core-plugins: route remote requests through HTTP client factory

[bolinfest]

Why

features.respect_system_proxy only works consistently when every remote-plugin request uses the route-aware service state established from the effective HttpClientFactory. Direct reqwest construction bypassed that policy, while returning a selected transport client would still allow the eventual request URL to diverge from the URL used for PAC/system-proxy routing.

The shared service configuration and curated startup-sync migration now live in #31924, leaving this PR focused on consuming that state for remote plugin APIs and backend-issued upload/download destinations.

What changed

• Add request-builder helpers to RemotePluginServiceConfig so route selection stays coupled to the eventual request URL.
• Route catalog reads, featured-plugin discovery, mutations, sharing, signed uploads, and bundle downloads through the shared abstraction.
• Build query strings before request creation and route backend-issued upload/download destinations independently.
• Collapse now-impossible client-construction error branches into the request error path.
• Remove the direct reqwest dependency and temporary deny.toml exception from codex-core-plugins.
• Add recording-selector coverage for complete query URLs and backend-issued destinations without expanding the public API.

Review guide

1. Start with the small RemotePluginServiceConfig::{http_request,catalog_request} additions in remote.rs; the selector/config foundation is reviewed in core-plugins: route curated startup sync through HTTP client factory #31924.
2. Review remote.rs, remote/share.rs, remote_legacy.rs, and remote_bundle.rs by request family.
3. Review the signed upload and bundle-download paths carefully: both choose a route from the backend-issued destination, not the preceding API URL.
4. The recording selector in test_support.rs verifies complete query URLs and backend-issued destinations.

Validation

• The commit builds independently with cargo check -p codex-core-plugins -p codex-core -p codex-app-server --tests.
• Route-recording, upload/download, and remote catalog tests in codex-core-plugins.

---

Stack created with Sapling. Best reviewed with ReviewStack.

• -> core-plugins: route remote requests through HTTP client factory #31837
• core-plugins: route curated startup sync through HTTP client factory #31924
• app-server-daemon: route updater download through HTTP client factory #31828
• cloud-tasks: route environment requests through HTTP client factory #31825
• backend-client: route requests through HTTP client factory #31821
• http-client: add route-aware redirect handling #31918
• http-client: add safe route-aware request pool #31917
• http-client: make proxy route fallback explicit #31916

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/backend-client/Cargo.toml

Lines 19 to 20 in daf617a

	http = { workspace = true }
	url = { workspace = true }

Refresh the Bazel cargo lock after dependency changes

This patch changes Rust dependencies in Cargo.toml/Cargo.lock, but the diff does not include an updated MODULE.bazel.lock. The repo requires running just bazel-lock-update for dependency changes, and CI verifies lockfile drift, so this will block the Bazel lockfile check until the generated lock update is committed.

AGENTS.md reference: AGENTS.md:L37-L39

---

codex/codex-rs/http-client/src/route_aware_client_pool.rs

Lines 84 to 88 in daf617a

	self.client_for_url_with_resolver(request_url, move |request_url| async move {
	http_client_factory
	.resolve_proxy_route_async(request_url)
	.await
	})

Re-resolve proxy routes when redirects change hosts

When respect_system_proxy is enabled, this resolves PAC/system proxy routing only for the original request_url and then sends the request with a reqwest client fixed to that Direct/Proxy route. Reqwest follows redirects inside the same client, so redirecting requests such as the GitHub zipball API URL used by curated plugin sync (which redirects to a different host) will not re-run PAC/NO_PROXY selection for the redirected URL; in environments where the redirect target uses a different proxy decision, the request can fail or bypass the required proxy. Consider disabling automatic redirects for route-aware callers and following them after resolving the next URL, or otherwise making redirect routing re-evaluate the final destination.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".