Lock upstream wire contract; harden auth, refresh, and consume idempotency - #4
Merged
Conversation
…me idempotency Verify codex-reset against current openai/codex (analyzed 2026-07-13..2026-08-16) by pinning the wire contract in tests instead of hand-copied constants, and fix the auth/routing/retry defects an adversarial review of that analysis exposed. Contract lock: - injectable HTTP transport (core/http.ts) + CODEX_RESET_BASE_URL override; production path unchanged and now regression-tested against a live socket - tools/extract-upstream-manifest.mjs generates the semantic manifest from 11 upstream Rust files; test/upstream-contract.test.ts asserts endpoints, consume request/response, snake_case codes, window fields, plan display names, JWT claims, auth-file schema, headers, refresh and whoami contracts against it and live-diffs a re-extraction when a checkout is present Defect hardening: - idempotent consume: persist redeem_request_id before the POST, reuse it across invocations on ambiguous outcomes (timeout / malformed 2xx / 5xx), warn when a different credit or a >24h record forces a fresh key (core/idempotency.ts) - FedRAMP: read chatgpt_account_is_fedramp, send X-OpenAI-Fedramp: true - PAT accounts: hydrate via the upstream whoami endpoint instead of dropping - token refresh: proactive (exp claim) + reactive (401 -> refresh -> retry once), rotation persisted atomically, upstream-parity failure messages surfaced - account-id precedence matches upstream (tokens.account_id -> claim -> orgs) - plan labels from KnownPlan::display_name() (ent26 -> Enterprise, etc.) - error matrix: 403/429+Retry-After/5xx/HTML/empty/oversized/network messages - auth-mode matrix: apikey/agentIdentity/bedrock/token-less files skipped with warnings instead of silently; organizations + profile.email fallbacks Tests: 52 -> 123, all green; production transport covered end to end.
Weekly (and manual) job regenerates the upstream manifest from a sparse openai/codex clone, uploads the drift diff as an artifact, and opens or updates an issue on drift. When the check itself fails (extractor crash on an upstream refactor), a separate always()+failure() step opens an upstream-drift-broken issue so drift tracking cannot die silently. The job is continue-on-error and never runs on pull requests. README: supported auth modes table (chatgpt / personalAccessToken via whoami / apikey+agent+bedrock skipped with warnings), file-storage-only credential model (keyring not read), token refresh + rotation behavior, FedRAMP routing header, precise idempotent-redemption guarantee with its limits, env overrides, and manifest maintenance instructions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings codex-reset to verified compatibility with current
openai/codex(analysis window 2026-07-13 → 2026-08-16, HEADb3cc21737) by pinning the wire contract in tests rather than hand-copied constants, and remediates the defects an adversarial review of that analysis exposed. Includes a second adversarial review pass over the implementation itself; all its actionable findings are fixed here (one rejected as noise, documented below).Contract lock (Phase 1)
src/core/http.ts) +CODEX_RESET_BASE_URLoverride. Production behavior unchanged — now regression-tested against a live localhost socket (test/http-transport.test.ts).tools/extract-upstream-manifest.mjs→test/fixtures/upstream-manifest.json): generated from 11 Rust files in a pinned checkout — endpoints, consume request/response fields, snake_case result codes, window fields, plan display names, JWT claim namespaces,AuthDotJsonschema, headers, refresh grant, PAT whoami. Never hand-edited.test/upstream-contract.test.ts) assert the tool's request boundary against the manifest, and live re-extract + deep-compare when a checkout is present.Defect hardening (Phase 2)
X-OpenAI-Fedramp: trueemitted for FedRAMP accountsexp) + reactive (401 → refresh → retry once); rotation persisted atomically; upstream-parity failure messages surfaced in the 401 hinttokens.account_id→ claim → organizations (last-resort discovery only)KnownPlan::display_name()map (ent26→ "Enterprise",enterprise_cbp_automation→ "Enterprise (Automation)", …) with graceful unknown-value fallbackDrift prevention (Phase 3)
Weekly non-blocking
upstream-driftworkflow: regenerates the manifest from upstream HEAD, uploads the drift diff, opens/updates an issue on drift — and opens anupstream-drift-brokenissue if the check itself fails, so drift tracking cannot die silently.Verification
npm ci && build && typecheck && lint && test→ 123/123 green (baseline was 52), exit 0AuthDotJson/registry.jsonschemaNot in scope (unchanged)
Zero-dependency constraint, spend-control display (feature, deferred), keyring-backed credential storage (documented file-only), no live
resetexecution against real credits.