Codex CLI 0.147.0 fails behind TUN proxy on Windows with os error 10061, MCP failure, and HTTPS fallback failure

What version of Codex CLI is running?

0.147.0

What subscription do you have?

ChatGPT Plus

Which model were you using?

gpt-5.6-sol

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

Windows Terminal with Windows PowerShell 5.1

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1786638683s since unix epoch",
  "overallStatus": "fail",
  "codexVersion": "0.147.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\鍗庝负\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\鍗庝负\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\鍗庝负\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\鍗庝负\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\鍗庝负\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "C:\\Users\\鍗庝负\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\鍗庝负\\.codex",
        "config.toml": "C:\\Users\\鍗庝负\\.codex\\config.toml",
        "config.toml parse": "ok",
        "cwd": "C:\\Users\\鍗庝负",
        "enabled feature flags": "<redacted>",
        "feature flag overrides": "none",
        "feature flags enabled": "39",
        "log dir": "C:\\Users\\鍗庝负\\.codex\\log",
        "mcp servers": "1",
        "model": "<default>",
        "model provider": "openai",
        "sqlite home": "C:\\Users\\鍗庝负\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git executable not found",
      "details": {
        "PATH git entries": "0",
        "repo detected": "false",
        "selected git": "not found"
      },
      "remediation": null,
      "durationMs": 20
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\锟斤拷为\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "current executable": "C:\\Users\\鍗庝负\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install context": "standalone (windows, package C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc, bin C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed by pnpm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 84
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "MCP configuration is locally consistent",
      "details": {
        "configured servers": "1",
        "disabled servers": "0",
        "stdio servers": "1"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars present": "HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, http_proxy, https_proxy, all_proxy"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "fail",
      "summary": "one or more required provider endpoints are unreachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ connect failed (required)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": "Check proxy, VPN, firewall, DNS, and custom CA configuration.",
      "durationMs": 2040
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "warning",
      "summary": "Responses WebSocket failed; HTTPS fallback may still work",
      "details": {
        "DNS": "1 IPv4, 0 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake transport error": "network error: 鐢变簬鐩爣璁＄畻鏈虹Н鏋佹嫆缁濓紝鏃犳硶杩炴帴銆?(os error 10061)",
        "model provider": "openai",
        "provider name": "OpenAI",
        "proxy env vars present": "HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, http_proxy, https_proxy, all_proxy",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": "Check proxy, VPN, firewall, DNS, custom CA, and WebSocket policy support.",
      "durationMs": 2079
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running standalone on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\鍗庝负\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install method": "standalone (windows, package C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc, bin C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.147.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases\\0.147.0-x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\鍗庝负\\.codex (dir)",
        "active rollout files": "33 files, 174465400 total bytes, 5286830 average bytes",
        "archived rollout files": "7 files, 3456990 total bytes, 493855 average bytes",
        "goals DB": "C:\\Users\\鍗庝负\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\鍗庝负\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\鍗庝负\\.codex\\log (missing)",
        "memories DB": "C:\\Users\\鍗庝负\\.codex\\memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "queue DB": "C:\\Users\\鍗庝负\\.codex\\queue_1.sqlite (file)",
        "queue DB integrity": "ok",
        "sqlite home": "C:\\Users\\鍗庝负\\.codex (dir)",
        "standalone release cache": "1 entries in C:\\Users\\鍗庝负\\.codex\\packages\\standalone\\releases",
        "state DB": "C:\\Users\\鍗庝负\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok",
        "thread history DB": "C:\\Users\\鍗庝负\\.codex\\thread_history_1.sqlite (file)",
        "thread history DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 262
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "33",
        "rollout DB active rows": "33",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "7",
        "rollout DB archived rows": "7",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=40",
        "rollout DB rows": "40",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "vscode=23, subagent:other=7, subagent:thread_spawn=6, cli=4",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 72
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language zh-CN",
      "details": {
        "EDITOR": "not set",
        "VISUAL": "not set",
        "os": "Windows 10.0.26200 (Windows 11 Professional) [64-bit]",
        "os language": "zh-CN",
        "os type": "Windows",
        "os version": "10.0.26200"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "WT_SESSION": "present",
        "color output": "disabled (stdout is not a terminal)",
        "console input code page": "936",
        "console output code page": "936",
        "stderr console mode": "0x00000007 (VT processing: true)",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout console mode": "unavailable",
        "stdout is terminal": "false",
        "terminal": "Windows Terminal",
        "terminal size": "120x30"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "cwd",
        "terminal title project value": "鍗庝负",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "warning",
      "summary": "update configuration is locally consistent",
      "details": {
        "check for update on startup": "true",
        "latest version probe": "curl: (7) Failed to connect to api.github.com:443 over proxy 127.0.0.1 after 2038 ms: Could not connect to server",
        "update action": "standalone installer",
        "version cache": [
          "C:\\Users\\鍗庝负\\.codex\\version.json",
          "missing"
        ]
      },
      "remediation": null,
      "durationMs": 2077
    }
  }
}

What issue are you seeing?

Codex CLI is unable to reliably connect when I use a TUN-mode proxy on Windows.

Codex starts normally, but requests fail with the following errors:

MCP client for codex_apps failed to start:
MCP startup failed: handshaking with MCP server failed.
HTTP request failed while sending the initialize request to:
https://chatgpt.com/backend-api/ps/mcp

Codex then reports:

Falling back from WebSockets to HTTPS transport.
stream disconnected before completion: 由于目标计算机积极拒绝，无法连接。 (os error 10061)

After falling back to HTTPS, the request still fails:

stream disconnected before completion: error sending request for url (https://chatgpt.com/backend-api/codex/responses)

The proxy application is iKuuu/OpenVXS using TUN mode. Normal browser access to ChatGPT works.

I also tested the ChatGPT backend endpoint with curl and successfully reached the server over HTTPS (the server returned HTTP 405 Method Not Allowed, which confirms that the HTTPS connection itself was established).

However, Codex CLI requests still fail with os error 10061.

codex doctor --json also reports a network-related failure when probing GitHub, including:

curl: (7) Failed to connect to api.github.com:443 over proxy 127.0.0.1: Could not connect to server

What steps can reproduce the bug?

1. On Windows 11, connect to the Internet normally.
2. Start iKuuu/OpenVXS and enable TUN mode.
3. Confirm that ChatGPT is accessible normally in a web browser.
4. Open Windows Terminal / PowerShell.
5. Run codex.
6. Send a simple prompt, for example: 你好，请只回复：连接成功.
7. Codex fails to initialize codex_apps MCP.
8. Codex falls back from WebSockets to HTTPS.
9. The request eventually fails with os error 10061 / stream disconnected before completion.
10. Run codex doctor --json. The report has an overall status of fail and also reports proxy/network connectivity problems.

What is the expected behavior?

Codex CLI should connect successfully through the active TUN-mode network configuration and return a response normally.

If WebSocket transport is unavailable and Codex falls back to HTTPS, the HTTPS transport should still be able to complete the request instead of failing with os error 10061.

The MCP connection to https://chatgpt.com/backend-api/ps/mcp should also initialize successfully.

Additional information

Additional troubleshooting performed:

• Codex CLI version: 0.147.0
• Model: gpt-5.6-sol
• Platform: Microsoft Windows NT 10.0.26200.0 x64
• Proxy/VPN application: iKuuu/OpenVXS
• Network mode: TUN
• Browser access to ChatGPT works normally.
• DNS resolution for chatgpt.com succeeds.
• A direct HTTPS test to the ChatGPT backend reached Cloudflare/OpenAI successfully and returned HTTP 405 Method Not Allowed, indicating that the HTTPS connection itself could be established.
• Codex CLI nevertheless fails when sending requests to the Codex backend.
• I temporarily removed the HTTP_PROXY and HTTPS_PROXY environment variables and ran codex doctor --json again. The doctor report still attempted to connect through 127.0.0.1 and reported a proxy/network connection failure.

This appears to be specific to how Codex CLI handles the proxy/TUN networking path rather than a general inability to reach chatgpt.com.

I found #34312, which reports a similar Windows os error 10061 after the WebSocket-to-HTTPS fallback. However, that issue was reported on Codex CLI 0.144.6 and is now closed. I can still reproduce the problem on 0.147.0, and in my case it also affects the codex_apps MCP connection and appears related to TUN/proxy handling.