fix(sns-cli): resolve shared local network config in vendored dfx-core (#10914)

## What broke

#10640 vendored a subset of `dfx-core` into `rs/sns/dfx-core-vendored`,
replacing `ic-sns-cli`'s external `dfx-core` dependency. This broke
local-network resolution for downstream consumers, notably
`dfinity/snsdemo`'s CI (dfinity/snsdemo#611, dfinity/snsdemo#612), which
now fails with:

```
Error: Failed to build agent for network `local` and identity `None`
...
Caused by:
    0: Failed to fetch root key from network ...
    1: error sending request for url (http://127.0.0.1:8000/api/v2/status)
```

snsdemo's shared local network is configured (via
`~/.config/dfx/networks.json`) to bind on `127.0.0.1:8080`, not the
default `127.0.0.1:8000`/`127.0.0.1:4943`, and snsdemo's project
`dfx.json` does not declare its own `networks.local` entry.

## Why

`resolve_local_network()` in `rs/sns/dfx-core-vendored/src/network.rs`
decided "project-scoped local network" vs. "shared local network" purely
by whether *any* `dfx.json` existed above the working directory (via
`find_project_root()`):

```rust
let (data_directory, default_address) = match find_project_root() {
    Some(project_root) => (
        project_root.join(".dfx").join("network").join("local"),
        project_local_address(&project_root),
    ),
    None => (
        get_shared_network_data_directory("local")...,
        DEFAULT_SHARED_LOCAL_ADDRESS.to_string(),
    ),
};
```

This doesn't check whether that `dfx.json` actually declares its own
`networks.local` entry. A project like snsdemo's, whose `dfx.json` has
no `networks` key at all, was wrongly routed into the "project-scoped"
branch and given the hardcoded `127.0.0.1:8000` default — instead of
falling back to the *shared* network and reading its actually-configured
`bind` address.

This mirrors a gap the PR's own description called out: the
shared-network config reading present in the real `dfx-core`
(`create_shared_network_descriptor`, which reads `networks.json`'s
`local` entry and only falls back to a hardcoded default when that entry
is itself absent) was not carried over to the vendored subset. Real
`dfx-core` only takes the project-config branch for a network the
project's `dfx.json` actually declares
(`create_project_network_descriptor` returns `None` — not an error —
when the network isn't present, letting resolution fall through to the
shared config).

## What this PR changes

In `rs/sns/dfx-core-vendored/src/network.rs`:

- Replaced `find_project_root()` (found *a* `dfx.json`, unconditionally
treated as project-scoped) with `find_project_local_network()`, which
returns the project root **and its configured `local` bind address**
only when the nearest `dfx.json` actually has a `networks.local` entry.
Otherwise it returns `None`, so resolution falls back to the shared
network, matching dfx's `create_project_network_descriptor` semantics.
- Added `shared_local_address()`, which reads the actual configured
`bind` from the shared `~/.config/dfx/networks.json` (via
`get_user_dfx_config_dir()`), falling back to the existing
`127.0.0.1:4943` default only when that file doesn't exist or has no
`local` entry. Note the shared `networks.json` has no top-level
`networks` key (it *is* the network map), unlike a project's `dfx.json`.
- Updated `resolve_local_network()` to use these instead of hardcoding
`DEFAULT_SHARED_LOCAL_ADDRESS` for every
dfx-project-adjacent-but-not-declaring case.
- Updated the module doc comment to describe the corrected behavior.
- Added unit tests covering: a project `dfx.json` with no `networks` key
falling back to the shared network's configured bind (the regression
case); a project `dfx.json` that does declare its own `local` network
taking precedence; and the shared-network default applying when neither
config declares `local`.
- Added a `rust_test` target to `BUILD.bazel` for the new tests
(serialized via `--test-threads=1`, since they mutate the process's
working directory and the shared-config-directory override).

No change to the external dependency surface — this stays a minimal,
in-place bugfix to the vendored subset rather than reintroducing the
full `dfx-core` dependency.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: IDX GitHub Automation <infra+github-automation@dfinity.org>

Author: 3 people

Cargo.lock

@@ -1,37 +1,55 @@
-load("@rules_rust//rust:defs.bzl", "rust_library")
+load("@rules_rust//rust:defs.bzl", "rust_library", "rust_test")
 
 package(default_visibility = [
     "//rs/sns/cli:__pkg__",
     "//rs/sns/testing:__pkg__",
 ])
 
+# See rs/nervous_system/feature_test.md
+DEPENDENCIES = [
+    # Keep sorted.
+    "@crate_index//:aes-gcm",
+    "@crate_index//:argon2",
+    "@crate_index//:candid",
+    "@crate_index//:dialoguer",
+    "@crate_index//:directories-next",
+    "@crate_index//:hex",
+    "@crate_index//:ic-agent",
+    "@crate_index//:ic-identity-hsm",
+    "@crate_index//:keyring",
+    "@crate_index//:lazy_static",
+    "@crate_index//:reqwest",
+    "@crate_index//:serde",
+    "@crate_index//:serde_json",
+    "@crate_index//:slog",
+    "@crate_index//:thiserror",
+    "@crate_index//:url",
+] + select({
+    "@platforms//os:osx": [
+        "@crate_index//:security-framework",
+    ],
+    "//conditions:default": [],
+})
+
+# Only needed by tests.
+DEV_DEPENDENCIES = [
+    "@crate_index//:tempfile",
+]
+
 rust_library(
     name = "dfx-core-vendored",
-    srcs = glob(["src/**/*.rs"]),
+    srcs = glob(
+        ["src/**/*.rs"],
+        exclude = ["**/*tests.rs"],
+    ),
     crate_name = "dfx_core_vendored",
     version = "0.4.0",
-    deps = [
-        # Keep sorted.
-        "@crate_index//:aes-gcm",
-        "@crate_index//:argon2",
-        "@crate_index//:candid",
-        "@crate_index//:dialoguer",
-        "@crate_index//:directories-next",
-        "@crate_index//:hex",
-        "@crate_index//:ic-agent",
-        "@crate_index//:ic-identity-hsm",
-        "@crate_index//:keyring",
-        "@crate_index//:lazy_static",
-        "@crate_index//:reqwest",
-        "@crate_index//:serde",
-        "@crate_index//:serde_json",
-        "@crate_index//:slog",
-        "@crate_index//:thiserror",
-        "@crate_index//:url",
-    ] + select({
-        "@platforms//os:osx": [
-            "@crate_index//:security-framework",
-        ],
-        "//conditions:default": [],
-    }),
+    deps = DEPENDENCIES,
+)
+
+rust_test(
+    name = "dfx-core-vendored_test",
+    srcs = glob(["src/**/*.rs"]),
+    crate_root = "src/lib.rs",
+    deps = DEPENDENCIES + DEV_DEPENDENCIES,
 )

rs/sns/dfx-core-vendored/BUILD.bazel

@@ -34,3 +34,6 @@ url = { workspace = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 security-framework = { version = "3" }
+
+[dev-dependencies]
+tempfile = { workspace = true }

rs/sns/dfx-core-vendored/Cargo.toml

@@ -9,7 +9,7 @@ use crate::foundation::get_user_home;
 use crate::fs::composite::ensure_dir_exists;
 use directories_next::ProjectDirs;
 use std::ffi::OsString;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::{LazyLock, Mutex};
 
 pub fn project_dirs() -> Result<&'static ProjectDirs, GetUserHomeError> {
@@ -26,18 +26,34 @@ pub fn get_shared_network_data_directory(network: &str) -> Result<PathBuf, GetUs
         .join(network))
 }
 
+/// Usually `~/.config/dfx`: see `get_user_dfx_config_dir_with_override` for
+/// the exact rule, including the `DFX_CONFIG_ROOT` override and the
+/// Windows-specific location.
 pub fn get_user_dfx_config_dir() -> Result<PathBuf, ConfigError> {
     let config_root = DFX_CONFIG_ROOT.lock().unwrap().clone();
+    get_user_dfx_config_dir_with_override(config_root.as_deref().map(Path::new))
+}
+
+/// Like [`get_user_dfx_config_dir`], but the config root override is passed in
+/// explicitly instead of being read from the process-global [`DFX_CONFIG_ROOT`].
+/// This lets a caller (in particular, a test) supply a value directly, instead
+/// of mutating shared global state that would otherwise race across parallel
+/// test threads.
+pub(crate) fn get_user_dfx_config_dir_with_override(
+    config_root_override: Option<&Path>,
+) -> Result<PathBuf, ConfigError> {
     // dirs-next is not used for *nix to preserve existing paths
     #[cfg(not(windows))]
     let p = {
         let home = get_user_home().map_err(DetermineConfigDirectoryFailed)?;
-        let root = config_root.unwrap_or(home);
+        let root = config_root_override
+            .map(|root| root.as_os_str().to_owned())
+            .unwrap_or(home);
         PathBuf::from(root).join(".config").join("dfx")
     };
     #[cfg(windows)]
-    let p = match config_root {
-        Some(var) => PathBuf::from(var),
+    let p = match config_root_override {
+        Some(var) => var.to_owned(),
         None => project_dirs()
             .map_err(DetermineConfigDirectoryFailed)?
             .config_dir()

rs/sns/dfx-core-vendored/src/config/directories.rs

@@ -0,0 +1,16 @@
+use crate::error::fs::ReadFileError;
+use std::path::PathBuf;
+use thiserror::Error;
+
+/// The subset of dfx-core's `LoadDfxConfigError` (`error/load_dfx_config.rs`)
+/// this crate needs, to read and parse a project's `dfx.json`. Omits variants
+/// for machinery this crate doesn't replicate (extension canister types,
+/// canonicalizing a config path via `Config::resolve_config_path`).
+#[derive(Error, Debug)]
+pub enum LoadDfxConfigError {
+    #[error("Failed to load dfx configuration")]
+    ReadFile(#[from] ReadFileError),
+
+    #[error("Failed to deserialize json from {0}")]
+    DeserializeValueFailed(Box<PathBuf>, #[source] serde_json::Error),
+}

rs/sns/dfx-core-vendored/src/error/load_dfx_config.rs

@@ -0,0 +1,14 @@
+use crate::error::config::ConfigError;
+use crate::error::structured_file::StructuredFileError;
+use thiserror::Error;
+
+/// Copied (name + shape) from dfx-core's `LoadNetworksConfigError`
+/// (`error/load_networks_config.rs`).
+#[derive(Error, Debug)]
+pub enum LoadNetworksConfigError {
+    #[error("Failed to get path for network configuration")]
+    GetConfigPathFailed(#[source] ConfigError),
+
+    #[error("Failed to load network configuration")]
+    LoadConfigFromFileFailed(#[source] StructuredFileError),
+}

rs/sns/dfx-core-vendored/src/error/load_networks_config.rs

@@ -4,4 +4,6 @@ pub mod fs;
 pub mod get_user_home;
 pub mod identity;
 pub mod keyring;
+pub mod load_dfx_config;
+pub mod load_networks_config;
 pub mod structured_file;