openai/codex · error · BuildRouteAwareHttpClientError

Failed to configure outbound proxy selected for {route_class

Error message

Failed to configure outbound proxy selected for {route_class}

What it means

BuildRouteAwareHttpClientError::InvalidProxyConfig is returned when reqwest::Proxy::all(proxy_url) rejects the proxy URL selected by the resolver (outbound_proxy.rs:490-494). The route (from macOS/Windows system proxy, PAC, or HTTPS_PROXY/HTTP_PROXY/ALL_PROXY env) was chosen, but its URL is not a valid proxy URL (missing scheme, unparseable). route_class labels the product path (auth|api|wss|other) that hit it; the underlying parse error is dropped. failure_class() maps it to RouteFailureClass::InvalidProxyConfig, and per the builder docs no alternative route is tried after this failure.

Source

Thrown at codex-rs/http-client/src/outbound_proxy.rs:416

}

fn proxy_resolution_url(request_url: &str) -> Cow<'_, str> {
    if let Some(suffix) = request_url.strip_prefix("wss://") {
        Cow::Owned(format!("https://{suffix}"))
    } else if let Some(suffix) = request_url.strip_prefix("ws://") {
        Cow::Owned(format!("http://{suffix}"))
    } else {
        Cow::Borrowed(request_url)
    }
}

/// Error while building a resolver-aware reqwest client.
#[derive(Debug, Error)]
pub enum BuildRouteAwareHttpClientError {
    #[error(transparent)]
    CustomCa(#[from] BuildCustomCaTransportError),

    #[error("Failed to configure outbound proxy selected for {route_class}")]
    InvalidProxyConfig { route_class: ClientRouteClass },
}

impl From<BuildRouteAwareHttpClientError> for io::Error {
    fn from(error: BuildRouteAwareHttpClientError) -> Self {
        match error {
            BuildRouteAwareHttpClientError::CustomCa(error) => error.into(),
            BuildRouteAwareHttpClientError::InvalidProxyConfig { .. } => io::Error::other(error),
        }
    }
}

/// Builds a reqwest client with conservative route selection and shared CA handling.
///
/// Unavailable platform resolution falls back to environment proxies and then direct. Errors after
/// a route is selected are returned without trying another route. Ordered PAC candidates are
/// currently collapsed to one route on both Windows and macOS; later proxy or `DIRECT` candidates
/// are not retried after a connection failure.

View on GitHub (pinned to 339751715c)

Solutions

1. Fix the proxy URL to include a scheme: http://proxy.corp:3128 instead of proxy.corp:3128
2. Check the process env (HTTPS_PROXY, HTTP_PROXY, ALL_PROXY, lowercase variants) for quotes, whitespace, or typos; also review macOS/Windows system proxy settings and PAC output
3. Temporarily unset the proxy env vars (or set NO_PROXY for the destination) to confirm direct routing works, then correct the proxy config
4. Validate proxy URLs at startup by attempting reqwest::Proxy::all on the configured value so the failure surfaces with the actual config

Example fix

# before
export HTTPS_PROXY=localhost:3128        # InvalidProxyConfig for route_class 'api'

# after
export HTTPS_PROXY=http://localhost:3128

// Validate a configured proxy URL exactly the way the builder will use it
fn proxy_url_valid(url: &str) -> bool {
    reqwest::Proxy::all(url).is_ok()
}

// Startup guard for env-driven config
for key in ["HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY"] {
    if let Ok(v) = std::env::var(key)
        && !v.is_empty() && !proxy_url_valid(v.trim()) {
        panic!("{key} is not a valid proxy URL (include the scheme): {v}");
    }
}

fn is_invalid_proxy_config(e: &RouteAwareRequestError) -> bool {
    e.failure_class() == Some(RouteFailureClass::InvalidProxyConfig)
}

if let Some(RouteFailureClass::InvalidProxyConfig) = error.failure_class() {
    // configuration error: report and stop, retrying cannot help
    return Err(Fatal::ProxyConfig("proxy URL rejected; include scheme like http://"));
}

When it happens

Trigger: Sending through RouteAwareClientPool (or HttpClientFactory::build_reqwest_client) under OutboundProxyPolicy::RespectSystemProxy where the resolved OutboundProxyRoute::Proxy url fails reqwest::Proxy::all parsing: 'HTTPS_PROXY=localhost:3128' without a scheme, an ALL_PROXY value with stray quotes/whitespace, or a PAC/system setting returning a malformed URL.

Common situations: Proxy env var written without the http:// scheme prefix (the most common form), CI-injected env vars carrying quotes or trailing newlines, misconfigured Windows/macOS system proxy fields, PAC scripts returning host:port instead of a full URL.

Related errors

• invalid agent graph store request: {message}
• {message}
• InvalidInput
• AWS service name must not be empty
• AWS profile must be configured

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/fff1ebc042353ac6. Report an issue: GitHub.