[HAYDEN-OAI]

Summary

Clean up handwritten code behind 55 CodeQL quality findings:

• Distinguish API/HTTP response type imports from the global Response constructor in four test suites, addressing the ambiguity behind 48 false-positive errors. Their emitted JavaScript is unchanged.
• Remove an unreachable NDJSON condition, a repeated test-helper error branch, and unused test code while preserving existing cancellation behavior, assertions, and compile-time checks.
• Import unittest.mock explicitly in the handwritten budget tests.
• Remove the unused regex-validation binding with void new RegExp(pattern);, preserving validation and the existing catch without a suppression. The explicit discard satisfies both no-new and unicorn/new-for-builtins; a direct RegExp(pattern); call fails the latter pinned rule.

The 143 generated smoke-test bindings and generated reporter-test import are handled by the upstream Castiron fix, https://github.com/openai/openai/pull/1433965, and will arrive through normal regeneration. This PR does not carry those generated-file edits or change generation metadata or budget policy.

The 34 intentional/false-positive findings identified during triage remain prepared for UI dismissal; none have been dismissed through GitHub.

Validation

• Pinned formatter/linter checks passed for all tracked files; TypeScript checking and CJS/ESM SDK build passed. Full pnpm lint encounters a formatting failure only in the worker-created, untracked .symphony/prompts/attempt.md.
• Nine affected handwritten suites: 345 tests passed; isolated global-fetch assignability test: 1 passed.
• The four Response suites emit byte-identical JavaScript; all 48 flagged expressions retain the global constructor type.
• Python custom-code suite: 63 tests run, 1 optional compiler-contract skip.
• Verified custom-code budget for this tree: 3,002 / 4,000 lines, leaving 998 lines of headroom.
• Verified that all 68 generated test files match the base revision exactly.
• Regex review follow-up: 52 Zod helper tests passed. Converted-pattern success and invalid-pattern fallback passed through CJS/ESM exports on Node 22.0.0, 24.19.0, and 26.7.0.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared b0f6f20b2a90 → bec1e9a76ee5. Generated baselines verified.

32 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/client.ts
• src/resources/audio/transcriptions.ts
• src/resources/audio/translations.ts
• src/resources/beta/assistants.ts
• src/resources/beta/beta.ts
• src/resources/beta/index.ts
• src/resources/beta/responses/internal-base.ts
• src/resources/beta/responses/responses.ts
• src/resources/beta/threads/index.ts
• src/resources/beta/threads/runs/index.ts
• src/resources/beta/threads/runs/runs.ts
• src/resources/beta/threads/threads.ts
• src/resources/chat/completions/completions.ts
• src/resources/chat/completions/index.ts
• src/resources/conversations/index.ts
• src/resources/embeddings.ts
• src/resources/files.ts
• src/resources/fine-tuning/checkpoints/permissions.ts
• src/resources/images.ts
• src/resources/responses/internal-base.ts
• src/resources/responses/responses.ts
• src/resources/skills/skills.ts
• src/resources/skills/versions/versions.ts
• src/resources/vector-stores/file-batches.ts
• src/resources/vector-stores/files.ts
• src/resources/webhooks/index.ts
• src/resources/webhooks/webhooks.ts
• tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 34052041786 --repo openai/openai-node \
  --name castiron-custom-code-34052041786-1 --dir /tmp/castiron-custom-code-34052041786-1
git apply --stat /tmp/castiron-custom-code-34052041786-1/custom-code.patch
cat /tmp/castiron-custom-code-34052041786-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin b0f6f20b2a90df25c1a764f13bf14ede97b2b760 bec1e9a76ee50c200641a065daa25267f79988d6
python3 scripts/castiron/custom_code_report.py report \
  --base b0f6f20b2a90df25c1a764f13bf14ede97b2b760 \
  --head bec1e9a76ee50c200641a065daa25267f79988d6 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-bec1e9a76ee5
cat /tmp/castiron-custom-code-bec1e9a76ee5/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T18:25:37.632660Z	a111fe1	New commits
🔒 Security Review	✅ Completed 2026-09-06T18:26:46.187722Z	a111fe1	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.168s for Node SDK PR #2660.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	149ms
tests/chat-completions-create.test.ts	✅ Passed	207ms
tests/chat-completions-stream.test.ts	✅ Passed	202ms
tests/files-content-binary.test.ts	✅ Passed	109ms
tests/files-create-multipart.test.ts	✅ Passed	143ms
tests/files-list-pagination.test.ts	✅ Passed	153ms
tests/initialize-config.test.ts	✅ Passed	182ms
tests/instance-isolation.test.ts	✅ Passed	77ms
tests/models-list.test.ts	✅ Passed	126ms
tests/responses-background-lifecycle.test.ts	✅ Passed	163ms
tests/responses-body-method-errors.test.ts	✅ Passed	250ms
tests/responses-cancel-timeout.test.ts	✅ Passed	236ms
tests/responses-cancel.test.ts	✅ Passed	171ms
tests/responses-compact-retries.test.ts	✅ Passed	153ms
tests/responses-compact.test.ts	✅ Passed	198ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	89ms
tests/responses-create-advanced.test.ts	✅ Passed	169ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.072s
tests/responses-create-errors.test.ts	✅ Passed	147ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	125ms
tests/responses-create-retries.test.ts	✅ Passed	236ms
tests/responses-create-stream-failures.test.ts	✅ Passed	151ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.143s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.249s
tests/responses-create-stream.test.ts	✅ Passed	106ms
tests/responses-create-terminal-states.test.ts	✅ Passed	233ms
tests/responses-create-timeout.test.ts	✅ Passed	205ms
tests/responses-create.test.ts	✅ Passed	116ms
tests/responses-delete.test.ts	✅ Passed	99ms
tests/responses-input-items-errors.test.ts	✅ Passed	183ms
tests/responses-input-items-list.test.ts	✅ Passed	259ms
tests/responses-input-items-options.test.ts	✅ Passed	106ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	231ms
tests/responses-input-tokens-count.test.ts	✅ Passed	202ms
tests/responses-malformed-inputs.test.ts	✅ Passed	1.823s
tests/responses-not-found-errors.test.ts	✅ Passed	208ms
tests/responses-parse.test.ts	✅ Passed	145ms
tests/responses-retrieve-retries.test.ts	✅ Passed	223ms
tests/responses-retrieve.test.ts	✅ Passed	161ms
tests/responses-stored-method-errors.test.ts	✅ Passed	463ms
tests/retry-behavior.test.ts	✅ Passed	2.932s
tests/sdk-error-shape.test.ts	✅ Passed	163ms

View OkTest run #34051997895

_{SDK merge (5d9002f5d4a8) · head (bec1e9a76ee5) · base (b0f6f20b2a90) · OkTest (2b1bdfd25e98)}

[jbeckwith-oai]

Reviewed the final 11-file handwritten cleanup against the revised 55-finding scope. The mechanical Response aliases, unreachable branches, unused test code, and generated-file revert are coherent, but one introduced lint suppression conflicts with the repository review contract because a straightforward compliant form exists. Please replace the suppression plus unused new expression with a direct RegExp(pattern) validation call. No other blocking finding found; I can re-review the updated head.

[jbeckwith-oai]

Re-reviewed exact head a111fe1. The suppression is gone, but the replacement introduces another unused binding: const regexTest = new RegExp(pattern);. This PR is specifically removing unused handwritten code, so please use the previously suggested RegExp(pattern); call expression, which preserves the validation and catch behavior without a suppression or unused local. No other in-scope blocker found in the 11-file diff. Current CI is green where complete; test matrix and ecosystem jobs are still running.

[markstuart-oai]

Reviewed all 10 files in a111fe1 against b0f6f20, including the surrounding stream lifecycle and test-helper contracts. The removed branches are unreachable, the remaining assertions and constructor type check are preserved, and the four Response suites emit identical CJS/ESM JavaScript. All 48 relevant Response expressions still resolve to the global constructor. No correctness, security, or structural maintainability findings.

Validation: 322 focused tests passed, the isolated global-fetch test passed, Python ran 63 tests with one optional skip, and lint, TypeScript checking, and CJS/ESM builds passed. Local checks used cached dependencies matching the manifests/lockfile after registry installation failed; live/Bun and generated suites were not run.

On the regex discussion: the final regex file exactly matches the PR base; this head does not introduce that binding. I also reproduced the pinned unicorn/new-for-builtins rejection of RegExp(pattern). Leaving that pre-existing vendored code unchanged is reasonable here. All 68 generated-file edits are reverted, so the upstream generator cleanup can arrive through normal regeneration without blocking this handwritten PR. Thanks for narrowing the scope.

[jbeckwith-oai]

Re-reviewed exact head bec1e9a. The remaining blocker is resolved: regex validation now has no lint suppression and no unused binding while preserving the existing throw/catch fallback. I rechecked the complete 11-file handwritten cleanup against the revised 55-finding scope; no other in-scope blocking findings remain, git diff --check is clean, and all exact-head CI is green except the final aggregate test-matrix job still queued.

[markstuart-oai]

Review checkpoint: re-reviewing all 11 changed files at bec1e9a against base/merge-base b0f6f20. I've inspected the regex conversion/fallback, NDJSON cancellation/finalization, Response type/runtime boundaries, and test-helper assertions. Local validation passed: 374 focused tests, the isolated global-fetch test, Python's 63-test suite (one optional skip), lint, TypeScript checking, and CJS/ESM builds. Independent regex probes preserve successful conversion and invalid-pattern fallback through CJS/ESM exports on Node 22.23.2 and 24.20.0. No blocker found so far; checking the live head and complete discussion before submitting the review.

[markstuart-oai]

Full re-review of all 11 changed files at bec1e9a against b0f6f20, following my earlier approval on a111fe1. No correctness, security, or structural maintainability findings.

The explicit void new RegExp(pattern) keeps construction and the existing throw/catch fallback without an unused binding or lint suppression. I independently checked the pinned rules and compared successful conversion, invalid-pattern fallback, warnings, and flag-bypass paths with the base through CJS/ESM exports on Node 22.23.2 and 24.20.0. The author’s explanation in the regex thread holds up.

The remaining cleanup preserves reachable assertions, awaited calls, cancellation/finalization, and global-fetch type checking. The four Response suites still emit identical CJS/ESM JavaScript, with all 48 relevant expressions resolving to the global constructor. All 68 generated-file reverts remain exact; Castiron can arrive separately through normal regeneration.

Validation on this head: 374 focused tests passed (including 52 Zod helper tests), isolated global-fetch test passed, Python ran 63 tests with one optional skip, and full lint, TypeScript checking, and CJS/ESM builds passed. Reused matching cached dependencies; live/Bun and generated suites and the full runtime matrix were not run. Thanks for resolving the regex cleanup without weakening the lint rules.