mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00

Files

T

canvrno-oai b16d2858f5 PAC 4 - Add macOS system proxy resolver (#26709 )

## Summary

Stacked on #26708.

Adds the macOS implementation of the shared system-proxy contract. This
allows Codex-owned auth clients to use the route macOS selects for each
auth URL through SystemConfiguration and CFNetwork, including PAC and
WPAD results.

The `respect_system_proxy` feature is disabled by default, so existing
client behavior remains unchanged unless explicitly enabled.

## Implementation

- Adds the macOS-only `system-configuration` dependency to
`codex-client`.
- Dispatches system-proxy resolution to `outbound_proxy/macos.rs` on
macOS.
- Reads system proxy settings from `SCDynamicStore` and resolves the
target URL with `CFNetworkCopyProxiesForURL`.
- Executes PAC URLs and inline PAC JavaScript through a bounded run loop
with a five-second timeout.
- Handles `DIRECT`, HTTP proxies, and CFNetwork HTTPS entries using HTTP
CONNECT; unsupported SOCKS entries map to `UnsupportedProxyScheme`.
- Builds concrete proxy URLs from host and port entries, including IPv6
host bracketing.
- Maps results into the shared `SystemProxyDecision::{Direct, Proxy,
Unavailable}` contract.
- Hashes URL-specific cache keys so PAC decisions remain distinct
without retaining raw request URLs or query strings.

## End-user behavior

- Disabled/default: existing client behavior is unchanged.
- Enabled with `[features.respect_system_proxy]`:
  - macOS auth clients honor system proxy configuration, PAC, and WPAD;
  - valid OS/PAC `DIRECT` decisions use a direct connection;
- unavailable system resolution falls back to explicit environment proxy
variables, then `DIRECT`, through the shared contract from #26707.
- Unsupported proxy schemes are not silently translated into another
route.
- Custom CA handling remains separate from proxy selection.
- Known limitation: only the first supported system/PAC candidate is
used. Subsequent proxy or `DIRECT` candidates are not attempted after a
connection failure. This matches the current Windows behavior and leaves
room for future ordered-fallback support.

## Tests

- `just test -p codex-client` — 34 tests passed.
- `just clippy -p codex-client`
- `just fmt`
- `just bazel-lock-check`

b16d2858f5 · 2026-06-22 17:56:04 -07:00

History

src

PAC 4 - Add macOS system proxy resolver (#26709 )

2026-06-22 17:56:04 -07:00

tests

[codex] Use expect in integration tests (#28441 )

2026-06-15 21:53:47 -07:00

BUILD.bazel

build: run buildifier from just fmt (#28125 )

2026-06-13 21:43:39 -07:00

Cargo.toml

PAC 4 - Add macOS system proxy resolver (#26709 )

2026-06-22 17:56:04 -07:00

README.md

chore: proper client extraction (#6996 )

2025-11-25 18:06:12 +00:00

README.md

codex-client

Generic transport layer that wraps HTTP requests, retries, and streaming primitives without any Codex/OpenAI awareness.

Defines HttpTransport and a default ReqwestTransport plus thin Request/Response types.
Provides retry utilities (RetryPolicy, RetryOn, run_with_retry, backoff) that callers plug into for unary and streaming calls.
Supplies the sse_stream helper to turn byte streams into raw SSE data: frames with idle timeouts and surfaced stream errors.
Consumed by higher-level crates like codex-api; it stays neutral on endpoints, headers, or API-specific error shapes.