Honor system proxy settings for standalone web search (#47142)

## Why

Standalone web search used a default HTTP client, bypassing the configured system proxy route when `respect_system_proxy` was enabled.

## What changed

Pass the configured `HttpClientFactory` to the web search tool and create its client asynchronously for the provider's search URL using the API route policy. Export and reuse `SEARCH_ENDPOINT` so route selection and search requests use the same endpoint.

## Testing

Add an isolated regression test with environment proxies removed and a mock system proxy. Verify that standalone web search reaches the proxy and returns its result in the follow-up model request.

GitOrigin-RevId: 3b64803a777b9d1eb0ccf694e06658b0fd562129

codex-rs/core/tests/suite/mod.rs

@@ -219,6 +219,8 @@ mod user_notification;
 mod user_shell_cmd;
 mod view_image;
 mod web_search;
+#[path = "web_search_system_proxy_tests.rs"]
+mod web_search_system_proxy;
 mod websocket_fallback;
 mod window_headers;
 #[cfg(target_os = "windows")]

codex-rs/core/tests/suite/web_search_system_proxy_tests.rs

@@ -0,0 +1,131 @@
+//! Standalone web search must use the configured system proxy route.
+
+use anyhow::Result;
+use codex_core::config::Config;
+use codex_extension_api::ExtensionRegistryBuilder;
+use codex_features::Feature;
+use codex_http_client::cache_system_proxy_route_for_test;
+use codex_login::CodexAuth;
+use codex_models_manager::bundled_models_response;
+use codex_protocol::config_types::WebSearchMode;
+use codex_web_search_extension::install as install_web_search_extension;
+use core_test_support::responses;
+use core_test_support::skip_if_no_network;
+use core_test_support::test_codex::test_codex;
+use pretty_assertions::assert_eq;
+use serde_json::json;
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::process::Command;
+use tokio::time::timeout;
+use wiremock::Mock;
+use wiremock::ResponseTemplate;
+use wiremock::matchers::method;
+use wiremock::matchers::path;
+
+const TEST_NAME: &str =
+    "suite::web_search_system_proxy::standalone_web_search_honors_respect_system_proxy";
+const TEST_SUBPROCESS_ENV_VAR: &str = "CODEX_WEB_SEARCH_SYSTEM_PROXY_TEST_SUBPROCESS";
+const API_BASE_URL: &str = "http://web-search-proxy.invalid/v1";
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn standalone_web_search_honors_respect_system_proxy() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    if std::env::var_os(TEST_SUBPROCESS_ENV_VAR).is_none() {
+        // Isolate the proxy cache and remove environment proxies so only the configured
+        // system proxy route can reach the fake API origin.
+        let mut command = Command::new(std::env::current_exe()?);
+        command.arg("--exact").arg(TEST_NAME);
+        for key in codex_network_proxy::PROXY_ENV_KEYS {
+            command.env_remove(key);
+        }
+        let output = timeout(
+            Duration::from_secs(120),
+            command
+                .kill_on_drop(true)
+                .env(TEST_SUBPROCESS_ENV_VAR, "1")
+                .output(),
+        )
+        .await??;
+        assert!(
+            output.status.success(),
+            "subprocess test `{TEST_NAME}` failed\nstdout:\n{}\nstderr:\n{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr),
+        );
+        return Ok(());
+    }
+
+    let proxy = responses::start_mock_server().await;
+    Mock::given(method("POST"))
+        .and(path("/v1/alpha/search"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "output": "Search result through system proxy",
+        })))
+        .expect(1)
+        .mount(&proxy)
+        .await;
+    responses::mount_sse_once(
+        &proxy,
+        responses::sse(vec![
+            responses::ev_response_created("resp-1"),
+            responses::ev_function_call_with_namespace(
+                "web-run-1",
+                "web",
+                "run",
+                &json!({"search_query": [{"q": "standalone web search"}]}).to_string(),
+            ),
+            responses::ev_completed("resp-1"),
+        ]),
+    )
+    .await;
+    let follow_up_mock = responses::mount_sse_once(
+        &proxy,
+        responses::sse(vec![
+            responses::ev_assistant_message("msg-1", "done"),
+            responses::ev_completed("resp-2"),
+        ]),
+    )
+    .await;
+
+    let auth = CodexAuth::from_api_key("dummy");
+    let auth_manager = codex_core::test_support::auth_manager_from_auth(auth.clone());
+    let mut extension_builder = ExtensionRegistryBuilder::<Config>::new();
+    install_web_search_extension(&mut extension_builder, auth_manager);
+    let mut builder = test_codex()
+        .with_auth(auth)
+        .with_extensions(Arc::new(extension_builder.build()))
+        .with_config(|config| {
+            config.model_catalog =
+                Some(bundled_models_response().expect("bundled models.json should parse"));
+            config.model_provider.base_url = Some(API_BASE_URL.to_string());
+            for feature in [Feature::RespectSystemProxy, Feature::StandaloneWebSearch] {
+                config
+                    .features
+                    .enable(feature)
+                    .expect("test config should allow feature update");
+            }
+            config.respect_system_proxy = true;
+            config
+                .web_search_mode
+                .set(WebSearchMode::Live)
+                .expect("web search mode should be accepted");
+        });
+    let test = builder.build_with_auto_env(&proxy).await?;
+
+    for endpoint in ["responses", "alpha/search"] {
+        cache_system_proxy_route_for_test(&format!("{API_BASE_URL}/{endpoint}"), proxy.uri());
+    }
+    test.submit_turn("search the web through the system proxy")
+        .await?;
+
+    assert_eq!(
+        follow_up_mock
+            .single_request()
+            .function_call_output_content_and_success("web-run-1"),
+        Some((Some("Search result through system proxy".to_string()), None))
+    );
+
+    Ok(())
+}