[Zakaria Khchiche (Zakariakhchiche)]

Motivation & Context

When the TypeSafe connector creates its own AsyncTypeSafeClient, it passes a custom _ApiKeyTransport. httpx2 reads HTTPS_PROXY, HTTP_PROXY, ALL_PROXY and NO_PROXY only when no custom transport is given, so these settings are ignored and the connector cannot reach TypeSafe from behind a proxy. The SDK on its own works in the same environment.

The transport only sets Authorization: Bearer <api_key>, which typesafe-sdk 0.7.1 and 0.7.2 already send. The SDK redacts that header in log records and exception messages, not on the wire.

Description & Review Guide

• What are the major changes?
  • Remove _ApiKeyTransport from _chat_client.py. The SDK builds its default transport and sends the bearer header itself.
  • Update the AGENTS.md note: connector-owned clients rely on the SDK for the Bearer header and keep its transport, so proxy settings apply. Transport-level tests still verify the outgoing header.
  • Tests: test_owned_client_sends_configured_api_key_on_wire now injects a MockTransport through the SDK's public transport parameter and still asserts Bearer configured-api-key. New test_owned_client_honors_proxy_environment sets HTTP_PROXY to a local proxy and checks that the request and its Authorization header go through it. Both tests fail on main.
• What is the impact of these changes? Connector-owned clients now follow the standard proxy environment variables, like AsyncTypeSafeClient. The Authorization header on the wire is unchanged. Injected SDK clients are not affected.
• What do you want reviewers to focus on? Whether the SDK should own the HTTP transport here. httpx2 stays a declared dependency because the tests import it directly.

Related Issue

Fixes #8983

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 1 · 1

Open (2)

• writer.close() is not awaited, which can leave the TCP connection half-closed until the event… · New
• This helper will raise TypeError: got multiple values for keyword argument 'transport' if the… · New

What changed in this PR

This PR updates the Python TypeSafe connector so connector-owned SDK clients honor standard proxy environment variables by no longer replacing the SDK’s default HTTP transport.

Changes:

• Removed the custom _ApiKeyTransport so the TypeSafe SDK owns the transport and proxy env vars (HTTP[S]_PROXY, NO_PROXY, etc.) apply.
• Updated tests to inject MockTransport via the SDK’s public transport parameter and added a new proxy-honoring test.
• Updated AGENTS.md to reflect the new transport/authorization behavior.

File	Description
python/​packages/​typesafe/​agent_framework_typesafe/​_chat_client.py	Removes custom transport so SDK transport is used (enables proxy env support).
python/​packages/​typesafe/​tests/​typesafe/​test_chat_client.py	Adjusts existing auth-header test and adds a new proxy env var test.
python/​packages/​typesafe/​AGENTS.md	Documents that connector-owned clients rely on SDK transport + SDK-sent bearer header.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Zakaria Khchiche (Zakariakhchiche)]

Addressed both automated review notes in 1471efa:

• The fake proxy now awaits writer.wait_closed() after writer.close().
• create_client now asserts that the connector passes neither transport nor http_client. A regression now fails with a clear assertion instead of a TypeError about a duplicate keyword argument, which is the behavior this test guards.

The package tests (85), ruff and poe test-typing -P typesafe pass.