Skip to content

fix(websocket): apply connection query overrides once - #1283

Open
markstuart-oai wants to merge 2 commits into
mainfrom
markstuart/websocket-runtime-audit-20261027
Open

markstuart-oai wants to merge 2 commits into
mainfrom
markstuart/websocket-runtime-audit-20261027

Conversation

@markstuart-oai

@markstuart-oai markstuart-oai commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Stable Responses and Realtime appended per-connection query parameters after the base URL query. Overrides could reach the server twice. Automatic Azure routing also treated a unified base URL with a query or fragment as a legacy endpoint.

Use the shared WebSocket request builder for both transports. Preserve the path segments and complete query that provider authenticators receive when they sign the handshake. Resolve the Azure API category from the URI path so supported unified endpoints retain their routing and authentication behavior.

Verification

All 648 runnable tests in the OkHttp client suite passed. Two live tests require credentials. The 194 focused tests include stable Responses signing, Realtime lifecycle and Azure compatibility. Twelve Azure probes captured the outgoing requests, and local WebSocket peers verified the signed headers and the encoded query on the wire. The formatter passed.

@github-actions

github-actions Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Castiron custom code

Evaluated main: a565f6e12496d129699f3732d3ead2b9f1d0691e.

Trusted main policy: a565f6e12496d129699f3732d3ead2b9f1d0691e.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared a565f6e12496 → 0e1697a14332. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 40464871943 --repo openai/openai-java \
  --name castiron-custom-code-40464871943-1 --dir /tmp/castiron-custom-code-40464871943-1
git apply --stat /tmp/castiron-custom-code-40464871943-1/custom-code.patch
cat /tmp/castiron-custom-code-40464871943-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin a565f6e12496d129699f3732d3ead2b9f1d0691e 0e1697a143321ab0ecdee7e8629d5d141407b9b7
python3 scripts/castiron/custom_code_report.py report \
  --base a565f6e12496d129699f3732d3ead2b9f1d0691e \
  --head 0e1697a143321ab0ecdee7e8629d5d141407b9b7 --target-branch main --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-0e1697a14332
cat /tmp/castiron-custom-code-0e1697a14332/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

@markstuart-oai
markstuart-oai marked this pull request as ready for review October 27, 2026 17:54
@markstuart-oai
markstuart-oai requested a review from a team as a code owner October 27, 2026 17:54
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-27T17:55:56.473151Z 0e1697a Draft marked ready
🔒 Security Review ✅ Completed 2026-10-27T17:57:12.128573Z 0e1697a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant