responses-proxy 0.1.0

package/dist/schema.js

@@ -0,0 +1,118 @@
+import { z } from "zod";
+const passthroughRecordSchema = z.record(z.string(), z.unknown());
+const inputTextPartSchema = z.object({
+    type: z.literal("input_text"),
+    text: z.string(),
+});
+const inputImagePartSchema = z.object({
+    type: z.literal("input_image"),
+    image_url: z.string().min(1),
+});
+const outputTextPartSchema = z.object({
+    type: z.literal("output_text"),
+    text: z.string(),
+});
+const contentPartSchema = z.union([
+    inputTextPartSchema,
+    inputImagePartSchema,
+    outputTextPartSchema,
+]);
+const imageUrlValueSchema = z.union([
+    z.string().min(1),
+    z.object({
+        url: z.string().min(1),
+    }),
+]);
+const chatTextPartSchema = z.object({
+    type: z.literal("text"),
+    text: z.string(),
+});
+const chatImagePartSchema = z.object({
+    type: z.literal("image_url"),
+    image_url: imageUrlValueSchema,
+});
+const chatContentPartSchema = z.union([chatTextPartSchema, chatImagePartSchema]);
+const assistantToolCallSchema = z.object({
+    id: z.string().optional(),
+    type: z.literal("function").optional(),
+    function: z.object({
+        name: z.string(),
+        arguments: z.string().optional(),
+    }),
+});
+const messageSchema = z.object({
+    role: z.enum(["user", "assistant", "system", "developer", "tool"]),
+    content: z.union([z.string(), z.array(chatContentPartSchema)]).optional(),
+    tool_calls: z.array(assistantToolCallSchema).optional(),
+    tool_call_id: z.string().optional(),
+    name: z.string().optional(),
+});
+const inputItemSchema = z.object({
+    role: z.enum(["user", "assistant", "system", "tool"]),
+    content: z.union([z.string(), z.array(contentPartSchema)]),
+});
+const functionToolSchema = z.object({
+    type: z.literal("function"),
+    name: z.string().optional(),
+    description: z.string().optional(),
+    parameters: z.record(z.string(), z.unknown()).optional(),
+    strict: z.boolean().optional(),
+    function: z
+        .object({
+        name: z.string(),
+        description: z.string().optional(),
+        parameters: z.record(z.string(), z.unknown()).optional(),
+        strict: z.boolean().optional(),
+    })
+        .optional(),
+});
+const passthroughToolSchema = passthroughRecordSchema;
+const toolChoiceSchema = z.union([
+    z.enum(["none", "auto", "required"]),
+    passthroughRecordSchema,
+]);
+const reasoningSchema = z.object({
+    effort: z.enum(["minimal", "low", "medium", "high"]).optional(),
+    summary: z.enum(["auto", "none", "concise", "detailed"]).optional(),
+});
+const textSchema = z.object({
+    verbosity: z.enum(["low", "medium", "high"]).optional(),
+    format: passthroughRecordSchema.optional(),
+});
+export const proxyResponsesRequestSchema = z
+    .object({
+    model: z.string().min(1),
+    input: z
+        .union([z.string(), z.array(z.union([inputItemSchema, passthroughRecordSchema]))])
+        .optional(),
+    messages: z.array(messageSchema).optional(),
+    instructions: z.string().optional(),
+    store: z.boolean().optional(),
+    stream: z.boolean().optional(),
+    tools: z.array(z.union([functionToolSchema, passthroughToolSchema])).optional(),
+    tool_choice: toolChoiceSchema.optional(),
+    parallel_tool_calls: z.boolean().optional(),
+    reasoning: reasoningSchema.nullable().optional(),
+    text: textSchema.nullable().optional(),
+    max_output_tokens: z.number().int().positive().optional(),
+    max_tool_calls: z.number().int().positive().optional(),
+    temperature: z.number().optional(),
+    top_p: z.number().optional(),
+    metadata: z.record(z.string(), z.string()).optional(),
+    user: z.string().optional(),
+    previous_response_id: z.string().optional(),
+    truncation: z.enum(["auto", "disabled"]).optional(),
+    include: z.array(z.string()).optional(),
+    prompt_cache_key: z.string().optional(),
+    prompt_cache_retention: z.string().optional(),
+})
+    .passthrough()
+    .superRefine((value, ctx) => {
+    if (value.input === undefined && value.messages === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["input"],
+            message: "Either input or messages must be provided",
+        });
+    }
+});

package/dist/schema.test.js

@@ -0,0 +1,16 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { proxyResponsesRequestSchema } from "./schema.js";
+test("accepts nullable reasoning and text fields from responses clients", () => {
+    const parsed = proxyResponsesRequestSchema.safeParse({
+        model: "gpt-5.4",
+        input: "ping",
+        reasoning: null,
+        text: null,
+    });
+    assert.equal(parsed.success, true);
+    if (parsed.success) {
+        assert.equal(parsed.data.reasoning, null);
+        assert.equal(parsed.data.text, null);
+    }
+});

package/dist/sepay-webhook.js

@@ -0,0 +1,87 @@
+const REQUEST_ID_PATTERN = /Chuc\s+ngon\s+mieng\s+ma\s+([A-Fa-f0-9-]{8,})/i;
+const DEFAULT_FALLBACK_AMOUNT_VND = 5_000;
+export function resolveExpectedAmountVnd(request, billing) {
+    if (typeof request.priceVnd === "number" && request.priceVnd > 0) {
+        return request.priceVnd;
+    }
+    if (request.kind === "renewal") {
+        const planId = request.requestedPlanId ?? "basic";
+        const plan = billing.getPlan(planId);
+        if (plan && plan.currency === "VND" && plan.priceCents > 0) {
+            return plan.priceCents;
+        }
+    }
+    return DEFAULT_FALLBACK_AMOUNT_VND;
+}
+export function extractRequestIdFromContent(content) {
+    if (!content) {
+        return undefined;
+    }
+    const match = content.match(REQUEST_ID_PATTERN);
+    return match ? match[1] : undefined;
+}
+export function processSepayWebhook(args) {
+    const payload = args.payload;
+    const transferType = typeof payload.transferType === "string" ? payload.transferType.toLowerCase() : undefined;
+    if (transferType && transferType !== "in") {
+        return { status: "ignored", reason: `transfer_type_${transferType}` };
+    }
+    const requestId = extractRequestIdFromContent(typeof payload.content === "string" ? payload.content : undefined);
+    if (!requestId) {
+        return { status: "ignored", reason: "no_request_id_in_content" };
+    }
+    const request = args.billing.getRenewalRequest(requestId);
+    if (!request) {
+        return { status: "ignored", reason: "request_not_found" };
+    }
+    if (request.status !== "open") {
+        return { status: "already_processed", request };
+    }
+    const receivedAmount = Number(payload.transferAmount);
+    if (!Number.isFinite(receivedAmount) || receivedAmount <= 0) {
+        return { status: "ignored", reason: "invalid_amount" };
+    }
+    const expectedAmount = resolveExpectedAmountVnd(request, args.billing);
+    if (receivedAmount !== expectedAmount) {
+        args.auditLog.record({
+            event: "payment.amount_mismatch",
+            actor: { type: "system", id: "sepay-webhook" },
+            subjectType: "renewal_request",
+            subjectId: request.id,
+            metadata: {
+                telegramUserId: request.telegramUserId,
+                workspaceId: request.workspaceId,
+                receivedAmountVnd: receivedAmount,
+                expectedAmountVnd: expectedAmount,
+                referenceCode: typeof payload.referenceCode === "string" ? payload.referenceCode : undefined,
+            },
+        });
+        return { status: "amount_mismatch", request, receivedAmount, expectedAmount };
+    }
+    const confirmed = args.billing.confirmRenewalPayment({
+        id: request.id,
+        resolution: "payment_confirmed_sepay_webhook",
+        expectedStatus: "open",
+    });
+    if (!confirmed) {
+        const latest = args.billing.getRenewalRequest(request.id);
+        return latest
+            ? { status: "already_processed", request: latest }
+            : { status: "ignored", reason: "request_gone" };
+    }
+    args.auditLog.record({
+        event: "payment.confirmed_sepay",
+        actor: { type: "system", id: "sepay-webhook" },
+        subjectType: "renewal_request",
+        subjectId: request.id,
+        metadata: {
+            telegramUserId: request.telegramUserId,
+            workspaceId: request.workspaceId,
+            amountVnd: receivedAmount,
+            transferDescription: typeof payload.content === "string" ? payload.content : undefined,
+            referenceCode: typeof payload.referenceCode === "string" ? payload.referenceCode : undefined,
+            gateway: typeof payload.gateway === "string" ? payload.gateway : undefined,
+        },
+    });
+    return { status: "confirmed", request: confirmed, amountVnd: receivedAmount };
+}

package/dist/sepay-webhook.test.js

@@ -0,0 +1,142 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { AuditLogRepository } from "./audit-log.js";
+import { BillingRepository } from "./billing.js";
+import { CustomerWorkspaceRepository } from "./telegram-bot/customer-workspace-repository.js";
+import { processSepayWebhook } from "./sepay-webhook.js";
+function setup() {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "sepay-webhook-"));
+    const dbFile = path.join(dir, "bot.sqlite");
+    const billing = BillingRepository.create(dbFile);
+    const audit = AuditLogRepository.create(dbFile);
+    const workspaces = CustomerWorkspaceRepository.create(dbFile);
+    return {
+        billing,
+        audit,
+        workspaces,
+        cleanup() {
+            rmSync(dir, { recursive: true, force: true });
+        },
+    };
+}
+test("sepay webhook confirms a matching renewal request", () => {
+    const { billing, audit, workspaces, cleanup } = setup();
+    try {
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const created = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+            priceVnd: 5_000,
+        });
+        const outcome = processSepayWebhook({
+            payload: {
+                transferAmount: 5_000,
+                transferType: "in",
+                content: `Chuc ngon mieng ma ${created.request.id}`,
+                referenceCode: "FT123",
+            },
+            billing,
+            auditLog: audit,
+        });
+        assert.equal(outcome.status, "confirmed");
+        assert.equal(billing.getRenewalRequest(created.request.id)?.status, "payment_confirmed");
+        const events = audit.listEvents({ event: "payment.confirmed_sepay", limit: 5 });
+        assert.equal(events.length, 1);
+    }
+    finally {
+        cleanup();
+    }
+});
+test("sepay webhook records mismatch without confirming on wrong amount", () => {
+    const { billing, audit, workspaces, cleanup } = setup();
+    try {
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const created = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+            priceVnd: 5_000,
+        });
+        const outcome = processSepayWebhook({
+            payload: {
+                transferAmount: 1_000,
+                transferType: "in",
+                content: `Chuc ngon mieng ma ${created.request.id}`,
+            },
+            billing,
+            auditLog: audit,
+        });
+        assert.equal(outcome.status, "amount_mismatch");
+        assert.equal(billing.getRenewalRequest(created.request.id)?.status, "open");
+        assert.equal(audit.listEvents({ event: "payment.amount_mismatch", limit: 5 }).length, 1);
+        assert.equal(audit.listEvents({ event: "payment.confirmed_sepay", limit: 5 }).length, 0);
+    }
+    finally {
+        cleanup();
+    }
+});
+test("sepay webhook ignores payloads without a recognizable request id", () => {
+    const { billing, audit, cleanup } = setup();
+    try {
+        const outcome = processSepayWebhook({
+            payload: {
+                transferAmount: 5_000,
+                transferType: "in",
+                content: "unrelated transfer",
+            },
+            billing,
+            auditLog: audit,
+        });
+        assert.equal(outcome.status, "ignored");
+        assert.equal(audit.listEvents({ limit: 5 }).length, 0);
+    }
+    finally {
+        cleanup();
+    }
+});
+test("sepay webhook reports already_processed for non-open requests", () => {
+    const { billing, audit, workspaces, cleanup } = setup();
+    try {
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const created = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+            priceVnd: 5_000,
+        });
+        billing.confirmRenewalPayment({ id: created.request.id, expectedStatus: "open" });
+        const outcome = processSepayWebhook({
+            payload: {
+                transferAmount: 5_000,
+                transferType: "in",
+                content: `Chuc ngon mieng ma ${created.request.id}`,
+            },
+            billing,
+            auditLog: audit,
+        });
+        assert.equal(outcome.status, "already_processed");
+        assert.equal(audit.listEvents({ event: "payment.confirmed_sepay", limit: 5 }).length, 0);
+    }
+    finally {
+        cleanup();
+    }
+});

package/dist/server-body-limit.test.js

@@ -0,0 +1,35 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-server-body-limit-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "https://upstream.example/v1";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+process.env.REQUEST_BODY_LIMIT_BYTES = "1024";
+const { app } = await import("./server.js");
+test.after(async () => {
+    await app.close();
+    rmSync(tempDir, { recursive: true, force: true });
+});
+test("server rejects payloads above configured body limit", async () => {
+    const response = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer provider-key",
+        },
+        payload: {
+            model: "gpt-4.1",
+            input: "x".repeat(2048),
+        },
+    });
+    assert.equal(response.statusCode, 413);
+});

package/dist/server-client-token-limits.test.js

@@ -0,0 +1,161 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import BetterSqlite3 from "better-sqlite3";
+import { DashboardAuthRepository } from "./dashboard-auth.js";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-server-token-limits-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "https://upstream.example/v1";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+process.env.RESPONSES_PROXY_CLIENT_API_KEY = "test-bot-api-key";
+process.env.TELEGRAM_BOT_TOKEN = "test-dashboard-bot-token";
+process.env.TELEGRAM_OWNER_USER_IDS = "1";
+process.env.TELEGRAM_ADMIN_USER_IDS = "1";
+const { app } = await import("./server.js");
+test.after(async () => {
+    await app.close();
+    rmSync(tempDir, { recursive: true, force: true });
+});
+async function loginDashboard() {
+    const approvalResponse = await app.inject({
+        method: "POST",
+        url: "/api/dashboard-auth/request-approval",
+    });
+    assert.equal(approvalResponse.statusCode, 200);
+    const approval = approvalResponse.json();
+    assert.equal(typeof approval.debugApprovalCode, "string");
+    const dashboardAuth = DashboardAuthRepository.create(dbFile);
+    const resolved = dashboardAuth.resolveApprovalChoice({
+        challengeId: approval.challengeId,
+        telegramUserId: "1",
+        selectedCode: approval.debugApprovalCode,
+    });
+    assert.equal(resolved.ok, true);
+    const statusResponse = await app.inject({
+        method: "GET",
+        url: `/api/dashboard-auth/approval-status?challengeId=${encodeURIComponent(approval.challengeId)}&pollToken=${encodeURIComponent(approval.pollToken)}`,
+    });
+    assert.equal(statusResponse.statusCode, 200);
+    assert.equal(statusResponse.json().status, "approved");
+    return statusResponse.headers["set-cookie"];
+}
+test("client token limit admin API creates reads and resets limits", async () => {
+    const cookie = await loginDashboard();
+    const initial = await app.inject({
+        method: "GET",
+        url: "/api/client-token-limits/default",
+        headers: { cookie },
+    });
+    assert.equal(initial.statusCode, 200);
+    assert.equal(initial.json().client.config, null);
+    const update = await app.inject({
+        method: "PUT",
+        url: "/api/client-token-limits/default",
+        headers: { cookie },
+        payload: {
+            enabled: true,
+            tokenLimit: 12,
+            windowType: "daily",
+            hardBlock: true,
+        },
+    });
+    assert.equal(update.statusCode, 200);
+    assert.equal(update.json().client.config.tokenLimit, 12);
+    assert.equal(update.json().client.status.remaining, 12);
+    const reset = await app.inject({
+        method: "POST",
+        url: "/api/client-token-limits/default/reset",
+        headers: { cookie },
+    });
+    assert.equal(reset.statusCode, 200);
+    assert.equal(reset.json().client.usage.totalTokens, 0);
+});
+test("client token limit admin API accepts disabled config without usable limit values", async () => {
+    const cookie = await loginDashboard();
+    const update = await app.inject({
+        method: "PUT",
+        url: "/api/client-token-limits/default",
+        headers: { cookie },
+        payload: {
+            enabled: false,
+            tokenLimit: 0,
+            windowType: "fixed",
+            windowSizeSeconds: 0,
+            hardBlock: true,
+        },
+    });
+    assert.equal(update.statusCode, 200);
+    assert.equal(update.json().client.config.enabled, false);
+    assert.equal(update.json().client.status.blocked, false);
+});
+test("client token limit enforcement rejects over-limit requests before upstream", async () => {
+    const cookie = await loginDashboard();
+    const now = new Date();
+    const windowStart = new Date(now);
+    windowStart.setUTCHours(0, 0, 0, 0);
+    await app.inject({
+        method: "PUT",
+        url: "/api/client-token-limits/default",
+        headers: { cookie },
+        payload: {
+            enabled: true,
+            tokenLimit: 1,
+            windowType: "daily",
+            hardBlock: true,
+        },
+    });
+    const db = new BetterSqlite3(dbFile);
+    try {
+        db.prepare(`INSERT INTO client_token_usage (
+        client_route,
+        window_start,
+        input_tokens,
+        output_tokens,
+        total_tokens,
+        updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(client_route, window_start) DO UPDATE SET
+        input_tokens = excluded.input_tokens,
+        output_tokens = excluded.output_tokens,
+        total_tokens = excluded.total_tokens,
+        updated_at = excluded.updated_at`).run("default", windowStart.toISOString(), 1, 0, 1, now.toISOString());
+    }
+    finally {
+        db.close();
+    }
+    const response = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer provider-key",
+        },
+        payload: {
+            model: "test-model",
+            input: "hello",
+        },
+    });
+    assert.equal(response.statusCode, 429);
+    assert.equal(response.headers["x-proxy-error-code"], "CLIENT_TOKEN_LIMIT_EXCEEDED");
+    assert.equal(response.json().error.code, "CLIENT_TOKEN_LIMIT_EXCEEDED");
+    assert.equal(response.json().error.client, "default");
+    assert.equal(response.json().error.usage.blocked, true);
+});
+test("bot api key can reach protected admin routes without dashboard session", async () => {
+    const response = await app.inject({
+        method: "GET",
+        url: "/api/client-configs/status",
+        headers: {
+            Authorization: "Bearer test-bot-api-key",
+        },
+    });
+    assert.equal(response.statusCode, 200);
+    assert.equal(response.json().ok, true);
+});

package/dist/server-codex-config-setup.test.js

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { BillingRepository } from "./billing.js";
+import { CustomerKeyRepository } from "./customer-keys.js";
+import { CustomerWorkspaceRepository } from "./telegram-bot/customer-workspace-repository.js";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-codex-setup-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "https://upstream.example/v1";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+process.env.RESPONSES_PROXY_DEFAULT_MODEL = "gpt-5.4";
+process.env.BOT_PUBLIC_RESPONSES_BASE_URL = "https://proxy.example.com/v1";
+const { app } = await import("./server.js");
+const billing = BillingRepository.create(dbFile);
+const customerKeys = CustomerKeyRepository.create(dbFile);
+const workspaces = CustomerWorkspaceRepository.create(dbFile);
+const workspace = workspaces.ensureDefaultWorkspace({
+    ownerTelegramUserId: "42",
+    defaultClientRoute: "default",
+    status: "active",
+});
+if (!billing.getPlan("curl-setup")) {
+    billing.createPlan({
+        id: "curl-setup",
+        name: "Curl Setup",
+        monthlyTokenLimit: 1_000_000,
+        maxApiKeys: 1,
+    });
+}
+billing.grantSubscription({
+    workspaceId: workspace.id,
+    planId: "curl-setup",
+    days: 30,
+});
+const { apiKey } = customerKeys.createKey({
+    workspaceId: workspace.id,
+    telegramUserId: "42",
+    clientRoute: "default",
+    apiKey: "sk-customer-test-secret",
+});
+test.after(async () => {
+    await app.close();
+    rmSync(tempDir, { recursive: true, force: true });
+});
+test("customer Codex setup script requires customer API key auth", async () => {
+    const response = await app.inject({
+        method: "GET",
+        url: "/api/customer/codex/setup.sh",
+    });
+    assert.equal(response.statusCode, 401);
+    assert.equal(response.json().error?.code, "CUSTOMER_API_KEY_REQUIRED");
+});
+test("customer Codex setup script returns patch script with customer key and public base URL", async () => {
+    const response = await app.inject({
+        method: "GET",
+        url: "/api/customer/codex/setup.sh",
+        headers: {
+            authorization: `Bearer ${apiKey}`,
+        },
+    });
+    assert.equal(response.statusCode, 200);
+    assert.match(response.headers["content-type"] ?? "", /^text\/x-shellscript/);
+    assert.equal(response.headers["cache-control"], "no-store");
+    assert.match(response.body, /model = "gpt-5\.4"/);
+    assert.match(response.body, /base_url = "https:\/\/proxy\.example\.com\/v1"/);
+    assert.match(response.body, /OPENAI_API_KEY": "sk-customer-test-secret"/);
+    assert.match(response.body, /install_file "\$tmpdir\/config\.toml" "\$HOME\/\.codex\/config\.toml"/);
+});