Honor configured proxy routes for auth refreshes (#34655)

## Why

ChatGPT token refresh requests need to follow the same configured routing policy as other authentication traffic, including environments that use the system proxy.

## What changed

- Require an `AuthRouteConfig` throughout login, logout, token refresh, personal access token, and agent identity flows.
- Build auth HTTP clients directly from that configuration instead of falling back to a default HTTP client when routing configuration is absent.

## Testing

- Add an integration test that refreshes a token through a cached system-proxy route and verifies the proxy receives the expected request.

GitOrigin-RevId: 7d54ab3219939a49921c51faf08cd4c2eabca51c

codex-rs/cli/src/login.rs

@@ -120,7 +120,7 @@ async fn clear_existing_auth_before_login(
     codex_home: &Path,
     auth_credentials_store_mode: AuthCredentialsStoreMode,
     auth_keyring_backend_kind: AuthKeyringBackendKind,
-    auth_route_config: Option<&AuthRouteConfig>,
+    auth_route_config: &AuthRouteConfig,
 ) {
     if let Err(err) = logout_with_revoke(
         codex_home,
@@ -139,13 +139,13 @@ pub async fn login_with_chatgpt(
     forced_chatgpt_workspace_id: Option<Vec<String>>,
     cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
     auth_keyring_backend_kind: AuthKeyringBackendKind,
-    auth_route_config: Option<AuthRouteConfig>,
+    auth_route_config: AuthRouteConfig,
 ) -> std::io::Result<()> {
     clear_existing_auth_before_login(
         &codex_home,
         cli_auth_credentials_store_mode,
         auth_keyring_backend_kind,
-        auth_route_config.as_ref(),
+        &auth_route_config,
     )
     .await;
 
@@ -180,7 +180,7 @@ pub async fn run_login_with_chatgpt(cli_config_overrides: CliConfigOverrides) ->
         forced_chatgpt_workspace_id,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        Some(config.auth_route_config()),
+        config.auth_route_config(),
     )
     .await
     {
@@ -246,7 +246,7 @@ pub async fn run_login_with_access_token(
         config.forced_chatgpt_workspace_id.as_deref(),
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
-        Some(&auth_route_config),
+        &auth_route_config,
     )
     .await
     {
@@ -320,7 +320,7 @@ pub async fn run_login_with_device_code(
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        Some(&auth_route_config),
+        &auth_route_config,
     )
     .await;
     let forced_chatgpt_workspace_id = config.forced_chatgpt_workspace_id.clone();
@@ -330,7 +330,7 @@ pub async fn run_login_with_device_code(
         forced_chatgpt_workspace_id,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        Some(auth_route_config),
+        auth_route_config,
     );
     if let Some(iss) = issuer_base_url {
         opts.issuer = iss;
@@ -368,7 +368,7 @@ pub async fn run_login_with_device_code_fallback_to_browser(
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        Some(&auth_route_config),
+        &auth_route_config,
     )
     .await;
 
@@ -379,7 +379,7 @@ pub async fn run_login_with_device_code_fallback_to_browser(
         forced_chatgpt_workspace_id,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        Some(auth_route_config),
+        auth_route_config,
     );
     if let Some(iss) = issuer_base_url {
         opts.issuer = iss;
@@ -430,7 +430,7 @@ pub async fn run_login_status(cli_config_overrides: CliConfigOverrides) -> ! {
         config.cli_auth_credentials_store_mode,
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
-        Some(&auth_route_config),
+        &auth_route_config,
     )
     .await
     {
@@ -484,7 +484,7 @@ pub async fn run_logout(cli_config_overrides: CliConfigOverrides) -> ! {
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        Some(&auth_route_config),
+        &auth_route_config,
     )
     .await
     {
@@ -557,7 +557,7 @@ mod tests {
             codex_home.path(),
             AuthCredentialsStoreMode::File,
             AuthKeyringBackendKind::default(),
-            /*auth_route_config*/ None,
+            &codex_login::test_support::transport_default_auth_route_config(),
         )
         .await;
 

codex-rs/cli/src/main.rs

@@ -1756,7 +1756,7 @@ async fn load_exec_server_remote_auth_provider(
         let auth = CodexAuth::from_agent_identity_jwt(
             &agent_identity_jwt,
             Some(&config.chatgpt_base_url),
-            Some(&auth_route_config),
+            &auth_route_config,
         )
         .await?;
         return Ok(codex_model_provider::auth_provider_from_auth(&auth));

codex-rs/cli/src/plugin_cmd.rs

@@ -610,7 +610,7 @@ pub(crate) async fn load_cli_auth_mode(config: &Config) -> Option<AuthMode> {
         config.cli_auth_credentials_store_mode,
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
-        Some(&auth_route_config),
+        &auth_route_config,
     )
     .await
     .ok()