openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Preserve WebSocket probe evidence and redact diagnostic details (#57597)

Browse Source 
## Why

Handshake probes can lose upgrade evidence when a subsequent read fails, and diagnostic output can expose URLs, server error messages, and close reasons containing sensitive values.

## What changed

- Retain successful upgrade status and allowlisted tracking headers, including on post-upgrade read failures.
- Return structured probe errors that distinguish typed TLS failures from failures with an unknown stage while preserving the underlying API error.
- Recognize empty close frames as immediate closes with code `1005`.
- Redact wire values from probe debug output and doctor error details, and remove URLs and raw errors from connection logs.

## Testing

Add local TLS and WebSocket fixtures covering certificate rejection, ordinary I/O failures, successful and rejected upgrades, immediate closes, malformed frames, header retention, and redaction. Add doctor output snapshots and error-detail redaction assertions.

GitOrigin-RevId: 1ee53720a7a752043943170d8e4da205ec4e55f3
This commit is contained in:
dob-oai
2026-10-27 23:51:43 +00:00
committed by copyberry
parent c8091aeeee
commit b538d2b340
9 changed files with 765 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/codex-api/src/lib.rs
+2
View File
@@ -74,6 +74,8 @@ pub use crate::endpoint::ResponsesWebsocketClient;
pub use crate::endpoint::ResponsesWebsocketClose;
pub use crate::endpoint::ResponsesWebsocketConnection;
pub use crate::endpoint::ResponsesWebsocketProbe;
pub use crate::endpoint::ResponsesWebsocketProbeError;
pub use crate::endpoint::ResponsesWebsocketProbeFailureStage;
pub use crate::endpoint::SearchClient;
pub use crate::endpoint::session_update_session_json;
pub use crate::error::ApiError;