Skip to content

fix(websocket): apply connection query overrides once - #1283

Draft
markstuart-oai wants to merge 2 commits into
mainfrom
markstuart/websocket-runtime-audit-20261027
Draft

markstuart-oai wants to merge 2 commits into
mainfrom
markstuart/websocket-runtime-audit-20261027

Conversation

@markstuart-oai

@markstuart-oai markstuart-oai commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Stable Responses and Realtime appended per-connection query parameters after the base URL query. Overrides could reach the server twice. Automatic Azure routing also treated a unified base URL with a query or fragment as a legacy endpoint.

Use the shared WebSocket request builder for both transports. Preserve the path segments and complete query that provider authenticators receive when they sign the handshake. Resolve the Azure API category from the URI path so supported unified endpoints retain their routing and authentication behavior.

Verification

All 648 runnable tests in the OkHttp client suite passed. Two live tests require credentials. The 194 focused tests include stable Responses signing, Realtime lifecycle and Azure compatibility. Twelve Azure probes captured the outgoing requests, and local WebSocket peers verified the signed headers and the encoded query on the wire. The formatter passed.

@github-actions

github-actions Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Castiron custom code

Evaluated main: a565f6e12496d129699f3732d3ead2b9f1d0691e.

Trusted main policy: a565f6e12496d129699f3732d3ead2b9f1d0691e.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared a565f6e12496 → 0e1697a14332. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 40464871943 --repo openai/openai-java \
  --name castiron-custom-code-40464871943-1 --dir /tmp/castiron-custom-code-40464871943-1
git apply --stat /tmp/castiron-custom-code-40464871943-1/custom-code.patch
cat /tmp/castiron-custom-code-40464871943-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin a565f6e12496d129699f3732d3ead2b9f1d0691e 0e1697a143321ab0ecdee7e8629d5d141407b9b7
python3 scripts/castiron/custom_code_report.py report \
  --base a565f6e12496d129699f3732d3ead2b9f1d0691e \
  --head 0e1697a143321ab0ecdee7e8629d5d141407b9b7 --target-branch main --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-0e1697a14332
cat /tmp/castiron-custom-code-0e1697a14332/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant