From 3771fdca3e82820fb1966a1e88da2214b1e42ed0 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Mon, 15 Jun 2026 04:39:55 +0000
Subject: [PATCH] fix: configure D601 AgentRun runner proxy

---
 config/agentrun.yaml              |  6 ++++++
 scripts/src/agentrun-lanes.ts     | 12 ++++++++++++
 scripts/src/agentrun-manifests.ts |  2 ++
 3 files changed, 20 insertions(+)

diff --git a/config/agentrun.yaml b/config/agentrun.yaml
index b4e75a83..12f5e0ef 100644
--- a/config/agentrun.yaml
+++ b/config/agentrun.yaml
@@ -303,6 +303,12 @@ controlPlane:
           apiKeySecretRef:
             name: agentrun-v02-api-key
             key: HWLAB_API_KEY
+          egressProxyUrl: http://sub2api-egress-proxy.platform-infra.svc.cluster.local:10808
+          noProxyExtra:
+            - sub2api-egress-proxy
+            - sub2api-egress-proxy.platform-infra
+            - sub2api-egress-proxy.platform-infra.svc
+            - sub2api-egress-proxy.platform-infra.svc.cluster.local
         localPostgres:
           enabled: false
       gitMirror:
diff --git a/scripts/src/agentrun-lanes.ts b/scripts/src/agentrun-lanes.ts
index 92d64f76..2235c31c 100644
--- a/scripts/src/agentrun-lanes.ts
+++ b/scripts/src/agentrun-lanes.ts
@@ -103,6 +103,8 @@ export interface AgentRunLaneSpec {
       readonly serviceAccount: string;
       readonly jobNamePrefix: string;
       readonly apiKeySecretRef: { readonly name: string; readonly key: string };
+      readonly egressProxyUrl: string | null;
+      readonly noProxyExtra: readonly string[];
     };
     readonly localPostgres: {
       readonly enabled: boolean;
@@ -283,6 +285,8 @@ export function agentRunLaneSummary(spec: AgentRunLaneSpec): Record<string, unkn
         serviceAccount: spec.deployment.runner.serviceAccount,
         jobNamePrefix: spec.deployment.runner.jobNamePrefix,
         apiKeySecretRef: spec.deployment.runner.apiKeySecretRef,
+        egressProxyUrl: spec.deployment.runner.egressProxyUrl,
+        noProxyExtra: spec.deployment.runner.noProxyExtra,
       },
       localPostgres: spec.deployment.localPostgres,
     },
@@ -516,6 +520,8 @@ function parseDeployment(input: Record<string, unknown>, path: string): AgentRun
       serviceAccount: stringField(runner, "serviceAccount", `${path}.runner`),
       jobNamePrefix: stringField(runner, "jobNamePrefix", `${path}.runner`),
       apiKeySecretRef: parseSecretRef(recordField(runner, "apiKeySecretRef", `${path}.runner`), `${path}.runner.apiKeySecretRef`),
+      egressProxyUrl: optionalStringField(runner, "egressProxyUrl", `${path}.runner`) ?? null,
+      noProxyExtra: optionalStringArrayField(runner, "noProxyExtra", `${path}.runner`),
     },
     localPostgres: parseLocalPostgres(localPostgres, `${path}.localPostgres`),
   };
@@ -659,6 +665,12 @@ function optionalEnvPair(obj: Record<string, unknown>, key: string, path: string
   };
 }
 
+function optionalStringArrayField(obj: Record<string, unknown>, key: string, path: string): readonly string[] {
+  const value = obj[key];
+  if (value === undefined || value === null) return [];
+  return stringArrayField(obj, key, path);
+}
+
 function stringRecordField(obj: Record<string, unknown>, path: string): Readonly<Record<string, string>> {
   const result: Record<string, string> = {};
   for (const [key, value] of Object.entries(obj)) {
diff --git a/scripts/src/agentrun-manifests.ts b/scripts/src/agentrun-manifests.ts
index bdd2d64c..902d39f7 100644
--- a/scripts/src/agentrun-manifests.ts
+++ b/scripts/src/agentrun-manifests.ts
@@ -437,6 +437,8 @@ function managerEnv(spec: AgentRunLaneSpec, sourceCommit: string, imageRef: stri
     { name: "AGENTRUN_INTERNAL_MGR_URL", value: spec.runtime.internalBaseUrl },
     { name: "AGENTRUN_RUNNER_IMAGE", value: imageRef },
     { name: "AGENTRUN_RUNNER_SERVICE_ACCOUNT", value: spec.deployment.runner.serviceAccount },
+    ...(spec.deployment.runner.egressProxyUrl === null ? [] : [{ name: "AGENTRUN_RUNNER_EGRESS_PROXY_URL", value: spec.deployment.runner.egressProxyUrl }]),
+    ...(spec.deployment.runner.noProxyExtra.length === 0 ? [] : [{ name: "AGENTRUN_RUNNER_NO_PROXY_EXTRA", value: spec.deployment.runner.noProxyExtra.join(",") }]),
     { name: "AGENTRUN_API_KEY", valueFrom: { secretKeyRef: spec.deployment.manager.apiKeySecretRef } },
     ...(spec.deployment.manager.unideskSshEndpointEnv === null ? [] : [{ name: spec.deployment.manager.unideskSshEndpointEnv.name, value: spec.deployment.manager.unideskSshEndpointEnv.value }]),
   ];