@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/internal-providers/provider-codex/test/relay.test.js

@@ -0,0 +1,600 @@
+import { codexProvider } from "../subscription.js";
+import { CodexBackendRelay, codexRelayAuth } from "../relay.js";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { startGateway } from "@velum-labs/routekit-gateway";
+import { borrowedBackendPorts, staticBackendModelPort } from "@velum-labs/routekit-provider-core";
+import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { Effect } from "effect";
+import { RelayOnlyBackend, relayPorts, SubscriptionAccountSet } from "@velum-labs/routekit-accounts";
+/**
+ * Regression (ENG-620): a Codex client pointed at the gateway keeps its own
+ * stock models. The relay merges the client's live stock catalog into
+ * `GET /v1/models` and adapts stock-model Responses requests to the Codex
+ * backend using the auth material the client itself attached.
+ */
+const CHATGPT_HEADERS = {
+    authorization: "Bearer chatgpt-token-redacted",
+    "chatgpt-account-id": "acct_123",
+    originator: "codex_cli_rs",
+    "openai-beta": "responses=v1"
+};
+const STOCK = [
+    {
+        slug: "gpt-5.5",
+        display_name: "GPT-5.5",
+        description: "Flagship",
+        visibility: "list",
+        priority: 0
+    },
+    {
+        slug: "gpt-5.3-codex",
+        display_name: "gpt-5.3-codex",
+        description: "Coding",
+        visibility: "list",
+        priority: 1
+    }
+];
+const FALLBACK_STOCK = [
+    {
+        slug: "gpt-5.5-cached",
+        display_name: "GPT-5.5 (cached)",
+        description: "Snapshot",
+        visibility: "list",
+        priority: 0
+    }
+];
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function closeServer(server) {
+    await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+}
+/** A stand-in for the ChatGPT Codex backend (`/models` + streaming `/responses`). */
+async function startMockCodexBackend() {
+    const state = {
+        url: "",
+        modelsRequests: [],
+        responsesRequests: [],
+        failModels: false,
+        close: async () => { }
+    };
+    const server = createServer((req, res) => {
+        void (async () => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            if (req.method === "GET" && url.pathname === "/models") {
+                state.modelsRequests.push({ headers: req.headers, search: url.search });
+                if (state.failModels) {
+                    res.writeHead(503, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ error: "unavailable" }));
+                    return;
+                }
+                res.writeHead(200, { "content-type": "application/json", etag: 'W/"models-v1"' });
+                res.end(JSON.stringify(state.modelsPayload ?? { models: STOCK }));
+                return;
+            }
+            if (req.method === "POST" && url.pathname === "/responses") {
+                state.responsesRequests.push({
+                    headers: req.headers,
+                    body: JSON.parse(await readBody(req))
+                });
+                res.writeHead(200, { "content-type": "text/event-stream" });
+                res.write('event: response.output_text.delta\ndata: {"delta":"STOCK_OK"}\n\n');
+                res.write('event: response.completed\ndata: {"response":{"id":"resp_relay"}}\n\n');
+                res.end();
+                return;
+            }
+            res.writeHead(404).end();
+        })().catch((error) => res.writeHead(500).end(String(error)));
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    assert.ok(typeof address === "object" && address !== null);
+    state.url = `http://127.0.0.1:${address.port}`;
+    state.close = () => closeServer(server);
+    return state;
+}
+/** The merged-catalog builder a host would wire in (local entry first). */
+function catalog(template, stock) {
+    const local = { ...template, slug: "local-primary", display_name: "local-primary", priority: 0 };
+    const rest = stock.filter((entry) => entry.slug !== "local-primary");
+    return [local, ...rest];
+}
+/** A minimal backend that serves exactly one local model plus one native id. */
+function fakeBackend() {
+    const chatModels = [];
+    const backend = {
+        chatModels,
+        defaultModel: "local-primary",
+        ports: borrowedBackendPorts("local-primary"),
+        chat(body) {
+            const model = body.model ?? "local-primary";
+            chatModels.push(model);
+            return Effect.succeed(new Response(JSON.stringify({
+                id: "chatcmpl_local",
+                object: "chat.completion",
+                created: 0,
+                model,
+                choices: [
+                    {
+                        index: 0,
+                        message: { role: "assistant", content: "LOCAL_OK" },
+                        finish_reason: "stop"
+                    }
+                ],
+                usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 }
+            }), { status: 200, headers: { "content-type": "application/json" } }));
+        },
+        models: () => Effect.succeed(new Response(JSON.stringify({
+            object: "list",
+            data: [
+                { id: "local-primary", object: "model" },
+                { id: "gpt-native", object: "model" }
+            ]
+        }), { status: 200, headers: { "content-type": "application/json" } })),
+        embeddings: () => Effect.succeed(new Response("{}", { status: 501 }))
+    };
+    backend.ports = {
+        models: {
+            ...staticBackendModelPort(backend.defaultModel),
+            kind: "model-catalog",
+            list: () => ["local-primary", "gpt-native"],
+            resolve: (requested) => (requested === "gpt-native" ? "gpt-native" : "local-primary"),
+            serves: (model) => model === "local-primary" || model === "gpt-native"
+        },
+        responses: { kind: "unsupported" },
+        lifecycle: { kind: "borrowed" }
+    };
+    return backend;
+}
+async function startRelayGateway(backendUrl, authToken) {
+    const backend = fakeBackend();
+    const gateway = await startGateway({
+        backend,
+        ...(authToken !== undefined ? { authToken } : {}),
+        codexRelay: relayPorts(new CodexBackendRelay({
+            backendUrl,
+            catalog,
+            fallbackStock: () => FALLBACK_STOCK,
+            logger: { warn: () => { }, error: () => { } }
+        }))
+    });
+    return { gateway, backend };
+}
+test("codexRelayAuth only accepts the ChatGPT bearer + account-id pair", () => {
+    assert.ok(codexRelayAuth(CHATGPT_HEADERS));
+    assert.equal(codexRelayAuth({ authorization: "Bearer sk-api-key" }), undefined);
+    assert.equal(codexRelayAuth({ "chatgpt-account-id": "acct_123" }), undefined);
+    assert.equal(codexRelayAuth({ authorization: "Basic abc", "chatgpt-account-id": "acct_123" }), undefined);
+    assert.equal(codexRelayAuth({}), undefined);
+});
+test("GET /v1/models with ChatGPT auth merges the live stock catalog behind local entries", async () => {
+    const upstream = await startMockCodexBackend();
+    const { gateway } = await startRelayGateway(upstream.url);
+    try {
+        const response = await fetch(`${gateway.url()}/v1/models?client_version=0.142.5`, {
+            headers: CHATGPT_HEADERS
+        });
+        assert.equal(response.status, 200);
+        assert.equal(response.headers.get("etag"), 'W/"models-v1"', "upstream ETag forwarded");
+        const body = (await response.json());
+        // Codex's ModelInfo catalog: local entries first, then the live stock list.
+        assert.deepEqual(body.models.map((entry) => entry.slug), ["local-primary", "gpt-native", "gpt-5.5", "gpt-5.3-codex"]);
+        // OpenAI-shape clients still see `data`, extended with the stock slugs.
+        assert.deepEqual(body.data.map((entry) => entry.id), ["local-primary", "gpt-native", "gpt-5.5", "gpt-5.3-codex"]);
+        // The upstream fetch carried the client's own auth + originator headers.
+        const seen = upstream.modelsRequests[0];
+        assert.ok(seen);
+        assert.equal(seen.headers.authorization, CHATGPT_HEADERS.authorization);
+        assert.equal(seen.headers["chatgpt-account-id"], CHATGPT_HEADERS["chatgpt-account-id"]);
+        assert.equal(seen.headers.originator, "codex_cli_rs");
+        assert.equal(seen.search, "?client_version=0.142.5", "query forwarded verbatim");
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await upstream.close();
+    }
+});
+test("GET /v1/models falls back to the stock snapshot without auth or when upstream fails", async () => {
+    const upstream = await startMockCodexBackend();
+    const { gateway } = await startRelayGateway(upstream.url);
+    try {
+        // No relayable auth: no upstream call, snapshot merge instead.
+        const anonymous = (await (await fetch(`${gateway.url()}/v1/models`)).json());
+        assert.deepEqual(anonymous.models.map((entry) => entry.slug), ["local-primary", "gpt-native", "gpt-5.5-cached"]);
+        assert.equal(upstream.modelsRequests.length, 0);
+        // Upstream down: authenticated fetch degrades to the same snapshot merge.
+        upstream.failModels = true;
+        const degraded = (await (await fetch(`${gateway.url()}/v1/models`, { headers: CHATGPT_HEADERS })).json());
+        assert.deepEqual(degraded.models.map((entry) => entry.slug), ["local-primary", "gpt-native", "gpt-5.5-cached"]);
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await upstream.close();
+    }
+});
+test("GET /v1/models validates the upstream shape: bad envelopes fall back, bad entries are dropped", async () => {
+    const upstream = await startMockCodexBackend();
+    const { gateway } = await startRelayGateway(upstream.url);
+    try {
+        // An unexpected envelope (no `models` array) degrades to the snapshot
+        // merge instead of trusting an arbitrary shape.
+        upstream.modelsPayload = { data: [{ id: "not-the-codex-shape" }] };
+        const degraded = (await (await fetch(`${gateway.url()}/v1/models`, { headers: CHATGPT_HEADERS })).json());
+        assert.deepEqual(degraded.models.map((entry) => entry.slug), ["local-primary", "gpt-native", "gpt-5.5-cached"]);
+        // Per-entry salvage: malformed entries (no string slug, non-objects) are
+        // dropped without costing the rest of the live catalog.
+        upstream.modelsPayload = {
+            models: [STOCK[0], { display_name: "no slug" }, null, "nope", { slug: "" }, STOCK[1]]
+        };
+        const salvaged = (await (await fetch(`${gateway.url()}/v1/models`, { headers: CHATGPT_HEADERS })).json());
+        assert.deepEqual(salvaged.models.map((entry) => entry.slug), ["local-primary", "gpt-native", "gpt-5.5", "gpt-5.3-codex"]);
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await upstream.close();
+    }
+});
+test("POST /v1/responses normalizes public string input under the client's own auth", async () => {
+    const upstream = await startMockCodexBackend();
+    const { gateway, backend } = await startRelayGateway(upstream.url);
+    try {
+        const response = await fetch(`${gateway.url()}/v1/responses`, {
+            method: "POST",
+            headers: { ...CHATGPT_HEADERS, "content-type": "application/json" },
+            body: JSON.stringify({
+                model: "gpt-5.3-codex",
+                input: "hello",
+                stream: true,
+                max_output_tokens: 64
+            })
+        });
+        assert.equal(response.status, 200);
+        assert.match(response.headers.get("content-type") ?? "", /text\/event-stream/);
+        const text = await response.text();
+        assert.match(text, /STOCK_OK/);
+        assert.match(text, /response\.completed/);
+        // The upstream saw canonical item-list input and the client's own auth headers.
+        const seen = upstream.responsesRequests[0];
+        assert.ok(seen);
+        assert.equal(seen.headers.authorization, CHATGPT_HEADERS.authorization);
+        assert.equal(seen.headers["chatgpt-account-id"], CHATGPT_HEADERS["chatgpt-account-id"]);
+        assert.deepEqual(seen.body, {
+            model: "gpt-5.3-codex",
+            input: [
+                {
+                    type: "message",
+                    role: "user",
+                    content: [{ type: "input_text", text: "hello" }]
+                }
+            ],
+            stream: true,
+            max_output_tokens: 64
+        });
+        // Nothing leaked into the local backend for a stock pick.
+        assert.deepEqual(backend.chatModels, []);
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await upstream.close();
+    }
+});
+test("POST /v1/responses preserves native item lists and continuation fields", async () => {
+    const upstream = await startMockCodexBackend();
+    const relay = new CodexBackendRelay({
+        backendUrl: upstream.url,
+        catalog,
+        fallbackStock: () => FALLBACK_STOCK,
+        logger: { warn: () => { }, error: () => { } }
+    });
+    const input = [
+        {
+            type: "message",
+            role: "user",
+            content: [{ type: "input_text", text: "Use the tool." }]
+        },
+        {
+            type: "reasoning",
+            id: "rs_1",
+            encrypted_content: "provider-owned-ciphertext",
+            summary: []
+        },
+        {
+            type: "function_call",
+            id: "fc_1",
+            call_id: "call_1",
+            name: "read_file",
+            arguments: '{"path":"README.md"}'
+        },
+        {
+            type: "function_call_output",
+            call_id: "call_1",
+            output: "# RouteKit"
+        },
+        {
+            type: "item_reference",
+            id: "msg_prior"
+        }
+    ];
+    try {
+        const body = {
+            model: "gpt-5.3-codex",
+            input,
+            previous_response_id: "resp_previous",
+            include: ["reasoning.encrypted_content"],
+            stream: true
+        };
+        const response = await runRouteKitEffect(relay.relayResponses({ ...CHATGPT_HEADERS, "content-type": "application/json" }, body));
+        assert.equal(response.status, 200);
+        await response.text();
+        assert.deepEqual(upstream.responsesRequests[0]?.body, body);
+    }
+    finally {
+        await upstream.close();
+    }
+});
+test("POST /v1/responses keeps locally served models local and unknown models local without auth", async () => {
+    const upstream = await startMockCodexBackend();
+    const { gateway, backend } = await startRelayGateway(upstream.url);
+    try {
+        // A gateway-served model with ChatGPT auth attached: handled locally.
+        const local = await fetch(`${gateway.url()}/v1/responses`, {
+            method: "POST",
+            headers: { ...CHATGPT_HEADERS, "content-type": "application/json" },
+            body: JSON.stringify({ model: "gpt-native", input: "hello", stream: false })
+        });
+        assert.equal(local.status, 200);
+        assert.match(await local.text(), /LOCAL_OK/);
+        // An unknown model WITHOUT relayable auth: historical fold-to-default.
+        const anonymous = await fetch(`${gateway.url()}/v1/responses`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ model: "gpt-5.3-codex", input: "hello", stream: false })
+        });
+        assert.equal(anonymous.status, 200);
+        assert.match(await anonymous.text(), /LOCAL_OK/);
+        assert.equal(upstream.responsesRequests.length, 0, "nothing was relayed");
+        assert.deepEqual(backend.chatModels, ["gpt-native", "local-primary"]);
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await upstream.close();
+    }
+});
+test("a gateway auth token disables the relay entirely", async () => {
+    const upstream = await startMockCodexBackend();
+    const { gateway } = await startRelayGateway(upstream.url, "gateway-token");
+    try {
+        const models = (await (await fetch(`${gateway.url()}/v1/models`, {
+            headers: { authorization: "Bearer gateway-token" }
+        })).json());
+        assert.deepEqual(models.models.map((entry) => entry.slug), ["local-primary", "gpt-native"], "gateway auth exposes only the local dual-shape catalog");
+        assert.deepEqual(models.data.map((entry) => entry.id), ["local-primary", "gpt-native"]);
+        assert.equal(upstream.modelsRequests.length, 0);
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await upstream.close();
+    }
+});
+test("server-owned Codex relay reroutes HTTP 200 terminal usage failure without leaking bytes", async () => {
+    const directory = mkdtempSync(join(tmpdir(), "routekit-codex-relay-pool-"));
+    const token = "eyJhbGciOiJub25lIn0.eyJleHAiOjk5OTk5OTk5OTl9.";
+    const outputText = "x".repeat(1_100_000);
+    for (const [name, accountId] of [
+        ["a", "acct-a"],
+        ["b", "acct-b"]
+    ]) {
+        writeFileSync(join(directory, `${name}.json`), JSON.stringify({
+            tokens: {
+                access_token: token,
+                refresh_token: `refresh-${name}`,
+                account_id: accountId
+            }
+        }));
+    }
+    const seenAccounts = [];
+    const server = createServer((req, res) => {
+        void (async () => {
+            const accountId = String(req.headers["chatgpt-account-id"]);
+            seenAccounts.push(accountId);
+            const body = JSON.parse(await readBody(req));
+            assert.equal(body.model, "gpt-5.5");
+            assert.deepEqual(body.input, [
+                {
+                    type: "message",
+                    role: "user",
+                    content: [{ type: "input_text", text: "hello" }]
+                }
+            ]);
+            assert.equal(body.store, false);
+            assert.equal(body.stream, true);
+            assert.equal(body.max_output_tokens, undefined);
+            assert.equal(body.temperature, undefined);
+            assert.equal(body.top_p, undefined);
+            res.writeHead(200, { "content-type": "application/octet-stream" });
+            if (accountId === "acct-a") {
+                res.end(`event: response.failed\ndata: ${JSON.stringify({
+                    response: {
+                        error: {
+                            type: "usage_limit_reached",
+                            code: "weekly_limit",
+                            message: "weekly usage limit reached",
+                            resets_at: Math.floor(Date.now() / 1000) + 300
+                        }
+                    }
+                })}\n\n`);
+                return;
+            }
+            res.end([
+                `event: response.output_item.done\ndata: ${JSON.stringify({
+                    type: "response.output_item.done",
+                    output_index: 0,
+                    item: {
+                        type: "message",
+                        id: "msg_pooled",
+                        status: "completed",
+                        role: "assistant",
+                        content: [{ type: "output_text", text: outputText, annotations: [] }]
+                    }
+                })}\n\n`,
+                `event: response.completed\ndata: ${JSON.stringify({
+                    response: {
+                        id: "resp_pooled",
+                        model: body.model,
+                        output: []
+                    }
+                })}\n\n`
+            ].join(""));
+        })().catch((error) => res.writeHead(500).end(String(error)));
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    assert.ok(typeof address === "object" && address !== null);
+    const accounts = await runRouteKitEffect(SubscriptionAccountSet.open(codexProvider(), {
+        source: { kind: "directory", path: directory },
+        strategy: "sticky"
+    }));
+    const relay = new CodexBackendRelay({
+        backendUrl: `http://127.0.0.1:${address.port}`,
+        catalog,
+        auth: { kind: "accounts", accounts }
+    });
+    const records = [];
+    const gateway = await startGateway({
+        backend: new RelayOnlyBackend(),
+        providerRelays: { codex: relayPorts(relay) },
+        provenance: { onModelCall: (record) => records.push(record) }
+    });
+    try {
+        const response = await fetch(`${gateway.url()}/v1/responses`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                model: "gpt-5.5",
+                input: "hello",
+                max_output_tokens: 128,
+                temperature: 0.2,
+                top_p: 0.9
+            })
+        });
+        assert.equal(response.status, 200);
+        assert.match(response.headers.get("content-type") ?? "", /application\/json/u);
+        const responseBody = (await response.json());
+        assert.equal(responseBody.id, "resp_pooled");
+        assert.equal(responseBody.status, "completed");
+        assert.equal(responseBody.output?.[0]?.content?.[0]?.text, outputText);
+        assert.deepEqual(seenAccounts, ["acct-a", "acct-b"]);
+        const snapshot = accounts.snapshot();
+        assert.ok(snapshot.members.find((member) => member.id === "a")?.coolingUntil);
+        assert.equal(snapshot.members.find((member) => member.lastSelected)?.id, "b");
+        assert.equal(records.length, 2);
+        assert.equal(records[0]?.status, "failed");
+        assert.equal(records[1]?.status, "succeeded");
+        assert.deepEqual({
+            attempts: records[1]?.metadata?.attribution?.attempts,
+            retries: records[1]?.metadata?.attribution?.retries,
+            account_failovers: records[1]?.metadata?.attribution?.account_failovers
+        }, { attempts: 2, retries: 1, account_failovers: 1 });
+        assert.match(records[1]?.metadata?.attribution?.account?.seat ?? "", /^seat_[0-9a-f]{16}$/);
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await closeServer(server);
+        rmSync(directory, { recursive: true, force: true });
+    }
+});
+test("server-owned Codex relay retries a pre-response transport disconnect once", async () => {
+    const directory = mkdtempSync(join(tmpdir(), "routekit-codex-relay-transport-"));
+    const token = "eyJhbGciOiJub25lIn0.eyJleHAiOjk5OTk5OTk5OTl9.";
+    writeFileSync(join(directory, "a.json"), JSON.stringify({
+        tokens: {
+            access_token: token,
+            refresh_token: "refresh-a",
+            account_id: "acct-a"
+        }
+    }));
+    let upstreamAttempts = 0;
+    const server = createServer((req, res) => {
+        void (async () => {
+            upstreamAttempts += 1;
+            await readBody(req);
+            if (upstreamAttempts === 1) {
+                req.socket.destroy();
+                return;
+            }
+            res.writeHead(200, { "content-type": "text/event-stream" });
+            res.end([
+                `event: response.output_item.done\ndata: ${JSON.stringify({
+                    type: "response.output_item.done",
+                    output_index: 0,
+                    item: {
+                        type: "message",
+                        id: "msg_transport_retry",
+                        status: "completed",
+                        role: "assistant",
+                        content: [{ type: "output_text", text: "recovered", annotations: [] }]
+                    }
+                })}\n\n`,
+                `event: response.completed\ndata: ${JSON.stringify({
+                    response: {
+                        id: "resp_transport_retry",
+                        model: "gpt-5.5",
+                        output: []
+                    }
+                })}\n\n`
+            ].join(""));
+        })().catch((error) => res.writeHead(500).end(String(error)));
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    assert.ok(typeof address === "object" && address !== null);
+    const accounts = await runRouteKitEffect(SubscriptionAccountSet.open(codexProvider(), {
+        source: { kind: "directory", path: directory },
+        strategy: "sticky"
+    }));
+    const relay = new CodexBackendRelay({
+        backendUrl: `http://127.0.0.1:${address.port}`,
+        catalog,
+        auth: { kind: "accounts", accounts }
+    });
+    const records = [];
+    const gateway = await startGateway({
+        backend: new RelayOnlyBackend(),
+        providerRelays: { codex: relayPorts(relay) },
+        provenance: { onModelCall: (record) => records.push(record) }
+    });
+    try {
+        const response = await fetch(`${gateway.url()}/v1/responses`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ model: "gpt-5.5", input: "hello", stream: false })
+        });
+        assert.equal(response.status, 200);
+        assert.match(response.headers.get("content-type") ?? "", /application\/json/u);
+        const body = (await response.json());
+        assert.equal(body.id, "resp_transport_retry");
+        assert.equal(body.output?.[0]?.content?.[0]?.text, "recovered");
+        assert.equal(upstreamAttempts, 2);
+        assert.equal(records.length, 2);
+        assert.equal(records[0]?.status, "failed");
+        assert.equal(records[1]?.status, "succeeded");
+        assert.deepEqual({
+            attempts: records[1]?.metadata?.attribution?.attempts,
+            retries: records[1]?.metadata?.attribution?.retries,
+            account_failovers: records[1]?.metadata?.attribution?.account_failovers
+        }, { attempts: 2, retries: 1, account_failovers: 0 });
+    }
+    finally {
+        await Effect.runPromise(gateway.close);
+        await closeServer(server);
+        rmSync(directory, { recursive: true, force: true });
+    }
+});

package/dist/internal-providers/provider-codex/test/subscription.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-codex/test/subscription.test.js

@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { subscriptionInfo } from "@velum-labs/routekit-registry";
+import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { codexProvider } from "../subscription.js";
+test("Codex refresh uses stored OAuth client provenance with registry fallback", async () => {
+    const root = mkdtempSync(join(tmpdir(), "routekit-codex-oauth-client-"));
+    const customPath = join(root, "custom.json");
+    const officialPath = join(root, "official.json");
+    writeFileSync(customPath, JSON.stringify({
+        tokens: {
+            access_token: "custom-access",
+            refresh_token: "custom-refresh",
+            id_token: "custom-id-token"
+        },
+        routekit: {
+            oauthClientId: "custom-codex-client",
+            retained: true
+        }
+    }));
+    writeFileSync(officialPath, JSON.stringify({
+        tokens: {
+            access_token: "official-access",
+            refresh_token: "official-refresh"
+        }
+    }));
+    const originalFetch = globalThis.fetch;
+    const clientIds = [];
+    globalThis.fetch = async (input, init) => {
+        assert.equal(String(input), subscriptionInfo("codex").oauth.tokenEndpoint);
+        const clientId = new URLSearchParams(String(init?.body)).get("client_id");
+        assert.ok(clientId);
+        clientIds.push(clientId);
+        return Response.json({
+            access_token: `rotated-access-${clientIds.length}`,
+            refresh_token: `rotated-refresh-${clientIds.length}`,
+            expires_in: 3600
+        });
+    };
+    try {
+        const provider = codexProvider();
+        const custom = await runRouteKitEffect(provider.loadCredential(customPath));
+        assert.equal(custom.oauthClientId, "custom-codex-client");
+        const refreshedCustom = await runRouteKitEffect(provider.refresh(custom));
+        assert.equal(refreshedCustom.oauthClientId, "custom-codex-client");
+        const persist = provider.persistCredential;
+        assert.ok(persist);
+        const persistedCustom = await runRouteKitEffect(persist(custom, refreshedCustom));
+        assert.equal(persistedCustom.oauthClientId, "custom-codex-client");
+        const persistedBlob = JSON.parse(readFileSync(customPath, "utf8"));
+        assert.equal(persistedBlob.tokens?.id_token, "custom-id-token");
+        assert.equal(persistedBlob.routekit?.oauthClientId, "custom-codex-client");
+        assert.equal(persistedBlob.routekit?.retained, true);
+        const official = await runRouteKitEffect(provider.loadCredential(officialPath));
+        assert.equal(official.oauthClientId, undefined);
+        const refreshedOfficial = await runRouteKitEffect(provider.refresh(official));
+        assert.equal(refreshedOfficial.oauthClientId, undefined);
+        assert.deepEqual(clientIds, [
+            "custom-codex-client",
+            subscriptionInfo("codex").oauth.clientId
+        ]);
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/internal-providers/provider-codex/test/translated-content.test.d.ts

@@ -0,0 +1 @@
+export {};