feature issue remains open unless this PR completes all agreed implementation, validation, and documentation
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

The daemon IPC and proxy-lifetime changes need Windows/WSL validation and maintainer confirmation, with x64 untested, Windows CI blocked, and the linked design/API proposal still unmerged.

No open issues 🎉

What changed in this PR

This fourth PR in the WSLC proxy stack enables a proxy configured during 1.1.0-alpha provisioning to apply to every exec in that container.

Changes:

• Moves proxy environment injection to the daemon and advances its protocol to version 10.
• Rejects conflicting exec proxy URLs and credential-bearing proxies with replacement environments.
• Adds lifecycle and unit coverage, updates existing test inputs, and documents provision-time proxy behavior.

File	Description
tests/​scripts/​run_wslc_state_aware_tests.ps1	Adds lifecycle checks for proxy inheritance and mismatch rejection.
src/​mxc-sdk/​tests/​wslc_daemon_ipc.rs	Updates IPC test inputs with optional proxy fields.
src/​mxc-sdk/​src/​bin/​wslc_daemon/​session_manager.rs	Stores the provisioned proxy and validates and applies it before exec.
src/​mxc-sdk/​src/​bin/​wslc_daemon/​control_server.rs	Updates control-server test inputs for the protocol changes.
src/​mxc-sdk/​src/​backends/​wslc/​common/​state_aware.rs	Forwards proxy URLs and unmodified exec environment entries to the daemon.
src/​mxc-sdk/​src/​backends/​wslc/​common/​policy.rs	Allows provision-time proxies and implements exec matching and credential checks.
src/​mxc-sdk/​src/​backends/​wslc/​common/​daemon_protocol.rs	Adds optional proxy fields and increments the protocol version.
docs/​backends/​wslc/​wslc-state-aware.md	Documents proxy inheritance, matching rules, and protocol version 10.
docs/​backends/​wslc/​wsl-container-getting-started.md	Explains where to configure proxies for execution and lifecycle operations.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The WSLC daemon policy changes lack supported-host validation, and the still-proposed proxy/exec compatibility contract needs maintainer design approval.

No open issues 🎉

_{Review effort: Balanced}