Reuse backend headers for credential route proxy

codex-rs/backend-client/src/client.rs

@@ -9,6 +9,7 @@ use crate::types::TurnAttemptsSiblingTurnsResponse;
 use anyhow::Result;
 use codex_api::SharedAuthProvider;
 use codex_client::build_reqwest_client_with_custom_ca;
+use codex_client::chatgpt_cloudflare_cookie_header;
 use codex_client::with_chatgpt_cloudflare_cookie_store;
 use codex_login::CodexAuth;
 use codex_login::default_client::get_codex_user_agent;
@@ -19,6 +20,7 @@ use codex_protocol::protocol::RateLimitSnapshot;
 use codex_protocol::protocol::RateLimitWindow;
 use reqwest::StatusCode;
 use reqwest::header::CONTENT_TYPE;
+use reqwest::header::COOKIE;
 use reqwest::header::HeaderMap;
 use reqwest::header::HeaderName;
 use reqwest::header::HeaderValue;
@@ -429,8 +431,14 @@ impl Client {
         }
     }
 
-    pub fn credential_routes_proxy_auth_headers(&self) -> HeaderMap {
-        self.auth_headers()
+    pub fn credential_routes_proxy_headers(&self) -> HeaderMap {
+        let mut headers = self.headers();
+        if let Ok(proxy_url) = reqwest::Url::parse(&self.credential_routes_proxy_url())
+            && let Some(cookie) = chatgpt_cloudflare_cookie_header(&proxy_url)
+        {
+            headers.insert(COOKIE, cookie);
+        }
+        headers
     }
 
     /// Fetch the selected cloud-managed config bundle from codex-backend.

codex-rs/codex-client/src/chatgpt_cloudflare_cookies.rs

@@ -55,6 +55,10 @@ pub fn with_chatgpt_cloudflare_cookie_store(
     builder.cookie_provider(Arc::clone(&SHARED_CHATGPT_CLOUDFLARE_COOKIE_STORE))
 }
 
+pub fn chatgpt_cloudflare_cookie_header(url: &reqwest::Url) -> Option<HeaderValue> {
+    SHARED_CHATGPT_CLOUDFLARE_COOKIE_STORE.cookies(url)
+}
+
 fn is_chatgpt_cookie_url(url: &reqwest::Url) -> bool {
     match url.scheme() {
         "https" => {}

codex-rs/codex-client/src/lib.rs

@@ -9,6 +9,7 @@ mod sse;
 mod telemetry;
 mod transport;
 
+pub use crate::chatgpt_cloudflare_cookies::chatgpt_cloudflare_cookie_header;
 pub use crate::chatgpt_cloudflare_cookies::with_chatgpt_cloudflare_cookie_store;
 pub use crate::chatgpt_hosts::is_allowed_chatgpt_host;
 pub use crate::custom_ca::BuildCustomCaTransportError;

codex-rs/core/src/credentialed_routes.rs

@@ -43,7 +43,7 @@ pub(crate) async fn load_for_session(
             CredentialedRoutesSessionConfig {
                 routes: response.routes,
                 proxy_headers: credentialed_route_proxy_headers(
-                    client.credential_routes_proxy_auth_headers(),
+                    client.credential_routes_proxy_headers(),
                 ),
                 proxy_url: Some(client.credential_routes_proxy_url()),
             }