mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-21 06:12:17 +03:00
fb3892b52e
The Codex Responses-over-WebSocket bridge authenticated the API key but never called enforceApiKeyPolicy(), so a key restricted via allowedModels/allowedCombos could still reach a direct Codex model (e.g. gpt-5.5) through this transport, bypassing what the HTTP /v1/responses path already enforces. prepare() now builds an equivalent Request carrying an explicit Authorization: Bearer <apiKey> header (the WS bridge's token normally arrives via a query param) and calls enforceApiKeyPolicy() against the client-requested model before any Codex-specific remapping or credential selection.