Repository navigation
🛫 feat: Enable Self-Service Code Worker Pairing - #15367
Conversation
|
@codex review exact head |
|
@codex review exact head |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a2cfa3207
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
4a2cfa3 to
d24f10a
Compare
|
@codex review Please review exact head 051ccefe75c5da747a39ceb7847ec1c255757485 after the principal-boundary fixes. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 051ccefe75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
051ccef to
42425c0
Compare
danny-avila
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 42425c02fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f260f91d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
36caad1 to
06eb2bb
Compare
|
@codex review Please review the current PR head 06eb2bbca584e6151977305124b05669b0d207dc. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads. This head is rebased onto the current principal registry and now signs the selected worker into the Code API JWT; focus on principal authorization, worker claim/header agreement, token-cache separation, and all execution/artifact call paths. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06eb2bbca5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
5ad4f7d to
cbe7aa0
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ad4f7d5c9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
cbe7aa0 to
0d23ba5
Compare
|
@codex review Please review the current PR head 0d23ba5f5ea74223206bbc731bd56ca6df30fc42 after the rebase onto merged predecessors and the worker-routing, caller-effective-config, cache-key, and pairing-rate-limit fixes. Please ignore superseded heads. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d23ba5f5e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0d23ba5 to
6ea3bab
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a9e255c260
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Enables authenticated, self-service pairing of user/principal-owned stateful code workers via an operator-approved Code API control plane, while keeping admin tokens and private routing details server-side.
Changes:
- Adds principal-aware pairing flow and worker-binding metadata (
workerPrincipal,bridgeWorkerId) persisted behind existing ACLs. - Propagates server-selected worker routing through code execution, file priming/harvest, and Code API JWT minting.
- Updates public config projection + schema validation to support pairing-only control planes and documents the new configuration.
Reviewed changes
Copilot reviewed 47 out of 47 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| packages/data-schemas/src/types/codeEnvironment.ts | Adds persisted workerPrincipal metadata to code environments. |
| packages/data-schemas/src/schema/codeEnvironment.ts | Persists workerPrincipal via a new embedded schema. |
| packages/data-schemas/src/methods/codeEnvironment.ts | Extends create input type to accept workerPrincipal. |
| packages/data-provider/src/config.ts | Extends endpoint schema for worker routing + pairing-only control planes. |
| packages/data-provider/specs/config-schemas.spec.ts | Adds schema tests for pairing-only and worker route conflicts. |
| packages/api/src/endpoints/config/endpoints.ts | Hides pairing-only control planes from client execution environments. |
| packages/api/src/endpoints/config/endpoints.spec.ts | Tests public config projection excludes pairing-only control planes. |
| packages/api/src/code/index.ts | Exports new code-bridge module. |
| packages/api/src/code/http.ts | Adds pairing endpoint + policy resolution and name validation. |
| packages/api/src/code/http.spec.ts | Adds pairing and policy/authorization tests for HTTP handlers. |
| packages/api/src/code/environments.ts | Adds name normalization, worker principal validation, and privacy filtering. |
| packages/api/src/code/environments.integration.spec.ts | Adds integration coverage for user-bound worker privacy semantics. |
| packages/api/src/code/config.ts | Adjusts merge behavior for pairing-only control planes and defaults. |
| packages/api/src/code/config.spec.ts | Tests defaulting when pairing-only control plane exists. |
| packages/api/src/code/bridge.ts | Introduces Code API bridge pairing client with timeout + validation. |
| packages/api/src/auth/codeapi.ts | Adds code_worker_id claim + signing readiness check + cache key hardening. |
| packages/api/src/auth/codeapi.spec.ts | Tests signing readiness and worker-bound token caching. |
| packages/api/src/app/service.ts | Adds failClosed option for security-sensitive config resolution. |
| packages/api/src/app/service.spec.ts | Tests failClosed propagation behavior. |
| packages/api/src/agents/skillFiles.ts | Propagates bridgeWorkerId through skill file priming uploads. |
| packages/api/src/agents/skillFiles.spec.ts | Verifies bridgeWorkerId propagation into batch upload calls. |
| packages/api/src/agents/harvest.ts | Propagates bridgeWorkerId into output harvesting/processing. |
| packages/api/src/agents/handlers.ts | Extends tool execution plumbing to include bridgeWorkerId. |
| packages/api/src/agents/handlers.spec.ts | Adds coverage for request param propagation including bridgeWorkerId. |
| packages/api/src/agents/execution.ts | Adds worker routing header + auth header composition helper. |
| packages/api/src/agents/execution.spec.ts | Tests routing, exclusion of pairing-only, and auth/header composition. |
| packages/api/src/admin/code.ts | Prevents exposing pairing config for non-singleton control planes. |
| packages/api/src/admin/code.spec.ts | Updates pairing shape in override test fixtures. |
| librechat.example.yaml | Documents pairing-only principal worker control-plane configuration. |
| e2e/setup/fake-model.js | Fixes stateful fake model to wait for the current tool result. |
| api/server/services/ToolService.js | Uses worker-aware Code API auth headers for tools execution. |
| api/server/services/Files/Code/process.spec.js | Updates tests for worker-aware auth/header propagation. |
| api/server/services/Files/Code/process.js | Routes download/exec/upload requests via bridgeWorkerId headers/auth. |
| api/server/services/Files/Code/preflight.js | Propagates bridgeWorkerId into preflight inspection path. |
| api/server/services/Files/Code/crud.spec.js | Adds/updates CRUD tests for worker-aware uploads/downloads. |
| api/server/services/Files/Code/crud.js | Adds worker-aware auth/header routing to CRUD + batch upload. |
| api/server/services/Files/Code/tests/process-traversal.spec.js | Mocks codeExecutionHeaders for traversal test suite. |
| api/server/routes/files/files.test.js | Updates route tests to pass worker routing through download path. |
| api/server/routes/files/files.js | Passes bridgeWorkerId to code download stream when configured. |
| api/server/routes/code-environments.test.js | Adds route coverage for /pairings with limiter middleware. |
| api/server/routes/code-environments.js | Adds /pairings endpoint with pairing rate limiter. |
| api/server/middleware/limiters/code.spec.js | Adds tests for pairing rate limiter behavior + error payload. |
| api/server/middleware/limiters/code.js | Introduces per-user pairing rate limiter middleware. |
| api/server/controllers/agents/v1.spec.js | Ensures pairing-only control plane cannot be saved as env id. |
| api/server/controllers/agents/v1.js | Validates and rejects pairing-only control planes in agent payload. |
| api/server/controllers/agents/callbacks.js | Propagates worker routing into code-output processing callbacks. |
| api/app/clients/tools/util/handleTools.js | Uses worker-aware Code API auth headers for execute_code tool. |
Suppressed comments (4)
packages/api/src/code/http.ts:1
resolveTenantId(req)can throw (e.g., missing tenant context in Code API JWT strict mode). As written, that exception is caught and converted into a generic 502 “upstream pairing request failed”, which misclassifies a local auth/config problem as an upstream failure. Consider resolvingtenantIdin its own guarded block before callingcreateCodeBridgePairing, returning a clearer 400/503 (and logging) when tenant context is unavailable.
packages/api/src/endpoints/config/endpoints.ts:1- The “pairing-only control plane” predicate is duplicated in multiple places (config schema validation, public config projection, execution context resolution, agent controller validation, etc.). To prevent drift (e.g., future additions to pairing semantics), consider centralizing this logic into a shared helper (exported from one module) and reusing it across these call sites.
packages/api/src/code/bridge.ts:1 - The bridge pairing timeout is hard-coded to 10s, which may be too aggressive for some deployments (cold starts, busy control planes) and too lax for others. Consider making this timeout configurable (env/config) and/or injectable via deps so operators can tune it without code changes.
packages/api/src/code/bridge.ts:1 - The bridge pairing timeout is hard-coded to 10s, which may be too aggressive for some deployments (cold starts, busy control planes) and too lax for others. Consider making this timeout configurable (env/config) and/or injectable via deps so operators can tune it without code changes.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 51edb2a660
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Summary
I added self-service pairing for principal-owned, stateful code environments on an operator-approved Code API control plane. This PR depends on LibreChat PR #15365 and Code API PR LibreChat-AI/code-interpreter#69.
librechat.example.yaml.Change Type
Testing
npx tsc --noEmit -p packages/api/tsconfig.json.@librechat/apitests covering pairing, routing, ACL-backed registry behavior, admin isolation, and public config projection.librechat-data-provider,@librechat/data-schemas, and@librechat/api.33080, an isolated Mongo database on27028, Code API on23112, Redis on26379, an outbound paired worker, and a network-disabled NsJail sandbox.Test Configuration:
LibreChatCodeSelfServiceE2Eremote-bridgeChecklist