refactor(proxy): separate proxy intent from activation

[SequeI]

Linked Issue

Closes #1099

Summary

Replace the flat ProxyLaunchOptions struct with focused intent structs: DomainFilterIntent, EndpointFilterIntent, CredentialProxyIntent, UpstreamProxyIntent, TlsInterceptIntent, and OpenUrlIntent.

Remove the stored active: bool field. Proxy activation is now derived via is_active(), which returns true when any activating intent struct is Some. WithEndpoints allow-domain entries are split from plain CONNECT-tunnel entries at prepare time, making the TLS-intercept requirement explicit in the type.

Infra-only flags (--proxy-port, --proxy-ca-validity, --trust-proxy-ca) now return an error if used without an activating proxy feature instead of silently doing nothing.

Test Plan

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+303
Lines removed	-80
Total changed	383
Classification	Large (> 300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[gemini-code-assist]

Code Review

This pull request refactors ProxyLaunchOptions by grouping its flat fields into structured intent types: DomainFilterIntent, EndpointFilterIntent, CredentialProxyIntent, UpstreamProxyIntent, TlsInterceptIntent, and OpenUrlIntent. The boolean active field is replaced with an is_active() helper method. Additionally, validation is added to ensure that infra-only flags (such as --proxy-port or TLS intercept settings) are not used without an activating proxy feature. There are no review comments, so we have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[lukehinds]

PRs good - and the following is only something I know from being tripped up before in this area (but mine was worse as it allowed rather then denied).

This let sorts entries by which enum variant , but there are actually two ways to write a plain "allow this whole domain" entry in a profile:

1. String form → parses to Plain:
   { "network": { "allow_domain": [ "foo.alwaysfurther.ai" ] } }

2. Object form → parses to WithEndpoints:

{ "network": { "allow_domain": [
    { "domain": "foo.alwaysfurther.ai", "endpoints": [ { "method": "GET", "path": "/v1/**" } ] }
] } }

Now the gotcha: endpoints has #[serde(default)], so you're allowed to write the object form and just leave em off:

{ "network": { "allow_domain": [ { "domain": "cdn.example.com" } ] } }

So you've got two ways to express the exact same intent that produce different internal variants,

the PR's partition keys on the variant (matches!(e, Plain(_))), so the second form gets misfiled into the endpoint bucket, and then dropped downstream.

The rest of the codebase avoids this trap by keying on !endpoints.is_empty() ("does this entry have path rules?") rather than on which variant it happens to be.

So I think its as simples as :

.partition(|e| !matches!(e, AllowDomainEntry::WithEndpoints { endpoints, .. } if !endpoints.is_empty()));

Hope that make sense , the debug_assert below can also get patched up with !endpoints.is_empty()

The rest is all good stuff , so will approve once you fix the above as if my musings are correct this would remove a domain from the proxy allowlist (mine was worse, it allowed a non allowed through).

[SequeI]

Ah I see, yea I tested locally and if endpoints is empty, the filter has nothing to match against so every request is failed rather than treated as a plain domain and passed through. Good spot!!