feat(codex): set official User-Agent on OAuth token exchange and refresh requests

[muyuan-ma]

Summary

Currently, internal/auth/codex/openai_auth.go sends token exchange and token refresh requests to https://auth.openai.com/oauth/token without setting a User-Agent header. As a result, Go's default http.Client automatically emits User-Agent: Go-http-client/2.0.

This PR ensures that all requests to the token endpoint carry an official Codex client User-Agent:

1. It prefers codex-header-defaults.user-agent from config.yaml if configured.
2. It falls back to the standard official Codex TUI client User-Agent (codex-tui/0.154.0 (Mac OS 26.5.2; arm64) iTerm.app/3.6.11 (codex-tui; 0.154.0)).

Benefits

• Eliminates the bare Go-http-client fingerprint during background OAuth token refreshes.
• Maintains fingerprint consistency between inference requests and auth refresh requests.
• Fully backward-compatible with existing configurations.

[github-actions]

This pull request targeted main.

The base branch has been automatically changed to dev.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T19:03:08.385890Z	da311f7	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

Configured User-Agent handling remains incomplete and inconsistent, with additional test, documentation, and shared-default updates needed.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds configured or official fallback Codex User-Agent headers to OAuth token exchange and refresh requests.

Changes:

• Resolves configured or fallback User-Agent values.
• Applies them to exchange and refresh requests.
• Adds fallback, configuration, and refresh tests.

File summaries

File	Reviewed changes and findings
internal/auth/codex/openai_auth.go	Adds User-Agent resolution and request headers. Findings: three nit issues (3, 3, and 1 votes) covering exchange-test coverage, shared default constant, and configuration documentation; two moderate issues (1 vote each) covering fetch_codex_models config propagation and precedence consistency with inference requests.
internal/auth/codex/openai_auth_test.go	Tests fallback, configuration override, and refresh behavior.

Review details

Suppressed comments (3)

internal/auth/codex/openai_auth.go:69

• CodexHeaderDefaults.UserAgent is documented in config.example.yaml:717-723 and internal/config/config_types.go:130-136 as applying only to Codex model requests, but this new helper also applies it to the OAuth token endpoint. Update the configuration documentation so users know that the setting controls token exchange and refresh requests as well.

		if ua := strings.TrimSpace(o.cfg.CodexHeaderDefaults.UserAgent); ua != "" {

internal/auth/codex/openai_auth.go:62

• The configured UA is still lost on the fetch_codex_models refresh path: cmd/fetch_codex_models/main.go:197 calls NewCodexAuthWithProxyURL(nil, auth.ProxyURL) even though that command loaded cfg from config.yaml at lines 85-92. A configured codex-header-defaults.user-agent is therefore ignored for this supported background refresh path; propagate the loaded config into the auth service.

		cfg:        cfg,

internal/auth/codex/openai_auth.go:70

• When codex-header-defaults.user-agent is configured, this makes OAuth requests use that value, but inference requests for models with config.override_header still unconditionally replace the UA with codexUserAgent in applyModelHeaderOverrides (covered by internal/runtime/executor/codex_websockets_executor_test.go:1923-1943). The two paths therefore still have different fingerprints, contrary to the PR's stated consistency goal; align the precedence in both paths.

func (o *CodexAuth) effectiveUserAgent() string {
	if o != nil && o.cfg != nil {
		if ua := strings.TrimSpace(o.cfg.CodexHeaderDefaults.UserAgent); ua != "" {
			return ua

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.