tools-socks-route — IMP FORGE

Configures the browser's SOCKS egress path end to end: a systemd --user ssh dynamic-forward unit and the matching Firefox proxy prefs, applied idempotently and revertible in one command. Replaces hand-editing a unit file and about:preferences and getting the two out of step.

Tier	tools
Role	unclassified (baselined)
Path	`crates/tools/socks-route`
Edition	2021
Targets	tools-socks-route, tools_socks_route, oracle
Public items	16 across 0 modules
Tests	14

What it is for

tools-socks-route -- the decidable core. Nothing here touches the filesystem, the network, or systemd; main.rs is the only place that does I/O.

Capabilities

`crate root`

tools-socks-route -- the decidable core. Nothing here touches the filesystem, the

Item
`pub const BEGIN: & str`
`pub const END: & str`
`pub const DEFAULT_USER: & str`
`pub const DEFAULT_SSH_PORT: u32`
`pub const DEFAULT_LOCAL_PORT: u32`
`fn revert_user_js(existing : & str) -> String`
`fn block_port(user_js : & str) -> Option <u32>`
`pub const PORT_SEARCH_SPAN: u32`
`fn port_candidates(start : u32) -> Vec <u32>`
`fn session_restore_enabled(prefs : & str) -> bool`
`fn is_main_firefox(argv : & String) -> bool`

`RouteSpec`

tools-socks-route -- the decidable core. Nothing here touches the filesystem, the

Item
`pub struct RouteSpec`
`RouteSpec :: fn validate(& self) -> Result <(), String>`
`fn render_unit(spec : & RouteSpec) -> String`
`fn user_js_block(spec : & RouteSpec) -> String`
`fn apply_user_js(existing : & str, spec : & RouteSpec) -> String`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

Item	What it is
`pub const BEGIN: & str`	Opening marker of the block this tool owns inside `user.js`.
`pub const END: & str`	Closing marker of the block this tool owns inside `user.js`.
`pub const DEFAULT_USER: & str`	—
`pub const DEFAULT_SSH_PORT: u32`	—
`pub const DEFAULT_LOCAL_PORT: u32`	—
`pub struct RouteSpec`	—
`RouteSpec :: fn validate(& self) -> Result <(), String>`	Every field lands in a systemd `ExecStart=` line and an `ssh` argument vector
`fn render_unit(spec : & RouteSpec) -> String`	The systemd --user unit
`fn user_js_block(spec : & RouteSpec) -> String`	The block written into `user.js`
`fn apply_user_js(existing : & str, spec : & RouteSpec) -> String`	Add or replace the managed block, neutralizing any hand-written proxy pref first
`fn revert_user_js(existing : & str) -> String`	Remove the managed block and restore every pref it neutralized, byte for byte.
`fn block_port(user_js : & str) -> Option <u32>`	The SOCKS port the browser is currently pointed at, if the managed block is present.
`pub const PORT_SEARCH_SPAN: u32`	How many ports past the requested one to try before giving up.
`fn port_candidates(start : u32) -> Vec <u32>`	Ports to try, in order, when the requested one is already held
`fn session_restore_enabled(prefs : & str) -> bool`	Whether Firefox will reopen the current windows and tabs after a restart
`fn is_main_firefox(argv : & String) -> bool`	Whether a process's argv identifies the ONE parent Firefox process

No pub use re-exports: every item above is declared in this crate.

Boundary

Depends on no other workspace tier.

Shares tier tools with 84 other crates: tools-advisory-reach, tools-archive-guard, tools-artifact-scaffold, tools-ask-ai-core, tools-ask-ais, tools-ask-gemini, tools-book, tools-book-report, … (84 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`tools`
Architectural role (taxonomy)	`unclassified (baselined)`
Location	`crates/tools/socks-route`
Vocabulary in force (lexicon)	`current`

Dependencies

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`anyhow`	`^1`	—	no	always
`clap`	`^4`	`derive`	no	always

Development, in this workspace.

Crate	Tier	Optional	Only on
`tools-cli-conformance`	tools	no	always

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["tools-socks-route"]
  SELF -->|development| n_tools_cli_conformance["tools-cli-conformance"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
bin	`tools-socks-route`	`src/main.rs`
lib	`tools_socks_route`	`src/lib.rs`
test	`oracle`	`tests/oracle.rs`

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

Property	Evidence
async public surface	none detected
async runtime	none detected
database access	none detected
network I/O	none detected
unsafe code	none detected
environment variables	yes

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

Variable	Read in
`HOME`	`src/main.rs`

No workspace crate depends on this one.

Verification

Kind	Count
Unit tests	1
Integration tests	13
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	15	0	0

What the tests establish, by name:

a_bound_socks_listener_is_loopback_only_and_carries_the_configured_port — tests/oracle.rs
a_file_with_no_trailing_newline_still_round_trips_after_normalization — tests/oracle.rs
a_hostile_host_or_user_can_never_reach_the_unit_file_or_the_ssh_argv — tests/oracle.rs
a_restart_is_only_safe_when_firefox_will_bring_the_tabs_back — tests/oracle.rs
a_taken_port_offers_the_next_ones_and_never_runs_off_the_end_of_the_range — tests/oracle.rs
an_identity_file_is_rendered_only_when_one_was_given — tests/oracle.rs
applying_twice_leaves_exactly_one_managed_block — tests/oracle.rs
only_the_parent_firefox_is_a_restart_target_never_a_child_process — tests/oracle.rs
re_applying_a_different_port_rewrites_the_block_instead_of_stacking_one — tests/oracle.rs
revert_on_a_file_we_never_touched_changes_nothing — tests/oracle.rs
revert_restores_the_file_byte_for_byte_including_the_users_own_proxy_prefs — tests/oracle.rs
status_reads_the_port_the_browser_is_actually_pointed_at — tests/oracle.rs
the_firefox_block_sets_every_pref_that_a_leak_would_need — tests/oracle.rs
cli_definition_conforms — src/main.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	12	16
Public modules with a `//!` block	0	0

pie showData
    title Public items with rustdoc
    "Documented" : 12
    "No rustdoc detected" : 4

Metrics

Metric	Value
Rust source files	2
Source lines	889
Code lines	721
Public API items	16
Public modules	0
Tests	14
Examples	0
Cargo features	0
Direct runtime dependencies	2
Workspace reverse dependencies	0

pie showData
    title Public API by kind
    "constant" : 6
    "function" : 8
    "method" : 1
    "struct" : 1

pie showData
    title Rust source composition
    "Code" : 721
    "Blank or comment" : 168

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.