From cb4884ec19dfe1ade28c824f135511092f6d484c Mon Sep 17 00:00:00 2001
From: Dylan <dylan.hurd@openai.com>
Date: Fri, 17 Oct 2025 22:48:42 -0700
Subject: [PATCH] Clarify proxy clearing applies to all GitHub runners

---
 .../app-server/tests/common/mcp_process.rs     | 18 ++++++++++++++++++
 .../mcp-server/tests/common/mcp_process.rs     | 18 ++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/codex-rs/app-server/tests/common/mcp_process.rs b/codex-rs/app-server/tests/common/mcp_process.rs
index 29768df81c..c290625048 100644
--- a/codex-rs/app-server/tests/common/mcp_process.rs
+++ b/codex-rs/app-server/tests/common/mcp_process.rs
@@ -39,6 +39,20 @@ use codex_app_server_protocol::RequestId;
 use std::process::Command as StdCommand;
 use tokio::process::Command;
 
+// GitHub-hosted runners on every OS export HTTP proxy variables that point at a
+// loopback MITM. Reqwest obeys those settings and will emit absolute-form URIs,
+// which Wiremock does not match against simple path predicates. We first noticed
+// the resulting "expected request" flakes on Windows, but we clear the proxy
+// variables everywhere so the tests behave consistently across runners.
+const DISABLED_PROXY_ENV_VARS: &[&str] = &[
+    "ALL_PROXY",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "all_proxy",
+    "http_proxy",
+    "https_proxy",
+];
+
 pub struct McpProcess {
     next_request_id: AtomicI64,
     /// Retain this child process until the client is dropped. The Tokio runtime
@@ -79,6 +93,10 @@ impl McpProcess {
         cmd.env("CODEX_HOME", codex_home);
         cmd.env("RUST_LOG", "debug");
 
+        for proxy_env in DISABLED_PROXY_ENV_VARS {
+            cmd.env_remove(proxy_env);
+        }
+
         for (k, v) in env_overrides {
             match v {
                 Some(val) => {
diff --git a/codex-rs/mcp-server/tests/common/mcp_process.rs b/codex-rs/mcp-server/tests/common/mcp_process.rs
index a6bc966d7e..62be802343 100644
--- a/codex-rs/mcp-server/tests/common/mcp_process.rs
+++ b/codex-rs/mcp-server/tests/common/mcp_process.rs
@@ -13,6 +13,20 @@ use anyhow::Context;
 use assert_cmd::prelude::*;
 use codex_mcp_server::CodexToolCallParam;
 
+// GitHub-hosted runners on every OS set the HTTP(S)_PROXY variables to a loopback MITM.
+// When reqwest honours those settings it forwards requests using absolute-form URIs, which
+// Wiremock does not match against simple path filters. We first saw the resulting flaky
+// "expected request" assertions on Windows, but clearing the proxy variables keeps the
+// local mock servers reachable across all runners.
+const DISABLED_PROXY_ENV_VARS: &[&str] = &[
+    "ALL_PROXY",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "all_proxy",
+    "http_proxy",
+    "https_proxy",
+];
+
 use mcp_types::CallToolRequestParams;
 use mcp_types::ClientCapabilities;
 use mcp_types::Implementation;
@@ -69,6 +83,10 @@ impl McpProcess {
         cmd.env("CODEX_HOME", codex_home);
         cmd.env("RUST_LOG", "debug");
 
+        for proxy_env in DISABLED_PROXY_ENV_VARS {
+            cmd.env_remove(proxy_env);
+        }
+
         for (k, v) in env_overrides {
             match v {
                 Some(val) => {