chore: closed connector write probe - #15
Closed
Wibias wants to merge 186 commits into
Closed
Conversation
codex-rs 0.147.x desktop voice (thread/realtime/start, standalone WebSocket transport) connects directly to /v1/realtime?intent=quicksilver&model= (V1), /v1/realtime?model= (RealtimeV2), or /v1/live?model= (Frameless) with no call_id. The proxy only recognized call-create POSTs and keyed sideband joins, so these upgrades fell through to the /v1/* guard and clients saw 'failed to connect realtime websocket: HTTP error: 404'. - parseLiveSidebandTarget: accept standalone /v1/realtime and /v1/live upgrade targets (present-but-invalid call_id stays a rejected join) - buildLiveSidebandUpstreamWsUrl: map standalone targets onto the canonical realtime root, preserving the client query verbatim - sanitizeStandaloneRealtimeQuery: drop credential-shaped query params (access_token/api_key/token/key/...) before upstream relay - loopback listener allowlist: admit the two standalone paths for WebSocket upgrades so a directly-spawned codex app-server keeps voice - tests: parser/builder/query-policy units, standalone e2e relays for both paths, auth/origin guard pins, loopback admission pins Plan: devlog/_plan/260812_realtime_standalone_ws/000_plan.md
…AVAS
Upstream codex-rs RealtimeCallClient posts Frameless API-shape
call-create to {base}/live with no AVAS query (realtime_call.rs); only
the realtime/calls inbound shape maps to the legacy keyed AVAS endpoint.
The keyed branch previously sent every inbound path to
/v1/realtime/calls?intent=quicksilver&architecture=avas, misrouting
Frameless session bodies to an endpoint that validates them as v1.
…thinking ladder DeepSeek-V4-Pro-0813 GA (2026-08-13): the official model table marks the Responses API for deepseek-v4-pro, the /responses reference accepts both V4 ids, and the thinking-mode table is now identical for flash and pro (low->low, xhigh->high). Registry gains the Responses wire default + terminal repair for v4-pro, the Pro ladder regains low, and the metadata bundle effort maps match. Tests updated from the pinned pre-GA behavior.
* fix(codex): preserve account-scoped native model ids * fix(codex): isolate observed account-native model ids * docs(codex): call the row check plausibility, not provenance Review follow-up on top of @Yuxin-Qiao's commits. The behavior is kept; what changes is the claim made about it. hasNativeCatalogProvenance checked only field shape — base_instructions non-empty, comp_hash string-or-null, shell_type, a reasoning-levels array, model_messages an object. There is no signature, source identity, or server attestation, and models_cache.json is a user-owned file, so a complete hand-written row passes. I reproduced that directly before changing anything: a forged gpt-* row with those fields is accepted. Calling that provenance is the problem, not the acceptance itself. It grants nothing new — router.ts already routes any bare gpt-* id under an account selector regardless of the catalog, so the effect is that a poisoned row gets ADVERTISED through discovery, not that a new route or credential becomes reachable. And anyone who can rewrite that cache can already edit config.json or run ocx directly. So the predicate is renamed to say what it does, the two docs pages drop the provenance language, and a test pins the accepting behavior with the reasoning attached. A future reader who wants rejection needs a real provenance signal, not a longer list of fields to match. The existing minimal-row test is kept and retitled: filtering malformed rows is what this check is actually for. --------- Co-authored-by: bitkyc08-arch <bitkyc08@gmail.com>
…n#1529) Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com>
* fix(provider): clamp Xiaomi MiMo public reasoning tiers * test(provider): record what the MiMo clamp does and does not govern Review follow-up on top of @Ingwannu's commit. The review flagged that a user reasoningEffortMap can lift a tier past the registry clamp, and that is true — I reproduced it: max resolves to max, not high. But it is the shipped contract, not an oversight. healMappedTiers treats a wire map as authoritative evidence of the tiers an upstream can emit and merges its Codex values into the ladder at lookup time. That is what lets a stale persisted ladder recover a newly documented tier without rewriting user config, and tests/reasoning-effort.test.ts pins it under 'stale reasoning-ladder self-heal'. I first tried making the clamp win. It broke two existing tests, because a mapped value like Kimi's is a legitimate non-Codex wire word, not a tier to compare against a ladder. Narrowing the clamp to Codex tiers only still fought healMappedTiers, so I reverted it: the right answer is that the registry clamp protects the DEFAULT route, and a user who writes a conflicting map has deliberately opted out. Two tests record that boundary — one for the default route where the clamp holds, one for the overriding map — so nobody later reads the clamp as an enforcement the code does not implement. --------- Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: bitkyc08-arch <bitkyc08@gmail.com>
* fix(claude): isolate native passthrough credentials * fix(server): align Anthropic listener policy --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…ts (lidge-jun#1471) Pins forwarded Codex credentials to the canonical ChatGPT host with a fail-closed path check, and stops the five credential-bearing sidecar fetches from following cross-origin redirects. Bun strips Authorization across origins but forwards nonstandard headers, so chatgpt-account-id, session_id and x-codex-turn-metadata would otherwise reach a redirect target. tests/credential-redirect-guard.test.ts pins both the sidecar family and the shared fetchWithHeaderTimeout helper. Co-authored-by: luvs01 <luvs01@users.noreply.github.com>
With the sidecar engaged, runWithWebSearch buffers every semantic adapter event of an iteration before scanning for web_search calls, so clients see nothing until the turn ends — 6-50s of silence, then the whole answer as one burst, on every routed-model turn (Codex sends the hosted web_search tool on every real turn). New config option webSearchSidecar.streamRoutedModelOutput (default false, behavior unchanged without opt-in): stream each iteration's leading text/thinking deltas live; the live window closes permanently at the first buffer-only event (tool calls above all), so web_search interception stays atomic, live events are exactly the first N passthrough entries, and the terminal replay skips them by count — nothing is delivered twice. Scanner semantics (thinking extraction, forced-answer output check) are unchanged. Verified: bun run test — 11197 pass / 0 fail (691 files); 4 new tests including a gated adapter proving live delivery mid-turn; tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ient receipt Address review: both tests previously asserted only final frames, which a fully buffered implementation also produces. They now withhold the tool call until the test has observed the leading delta on the wire (buffered delivery deadlocks the gate), and the tool-boundary test additionally asserts wire order: prefix delta -> function_call item -> suffix delta. Docs: note that Kiro commentary streaming is independent of the new option; devlog: qualify the reasoning-first-model claim (their leading reasoning becomes visible too — that visibility is the point). Verified: bun run test tests/web-search.test.ts — 55 pass / 0 fail; tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ad of releasing the gate The previous 5s guard called the adapter's release function on timeout, so a fully buffered implementation could still pass: the timer opens the gate, the terminal replay delivers the leading delta, and readUntil observes the replayed copy. The deadline now rejects the readUntil wait; the gate opens only after the client has genuinely observed the live delta. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…oggle on the overview page GET/PUT /api/sidecar-settings now carry webSearch.streamRoutedModelOutput (boolean; false is the default and removes the key so config files stay minimal), and the web-search sidecar card on the Dashboard overview gains a "Stream answers live" switch so the option is discoverable without editing config.json. Strings added to all eight locales. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…notes Swept in by a bulk add; the follow-up devlog in 260812_websearch_sidecar_live_streaming stands on its own. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…webSearch shape Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…utedModelOutput Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rt durable persistence CodeRabbit round 4: the dashboard hint implied the whole turn streams — reworded in all eight locales to say leading text/reasoning streams until the model decides on a tool call, with the rest buffered for search interception. The sidecar-settings test now reloads the config from disk after each PUT and asserts the flag survives (true persists, false removes the key); the fixture gained a schema-valid provider because loadConfig() discards invalid files wholesale, which would have voided the reload assertions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
) Replaces credential-bearing live provider updates with an attested bodyless POST /api/providers/reload, binding a single-use capability to provider, method, exact path, nonce, PID, port and expiry, verified with timingSafeEqual. Also reports a reload the running proxy could not accept, so a CLI talking to a pre-attestation proxy no longer prints unconditional success while the live process keeps the previous credential. Co-authored-by: luvs01 <luvs01@users.noreply.github.com>
Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Adds an experimental, config-only recovery path for native Codex v2 NEW_TASK messages whose payload is backend-encrypted. Disabled by default; when enabled it accepts only a native Codex ChatGPT credential from a loopback caller and sends it only to the compiled-in ChatGPT Codex endpoint, with redirect: error. Recovered plaintext is barred from the persisted continuation cache: recovery mutates the request input in place, so the body would otherwise have been written to responses-state.json with no TTL. Co-authored-by: soulbah <soulbah@users.noreply.github.com>
…-jun#1541 Also records the lidge-jun#1302 reproduction seen while running campaign CI: three spinning bun test processes, State R with wchan 0, growing epoll/eventfd counts, and an open SQLite journal — diagnosis only, the issue stays open.
CodeRabbit round 6: the live-window tests only covered text_delta, so a regression that buffers or drops thinking_delta would pass. The new gated test blocks the adapter until the client has observed the leading response.reasoning_summary_text.delta on the wire (rejecting 5s deadline), then asserts exactly-once delivery across the terminal replay. Requires reasoning.summary=auto in the request — without it the parser sets hideThinkingSummary and reasoning is never client-visible by design. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…attested reload call lidge-jun#1541 (fb4f2fe) added a seventh 'await convergeCodexCatalog()' to provider-routes.ts in the new attested credential-free provider-reload route, but the inventory contract still expected 6, leaving dev CI red for every open PR. Update the expected count and test title to match. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ntract-provider-reload test(codex-convergence): update route inventory for lidge-jun#1541's attested reload call
github-actions
Bot
added
the
intake: hygiene-blocked
|
⏳ DRAFT
What to do
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Created accidentally while probing the GitHub connector write path during work on upstream PR lidge-jun#1623. No merge was intended. Closed immediately.