fix(responses): honor outbound proxy routing for upstream WebSocket

[lidge-jun]

Summary

Upstream Codex WebSockets previously dialed without the configured outbound proxy. Carry #3679 so both one-shot and retained sessions resolve HTTPS_PROXY/ALL_PROXY and NO_PROXY before dialing, fall back before dispatch for unsupported proxy routes, and replace a pooled session when its proxy route changes. Reuse the existing NO_PROXY matcher for provider discovery.

Original contributor commit and author preserved. The config.ts edit clarifies precedence in a comment; it does not change config persistence.

Stack (merge bottom-up):

Layer	PR	Review focus
0 — foundation	#3696	Deterministic Windows shutdown verification
1	#3683	SSE failure termination
2 — this PR	carries #3679	WS route selection and pool identity
3 — planned	source #3568	Native MESSAGE recovery
4 — planned	source #3581	Command Code affinity
5 — planned	source #3671	Effective policy capabilities

Depends on #3683. Review this layer's diff only.

Verification

• Independent plan review passed at original head b05cccf; all three original review findings are resolved there.
• git diff --check passed; original source author and -x provenance retained.
• No local suite, typecheck or build executed, per maintainer instruction.
• Project-pinned Bun 1.4.0, exact carried head 10fbda2e031230d57873b5afb828324c18ae090f: combined SSE/WS focused checks 186 pass, 2 expected skips (older-runtime branch and Windows-only probe), 0 fail; typecheck passed.
• Removing constructor proxy propagation and removing proxy from reuse identity each makes its targeted regression fail; candidate restored after both controls.
• Independent explicit static security review passed, including pinned Bun 1.4.0 CONNECT credential separation.
• Remote documentation build passed: 425 pages.
• Full CI including Windows was superseded before completion: https://github.com/lidge-jun/opencodex/actions/runs/33978680373 ; PR remains draft.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: Clive Rosfield 64878945+S0RYUASUKA@users.noreply.github.com

Verification update: the additional manual full-CI run on this pre-repair head was cancelled after existing Windows shutdown-spill fixture defects were identified. Normal PR verification and captured logs are retained. A separate deterministic fixture repair will be inserted beneath the stack; required CI will be rerun on refreshed heads before admin merge. No passing full-Windows claim is made.

Current stack verification: head e132781fbe4c572b76d68efd69adc2b85209174e, base codex/a-01-sse. Foundation #3696 is included; all five layer diffs are byte-identical to their independently reviewed pre-foundation diffs, and original contributor commits remain ancestors. Prior focused results above are pre-restack evidence. Current-head full CI: https://github.com/lidge-jun/opencodex/actions/runs/33981581047 . Required completion is pending; admin merge remains bottom-up.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 71 / 80

이 PR은 Codex upstream WebSocket이 설정된 outbound 프록시를 무시하고 직접 dial하던 구멍을 막습니다. 지금 HEAD의 src/server/responses/codex-ws-session.ts는 new WebSocket(url, {{ headers }})만 쓰고, ws-upstream.ts의 codexWsUpstreamFetch도 프록시 라우트를 고르지 않습니다. HTTP fetch 쪽은 이미 env 미러를 쓰지만, WSS는 빠져 있었습니다. 이 변경은 resolveProxyRoute를 src/lib/proxy-env.ts에 두고(NO_PROXY → HTTPS_PROXY/https_proxy/ALL_PROXY), 지원하지 않는 프록시는 WS 시도 없이 기존 SSE fallback으로 보내며, 풀 재사용 identity에 proxy 문자열을 넣어 경로가 바뀌면 세션을 교체합니다. noProxyMatches / hostname 정규화는 provider-outbound.ts에서 공유 모듈로 옮깁니다. config.ts 주석은 우선순위만 명확히 하고 persistence는 안 바꿉니다.

베이스는 codex/a-01-sse(#3683)입니다. A 스택 2/5이고 원본 #3679 carry입니다. 부모 SSE 레이어가 먼저 들어가야 합니다. 테스트는 프록시 변경·NO_PROXY로 풀 폐기, unsupported proxy의 SSE fallback, env 격리 before/after가 있습니다. 보안 리뷰에서 Bun CONNECT 자격 증명 분리를 봤다고 본문에 적혀 있습니다. draft·CI 진행 중입니다.

기업망·강제 프록시 환경에서 Codex WSS만 빠져나가면, HTTP는 프록시를 타는데 WS만 직행하는 보안/연결 불일치가 납니다. identity에 proxy를 넣은 것도 중요합니다. 안 넣으면 프록시가 바뀐 뒤에도 풀이 옛 egress를 재사용합니다. A 레인 2층으로서 부모 SSE hang 수정 위에 올려야 원인 분리가 됩니다.

경로/심볼 resolveProxyRoute - WSS는 HTTPS_PROXY 계열(+ALL_PROXY). HTTP_PROXY만으로는 WSS를 안 태웁니다. structure 문서와 같은 계약입니다.

경로 CodexWsSession proxy 옵션 - WebSocket 생성에 proxy를 실어 dial합니다. 풀 acquire도 같은 proxy를 받습니다.

경로 codexWsReuseIdentity(..., proxy) - 헤더·모델이 같아도 프록시가 다르면 다른 identity. 잘못된 egress 재사용을 막습니다.

경로 provider-outbound.ts - NO_PROXY 헬퍼를 proxy-env로 옮기고 import합니다. fetch 경로와 WS 경로가 같은 matcher를 씁니다.

경로 의존 #3683 - 아직 draft. 이 PR만 머지할 수 없습니다. bottom-up을 지키세요.

경로 원본 #3679 - OPEN. 안착 후 landed로 닫으세요.

메인테이너의 판단이 필요한 지점

• ALL_PROXY를 WSS에만 쓰고 fetch에는 안 쓰는 비대칭을 문서/운영에 어떻게 안내할지
• fallback(SSE)이 프록시 미지원일 때 충분한지, 에러로 실패 종료할지
• #3683 CI와 이 PR CI를 한 열차로 묶을지

너의 추천
#3683 머지 후 이 레이어 CI 초록이면 머지하세요. 프록시 환경 사용자에게 체감이 큽니다. 머지 후 #3679를 닫고 A 스택 3층(MESSAGE recovery)으로 가면 됩니다.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Owner-authorized admin merge of #3686, carrying #3679 with original contributor commits and attribution preserved.

Exact head: e132781. All functional producers in full cross-platform run https://github.com/lidge-jun/opencodex/actions/runs/33981581047 succeeded, including all Linux/macOS/Windows suite jobs, unsharded macOS control, type/privacy gates and platform smokes. Any remaining queued ci aggregation is evaluated directly by its success/skipped allowlist; no unexecuted tests or failures are bypassed.

Independent implementation/security review passed. Foundation restacking preserved the complete layer diff byte-for-byte and retained original contributor commits. Child retargeting precedes auto-deletion. Final dev inclusion will be checked immediately after merge.

Co-authored-by: Clive Rosfield 64878945+S0RYUASUKA@users.noreply.github.com

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:35:21.493558Z	e132781	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.