e326520d50
Gate round-1 follow-ups on the #121486 fix: - auxiliary_client: inline the pool route lookup (no dead try/except or fallbacks; HERMES_CODEX_BASE_URL short-circuits once) and read auth.json directly when the pool yields no token (no second uncached pool load, no re-select race pairing a new pool key with chatgpt.com). - image plugin: _read_codex_credential() is the single source for both is_available() and generate(); _post_image_request requires base_url. - auth_codex: drop the unused _pool_codex_access_token wrapper; the route helper's error fallback reads the profile-scoped override, not the raw process env. - model setup flow: the confirm guards get the resolved Codex base, not the chatgpt.com constant. - cli_model_switch_mixin: self.base_url is always set.
255 lines
11 KiB
Python
255 lines
11 KiB
Python
"""Regression coverage for required Codex identity and account headers.
|
|
|
|
The official Codex endpoint must receive Hermes' own harness identity, rather
|
|
than the historical first-party compatibility identity. Live endpoint
|
|
acceptance is a separate smoke test; these tests verify request construction.
|
|
|
|
``_codex_cloudflare_headers`` in ``agent.auxiliary_client`` centralizes the
|
|
header set so the primary chat client (``run_agent.AIAgent.__init__`` +
|
|
``_apply_client_headers_for_base_url``) and the auxiliary client paths
|
|
(``_build_codex_client`` and the ``raw_codex`` branch of ``resolve_provider_client``)
|
|
all emit the same headers.
|
|
|
|
These tests pin:
|
|
- the required Hermes originator
|
|
- the versioned Hermes User-Agent
|
|
- ``ChatGPT-Account-ID`` extraction from the OAuth JWT (canonical casing,
|
|
from codex-rs ``auth.rs``)
|
|
- graceful handling of malformed tokens (drop the account-ID header, don't
|
|
raise)
|
|
- primary-client wiring at both entry points in ``run_agent.py``
|
|
- aux-client wiring at both entry points in ``agent/auxiliary_client.py``
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import json
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from hermes_cli.version_info import get_version_info
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Fixtures
|
|
# ---------------------------------------------------------------------------
|
|
|
|
def _make_codex_jwt(
|
|
account_id: str = "acct-test-123",
|
|
data_residency: str | None = None,
|
|
compute_residency: str | None = None,
|
|
) -> str:
|
|
"""Build a syntactically valid Codex-style JWT with the account_id claim."""
|
|
def b64url(data: bytes) -> str:
|
|
return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
|
|
header = b64url(b'{"alg":"RS256","typ":"JWT"}')
|
|
auth_claims: dict = {
|
|
"chatgpt_account_id": account_id,
|
|
"chatgpt_plan_type": "plus",
|
|
}
|
|
if data_residency is not None:
|
|
auth_claims["chatgpt_data_residency"] = data_residency
|
|
if compute_residency is not None:
|
|
auth_claims["chatgpt_compute_residency"] = compute_residency
|
|
claims = {
|
|
"sub": "user-xyz",
|
|
"exp": 9999999999,
|
|
"https://api.openai.com/auth": auth_claims,
|
|
}
|
|
payload = b64url(json.dumps(claims).encode())
|
|
sig = b64url(b"fake-sig")
|
|
return f"{header}.{payload}.{sig}"
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# _codex_cloudflare_headers — the shared helper
|
|
# ---------------------------------------------------------------------------
|
|
|
|
class TestCodexCloudflareHeaders:
|
|
|
|
def test_user_agent_advertises_hermes_version(self):
|
|
from agent.auxiliary_client import _codex_cloudflare_headers
|
|
headers = _codex_cloudflare_headers(_make_codex_jwt())
|
|
assert headers["User-Agent"] == f"HermesAgent/{get_version_info().base_version}"
|
|
assert headers["originator"] == "hermes-agent"
|
|
|
|
|
|
|
|
|
|
|
|
def test_jwt_without_chatgpt_account_id_claim(self):
|
|
"""A valid JWT that lacks the account_id claim should still return headers."""
|
|
from agent.auxiliary_client import _codex_cloudflare_headers
|
|
import base64 as _b64, json as _json
|
|
|
|
def b64url(data: bytes) -> str:
|
|
return _b64.urlsafe_b64encode(data).rstrip(b"=").decode()
|
|
payload = b64url(_json.dumps({"sub": "user-xyz", "exp": 9999999999}).encode())
|
|
token = f"{b64url(b'{}')}.{payload}.{b64url(b'sig')}"
|
|
headers = _codex_cloudflare_headers(token)
|
|
assert headers["originator"] == "hermes-agent"
|
|
assert "ChatGPT-Account-ID" not in headers
|
|
|
|
def test_residency_header_from_jwt_claims(self, monkeypatch):
|
|
"""#23896: residency-enforced workspaces 401 without x-openai-internal-codex-residency.
|
|
chatgpt_data_residency wins; chatgpt_compute_residency is the fallback; and the two
|
|
models-catalog probes (picker via httpx, context-length via model_metadata_http) send it on the
|
|
wire — not just the shared helper."""
|
|
import sys
|
|
|
|
from agent import model_metadata
|
|
from agent.auxiliary_client import _codex_cloudflare_headers
|
|
from hermes_cli import codex_models
|
|
|
|
both = _make_codex_jwt(data_residency="us", compute_residency="eu")
|
|
assert _codex_cloudflare_headers(both)["x-openai-internal-codex-residency"] == "us"
|
|
compute_only = _make_codex_jwt(compute_residency="eu")
|
|
|
|
sent: list[dict] = []
|
|
|
|
class _FakeResp:
|
|
status_code = 200
|
|
|
|
def json(self):
|
|
# Non-empty so the newest-client request is accepted and each site makes one call
|
|
# (an empty answer would legitimately trigger the 0.0.0 sentinel fallback).
|
|
return {"models": [{"slug": "gpt-5.5", "visibility": "list"}]}
|
|
|
|
class _FakeHttp:
|
|
@staticmethod
|
|
def get(url, headers=None, timeout=None, verify=None, **kwargs):
|
|
sent.append(dict(headers or {}))
|
|
return _FakeResp()
|
|
|
|
monkeypatch.setitem(sys.modules, "httpx", _FakeHttp)
|
|
codex_models._fetch_models_from_api(access_token=compute_only)
|
|
# The context-length probe goes through the shared model_metadata_http seam.
|
|
from agent import model_metadata_http
|
|
monkeypatch.setattr(model_metadata_http, "get", _FakeHttp.get)
|
|
monkeypatch.setattr(model_metadata, "_codex_oauth_context_cache", {})
|
|
model_metadata._fetch_codex_oauth_context_lengths_with_source(compute_only)
|
|
|
|
assert len(sent) == 2
|
|
for headers in sent:
|
|
assert headers["x-openai-internal-codex-residency"] == "eu"
|
|
assert headers["ChatGPT-Account-ID"] == "acct-test-123"
|
|
|
|
def test_no_residency_claim_omits_header(self):
|
|
"""Control: tokens without the claim, and malformed tokens, never carry the header."""
|
|
from agent.auxiliary_client import _codex_cloudflare_headers
|
|
for token in [_make_codex_jwt(), "not-a-jwt", "", "only.one", " ", "...."]:
|
|
headers = _codex_cloudflare_headers(token)
|
|
assert "x-openai-internal-codex-residency" not in headers
|
|
assert headers["originator"] == "hermes-agent"
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Primary chat client wiring (run_agent.AIAgent)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
class TestPrimaryClientWiring:
|
|
|
|
def test_apply_client_headers_on_base_url_change(self):
|
|
"""Credential-rotation / base-url change path must also emit codex headers."""
|
|
from run_agent import AIAgent
|
|
token = _make_codex_jwt("acct-rotation")
|
|
with patch("agent.process_bootstrap.OpenAI") as mock_openai:
|
|
mock_openai.return_value = MagicMock()
|
|
agent = AIAgent(
|
|
api_key="placeholder-openrouter-key",
|
|
base_url="https://openrouter.ai/api/v1",
|
|
provider="openrouter",
|
|
model="anthropic/claude-sonnet-4.6",
|
|
quiet_mode=True,
|
|
skip_context_files=True,
|
|
skip_memory=True,
|
|
)
|
|
# Simulate rotation into a Codex credential
|
|
agent._client_kwargs["api_key"] = token
|
|
agent._apply_client_headers_for_base_url(
|
|
"https://chatgpt.com/backend-api/codex"
|
|
)
|
|
headers = agent._client_kwargs.get("default_headers") or {}
|
|
assert headers.get("originator") == "hermes-agent"
|
|
assert headers.get("ChatGPT-Account-ID") == "acct-rotation"
|
|
assert headers.get("User-Agent") == f"HermesAgent/{get_version_info().base_version}"
|
|
|
|
def test_apply_client_headers_clears_codex_headers_off_chatgpt(self):
|
|
"""Switching AWAY from chatgpt.com must drop the codex headers."""
|
|
from run_agent import AIAgent
|
|
token = _make_codex_jwt()
|
|
with patch("agent.process_bootstrap.OpenAI") as mock_openai:
|
|
mock_openai.return_value = MagicMock()
|
|
agent = AIAgent(
|
|
api_key=token,
|
|
base_url="https://chatgpt.com/backend-api/codex",
|
|
provider="openai-codex",
|
|
model="gpt-5.4",
|
|
quiet_mode=True,
|
|
skip_context_files=True,
|
|
skip_memory=True,
|
|
)
|
|
# Sanity: headers are set initially
|
|
assert "originator" in (agent._client_kwargs.get("default_headers") or {})
|
|
agent._apply_client_headers_for_base_url(
|
|
"https://api.anthropic.com"
|
|
)
|
|
# default_headers should be popped for anthropic base
|
|
assert "default_headers" not in agent._client_kwargs
|
|
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Auxiliary client wiring (agent.auxiliary_client)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
class TestAuxiliaryClientWiring:
|
|
def test_build_codex_client_passes_codex_headers(self, monkeypatch):
|
|
"""_build_codex_client builds the OpenAI client used for compression /
|
|
vision / title generation when routed through Codex. Must emit codex
|
|
headers."""
|
|
from agent import auxiliary_client
|
|
token = _make_codex_jwt("acct-aux-try-codex")
|
|
|
|
# Force _select_pool_entry to return "no pool" so we fall through to
|
|
# the auth.json token.
|
|
monkeypatch.setattr(
|
|
auxiliary_client, "_select_pool_entry",
|
|
lambda provider: (False, None),
|
|
)
|
|
monkeypatch.setattr(
|
|
auxiliary_client, "_read_codex_singleton_token",
|
|
lambda: token,
|
|
)
|
|
with patch("agent.auxiliary_client.OpenAI") as mock_openai:
|
|
mock_openai.return_value = MagicMock()
|
|
client, model = auxiliary_client._build_codex_client("gpt-5.4")
|
|
assert client is not None
|
|
headers = mock_openai.call_args.kwargs.get("default_headers") or {}
|
|
assert headers.get("originator") == "hermes-agent"
|
|
assert headers.get("ChatGPT-Account-ID") == "acct-aux-try-codex"
|
|
assert headers.get("User-Agent") == f"HermesAgent/{get_version_info().base_version}"
|
|
|
|
def test_resolve_provider_client_raw_codex_passes_codex_headers(self, monkeypatch):
|
|
"""The ``raw_codex=True`` branch (used by the main agent loop for direct
|
|
responses.stream() access) must also emit codex headers."""
|
|
from agent import auxiliary_client
|
|
token = _make_codex_jwt("acct-aux-raw-codex")
|
|
monkeypatch.setattr(
|
|
auxiliary_client, "_select_pool_entry",
|
|
lambda provider: (False, None),
|
|
)
|
|
monkeypatch.setattr(
|
|
auxiliary_client, "_read_codex_singleton_token",
|
|
lambda: token,
|
|
)
|
|
with patch("agent.auxiliary_client.OpenAI") as mock_openai:
|
|
mock_openai.return_value = MagicMock()
|
|
client, model = auxiliary_client.resolve_provider_client(
|
|
"openai-codex", model="gpt-5.4", raw_codex=True,
|
|
)
|
|
assert client is not None
|
|
headers = mock_openai.call_args.kwargs.get("default_headers") or {}
|
|
assert headers.get("originator") == "hermes-agent"
|
|
assert headers.get("ChatGPT-Account-ID") == "acct-aux-raw-codex"
|
|
assert headers.get("User-Agent") == f"HermesAgent/{get_version_info().base_version}"
|