[HAYDEN-OAI]

Summary

• Measure workload-identity OAuth exchange duration with a monotonic clock, after acquiring the subject token.
• Derive the cache deadline from the remaining lifetime at response completion, and reject expired tokens before caching or API dispatch.
• Keep proactive refresh tied to the original lifetime, preserving zero-buffer behavior and the one-hour fallback.

Why

The cache previously calculated expiresAt after reading the complete token response. That restarted the full lifetime after response delivery: a valid one-second token whose response body took 1.5 seconds to arrive was returned to concurrent callers and cached despite already being expired. Shorter delays also postponed later refreshes.

OAuth 2.0 §5.1 defines expires_in relative to response generation. The fix measures elapsed exchange time with performance.now() and converts the remaining lifetime into a completion-relative wall-clock deadline. Subject-token acquisition is deliberately excluded.

The review follow-up addresses wall-clock adjustments during exchange without adding new cache fields or changing the cache's existing wall-clock policy. It also rejects positive remaining lifetimes that are too small to represent beyond the completion timestamp.

This is a cache/retry reliability fix, not a change to token parsing, authentication destinations, exported APIs, or concurrency infrastructure. The expiration checks are grouped in a small helper to keep refreshToken within the existing complexity limit.

Regression coverage and validation

• Seven original regressions failed before the initial fix; nine additional clock-adjustment/precision regressions failed before the review follow-up.
• All 51 expiration tests pass, including delayed headers/body, forward/backward clock adjustments, exact expiration, shared rejection and recovery, fractional remaining lifetime, original refresh buffering, and provider-acquisition exclusion.
• All 836 auth and public workload-identity tests pass on Node 22.22.2 and 24.19.0.
• 210 independent checks pass through the actual final built CJS/ESM public clients on exact Node 22.0.0, 24.19.0, and 26.7.0, including background refresh preserving an older usable cache entry.
• Full TypeScript check, canonical ./scripts/build, pinned Oxfmt 0.62.0, available cached Oxlint 1.76.0, declaration comparison, and git diff --check pass.
• Full unit suite after the follow-up: 7,490 passed; one pre-existing formatter-fixture failure in tests/oxlint-config.test.ts, reproduced identically in the clean f83de8fe base. Local dependency installation remains blocked by the configured registry's missing publication-time metadata for qs@6.16.0; the available cache has Vitest 4.1.10 and Oxlint 1.76.0 rather than the pinned versions. No registry, lockfile, policy, or dependency changes are included; pinned CI remains authoritative.

Scope and review

Only the handwritten implementation and its existing expiration/auth test files change. The additional auth-test changes freeze and restore the monotonic clock in two existing exact-boundary tests. All three paths are absent from the current pinned generated snapshot 0669a894f02e0cd93cf431ebdbbab0529f81d8e8; no overlapping open PR was found.

Repeated adversarial review covered security/privacy, missing/null/fractional lifetimes, zero refresh buffers, clock adjustments, background failures, callers joining a pending refresh, invalidation races, and supported runtime compatibility. No blocking findings remain in the final self-review; fresh CI and maintainer review apply to the new head.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T17:09:44.338259Z	886cd6e	New commits
🔒 Security Review	✅ Completed 2026-09-04T17:10:49.514027Z	886cd6e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 10.958s for Node SDK PR #2609.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	172ms
tests/chat-completions-create.test.ts	✅ Passed	211ms
tests/chat-completions-stream.test.ts	✅ Passed	261ms
tests/files-content-binary.test.ts	✅ Passed	195ms
tests/files-create-multipart.test.ts	✅ Passed	152ms
tests/files-list-pagination.test.ts	✅ Passed	155ms
tests/initialize-config.test.ts	✅ Passed	176ms
tests/instance-isolation.test.ts	✅ Passed	104ms
tests/models-list.test.ts	✅ Passed	135ms
tests/responses-background-lifecycle.test.ts	✅ Passed	215ms
tests/responses-body-method-errors.test.ts	✅ Passed	445ms
tests/responses-cancel-timeout.test.ts	✅ Passed	291ms
tests/responses-cancel.test.ts	✅ Passed	202ms
tests/responses-compact-retries.test.ts	✅ Passed	244ms
tests/responses-compact.test.ts	✅ Passed	225ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	157ms
tests/responses-create-advanced.test.ts	✅ Passed	278ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.205s
tests/responses-create-errors.test.ts	✅ Passed	260ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	179ms
tests/responses-create-retries.test.ts	✅ Passed	287ms
tests/responses-create-stream-failures.test.ts	✅ Passed	219ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.172s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.504s
tests/responses-create-stream.test.ts	✅ Passed	119ms
tests/responses-create-terminal-states.test.ts	✅ Passed	285ms
tests/responses-create-timeout.test.ts	✅ Passed	301ms
tests/responses-create.test.ts	✅ Passed	157ms
tests/responses-delete.test.ts	✅ Passed	255ms
tests/responses-input-items-errors.test.ts	✅ Passed	239ms
tests/responses-input-items-list.test.ts	✅ Passed	200ms
tests/responses-input-items-options.test.ts	✅ Passed	103ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	295ms
tests/responses-input-tokens-count.test.ts	✅ Passed	233ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.138s
tests/responses-not-found-errors.test.ts	✅ Passed	351ms
tests/responses-parse.test.ts	✅ Passed	186ms
tests/responses-retrieve-retries.test.ts	✅ Passed	268ms
tests/responses-retrieve.test.ts	✅ Passed	252ms
tests/responses-stored-method-errors.test.ts	✅ Passed	646ms
tests/retry-behavior.test.ts	✅ Passed	2.974s
tests/sdk-error-shape.test.ts	✅ Passed	362ms

View OkTest run #33898924517

_{SDK merge (302f7d069f76) · head (886cd6ea662c) · base (f83de8fe4c4a) · OkTest (2b1bdfd25e98)}

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared f83de8fe4c4a → 886cd6ea662c. Generated baselines verified.

32 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/client.ts
• src/resources/audio/transcriptions.ts
• src/resources/audio/translations.ts
• src/resources/beta/assistants.ts
• src/resources/beta/beta.ts
• src/resources/beta/index.ts
• src/resources/beta/responses/internal-base.ts
• src/resources/beta/responses/responses.ts
• src/resources/beta/threads/index.ts
• src/resources/beta/threads/runs/index.ts
• src/resources/beta/threads/runs/runs.ts
• src/resources/beta/threads/threads.ts
• src/resources/chat/completions/completions.ts
• src/resources/chat/completions/index.ts
• src/resources/conversations/index.ts
• src/resources/embeddings.ts
• src/resources/files.ts
• src/resources/fine-tuning/checkpoints/permissions.ts
• src/resources/images.ts
• src/resources/responses/internal-base.ts
• src/resources/responses/responses.ts
• src/resources/skills/skills.ts
• src/resources/skills/versions/versions.ts
• src/resources/vector-stores/file-batches.ts
• src/resources/vector-stores/files.ts
• src/resources/webhooks/index.ts
• src/resources/webhooks/webhooks.ts
• tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33899044946 --repo openai/openai-node \
  --name castiron-custom-code-33899044946-1 --dir /tmp/castiron-custom-code-33899044946-1
git apply --stat /tmp/castiron-custom-code-33899044946-1/custom-code.patch
cat /tmp/castiron-custom-code-33899044946-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin f83de8fe4c4a309cabae861ab552a3ce6d4a2c65 886cd6ea662cde2f28d93e8c5962b6712ba67221
python3 scripts/castiron/custom_code_report.py report \
  --base f83de8fe4c4a309cabae861ab552a3ce6d4a2c65 \
  --head 886cd6ea662cde2f28d93e8c5962b6712ba67221 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-886cd6ea662c
cat /tmp/castiron-custom-code-886cd6ea662c/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 43a2d20d56

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jbeckwith-oai]

Requesting changes on exact head 43a2d20. The elapsed-time correction uses Date.now() as both the start and completion clock. A backward wall-clock adjustment during the exchange extends expiresAt by the jump and can cache or return the token beyond its advertised lifetime. Please measure elapsed exchange time with a monotonic clock and derive the wall deadline from the remaining lifetime, or retain both monotonic and wall deadlines as the X.509 path does. This matches the unresolved inline P2 at discussion_r3936243895. Other reviewed expiration, concurrency, and recovery behavior looks sound; remaining CI is still running with no failures.

[markstuart-oai]

Reviewed the monotonic-clock follow-up on the fresh head. The elapsed-time accounting now handles wall-clock adjustments and expired responses, with focused coverage across header/body delay, concurrency, and retry recovery. Exact-head CI is green across the supported Node matrix, build, lint, ecosystem, and Castiron checks; local diff validation also passed.

[sylvesterkaczmarek]

Using performance.now() for exchange duration while expressing the final deadline in Date.now() coordinates is the right split: forward or backward wall-clock adjustments affect both the completion timestamp and stored deadline equally, while real delivery latency still reduces usable lifetime. Keeping refresh buffering tied to the original advertised lifetime also avoids making a slow exchange progressively more aggressive. The delayed headers/body and clock-adjustment regressions cover the important boundary.

[jbeckwith-oai]

Reviewed exact head 886cd6e with extra attention to the auth/cache boundary. The prior clock-handling blocker is resolved: exchange duration is measured monotonically, the stored wall-clock deadline is anchored at response completion, and tokens already expired on arrival are rejected before caching or dispatch. Concurrency sharing/recovery and proactive refresh behavior remain covered, including forward/backward wall-clock adjustments. Exact-head CI is green. No blocking findings.