{"record":{"id":"fff1ebc042353ac6","repo":"openai/codex","slug":"failed-to-configure-outbound-proxy-selected-for-r","errorCode":null,"errorMessage":"Failed to configure outbound proxy selected for {route_class}","messagePattern":"Failed to configure outbound proxy selected for (.+?)","errorType":"exception","errorClass":"BuildRouteAwareHttpClientError","httpStatus":null,"severity":"error","filePath":"codex-rs/http-client/src/outbound_proxy.rs","lineNumber":416,"sourceCode":"}\n\nfn proxy_resolution_url(request_url: &str) -> Cow<'_, str> {\n    if let Some(suffix) = request_url.strip_prefix(\"wss://\") {\n        Cow::Owned(format!(\"https://{suffix}\"))\n    } else if let Some(suffix) = request_url.strip_prefix(\"ws://\") {\n        Cow::Owned(format!(\"http://{suffix}\"))\n    } else {\n        Cow::Borrowed(request_url)\n    }\n}\n\n/// Error while building a resolver-aware reqwest client.\n#[derive(Debug, Error)]\npub enum BuildRouteAwareHttpClientError {\n    #[error(transparent)]\n    CustomCa(#[from] BuildCustomCaTransportError),\n\n    #[error(\"Failed to configure outbound proxy selected for {route_class}\")]\n    InvalidProxyConfig { route_class: ClientRouteClass },\n}\n\nimpl From<BuildRouteAwareHttpClientError> for io::Error {\n    fn from(error: BuildRouteAwareHttpClientError) -> Self {\n        match error {\n            BuildRouteAwareHttpClientError::CustomCa(error) => error.into(),\n            BuildRouteAwareHttpClientError::InvalidProxyConfig { .. } => io::Error::other(error),\n        }\n    }\n}\n\n/// Builds a reqwest client with conservative route selection and shared CA handling.\n///\n/// Unavailable platform resolution falls back to environment proxies and then direct. Errors after\n/// a route is selected are returned without trying another route. Ordered PAC candidates are\n/// currently collapsed to one route on both Windows and macOS; later proxy or `DIRECT` candidates\n/// are not retried after a connection failure.","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/http-client/src/outbound_proxy.rs#L398-L434","documentation":"BuildRouteAwareHttpClientError::InvalidProxyConfig is returned when reqwest::Proxy::all(proxy_url) rejects the proxy URL selected by the resolver (outbound_proxy.rs:490-494). The route (from macOS/Windows system proxy, PAC, or HTTPS_PROXY/HTTP_PROXY/ALL_PROXY env) was chosen, but its URL is not a valid proxy URL (missing scheme, unparseable). route_class labels the product path (auth|api|wss|other) that hit it; the underlying parse error is dropped. failure_class() maps it to RouteFailureClass::InvalidProxyConfig, and per the builder docs no alternative route is tried after this failure.","triggerScenarios":"Sending through RouteAwareClientPool (or HttpClientFactory::build_reqwest_client) under OutboundProxyPolicy::RespectSystemProxy where the resolved OutboundProxyRoute::Proxy url fails reqwest::Proxy::all parsing: 'HTTPS_PROXY=localhost:3128' without a scheme, an ALL_PROXY value with stray quotes/whitespace, or a PAC/system setting returning a malformed URL.","commonSituations":"Proxy env var written without the http:// scheme prefix (the most common form), CI-injected env vars carrying quotes or trailing newlines, misconfigured Windows/macOS system proxy fields, PAC scripts returning host:port instead of a full URL.","solutions":["Fix the proxy URL to include a scheme: http://proxy.corp:3128 instead of proxy.corp:3128","Check the process env (HTTPS_PROXY, HTTP_PROXY, ALL_PROXY, lowercase variants) for quotes, whitespace, or typos; also review macOS/Windows system proxy settings and PAC output","Temporarily unset the proxy env vars (or set NO_PROXY for the destination) to confirm direct routing works, then correct the proxy config","Validate proxy URLs at startup by attempting reqwest::Proxy::all on the configured value so the failure surfaces with the actual config"],"exampleFix":"# before\nexport HTTPS_PROXY=localhost:3128        # InvalidProxyConfig for route_class 'api'\n\n# after\nexport HTTPS_PROXY=http://localhost:3128","handlingStrategy":"validation","validationCode":"// Validate a configured proxy URL exactly the way the builder will use it\nfn proxy_url_valid(url: &str) -> bool {\n    reqwest::Proxy::all(url).is_ok()\n}\n\n// Startup guard for env-driven config\nfor key in [\"HTTPS_PROXY\", \"HTTP_PROXY\", \"ALL_PROXY\"] {\n    if let Ok(v) = std::env::var(key)\n        && !v.is_empty() && !proxy_url_valid(v.trim()) {\n        panic!(\"{key} is not a valid proxy URL (include the scheme): {v}\");\n    }\n}","typeGuard":"fn is_invalid_proxy_config(e: &RouteAwareRequestError) -> bool {\n    e.failure_class() == Some(RouteFailureClass::InvalidProxyConfig)\n}","tryCatchPattern":"if let Some(RouteFailureClass::InvalidProxyConfig) = error.failure_class() {\n    // configuration error: report and stop, retrying cannot help\n    return Err(Fatal::ProxyConfig(\"proxy URL rejected; include scheme like http://\"));\n}","preventionTips":["Always write proxy URLs with an explicit scheme (http:// or https://)","Validate proxy config at startup with reqwest::Proxy::all, mirroring the library's own check","Lint CI-injected env vars for quotes, whitespace, and missing schemes","Re-check macOS/Windows system proxy settings after network-profile changes"],"tags":["proxy","configuration","env-vars","rust"],"backgroundTag":"invalid-proxy-url","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}