From da872ce44e855458133d86386ffdc732af8ac906 Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Wed, 8 Jul 2026 18:25:48 -0700
Subject: [PATCH] build: ratchet direct reqwest dependencies

---
 codex-rs/deny.toml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/codex-rs/deny.toml b/codex-rs/deny.toml
index 4e52422f39cf..b15f7b233517 100644
--- a/codex-rs/deny.toml
+++ b/codex-rs/deny.toml
@@ -233,6 +233,39 @@ deny = [
         "tonic",
         "zbus",
     ], reason = "first-party traits must use native async trait methods with explicit Send bounds" },
+    # Migration ratchet: `codex-http-client` is the intended reqwest owner. Remove each temporary
+    # wrapper when that crate's direct reqwest dependency is migrated to the shared abstraction.
+    { crate = "reqwest", wrappers = [
+        # Intended owner.
+        "codex-http-client",
+        # Temporary migration exceptions.
+        "codex-agent-identity",
+        "codex-api",
+        "codex-app-server",
+        "codex-app-server-daemon",
+        "codex-backend-client",
+        "codex-cloud-tasks",
+        "codex-core",
+        "codex-core-plugins",
+        "codex-exec-server",
+        "codex-lmstudio",
+        "codex-login",
+        "codex-ollama",
+        "codex-otel",
+        "codex-protocol",
+        "codex-responses-api-proxy",
+        "codex-rmcp-client",
+        "codex-tui",
+        "core_test_support",
+        # Third-party crates that own their reqwest integration. These are not part of the
+        # first-party migration count above.
+        "oauth2",
+        "opentelemetry-http",
+        "opentelemetry-otlp",
+        "rmcp",
+        "sentry",
+        "webrtc-sys-build",
+    ], reason = "new direct reqwest dependencies must use codex-http-client; temporary wrappers track migration debt" },
 ]
 
 # List of features to allow/deny