Extract shared HTTP transport into codex-http-client

[bolinfest]

Why

Codex-owned HTTP construction currently lives in codex-client alongside higher-level retry, SSE, and request-telemetry policy. That makes it difficult to apply shared network behavior consistently across crates, particularly system proxy/PAC resolution, custom CA handling, and the ChatGPT Cloudflare cookie policy. It also leaves no clear crate boundary for migrating direct reqwest usage behind a single Codex abstraction.

This change establishes that low-level ownership boundary without changing request behavior. It builds on the system proxy support introduced in #26706, #26707, #26708, and #26709.

What changed

• Added codex-rs/http-client as the codex-http-client crate.
• Moved request/response types, the concrete reqwest transport, custom CA handling, Cloudflare cookie policy, and macOS/Windows proxy resolution into the new crate.
• Kept retry, SSE, and request-telemetry policy in codex-client.
• Re-exported the moved API from codex-client, including compatibility aliases for CodexHttpClient and CodexRequestBuilder, so existing consumers do not change in this PR.
• Moved the existing proxy and custom-CA tests with their implementation.

Scope boundary

This PR deliberately stops at the crate extraction. Stacked follow-up #31331 migrates downstream imports from codex-client to codex-http-client, keeping this change focused on ownership and compatibility rather than mixing in repository-wide call-site churn.

Review guide

GitHub reports 30 changed files, of which 17 are detected renames. A useful review order is:

1. Review the new boundary in codex-rs/http-client/Cargo.toml and codex-rs/http-client/src/lib.rs.
2. Review codex-rs/codex-client/Cargo.toml and codex-rs/codex-client/src/lib.rs for what remains in the higher-level crate and how compatibility is preserved.
3. Treat the renamed implementation and test files as moves. Their meaningful edits are limited to crate paths and normalizing the new crate's type names to HttpClient and RequestBuilder.
4. Review codex-rs/Cargo.toml, codex-rs/Cargo.lock, and the two BUILD.bazel files as mechanical workspace integration.

Test plan

• just test -p codex-http-client -p codex-client (38 tests)
• Compile-checked the unchanged codex-api, codex-backend-client, codex-cloud-tasks, codex-exec-server, codex-login, and codex-model-provider consumers against the compatibility re-exports.

---

Stack created with Sapling. Best reviewed with ReviewStack.

• Migrate direct HTTP consumers to codex-http-client #31331
• -> Extract shared HTTP transport into codex-http-client #31323

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e1c44cd34e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".