Bug: Codex subscription catalog validation times out behind an HTTP proxy on VPN, while completions succeed

[veny]

Issue details

I am using fx 0.0.10 on Arch Linux behind a corporate VPN. All outbound HTTP(S) traffic must traverse a corporate forward proxy.

Proxy configuration:

http_proxy=http://<corporate-proxy>:80
https_proxy=http://<corporate-proxy>:80
no_proxy=localhost,127.0.0.1,<internal CIDRs and corporate domains>

I also tested with uppercase and generic proxy variables:

HTTP_PROXY="$http_proxy" \
HTTPS_PROXY="$https_proxy" \
ALL_PROXY="$https_proxy" \
NO_PROXY="$no_proxy" \
FX_TRACE=1 \
FX_TRACE_STDERR=1 \
FX_TRACE_LOG=/tmp/fx-codex.trace \
fx ask "where is Prague?"

fx login codex completes browser OAuth successfully. However, /setup codex waits several minutes and then reports:

provider: Subscription sign-in completed, but its model catalog could not be validated. The current provider is unchanged.

The same fx ask request waits about 272 seconds for the catalog/version lookup to time out, then completes successfully through the Codex subscription.

The official Codex CLI and OpenCode work through the same VPN/proxy configuration. fx also works correctly when disconnected from the VPN, which bypasses the corporate proxy path.

Expected behavior:

the catalog/version request should honor the same proxy configuration as the successful generation request. At minimum, fx should use the cached version immediately rather than blocking for several minutes, and should permit the Codex provider to become active.

Trace

1790245463803 [agent] event=prompt_start turn_id=1 prompt_bytes=16 model=gpt-6-sol
1790245463803 [agent] event=provider_admitted model=gpt-5.6-luna

1790245735576 [stream] bounded termination cause=deadline phase=control
1790245735576 [models] provider version lookup failed provider=codex err=Timeout
1790245735576 [models] provider version lookup unavailable provider=codex; using cached version=0.156.1

1790245735579 [stream] bounded termination cause=deadline phase=admission
1790245735579 [catalog] event=model_catalog_load requested_access=authenticated credential_source=chatgpt_subscription
effective_access=authenticated public_only_reason=none anonymous_fallback=false outcome=failed failure_category=transport
http_status=none retryable=true
1790245735579 [gateway] model catalog refresh failed category=transport retained=false
1790245735579 [gateway] model catalog lookup outcome=cache_failed model=gpt-6-sol

1790245735580 [gateway] event=credential_refreshed turn_id=1 step_id=1 source=chatgpt_subscription mode=if_needed
1790245735583 [agent] event=provider_admitted turn_id=1 step_id=1 model=gpt-6-sol

--- (my comment) The terminal rendered the successful response between the following entries:
Prague is the capital of the Czech Republic, in Central Europe.

1790245740858 [agent] event=assistant_completion turn_id=1 step_id=1 content_bytes=63 tool_call_count=0 finish_reason=stop
1790245740862 [agent] event=prompt_finish turn_id=1 outcome_kind=assistant

Sensitive information

• I reviewed the information above and removed secrets and other sensitive data.