Initialize execution environments with the final HTTP policy (#34995)

## Why

The TUI must inspect the default execution environment before loading its final
configuration. Initializing the environment manager at that point can give
startup services the bootstrap HTTP policy instead of the effective policy after
managed requirements are applied.

## What changed

- Split environment discovery from manager construction so callers can inspect
  the default environment without starting remote connections.
- Build the environment manager after final configuration loading and pass its
  resolved `HttpClientFactory` through all construction paths.
- Add shared test support for managers that use the legacy default HTTP policy.

## Testing

- Cover connection-free environment discovery and explicit HTTP policy
  propagation.
- Verify TUI startup services use the final managed `respect_system_proxy` value.

GitOrigin-RevId: 928fa31e6b4bcfbe1a121cade2f351427fdfa0f4

codex-rs/core/src/config/mod.rs

@@ -2927,13 +2927,22 @@ pub fn resolve_bootstrap_auth_route_config(
     cfg: &ConfigToml,
     feature_requirements: Option<&Sourced<FeatureRequirementsToml>>,
 ) -> std::io::Result<AuthRouteConfig> {
+    resolve_bootstrap_http_client_factory(cfg, feature_requirements)
+        .map(AuthRouteConfig::from_http_client_factory)
+}
+
+/// Resolves shared HTTP routing for startup work that runs before final [`Config`] loading.
+pub fn resolve_bootstrap_http_client_factory(
+    cfg: &ConfigToml,
+    feature_requirements: Option<&Sourced<FeatureRequirementsToml>>,
+) -> std::io::Result<HttpClientFactory> {
     resolve_bootstrap_respect_system_proxy(cfg, feature_requirements).map(|respect_system_proxy| {
         let outbound_proxy_policy = if respect_system_proxy {
             OutboundProxyPolicy::RespectSystemProxy
         } else {
             OutboundProxyPolicy::ReqwestDefault
         };
-        AuthRouteConfig::from_http_client_factory(HttpClientFactory::new(outbound_proxy_policy))
+        HttpClientFactory::new(outbound_proxy_policy)
     })
 }
 

codex-rs/core/src/connectors.rs

@@ -166,9 +166,12 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
         config.codex_self_exe.clone(),
         config.codex_linux_sandbox_exe.clone(),
     )?;
-    let environment_manager =
-        EnvironmentManager::from_codex_home(config.codex_home.clone(), Some(local_runtime_paths))
-            .await?;
+    let environment_manager = EnvironmentManager::from_codex_home(
+        config.codex_home.clone(),
+        Some(local_runtime_paths),
+        config.http_client_factory(),
+    )
+    .await?;
     list_accessible_connectors_from_mcp_tools_with_environment_manager(
         config,
         force_refetch,

codex-rs/core/src/environment_selection.rs

@@ -480,6 +480,9 @@ mod tests {
     use codex_exec_server::ExecServerRuntimePaths;
     use codex_exec_server::LOCAL_ENVIRONMENT_ID;
     use codex_exec_server::REMOTE_ENVIRONMENT_ID;
+    use codex_exec_server_test_support::environment_manager_without_environments;
+    use codex_http_client::HttpClientFactory;
+    use codex_http_client::OutboundProxyPolicy;
     use codex_protocol::protocol::TurnEnvironmentSelection;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use codex_utils_path_uri::PathUri;
@@ -609,10 +612,13 @@ url = "ws://127.0.0.1:8765"
         .expect("write environments.toml");
         let cwd = AbsolutePathBuf::current_dir().expect("cwd");
         let cwd_uri = PathUri::from_abs_path(&cwd);
-        let manager =
-            EnvironmentManager::from_codex_home(temp_dir.path(), Some(test_runtime_paths()))
-                .await
-                .expect("environment manager");
+        let manager = EnvironmentManager::from_codex_home(
+            temp_dir.path(),
+            Some(test_runtime_paths()),
+            HttpClientFactory::new(OutboundProxyPolicy::ReqwestDefault),
+        )
+        .await
+        .expect("environment manager");
 
         assert_eq!(
             default_thread_environment_selections(&manager, &cwd, std::slice::from_ref(&cwd)),
@@ -634,7 +640,7 @@ url = "ws://127.0.0.1:8765"
     #[tokio::test]
     async fn default_thread_environment_selections_empty_when_default_disabled() {
         let cwd = AbsolutePathBuf::current_dir().expect("cwd");
-        let manager = EnvironmentManager::without_environments();
+        let manager = environment_manager_without_environments();
 
         assert_eq!(
             default_thread_environment_selections(&manager, &cwd, std::slice::from_ref(&cwd)),
@@ -1062,7 +1068,7 @@ url = "ws://127.0.0.1:8765"
             Vec::new(),
             /*shell*/ None,
         );
-        let manager = Arc::new(EnvironmentManager::without_environments());
+        let manager = Arc::new(environment_manager_without_environments());
         manager
             .upsert_environment(
                 REMOTE_ENVIRONMENT_ID.to_string(),

codex-rs/core/src/prompt_debug.rs

@@ -52,6 +52,7 @@ pub async fn build_prompt_input(
             EnvironmentManager::from_codex_home(
                 config.codex_home.clone(),
                 Some(local_runtime_paths),
+                config.http_client_factory(),
             )
             .await
             .map_err(|err| CodexErr::Fatal(err.to_string()))?,