mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
canvrno-oai
5f129a4703
## Summary Stacked on #26707. Adds the Windows implementation of the shared system-proxy contract. This allows Codex-owned auth clients to use the route Windows selects for each auth URL, including explicit PAC configuration, WPAD auto-detection, static proxies, and bypass rules. The `respect_system_proxy` feature is disabled by default, so existing client behavior remains unchanged unless explicitly enabled. ## Implementation - Adds Windows-only `codex-client` dependencies: - `windows-sys` with `Win32_Foundation` and `Win32_Networking_WinHttp`; - `sha2` for redacted cache keys. - Dispatches system-proxy resolution to `outbound_proxy/windows.rs` on Windows. - Reads the current-user WinHTTP/IE proxy configuration via `WinHttpGetIEProxyConfigForCurrentUser`. - Resolves explicit PAC URLs first, then OS-enabled WPAD auto-detection, then static proxy and bypass settings. - Uses `WinHttpGetProxyForUrl` for PAC/WPAD and maps results into the shared `SystemProxyDecision::{Direct, Proxy, Unavailable}` contract. - Parses `DIRECT`, `PROXY`, `HTTPS`, and keyed static proxy entries. - Treats unsupported schemes such as SOCKS as unavailable so the shared resolver can apply its environment-proxy fallback. - Handles Windows bypass entries, including `<local>` and host, suffix, wildcard, and port matching. - Releases WinHTTP-owned strings with `GlobalFree` and closes sessions with `WinHttpCloseHandle`. - Hashes URL-specific cache keys with SHA-256 so PAC decisions remain URL-specific without retaining raw request URLs or query strings. ## End-user behavior - Disabled/default: existing client behavior is unchanged. - Enabled with `[features.respect_system_proxy]`: - Windows auth clients honor explicit PAC configuration, OS-enabled WPAD, static proxies, and bypass rules; - valid OS/PAC `DIRECT` decisions use a direct connection; - unavailable system resolution falls back to explicit environment proxy variables, then `DIRECT`, through the shared contract from #26707. - Unsupported proxy schemes are not silently translated into a different route. - Custom CA handling remains separate from proxy selection. ## Tests Adds coverage for: - PAC-style proxy tokens such as `PROXY proxy.internal:8080` and `HTTPS proxy.internal:8443`; - static WinHTTP proxy entries keyed by target scheme; - `DIRECT` and unsupported proxy-token behavior; - Windows bypass matching, including `<local>`, wildcard, suffix, and port-qualified entries; - preserving URL-specific PAC cache decisions without retaining the raw URL on Windows.
47 lines
1.3 KiB
TOML
47 lines
1.3 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-client"
|
|
version.workspace = true
|
|
|
|
[dependencies]
|
|
bytes = { workspace = true }
|
|
eventsource-stream = { workspace = true }
|
|
futures = { workspace = true }
|
|
http = { workspace = true }
|
|
opentelemetry = { workspace = true }
|
|
rand = { workspace = true }
|
|
reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots", "stream"] }
|
|
rustls = { workspace = true }
|
|
rustls-native-certs = { workspace = true }
|
|
rustls-pki-types = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt", "time", "sync"] }
|
|
tracing = { workspace = true }
|
|
tracing-opentelemetry = { workspace = true }
|
|
codex-utils-rustls-provider = { workspace = true }
|
|
zstd = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
sha2 = { workspace = true }
|
|
windows-sys = { version = "0.52", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Networking_WinHttp",
|
|
] }
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dev-dependencies]
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
opentelemetry_sdk = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
|
|
[lib]
|
|
doctest = false
|