Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The Codex CLI 0.167.0 changelog says macOS and Windows users can opt into system proxy settings from /experimental. PR #58157 records the respect_system_proxy flag as disabled by default and requires a restart.
- For manual configuration, use a supported config.toml defaults source or managed_config.toml and set respect_system_proxy = true in the features table. Project-local configuration cannot enable it.
- Current official documentation limits it to network clients owned by the Codex runtime. Windows and macOS support native system proxy discovery; other platforms use proxy environment settings or direct connections.
- A PAC result selects one route, with no retry through later entries after a connection fails. The separate system_proxy_fallback is on by default and can retry only supported sign-in and cloud-configuration requests after certain connection failures.
The 0.167.0 switch is off by default
OpenAI lists the system proxy option in the November 6, 2026 Codex CLI 0.167.0 update: macOS and Windows users can opt into System proxy from /experimental. The linked merge #58157 names the feature respect_system_proxy, keeps it disabled by default, and requires a restart after a change.
A system proxy is an operating-system setting that gives applications a connection route. Installing a newer CLI and enabling this experimental option are separate actions. An existing OS proxy setting alone does not establish that a particular Codex request uses it. Check the CLI version and experimental menu in the installation and on the host actually running.
Enable it from /experimental, then restart
Open /experimental in the CLI you actually use, find System proxy, and enable it. Restart Codex after the change, then check the same client connection. Installing 0.167.0 without enabling the option does not establish that system proxy configuration is active.
To turn off an enabled setting, change respect_system_proxy to false in the same configuration source that enabled it, then restart Codex. If the experimental control is how it was enabled, turn off the same System proxy control. This changes respect_system_proxy only; it does not automatically disable the separate sign-in and cloud-configuration fallback.
Use a supported configuration source
The current official managed configuration documentation shows two TOML lines: [features], followed by respect_system_proxy = true. Use a supported config.toml defaults source or managed_config.toml; project-local configuration cannot enable this setting. Save the change and restart the client.
For an organization-managed Mac, the documentation also allows the same TOML in the MDM config_toml_base64 value. Have the administrator confirm a supported source and record which layer enables it. To disable it, change the source that enabled it as the documentation directs, rather than repeatedly editing project files to infer whether the switch is active.
Which requests does it affect, and when can it connect directly?
The current documentation limits the switch to network clients owned by the local Codex runtime. It does not configure every ChatGPT desktop request, browser request, plugin process, or shell command, and it does not enforce a destination allowlist or guarantee that direct connections are blocked. Check the type of request that originally failed; enabling the switch does not establish that all device traffic uses the proxy.
The documentation says macOS and Windows support native system proxy discovery. If system resolution is unavailable, explicit proxy environment settings take over when present; otherwise the runtime connects directly. Other platforms use environment settings or direct connections without the same native discovery. These are current runtime documentation details, not a claim that every routing behavior has been verified in every 0.167.0 package or desktop version.
PAC routing and sign-in fallback are separate
PAC is a configuration that selects a proxy route for a request using rules. Current documentation says the runtime chooses one route from the PAC result. If it fails, the runtime does not try later proxy or DIRECT entries. Several alternatives in the PAC list therefore do not mean the client will cycle through them.
system_proxy_fallback is a separate feature that the current managed documentation says is enabled by default. After certain connection failures, it can retry supported sign-in and cloud-configuration requests through the system proxy, even when respect_system_proxy is false. Setting respect_system_proxy to false does not turn off the fallback; the fallback also does not guarantee that every application request will recover.
Separate proxy routing from authentication errors
If direct access fails and sign-in fallback is unavailable, disabled, or unsuccessful, the managed documentation says to enable respect_system_proxy through supported local configuration before sign-in. For a deployment, check sign-in and an authenticated request with the actual client versions and networks. The system proxy setting alone does not establish whether a browser, plugin, or shell uses the same route.
An HTTP 407 from the Windows proxy during tunnel setup calls for checking its authentication method; enabling system proxy does not guarantee that every 407 disappears. For authentication scope, see https://puppyip.com/en/resources/codex-cli-windows-proxy-auth-negotiate-ntlm-v0164 . For timeout, DNS and TLS layers, see https://puppyip.com/en/resources/proxy-connection-troubleshooting-checklist . Do not disable certificate checks or disclose real proxy credentials to force a connection.
Sources
Frequently Asked Questions
Will a remote Linux development host use my local Windows system proxy?
Do not infer that from the local switch. Check the host and process actually running Codex. Current documentation describes other platforms as using their own proxy environment settings or direct connections, without Windows/macOS-style native system discovery. A working local browser does not establish the route used by a remote process.
What should I keep for a network administrator?
Record the actual client version, OS and runtime host, the configuration source that enabled the option, the check time, request category and a redacted error. Keep sign-in, authenticated requests and shell commands separate. Do not send tokens, Windows authentication material, real passwords or complete private configuration.