fix(codex): honor env proxies for WebSockets

CHANGELOG.md

@@ -5,6 +5,10 @@ description: Release notes for claude-code-proxy.
 
 ## Unreleased
 
+- Codex WebSocket connections honor `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`,
+  and `NO_PROXY`, restoring standard non-TUN HTTP proxy support for both plain
+  WebSocket Upgrade requests and WSS CONNECT tunnels.
+
 ## v0.1.26 (2026-07-28)
 
 - Standard OpenAI clients can use Codex through the optional

Cargo.toml

@@ -26,14 +26,19 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }
 uuid = { version = "1", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["formatting", "parsing"] }
-reqwest = { version = "0.12", default-features = false, features = ["json", "stream", "rustls-tls", "blocking", "http2"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "stream", "rustls-tls", "blocking", "http2", "socks"] }
 base64 = "0.22"
 rand = "0.8"
 sha2 = "0.10"
 hostname = "0.4"
 once_cell = "1.20"
 regex-lite = "0.1"
 tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect", "rustls-tls-native-roots"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+rustls-native-certs = "0.8"
+webpki-roots = "1"
+hyper-util = { version = "0.1", features = ["client-proxy"] }
 url = "2"
 prost = "0.13"
 flate2 = "1.0"

docs/src/content/docs/providers/codex.md

@@ -45,6 +45,8 @@ Claude Code summary compaction requests are capped at low effort by default beca
 
 WebSocket is the default transport. Set `CCP_CODEX_TRANSPORT=http` for HTTP SSE, or `auto` to use WebSocket with HTTP fallback only when setup fails before a request is sent.
 
+WebSocket setup honors `HTTP_PROXY` for `ws://`, `HTTPS_PROXY` for the default `wss://` endpoint, `ALL_PROXY` as a fallback, and `NO_PROXY` exclusions. A normal HTTP proxy can therefore carry the default WebSocket connection with CONNECT; TUN mode is not required. Set proxy variables before starting the process and restart after changing them. For example, setting `HTTPS_PROXY` to `http://127.0.0.1:7890` sends HTTPS/WSS destinations through the HTTP proxy at port 7890; it does not require an `https://` proxy URL.
+
 `CCP_CODEX_PREVIOUS_RESPONSE_ID=1` enables append-only WebSocket continuation. It reuses a session connection and sends `previous_response_id` only when the translated request shape and transcript extension are safe. State is in memory, keyed by Claude Code session ID.
 
 ## Server compaction

docs/src/content/docs/reference/configuration.md

@@ -69,6 +69,28 @@ All keys are optional. An unreadable file, malformed JSON, or incompatible field
 
 Codex auto-review classifier requests use `gpt-5.6-luna` by default. Requests routed through other providers retain their requested model. `CCP_AUTO_REVIEW_MODEL` or `autoReviewModel` selects an explicit registered model for all detected classifier requests without changing the session's provider affinity. Normal messages, streaming requests, tool-using requests, and token counting retain their requested model.
 
+## Outbound proxies
+
+Outbound HTTP requests and Codex WebSocket setup inherit standard proxy environment variables when each provider client is created:
+
+| Environment | Applies to | Purpose |
+| --- | --- | --- |
+| `HTTP_PROXY` / `http_proxy` | `http://` and `ws://` destinations | Routes plain HTTP and WebSocket Upgrade requests through the configured proxy. |
+| `HTTPS_PROXY` / `https_proxy` | `https://` and `wss://` destinations | Routes TLS destinations through the configured proxy, normally with HTTP CONNECT. |
+| `ALL_PROXY` / `all_proxy` | Any destination without a scheme-specific proxy | Provides the fallback proxy. |
+| `NO_PROXY` / `no_proxy` | Matching destination hosts and IPs | Bypasses proxy routing. Supports comma-separated domains, subdomains, IP addresses, CIDR ranges, and `*`. |
+
+On case-sensitive platforms, uppercase names are checked before lowercase names when both spellings exist. Windows treats environment names as case-insensitive, so each uppercase/lowercase pair identifies one variable. Set these variables before starting claude-code-proxy; changing them requires a restart because clients and pooled WebSocket connections retain their startup route. For CGI safety, proxy environment variables are ignored when `REQUEST_METHOD` is present. The variable name describes the **destination** scheme, so this default-WSS configuration is valid even though the local proxy URL uses `http://`:
+
+| Variable | Value |
+| --- | --- |
+| `HTTP_PROXY` | `http://127.0.0.1:7890` |
+| `HTTPS_PROXY` | `http://127.0.0.1:7890` |
+
+After setting both variables through the operating system, service manager, or shell, start `claude-code-proxy serve` in the same environment.
+
+Proxy URLs may use `http`, `https`, `socks4`, `socks4a`, `socks5`, or `socks5h`. HTTP proxy URLs can contain percent-encoded Basic credentials, for example `http://user:[email protected]:7890`; SOCKS5 and SOCKS5H URLs can contain username/password credentials for the SOCKS handshake. SOCKS4 and SOCKS4A are supported without URL credentials. Prefer a secret-management mechanism when available because environment variables may be visible to other local processes. WSS certificate verification uses both bundled public roots and the platform native root store, including locally installed enterprise proxy CAs. Malformed or unsupported proxy URLs fail provider startup rather than being ignored. Proxy failures do not silently retry with a direct connection; only `NO_PROXY` selects direct routing. OS proxy settings, PAC files, and WPAD are not read automatically.
+
 ## Codex
 
 | Environment | Config key | Default | Purpose |

docs/src/content/docs/using/troubleshooting.md

@@ -51,6 +51,19 @@ Set `CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK=1` for Claude Code. Retrying a pa
 
 ## Codex WebSocket fails
 
+For a non-TUN local HTTP proxy, set both destination-scheme variables before starting the proxy:
+
+| Variable | Value |
+| --- | --- |
+| `HTTP_PROXY` | `http://127.0.0.1:7890` |
+| `HTTPS_PROXY` | `http://127.0.0.1:7890` |
+
+Set them through the operating system, service manager, or shell, then start `claude-code-proxy serve` in the same environment.
+
+The default `wss://chatgpt.com` connection uses `HTTPS_PROXY`; a working proxy should show `CONNECT chatgpt.com:443`. The `http://` value is normal: it describes how to reach the proxy, while `HTTPS_PROXY` describes which destinations use it. Restart claude-code-proxy after changing these variables because the client and pooled WebSocket route are created at startup.
+
+Check `NO_PROXY` when the proxy sees no request. Proxy connection, authentication, or CONNECT failure is returned as an error and never retried directly. Environment variables are supported; OS proxy settings and PAC/WPAD discovery are not automatic.
+
 Use HTTP SSE to isolate transport behavior:
 
 ```sh

src/logging.rs

@@ -11,8 +11,9 @@ pub const MAX_LOG_BYTES: u64 = 20 * 1024 * 1024;
 
 static STDERR_SUPPRESSION_DEPTH: AtomicUsize = AtomicUsize::new(0);
 
-pub const REDACT_KEYS: [&str; 14] = [
+pub const REDACT_KEYS: [&str; 15] = [
     "authorization",
+    "proxy-authorization",
     "access",
     "access_token",
     "refresh",
@@ -259,4 +260,15 @@ mod tests {
         drop(outer);
         assert!(should_mirror_to_stderr("warn"));
     }
+
+    #[test]
+    fn redacts_proxy_authorization_case_insensitively() {
+        let redacted = redact_value(serde_json::json!({
+            "Proxy-Authorization": "Basic dXNlcjpwYXNz",
+            "safe": "kept"
+        }));
+
+        assert_eq!(redacted["safe"], "kept");
+        assert_eq!(redacted["Proxy-Authorization"], "[redacted len=18]");
+    }
 }