feat(proxy): support OAuth callers for Codex Live Voice by crowscc · Pull Request #1577 · Soju06/codex-lb

crowscc · 2026-08-03T14:35:14Z

Summary

Support Codex Live Voice through codex-lb for both the built-in openai OAuth provider and registered Proxy API Key clients. OAuth callers use the zero-key origin boundary plus a Settings-managed upstream account pool, while call creation and every sideband route remain bound to the same serving account.

Type of change

fix: — bug fix (no behavior change beyond the bug)
feat: — new user-facing feature or capability
refactor: — internal refactor (no behavior change, no API change)
docs: — documentation only
chore: / ci: / build: — tooling, CI, packaging
test: — test-only change
Breaking change

Linked issue: Related to #1492.

OpenSpec

This PR includes / updates an OpenSpec change
Not applicable — bug fix that matches the existing spec
Not applicable — docs / CI / chore only
This PR touches a codex-faithful path and preserves upstream-equivalent request, response, and sideband behavior

Change directory: openspec/changes/add-oauth-live-voice-auth/

Capabilities:

realtime-api-compat
database-migrations
frontend-architecture

Changes

Live caller admission and ownership

Keep registered sk-clb-* callers on strict Proxy API Key authentication, assignment, limits, attribution, and affinity.
Admit official Codex OAuth callers through the zero-key origin boundary when global Proxy API Key authentication is disabled.
Derive a purpose-separated HMAC caller scope from the OAuth bearer and normalized chatgpt-account-id; credentials and raw account headers are never persisted.
Bind call creation and all three supported sideband routes to the exact serving account, then enforce the current caller policy and account eligibility on every sideband connection.

Policy and persistence

Add one default-off global OAuth Live policy with an explicit allowed upstream account set.
Provide transactional dashboard read/write APIs, active-account filtering, safe audit metadata, and cascade cleanup for removed accounts.
Store only the scoped caller digest, call digest, serving account reference, and expiry required for ownership.
Preserve nullable API-key attribution for OAuth Live logs while keeping registered-Key attribution unchanged.

Settings and client profiles

Add a Settings → Live Voice card with one enable switch, a compact account multi-select, and one save action.
Keep selected unavailable accounts visible so operators can remove them from the policy.
Document the built-in openai OAuth profile and registered Proxy API Key profile, including both experimental realtime base URLs.
Keep WebRTC media peer-to-peer; codex-lb handles private call creation and control sideband routing only.

Simplicity

New feature defaults to off
No new required setup step
New setting(s) and why each can't be a default: the persisted OAuth Live policy requires an operator-selected upstream account pool, so it starts disabled with an empty pool. No new CODEX_LB_* environment setting is added.
No README section, .env.example entry, dashboard navigation item, or dependency is added

Test plan

Local verification:

make ci-fast
  architecture checks passed
  Ruff and formatting passed
  ty passed
  frontend: 136 files / 1,032 tests passed; production build passed
  backend unit: 5,194 passed, 68 skipped
  source distribution, wheel, and packaged frontend assets passed

openspec validate add-oauth-live-voice-auth --strict
  Change 'add-oauth-live-voice-auth' is valid

openspec validate --specs --strict
  49 passed, 0 failed

focused OAuth Live and migration suite
  215 passed, 3 skipped (PostgreSQL-only cases)

Manual Codex Desktop acceptance:

Client profile	Normal conversation	Live Voice
Built-in `openai` OAuth provider	Passed	Passed
Registered Proxy API Key	Passed	Passed

Both realtime base URLs targeted codex-lb during Live Voice acceptance.

Screenshots / output

Before

No OAuth Live policy control was available in Settings.

After

Settings exposes the default-off OAuth Live policy and compact upstream account selector.

Checklist

Title is in Conventional Commits format (<type>(<scope>)?: <subject>).
Linked the related issue / discussion above.
Added or updated tests covering the change.
Ran the relevant make ci-fast local gate.
openspec validate --specs --strict passes and the OpenSpec change is complete.
Simplicity gates reviewed: the five simplicity rules (PRINCIPLES.md P1-P5).
CHANGELOG is not edited by hand.

chatgpt-codex-connector · 2026-08-03T14:35:26Z

To use Codex here, create an environment for this repo.

crowscc · 2026-08-03T14:39:15Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f807e55d62

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crowscc · 2026-08-03T14:51:19Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26d657492b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crowscc · 2026-08-03T15:04:22Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddddd6b463

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crowscc · 2026-08-04T00:04:49Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5959e764eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…obal-policy # Conflicts: # tests/integration/test_migrations.py # tests/unit/test_db_migrate.py

crowscc · 2026-08-04T03:41:00Z

@codex review

chatgpt-codex-connector · 2026-08-04T03:45:13Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 5428e89f46

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

crowscc · 2026-08-04T04:34:14Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0bc228d88b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T04:39:25Z

 **Codex CLI falls back to POST instead of WebSockets.**
 Run the [WebSocket verification steps](client-setup.md#verify-websocket-transport). If codex-lb sits behind a reverse proxy, make sure it forwards WebSocket upgrades — see [Remote Access](deployment/remote.md).

+## Live Voice


Link Live Voice pages to their owning spec

The new Live Voice material here, along with the additions in docs/client-setup.md and docs/configuration.md, links only to docs/live-voice.md; none of these affected pages links directly to openspec/specs/realtime-api-compat, and their existing footer links name unrelated capabilities. Add the owning capability link to each affected page so the published guidance remains directly traceable to its normative requirements.

AGENTS.md reference: AGENTS.md:L39-L39

Useful? React with 👍 / 👎.

feat(proxy): support OAuth callers for Codex Live Voice

f807e55

github-actions Bot added the db migration PR changes Alembic database migrations; maintainer must coordinate merge order label Aug 3, 2026

chatgpt-codex-connector Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread app/modules/proxy/api.py Outdated

fix(proxy): reject conflicting Live call IDs before auth

26d6574

chatgpt-codex-connector Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread app/core/auth/codex_oauth_identity.py Outdated

fix(auth): keep OAuth Live affinity stable across account changes

ddddd6b

chatgpt-codex-connector Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread app/core/auth/dependencies.py Outdated

Comment thread app/core/auth/codex_oauth_identity.py Outdated

Comment thread frontend/src/features/settings/components/oauth-live-settings.tsx

Komzpa added the 🤖 codex: needs work [@codex review] raised an issue label Aug 3, 2026

fix(oauth-live): close authorization and policy gaps

5959e76

chatgpt-codex-connector Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread app/core/auth/dependencies.py Outdated

crowscc added 3 commits August 4, 2026 10:14

fix(oauth-live): reuse keyless proxy admission

0d3ceef

Merge remote-tracking branch 'origin/main' into feature/oauth-live-gl…

795f711

…obal-policy # Conflicts: # tests/integration/test_migrations.py # tests/unit/test_db_migrate.py

docs(openspec): describe final OAuth Live contract

5428e89

crowscc marked this pull request as ready for review August 4, 2026 04:20

docs(live): complete OAuth Live operator guide

0bc228d

chatgpt-codex-connector Bot reviewed Aug 4, 2026

View reviewed changes

Conversation

crowscc commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of change

OpenSpec

Changes

Live caller admission and ownership

Policy and persistence

Settings and client profiles

Simplicity

Test plan

Screenshots / output

Before

After

Checklist

Uh oh!

chatgpt-codex-connector Bot commented Aug 3, 2026

Uh oh!

crowscc commented Aug 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

crowscc commented Aug 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

crowscc commented Aug 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

crowscc commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

crowscc commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

crowscc commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

crowscc commented Aug 3, 2026 •

edited

Loading