mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
richardopenai
8d44977aa2
## What changed Add `codex tcp-tunnel --diagnostics-json` to emit versioned, newline-delimited JSON diagnostics on stderr. Records classify startup, CONNECT, transport, and control failures without exposing credentials, addresses, headers, or raw error messages. Rejected CONNECT records may include a validated `http_status`. Distinguish terminal failures from recoverable stream and transport events, flush terminal records before returning a generic error, and preserve stdout readiness and credential acknowledgments. Keep human-readable diagnostics as the default and document the version 1 schema and consumer fallback rules. ## Testing Add tests for bounded output, error-chain suppression, terminal flushing, control error classification, CONNECT status validation, legacy behavior, and flag parsing. Extend the reconnect test to exercise a rejected CONNECT followed by a successful connection in JSON mode. GitOrigin-RevId: 350f67fe8e3f313e8a6d3bb0fd891952b77647fd
26 lines
2.3 KiB
Markdown
26 lines
2.3 KiB
Markdown
# HTTP/3 TCP tunnel
|
||
|
||
The ordinary Codex binary includes the hidden `codex tcp-tunnel` command. It forwards a loopback TCP listener to an explicitly selected host and port through a TLS-verified HTTP/3 CONNECT proxy. The proxy URL must be an exact HTTPS origin in the supplied policy file; the target is provided separately as `host:port` or `[IPv6]:port`.
|
||
|
||
The initial bearer must be provided as a single line on standard input (`--auth-token-stdin`). With `--auth-token-updates-stdin`, later lines replace the bearer for new connections, emit `AUTH_UPDATED`, and closure of the controlling pipe stops the tunnel. With `--connect-headers-stdin`, the first line is instead a JSON list of `["x-name","value"]` pairs; token lines follow. Only non-forwarding `x-` extension headers are accepted. No header values or credentials belong in the command arguments.
|
||
|
||
The process emits `LISTENING 127.0.0.1:<port>` after connecting to the proxy. A proxy handshake does not authorize the target; each local connection makes its own authenticated CONNECT. The listener survives transport reconnects, but TCP streams are never replayed.
|
||
|
||
`--diagnostics-json` opts into newline-delimited JSON on stderr. Version 1 contains
|
||
`v`, `phase` (`startup`, `connect`, `transport`, or `control`), `code` (`failed`,
|
||
`timeout`, `rejected`, `closed`, `draining`, or `invalid_input`), and `terminal`.
|
||
A rejected CONNECT may also include a numeric `http_status` (100–599, excluding
|
||
2xx). Records contain no credentials, addresses, headers, or raw error messages
|
||
and are less than 256 bytes. Stdout readiness and credential acknowledgments are
|
||
unchanged. A terminal record is flushed before an unsuccessful return; closing
|
||
the controlling pipe normally emits no failure. The CLI may append a generic
|
||
error line after the terminal record. Nonterminal events may concern
|
||
one TCP stream or a reconnecting shared transport and do not identify the cause
|
||
of a later child-process failure. Consumers must ignore records with unknown versions or fields and keep a generic
|
||
fallback for helpers without this flag.
|
||
|
||
Version 1 terminal combinations are `startup/{failed,timeout}`,
|
||
`control/{failed,invalid_input}`, and `transport/failed`. Nonterminal combinations
|
||
are `connect/{failed,rejected}` and `transport/{failed,timeout,closed,draining}`.
|
||
Other combinations are unknown records and must use the generic fallback.
|