Preserve Cloudfare HTTP cookies in codex

codex-rs/Cargo.toml

@@ -295,7 +295,7 @@ ratatui = "0.29.0"
 ratatui-macros = "0.6.0"
 regex = "1.12.3"
 regex-lite = "0.1.8"
-reqwest = "0.12"
+reqwest = { version = "0.12", features = ["cookies"] }
 rmcp = { version = "0.15.0", default-features = false }
 runfiles = { git = "https://github.com/dzbarsky/rules_rust", rev = "b56cbaa8465e74127f1ea216f813cd377295ad81" }
 rustls = { version = "0.23", default-features = false, features = [

codex-rs/app-server/src/transport/remote_control/protocol.rs

@@ -105,7 +105,7 @@ pub(crate) struct ServerEnvelope {
     pub(crate) seq_id: u64,
 }
 
-fn is_allowed_chatgpt_host(host: &Option<Host<&str>>) -> bool {
+fn is_allowed_remote_control_chatgpt_host(host: &Option<Host<&str>>) -> bool {
     let Some(Host::Domain(host)) = *host else {
         return false;
     };
@@ -156,7 +156,7 @@ pub(super) fn normalize_remote_control_url(
         .map_err(map_url_parse_error)?;
     let host = enroll_url.host();
     match enroll_url.scheme() {
-        "https" if is_localhost(&host) || is_allowed_chatgpt_host(&host) => {
+        "https" if is_localhost(&host) || is_allowed_remote_control_chatgpt_host(&host) => {
             websocket_url.set_scheme("wss").map_err(map_scheme_error)?;
         }
         "http" if is_localhost(&host) => {
@@ -232,6 +232,7 @@ mod tests {
             "http://chatgpt.com/backend-api",
             "http://example.com/backend-api",
             "https://example.com/backend-api",
+            "https://chat.openai.com/backend-api",
             "https://chatgpt.com.evil.com/backend-api",
             "https://evilchatgpt.com/backend-api",
             "https://foo.localhost/backend-api",

codex-rs/backend-client/src/client.rs

@@ -6,6 +6,7 @@ use crate::types::RateLimitStatusPayload;
 use crate::types::TurnAttemptsSiblingTurnsResponse;
 use anyhow::Result;
 use codex_client::build_reqwest_client_with_custom_ca;
+use codex_client::with_chatgpt_cloudflare_cookie_store;
 use codex_login::CodexAuth;
 use codex_login::default_client::get_codex_user_agent;
 use codex_protocol::account::PlanType as AccountPlanType;
@@ -137,7 +138,9 @@ impl Client {
         {
             base_url = format!("{base_url}/backend-api");
         }
-        let http = build_reqwest_client_with_custom_ca(reqwest::Client::builder())?;
+        let http = build_reqwest_client_with_custom_ca(with_chatgpt_cloudflare_cookie_store(
+            reqwest::Client::builder(),
+        ))?;
         let path_style = PathStyle::from_base_url(&base_url);
         Ok(Self {
             base_url,