feat: support Codex custom endpoint authentication by wibus-wee · Pull Request #556 · LodyAI/Lody

wibus-wee · 2026-09-09T15:51:54Z

Related issue

Same-repository product request; no separate tracking issue.

Problem

Codex setup exposed only ChatGPT device login, so users of OpenAI-compatible relay services could not provide a Base URL and API Key during onboarding. The credential must remain machine-local while renderer Flock writes and target-daemon RPCs synchronize asynchronously.

Summary

Add ChatGPT and Base URL + API Key modes to Codex onboarding and Settings.
Require HTTPS for remote credential endpoints; permit HTTP only for localhost and loopback IPs, enforced in UI and shared provider construction.
Keep one-shot API keys out of AgentConfig, ProviderSetup, logs, and workspace documents. Transfer them through encrypted Machine ACP input and store only a SHA-256 digest of the canonical launch binding.
Stage the desired credential beside the published binding during publication. A crash on either side of the Flock commit leaves the surviving durable config with a usable key; successful flush finalizes the new binding.
Define the Flock commit as the irreversible authentication boundary. Cancel or timeout wins before commit; after commit, publication wins and cancellation reports that it is too late.
Report post-commit flush failure as uncertain durability and force renderer resynchronization instead of claiming a clean failure.
Generate a fresh setup revision per submit. Exact failure cancellation cannot cancel a later retry; wildcard cancellation blocks in-flight replacement for delete and custom-to-ChatGPT transitions.
Use wildcard ProviderSetupCancellation as both the durable replacement barrier and credential cleanup intent. There is no separate credential-cleanup row family. Retract the barrier only in the same Flock transaction that writes the fresh setup revision.
Preserve cancellation-first deletion ordering, then durably delete the already captured AgentConfig rather than re-reading an optimistic projection that may have hidden it.
Restrict generic credential reconciliation to startup recovery. Recovery snapshots only config IDs and re-reads current Flock references inside each per-config credential mutation sequence.
Inject machine-local credentials at the common SessionManager process-launch boundary, including prepared sessions, fork, resume, and edit-and-resend cold recreation.
Let metadata-only edits save without rotating the API key. Replacement publication merges the latest published metadata.
Preserve existing CODEX_API_KEY, model_provider, unrelated providers, and env values across custom-to-ChatGPT round trips; reject malformed JSON and reserved namespace collisions.

State flow

flowchart LR
  A[Renderer writes non-secret setup revision] --> B[Machine RPC wake-up]
  B --> C[Daemon waits for exact setup]
  C --> D[Encrypted key input]
  D --> E[In-memory candidate]
  E --> F[Responses API probe]
  F --> G[Stage desired and published bindings]
  G --> H[Mark committed]
  H --> I[Publish AgentConfig and delete setup]
  I --> J[Flush durable Flock state]
  J --> K[Finalize credential binding]

Delete and custom-to-ChatGPT first write a wildcard setup cancellation. The renderer then deletes the captured AgentConfig durably. An offline daemon later consumes the same cancellation as credential cleanup intent. Re-enabling custom atomically replaces that barrier with the fresh setup revision, so no replica can observe a barrier-free state that still authorizes an older setup.

Security and consistency properties

Boundary	Result
Remote endpoint	HTTPS required; HTTP limited to loopback
Machine Flock	Setup, config, and cancellation rows contain no protocol-owned one-shot key
Credential transport	Ephemeral ECDH/AES-GCM envelope for remote Machine RPC
Credential at rest	Normally one config-bound machine-local record; at most two binding digests during publication. POSIX directory/file modes are 0700/0600; Windows relies on the inherited ACL of the existing per-user Lody data directory
Process launch	One common SessionManager boundary injects only an exact-binding credential
Create/edit consistency	Prior launch config stays live during probe; either pre- or post-publication state remains launchable across restart
Cancellation	One lifecycle spans setup wait through publication, with Flock commit as the winner boundary
Recovery	Startup snapshots IDs only; authoritative references are read under the matching credential mutation sequence
Concurrent edits	Per-attempt revision CAS protects retries; atomic wildcard-to-setup replacement prevents stale attempts from regaining publication authority; current display metadata is merged at replacement publication
Delete while offline	Wildcard cancellation prevents replacement resurrection and replays credential cleanup; durable config deletion uses the captured config

The credential RPC retains the existing shared-machine provider-management authorization boundary; this PR does not introduce a separate machine-owner role.

Verification

pnpm format
pnpm format:check
pnpm check
pnpm run docs check
Focused provider manager, renderer durable-delete, and Codex dialog suites passed.
Behavioral coverage includes cancellation after Flock commit, post-commit flush uncertainty, dual-binding crash cuts followed by recovery, concurrent multi-config startup recovery, offline delete and ChatGPT transition cleanup, atomic two-replica wildcard-to-R2 replacement with a held stale R1 publication, setup-authoring failure, delete then re-add, same-binding key rotation, concurrent metadata preservation, and common-boundary credential injection.
Controlled loopback run with bundled Codex 0.153.4 observed POST /v1/responses, stream=true, the configured model, and a matching bearer credential; the relay recorded only a boolean match and returned an intentional 401.

No external third-party credential was used. Bundled Codex HTTPS downgrade and cross-origin redirect handling remains an explicitly unverified integration boundary.

Context handoff

Instructions for reviewing agents

Follow the staged config through exact setup wait, encrypted one-shot input, in-memory probe, two-binding publication, the Flock commit boundary, flush, and credential finalization.
Exercise cancellation on both sides of commit, stale retry compensation, concurrent startup recovery and provisioning, metadata edits, and delete or ChatGPT transitions during an in-flight replacement.
Confirm no protocol-owned secret enters workspace state or logs and every SessionManager spawn reaches the common hydration boundary.

Authoring context

User goal: support Codex relay Base URL + API Key during onboarding without weakening credential isolation.
Risk-bearing decisions: credentials are execution-host scoped and full-config-bound; candidate keys stay in memory until probe success; publication temporarily retains the old and desired binding digests; Flock commit is irreversible; wildcard cancellation owns both the replacement barrier and cleanup intent.
Deliberately unverified: external relay compatibility, Windows inherited ACL details, and bundled Codex redirect policy.

chatgpt-codex-connector · 2026-09-09T15:52:05Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T04:53:21.695230Z	`dbb05a8`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70dab84399

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Expose Codex during onboarding and add a guided Base URL plus API Key path alongside ChatGPT login. Generate a dedicated Responses API model provider while preserving unrelated Codex configuration. Model: gpt-5

Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 566ef646f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Model: gpt-5

wibus-wee · 2026-09-10T04:40:38Z

Second-round state-machine blockers addressed in 9f405022.

In addition to the three inline threads, endpoint/key-changing edits no longer update the live AgentConfig before provisioning. They create a replacement setup while the old config remains published, store and probe a new revision, persist verified, and atomically replace the live config. A restart from the durable verified state completes publication without probing the stale published config; cancellation preserves the old config and removes only the staged credential generation.

Validation: pnpm format, full pnpm check, and pnpm run docs check pass. The PR description now documents the exact-revision saga, durable cleanup replay, Windows inherited-ACL assumption, and the still-unverified bundled Codex redirect boundary.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f405022b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3dca0036d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df6eda4cb6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f63cdbb61

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-10T17:51:54Z

+        if (getLodyCodexCustomProvider(config.env)) {
+          await deleteSetup({
+            id: config.id,
+            machineId: config.machineId,
+            preservePublishedConfig: false,


Delete the config before pruning the optimistic cache

When deleting a custom Codex provider on an offline remote machine, awaiting deleteSetup first removes the agentConfig from the initiating client's optimistic rows because preservePublishedConfig is false; the subsequent deleteConfig(config.id) re-reads getAllAgentConfigAtom, finds no config, and skips the durable Flock deletion. Fresh evidence after the prior deletion fix is this call ordering together with deleteAgentConfigAtom's cache-dependent lookup, so until the daemon reconnects and applies the cancellation, a reload or another client reads the still-durable config and shows the deleted provider again. Delete using the captured config before pruning it from the cache.

AGENTS.md reference: packages/components/src/components/settings/AGENTS.md:L24-L26

Useful? React with 👍 / 👎.

Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5442efd3e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-11T10:41:15Z

+              ...config,
+              env: { ...config.env, [LODY_CODEX_API_KEY_ENV]: candidateApiKey },
+            };
+            provisioningRefresh = await verifyConfig(verifiedConfig, signal);


Defer capability cache writes until publication commits

When cancellation or a newer setup revision wins after the live probe succeeds, verifyConfig() has already persisted the staged endpoint's capability cache before commitCodexProviderCredential() rejects publication. The original AgentConfig remains active, but Codex's capability source version does not include the endpoint binding, so sessions and settings can continue using models/options discovered from the rejected endpoint. Stage the probe result without updating the shared cache, then publish it only after the setup commit succeeds.

AGENTS.md reference: apps/cli/src/agent/AGENTS.md:L81-L82

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-11T10:41:15Z

+    const ids = new Set<AgentConfigId>([
+      ...(Object.keys(configs) as AgentConfigId[]),
+      ...(Object.keys(setups) as AgentConfigId[]),
+      ...(Object.keys(cancellations) as AgentConfigId[]),
+    ]);


Reconcile credentials for direct agent-config deletions

When a custom Codex provider is removed through the shipped lody agent-config delete path (apps/cli/src/commands/agent-config.ts:834) or an older client, the generic deletion writes no providerSetupCancellation. This recovery scan only discovers IDs that still have a config, setup, or cancellation row, so the deleted ID is absent and its hashed provider-credential file remains on disk indefinitely. Ensure every deletion path emits the cleanup intent, or retain enough local indexing to reconcile credentials whose Flock rows have disappeared.

Useful? React with 👍 / 👎.

Drop the obsolete Electron release-workflow assertion after the base branch removed that workflow. Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1faa68036f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-11T11:27:45Z

+export function providerSetupContainsCodexCredential(config: AgentConfigMeta): boolean {
+  return Boolean(config.env[LODY_CODEX_API_KEY_ENV]?.trim());


Reject the local credential from AgentConfig rows

This guard is applied only to providerSetup rows, while the shipped lody agent-config create/update --env paths still accept arbitrary environment keys and directly upsert an AgentConfig (apps/cli/src/commands/agent-config.ts:680,790). Supplying LODY_CODEX_CUSTOM_ENDPOINT_API_KEY through either path therefore stores the raw API key in the synced Machine Flock—and agent-config show subsequently prints it—exposing a credential intended to remain machine-local to workspace readers. Reject this reserved key at every AgentConfig write/normalization boundary, not only inside setup drafts.

Useful? React with 👍 / 👎.

Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd4f601d69

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-11T19:12:02Z

+export function agentConfigContainsCodexCredential(config: AgentConfigEnvironment): boolean {
+  return Boolean(
+    config.env && Object.prototype.hasOwnProperty.call(config.env, LODY_CODEX_API_KEY_ENV)
+  );


Reject reserved environment keys case-insensitively

On Windows, environment-variable names are case-insensitive, but this exact-case lookup lets an alias such as lody_codex_custom_endpoint_api_key pass every new AgentConfig guard. A user can therefore add that spelling through lody agent-config create/update --env; Codex can consume it as the generated uppercase env_key, while Machine Flock and agent-config show persist and reveal the raw credential. Fresh evidence after the earlier reserved-key fix is that the shared guard still compares literal casing; reject case-insensitive aliases on Windows (and filter them from credential bindings) as well.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-11T19:12:03Z

+              const provision = await provisionCodexCredential({
+                machineId: config.machineId,
+                configId: config.id,
+                setupRevision: payload.setupRevision,
+                apiKey: payload.codexApiKey,
+              });


Cancel provisioning when the dialog is dismissed

While this provisioning call is awaiting setup synchronization, input, or the live probe, the dialog can still be dismissed through its Radix close button, Escape, or backdrop, and the parent immediately unmounts AgentConfigDialog. The authentication hook is owned by the still-mounted settings/onboarding parent, so its cleanup does not send cancellation and this await can later publish the provider and store the key after the user closed the flow. Fresh evidence after the prior lifecycle fix is that dialog dismissal never reaches that cancellable backend lifecycle; prevent dismissal while submitting or explicitly cancel the request on dialog teardown.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-11T19:12:03Z

+  if (existingCancellation && !setup && (!config || cancellation.preservePublishedConfig)) {
    return false;
  }
  if (!existingCancellation) {


Replace revision-scoped markers with the wildcard delete barrier

When lody agent-config delete removes a custom Codex provider while this key already contains a revision-scoped cancellation from an earlier attempt, the incoming revision-independent cancellation is not written because existingCancellation is truthy. In a multi-replica race, a different-revision provisioning request on a daemon that has not observed the deletion can therefore publish later and clear the stale exact marker, resurrecting the deleted provider; the retained exact marker also is not treated as the durable wildcard cleanup intent. An incoming explicit wildcard cancellation must replace an existing revision-scoped marker.

Useful? React with 👍 / 👎.

Remove redundant credential compatibility and response state, preserve committed setup outcomes, and harden secret filtering and cancellation barriers. Model: gpt-6

Cover case-insensitive reserved credential keys, wildcard cancellation upgrades across replicas, and dialog dismissal during provisioning. Model: gpt-6

Document case-insensitive credential filtering, wildcard cancellation precedence, and dialog behavior during provisioning. Model: gpt-6

Model: gpt-6

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9af4cdfbc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-12T06:52:22Z

+    ...(previousEntry && previousEntry.binding !== desiredBinding
+      ? { previous: previousEntry }
+      : {}),


Preserve the old key during same-binding staging

If the daemon exits after writeRecord() but before publishVerifiedConfig() commits a same-endpoint key rotation, this condition omits the previous key because both entries have the same binding digest. On restart, both the published config and pending setup reference that digest, so reconciliation retains the new current key; subsequently cancelling the still-pending setup cannot restore the old key. The replacement credential therefore becomes active and the prior credential is lost even though publication never committed, contrary to the rule that cancellation wins until that boundary; retain enough staged state to restore the prior same-binding secret after this crash cut.

AGENTS.md reference: apps/cli/src/agent/AGENTS.md:L81-L85

Useful? React with 👍 / 👎.

Model: gpt-5

Give same-endpoint key rotations distinct non-secret binding identities so crash recovery can select the key chosen by the Flock commit boundary. Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5981cadf73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-12T08:13:26Z

-  // Nothing is read from the mirror before it, so the boundary is never delayed.
+  // The durable marker is the cancellation accept boundary. The target CLI applies
+  // the revision CAS and removes the affected rows; local projection only hides them.
  await runtime.writer.flockRowPut(flockDocId, cancellationKey, cancellation);


Preserve the wildcard barrier when writing exact cancellations

When a stale client failure-compensates revision R1 after another client has deleted the provider and written a wildcard cancellation, its cached setup can pass the revision precheck and this unconditional put replaces the single cancellation row with the narrower R1 marker. The daemon then sees only the merged exact marker, so a concurrent R2 setup is no longer fenced and can republish the deleted provider. Fresh evidence after the prior wildcard-precedence fix is that the renderer writer still bypasses applyProviderSetupCancellationToFlock; merge this write transactionally so an existing wildcard always wins over an exact cancellation.

AGENTS.md reference: packages/components/src/AGENTS.md:L81-L83

Useful? React with 👍 / 👎.

Route renderer cancellation through the shared transactional merge and mark authentication committed only after Flock commit succeeds. Model: gpt-5

Model: gpt-5

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b01eb43ed7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-12T10:02:41Z

+      if (!setup || setup.setupRevision !== setupRevision) return undefined;
+      return setup.machineId === machineId &&
+        isValidDaemonLaunchConfig(setup.config, agentConfigId, machineId)
+        ? setup.config


Bind the revision to the staged launch config

When another workspace writer rewrites the shared providerSetup.config while preserving its visible setupRevision, this check accepts the altered row solely because the revision string matches. Fresh evidence beyond the prior setup-visibility race is that no expected config or binding digest crosses the RPC: provisioning then probes the accepted config with the victim's one-shot key, so a collaborator racing base_url to an endpoint they control can exfiltrate it. Bind the request to the exact staged launch-config digest and verify it before requesting or using the secret.

AGENTS.md reference: apps/cli/src/agent/AGENTS.md:L83-L85

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-12T10:02:41Z

+          agentType: config.agentType,
+          customAcp: config.customAcp,
+          runtimeOverrides: config.runtimeOverrides,
+          env: config.env ?? {},


Hydrate credentials before adding GitHub session variables

When a custom-endpoint Codex session targets a GitHub repository, both the cold and prepared launch paths call prepareGitHubRepoSessionConfig before this method; that adds GH_TOKEN and per-session broker variables to config.env. The credential record's binding was computed from the persisted AgentConfig.env, while hydration hashes the entire augmented environment, so the binding no longer matches and the API key is omitted, causing Codex to contact the custom endpoint without authentication. Hydrate against the untouched AgentConfig launch fields before merging per-session variables.

AGENTS.md reference: apps/cli/src/agent/AGENTS.md:L83-L85

Useful? React with 👍 / 👎.

Model: gpt-5

github-actions · 2026-09-12T19:08:52Z

Desktop PR regression failed on commit 45054c8500363f0c12f22aa4aa37d1cb51a4bb31.

Workflow run: https://github.com/LodyAI/Lody/actions/runs/34713170972
Failed scenarios indexed: 0
Recording: 1/1

Recordings not attached

Run evidence: failure-index.json is missing

The Actions artifact retains the complete trace, screenshots, logs, and runtime evidence.

Model: gpt-5

github-actions Bot added scope: cli scope: shared scope: components labels Sep 9, 2026

chatgpt-codex-connector Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread packages/components/src/components/settings/agent-config-dialog.tsx Outdated

wibus-wee added 2 commits September 10, 2026 02:21

feat: support Codex custom endpoint authentication

74388a1

Expose Codex during onboarding and add a guided Base URL plus API Key path alongside ChatGPT login. Generate a dedicated Responses API model provider while preserving unrelated Codex configuration. Model: gpt-5

fix: secure Codex custom endpoint credentials

566ef64

Model: gpt-5

wibus-wee force-pushed the feat/codex-base-url-api-key branch from 70dab84 to 566ef64 Compare September 9, 2026 18:33

chatgpt-codex-connector Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread packages/components/src/components/settings/machine-agent-settings.tsx Outdated

Comment thread apps/cli/src/agent/acp-authentication.ts Outdated

Comment thread packages/components/src/components/settings/machine-agent-settings.tsx Outdated

fix: make Codex credential setup crash consistent

9f40502

Model: gpt-5

github-actions Bot added the scope: streams-rpc label Sep 10, 2026

chatgpt-codex-connector Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread apps/cli/src/session/session-manager.ts Outdated

fix: simplify Codex credential provisioning

c3dca00

Model: gpt-5

chatgpt-codex-connector Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread packages/components/src/components/settings/machine-agent-settings.tsx Outdated

Comment thread apps/cli/src/session/session-execution-service.ts Outdated

chatgpt-codex-connector Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread apps/cli/src/session/session-execution-service.ts Outdated

fix: close Codex credential commit races

68e0d45

Model: gpt-5

wibus-wee force-pushed the feat/codex-base-url-api-key branch from df6eda4 to 68e0d45 Compare September 10, 2026 11:12

fix: linearize provider credential publication

6f63cdb

Model: gpt-5

chatgpt-codex-connector Bot reviewed Sep 10, 2026

View reviewed changes

wibus-wee added 3 commits September 11, 2026 14:33

fix: preserve provider lifecycle authority

6c4aa85

Model: gpt-5

fix: reconcile provider branch with main

e1cb502

Model: gpt-5

fix: atomically replace provider cancellation barrier

a5442ef

Model: gpt-5

chatgpt-codex-connector Bot reviewed Sep 11, 2026

View reviewed changes

fix: reconcile provider branch with latest main

1faa680

Drop the obsolete Electron release-workflow assertion after the base branch removed that workflow. Model: gpt-5

github-actions Bot added the scope: desktop label Sep 11, 2026

chatgpt-codex-connector Bot reviewed Sep 11, 2026

View reviewed changes

fix: harden custom provider publication boundaries

cd4f601

Model: gpt-5

chatgpt-codex-connector Bot reviewed Sep 11, 2026

View reviewed changes

fix: simplify and harden Codex credential provisioning

d4b670a

Remove redundant credential compatibility and response state, preserve committed setup outcomes, and harden secret filtering and cancellation barriers. Model: gpt-6

wibus-wee added 3 commits September 12, 2026 14:44

test: cover Codex credential publication safeguards

cf0deb3

Cover case-insensitive reserved credential keys, wildcard cancellation upgrades across replicas, and dialog dismissal during provisioning. Model: gpt-6

docs: clarify Codex credential safety and publication contracts

3987ce6

Document case-insensitive credential filtering, wildcard cancellation precedence, and dialog behavior during provisioning. Model: gpt-6

chore: preserve existing updater test formatting

a9af4cd

Model: gpt-6

chatgpt-codex-connector Bot reviewed Sep 12, 2026

View reviewed changes

wibus-wee added 2 commits September 12, 2026 14:54

test: fix Codex safeguard test imports

ecca100

Model: gpt-5

fix: bind Codex credentials to publication revisions

5981cad

Give same-endpoint key rotations distinct non-secret binding identities so crash recovery can select the key chosen by the Flock commit boundary. Model: gpt-5

chatgpt-codex-connector Bot reviewed Sep 12, 2026

View reviewed changes

wibus-wee added 2 commits September 12, 2026 16:45

fix: preserve provider cancellation boundaries

9f14990

Route renderer cancellation through the shared transactional merge and mark authentication committed only after Flock commit succeeds. Model: gpt-5

fix: merge main into Codex custom endpoint auth

b01eb43

Model: gpt-5

github-actions Bot removed the scope: desktop label Sep 12, 2026

chatgpt-codex-connector Bot reviewed Sep 12, 2026

View reviewed changes

wibus-wee added 2 commits September 12, 2026 18:44

refactor: generalize machine-local provider credentials

f3143f3

Model: gpt-5

fix: bind provider secrets to confirmed config

45054c8

Model: gpt-5

fix: merge main into Codex endpoint authentication

dbb05a8

Model: gpt-5

wibus-wee marked this pull request as draft September 13, 2026 06:24

wibus-wee added the question Further information is requested label Sep 13, 2026

refactor: align Codex credentials with provider configs

9d28e08

Model: gpt-5

github-actions Bot added scope: agent-runtime and removed scope: streams-rpc labels Sep 14, 2026

		export function providerSetupContainsCodexCredential(config: AgentConfigMeta): boolean {
		return Boolean(config.env[LODY_CODEX_API_KEY_ENV]?.trim());

Conversation

wibus-wee commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issue

Problem

Summary

State flow

Security and consistency properties

Verification

Context handoff

Instructions for reviewing agents

Authoring context

Uh oh!

chatgpt-codex-connector Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wibus-wee commented Sep 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Sep 11, 2026

Choose a reason for hiding this comment

wibus-wee commented Sep 9, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 9, 2026 •

edited

Loading