Can't connect to API proxy when using musl build and VPN

What version of Codex CLI is running?

codex-cli 0.97.0

What subscription do you have?

Enterprise but using through API

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Linux 6.14.0-37-generic aarch64 aarch64

What terminal emulator and version are you using (if applicable)?

Windows Terminal, via ssh to bash on remote host

What issue are you seeing?

stream disconnected before completion: error sending request for url (https://<my api proxy host>/api/
providers/openai/v1/responses)

What steps can reproduce the bug?

I get this error only when using the musl release build when using my corporate VPN.
If I use the gnu release build it works fine.
If I'm in the office (not using the VPN), then both builds work fine.

A broken session:

$ echo "help" | RUST_LOG=codex_client=debug ./codex-aarch64-unknown-linux-musl exec --skip-git-repo-check
Reading prompt from stdin...
OpenAI Codex v0.97.0 (research preview)
--------
workdir: /home/matben01
model: gpt-5.2-codex
provider: proxy
approval: never
sandbox: workspace-write [workdir, /tmp, $TMPDIR]
reasoning effort: none
reasoning summaries: auto
session id: 019c2dad-54ca-7be1-af91-c26df75c60f8
--------
user
help

mcp startup: no servers
2026-02-05T12:01:05.131623Z DEBUG codex_client::default_client: Request failed method=POST url=https://<my api proxy host>/api/providers/openai/v1/responses error=error sending request for url (https://<my api proxy host>/api/providers/openai/v1/responses)
2026-02-05T12:01:10.355050Z DEBUG codex_client::default_client: Request failed method=POST url=https://<my api proxy host>/api/providers/openai/v1/responses error=error sending request for url (https://<my api proxy host>/api/providers/openai/v1/responses)
^Ctask interrupted

A working session:

$ echo "help" | RUST_LOG=codex_client=debug ./codex-aarch64-unknown-linux-gnu exec --skip-git
-repo-check
Reading prompt from stdin...
OpenAI Codex v0.97.0 (research preview)
--------
workdir: /home/matben01
model: gpt-5.2-codex
provider: proxy
approval: never
sandbox: workspace-write [workdir, /tmp, $TMPDIR]
reasoning effort: none
reasoning summaries: auto
session id: 019c2dac-e186-7e60-acb9-f620a2bb2400
--------
user
help

mcp startup: no servers
2026-02-05T12:00:31.232282Z DEBUG codex_client::default_client: Request completed method=POST url=https://<my api proxy host>/api/providers/openai/v1/responses status=200 OK headers={"date": "Thu, 05 Feb 2026 12:00:31 GMT", "content-type": "text/event-stream; charset=utf-8", "transfer-encoding": "chunked", "connection": "keep-alive", "strict-transport-security": "max-age=31536000; includeSubDomains"} version=HTTP/1.1
codex
What do you want help with? If you’re not sure, tell me what you’re trying to do and I’ll propose next steps.
tokens used
828
What do you want help with? If you’re not sure, tell me what you’re trying to do and I’ll propose next steps.

What is the expected behavior?

Both builds work the same way, and both can connect to the proxy when I'm on the VPN.

Additional information

The issue was fixed in main by 7b27aa770795edec9353b1490a7ba5e64fb3f268, but the fix was reverted in 4d48d4e0c27cd67a38f24312fd6a4d63eb7785a3.

If I build the CLI myself then I can fix the issue either by using the rustls-tls-native-roots feature of reqwest, or by using reqwest v0.13.