[friel-openai]

WebDAV pushes with credentials in the URL fail after curl 8.23.0 or a distribution backport of its CURLINFO_EFFECTIVE_URL security fix. Curl now removes userinfo from that result even without an HTTP redirect. Git treats the sanitized URL as a redirect and starts git-http-push without the username, so its PROPFIND request gets HTTP 401.

Use the requested URL already tracked by http_request_with_redirects() for effective_url and update_url_from_redirect(). Actual redirects still select the destination credential context before requesting it. Add a test that supplies a username and password, checks the remote ref, and rejects an unexpected prompt or redirect warning.

The source branch starts at the intended prerequisite af/codex/http-auth-retry-redirect-v2 (b81ca645fdf0), rather than a generated codex tip. The fix and regression patch is unchanged by this ancestry correction (git range-diff reports equality). A separate commit retains the three exact CI workflow blobs accepted by the controller. The review target remains codex; this is a review-only topic PR.

Found in linux-meson t5540.18 while validating #141. The failure reproduces at #141's unchanged codex base; WebDAV uses git-http-push, not the send-pack negotiation code changed by #141. The same base tree passed on October 5 with Ubuntu curl 8.18.0-1ubuntu2.7. The failing run installed .8, which includes the October 14 CURLINFO_EFFECTIVE_URL security fix. This was a dependency change after passing CI, rather than an untested Git change. The regression test and code comment preserve the distinction between a requested URL and curl's sanitized URL.

The same curl behavior also causes dumb-HTTP authentication tests t5550.15, .16, and .20 to fail on #141’s explicit-haves prerequisite a3eae730133768ea334731d2f48a80aff724fb5d. All three failures reproduce on that unchanged prerequisite with curl 8.23; all 63 tests pass with curl 8.5. The HTTP source and affected tests are unchanged by #141. PR126, the prerequisite of this PR, already fixes those dumb-HTTP cases by preserving authentication across discovery requests. Its source and this PR’s source each pass all 63 tests with curl 8.23 and SHA-256. This PR adds the WebDAV correction; its patch alone does not apply to the older automatic-redirect implementation.

Validation:

• Before the fix, the existing username-only test and new username/password test fail with curl 8.23.0.
• After the fix, t5540, t5550, t5551, t5549, t5563, and t5812 pass with curl 8.5.0 and 8.23.0: 223 tests per version, including existing expected failures and prerequisite skips.
• After correcting source ancestry, the DEVELOPER build and the same six HTTP scripts pass with curl 8.23.0: 203 tests on the prerequisite source tree. Unrelated generated topics account for the different test count.
• Test lint and git diff --check pass. Standalone topic CI remains prerequisite-dependent; the combined validation below is green.

A CI-only combined candidate tests #141, this PR, #143, and the existing HTTP prerequisites, including the version-specific Debian HTTP/2 quarantine. All 306 local tests across t0610, t5540, t5549, t5550, t5556, and t5702 pass on that composition with curl 8.23; combined CI completed successfully: 45 jobs passed, two expected jobs were skipped, and none failed. The candidate leaves topic source ancestry intact and contains no release or controller workflow.

This is a client-only change compatible with existing HTTP servers and both tested curl versions. Clients can be updated independently. Reverting restores the WebDAV failure with the newer curl behavior; repository data formats are unchanged.

The tested candidate is 2006a35b7b78c1024e56f1658f7f1190f4b76a7c, assembled from public master b8242b093d9e941a34460d715e3ce616a34ac3fe with these exact sources: explicit-haves prerequisite a3eae730133768ea334731d2f48a80aff724fb5d, #141 772653bcb2b069505961b0b10604b0abf5a13062, HTTP redirect prerequisite b81ca645fdf0bf70789691823f9d7a4abbb05697, gzip authentication prerequisite 50f753ee38ef84de2fc22ca5cdde6698f0479f85, Debian HTTP/2 quarantine 003e6089a2598e2f37eb2326ab3947836ebb86c0, #142 0ad3526206bbe3c820e9aced7832c6d3e2c9e7ac, and #143 b1013cd9c374194c94a35889dca67d7ca57fdb7a. This validates the combined source; human review and normal controller staging remain required.

-frielbot

Codex Task: codex://threads/01a13b95-2df7-75a1-bc99-4266c08d7d89

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T19:15:03.837346Z	3db54bf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ttaylorr-oai]

Reviewed the URL tracking change and regression test. The requested URL retains credentials when curl strips userinfo, while real redirects still select the destination credential context. Existing CI passes; this fixes the WebDAV failure on the current release base.