feat(cpython): own requests and httpx modules over the HTTP bridge

[chaliy]

What changed

import requests, import httpx and import httpx2 work in the CPython (cpython feature) python3. They are bashkit's own compact implementations of the common API, written on top of the HTTP bridge from #2568, so every request still goes through the network allowlist, SSRF checks, credential injection and the response cap. They are preloaded in the snapshot, so importing them costs nothing.

• requests: the verb helpers and Session, along with params, data, json, files, headers, cookies, basic auth, timeouts, redirects and hooks. Response helpers, and the upstream exception hierarchy.
• httpx / httpx2: the verb helpers and stream(), plus Client and AsyncClient with base_url, follow_redirects, event hooks and MockTransport. Also URL, Headers, QueryParams, Cookies, Timeout, codes, and the upstream exceptions.
• Out of scope: retries, proxies, client certificates, HTTP/2, digest auth, streaming uploads, and OPTIONS. Documented as L-CPY-010.
• Response cookies are sent back only to their own host. Authorization is dropped on a cross-host redirect. Each redirect hop is re-checked by the host.
• A http.client read timeout now surfaces from getresponse(), as in CPython.

Why

Upstream requests + urllib3 + idna + charset_normalizer import 155 modules and cost ~3.1 s per call on Pulley (urllib3 alone 1.3 s). Every call starts from the snapshot, so that cost repeats on every call. Agents mostly use the common API surface.

Before / After

Before: python3 -c 'import requests' gives ModuleNotFoundError. Bundling upstream made the same call take ~3.1 s.

After (criterion, Pulley):

Benchmark	Time
python_call/cpython/print	4.03 ms
python_import/cpython/requests_httpx (import requests, httpx)	3.87 ms

Differential test vs upstream requests 2.34.2 / httpx 0.28.1 (same 9 scenarios, shared fake server, output must match line for line):

ok   requests_basics
ok   requests_errors
ok   requests_redirects
ok   requests_session_and_body
ok   httpx_basics
ok   httpx_errors_and_redirects
ok   httpx_client_and_async
ok   requests_misc
ok   httpx_misc
{"scenarios": 9, "failed": 0}

It caught two divergences, both fixed: True in requests params, and httpx's Host header.

Risk

• Medium
• Scripts relying on features outside the subset (retries, proxies, HTTP/2) behave differently from upstream. Those options are accepted and ignored, or fail with a clear exception.
• The CPython crate grows to 9.8 MiB (still under the crates.io cap; a follow-up moves the snapshot to xz).

Checklist

• Tests added or updated: 11 new integration tests through the real bridge, covering gzip, charset fallback, 303/307 rules, redirect loops, cross-host auth drop, CRLF rejection, the request cap, hooks, streams and async. Also the differential test, run as a CI step.
• Backward compatibility considered: new modules only; the capability case that expected import requests to fail now checks numpy.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	563a489	Commit Preview URL Branch Preview URL	Oct 07 2026, 03:55 PM