bug(codex): refresh path still ignores per-auth/Auth File proxy on latest version

[tdlrobin]

Hi, I'm opening a new bug report because this still appears reproducible on the latest version, and the previous discussion/closed reports did not resolve the actual issue.

Related:

• bug(codex): token refresh ignores configured proxy and fails with 403 unsupported_country_region_territory unless system-wide proxy is enabled #2812 (closed as Q&A / region-related answer, but my issue is about proxy handling in refresh path)
• openai_auth.go:285 认证文件配了代理，刷新token的时没有使用指定的代理导致刷新token一直报错 #2180
• Feature: Per-OAuth-Account Outbound Proxy Enforcement for Google (Gemini/Antigravity) + OpenAI Codex – incl. Token Refresh and optional Strict/Fail-Closed Mode #1508

Observed behavior:

• Normal Codex usage works when using the proxy configured in the Auth File
• Token refresh fails with 403 unsupported_country_region_territory
• If I enable a system-wide/global proxy, the same token refresh succeeds immediately

Why this seems to be a bug:

• Normal request flow respects the Auth File proxy
• Refresh flow appears to use a different HTTP client or different proxy source
• The 403 is therefore a symptom of the refresh request not using the configured per-auth proxy

Expected behavior:
Token refresh should use the same per-auth/Auth File proxy settings as normal Codex requests.

Please treat this as a bug in proxy inheritance for the refresh path, not just a region-support question.

Environment:

• CLIProxyAPI version: v6.9.28-0-plus
• Auth method: Codex auth file
• Proxy works for normal requests: yes
• Refresh works only with system/global proxy: yes

Minimal repro:

1. Configure proxy only in Auth File / per-auth settings
2. Start Codex and confirm normal requests succeed
3. Wait for token refresh
4. Refresh fails with 403 unsupported_country_region_territory
5. Enable system/global proxy
6. Retry refresh
7. Refresh succeeds