fix(auth): sanitize malformed workload OAuth token responses by HAYDEN-OAI · Pull Request #2468 · openai/openai-node

HAYDEN-OAI · 2026-08-25T19:13:35Z

I understand that this repository is auto-generated and my pull request may not be merged

Summary

Sanitize malformed JSON diagnostics only at the successful workload-identity OAuth token-exchange response boundary.
Recognize native and cross-realm syntax errors, nested parser failures, and supported node-fetch invalid-JSON wrappers without retaining sensitive response previews.
Preserve custom response parsers, non-parser transport and provider error identity, rejected OAuth responses, token caching, and concurrent refresh behavior.

Validation

Regression-first public coverage: 26 failing privacy cases and 18 passing compatibility controls before the fix; all 44 pass afterward.
Four focused authentication suites: 378 tests passed, including real loopback OAuth responses, public OpenAI client requests, malformed-wrapper variants, hostile error objects, recovery, and concurrency.
Complete handwritten suite: 146 suites and 6,231 tests passed with CI-mode snapshot updates disabled.
Generated API suite: 82 suites and 556 tests passed against an isolated authenticated Steady server.
Repository formatting, lint, and source TypeScript checks passed.
Full production build and generated-package TypeScript 4.9 plus current TypeScript checks passed.
Published-package lint and packed CommonJS/ESM verification passed, including 1,256 source maps.
Independently verified the actual built CommonJS and ESM OpenAI clients sanitize both native and supported wrapped OAuth parser failures.

openai-sdks · 2026-08-25T19:14:01Z

OkTest Summary

✅ 237/237 SDK tests passed in 11.199s for Node SDK PR #2468.

Test results — 42 files

Test	Result	Time
`tests/chat-completions-complex-body.test.ts`	✅ Passed	174ms
`tests/chat-completions-create.test.ts`	✅ Passed	274ms
`tests/chat-completions-stream.test.ts`	✅ Passed	237ms
`tests/files-content-binary.test.ts`	✅ Passed	161ms
`tests/files-create-multipart.test.ts`	✅ Passed	183ms
`tests/files-list-pagination.test.ts`	✅ Passed	193ms
`tests/initialize-config.test.ts`	✅ Passed	144ms
`tests/instance-isolation.test.ts`	✅ Passed	115ms
`tests/models-list.test.ts`	✅ Passed	173ms
`tests/responses-background-lifecycle.test.ts`	✅ Passed	294ms
`tests/responses-body-method-errors.test.ts`	✅ Passed	360ms
`tests/responses-cancel-timeout.test.ts`	✅ Passed	211ms
`tests/responses-cancel.test.ts`	✅ Passed	283ms
`tests/responses-compact-retries.test.ts`	✅ Passed	278ms
`tests/responses-compact.test.ts`	✅ Passed	373ms
`tests/responses-create-advanced-stream.test.ts`	✅ Passed	125ms
`tests/responses-create-advanced.test.ts`	✅ Passed	214ms
`tests/responses-create-disconnect.test.ts`	✅ Passed	1.101s
`tests/responses-create-errors.test.ts`	✅ Passed	253ms
`tests/responses-create-malformed-api-responses.test.ts`	✅ Passed	202ms
`tests/responses-create-retries.test.ts`	✅ Passed	307ms
`tests/responses-create-stream-failures.test.ts`	✅ Passed	240ms
`tests/responses-create-stream-timeout.test.ts`	✅ Passed	2.178s
`tests/responses-create-stream-wire.test.ts`	✅ Passed	2.705s
`tests/responses-create-stream.test.ts`	✅ Passed	106ms
`tests/responses-create-terminal-states.test.ts`	✅ Passed	248ms
`tests/responses-create-timeout.test.ts`	✅ Passed	221ms
`tests/responses-create.test.ts`	✅ Passed	263ms
`tests/responses-delete.test.ts`	✅ Passed	260ms
`tests/responses-input-items-errors.test.ts`	✅ Passed	180ms
`tests/responses-input-items-list.test.ts`	✅ Passed	185ms
`tests/responses-input-items-options.test.ts`	✅ Passed	138ms
`tests/responses-input-tokens-count-timeout.test.ts`	✅ Passed	256ms
`tests/responses-input-tokens-count.test.ts`	✅ Passed	229ms
`tests/responses-malformed-inputs.test.ts`	✅ Passed	2.371s
`tests/responses-not-found-errors.test.ts`	✅ Passed	289ms
`tests/responses-parse.test.ts`	✅ Passed	242ms
`tests/responses-retrieve-retries.test.ts`	✅ Passed	257ms
`tests/responses-retrieve.test.ts`	✅ Passed	211ms
`tests/responses-stored-method-errors.test.ts`	✅ Passed	641ms
`tests/retry-behavior.test.ts`	✅ Passed	3.159s
`tests/sdk-error-shape.test.ts`	✅ Passed	314ms

View OkTest run #33014528508

_{SDK merge (558f0c049b7f) · head (c0872e030336) · base (520d60447177) · OkTest (2b1bdfd25e98)}

chatgpt-codex-connector · 2026-08-25T19:14:04Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-26T21:18:31.243717Z	`c0872e0`	New commits
🔒 Security Review	✅ Completed 2026-08-26T21:17:40.579513Z	`c0872e0`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-08-25T19:14:42Z

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared 520d60447177 → c0872e030336. Generated baselines verified.

32 existing customizations unchanged

api.md
scripts/castiron/README.md
scripts/castiron/custom_code_report.py
scripts/castiron/test_custom_code_report.py
src/client.ts
src/resources/audio/transcriptions.ts
src/resources/audio/translations.ts
src/resources/beta/assistants.ts
src/resources/beta/beta.ts
src/resources/beta/index.ts
src/resources/beta/responses/internal-base.ts
src/resources/beta/responses/responses.ts
src/resources/beta/threads/index.ts
src/resources/beta/threads/runs/index.ts
src/resources/beta/threads/runs/runs.ts
src/resources/beta/threads/threads.ts
src/resources/chat/completions/completions.ts
src/resources/chat/completions/index.ts
src/resources/conversations/index.ts
src/resources/embeddings.ts
src/resources/files.ts
src/resources/fine-tuning/checkpoints/permissions.ts
src/resources/images.ts
src/resources/responses/internal-base.ts
src/resources/responses/responses.ts
src/resources/skills/skills.ts
src/resources/skills/versions/versions.ts
src/resources/vector-stores/file-batches.ts
src/resources/vector-stores/files.ts
src/resources/webhooks/index.ts
src/resources/webhooks/webhooks.ts
tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33014560995 --repo openai/openai-node \
  --name castiron-custom-code-33014560995-1 --dir /tmp/castiron-custom-code-33014560995-1
git apply --stat /tmp/castiron-custom-code-33014560995-1/custom-code.patch
cat /tmp/castiron-custom-code-33014560995-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 520d6044717790d922e9659427518850a80a0345 c0872e0303360923bc6a0e03695f18f565aa2c9b
python3 scripts/castiron/custom_code_report.py report \
  --base 520d6044717790d922e9659427518850a80a0345 \
  --head c0872e0303360923bc6a0e03695f18f565aa2c9b --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-c0872e030336
cat /tmp/castiron-custom-code-c0872e030336/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d1be4ab16

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jbeckwith-oai

Requesting changes for the existing P2 discussion at src/auth/workload-identity-auth.ts:85. Object.assign(Object.create(Error.prototype), { type: 'invalid-json' }) and Object.create(SyntaxError.prototype) satisfy instanceof despite lacking the native Error internal brand. The new classifier consequently replaces supported custom Response.json transport/business rejections with a sanitized SyntaxError instead of preserving their original identity. Verify genuine native Error branding before classifying parser markers or cross-realm prototypes, and add regressions for forged Error and SyntaxError prototypes while retaining real malformed-response privacy. The existing inline discussion already captures the issue.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a2bfa6f10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b48a9e0caf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 57f372f661

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89ffaf4c7e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34adfac4f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05c6b2dac9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-25T22:25:53Z

💡 Codex Review

openai-node/src/internal/auth/malformed-json-error.ts

Lines 593 to 595 in 4b669b3

    
           const name = getErrorDescriptor(error, 'name'); 
        
           return name && 'value' in name && name.value === 'SyntaxError' && name.configurable 
        
             ? 'native-syntax'

Preserve Errors whose name is assigned SyntaxError

When a custom Response.json() rejects an ordinary native Error after setting error.name = 'SyntaxError'—a common pattern for custom error classes—the resulting own property is configurable, so this branch classifies it as a native syntax error without checking the error’s actual kind. Checked on supported Bun 1.2.14: both auth paths replace this unrelated rejection with the sanitized SyntaxError, breaking the custom parser’s rejection identity; the existing spoofing regression misses this because Object.defineProperty creates a non-configurable property by default. Use the already captured native/structured classification rather than configurability alone.

AGENTS.md reference: AGENTS.md:L52-L57

openai-node/src/internal/auth/malformed-json-error.ts

Line 209 in 4b669b3

? (nativeErrorBrandDescriptor.value.bind(Error) as ErrorBrand)

Reject polyfilled Error.isError before classifying rejections

In a browser or worker that installs an Error.isError polyfill before SDK import, this accepts that function solely because it is an own data property. A polyfill implemented with Object.prototype.toString therefore invokes an untrusted Symbol.toStringTag getter when a custom Response.json() rejects an error-shaped object; this was reproduced on Bun 1.2.14 by installing such a polyfill before importing the classifier. Fresh evidence beyond the earlier native-brand fix is that the final code validates structuredClone source and behavior but still treats any preinstalled Error.isError function as an intrinsic, allowing classification to execute hostile accessors; verify this brand function’s native semantics or avoid calling it on the rejection.

AGENTS.md reference: AGENTS.md:L98-L105

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 922ee814c9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3927079c4f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 81ea88159e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95fbe51ab2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e00bbb40d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jbeckwith-oai

Freshly re-reviewed the moved HEAD and independently validated strengthened native/cross-realm parser-error branding, bounded cause traversal, safe hostile accessor/proxy handling, and malformed OAuth/Azure response sanitization without replacing genuine transport or application failures.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5163f80e29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 665132393a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…912-2d1be4ab

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7259d28767

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62aa988184

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0872e0303

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fix(auth): sanitize malformed workload OAuth token responses

2d1be4a

HAYDEN-OAI requested a review from a team as a code owner August 25, 2026 19:13

HAYDEN-OAI added the autoimprove label Aug 25, 2026 — with ChatGPT Codex Connector

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/auth/workload-identity-auth.ts Resolved

jbeckwith-oai requested changes Aug 25, 2026

View reviewed changes

fix: verify native error brands before sanitizing OAuth JSON failures

4a2bfa6

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/auth/workload-identity-auth.ts Resolved

Comment thread src/auth/workload-identity-auth.ts Resolved

Comment thread src/auth/workload-identity-auth.ts Resolved

test: satisfy workload identity privacy regression checks

4056587

HAYDEN-OAI requested a review from jbeckwith-oai August 25, 2026 19:43

fix: share private auth JSON error classification across runtimes

b48a9e0

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/auth/malformed-json-error.ts Resolved

Comment thread src/auth/malformed-json-error.ts Resolved

fix(auth): harden private JSON error handling across runtimes

57f372f

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): safely classify forged and proxied JSON errors

89ffaf4

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): harden concealed parser proxies and clone intrinsics

34adfac

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): distinguish forged proxies from concealed parser errors

05c6b2d

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): preserve safe cross-runtime parser classification

4b669b3

Merge main into workload OAuth privacy protections

922ee81

chatgpt-codex-connector Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread scripts/test-packed-package.ts Resolved

HAYDEN-OAI added 2 commits August 25, 2026 16:39

fix(auth): preserve renamed errors and stackless Bun proxies

e471448

Merge main into workload OAuth JSON privacy branch

3927079

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): sanitize stack-only parser error proxies

81ea881

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): fail closed for concealed parser proxy causes

95fbe51

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): authenticate error branding and nested causes

6e00bbb

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

jbeckwith-oai approved these changes Aug 26, 2026

View reviewed changes

fix(auth): authenticate process-provided error intrinsics

5163f80

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/internal/auth/malformed-json-error.ts Resolved

fix(auth): own OAuth token response JSON parsing

6651323

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/auth/workload-identity-auth.ts Resolved

HAYDEN-OAI added 2 commits August 26, 2026 13:32

Merge branch 'main' into codex/workload-oauth-json-privacy-20260825-1…

1604fda

…912-2d1be4ab

Merge branch 'main' into codex/workload-oauth-json-privacy-20260825-1…

6aadcda

…912-2d1be4ab

HAYDEN-OAI added this pull request to the merge queue Aug 26, 2026

HAYDEN-OAI removed this pull request from the merge queue due to a manual request Aug 26, 2026

HAYDEN-OAI mentioned this pull request Aug 26, 2026

fix: publish Castiron checks for behind-main pull requests #2486

Merged

fix(auth): preserve prototype-defined OAuth response parsers

7259d28

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/auth/workload-identity-auth.ts Resolved

Comment thread src/auth/workload-identity-auth.ts Resolved

fix(auth): authenticate OAuth response body readers

62aa988

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/auth/workload-identity-auth.ts Resolved

Comment thread src/auth/workload-identity-auth.ts Resolved

fix(auth): protect OAuth transport parser boundaries

c0872e0

chatgpt-codex-connector Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread src/auth/workload-identity-auth.ts Resolved

HAYDEN-OAI added this pull request to the merge queue Aug 26, 2026

Merged via the queue into main with commit cd5b2d8 Aug 26, 2026
35 checks passed

HAYDEN-OAI deleted the codex/workload-oauth-json-privacy-20260825-1912-2d1be4ab branch August 26, 2026 21:24

openai-sdks Bot mentioned this pull request Aug 26, 2026

release: 7.6.0 #2381

Merged

Conversation

HAYDEN-OAI commented Aug 25, 2026

Summary

Validation

Uh oh!

openai-sdks Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OkTest Summary

Uh oh!

chatgpt-codex-connector Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Castiron custom code

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

jbeckwith-oai left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 25, 2026

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

openai-sdks Bot commented Aug 25, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 25, 2026 •

edited

Loading

github-actions Bot commented Aug 25, 2026 •

edited

Loading