Skip to content

test: pin OpenCode redirect token boundary #1613

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seonghobae wants to merge 1 commit into
base: codex/agents-pr-lifecycle-knowhow
Choose a base branch
from
+2 −0
Draft

test: pin OpenCode redirect token boundary #1613

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions backend/tests/test_release_governance.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,8 @@ def test_agent_lifecycle_governance_artifacts_stay_aligned() -> None:
assert "CONTEXTUAL_ORCHESTRATOR_TOKEN=" in environment_example
assert "CONTEXTUAL_ORCHESTRATOR_TOKEN" in readme
assert "http://127.0.0.1:8100/v1" in readme
assert "Fetch transport removes" in readme
assert "cross-origin redirect" in readme
Comment on lines +71 to +72

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Exercise the redirect instead of checking documentation text

These assertions only prove that two phrases remain somewhere in README.md; they never exercise the configured OpenCode transport or show that the redirected request omits Authorization. If OpenCode or @ai-sdk/openai-compatible changes its fetch implementation, the test remains green while a cross-origin redirect can carry the gateway token. Add a transport-level regression that sends the token to the fixed loopback origin, follows a redirect to a distinct origin, and inspects the second request rather than treating prose as security evidence.

AGENTS.md reference: AGENTS.md:L204-L206

Useful? React with 👍 / 👎.

assert "short-lived" in readme
assert "owner-issued" in readme
assert "docs/development/merge-gate-policy.md" in guidance
Expand Down