codex_apps MCP bootstrap fails on SOCKS-only ALL_PROXY and appears to require HTTP proxy vars

Summary

codex_apps MCP bootstrap appears to fail when Codex is configured with ALL_PROXY=socks5h://... only, even though the main codex e ping flow succeeds.

The failure path is the optional Streamable HTTP MCP endpoint at https://chatgpt.com/backend-api/wham/apps.

Observed behavior

With only:

export ALL_PROXY=socks5h://127.0.0.1:10808
export NO_PROXY=127.0.0.1,localhost,::1

codex e ping --skip-git-repo-check still returns pong, but logs this error during startup:

ERROR rmcp::transport::worker: worker quit with fatal: Transport channel closed, when Client(Reqwest(reqwest::Error { kind: Request, url: "https://chatgpt.com/backend-api/wham/apps", source: hyper_util::client::legacy::Error(Connect, TunnelUnexpectedEof) }))

When HTTP_PROXY / HTTPS_PROXY / WS_PROXY / WSS_PROXY are also set to an HTTP proxy listener, the noise goes away.

Why this looks like a Codex bug

The optional apps/bootstrap path is built here:

• codex-rs/core/src/mcp/mod.rs:165-199
• codex_apps URL resolves to https://chatgpt.com/backend-api/wham/apps

That transport is created by codex-rmcp-client using a plain reqwest::Client:

• codex-rs/rmcp-client/src/rmcp_client.rs:103-106
• codex-rs/rmcp-client/src/rmcp_client.rs:986-989

But codex-rmcp-client depends on reqwest without the socks feature:

• codex-rs/rmcp-client/Cargo.toml:24-28

reqwest = { version = "0.12", default-features = false, features = [
    "json",
    "stream",
    "rustls-tls",
] }

So this path appears unable to use a socks5h://...-style ALL_PROXY configuration, even though Codex docs and other runtime paths treat ALL_PROXY as part of the supported proxy setup.

Expected behavior

One of these should happen:

1. codex_apps / RMCP Streamable HTTP should support SOCKS via ALL_PROXY=socks5h://...
2. or the optional codex_apps bootstrap should fail quietly without a fatal startup error when only SOCKS proxying is configured
3. or the CLI should clearly document that this optional path currently requires an HTTP proxy (HTTP_PROXY / HTTPS_PROXY) rather than SOCKS-only ALL_PROXY

Repro

export ALL_PROXY=socks5h://127.0.0.1:10808
export NO_PROXY=127.0.0.1,localhost,::1
unset HTTP_PROXY HTTPS_PROXY WS_PROXY WSS_PROXY
codex e ping --skip-git-repo-check

Result:

• main request succeeds (pong)
• optional wham/apps MCP bootstrap logs fatal TunnelUnexpectedEof

Then:

export HTTP_PROXY=http://127.0.0.1:10809
export HTTPS_PROXY=http://127.0.0.1:10809
export WS_PROXY=http://127.0.0.1:10809
export WSS_PROXY=http://127.0.0.1:10809
codex e ping --skip-git-repo-check

Result:

• pong
• no wham/apps proxy error in the same environment