Celia Chen

Route exec-server WebSockets through configured proxies (#35056) ## Why Remote environment connections need to honor Codex's effective outbound proxy policy, including when a rendezvous connection reconnects. ## What changed - Pass the configured `HttpClientFactory` into remote environment transports and use `WebSocketConnector` for exec-server and rendezvous WebSockets. - Resolve proxy routes asynchronously so these connections can use the configured system proxy. - Add connector options that preserve Tungstenite's default TLS behavior and enable `TCP_NODELAY` for latency-sensitive rendezvous traffic. ## Testing - Verify prepared remote environments connect through a configured system proxy. - Verify initial and reconnected encrypted relay peers use the system proxy. - Cover default TLS selection and opt-in `TCP_NODELAY` behavior in the WebSocket client. GitOrigin-RevId: 8a8da2116e37cb3a891269d0c0b037986fecdd3c

Add rustls fallback for local MCP HTTP requests (#38436) ## Why Local MCP requests can fail when the platform TLS backend cannot negotiate a protocol version with an HTTPS endpoint. ## What changed - Retry replayable local MCP requests once with rustls after a recognized TLS protocol-version negotiation failure. Keep certificate, timeout, and unrelated connection failures on the existing error path. - Remember successful fallback per HTTPS origin and outbound route, while keeping the platform TLS backend as the default for other destinations. - Share the fallback-enabled client across local MCP resolution, CLI login, and OAuth discovery while preserving remote environment HTTP clients. ## Testing Added coverage for platform-specific error detection, request replay, cached fallback reuse and isolation, non-replayable requests, redirects, and remote MCP client selection. GitOrigin-RevId: 39a2d96fdb2ea0e51df14f652ba2a953d24e69a1

Route MCP OAuth through configured HTTP clients (#35806) ## What changed - Pass resolved, route-aware HTTP clients through MCP OAuth discovery and login so CLI commands, plugin installation, and skill dependency setup honor configured proxies and execution environments. - Apply per-plugin MCP server configuration and requirements before starting OAuth during installation, and skip disabled servers or servers assigned to unowned environments. - Preserve configured MCP server policies when merging remotely installed plugin metadata. ## Testing - Cover proxy-routed OAuth for `codex mcp add`, `codex mcp login`, plugin installation, and skill MCP dependencies. - Cover plugin-install OAuth filtering for disabled servers, plugin requirements, and unowned environments. GitOrigin-RevId: f84c88820e24a627faa78d6bed1b371682ecdc2f

feat: use encrypted local secrets for CLI auth (#27539) ## Why Windows Credential Manager limits generic credential blobs to 2,560 bytes. Large serialized ChatGPT auth payloads can exceed that limit, so keyring-mode CLI auth needs a backend that keeps only the encryption key in the OS keyring and stores the payload in Codex's encrypted local-secrets file. This is the third PR in the encrypted-auth stack: 1. #27504 — feature and config selection 2. #27535 — auth-specific local-secrets namespaces 3. This PR — CLI auth implementation and activation 4. MCP OAuth implementation and activation ## What Changed - Added encrypted CLI-auth storage using the `CliAuth` secrets namespace. - Preserved direct keyring storage for platforms/configurations where it remains selected. - Selected the backend consistently for login, logout, refresh, device-code login, auth loading, and login restrictions. - Threaded resolved bootstrap/full config through CLI, exec, TUI, app-server account handling, cloud config, and cloud tasks. - Removed stale `auth.json` fallback data after successful encrypted saves and removed encrypted, direct-keyring, and fallback data during logout. - Added storage and integration coverage for both direct and encrypted keyring modes. MCP OAuth persistence is intentionally left to the next PR. ## Validation - `just test -p codex-login` — 131 passed - `just test -p codex-cli` — 280 passed - `just test -p codex-app-server v2::account` — 25 passed - `just test -p codex-cloud-config service` — 21 passed, 7 skipped - `just fix -p codex-login` - `just fix -p codex-cli` - `just fmt`

Initialize execution environments with the final HTTP policy (#34995) ## Why The TUI must inspect the default execution environment before loading its final configuration. Initializing the environment manager at that point can give startup services the bootstrap HTTP policy instead of the effective policy after managed requirements are applied. ## What changed - Split environment discovery from manager construction so callers can inspect the default environment without starting remote connections. - Build the environment manager after final configuration loading and pass its resolved `HttpClientFactory` through all construction paths. - Add shared test support for managers that use the legacy default HTTP policy. ## Testing - Cover connection-free environment discovery and explicit HTTP policy propagation. - Verify TUI startup services use the final managed `respect_system_proxy` value. GitOrigin-RevId: 928fa31e6b4bcfbe1a121cade2f351427fdfa0f4

feat: use encrypted local secrets for MCP OAuth (#27541) ## Summary - store MCP OAuth credentials in the configured auth credential backend - support encrypted-local OAuth storage, including legacy keyring migration - propagate the credential backend through MCP refresh, session, CLI, and app-server paths ## Stack 1. #27504 — config and feature flag 2. #27535 — auth-specific secret namespaces 3. #27539 — encrypted CLI auth storage 4. this PR — encrypted MCP OAuth storage This is a parallel review stack; the original #17931 remains unchanged. ## Tests - `just test -p codex-rmcp-client` (the transport round-trip test passed after building the required `codex` binary and retrying) - `just test -p codex-mcp` - `just test -p codex-app-server refresh_config_uses_latest_auth_keyring_backend` - `just test -p codex-core refresh_mcp_servers_is_deferred_until_next_turn` - `just test -p codex-cli mcp` - `just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli -p codex-app-server -p codex-protocol` - `just bazel-lock-check`

Route exec-server HTTP through configured proxy policy (#35023) ## Why Delegated HTTP requests need to honor the same outbound proxy policy as the Codex process that starts the exec server. ## What changed - Pass the configured `HttpClientFactory` through local and remote exec-server startup and use route-aware client pools for delegated HTTP and local MCP requests. - Preserve per-request timeouts and follow-or-stop redirect behavior while keeping request URLs and sensitive response headers out of diagnostics. ## Testing - Cover configured system-proxy routing across the exec-server transport. - Cover both redirect policies and verify that success and failure logs do not expose request or response secrets. GitOrigin-RevId: 4af6aec1d265c4db62dfcb6e1fb076fb31736137

Enable cached web search for Amazon Bedrock (#36938) ## Why Amazon Bedrock supports hosted text web search, but it rejects the `search_content_types` field used for multimodal search and does not support external live or indexed web access. ## What changed - Advertise hosted web search for Amazon Bedrock while marking external web access as unsupported. - Resolve unsupported live and indexed modes to cached search, or disable the tool when cached search is prohibited by managed requirements. - Normalize built-in and configured Bedrock model catalogs to text-only web search, and retain the runtime provider in session configuration so turn setup can apply its capabilities. ## Testing - Cover cached fallback, managed-mode restrictions, text-only tool payloads, provider capabilities, and catalog normalization. GitOrigin-RevId: 310473849257401654388a4ebb42920e03aa3228

Add an Amazon Bedrock Runtime provider (#38470) ## What changed - Add the built-in `amazon-bedrock-runtime` provider for regional `bedrock-runtime` OpenAI-compatible endpoints. - Use endpoint-specific SigV4 service configuration while preserving bearer token auth and per-provider AWS profile, region, and transport overrides. - Provide global and US cross-region GPT-5.6 model variants, prefer global routing for fallback and background tasks, and disable unsupported web search. ## Testing - Cover provider configuration and capabilities, endpoint and auth selection, runtime catalog ordering, model fallback, and web search omission. GitOrigin-RevId: d158ab74a5768e1b4c61063365a0c06735313322

Use configured HTTP clients for all MCP OAuth requests (#35814) ## What changed - Require callers to provide an HTTP client for MCP OAuth discovery and login, removing the separate direct `reqwest` path. - Use the shared `http` and `url` types throughout the MCP client and drop its direct `reqwest` dependency. - Preserve configured MCP headers when routing OAuth discovery through the provided client. ## Testing - Add coverage that routed OAuth discovery forwards configured headers. GitOrigin-RevId: 1345f56bd794626533133447597a5908e57b9b48