Extract shared HTTP transport into codex-http-client

codex-rs/Cargo.toml

@@ -41,6 +41,7 @@ members = [
     "core-plugins",
     "core-skills",
     "hooks",
+    "http-client",
     "secrets",
     "exec",
     "file-system",
@@ -164,6 +165,7 @@ codex-cloud-tasks-mock-client = { path = "cloud-tasks-mock-client" }
 codex-code-mode = { path = "code-mode" }
 codex-code-mode-protocol = { path = "code-mode-protocol" }
 codex-home = { path = "codex-home" }
+codex-http-client = { path = "http-client" }
 codex-config = { path = "config" }
 codex-connectors = { path = "connectors" }
 codex-connectors-extension = { path = "ext/connectors" }

codex-rs/codex-client/BUILD.bazel

@@ -2,6 +2,5 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "codex-client",
-    compile_data = glob(["tests/fixtures/**"]),
     crate_name = "codex_client",
 )

codex-rs/codex-client/Cargo.toml

@@ -5,47 +5,16 @@ name = "codex-client"
 version.workspace = true
 
 [dependencies]
-bytes = { workspace = true }
+codex-http-client = { workspace = true }
 eventsource-stream = { workspace = true }
 futures = { workspace = true }
 http = { workspace = true }
-opentelemetry = { workspace = true }
 rand = { workspace = true }
-reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots", "stream"] }
-rustls = { workspace = true }
-rustls-native-certs = { workspace = true }
-rustls-pki-types = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-thiserror = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt", "time", "sync"] }
-tracing = { workspace = true }
-tracing-opentelemetry = { workspace = true }
-codex-utils-rustls-provider = { workspace = true }
-zstd = { workspace = true }
-
-[target.'cfg(any(target_os = "windows", target_os = "macos"))'.dependencies]
-sha2 = { workspace = true }
-
-[target.'cfg(target_os = "macos")'.dependencies]
-system-configuration = { workspace = true }
-
-[target.'cfg(target_os = "windows")'.dependencies]
-windows-sys = { version = "0.52", features = [
-    "Win32_Foundation",
-    "Win32_Networking_WinHttp",
-] }
 
 [lints]
 workspace = true
 
-[dev-dependencies]
-codex-utils-cargo-bin = { workspace = true }
-opentelemetry_sdk = { workspace = true }
-pretty_assertions = { workspace = true }
-rcgen = { workspace = true }
-tempfile = { workspace = true }
-tracing-subscriber = { workspace = true }
-
 [lib]
 doctest = false
+test = false

codex-rs/codex-client/README.md

@@ -1,8 +1,8 @@
 # codex-client
 
-Generic transport layer that wraps HTTP requests, retries, and streaming primitives without any Codex/OpenAI awareness.
+Higher-level request policy layered on `codex-http-client` without any Codex/OpenAI API awareness.
 
-- Defines `HttpTransport` and a default `ReqwestTransport` plus thin `Request`/`Response` types.
 - Provides retry utilities (`RetryPolicy`, `RetryOn`, `run_with_retry`, `backoff`) that callers plug into for unary and streaming calls.
 - Supplies the `sse_stream` helper to turn byte streams into raw SSE `data:` frames with idle timeouts and surfaced stream errors.
-- Consumed by higher-level crates like `codex-api`; it stays neutral on endpoints, headers, or API-specific error shapes.
+- Defines the request telemetry callback used by higher-level clients.
+- Re-exports the low-level HTTP types temporarily so consumers can migrate to `codex-http-client` incrementally.

codex-rs/codex-client/src/lib.rs

@@ -1,49 +1,13 @@
-mod chatgpt_cloudflare_cookies;
-mod chatgpt_hosts;
-mod custom_ca;
-mod default_client;
-mod error;
-mod outbound_proxy;
-mod request;
 mod retry;
 mod sse;
 mod telemetry;
-mod transport;
 
-pub use crate::chatgpt_cloudflare_cookies::with_chatgpt_cloudflare_cookie_store;
-pub use crate::chatgpt_hosts::is_allowed_chatgpt_host;
-pub use crate::custom_ca::BuildCustomCaTransportError;
-/// Test-only subprocess hook for custom CA coverage.
-///
-/// This stays public only so the `custom_ca_probe` binary target can reuse the shared helper. It
-/// is hidden from normal docs because ordinary callers should use
-/// [`build_reqwest_client_with_custom_ca`] instead.
-#[doc(hidden)]
-pub use crate::custom_ca::build_reqwest_client_for_subprocess_tests;
-pub use crate::custom_ca::build_reqwest_client_with_custom_ca;
-pub use crate::custom_ca::maybe_build_rustls_client_config_with_custom_ca;
-pub use crate::default_client::CodexHttpClient;
-pub use crate::default_client::CodexRequestBuilder;
-pub use crate::error::StreamError;
-pub use crate::error::TransportError;
-pub use crate::outbound_proxy::BuildRouteAwareHttpClientError;
-pub use crate::outbound_proxy::ClientRouteClass;
-pub use crate::outbound_proxy::OutboundProxyConfig;
-pub use crate::outbound_proxy::RouteFailureClass;
-pub use crate::outbound_proxy::build_reqwest_client_for_route;
-pub use crate::request::EncodedJsonBody;
-pub use crate::request::PreparedRequestBody;
-pub use crate::request::Request;
-pub use crate::request::RequestBody;
-pub use crate::request::RequestCompression;
-pub use crate::request::Response;
 pub use crate::retry::RetryOn;
 pub use crate::retry::RetryPolicy;
 pub use crate::retry::backoff;
 pub use crate::retry::run_with_retry;
 pub use crate::sse::sse_stream;
 pub use crate::telemetry::RequestTelemetry;
-pub use crate::transport::ByteStream;
-pub use crate::transport::HttpTransport;
-pub use crate::transport::ReqwestTransport;
-pub use crate::transport::StreamResponse;
+pub use codex_http_client::HttpClient as CodexHttpClient;
+pub use codex_http_client::RequestBuilder as CodexRequestBuilder;
+pub use codex_http_client::*;

codex-rs/codex-client/src/retry.rs

@@ -1,5 +1,5 @@
-use crate::error::TransportError;
-use crate::request::Request;
+use codex_http_client::Request;
+use codex_http_client::TransportError;
 use rand::Rng;
 use std::future::Future;
 use std::time::Duration;

codex-rs/codex-client/src/sse.rs

@@ -1,5 +1,5 @@
-use crate::error::StreamError;
-use crate::transport::ByteStream;
+use codex_http_client::ByteStream;
+use codex_http_client::StreamError;
 use eventsource_stream::Eventsource;
 use futures::StreamExt;
 use tokio::sync::mpsc;

codex-rs/codex-client/src/telemetry.rs

@@ -1,4 +1,4 @@
-use crate::error::TransportError;
+use codex_http_client::TransportError;
 use http::StatusCode;
 use std::time::Duration;
 

codex-rs/http-client/BUILD.bazel

@@ -0,0 +1,7 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "http-client",
+    compile_data = glob(["tests/fixtures/**"]),
+    crate_name = "codex_http_client",
+)

codex-rs/http-client/Cargo.toml

@@ -0,0 +1,49 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-http-client"
+version.workspace = true
+
+[dependencies]
+bytes = { workspace = true }
+codex-utils-rustls-provider = { workspace = true }
+futures = { workspace = true }
+http = { workspace = true }
+opentelemetry = { workspace = true }
+reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots", "stream"] }
+rustls = { workspace = true }
+rustls-native-certs = { workspace = true }
+rustls-pki-types = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt", "time", "sync"] }
+tracing = { workspace = true }
+tracing-opentelemetry = { workspace = true }
+zstd = { workspace = true }
+
+[target.'cfg(any(target_os = "windows", target_os = "macos"))'.dependencies]
+sha2 = { workspace = true }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+system-configuration = { workspace = true }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-sys = { version = "0.52", features = [
+    "Win32_Foundation",
+    "Win32_Networking_WinHttp",
+] }
+
+[lints]
+workspace = true
+
+[dev-dependencies]
+codex-utils-cargo-bin = { workspace = true }
+opentelemetry_sdk = { workspace = true }
+pretty_assertions = { workspace = true }
+rcgen = { workspace = true }
+tempfile = { workspace = true }
+tracing-subscriber = { workspace = true }
+
+[lib]
+doctest = false

codex-rs/http-client/README.md

@@ -0,0 +1,9 @@
+# codex-http-client
+
+Low-level HTTP transport shared by Codex crates.
+
+- Defines the request, response, streaming, and transport types used for outbound HTTP calls.
+- Owns the `reqwest` implementation, custom CA handling, and ChatGPT Cloudflare cookie policy.
+- Resolves system, PAC/WPAD, environment, and direct proxy routes for supported clients.
+
+Higher-level retry, SSE, and request telemetry policy remains in `codex-client`.

codex-rs/codex-client/src/bin/custom_ca_probe.rs → codex-rs/http-client/src/bin/custom_ca_probe.rs

@@ -10,9 +10,9 @@
 //! - error messages guide users when CA files are invalid.
 //! - optional HTTPS probes can complete a request through the constructed client.
 //!
-//! The detailed explanation of what "hermetic" means here lives in `codex_client::custom_ca`.
+//! The detailed explanation of what "hermetic" means here lives in `codex_http_client::custom_ca`.
 //! This binary exists so the tests can exercise
-//! [`codex_client::build_reqwest_client_for_subprocess_tests`] in a separate process without
+//! [`codex_http_client::build_reqwest_client_for_subprocess_tests`] in a separate process without
 //! duplicating client-construction logic.
 
 use std::env;
@@ -69,11 +69,11 @@ fn build_probe_client(
     if let Some(proxy_url) = proxy_url {
         let proxy = reqwest::Proxy::https(proxy_url)
             .map_err(|error| format!("failed to configure probe proxy {proxy_url}: {error}"))?;
-        return codex_client::build_reqwest_client_with_custom_ca(builder.proxy(proxy))
+        return codex_http_client::build_reqwest_client_with_custom_ca(builder.proxy(proxy))
             .map_err(|error| error.to_string());
     }
 
-    codex_client::build_reqwest_client_for_subprocess_tests(builder)
+    codex_http_client::build_reqwest_client_for_subprocess_tests(builder)
         .map_err(|error| error.to_string())
 }
 

codex-rs/codex-client/src/chatgpt_cloudflare_cookies.rs → codex-rs/http-client/src/chatgpt_cloudflare_cookies.rs

@@ -7,7 +7,7 @@ use reqwest::header::HeaderValue;
 
 use crate::chatgpt_hosts::is_allowed_chatgpt_host;
 
-// WARNING: this store is process-global and may be shared across auth contexts.
+// WARNING: this HTTP cookie store is process-global and may be shared across auth contexts.
 // It must only ever contain Cloudflare infrastructure cookies. Never extend this
 // store to persist ChatGPT account, session, auth, or other user-specific cookie
 // data.

codex-rs/codex-client/src/chatgpt_hosts.rs → codex-rs/http-client/src/chatgpt_hosts.rs

@@ -1,5 +1,5 @@
 /// Returns whether `host` is one of the ChatGPT hosts Codex is allowed to treat
-/// as first-party ChatGPT traffic.
+/// as first-party ChatGPT HTTP traffic.
 pub fn is_allowed_chatgpt_host(host: &str) -> bool {
     const EXACT_HOSTS: &[&str] = &["chatgpt.com", "chat.openai.com", "chatgpt-staging.com"];
     const SUBDOMAIN_SUFFIXES: &[&str] = &[".chatgpt.com", ".chatgpt-staging.com"];

codex-rs/codex-client/src/custom_ca.rs → codex-rs/http-client/src/custom_ca.rs

@@ -1,4 +1,4 @@
-//! Custom CA handling for Codex outbound HTTP and websocket clients.
+//! Custom CA handling shared by Codex outbound HTTP and websocket clients.
 //!
 //! Codex constructs outbound reqwest clients and secure websocket connections in a few crates, but
 //! they all need the same trust-store policy when enterprise proxies or gateways intercept TLS.