add Claude rewrite mode and broker#1
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 918377155d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }) | ||
| return | ||
| } | ||
| writeJSON(w, http.StatusOK, token) |
There was a problem hiding this comment.
Return payload for /claude/oauth/token currently serializes the full claudeoauth.Token, which includes refresh_token when the upstream refresh call rotates it. That leaks the long-lived credential to every admin-authenticated client (including the local Claude sidecar), undermining the broker’s goal of keeping refresh tokens centralized on the VPS. This handler should only expose short-lived access token data (for example access_token and expires_at) and never echo refresh tokens.
Useful? React with 👍 / 👎.
| "proxy_url": fmt.Sprintf("http://%s:%s@%s:%d", spec.Proxy.Username, spec.Proxy.Password, endpoint.Tunnel.LocalHost, endpoint.Tunnel.LocalPort), | ||
| "oauth_broker_url": fmt.Sprintf("http://%s:%d/claude/oauth/token", spec.ClaudeCode.AdminLocalHost, spec.ClaudeCode.AdminLocalPort), |
There was a problem hiding this comment.
RenderClaudeClientConfig builds proxy_url and oauth_broker_url with raw "%s:%d" host formatting, which produces invalid URLs when users configure IPv6 loopback/bind hosts (for example ::1). In that case generated URLs like http://::1:19090/... fail claude-client config validation and prevent startup. Use URL builders plus net.JoinHostPort (or equivalent) so IPv6 hosts are bracketed correctly.
Useful? React with 👍 / 👎.
alphabetc1
force-pushed
the
codex/claude-mode-oauth-broker
branch
from
bb36931 to
5573c88
Compare
1 participant
No description provided.