refactor(codex): remove unused auth-scope fingerprinting #19

2026-11-05T20:35:48Z

eleith-gitea-agent Bot commented

2026-11-05 20:35:48 +00:00

Summary

Remove unused readCodexAuthScope(), the auth-only request resource, SHA-256 credential fingerprinting, and internal auth-scope/catalog wrapper types.
Return raw catalog JSON directly and update the FastController eligibility consumer and mocks accordingly. Usage continues to return its raw JSON unchanged.
Preserve Pi-owned OAuth resolution, endpoint restrictions/recheck, token-derived account routing, the credential-header whitelist, public handoff cancellation checks, timeouts, response bounds, and safe error/retry behavior.
Retarget auth-only validation/cancellation tests to active catalog requests and test fresh resolved credentials through real catalog request headers.
Add a patch changeset for @eleith-pi/codex; no UI or account-policy change.

Validation

Full suite: 76 files / 1,456 tests passed.
Focused client, fast controller, native SDK SSE/WebSocket, and command tests: 120 passed; independently rerun by reviewers.
Typecheck, lint, repository formatting, whitespace checks, and all nine extension builds passed.
Test count drops by two intentionally: the obsolete hash-stability-only test and removed auth-only handoff matrix entry. Relevant security coverage remains on active usage/catalog paths.
No live account/network requests performed; account tests use synthetic credentials and isolated transports.

Reviews

Independent code, readability, and test reviews completed with no actionable findings. Repository consumer/export checks found no remaining dependencies on the removed internal API or metadata shapes.

Other Pi audit cleanup and release planning remain separate; no version tag or publishing is included.

## Summary - Remove unused `readCodexAuthScope()`, the auth-only request resource, SHA-256 credential fingerprinting, and internal auth-scope/catalog wrapper types. - Return raw catalog JSON directly and update the FastController eligibility consumer and mocks accordingly. Usage continues to return its raw JSON unchanged. - Preserve Pi-owned OAuth resolution, endpoint restrictions/recheck, token-derived account routing, the credential-header whitelist, public handoff cancellation checks, timeouts, response bounds, and safe error/retry behavior. - Retarget auth-only validation/cancellation tests to active catalog requests and test fresh resolved credentials through real catalog request headers. - Add a patch changeset for `@eleith-pi/codex`; no UI or account-policy change. ## Validation - Full suite: 76 files / 1,456 tests passed. - Focused client, fast controller, native SDK SSE/WebSocket, and command tests: 120 passed; independently rerun by reviewers. - Typecheck, lint, repository formatting, whitespace checks, and all nine extension builds passed. - Test count drops by two intentionally: the obsolete hash-stability-only test and removed auth-only handoff matrix entry. Relevant security coverage remains on active usage/catalog paths. - No live account/network requests performed; account tests use synthetic credentials and isolated transports. ## Reviews Independent code, readability, and test reviews completed with no actionable findings. Repository consumer/export checks found no remaining dependencies on the removed internal API or metadata shapes. Other Pi audit cleanup and release planning remain separate; no version tag or publishing is included.

eleith-gitea-agent Bot added 1 commit 2026-11-05 20:35:48 +00:00

refactor(codex): remove unused auth-scope fingerprinting

ci/woodpecker/pr/codex Pipeline was successful

Details

ci/woodpecker/push/codex Pipeline was successful

Details

09a0a684ac

eleith merged commit 09a0a684ac into main

2026-11-05 20:43:16 +00:00

eleith deleted branch refactor/codex-account-client-cleanup

2026-11-05 20:43:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/pi-extensions#19