Repository navigation
docs(minimal): reword activate network and egress flag help - #2170
Merged
norrietaylor merged 3 commits intoOct 12, 2026
Merged
norrietaylor merged 3 commits into
norrietaylor merged 3 commits into
Conversation
Replace jargon-heavy help on seven network and egress flags of min session activate (network, dynamic-ingress, dynamic-range, allow-subnets, allow-dns-hosts, deny-all-egress, credentialed- upstream) with plain-language wording: name the commands and modes a person types, say what each stance does, and drop internal ids and crate paths from user-facing help. Match the one affected --network row in docs/reference/cli-min.md. Co-Authored-By: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to This change only updates CLI help and reference wording for network and egress flags, with no behavior change. No actionable merge risk remains. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title is concise, uses the expected Conventional Commit format, and accurately describes the documentation-only network and egress help changes. |
| Description check | |
The description clearly explains the scope, behavior clarifications, testing performed, and non-code impact. It includes Summary and Testing content, although it does not reproduce the template's expl… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
-
📝 Generate docstrings
-
-
-
-
-
-
-
-
-
-
- Commit to this branch
- Create a new PR
-
-
-
-
-
-
-
-
-
🧪 Generate unit tests (beta)
-
-
- Commit to this branch
- Create a new PR
-
-
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit reads the flags at night
The network paths are clear and bright
Allow and deny take shape in rows
The ingress range now clearly shows
It twitches ears, then hops away
With tidy help to guide the day
Comment @coderabbitai help to get the list of available commands.
Member
|
/review |
Contributor
The reworded `--allow-subnets` help said the egress flags work with `host_ip`. They are accepted there, and only `own_ip` enforces the rule flags: a host that decides per box refuses the create, and any other host runs the box with the rules unenforced. Say that in the help and in the matching reference row. State the per-list rule where the flags are read: once any egress flag is given, an allow list that is not given allows nothing. Reword `--allow-protocols` and `--deny-subnets` in the same voice as the other egress flags, restore the host_ip clause on `--deny-all-egress`, and name the host, not the daemon, as the one that opts out.
Member
|
/review |
Member
|
/review |
norrietaylor
enabled auto-merge (squash)
October 12, 2026 01:24
norrietaylor
approved these changes
Oct 12, 2026
norrietaylor
deleted the
inbox-patch/reword-activate-net-help-d6b12713910b58f5
branch
October 12, 2026 01:25
gominimal-aw-bot Bot
added a commit
that referenced
this pull request
Oct 12, 2026
* docs(minimal): reword activate network and egress flag help Replace jargon-heavy help on seven network and egress flags of min session activate (network, dynamic-ingress, dynamic-range, allow-subnets, allow-dns-hosts, deny-all-egress, credentialed- upstream) with plain-language wording: name the commands and modes a person types, say what each stance does, and drop internal ids and crate paths from user-facing help. Match the one affected --network row in docs/reference/cli-min.md. Co-Authored-By: Copilot <223556219+Copilot@users.noreply.github.com> * docs(minimal): state which network mode enforces the egress flags The reworded `--allow-subnets` help said the egress flags work with `host_ip`. They are accepted there, and only `own_ip` enforces the rule flags: a host that decides per box refuses the create, and any other host runs the box with the rules unenforced. Say that in the help and in the matching reference row. State the per-list rule where the flags are read: once any egress flag is given, an allow list that is not given allows nothing. Reword `--allow-protocols` and `--deny-subnets` in the same voice as the other egress flags, restore the host_ip clause on `--deny-all-egress`, and name the host, not the daemon, as the one that opts out. * docs(minimal): say a hostname-only egress rule reaches no address directly --------- Co-authored-by: gominimal-aw-bot[bot] <281738952+gominimal-aw-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>
gominimal-aw-bot Bot
added a commit
that referenced
this pull request
Oct 12, 2026
* docs(minimal): reword activate network and egress flag help Replace jargon-heavy help on seven network and egress flags of min session activate (network, dynamic-ingress, dynamic-range, allow-subnets, allow-dns-hosts, deny-all-egress, credentialed- upstream) with plain-language wording: name the commands and modes a person types, say what each stance does, and drop internal ids and crate paths from user-facing help. Match the one affected --network row in docs/reference/cli-min.md. Co-Authored-By: Copilot <223556219+Copilot@users.noreply.github.com> * docs(minimal): state which network mode enforces the egress flags The reworded `--allow-subnets` help said the egress flags work with `host_ip`. They are accepted there, and only `own_ip` enforces the rule flags: a host that decides per box refuses the create, and any other host runs the box with the rules unenforced. Say that in the help and in the matching reference row. State the per-list rule where the flags are read: once any egress flag is given, an allow list that is not given allows nothing. Reword `--allow-protocols` and `--deny-subnets` in the same voice as the other egress flags, restore the host_ip clause on `--deny-all-egress`, and name the host, not the daemon, as the one that opts out. * docs(minimal): say a hostname-only egress rule reaches no address directly --------- Co-authored-by: gominimal-aw-bot[bot] <281738952+gominimal-aw-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>
norrietaylor
pushed a commit
that referenced
this pull request
Oct 15, 2026
* docs(minimal): reword activate network and egress flag help Replace jargon-heavy help on seven network and egress flags of min session activate (network, dynamic-ingress, dynamic-range, allow-subnets, allow-dns-hosts, deny-all-egress, credentialed- upstream) with plain-language wording: name the commands and modes a person types, say what each stance does, and drop internal ids and crate paths from user-facing help. Match the one affected --network row in docs/reference/cli-min.md. * docs(minimal): state which network mode enforces the egress flags The reworded `--allow-subnets` help said the egress flags work with `host_ip`. They are accepted there, and only `own_ip` enforces the rule flags: a host that decides per box refuses the create, and any other host runs the box with the rules unenforced. Say that in the help and in the matching reference row. State the per-list rule where the flags are read: once any egress flag is given, an allow list that is not given allows nothing. Reword `--allow-protocols` and `--deny-subnets` in the same voice as the other egress flags, restore the host_ip clause on `--deny-all-egress`, and name the host, not the daemon, as the one that opts out. * docs(minimal): say a hostname-only egress rule reaches no address directly --------- (cherry picked from commit 21c2f3d)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routing-Key: inbox-route/I_kwDOSUhdos8AAAABWfdjvQ
The
min session activatenetwork and egress flag help wrapped plain descriptions around internals nobody choosing flags can act on: spec requirement ids, Box Spec field names, crate paths. This rewords the seven affected doc comments incrates/minimal/src/cli.rs(--network,--dynamic-ingress,--dynamic-range,--allow-subnets,--allow-dns-hosts,--deny-all-egress,--credentialed-upstream) to state what each stance does in the words a person types, and matches the one affected fragment of the--networkrow indocs/reference/cli-min.md. Help text only — no#[arg]attribute, parser, or code-path change (informed by #570).Not only a reword, in three places:
--allow-subnetsand--allow-dns-hostsare removed because they no longer hold: with the deny-all default in force, an allow list that is not given inside a declaration allows nothing. The help now states that rule on--allow-subnets, and--allow-dns-hostspoints to it.--allow-subnetsand its reference row no longer say the rule flags work withhost_ip. They are accepted withown_ipandhost_ip, and onlyown_ipenforces them: a host that decides per box refuses the create, and any other host runs the box with the rules unenforced.--allow-protocolsand--deny-subnetsare reworded in the same voice, and--deny-all-egresskeeps itshost_ipclause.Verification
-D warnings: clean.cargo testwith default output capture,legacy_network_spellings_parse_with_hintfails on this branch and on the untouched base alike. That is an artifact of running it outside the supported lane: the test captures the real fd 2, and under nextest, the lanejust testand CI run this crate in, every test owns its process and the test passes onmain.(NET-043):,(NET-079),NET-074,NET-134, "unset means allow-all", "range-without-mode", "interim source",sessions::EgressPolicy::deny_all(), "this declares the lane", "an IP of its own on the host's switch"); each replacement wording is present at its site.just lint-prose docs/reference/cli-min.md, run afterwards on a host with Vale: the changed line carries the same single pre-existing sentence-length warning as onmain, and the file's alert counts are unchanged (no new alerts).Untrusted-content note: no embedded instructions were found in the issue, ledger, or decision comment; the decision comment's
patch.briefwas treated as an advisory hint only, and every factual claim in the new wording was re-verified against the code (min net exposeis the in-box helper,--dynamic-ingressis refused offown_ip,--dynamic-rangerequires--dynamic-ingress,--network nonerejects egress flags, the deny-all default applies to anown_ipbox unless the daemon opts out, the credentialed-upstream lane takes effect only withown_ip).Summary by CodeRabbit
own_ipsessions receive their own IP address and, unless the host opts out, cannot reach external addresses without egress rules.noneand the behavior of--deny-all-egress.