Gate Rendezvous TCP_NODELAY by signed path

codex-rs/exec-server/src/client_transport.rs

@@ -30,6 +30,7 @@ use crate::noise_channel::NoiseChannelIdentity;
 use crate::noise_relay::NoiseHarnessConnectionArgs;
 use crate::noise_relay::noise_harness_connection_from_websocket;
 use crate::noise_relay::noise_relay_websocket_config;
+use crate::noise_relay::rendezvous_tcp_nodelay;
 use crate::relay::harness_connection_from_websocket;
 use crate::trace_context::current_trace_context_headers;
 
@@ -269,15 +270,13 @@ impl ExecServerClient {
         request
             .headers_mut()
             .extend(current_trace_context_headers());
+        let tcp_nodelay = rendezvous_tcp_nodelay(request.uri());
         let (stream, _) = timeout(
             connect_timeout,
             connect_async_with_config(
                 request,
                 Some(noise_relay_websocket_config()),
-                // Relay traffic consists of small, latency-sensitive frames, so
-                // send them immediately instead of waiting for Nagle coalescing.
-                /*disable_nagle*/
-                true,
+                /*disable_nagle*/ tcp_nodelay,
             ),
         )
         .await

codex-rs/exec-server/src/noise_relay/mod.rs

@@ -23,6 +23,19 @@ pub(crate) fn noise_relay_websocket_config() -> WebSocketConfig {
         .max_message_size(Some(MAX_NOISE_RELAY_WEBSOCKET_MESSAGE_SIZE))
 }
 
+pub(crate) fn rendezvous_tcp_nodelay(uri: &http::Uri) -> bool {
+    let Some(path) = uri.path().strip_prefix("/cloud-agent-nodelay/") else {
+        return false;
+    };
+    let Some((route_id, environment_id)) = path.split_once("/ws/environment/") else {
+        return false;
+    };
+    !route_id.is_empty()
+        && !route_id.contains('/')
+        && !environment_id.is_empty()
+        && !environment_id.contains('/')
+}
+
 fn take_next_sequence(next_seq: &mut u32) -> Result<u32, ExecServerError> {
     // Never wrap: relay sequence is the explicit ordering key for an implicit
     // Noise nonce. Reusing zero after u32::MAX would be ambiguous and unsafe.
@@ -32,3 +45,7 @@ fn take_next_sequence(next_seq: &mut u32) -> Result<u32, ExecServerError> {
     })?;
     Ok(seq)
 }
+
+#[cfg(test)]
+#[path = "rendezvous_url_tests.rs"]
+mod rendezvous_url_tests;

codex-rs/exec-server/src/noise_relay/rendezvous_url_tests.rs

@@ -0,0 +1,26 @@
+use http::Uri;
+use pretty_assertions::assert_eq;
+
+use super::rendezvous_tcp_nodelay;
+
+#[test]
+fn enables_tcp_nodelay_only_for_the_exact_treatment_path() {
+    for (path, expected) in [
+        ("/cloud-agent-nodelay/route/ws/environment/env", true),
+        (
+            "/cloud-agent-nodelay/route/ws/environment/env?role=harness&sig=abc",
+            true,
+        ),
+        ("/cloud-agent/route/ws/environment/env", false),
+        ("/cloud-agent/nodelay/ws/environment/env", false),
+        ("/cloud-agent/nodelay/route/ws/environment/env", false),
+        ("/cloud-agent-nodelay/route/ws/environment/", false),
+        ("/cloud-agent-nodelay/route/ws/environment/env/extra", false),
+    ] {
+        assert_eq!(
+            rendezvous_tcp_nodelay(&path.parse::<Uri>().expect("valid URI")),
+            expected,
+            "unexpected TCP_NODELAY decision for {path}",
+        );
+    }
+}

codex-rs/exec-server/src/remote.rs

@@ -36,6 +36,7 @@ use crate::NoiseRendezvousConnectBundle;
 use crate::NoiseRendezvousConnectProvider;
 use crate::client_api::DEFAULT_REMOTE_EXEC_SERVER_CONNECT_TIMEOUT;
 use crate::noise_relay::noise_relay_websocket_config;
+use crate::noise_relay::rendezvous_tcp_nodelay;
 use crate::relay::HarnessKeyValidator;
 use crate::relay::run_multiplexed_environment;
 use crate::server::ConnectionProcessor;
@@ -558,13 +559,11 @@ async fn connect_rendezvous(
         request
             .headers_mut()
             .extend(current_trace_context_headers());
+        let tcp_nodelay = rendezvous_tcp_nodelay(request.uri());
         connect_async_with_config(
             request,
             Some(noise_relay_websocket_config()),
-            // Relay traffic consists of small, latency-sensitive frames, so send
-            // them immediately instead of waiting for Nagle coalescing.
-            /*disable_nagle*/
-            true,
+            /*disable_nagle*/ tcp_nodelay,
         )
         .await
         .map(|(websocket, _)| websocket)