openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-10 21:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Apply workspace routing to Guardian v2 classifier requests (#47162)

Browse Source 
## Why

Classifier requests need to preserve their owning thread's workspace routing and account binding, including when reusing pooled connections or retrying after authentication changes.

## What changed

- Share the thread's `WorkspaceRoutingContext` with Guardian v2 and resolve routing before leasing HTTP or pooled WebSocket connections.
- Reuse WebSockets only when their connection key and authentication state still match. Cache HTTP transports by URL and redirect policy, rejecting redirects when routing requires it.
- Stop classification requests and retries when the account owner changes while allowing token refreshes for the same user and workspace.

## Testing

Add regression coverage for routing failures with prewarmed sockets, shared thread routing state, account switches during HTTP and WebSocket requests, same-account token refreshes, and HTTP redirect-policy cache changes.

GitOrigin-RevId: 7b3efcadb4797b6a2de2e28e7506b297b0728d69
This commit is contained in:
acrognale-oai
2026-09-22 02:33:29 +00:00
committed by copyberry
parent b23324986d
commit 30daed37ad
11 changed files with 575 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/app-server/README.md
+1
View File
@@ -310,6 +310,7 @@ Routing compares origins by scheme, host, and effective port, ignoring API paths
configured base URL.
Responses HTTP (including compaction) and WebSockets wait for discovery and preserve API paths.
Guardian v2 classifier HTTP and pooled WebSockets use the same routing.
HTTP redirects are rejected. `us` and `us_cr` set `X-OpenAI-Account-Routing-Override`;
`NO_CONSTRAINT` omits it.