feat(auth): add caller-attested X.509 transport capability - #2428
feat(auth): add caller-attested X.509 transport capability#2428jbeckwith-oai wants to merge 5 commits into
Conversation
Castiron custom code✅ No new custom-code files detected. 32 mixed files remain; 0 existing customizations changed. Compared 32 existing customizations unchanged
A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32533602163 --repo openai/openai-node \
--name castiron-custom-code-32533602163-1 --dir /tmp/castiron-custom-code-32533602163-1
git apply --stat /tmp/castiron-custom-code-32533602163-1/custom-code.patch
cat /tmp/castiron-custom-code-32533602163-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 7b7d6ca71130d37ec09792c50056b47861f2eccf 9aa16c5c97919506a86ce562a600320562e187a0
python3 scripts/castiron/custom_code_report.py report \
--base 7b7d6ca71130d37ec09792c50056b47861f2eccf \
--head 9aa16c5c97919506a86ce562a600320562e187a0 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-9aa16c5c9791
cat /tmp/castiron-custom-code-9aa16c5c9791/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2ffa2c910
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1db8103 to
acab1ae
Compare
jbeckwith-oai
changed the title
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
One validated P2 package-installation compatibility regression.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a249be1004
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
apcha-oai
left a comment
apcha-oai
left a comment
There was a problem hiding this comment.
[sdk codex review] Completed two independent full reviews of 0125855c39e9a5e5a0966b54ae9c59b745629a26, covering all six changed files, supporting code, compatibility, tests, CI, maintainability and all existing feedback.
Requesting changes for one P2: the opt-in X.509 capability accepts Undici implementations that cannot satisfy its dispatch contract. The ordinary compatibility details and suggested regression boundary are in the inline comment. Preserve older optional-peer installation for unrelated SDK consumers while establishing the feature’s actual activation requirements.
Potentially security-sensitive technical details are in the OpenAI-only Slack thread: #sdk-reviews details. That discussion also states the current reachability limits; this is not a claim that ordinary OpenAI clients currently use the new internal sender.
Immediately before submission: open, non-draft, Justin-authored and MERGEABLE; PR base/actual merge base a0d68cc53125c2cb82eab31271b8984b8d65d4b2, live main 7b7d6ca71130d37ec09792c50056b47861f2eccf. All 32 check contexts are terminal (20 successful, 12 expected skips). Hosted CI uses modern Undici; recorded OkTest integration used an older base. Source analysis and hosted CI only; no PR code or tests executed locally.
5906d3b to
9aa16c5
Compare
3 participants
Summary
openai/auth/x509-transportentrypoint for one explicitly caller-attested Node.js UndiciAgentorProxyAgent.This is PR 2 of 5, following #2417. Certificate stability, safe proxy TLS separation, and fresh-dispatcher rotation are application attestations—not claims that transport identity cryptographically proves certificate selection. OAuth exchange, OpenAI client integration, credential caching, and lifecycle policy remain explicitly out of scope.
Verification
pnpm install --frozen-lockfile --ignore-scriptspnpm lintpnpm exec tsc --noEmitpnpm buildnode --experimental-strip-types scripts/test-packed-package.ts— CommonJS, ESM, TypeScript 4.9/current, browser-safe source navigation, and optional Undici absent/presentenv NODE_USE_ENV_PROXY=0 CI=1 ./scripts/test --testNamePattern='^(?!.*(?:pre-opened readable original inode|original held inode)).*$'— 4,064 handwritten tests passed; two pre-existing Linux-only inode cases skipped on macOS; 559 generated tests and 12 snapshots passeda3ac2b08-df37-44b8-9ba1-e105c884df5e— complete changed-source coverage, zero findings