1
00:00:00,099 --> 00:00:05,179
If you have ever ran Codex inside a locked
down corporate network and watched a

2
00:00:05,259 --> 00:00:11,439
plugin download or an OAuth authorization
flow just silently stall out on an HTTP

3
00:00:11,479 --> 00:00:15,920
redirect, it was not actually your proxy
playing tricks on you.

4
00:00:15,979 --> 00:00:22,139
It was a pretty fundamental architectural
quirk in how HTTP clients in Rust handle

5
00:00:22,199 --> 00:00:23,799
proxy routing across redirects.

6
00:00:24,232 --> 00:00:27,932
Wait, so it wasn't just a misconfigured
PAC file?

7
00:00:28,552 --> 00:00:34,333
I, I know so many developers who spent
hours tweaking Proxy Auto Config scripts

8
00:00:34,372 --> 00:00:37,392
because plugin downloads kept hanging
halfway through.

9
00:00:37,750 --> 00:00:39,350
Right, exactly!

10
00:00:39,414 --> 00:00:45,110
What was happening under the hood was that
the standard Rust HTTP client would lock

11
00:00:45,158 --> 00:00:47,590
onto the proxy route for the initial URL.

12
00:00:47,857 --> 00:00:52,790
So say you start on an internal domain
like auth point enterprise dot com.

13
00:00:52,930 --> 00:00:58,550
The client picks the internal proxy route,
but then that server responds with a 302

14
00:00:58,621 --> 00:01:02,790
redirect to an external S3 bucket or a
CDN, right?

15
00:01:02,930 --> 00:01:07,430
And instead of re evaluating where that
new external address should go,

16
00:01:07,450 --> 00:01:11,110
the client just reuses the original
internal proxy route.

17
00:01:11,150 --> 00:01:16,230
And boom, the corporate proxy drops it
because it violates the destination rules.

18
00:01:17,549 --> 00:01:18,309
Wow.

19
00:01:18,629 --> 00:01:24,710
So it tried to route an external S3 bucket
through an internal only proxy path?

20
00:01:25,550 --> 00:01:26,269
That is...

21
00:01:27,109 --> 00:01:30,829
yeah, that would definitely fail silently
every single time.

22
00:01:31,208 --> 00:01:32,248
Every single time.

23
00:01:32,408 --> 00:01:37,848
But in Codex version zero point one forty
six point zero, they introduced something

24
00:01:37,894 --> 00:01:42,128
called RouteAwareClientPool to fix this
exact flaw.

25
00:01:42,218 --> 00:01:44,168
And what it does is pretty neat.

26
00:01:44,275 --> 00:01:49,848
On every single redirect hop, it re
evaluates the proxy routing rules from scratch.

27
00:01:50,061 --> 00:01:55,688
If the host changes, it completely re
resolves the target, enforces a ten hop

28
00:01:55,768 --> 00:02:01,208
ceiling so you do not end up in an
infinite redirect loop, and it strips origin

29
00:02:01,264 --> 00:02:06,488
sensitive authorization headers so you are
not leaking enterprise tokens to external

30
00:02:06,548 --> 00:02:07,048
targets.

31
00:02:07,481 --> 00:02:09,801
Okay, let me make sure I follow this.

32
00:02:10,461 --> 00:02:15,441
So before, the HTTP client was essentially
blind after hop one.

33
00:02:15,901 --> 00:02:18,801
It pinned the initial proxy settings for
the whole trip.

34
00:02:19,521 --> 00:02:24,302
But with RouteAwareClientPool, it re
checks the map on every hop,

35
00:02:24,821 --> 00:02:29,461
strips your secret auth headers if you
leave the domain, caps redirects at ten,

36
00:02:30,142 --> 00:02:30,421
and...

37
00:02:31,081 --> 00:02:34,722
wait, does keeping all those routes open
cause memory issues if you are running a

38
00:02:34,781 --> 00:02:35,981
long daemon process?

39
00:02:36,673 --> 00:02:41,552
Great catch, and no, because they capped
the route cache at a bounded limit of

40
00:02:41,632 --> 00:02:42,472
sixteen routes.

41
00:02:43,132 --> 00:02:47,952
So it automatically prunes old routes to
prevent memory leaks in background daemons.

42
00:02:48,592 --> 00:02:50,972
And they did not just patch this in one
spot.

43
00:02:51,492 --> 00:02:55,072
They actually wired this pool into app
server account requests,

44
00:02:55,692 --> 00:03:01,093
plugin startup sync, remote plugin
bundles, LM Studio local connections,

45
00:03:01,692 --> 00:03:06,292
WebSockets, MCP authorization, and
background daemon updates.

46
00:03:06,752 --> 00:03:11,233
So basically, they honor configured
proxies across authentication,

47
00:03:11,632 --> 00:03:17,053
plugin downloads, MCP authorization,
remote execution, WebSockets,

48
00:03:17,372 --> 00:03:19,932
redirects, and LM Studio connections.

49
00:03:20,472 --> 00:03:23,093
Everything uses that same smart routing
now!

50
00:03:23,417 --> 00:03:25,097
Yes, exactly that.

51
00:03:25,310 --> 00:03:30,537
It brings universal proxy routing coverage
across the whole surface area of the app.

52
00:03:30,841 --> 00:03:33,762
Okay, but what about built in build tools?

53
00:03:34,201 --> 00:03:39,281
Because running Rust or Cargo inside an
enterprise sandbox with SSL inspection used

54
00:03:39,302 --> 00:03:43,681
to panic all the time, even when Codex
itself trusted the proxy certificate.

55
00:03:44,119 --> 00:03:45,159
Ah, yes!

56
00:03:45,679 --> 00:03:48,519
The infamous Man In The Middle sandbox
panic.

57
00:03:49,179 --> 00:03:54,420
So corporate networks insert their own
custom CA certificates to inspect SSL

58
00:03:54,539 --> 00:03:55,539
traffic, right?

59
00:03:56,279 --> 00:04:00,799
Codex knew about those custom certificates
through system stores or environment

60
00:04:00,920 --> 00:04:07,119
flags, but Cargo subprocesses running
inside the sandbox did not inherit them.

61
00:04:07,219 --> 00:04:12,439
Cargo has its own separate network stack
and ignores the system CA store on many

62
00:04:12,500 --> 00:04:13,079
platforms.

63
00:04:13,799 --> 00:04:16,880
So as soon as Cargo tried to fetch crates
from crates dot io,

64
00:04:17,559 --> 00:04:20,340
it would panic on untrusted TLS
certificates.

65
00:04:20,736 --> 00:04:24,877
Oh, I have seen that error message in so
many build logs.

66
00:04:25,357 --> 00:04:29,297
The classic self signed certificate in
certificate chain error.

67
00:04:29,667 --> 00:04:30,387
Precisely.

68
00:04:30,627 --> 00:04:35,347
So in zero point one forty six point zero,
they fixed this by adding

69
00:04:35,507 --> 00:04:42,227
CARGO_HTTP_CAINFO to the curated custom CA
environment variables so

70
00:04:42,320 --> 00:04:45,827
Cargo inherits the managed MITM trust
bundle.

71
00:04:45,987 --> 00:04:51,907
That means when Codex spawns a Cargo
subprocess, it automatically passes that custom

72
00:04:52,040 --> 00:04:57,587
CA bundle straight to Cargo through
CARGO_HTTP_CAINFO.

73
00:04:57,982 --> 00:05:04,662
So if a developer sets SSL_CERT_FILE or
NODE_EXTRA_CA_CERTS in their dot

74
00:05:04,822 --> 00:05:10,982
codex slash config dot toml file or
workspace flags, Cargo just works now without

75
00:05:11,062 --> 00:05:15,263
needing custom shell wrappers or manual
export statements in every subshell?

76
00:05:15,765 --> 00:05:16,625
Exactly.

77
00:05:17,064 --> 00:05:20,864
It inherits the managed MITM trust bundle
seamlessly.

78
00:05:21,384 --> 00:05:25,744
It completely eliminates that friction
layer for Rust developers in corporate

79
00:05:25,784 --> 00:05:26,324
environments.

80
00:05:27,592 --> 00:05:31,273
That is going to save so many dev ops
support tickets.

81
00:05:31,372 --> 00:05:34,352
Were there any terminal UI improvements in
this release too,

82
00:05:34,753 --> 00:05:36,593
or was it all under the hood networking?

83
00:05:36,958 --> 00:05:40,398
Oh, there are some great quality of life
terminal tweaks!

84
00:05:40,538 --> 00:05:46,638
For one, if you manage multiple side
conversations, you can now use slash new with a

85
00:05:46,718 --> 00:05:52,558
name and slash clear with a name to name
and clear specific sub sessions directly.

86
00:05:52,734 --> 00:05:56,478
Plus, they added a safety threshold for
syntax highlighting.

87
00:05:56,718 --> 00:06:02,078
If a single line of output exceeds four
kibibytes, Codex turns off syntax

88
00:06:02,115 --> 00:06:03,438
highlighting for that line.

89
00:06:04,637 --> 00:06:10,577
Because dumping a massive four kilobyte
minified JSON blob would literally freeze

90
00:06:10,617 --> 00:06:16,057
your entire terminal window for ten
seconds while the parser tried to color code it!

91
00:06:16,462 --> 00:06:17,203
Exactly.

92
00:06:17,762 --> 00:06:22,682
It protects your terminal from lockups
without sacrificing syntax highlighting on

93
00:06:22,762 --> 00:06:23,742
normal code blocks.

94
00:06:24,522 --> 00:06:30,642
Overall, zero point one forty six point
zero really feels like a major milestone for

95
00:06:30,722 --> 00:06:34,702
enterprise readiness, fixing network
pipelines from the bottom up.

96
00:06:35,151 --> 00:06:38,651
Yeah, no more proxy hacks just to run a
basic build.

97
00:06:39,252 --> 00:06:41,311
Alright, good chatting Ethan, talk soon!