Repository navigation
fix(codex): stop overriding chatgpt_base_url so ChatGPT workspace discovery works - #697
Conversation
…covery works (#671) In ChatGPT-OAuth mode the Codex launcher (server/providers.js) and the Herdr plugin (codexAgentArgs) now set only openai_base_url=<proxy>/v1. Codex keeps its default chatgpt_base_url, so workspace discovery and account/plugin/connector calls go to chatgpt.com over HTTPS instead of failing with -32603 on a plaintext loopback URL. Model traffic still reaches ccxray; API-key mode is unchanged. The /v1 suffix is load-bearing: Codex re-routes the openai provider to a discovered workspace origin only when its base_url ends in /backend-api/codex. Tests pin the suffix and the absence of chatgpt_base_url in both launchers, plus argv parity between them. ccxray codex now warns, read-only, when $CODEX_HOME/config.toml still points chatgpt_base_url at a loopback proxy, which keeps failing. Docs: rewrite codex-workspace-routing.md to the resolved state (gate invariant, broken entry points, residency/us caveat, user-config note), update env-vars, provider-modules, running-ccxray, wire-protocol rows, openspec two-domain-auth scenario, and move the CHANGELOG entry from Known limitations to Fixed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f33ee6dffc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| console.warn(`[ccxray] chatgpt_base_url in ${codexConfigPath(env)} points at a loopback proxy (${url}); ` | ||
| + 'Codex ChatGPT workspace discovery will fail (#671). Remove it — ccxray no longer needs it.'); |
There was a problem hiding this comment.
When chatgpt_base_url includes URL userinfo, a query token, or another credential (for example, an authenticated local proxy), interpolating the complete value copies that secret into stderr and potentially captured launch logs. The warning only needs the host and port to identify the stale loopback setting, so redact credentials and query/fragment data before printing it.
Useful? React with 👍 / 👎.
) Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
1 participant
Fixes #671.
Problem
ChatGPT-login Codex (0.159.2, 0.163.0) aborted at startup through ccxray:
account/read failed during TUI bootstrap: workspace routing discovery failed (-32603). The launcher overrode bothopenai_base_urlandchatgpt_base_urlwithhttp://localhost:<port>/v1. Codex runs workspace discovery againstchatgpt_base_url, which then hit a wrong upstream path (404), and Codex also requires an HTTPSchatgpt_base_url.Fix
ccxray codexand the herdr plugin now pass only-c openai_base_url=<proxy>/v1.chatgpt_base_urlkeeps Codex's default (https://chatgpt.com/backend-api/), so account and discovery calls go straight to chatgpt.com over HTTPS. Model traffic (/responses, HTTP and WebSocket) still goes through ccxray and is recorded./v1, never in/backend-api/codex. Codex applies a discovered workspace origin to the openai provider only whensupports_codex_backend_routes()holds (base_url unset or ending in/backend-api/codex), so model traffic cannot be re-routed past the proxy.ccxray codexprints a read-only warning when$CODEX_HOME/config.tomlsetschatgpt_base_urlto a loopback address (the setup in the issue). It never edits the file.docs/codex-workspace-routing.mdis rewritten to describe the resolved state, including the residency caveat (CHATGPT_BASE_URLcovers the origin only;us/us_crworkspaces may still be rejected upstream). Also updated: env-vars, provider-modules, running-ccxray, wire-protocol-reference (obs-fragile, Codex 0.159.2–0.163.0), the openspec spec, and the CHANGELOG (moved from Known limitations to Fixed).Verification
/v1assertions fail on 3bfb426 and pass with this patch.CCXRAY_HOMEand a free port:ccxray codex -m gpt-6-lunastarted without -32603 and completed one prompt. Two entries were recorded (the turn plus title generation), with the correct cwd and exact cost. The test captures were deleted afterwards.