[maria-rcks]

When the server runs the ChatGPT sign-in itself, it opens a local listener for the OAuth redirect. That listener accepted the first GET to /auth/callback before checking its state, so one request with the wrong state or no code ended the sign-in and closed the listener. The real redirect then got connection refused and the user had to start over.

The listener now runs the same check as the paste path and the desktop receiver (codexCallbackUrl) before accepting a request. A request that doesn't match gets a 400 and the sign-in keeps waiting. A request path that can't be parsed, such as //, now gets a 404 like any other unknown path instead of throwing in the listener. The listener still closes after the real redirect, on cancel and on the 5-minute timeout.

The existing state-mismatch test now expects the wrong-state request to be rejected without a token exchange and an unparsable path to get a 404, and the real redirect to complete the sign-in afterwards.

Implemented with claude-opus-5-5 and reviewed with claude-fable-5-2 in Claude Code, on behalf of Maria.

Reviewed with sol-loop: 2 rounds with claude-fable-5-2 at unknown. Verdicts: approved, approved.

[macroscopeapp]

Approvability

Verdict: Approved at c439d1c

Macroscope's review found this PR approvable — ChatGPT sign-in now rejects stray callback requests without consuming the active sign-in attempt. The change remains confined to the local callback listener and preserves existing authentication safeguards.

Notes:

• All code in this push has already been reviewed. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: t3/codex-callback-keeps-listening
• File: .coderabbit.config.ts
• Commit: c439d1c
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: e1d91458-a45b-4ba8-b672-6113cf804f71

Commits

Reviewing files that changed from the base of the PR and between 169dca7 and c439d1c.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The localhost OAuth callback now validates the callback URL and active state before accepting it. Invalid callbacks return HTTP 400 without ending the sign-in. The regression test checks rejection and confirms that the sign-in can still complete.

Changes: OAuth callback validation

Layer / File(s)	Summary
Validate callback and verify recovery apps/server/src/provider/CodexChatGptAuth.ts, apps/server/src/provider/CodexChatGptAuth.test.ts	The callback validates the full URL and active state before resolving sign-in. The test verifies that a mismatched state does not exchange tokens or save credentials, that an unparsable path returns 404, and that the waiting sign-in can complete after the mismatch is reset.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: Minimal · previous review 169dc

Stray or mismatched callback requests no longer end ChatGPT sign-in, and the real redirect still completes it. No actionable merge-blocking risk remains.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main server sign-in fix and follows the repository’s conventional format.
Description check		The description explains the problem, the implementation, and focused verification results. It does not include a separate scope and approval section, but the core required information is present.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: t3/codex-callback-keeps-listening
• File: .coderabbit.config.ts
• Commit: 169dca7
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7d715efc-fb78-4efd-a42e-12d2673213ec

Commits

Reviewing files that changed from the base of the PR and between f31ce3e and 169dca7.

Files selected for processing: 2

• apps/server/src/provider/CodexChatGptAuth.test.ts
• apps/server/src/provider/CodexChatGptAuth.ts

Limit details: You’ve used all 10 included reviews currently available.

Dismissing prior approval to re-evaluate c439d1c

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: cc62443 · PR result: c439d1c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.