docs(realtime): add standard WebSocket workflows - #500
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 50 mixed files remain; 0 existing customizations changed. Compared 50 existing customizations unchanged
10 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32449620513 --repo openai/openai-ruby \
--name castiron-custom-code-32449620513-1 --dir /tmp/castiron-custom-code-32449620513-1
git apply --stat /tmp/castiron-custom-code-32449620513-1/custom-code.patch
cat /tmp/castiron-custom-code-32449620513-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 7ab65d8b6583aff4163dd527b4919368cacaf028 787b12a037a7116c2ca4a7c105c5875eb540ea72
python3 scripts/castiron/custom_code_report.py report \
--base 7ab65d8b6583aff4163dd527b4919368cacaf028 \
--head 787b12a037a7116c2ca4a7c105c5875eb540ea72 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-787b12a037a7
cat /tmp/castiron-custom-code-787b12a037a7/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bee201d890
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 66da2b0480
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89dc1953ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 787b12a037
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| length = bytes.byteslice(offset, 4).unpack1("N") | ||
| type = bytes.byteslice(offset + 4, 4) |
There was a problem hiding this comment.
When a CRC-valid unknown critical chunk such as ABCD appears between IHDR and IDAT, this parser silently skips it and returns true, even though a PNG decoder must stop when it cannot interpret a critical chunk. The example consequently opens the authenticated connection and uploads an image that its preflight validation claims is valid; validate chunk-type bits and reject unsupported critical chunks, with a focused regression case.
AGENTS.md reference: AGENTS.md:L25-L29
Useful? React with 👍 / 👎.
| if type == "IDAT" | ||
| saw_idat = true | ||
| idat << data |
There was a problem hiding this comment.
When an ancillary chunk such as tEXt separates two IDAT chunks, this loop concatenates the compressed bytes and accepts the file, although PNG requires the IDAT sequence to be consecutive and standard decoders reject such input. Track whether the IDAT run has ended and reject any later IDAT before connecting and uploading, with a focused malformed-image test.
AGENTS.md reference: AGENTS.md:L25-L29
Useful? React with 👍 / 👎.
| return valid_jpeg_scans?(frame, scans) | ||
| end | ||
|
|
||
| next if marker == 0x01 || (0xD0..0xD7).cover?(marker) |
There was a problem hiding this comment.
When an RST marker such as FF D0 is inserted after SOI or between ordinary metadata segments, this branch skips it and the otherwise valid file still passes preflight. Restart markers are only valid inside entropy-coded scan data, where jpeg_scan_data already validates their sequence and restart interval; reject them in the outer marker loop so malformed files are not connected and uploaded, with a focused regression case.
AGENTS.md reference: AGENTS.md:L25-L29
Useful? React with 👍 / 👎.
| connection.conversation.items.create( | ||
| type: :mcp_approval_response, | ||
| id: "approval_response_1", | ||
| approval_request_id: item.id, | ||
| approve: true, | ||
| reason: "Approved by the example application policy." |
There was a problem hiding this comment.
When the configured MCP server advertises any tool under the expected label, the example selects its first tool and unconditionally approves whatever arguments the model supplies; the checks above only compare values that originated from that same server and therefore do not constitute an independent approval policy. A compromised or unexpectedly changed server can consequently cause a destructive call without operator consent, so require a caller-provided tool/argument allowlist or an explicit interactive decision before sending approve: true.
AGENTS.md reference: AGENTS.md:L25-L29
Useful? React with 👍 / 👎.
1 participant
Summary
client.realtime.connecthelpers, including genericfunction_call_outputandmcp_approval_responseconversation itemsValidation
bundle exec rake lint: passedbundle exec rake typecheck: passedbundle exec rake testwith the required Steady mock: 1,111 / 1,112 tests passed; the existingRealtimeNetworkInvariantsTest#test_http_proxy_uses_connect_and_isolates_proxy_and_origin_credentialsraces its localhost accept thread against teardown in this environment and also fails in isolationReview notes
conversation.items.create@openai/sdks-teamreview because this documents file-path/image and remote MCP endpoint boundaries