fix(oai): align HTTPS Codex compatibility identity

Author: ericjuta

crates/nanocodex-oai-api/src/transport/http.rs

@@ -5,6 +5,7 @@ use http::header;
 use tokio::time::timeout;
 use tokio_tungstenite::tungstenite::Utf8Bytes;
 
+use super::{CODEX_COMPATIBILITY_USER_AGENT, CODEX_COMPATIBILITY_VERSION, CODEX_ORIGINATOR};
 use crate::{EncodedRequest, ResponsesError, socket::ReceivedText};
 
 const EVENT_IDLE_TIMEOUT: Duration = if cfg!(test) {
@@ -55,10 +56,9 @@ impl ResponsesHttp {
             .header("session-id", session_id)
             .header("thread-id", session_id)
             .header("x-client-request-id", session_id)
-            .header(
-                header::USER_AGENT,
-                concat!("nanocodex/", env!("CARGO_PKG_VERSION")),
-            )
+            .header("originator", CODEX_ORIGINATOR)
+            .header("version", CODEX_COMPATIBILITY_VERSION)
+            .header(header::USER_AGENT, CODEX_COMPATIBILITY_USER_AGENT)
             .body(request.raw().get().to_owned());
         if let Some(account_id) = auth.account_id() {
             builder = builder.header("ChatGPT-Account-ID", account_id);

crates/nanocodex-oai-api/src/transport/mod.rs

@@ -16,6 +16,14 @@ pub(crate) mod socket;
 pub(crate) mod telemetry;
 mod wire;
 
+pub(crate) const CODEX_ORIGINATOR: &str = "codex_cli_rs";
+pub(crate) const CODEX_COMPATIBILITY_VERSION: &str = "0.1337.0";
+pub(crate) const CODEX_COMPATIBILITY_USER_AGENT: &str = concat!(
+    "codex_cli_rs/0.1337.0 (nanocodex/",
+    env!("CARGO_PKG_VERSION"),
+    ")"
+);
+
 use std::{fmt, str::FromStr};
 
 pub use crate::tower::attempt::{TransportStats, TransportStatsDelta, TransportStatsSnapshot};

crates/nanocodex-oai-api/src/transport/socket.rs

@@ -17,6 +17,7 @@ use tokio_tungstenite::{
 use crate::{EncodedRequest, OpenAiAuthSnapshot, ResponsesError, connector::connect_async};
 use crate::{monotonic_now_ns, transport::wire::turn_state_from_event};
 
+use super::{CODEX_COMPATIBILITY_USER_AGENT, CODEX_COMPATIBILITY_VERSION, CODEX_ORIGINATOR};
 pub(crate) use crate::transport::wire::{decode_event, parse_raw_json};
 
 const CONNECT_TIMEOUT: Duration = Duration::from_secs(30);
@@ -30,13 +31,6 @@ const SOCKET_MESSAGE_CAPACITY: usize = 32;
 const RESPONSES_WEBSOCKETS_BETA: &str = "responses_websockets=2026-02-06";
 const RESPONSES_LITE_HEADER: &str = "x-openai-internal-codex-responses-lite";
 const TURN_STATE_HEADER: &str = "x-codex-turn-state";
-const CODEX_ORIGINATOR: &str = "codex_cli_rs";
-const CODEX_COMPATIBILITY_VERSION: &str = "0.1337.0";
-const CODEX_COMPATIBILITY_USER_AGENT: &str = concat!(
-    "codex_cli_rs/0.1337.0 (nanocodex/",
-    env!("CARGO_PKG_VERSION"),
-    ")"
-);
 
 type Socket = WebSocketStream<MaybeTlsStream<TcpStream>>;
 

crates/nanocodex-oai-api/tests/it/https.rs

@@ -9,6 +9,48 @@ use tokio::{
 
 const TURN_STATE_HEADER: &str = "x-codex-turn-state";
 
+#[tokio::test]
+async fn https_requests_advertise_supported_codex_compatibility_version() -> Result<()> {
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let api_base_url = format!("http://{}", listener.local_addr()?);
+    let server = tokio::spawn(async move {
+        let request = read_http_json(&listener).await?;
+        assert!(
+            request.headers.contains("\r\noriginator: codex_cli_rs\r\n"),
+            "HTTPS requests must identify as the supported Codex client"
+        );
+        assert!(
+            request.headers.contains("\r\nversion: 0.1337.0\r\n"),
+            "HTTPS requests must advertise the supported Codex compatibility version"
+        );
+        let expected_user_agent = format!(
+            "\r\nuser-agent: codex_cli_rs/0.1337.0 (nanocodex/{})\r\n",
+            env!("CARGO_PKG_VERSION")
+        );
+        assert!(
+            request.headers.contains(&expected_user_agent),
+            "HTTPS requests must retain Nanocodex provenance in the Codex user agent"
+        );
+        send_http_events(
+            request.stream,
+            None,
+            [completed_response("resp-version", "ok")],
+        )
+        .await
+    });
+
+    let openai = OpenAi::builder("test-key")
+        .transport(ResponsesTransport::Https)
+        .api_base_url(api_base_url)
+        .build()?;
+    let mut session = openai.instructions("Respond with one word.").build()?;
+    assert_eq!(session.turn().create("test").await?.output_text(), "ok");
+    timeout(std::time::Duration::from_secs(5), server)
+        .await
+        .map_err(|_| eyre!("mock HTTPS compatibility server did not finish"))???;
+    Ok(())
+}
+
 #[tokio::test]
 async fn https_turn_state_is_scoped_to_one_logical_turn_and_survives_retry() -> Result<()> {
     let listener = TcpListener::bind("127.0.0.1:0").await?;