From 7f1c09979c79579c43b953762effe22eabc20e06 Mon Sep 17 00:00:00 2001 From: Abhinav Date: Thu, 29 Oct 2026 19:08:13 +0000 Subject: [PATCH] Expose system proxy support as an experimental setting (#58157) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What changed - Add “System proxy” to `/experimental` for opting into macOS or Windows system proxy settings. Keep `respect_system_proxy` disabled by default. - Update doctor’s macOS proxy guidance to point to `/experimental` and `codex features enable respect_system_proxy`, and tell users to restart Codex after changing the setting. ## Testing Add snapshots for the experimental setting and doctor guidance, plus a Responses test verifying that `x-codex-beta-features` includes `respect_system_proxy` only when enabled. GitOrigin-RevId: caa3e1a7cbe222069f35022b06c59da578b8a4dd --- codex-rs/cli/src/doctor/network.rs | 8 ++--- codex-rs/cli/src/doctor/output.rs | 9 +++++ ..._doctor_human_report_environment_rows.snap | 4 ++- .../tests/suite/responses_system_proxy.rs | 35 +++++++++++++++++++ codex-rs/features/src/lib.rs | 6 +++- .../experimental_features_view_tests.rs | 1 + ...imental_features_respect_system_proxy.snap | 15 ++++++++ 7 files changed, 72 insertions(+), 6 deletions(-) create mode 100644 codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__experimental_features_view__tests__experimental_features_respect_system_proxy.snap diff --git a/codex-rs/cli/src/doctor/network.rs b/codex-rs/cli/src/doctor/network.rs index c80c8c58fe..28ccfac415 100644 --- a/codex-rs/cli/src/doctor/network.rs +++ b/codex-rs/cli/src/doctor/network.rs @@ -75,6 +75,9 @@ pub(super) async fn checks( vec![config_check, network, websocket, reachability] } +#[cfg(any(target_os = "macos", test))] +pub(super) const SYSTEM_PROXY_REMEDIATION: &str = "A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the experimental System proxy setting in `/experimental` or with `codex features enable respect_system_proxy`. Restart Codex after changing this setting."; + pub(super) fn check(config: Option<&Config>) -> DoctorCheck { let mut details = Vec::new(); push_proxy_env_details(&mut details); @@ -163,10 +166,7 @@ pub(super) fn with_system_proxy_remediation( ) }) { - check.remediation = Some( - "A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the under-development feature with `codex features enable respect_system_proxy`." - .to_string(), - ); + check.remediation = Some(SYSTEM_PROXY_REMEDIATION.to_string()); } check } diff --git a/codex-rs/cli/src/doctor/output.rs b/codex-rs/cli/src/doctor/output.rs index 3ce3fd1b28..5445484b12 100644 --- a/codex-rs/cli/src/doctor/output.rs +++ b/codex-rs/cli/src/doctor/output.rs @@ -1415,6 +1415,15 @@ Background Server #[test] fn render_human_report_snapshot_covers_environment_rows() { let mut report = sample_report(); + report.checks.push( + DoctorCheck::new( + "network.reachability", + "network", + CheckStatus::Fail, + "provider is unreachable", + ) + .remediation(super::super::network::SYSTEM_PROXY_REMEDIATION), + ); report.checks.push( DoctorCheck::new("config.load", "config", CheckStatus::Ok, "config loaded") .detail("configured TUI mode: fullscreen"), diff --git a/codex-rs/cli/src/doctor/snapshots/codex__doctor__output__tests__doctor_human_report_environment_rows.snap b/codex-rs/cli/src/doctor/snapshots/codex__doctor__output__tests__doctor_human_report_environment_rows.snap index 90a4d4bfc3..38a773a2f5 100644 --- a/codex-rs/cli/src/doctor/snapshots/codex__doctor__output__tests__doctor_human_report_environment_rows.snap +++ b/codex-rs/cli/src/doctor/snapshots/codex__doctor__output__tests__doctor_human_report_environment_rows.snap @@ -8,6 +8,7 @@ Notes ↑ desktop build 123 available (ready to install) ⚠ terminal narrow terminal ✗ auth token expired - Run `codex login`. + ✗ network provider is unreachable - A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the experimental System proxy setting in `/experimental` or with `codex features enable respect_system_proxy`. Restart Codex after changing this setting. ⚠ git this worktree is not on a Windows Dev Drive - create a trusted Windows Dev Drive: https://learn.microsoft.com/en-us/windows/dev-drive/ ⚠ security Microsoft Defender can interfere with Codex. Verify Codex exclusions. ───────────────────────────────────────────────────────────── @@ -65,6 +66,7 @@ Updates Connectivity ✓ network network environment readable + ✗ network provider is unreachable — A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the experimental System proxy setting in `/experimental` or with `codex features enable respect_system_proxy`. Restart Codex after changing this setting. ✓ websocket Responses WebSocket handshake succeeded ✓ reachability active provider endpoints are reachable over HTTP @@ -72,7 +74,7 @@ Background Server ✓ app-server background server is not running ───────────────────────────────────────────────────────────── -16 ok · 5 notes · 3 warn · 1 fail failed +16 ok · 6 notes · 3 warn · 2 fail failed --summary compact output --all expand truncated lists --json redacted report diff --git a/codex-rs/core/tests/suite/responses_system_proxy.rs b/codex-rs/core/tests/suite/responses_system_proxy.rs index 2581f8c6ae..b2c9ae2051 100644 --- a/codex-rs/core/tests/suite/responses_system_proxy.rs +++ b/codex-rs/core/tests/suite/responses_system_proxy.rs @@ -1,6 +1,7 @@ use anyhow::Result; use codex_features::Feature; use codex_models_manager::bundled_models_response; +use core_test_support::responses; use core_test_support::responses::ev_completed; use core_test_support::responses::ev_response_created; use core_test_support::responses::sse; @@ -18,6 +19,40 @@ const SYSTEM_PROXY_TEST_SUBPROCESS_ENV_VAR: &str = "CODEX_SYSTEM_PROXY_TEST_SUBP const TEST_NAME: &str = "suite::responses_system_proxy::regular_responses_turn_honors_respect_system_proxy"; +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn responses_beta_header_tracks_system_proxy_opt_in() -> Result<()> { + skip_if_no_network!(Ok(())); + + for enabled in [false, true] { + let server = MockServer::start().await; + let response = responses::mount_sse_once( + &server, + sse(vec![ev_response_created("resp-1"), ev_completed("resp-1")]), + ) + .await; + let mut builder = test_codex().with_config(move |config| { + config + .features + .set_enabled(Feature::RespectSystemProxy, enabled) + .expect("test config should allow feature update"); + config.respect_system_proxy = enabled; + }); + let test = builder.build_with_auto_env(&server).await?; + test.submit_turn("hello").await?; + + let request = response.single_request(); + let beta_features = request.header("x-codex-beta-features").unwrap_or_default(); + assert_eq!( + beta_features + .split(',') + .any(|feature| feature == "respect_system_proxy"), + enabled, + ); + } + + Ok(()) +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn regular_responses_turn_honors_respect_system_proxy() -> Result<()> { skip_if_no_network!(Ok(())); diff --git a/codex-rs/features/src/lib.rs b/codex-rs/features/src/lib.rs index 6444f01f6f..d75146e5d3 100644 --- a/codex-rs/features/src/lib.rs +++ b/codex-rs/features/src/lib.rs @@ -1564,7 +1564,11 @@ pub const FEATURES: &[FeatureSpec] = &[ FeatureSpec { id: Feature::RespectSystemProxy, key: "respect_system_proxy", - stage: Stage::UnderDevelopment, + stage: Stage::Experimental { + name: "System proxy", + menu_description: "Use macOS or Windows system proxy settings for Codex requests.", + announcement: "", + }, default_enabled: false, }, FeatureSpec { diff --git a/codex-rs/tui/src/bottom_pane/experimental_features_view_tests.rs b/codex-rs/tui/src/bottom_pane/experimental_features_view_tests.rs index 25a2351fb9..c3a0ff6a92 100644 --- a/codex-rs/tui/src/bottom_pane/experimental_features_view_tests.rs +++ b/codex-rs/tui/src/bottom_pane/experimental_features_view_tests.rs @@ -53,6 +53,7 @@ fn experimental_features_display_metadata() { for feature in [ Feature::AnalyticsPlanHistory, Feature::LoginShellPackagePath, + Feature::RespectSystemProxy, ] { let stage = feature.stage(); let (app_tx, _app_rx) = tokio::sync::mpsc::unbounded_channel(); diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__experimental_features_view__tests__experimental_features_respect_system_proxy.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__experimental_features_view__tests__experimental_features_respect_system_proxy.snap new file mode 100644 index 0000000000..76a1cf000c --- /dev/null +++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__experimental_features_view__tests__experimental_features_respect_system_proxy.snap @@ -0,0 +1,15 @@ +--- +source: tui/src/bottom_pane/experimental_features_view_tests.rs +expression: buffer_text(&buffer) +--- + + Experimental features + Checked features are configured on. Some experimental features take effect + only in new tasks or after restarting the Codex server. + + +› [ ] System proxy Use macOS or Windows system proxy settings for Codex + requests. + + + space toggle · enter save · esc save/close