Fix Codex adapter: session-token auth and real rate_limit shape - #3
Merged
Merged
Conversation
Verified against a live capture: the wham/usage endpoint requires the same short-lived bearer the ChatGPT page mints from the browser session, so cookies alone came back as 'Not logged in'. The adapter now does what the page does — GET /api/auth/session (cookie-authed) for the token, use it in-memory for the single usage request, never persist it (tested: nothing reaches the adapter cache; the session call itself carries no Authorization header). A 200 session response without an accessToken is the logged-out signal and maps to unauthenticated without touching the usage endpoint. The live response also nests the windows under rate_limit (with limit_window_seconds identifying the 5h/weekly windows) rather than at the top level, and additional_rate_limits entries wrap their own rate_limit block. That shape is now the primary schema variant, recorded as a redacted fixture; the flat variants remain as fallbacks. Adapter version bumped to 2. README/CONTRIBUTING updated to state the session-token policy precisely.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
First live test showed the Codex card stuck on "Not logged in" even with an active chatgpt.com session. A DevTools capture revealed two gaps:
GET /backend-api/wham/usagerequires the same short-lived bearer token the ChatGPT page mints from the browser session — cookies alone return 401.rate_limit(rate_limit.primary_window/secondary_window, withlimit_window_secondsidentifying the 5h vs. weekly window), andadditional_rate_limits[]entries wrap their ownrate_limitblock — different from the flat shapes the adapter was built against.The fix
GET /api/auth/session(cookie-authed) for the token, then the usage call withAuthorization: Bearer <token>. The token lives only in function scope — tests assert it never reaches the adapter's persistent cache and that the session call itself carries no Authorization header. A 200 session response without anaccessTokenis the logged-out signal and maps tounauthenticatedwithout touching the usage endpoint.wham_rate_limit(the live shape, recorded as a redacted fixture) is now the primary schema variant; the flatprimary_windowandfive_hour_limitshapes remain as fallbacks. Windows are labeled fromlimit_window_seconds(18000 → "Session (5h)", 604800 → "Weekly");additional_rate_limitsentries become extra lanes (e.g.gpt-reserve).Verification
npm run cigreen: typecheck + 57 tests + build.🤖 Generated with Claude Code
https://claude.ai/code/session_015gwwHsEgVxtmfRn3dEkBif
Generated by Claude Code