Diego Rodrigues de Sa e Souza fb3892b52e fix(auth): enforce API-key model/combo policy on the Codex Responses WebSocket bridge (#6564) (#6621) ...

The Codex Responses-over-WebSocket bridge authenticated the API key but
never called enforceApiKeyPolicy(), so a key restricted via
allowedModels/allowedCombos could still reach a direct Codex model
(e.g. gpt-5.5) through this transport, bypassing what the HTTP
/v1/responses path already enforces.

prepare() now builds an equivalent Request carrying an explicit
Authorization: Bearer <apiKey> header (the WS bridge's token normally
arrives via a query param) and calls enforceApiKeyPolicy() against the
client-requested model before any Codex-specific remapping or
credential selection.

2026-07-08 00:08:37 -03:00

..

modelResolution.ts

Release v3.8.20 (#3547)

2026-06-10 13:49:08 -03:00

route.ts

fix(auth): enforce API-key model/combo policy on the Codex Responses WebSocket bridge (#6564) (#6621)

2026-07-08 00:08:37 -03:00