Use the shared HTTP client in codex-protocol (#36033)

## What changed

- Replace direct `reqwest` error types in `codex-protocol` with
  `codex_http_client::HttpError`.
- Build the response-stream error test through
  `codex_http_client::HttpResponse`.
- Remove `codex-protocol` from the direct `reqwest` dependency allowlist.

## Testing

- Update the response-stream failure test to cover status and URL propagation
  through the shared HTTP response wrapper.

GitOrigin-RevId: 7abcbbe55f994acb13cccefef806a53c7008acde

codex-rs/Cargo.lock

@@ -3821,6 +3821,7 @@ dependencies = [
  "codex-async-utils",
  "codex-execpolicy",
  "codex-extension-items",
+ "codex-http-client",
  "codex-network-proxy",
  "codex-utils-absolute-path",
  "codex-utils-image",
@@ -3835,7 +3836,6 @@ dependencies = [
  "landlock",
  "pretty_assertions",
  "quick-xml 0.41.0",
- "reqwest 0.12.28",
  "schemars 0.8.22",
  "seccompiler",
  "serde",

codex-rs/deny.toml

@@ -243,7 +243,6 @@ deny = [
         "codex-core",
         "codex-ollama",
         "codex-otel",
-        "codex-protocol",
         "codex-responses-api-proxy",
         # Third-party crates that own their reqwest integration. These are not part of the
         # first-party migration count above.

codex-rs/protocol/Cargo.toml

@@ -18,6 +18,7 @@ chrono = { workspace = true, features = ["serde"] }
 codex-async-utils = { workspace = true }
 codex-execpolicy = { workspace = true }
 codex-extension-items = { workspace = true }
+codex-http-client = { workspace = true }
 codex-network-proxy = { workspace = true }
 codex-utils-absolute-path = { workspace = true }
 codex-utils-image = { workspace = true }
@@ -25,11 +26,11 @@ codex-utils-path-uri = { workspace = true }
 codex-utils-string = { workspace = true }
 encoding_rs = { workspace = true }
 globset = { workspace = true }
+http = { workspace = true }
 icu_decimal = { workspace = true }
 icu_locale_core = { workspace = true }
 icu_provider = { workspace = true, features = ["sync"] }
 quick-xml = { workspace = true, features = ["serialize"] }
-reqwest = { workspace = true }
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
@@ -54,7 +55,6 @@ seccompiler = { workspace = true }
 
 [dev-dependencies]
 anyhow = { workspace = true }
-http = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 

codex-rs/protocol/src/error.rs

@@ -15,9 +15,10 @@ use chrono::Datelike;
 use chrono::Local;
 use chrono::Utc;
 use codex_async_utils::CancelErr;
+use codex_http_client::HttpError;
 use codex_utils_string::truncate_middle_chars;
 use codex_utils_string::truncate_middle_with_token_budget;
-use reqwest::StatusCode;
+use http::StatusCode;
 use serde_json;
 use std::fmt;
 use std::io;
@@ -470,7 +471,7 @@ impl CodexErr {
 
 #[derive(Debug)]
 pub struct ConnectionFailedError {
-    pub source: reqwest::Error,
+    pub source: HttpError,
 }
 
 impl std::fmt::Display for ConnectionFailedError {
@@ -481,7 +482,7 @@ impl std::fmt::Display for ConnectionFailedError {
 
 #[derive(Debug)]
 pub struct ResponseStreamFailed {
-    pub source: reqwest::Error,
+    pub source: HttpError,
     pub request_id: Option<String>,
 }
 

codex-rs/protocol/src/error_tests.rs

@@ -5,12 +5,10 @@ use chrono::DateTime;
 use chrono::Duration as ChronoDuration;
 use chrono::TimeZone;
 use chrono::Utc;
-use http::Response as HttpResponse;
+use codex_http_client::HttpResponse;
+use http::Response as RawHttpResponse;
+use http::StatusCode;
 use pretty_assertions::assert_eq;
-use reqwest::Response;
-use reqwest::ResponseBuilderExt;
-use reqwest::StatusCode;
-use reqwest::Url;
 use std::time::Duration;
 
 #[test]
@@ -224,12 +222,14 @@ fn sandbox_denied_reports_stdout_when_no_stderr() {
 
 #[test]
 fn to_error_event_handles_response_stream_failed() {
-    let response = HttpResponse::builder()
+    let response = RawHttpResponse::builder()
         .status(StatusCode::TOO_MANY_REQUESTS)
-        .url(Url::parse("http://example.com").unwrap())
         .body("")
         .unwrap();
-    let source = Response::from(response).error_for_status_ref().unwrap_err();
+    let source = HttpResponse::from(response)
+        .error_for_status_ref()
+        .unwrap_err()
+        .with_url("http://example.com".parse().unwrap());
     let err = CodexErr::ResponseStreamFailed(ResponseStreamFailed {
         source,
         request_id: Some("req-123".to_string()),