1 00:00:00,360 --> 00:00:04,740 Your terminal probably has a proxy set, but your Dock launched apps don't, 2 00:00:05,260 --> 00:00:08,420 and that gap is behind a lot of weird Codex hangs. 3 00:00:09,380 --> 00:00:12,560 Quick thanks to Jellypod AI for sponsoring this episode. 4 00:00:13,560 --> 00:00:20,360 Now, the Codex CLI 0.167.0 change that fixes the gap, and the traps that come with 5 00:00:20,400 --> 00:00:20,560 it. 6 00:00:21,215 --> 00:00:22,055 Here's what changed. 7 00:00:22,335 --> 00:00:28,675 Pull request 58157 exposes system proxy support as an experimental setting. 8 00:00:29,875 --> 00:00:34,375 On macOS and Windows, Codex can now follow the operating system's proxy 9 00:00:34,415 --> 00:00:37,435 configuration, not just shell environment variables. 10 00:00:38,415 --> 00:00:42,335 We touched on this briefly in an earlier episode, when it showed up in experimental. 11 00:00:42,755 --> 00:00:44,795 Today is the transport underneath it. 12 00:00:45,403 --> 00:00:50,723 Inside the codex-http-client crate, there's an outbound proxy policy with two modes. 13 00:00:51,163 --> 00:00:53,823 The old one is called ReqwestDefault. 14 00:00:54,283 --> 00:00:59,943 That's the legacy behavior, and in practice it means HTTP_PROXY and HTTPS_PROXY from 15 00:00:59,983 --> 00:01:00,623 the environment. 16 00:01:01,363 --> 00:01:03,963 The new one is RespectSystemProxy. 17 00:01:04,643 --> 00:01:08,323 In that mode, Codex resolves the route for the complete request URL. 18 00:01:08,883 --> 00:01:12,643 Platform system settings and PAC or WPAD scripts come first. 19 00:01:13,203 --> 00:01:15,323 Then explicit proxy environment variables. 20 00:01:15,723 --> 00:01:16,783 Then a direct connection. 21 00:01:17,690 --> 00:01:18,490 Why does this matter? 22 00:01:19,010 --> 00:01:21,350 Because GUI launches don't inherit your shell. 23 00:01:22,050 --> 00:01:26,970 Launch from the Dock, the Start menu, or a desktop app, and the app server process 24 00:01:27,030 --> 00:01:29,570 never sees the variables you exported in your terminal. 25 00:01:31,470 --> 00:01:35,330 A GitHub issue, number 39237, shows the cost. 26 00:01:35,970 --> 00:01:42,190 A user on macOS, with a local proxy listening on 127.0.0.1 port 27 00:01:42,430 --> 00:01:47,350 7897, saw Codex connect directly to hosts the proxy rules didn't cover. 28 00:01:48,010 --> 00:01:52,410 Connections sat in SYN_SENT, and new sessions took around two minutes, 29 00:01:52,710 --> 00:01:54,090 retrying about five times. 30 00:01:54,870 --> 00:02:00,710 The workaround was launchctl setenv, which injects proxy variables for every GUI app 31 00:02:00,750 --> 00:02:01,410 on the machine. 32 00:02:02,710 --> 00:02:03,390 Blunt instrument. 33 00:02:04,050 --> 00:02:06,610 There's another detail in the crate README that's worth knowing. 34 00:02:07,170 --> 00:02:11,050 Proxy choice can depend on the full URL, not only the origin. 35 00:02:11,590 --> 00:02:16,970 So Codex uses a route aware client pool, which caches up to 16 transport clients by 36 00:02:16,990 --> 00:02:17,750 resolved route. 37 00:02:18,450 --> 00:02:22,070 And redirects get handled by the pool itself, resolving every hop, 38 00:02:22,570 --> 00:02:25,790 so a redirect target can't quietly skip your proxy rules. 39 00:02:26,330 --> 00:02:28,810 It also strips sensitive headers when the origin changes. 40 00:02:29,528 --> 00:02:30,388 How do you turn it on? 41 00:02:30,868 --> 00:02:31,488 Two ways. 42 00:02:32,108 --> 00:02:36,988 Open the TUI, run slash experimental, and toggle System proxy. 43 00:02:37,628 --> 00:02:43,128 Or put this in your config dot toml under home dot codex: a features table, 44 00:02:43,468 --> 00:02:47,108 with respect underscore system underscore proxy equals true. 45 00:02:47,808 --> 00:02:52,448 Then you can check with codex doctor, or codex doctor with the network only flag, 46 00:02:52,568 --> 00:02:53,568 to confirm it's active. 47 00:02:54,300 --> 00:02:55,240 Now the traps. 48 00:02:55,840 --> 00:02:56,740 First, naming. 49 00:02:57,260 --> 00:02:58,380 The key is singular. 50 00:02:58,780 --> 00:03:01,660 respect underscore system underscore proxy. 51 00:03:02,180 --> 00:03:06,300 The features table is a free form map of keys to booleans, so if you type the 52 00:03:06,360 --> 00:03:11,260 plural, respect system proxies, it parses without error and does nothing. 53 00:03:11,980 --> 00:03:13,700 Codex stays on ReqwestDefault. 54 00:03:14,520 --> 00:03:17,860 That exact mistake is what happened in issue 39237. 55 00:03:18,520 --> 00:03:23,340 The reporter saw timeouts over 120 seconds, and a commenter spotted the plural key. 56 00:03:24,000 --> 00:03:27,840 After switching to singular, the same test exited cleanly in about eleven seconds, 57 00:03:28,200 --> 00:03:30,260 with connections established to the local proxy. 58 00:03:30,987 --> 00:03:32,687 Second, the process boundary. 59 00:03:33,027 --> 00:03:37,487 This only governs Codex's own Rust HTTP and WebSocket client. 60 00:03:38,197 --> 00:03:42,977 If the model runs a bare curl in your terminal, curl doesn't read the macOS system 61 00:03:43,057 --> 00:03:43,477 proxy. 62 00:03:43,937 --> 00:03:46,677 It needs a dash x flag or environment variables. 63 00:03:47,237 --> 00:03:51,217 So a curl timing out inside a session doesn't mean the feature is broken. 64 00:03:51,902 --> 00:03:53,182 Third, loopback. 65 00:03:53,842 --> 00:03:59,262 Issue 56919, still open as of the source, reports that on macOS, 66 00:03:59,482 --> 00:04:06,162 with a custom provider on 127.0.0.1, requests went through the system proxy anyway 67 00:04:06,822 --> 00:04:08,782 and came back 502 Bad Gateway. 68 00:04:09,582 --> 00:04:14,662 The reporter suspects, and flags as unverified, that the exceptions list isn't 69 00:04:14,702 --> 00:04:15,202 consulted. 70 00:04:16,062 --> 00:04:22,642 Their workaround: set NO_PROXY to 127.0.0.1, localhost, and 71 00:04:22,882 --> 00:04:26,062 ::1 in whatever environment launches Codex. 72 00:04:26,822 --> 00:04:28,742 If you run local models, do that. 73 00:04:29,383 --> 00:04:32,363 A few smaller things in 0.167.0. 74 00:04:32,763 --> 00:04:37,583 Ctrl+L now clears the display but keeps earlier messages reachable through Ctrl+T. 75 00:04:38,783 --> 00:04:42,423 Deleting text that exposes a leading bang keeps your draft in chat mode, 76 00:04:42,623 --> 00:04:44,683 so it won't be treated as a raw shell command. 77 00:04:45,322 --> 00:04:48,783 And on terminals with Kitty graphics, you get local image thumbnails while 78 00:04:48,803 --> 00:04:51,543 composing, plus clickable image paths in the transcript. 79 00:04:52,297 --> 00:04:56,277 So, the takeaway: if Codex hangs only when launched from a GUI, 80 00:04:56,857 --> 00:05:03,477 enable the singular key, run codex doctor, and keep NO_PROXY handy for localhost.