mirror of
https://github.com/openai/codex.git
synced 2026-09-04 15:08:45 +00:00
6afcf26d5d
## Why `features.respect_system_proxy` already routes authentication traffic through the OS proxy APIs, but it does not affect the primary inference path. That leaves users behind OS-managed proxies unable to send normal Responses API requests even after login succeeds. This PR is the first product-path migration onto the route-aware transport introduced in #31323 and refined in #31331. It also establishes the construction pattern for later migrations: the effective feature state is resolved once into a required HTTP client factory rather than represented by an optional per-call setting. The scope remains limited to the two HTTP Responses endpoints; WebSockets, model discovery, memories, realtime, and file uploads remain follow-up migrations. ## What changed - Replace the optional proxy marker with an explicit `OutboundProxyPolicy::{ReqwestDefault, RespectSystemProxy}` and a required `HttpClientFactory`. The policy has no default, and the lower-level route-aware reqwest builder is now private. - Have `Config` construct the factory from the effective feature state and require every `ModelClient` constructor to receive it. There is no optional setter or implicit `None` fallback. - Build HTTP clients for `/responses` and `/responses/compact` with `ClientRouteClass::Api`, using the complete destination URL so PAC rules can make URL-specific decisions. - Layer route-aware selection onto Codex's existing default headers, Cloudflare cookie store, custom CA handling, and sandbox no-proxy behavior. - Add an integration test that loads `features.respect_system_proxy` through `config.toml`, creates a real Codex session, and verifies that both a normal Responses turn and remote compaction reach an isolated local proxy. ## Review guide 1. `http-client/src/outbound_proxy.rs` defines the mandatory policy/factory boundary and keeps route resolution private. 2. `core/src/config/mod.rs`, `core/src/session/session.rs`, and `core/src/client.rs` show the compile-time invariant: effective config creates the factory, and `ModelClient` cannot be constructed without one. 3. `login/src/auth/default_client.rs` preserves existing default-client behavior while accepting the required factory for migrated routes. 4. `core/src/client.rs` switches only streaming Responses and remote compaction HTTP transports to the API route class. 5. `core/tests/suite/responses_api_system_proxy.rs` is the behavioral regression boundary. Its Linux subprocess deliberately sets the CGI marker that disables reqwest's implicit environment-proxy handling, so the test fails if session wiring or either Responses call site falls back to the default client. ## Test plan - `cargo check --tests -p codex-http-client -p codex-login -p codex-core` - `just test -p codex-login` - `just test -p codex-core respect_system_proxy_feature_resolves_enabled` - Existing `compact_uses_bearer_after_agent_identity_session_fallback` coverage passes with the new transport construction. - New Linux integration coverage: `responses_and_compact_use_enabled_system_proxy` - `just bazel-lock-check` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/31335). * #31342 * __->__ #31335
170 lines
5.6 KiB
TOML
170 lines
5.6 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-core"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_core"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "codex-write-config-schema"
|
|
path = "src/bin/config_schema.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
arc-swap = { workspace = true }
|
|
async-channel = { workspace = true }
|
|
base64 = { workspace = true }
|
|
bm25 = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
codex-analytics = { workspace = true }
|
|
codex-agent-graph-store = { workspace = true }
|
|
codex-api = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-apply-patch = { workspace = true }
|
|
codex-async-utils = { workspace = true }
|
|
codex-code-mode = { workspace = true }
|
|
codex-connectors = { workspace = true }
|
|
codex-context-fragments = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-core-plugins = { workspace = true }
|
|
codex-core-skills = { workspace = true }
|
|
codex-exec-server = { workspace = true }
|
|
codex-extension-api = { workspace = true }
|
|
codex-features = { workspace = true }
|
|
codex-feedback = { workspace = true }
|
|
codex-file-system = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-memories-read = { workspace = true }
|
|
codex-mcp = { workspace = true }
|
|
codex-model-provider-info = { workspace = true }
|
|
codex-models-manager = { workspace = true }
|
|
codex-shell-command = { workspace = true }
|
|
codex-execpolicy = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-hooks = { workspace = true }
|
|
codex-http-client = { workspace = true }
|
|
codex-install-context = { workspace = true }
|
|
codex-network-proxy = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-plugin = { workspace = true }
|
|
codex-model-provider = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-response-debug-context = { workspace = true }
|
|
codex-prompts = { workspace = true }
|
|
codex-rollout = { workspace = true }
|
|
codex-rollout-trace = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-sandboxing = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-terminal-detection = { workspace = true }
|
|
codex-thread-store = { workspace = true }
|
|
codex-tools = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-cache = { workspace = true }
|
|
codex-utils-image = { workspace = true }
|
|
codex-utils-home-dir = { workspace = true }
|
|
codex-utils-output-truncation = { workspace = true }
|
|
codex-utils-path = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
codex-utils-plugins = { workspace = true }
|
|
codex-utils-pty = { workspace = true }
|
|
codex-utils-string = { workspace = true }
|
|
codex-utils-stream-parser = { workspace = true }
|
|
codex-windows-sandbox = { package = "codex-windows-sandbox", path = "../windows-sandbox-rs" }
|
|
csv = { workspace = true }
|
|
dirs = { workspace = true }
|
|
dunce = { workspace = true }
|
|
eventsource-stream = { workspace = true }
|
|
futures = { workspace = true }
|
|
http = { workspace = true }
|
|
iana-time-zone = { workspace = true }
|
|
image = { workspace = true, features = ["jpeg", "png", "webp"] }
|
|
indexmap = { workspace = true }
|
|
libc = { workspace = true }
|
|
once_cell = { workspace = true }
|
|
rand = { workspace = true }
|
|
regex-lite = { workspace = true }
|
|
reqwest = { workspace = true, features = ["json", "stream"] }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"base64",
|
|
"macros",
|
|
"schemars",
|
|
"server",
|
|
] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha1 = { workspace = true }
|
|
shlex = { workspace = true }
|
|
similar = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tokio-util = { workspace = true, features = ["rt"] }
|
|
tokio-tungstenite = { workspace = true }
|
|
toml = { workspace = true }
|
|
toml_edit = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
url = { workspace = true }
|
|
uuid = { workspace = true, features = ["serde", "v4", "v5"] }
|
|
which = { workspace = true }
|
|
whoami = { workspace = true }
|
|
|
|
# Build OpenSSL from source for musl builds.
|
|
[target.x86_64-unknown-linux-musl.dependencies]
|
|
openssl-sys = { workspace = true, features = ["vendored"] }
|
|
|
|
# Build OpenSSL from source for musl builds.
|
|
[target.aarch64-unknown-linux-musl.dependencies]
|
|
openssl-sys = { workspace = true, features = ["vendored"] }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
codex-shell-escalation = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
assert_cmd = { workspace = true }
|
|
assert_matches = { workspace = true }
|
|
codex-image-generation-extension = { workspace = true }
|
|
codex-home = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-test-binary-support = { workspace = true }
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
codex-web-search-extension = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
ctor = { workspace = true }
|
|
insta = { workspace = true }
|
|
maplit = { workspace = true }
|
|
opentelemetry = { workspace = true }
|
|
predicates = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
test-case = "3.3.1"
|
|
opentelemetry_sdk = { workspace = true, features = [
|
|
"experimental_metrics_custom_reader",
|
|
"metrics",
|
|
] }
|
|
serial_test = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
test-log = { workspace = true }
|
|
tracing-opentelemetry = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
tracing-test = { workspace = true, features = ["no-env-filter"] }
|
|
walkdir = { workspace = true }
|
|
wiremock = { workspace = true }
|
|
zstd = { workspace = true }
|
|
|
|
[package.metadata.cargo-shear]
|
|
ignored = ["openssl-sys"]
|
|
ignored-paths = ["tests/remote_env_windows/*.rs"]
|