fix(proxy): preserve Codex originator header

Author: odyslam

services/api-rs/crates/centaur-iron-proxy/src/tests.rs

@@ -105,7 +105,7 @@ fn access_token_fragment_carries_no_broker_credentials_block() {
 }
 
 #[test]
-fn shipped_proxy_allowlist_preserves_railway_project_tokens() {
+fn shipped_proxy_allowlist_preserves_integration_headers() {
     let config: serde_yaml::Value =
         serde_yaml::from_str(include_str!("../../../../iron-proxy/iron-proxy.yaml")).unwrap();
     let transforms = config["transforms"].as_sequence().unwrap();
@@ -120,4 +120,9 @@ fn shipped_proxy_allowlist_preserves_railway_project_tokens() {
             .iter()
             .any(|header| header.as_str() == Some("project-access-token"))
     );
+    assert!(
+        headers
+            .iter()
+            .any(|header| header.as_str() == Some("originator"))
+    );
 }

services/iron-proxy/iron-proxy.yaml

@@ -40,6 +40,8 @@ transforms:
         - "openai-organization"
         - "openai-project"
         - "chatgpt-account-id"
+        # Codex uses this non-secret client marker when resolving model routes.
+        - "originator"
         - "x-request-id"
         - "x-stainless-arch"
         - "x-stainless-os"