fix: serialize NO_PROXY sanitization across concurrent client constructions

Addresses Codex P2: when two SDK default clients are constructed
concurrently while NO_PROXY contains a newline, one call can enter the
context after another already sanitized the process-wide env, record no
original value, and then the first call restores the invalid value before
the second call's super().__init__() reaches httpx's env proxy parsing.
That leaves the second client exposed to the same InvalidURL this change
is trying to prevent.

Added a module-level threading.Lock (_no_proxy_sanitizer_lock) that wraps
the entire sanitize-construct-restore window in _sanitized_no_proxy, so
concurrent client constructions are serialized and each call sees a
consistent environment. Added test_concurrent_client_construction_serializes_sanitization
that spawns 10 threads constructing clients with a newline NO_PROXY and
verifies no errors and the original value is restored.

Author: rkfshakti

src/openai/_base_client.py

@@ -11,6 +11,7 @@
 import logging
 import platform
 import warnings
+import threading
 import contextlib
 import email.utils
 from types import TracebackType
@@ -833,6 +834,9 @@ def _idempotency_key(self) -> str:
         return f"stainless-python-retry-{uuid.uuid4()}"
 
 
+_no_proxy_sanitizer_lock = threading.Lock()
+
+
 @contextlib.contextmanager
 def _sanitized_no_proxy() -> Iterator[None]:
     """Temporarily normalize line separators in NO_PROXY/no_proxy for the
@@ -846,21 +850,26 @@ def _sanitized_no_proxy() -> Iterator[None]:
     sanitized value to be visible for that window and then restore the original
     afterwards — this avoids permanently mutating process-global state for
     unrelated clients.
+
+    A module-level lock serializes concurrent client constructions so that one
+    call cannot restore the original (invalid) value while another call's
+    ``super().__init__()`` is still reading the environment.
     """
-    originals: dict[str, str] = {}
-    try:
-        for key in ("NO_PROXY", "no_proxy"):
-            val = os.environ.get(key)
-            if val and any(c in val for c in "\n\r"):
-                originals[key] = val
-                # splitlines() handles \n, \r, \r\n, and other Unicode line
-                # separators uniformly.
-                parts = [part.strip() for part in val.splitlines()]
-                os.environ[key] = ",".join(p for p in parts if p)
-        yield
-    finally:
-        for key, val in originals.items():
-            os.environ[key] = val
+    with _no_proxy_sanitizer_lock:
+        originals: dict[str, str] = {}
+        try:
+            for key in ("NO_PROXY", "no_proxy"):
+                val = os.environ.get(key)
+                if val and any(c in val for c in "\n\r"):
+                    originals[key] = val
+                    # splitlines() handles \n, \r, \r\n, and other Unicode line
+                    # separators uniformly.
+                    parts = [part.strip() for part in val.splitlines()]
+                    os.environ[key] = ",".join(p for p in parts if p)
+            yield
+        finally:
+            for key, val in originals.items():
+                os.environ[key] = val
 
 
 class _DefaultHttpxClient(httpx.Client):

tests/test_no_proxy_sanitize.py

@@ -7,6 +7,8 @@
 
 from __future__ import annotations
 
+import os
+
 import pytest
 
 
@@ -197,3 +199,36 @@ def test_aiohttp_client_trust_env_false_skips_sanitization(monkeypatch: pytest.M
 
     assert os.environ.get("NO_PROXY") == "localhost\n127.0.0.1"
     assert client._mounts == {}
+
+
+def test_concurrent_client_construction_serializes_sanitization(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Concurrent client constructions must not race on the env mutation.
+
+    Without the lock, one call could restore the original (invalid) NO_PROXY
+    value while another call's ``super().__init__()`` is still reading the
+    environment, exposing the second client to InvalidURL.  The lock
+    serializes the sanitize-construct-restore window so each call sees a
+    consistent environment.
+    """
+    import threading
+
+    from openai._base_client import _DefaultHttpxClient
+
+    _set_no_proxy(monkeypatch, "localhost\n127.0.0.1")
+    errors: list[Exception] = []
+
+    def construct() -> None:
+        try:
+            _DefaultHttpxClient()
+        except Exception as exc:
+            errors.append(exc)
+
+    threads = [threading.Thread(target=construct) for _ in range(10)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    assert not errors, f"Concurrent constructions failed: {errors}"
+    # The original (invalid) value must be restored after all constructions
+    assert os.environ.get("NO_PROXY") == "localhost\n127.0.0.1"