mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-23 15:42:12 +03:00
f330b21afd
Merged via merge-train (release/v3.8.50, batch1 2026-08-20) — static gates (typecheck/file-size/complexity/cognitive/changelog) green on the combined tree; test:unit reds observed in the boarded run were verified pre-existing on the pure release tip (unrelated flake), not caused by this PR. Thanks for the contribution!
456 lines
17 KiB
TypeScript
456 lines
17 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
import {
|
|
applyCodexClientIdentityHeaders,
|
|
applyCodexClientMetadata,
|
|
applyCodexOriginalIdentityHeaders,
|
|
createCodexClientIdentity,
|
|
ensureCodexFingerprintSeed,
|
|
getCodexClientSessionId,
|
|
getCodexConvergedSessionId,
|
|
getCodexConvergedThreadId,
|
|
getCodexFingerprintMode,
|
|
getCodexInstallationId,
|
|
resolveCodexFingerprintIdentity,
|
|
resolveCodexOriginalIdentityHeaders,
|
|
withCodexFingerprintCredentials,
|
|
} from "../../open-sse/config/codexIdentity.ts";
|
|
|
|
const oauthCredentials = {
|
|
accessToken: "oauth-token",
|
|
connectionId: "connection-42",
|
|
providerSpecificData: { workspaceId: "workspace-42" },
|
|
};
|
|
|
|
test("Codex fingerprint mode defaults to session and only explicit off disables it", () => {
|
|
assert.equal(getCodexFingerprintMode(undefined), "session");
|
|
assert.equal(getCodexFingerprintMode({ codexFingerprintMode: "invalid" }), "session");
|
|
assert.equal(getCodexFingerprintMode({ codexFingerprintMode: "off" }), "off");
|
|
assert.equal(
|
|
resolveCodexFingerprintIdentity({
|
|
credentials: { ...oauthCredentials, providerSpecificData: { codexFingerprintMode: "off" } },
|
|
clientHeaders: { "session-id": "client-session" },
|
|
body: {},
|
|
}),
|
|
null
|
|
);
|
|
});
|
|
|
|
test("Codex off mode preserves original OAuth identity headers", () => {
|
|
const clientHeaders = {
|
|
"session-id": "client-session",
|
|
"thread-id": "client-thread",
|
|
"x-client-request-id": "client-request",
|
|
"x-codex-window-id": "client-thread:0",
|
|
"x-codex-turn-metadata": '{"turn_id":"client-turn"}',
|
|
};
|
|
const credentials = {
|
|
...oauthCredentials,
|
|
providerSpecificData: { codexFingerprintMode: "off" },
|
|
};
|
|
const original = resolveCodexOriginalIdentityHeaders({
|
|
credentials,
|
|
clientHeaders,
|
|
});
|
|
const wrapped = withCodexFingerprintCredentials(credentials, clientHeaders, {});
|
|
assert.deepEqual(wrapped.providerSpecificData.codexOriginalIdentityHeaders, original);
|
|
assert.equal(wrapped.providerSpecificData.codexClientIdentity, undefined);
|
|
|
|
const resolvedAgain = resolveCodexOriginalIdentityHeaders({
|
|
credentials,
|
|
clientHeaders,
|
|
});
|
|
assert.ok(resolvedAgain);
|
|
|
|
const headers: Record<string, string> = { session_id: "generated-session" };
|
|
applyCodexOriginalIdentityHeaders(headers, resolvedAgain);
|
|
assert.equal(headers["session-id"], "client-session");
|
|
assert.equal(headers["thread-id"], "client-thread");
|
|
assert.equal(headers["x-client-request-id"], "client-request");
|
|
assert.equal(headers["x-codex-window-id"], "client-thread:0");
|
|
assert.equal(headers["x-codex-turn-metadata"], '{"turn_id":"client-turn"}');
|
|
assert.equal(
|
|
resolveCodexOriginalIdentityHeaders({
|
|
credentials: {
|
|
...oauthCredentials,
|
|
requestEndpointPath: "/responses/compact",
|
|
providerSpecificData: { codexFingerprintMode: "off" },
|
|
},
|
|
clientHeaders: { "session-id": "compact-session" },
|
|
}),
|
|
null
|
|
);
|
|
});
|
|
|
|
test("Codex device/session/full modes preserve their Sub2API convergence boundaries", () => {
|
|
const providerSpecificData = { workspaceId: "workspace-42" };
|
|
const device = createCodexClientIdentity("client-session-a", providerSpecificData, {
|
|
mode: "device",
|
|
});
|
|
const sessionA = createCodexClientIdentity("client-session-a", providerSpecificData, {
|
|
mode: "session",
|
|
accountKey: "connection-42",
|
|
});
|
|
const sessionB = createCodexClientIdentity("client-session-b", providerSpecificData, {
|
|
mode: "session",
|
|
accountKey: "connection-42",
|
|
});
|
|
const fullA = createCodexClientIdentity("client-session-a", providerSpecificData, {
|
|
mode: "full",
|
|
accountKey: "connection-42",
|
|
});
|
|
const fullB = createCodexClientIdentity("client-session-b", providerSpecificData, {
|
|
mode: "full",
|
|
accountKey: "connection-42",
|
|
});
|
|
|
|
assert.ok(device && sessionA && sessionB && fullA && fullB);
|
|
assert.equal(device.installationId, getCodexInstallationId(providerSpecificData, undefined));
|
|
assert.notEqual(
|
|
getCodexInstallationId({}, "connection-a"),
|
|
getCodexInstallationId({}, "connection-b")
|
|
);
|
|
assert.equal(device.sessionId, "");
|
|
assert.equal(sessionA.sessionId, sessionB.sessionId);
|
|
assert.notEqual(sessionA.threadId, sessionB.threadId);
|
|
assert.equal(sessionA.windowId, `${sessionA.threadId}:0`);
|
|
assert.equal(fullA.sessionId, fullB.sessionId);
|
|
assert.equal(fullA.threadId, fullA.sessionId);
|
|
assert.equal(fullA.threadId, fullB.threadId);
|
|
assert.notEqual(sessionA.turnId, sessionB.turnId);
|
|
assert.equal(
|
|
getCodexConvergedSessionId(providerSpecificData, "connection-42"),
|
|
sessionA.sessionId
|
|
);
|
|
assert.equal(
|
|
getCodexConvergedThreadId("client-session-a", providerSpecificData, "connection-42"),
|
|
sessionA.threadId
|
|
);
|
|
});
|
|
|
|
test("Codex client session extraction prefers hyphenated session-id and rejects unsafe values", () => {
|
|
assert.equal(
|
|
getCodexClientSessionId({ "session-id": "hyphen", session_id: "underscore" }),
|
|
"hyphen"
|
|
);
|
|
assert.equal(getCodexClientSessionId({ session_id: "underscore" }), "underscore");
|
|
assert.equal(getCodexClientSessionId({ "session-id": "bad\\r\\nheader" }), null);
|
|
});
|
|
|
|
test("One Codex identity is shared by headers, body metadata, and nested turn metadata", () => {
|
|
const identity = resolveCodexFingerprintIdentity({
|
|
credentials: oauthCredentials,
|
|
clientHeaders: { "session-id": "client-session" },
|
|
body: {},
|
|
});
|
|
assert.ok(identity);
|
|
|
|
const headers: Record<string, string> = {};
|
|
applyCodexClientIdentityHeaders(headers, identity);
|
|
const body: Record<string, unknown> = {
|
|
client_metadata: { "x-codex-turn-metadata": '{"sandbox":"none"}' },
|
|
};
|
|
applyCodexClientMetadata(body, identity);
|
|
|
|
const headerMetadata = JSON.parse(headers["x-codex-turn-metadata"]);
|
|
const clientMetadata = body.client_metadata as Record<string, unknown>;
|
|
const bodyMetadata = JSON.parse(clientMetadata["x-codex-turn-metadata"] as string);
|
|
|
|
assert.equal(headers["session-id"], clientMetadata.session_id);
|
|
assert.equal(headers["thread-id"], clientMetadata.thread_id);
|
|
assert.equal(headers["x-codex-window-id"], clientMetadata["x-codex-window-id"]);
|
|
assert.equal(identity.installationId, headers["x-codex-installation-id"]);
|
|
assert.equal(identity.turnId, clientMetadata.turn_id);
|
|
assert.equal(identity.turnId, headerMetadata.turn_id);
|
|
assert.equal(identity.turnId, bodyMetadata.turn_id);
|
|
assert.equal(bodyMetadata.sandbox, "none");
|
|
});
|
|
|
|
test("Codex compact requests do not resolve a fingerprint identity", () => {
|
|
assert.equal(
|
|
resolveCodexFingerprintIdentity({
|
|
credentials: {
|
|
...oauthCredentials,
|
|
requestEndpointPath: "/responses/compact",
|
|
},
|
|
clientHeaders: { "session-id": "client-session" },
|
|
body: {},
|
|
}),
|
|
null
|
|
);
|
|
});
|
|
|
|
test("Codex HTTP off mode preserves original identity headers and body metadata", async () => {
|
|
const { CodexExecutor } = await import("../../open-sse/executors/codex.ts");
|
|
const executor = new CodexExecutor();
|
|
const originalFetch = globalThis.fetch;
|
|
let upstreamHeaders = new Headers();
|
|
let upstreamBody: Record<string, unknown> = {};
|
|
globalThis.fetch = async (_url, init) => {
|
|
upstreamHeaders = new Headers(init?.headers);
|
|
upstreamBody = JSON.parse(String(init?.body || "{}"));
|
|
return new Response(JSON.stringify({ id: "resp-off", object: "response" }), {
|
|
status: 200,
|
|
headers: { "Content-Type": "application/json" },
|
|
});
|
|
};
|
|
|
|
try {
|
|
await executor.execute({
|
|
model: "gpt-5.5",
|
|
body: {
|
|
model: "gpt-5.5",
|
|
input: [{ role: "user", content: "hello" }],
|
|
client_metadata: {
|
|
session_id: "client-session",
|
|
thread_id: "client-thread",
|
|
turn_id: "client-turn",
|
|
"x-codex-window-id": "client-thread:0",
|
|
"x-codex-turn-metadata": '{"turn_id":"client-turn"}',
|
|
},
|
|
_nativeCodexPassthrough: true,
|
|
},
|
|
stream: true,
|
|
clientHeaders: {
|
|
"session-id": "client-session",
|
|
"thread-id": "client-thread",
|
|
"x-client-request-id": "client-request",
|
|
"x-codex-window-id": "client-thread:0",
|
|
"x-codex-turn-metadata": '{"turn_id":"client-turn"}',
|
|
},
|
|
credentials: {
|
|
accessToken: "codex-token",
|
|
connectionId: "conn-http-off",
|
|
providerSpecificData: { workspaceId: "http-off", codexFingerprintMode: "off" },
|
|
},
|
|
});
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
|
|
const metadata = upstreamBody.client_metadata as Record<string, unknown>;
|
|
assert.equal(upstreamHeaders.get("session-id"), "client-session");
|
|
assert.equal(upstreamHeaders.get("thread-id"), "client-thread");
|
|
assert.equal(upstreamHeaders.get("x-client-request-id"), "client-request");
|
|
assert.equal(upstreamHeaders.get("x-codex-window-id"), "client-thread:0");
|
|
assert.equal(upstreamHeaders.get("x-codex-turn-metadata"), '{"turn_id":"client-turn"}');
|
|
assert.equal(metadata.session_id, "client-session");
|
|
assert.equal(metadata.thread_id, "client-thread");
|
|
assert.equal(metadata.turn_id, "client-turn");
|
|
assert.equal(metadata["x-codex-window-id"], "client-thread:0");
|
|
assert.equal(metadata["x-codex-turn-metadata"], '{"turn_id":"client-turn"}');
|
|
});
|
|
|
|
test("Codex websocket off mode preserves original identity headers and body metadata", async () => {
|
|
const { CodexExecutor, __setCodexWebSocketTransportForTesting } =
|
|
await import("../../open-sse/executors/codex.ts");
|
|
const executor = new CodexExecutor();
|
|
let sent: string | null = null;
|
|
let wsHeaders: Record<string, string> = {};
|
|
__setCodexWebSocketTransportForTesting(async (_url, opts) => {
|
|
wsHeaders = (opts?.headers as Record<string, string>) || {};
|
|
return {
|
|
send(data: string) {
|
|
sent = data;
|
|
queueMicrotask(() => {
|
|
this.onmessage?.({
|
|
data: JSON.stringify({
|
|
type: "response.completed",
|
|
response: { status: "completed" },
|
|
}),
|
|
});
|
|
});
|
|
},
|
|
close() {},
|
|
onmessage: null,
|
|
onerror: null,
|
|
onclose: null,
|
|
};
|
|
});
|
|
|
|
try {
|
|
const result = await executor.execute({
|
|
model: "gpt-5.5",
|
|
body: {
|
|
model: "gpt-5.5",
|
|
input: [{ role: "user", content: "hello" }],
|
|
client_metadata: {
|
|
session_id: "client-session",
|
|
thread_id: "client-thread",
|
|
turn_id: "client-turn",
|
|
},
|
|
},
|
|
stream: true,
|
|
clientHeaders: {
|
|
"session-id": "client-session",
|
|
"thread-id": "client-thread",
|
|
"x-client-request-id": "client-request",
|
|
"x-codex-window-id": "client-thread:0",
|
|
"x-codex-turn-metadata": '{"turn_id":"client-turn"}',
|
|
},
|
|
credentials: {
|
|
accessToken: "codex-token",
|
|
connectionId: "conn-ws-off",
|
|
providerSpecificData: {
|
|
workspaceId: "ws-off",
|
|
codexTransport: "websocket",
|
|
codexFingerprintMode: "off",
|
|
},
|
|
},
|
|
});
|
|
await result.response.text();
|
|
} finally {
|
|
__setCodexWebSocketTransportForTesting(undefined);
|
|
}
|
|
|
|
assert.ok(sent);
|
|
const payload = JSON.parse(sent as string) as Record<string, unknown>;
|
|
const metadata = payload.client_metadata as Record<string, unknown>;
|
|
assert.equal(wsHeaders["session-id"], "client-session");
|
|
assert.equal(wsHeaders["thread-id"], "client-thread");
|
|
assert.equal(wsHeaders["x-client-request-id"], "client-request");
|
|
assert.equal(wsHeaders["x-codex-window-id"], "client-thread:0");
|
|
assert.equal(wsHeaders["x-codex-turn-metadata"], '{"turn_id":"client-turn"}');
|
|
assert.equal(metadata.session_id, "client-session");
|
|
assert.equal(metadata.thread_id, "client-thread");
|
|
assert.equal(metadata.turn_id, "client-turn");
|
|
});
|
|
|
|
test("Codex websocket headers and payload share one fingerprint identity", async () => {
|
|
const { CodexExecutor, __setCodexWebSocketTransportForTesting } =
|
|
await import("../../open-sse/executors/codex.ts");
|
|
const executor = new CodexExecutor();
|
|
let sent: string | null = null;
|
|
let wsHeaders: Record<string, string> = {};
|
|
__setCodexWebSocketTransportForTesting(async (_url, opts) => {
|
|
wsHeaders = (opts?.headers as Record<string, string>) || {};
|
|
return {
|
|
send(data: string) {
|
|
sent = data;
|
|
queueMicrotask(() => {
|
|
this.onmessage?.({
|
|
data: JSON.stringify({
|
|
type: "response.completed",
|
|
response: { status: "completed" },
|
|
}),
|
|
});
|
|
});
|
|
},
|
|
close() {},
|
|
onmessage: null,
|
|
onerror: null,
|
|
onclose: null,
|
|
};
|
|
});
|
|
|
|
try {
|
|
const result = await executor.execute({
|
|
model: "gpt-5.5",
|
|
body: {
|
|
model: "gpt-5.5",
|
|
session_id: "client-ws",
|
|
input: [{ role: "user", content: "hello" }],
|
|
},
|
|
stream: true,
|
|
credentials: {
|
|
accessToken: "codex-token",
|
|
connectionId: "conn-ws",
|
|
providerSpecificData: { workspaceId: "ws-ws", codexTransport: "websocket" },
|
|
},
|
|
});
|
|
await result.response.text();
|
|
} finally {
|
|
__setCodexWebSocketTransportForTesting(undefined);
|
|
}
|
|
|
|
assert.ok(sent);
|
|
const payload = JSON.parse(sent as string) as Record<string, unknown>;
|
|
const metadata = (payload.client_metadata as Record<string, unknown>) || {};
|
|
assert.equal(wsHeaders.session_id, metadata.session_id);
|
|
assert.equal(wsHeaders["x-client-request-id"], metadata.thread_id);
|
|
assert.equal(wsHeaders["x-codex-window-id"], metadata["x-codex-window-id"]);
|
|
assert.equal(payload.type, "response.create");
|
|
});
|
|
|
|
test("Codex fingerprint seed: persisted seed drives v2 derivation deterministically", () => {
|
|
const seed = "11111111-2222-4233-8444-555555555555";
|
|
const seeded = { workspaceId: "workspace-42", codexFingerprintSeed: seed };
|
|
|
|
const installationId = getCodexInstallationId(seeded, "connection-42");
|
|
const sessionId = getCodexConvergedSessionId(seeded, "connection-42");
|
|
const threadId = getCodexConvergedThreadId("client-session", seeded, "connection-42");
|
|
|
|
// Deterministic: same seed → same ids, regardless of the connection key.
|
|
assert.equal(getCodexInstallationId(seeded, "another-connection"), installationId);
|
|
assert.equal(getCodexConvergedSessionId(seeded, "another-connection"), sessionId);
|
|
assert.equal(getCodexConvergedThreadId("client-session", seeded, null), threadId);
|
|
|
|
// v2 derivation deliberately rotates away from the legacy workspace-derived ids.
|
|
const legacy = { workspaceId: "workspace-42" };
|
|
assert.notEqual(installationId, getCodexInstallationId(legacy, "connection-42"));
|
|
assert.notEqual(sessionId, getCodexConvergedSessionId(legacy, "connection-42"));
|
|
|
|
// Two connections never share an identity once seeded (sub2api #5696).
|
|
const otherSeed = { codexFingerprintSeed: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee" };
|
|
assert.notEqual(getCodexInstallationId(otherSeed, "connection-42"), installationId);
|
|
assert.notEqual(getCodexConvergedSessionId(otherSeed, "connection-42"), sessionId);
|
|
|
|
// Admin-configured explicit installation id still wins over the seed.
|
|
assert.equal(
|
|
getCodexInstallationId(
|
|
{ ...seeded, codexInstallationId: "99999999-8888-4777-8666-555555555555" },
|
|
"connection-42"
|
|
),
|
|
"99999999-8888-4777-8666-555555555555"
|
|
);
|
|
});
|
|
|
|
test("ensureCodexFingerprintSeed creates once, preserves, and skips non-converged", () => {
|
|
const oauth = { accessToken: "oauth-token" };
|
|
|
|
// Default mode (session) on OAuth → seed created.
|
|
const created = ensureCodexFingerprintSeed(undefined, oauth);
|
|
assert.match(created?.codexFingerprintSeed as string, /^[0-9a-f-]{36}$/);
|
|
|
|
// The stored seed ALWAYS wins over an incoming payload that omits it
|
|
// (partial update) or carries a client-forged one (system-managed key).
|
|
const stored = { codexFingerprintSeed: "11111111-2222-4233-8444-555555555555" };
|
|
assert.deepEqual(ensureCodexFingerprintSeed(undefined, oauth, stored), stored);
|
|
assert.deepEqual(
|
|
ensureCodexFingerprintSeed(
|
|
{ codexFingerprintSeed: "99999999-8888-4777-8666-555555555555" },
|
|
oauth,
|
|
stored
|
|
),
|
|
stored
|
|
);
|
|
// The stored seed stays dormant when the mode is switched off.
|
|
assert.deepEqual(ensureCodexFingerprintSeed({ codexFingerprintMode: "off" }, oauth, stored), {
|
|
codexFingerprintMode: "off",
|
|
codexFingerprintSeed: "11111111-2222-4233-8444-555555555555",
|
|
});
|
|
|
|
// Explicit off without a stored seed stays seedless; a client-supplied seed
|
|
// on create is stripped and replaced by a system-generated one.
|
|
assert.deepEqual(ensureCodexFingerprintSeed({ codexFingerprintMode: "off" }, oauth), {
|
|
codexFingerprintMode: "off",
|
|
});
|
|
const forgedOnCreate = ensureCodexFingerprintSeed(
|
|
{ codexFingerprintSeed: "99999999-8888-4777-8666-555555555555" },
|
|
oauth
|
|
);
|
|
assert.match(forgedOnCreate?.codexFingerprintSeed as string, /^[0-9a-f-]{36}$/);
|
|
assert.notEqual(forgedOnCreate?.codexFingerprintSeed, "99999999-8888-4777-8666-555555555555");
|
|
|
|
// Non-OAuth (API key) connections are never seeded.
|
|
assert.equal(ensureCodexFingerprintSeed(undefined, { apiKey: "sk-x" }), undefined);
|
|
assert.equal(ensureCodexFingerprintSeed(undefined, undefined), undefined);
|
|
|
|
// device/full modes require the seed as well.
|
|
for (const mode of ["device", "full"]) {
|
|
const result = ensureCodexFingerprintSeed({ codexFingerprintMode: mode }, oauth);
|
|
assert.match(result?.codexFingerprintSeed as string, /^[0-9a-f-]{36}$/);
|
|
}
|
|
});
|