Windows desktop app intermittently fails streamed responses behind Clash Verge Rev proxy (TLS EOF / response body decode error)

Open 💬 3 comments Opened Apr 20, 2026 by kkx9578
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.415.4716.0

What subscription do you have?

plus

What platform is your computer?

_No response_

What issue are you seeing?

On Windows desktop, Codex intermittently fails during streamed replies when running behind Clash Verge Rev.

This is not a total connectivity failure. The app can still partially continue working and produce output, but the same session, or a newly opened window/session, may show repeated reconnects or fail before the streamed response completes.

I observed multiple failure modes during the same general setup:

  • stream disconnected before completion: IO error: peer closed connection without sending TLS close_notify
  • stream disconnected before completion: tls handshake eof
  • stream disconnected before completion: Transport error: network error: error decoding response body

In some cases, one window/session can still work while another newly opened window/session shows reconnects or stream completion failures.

What steps can reproduce the bug?

Steps to reproduce

  1. Run the Codex Windows desktop app.
  2. Use Clash Verge Rev as the local proxy.
  3. Verify the active local proxy port is 127.0.0.1:7897 (mixed-port).
  4. Launch Codex with explicit proxy environment variables:
  • HTTP_PROXY=http://127.0.0.1:7897
  • HTTPS_PROXY=http://127.0.0.1:7897
  • ALL_PROXY=socks5://127.0.0.1:7897
  1. Start a normal chat, especially one that triggers web searches or a longer streamed response.
  2. Open a new window/session and repeat.
  3. Observe intermittent reconnects and stream completion failures.

What is the expected behavior?

Expected behavior

Codex should stream the full response normally without repeated reconnects or stream completion failures.

Actual behavior

The desktop app intermittently reconnects or fails before the stream completes.

Examples shown in the UI include:

Reconnecting... 2/5
stream disconnected before completion: IO error: peer closed connection without sending TLS close_notify

Reconnecting... 3/5
stream disconnected before completion: tls handshake eof

stream disconnected before completion: Transport error: network error: error decoding response body

### Additional information

_No response_

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 4 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #17137
  • #17199

Powered by Codex Action

etraut-openai contributor · 4 months ago

This is likely an issue with your proxy, not with Codex. Please work with your IT department to diagnose.

Sapientropic · 3 months ago

Sharing one proxy-side data point in case it helps other Windows users who hit the same symptom with rule-based routing.

In my setup:

  • Codex Desktop on Windows was behind Clash Verge Rev / mihomo.
  • Global proxy mode worked.
  • Rule mode caused immediate reconnect loops and errors like:
  • stream disconnected before completion
  • tls handshake eof
  • request failures around https://chatgpt.com/backend-api/codex/responses

The fix was not just adding Codex/OpenAI domain rules. The important bit was selector consistency.

The OpenAI-specific proxy group was pinned to a stale fixed proxy, while the primary/default selector was using a different working proxy. That made global mode work, but rule mode forced Codex traffic through the stale OpenAI route.

Changing the OpenAI proxy group to follow the same currently working primary/default selector fixed the reconnect loop.

Relevant rules:

- PROCESS-NAME,Codex.exe,OpenAI
- PROCESS-NAME,codex.exe,OpenAI
- DOMAIN,challenges.cloudflare.com,OpenAI
- DOMAIN,desktop.chat.openai.com,OpenAI
- DOMAIN,events.statsigapi.net,OpenAI
- DOMAIN,featuregates.org,OpenAI
- DOMAIN,o33249.ingest.sentry.io,OpenAI
- DOMAIN,openaiapi-site.azureedge.net,OpenAI
- DOMAIN,ws.chatgpt.com,OpenAI
- DOMAIN-SUFFIX,chatgpt.com,OpenAI
- DOMAIN-SUFFIX,openai.com,OpenAI
- DOMAIN-SUFFIX,oaistatic.com,OpenAI
- DOMAIN-SUFFIX,oaiusercontent.com,OpenAI
- DOMAIN-SUFFIX,statsigapi.net,OpenAI
- DOMAIN-SUFFIX,sentry.io,OpenAI

After the fix, the proxy logs showed Codex traffic being routed consistently, for example:

codex.exe -> chatgpt.com:443 match DomainSuffix(chatgpt.com) using OpenAI[primary selector route]
Codex.exe -> chat.openai.com:443 match DomainSuffix(openai.com) using OpenAI[primary selector route]

Takeaway: for rule-based proxy setups, it may not be enough to add the right Codex/OpenAI domain rules. The OpenAI-specific route also needs to use the same currently working path as the primary selector, otherwise global mode can work while rule mode breaks Codex's long-lived HTTPS/WebSocket streams.

This is a proxy-side mitigation rather than a claim that Codex itself is at fault, but the symptom looks exactly like a Codex stream failure from the app side, so it may be useful troubleshooting context.