feat(process-hardening): share hardening crate and update proxy

2026-10-17 15:34:54 +00:00 · 2025-09-30 08:23:01 +10:00
parent b507bd46d4
commit 093fb65073
22 changed files with 317 additions and 426 deletions
@@ -27,6 +27,34 @@
          "path": "codex.exe"
        }
      }
+    },
+    "codex-responses-api-proxy": {
+      "platforms": {
+        "macos-aarch64": {
+          "regex": "^codex-responses-api-proxy-aarch64-apple-darwin\\.zst$",
+          "path": "codex-responses-api-proxy"
+        },
+        "macos-x86_64": {
+          "regex": "^codex-responses-api-proxy-x86_64-apple-darwin\\.zst$",
+          "path": "codex-responses-api-proxy"
+        },
+        "linux-x86_64": {
+          "regex": "^codex-responses-api-proxy-x86_64-unknown-linux-musl\\.zst$",
+          "path": "codex-responses-api-proxy"
+        },
+        "linux-aarch64": {
+          "regex": "^codex-responses-api-proxy-aarch64-unknown-linux-musl\\.zst$",
+          "path": "codex-responses-api-proxy"
+        },
+        "windows-x86_64": {
+          "regex": "^codex-responses-api-proxy-x86_64-pc-windows-msvc\\.exe\\.zst$",
+          "path": "codex-responses-api-proxy.exe"
+        },
+        "windows-aarch64": {
+          "regex": "^codex-responses-api-proxy-aarch64-pc-windows-msvc\\.exe\\.zst$",
+          "path": "codex-responses-api-proxy.exe"
+        }
+      }
    }
  }
 }
@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // Unified entry point for the Codex CLI.

+import { spawn } from "node:child_process";
 import { existsSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
@@ -68,7 +69,6 @@ const binaryPath = path.join(archRoot, "codex", codexBinaryName);
 // executing. This allows us to forward those signals to the child process
 // and guarantees that when either the child terminates or the parent
 // receives a fatal signal, both processes exit in a predictable manner.
-const { spawn } = await import("child_process");

 function getUpdatedPath(newDirs) {
  const pathSep = process.platform === "win32" ? ";" : ":";
@@ -11,7 +11,7 @@
        "codex": "bin/codex.js"
      },
      "engines": {
-        "node": ">=20"
+        "node": ">=16"
      }
    }
  }
@@ -8,7 +8,7 @@
  },
  "type": "module",
  "engines": {
-    "node": ">=20"
+    "node": ">=16"
  },
  "files": [
    "bin/coder.js",
@@ -949,15 +949,14 @@ dependencies = [
 "codex-exec",
 "codex-login",
 "codex-mcp-server",
+ "codex-process-hardening",
 "codex-protocol",
 "codex-protocol-ts",
- "codex-responses-api-proxy",
 "codex-tui",
 "codex-version",
 "ctor 0.5.0",
 "flate2",
 "futures",
- "libc",
 "owo-colors",
 "predicates",
 "pretty_assertions",
@@ -1223,6 +1222,13 @@ dependencies = [
 "wiremock",
 ]

+[[package]]
+name = "codex-process-hardening"
+version = "0.0.0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "codex-protocol"
 version = "0.0.0"
@@ -1263,13 +1269,13 @@ version = "0.0.0"
 dependencies = [
 "anyhow",
 "clap",
- "codex-arg0",
+ "codex-process-hardening",
+ "ctor 0.5.0",
 "libc",
 "reqwest",
 "serde",
 "serde_json",
 "tiny_http",
- "tokio",
 "zeroize",
 ]

@@ -16,6 +16,7 @@ members = [
    "mcp-server",
    "mcp-types",
    "ollama",
+    "process-hardening",
    "protocol",
    "protocol-ts",
    "rmcp-client",
@@ -49,10 +50,10 @@ codex-login = { path = "login" }
 codex-mcp-client = { path = "mcp-client" }
 codex-mcp-server = { path = "mcp-server" }
 codex-ollama = { path = "ollama" }
+codex-process-hardening = { path = "process-hardening" }
 codex-protocol = { path = "protocol" }
-codex-rmcp-client = { path = "rmcp-client" }
 codex-protocol-ts = { path = "protocol-ts" }
-codex-responses-api-proxy = { path = "responses-api-proxy" }
+codex-rmcp-client = { path = "rmcp-client" }
 codex-tui = { path = "tui" }
 codex-utils-readiness = { path = "utils/readiness" }
 core_test_support = { path = "core/tests/common" }
@@ -83,8 +84,8 @@ dirs = "6"
 dotenvy = "0.15.7"
 env-flags = "0.1.1"
 env_logger = "0.11.5"
-eventsource-stream = "0.2.3"
 escargot = "0.5"
+eventsource-stream = "0.2.3"
 futures = "0.3"
 icu_decimal = "2.0.0"
 icu_locale_core = "2.0.0"
@@ -25,9 +25,9 @@ codex-core = { workspace = true }
 codex-exec = { workspace = true }
 codex-login = { workspace = true }
 codex-mcp-server = { workspace = true }
+codex-process-hardening = { workspace = true }
 codex-protocol = { workspace = true }
 codex-protocol-ts = { workspace = true }
-codex-responses-api-proxy = { workspace = true }
 codex-tui = { workspace = true }
 codex-version = { path = "../codex-version" }
 ctor = { workspace = true }
@@ -54,15 +54,6 @@ tokio = { workspace = true, features = [
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }

-[target.'cfg(target_os = "linux")'.dependencies]
-libc = { workspace = true }
-
-[target.'cfg(target_os = "android")'.dependencies]
-libc = { workspace = true }
-
-[target.'cfg(target_os = "macos")'.dependencies]
-libc = { workspace = true }
-
 [dev-dependencies]
 assert_cmd = { workspace = true }
 predicates = { workspace = true }
@@ -15,7 +15,6 @@ use codex_cli::login::run_login_with_chatgpt;
 use codex_cli::login::run_logout;
 use codex_cli::proto;
 mod llm;
-mod pre_main_hardening;
 use llm::{LlmCli, run_llm};
 use codex_common::CliConfigOverrides;
 use codex_core::find_conversation_path_by_id_str;
@@ -47,14 +46,7 @@ fn pre_main_hardening() {
    };

    if secure_mode == "1" {
-        #[cfg(any(target_os = "linux", target_os = "android"))]
-        crate::pre_main_hardening::pre_main_hardening_linux();
-
-        #[cfg(target_os = "macos")]
-        crate::pre_main_hardening::pre_main_hardening_macos();
-
-        #[cfg(windows)]
-        crate::pre_main_hardening::pre_main_hardening_windows();
+        codex_process_hardening::pre_main_hardening();
    }

    // Always clear this env var so child processes don't inherit it.
@@ -1,92 +0,0 @@
-use anyhow::Context;
-use serde::Deserialize;
-use serde::Serialize;
-use std::io::ErrorKind;
-use std::path::Path;
-use std::path::PathBuf;
-
-use crate::config::resolve_codex_path_for_read;
-
-pub(crate) const INTERNAL_STORAGE_FILE: &str = "internal_storage.json";
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct InternalStorage {
-    #[serde(skip)]
-    storage_path: PathBuf,
-    #[serde(default = "default_gpt_5_codex_model_prompt_seen")]
-    pub gpt_5_codex_model_prompt_seen: bool,
-}
-
-const fn default_gpt_5_codex_model_prompt_seen() -> bool {
-    true
-}
-
-impl Default for InternalStorage {
-    fn default() -> Self {
-        Self {
-            storage_path: PathBuf::new(),
-            gpt_5_codex_model_prompt_seen: default_gpt_5_codex_model_prompt_seen(),
-        }
-    }
-}
-
-// TODO(jif) generalise all the file writers and build proper async channel inserters.
-impl InternalStorage {
-    pub fn load(codex_home: &Path) -> Self {
-        let storage_path = codex_home.join(INTERNAL_STORAGE_FILE);
-        let read_path = resolve_codex_path_for_read(codex_home, Path::new(INTERNAL_STORAGE_FILE));
-
-        match std::fs::read_to_string(&read_path) {
-            Ok(serialized) => match serde_json::from_str::<Self>(&serialized) {
-                Ok(mut storage) => {
-                    storage.storage_path = storage_path;
-                    storage
-                }
-                Err(error) => {
-                    tracing::warn!("failed to parse internal storage: {error:?}");
-                    Self::empty(storage_path)
-                }
-            },
-            Err(error) => {
-                if error.kind() == ErrorKind::NotFound {
-                    tracing::debug!(
-                        "internal storage not found at {}; initializing defaults",
-                        storage_path.display()
-                    );
-                } else {
-                    tracing::warn!("failed to read internal storage: {error:?}");
-                }
-                Self::empty(storage_path)
-            }
-        }
-    }
-
-    fn empty(storage_path: PathBuf) -> Self {
-        Self {
-            storage_path,
-            ..Default::default()
-        }
-    }
-
-    pub async fn persist(&self) -> anyhow::Result<()> {
-        let serialized = serde_json::to_string_pretty(self)?;
-
-        if let Some(parent) = self.storage_path.parent() {
-            tokio::fs::create_dir_all(parent).await.with_context(|| {
-                format!(
-                    "failed to create internal storage directory at {}",
-                    parent.display()
-                )
-            })?;
-        }
-
-        tokio::fs::write(&self.storage_path, serialized)
-            .await
-            .with_context(|| {
-                format!(
-                    "failed to persist internal storage at {}",
-                    self.storage_path.display()
-                )
-            })
-    }
-}
@@ -33,7 +33,6 @@ mod exec_command;
 pub mod exec_env;
 mod flags;
 pub mod git_info;
-pub mod internal_storage;
 pub mod landlock;
 pub mod http_client;
 pub mod mcp_connection_manager;
@@ -0,0 +1,15 @@
+[package]
+edition = "2021"
+name = "codex-process-hardening"
+version = { workspace = true }
+
+[lib]
+name = "codex_process_hardening"
+path = "src/lib.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+[target.'cfg(unix)'.dependencies]
+libc = { workspace = true }
@@ -0,0 +1,7 @@
+# codex-process-hardening
+
+This crate provides `pre_main_hardening()`, which is designed to be called pre-`main()` (using `#[ctor::ctor]`) to perform various process hardening steps, such as
+
+- disabling core dumps
+- disabling ptrace attach on Linux and macOS
+- removing dangerous environment variables such as `LD_PRELOAD` and `DYLD_*`
@@ -1,3 +1,19 @@
+/// This is designed to be called pre-main() (using `#[ctor::ctor]`) to perform
+/// various process hardening steps, such as
+/// - disabling core dumps
+/// - disabling ptrace attach on Linux and macOS.
+/// - removing dangerous environment variables such as LD_PRELOAD and DYLD_*
+pub fn pre_main_hardening() {
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    pre_main_hardening_linux();
+
+    #[cfg(target_os = "macos")]
+    pre_main_hardening_macos();
+
+    #[cfg(windows)]
+    pre_main_hardening_windows();
+}
+
 #[cfg(any(target_os = "linux", target_os = "android"))]
 const PRCTL_FAILED_EXIT_CODE: i32 = 5;

@@ -8,7 +8,7 @@ name = "codex_responses_api_proxy"
 path = "src/lib.rs"

 [[bin]]
-name = "responses-api-proxy"
+name = "codex-responses-api-proxy"
 path = "src/main.rs"

 [lints]
@@ -17,11 +17,11 @@ workspace = true
 [dependencies]
 anyhow = { workspace = true }
 clap = { workspace = true, features = ["derive"] }
-codex-arg0 = { workspace = true }
+codex-process-hardening = { workspace = true }
+ctor = { workspace = true }
 libc = { workspace = true }
 reqwest = { workspace = true, features = ["blocking", "json", "rustls-tls"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tiny_http = { workspace = true }
-tokio = { workspace = true }
 zeroize = { workspace = true }
@@ -4,12 +4,12 @@ A strict HTTP proxy that only forwards `POST` requests to `/v1/responses` to the

 ## Expected Usage

-**IMPORTANT:** This is designed to be used with `CODEX_SECURE_MODE=1` so that an unprivileged user cannot inspect or tamper with this process. Though if `--http-shutdown` is specified, an unprivileged user _can_ shutdown the server.
+**IMPORTANT:** `codex-responses-api-proxy` is designed to be run by a privileged user with access to `OPENAI_API_KEY` so that an unprivileged user cannot inspect or tamper with the process. Though if `--http-shutdown` is specified, an unprivileged user _can_ make a `GET` request to `/shutdown` to shutdown the server, as an unprivileged could not send `SIGTERM` to kill the process.

-A privileged user (i.e., `root` or a user with `sudo`) who has access to `OPENAI_API_KEY` would run the following to start the server:
+A privileged user (i.e., `root` or a user with `sudo`) who has access to `OPENAI_API_KEY` would run the following to start the server, as `codex-responses-api-proxy` reads the auth token from `stdin`:

 ```shell
-printenv OPENAI_API_KEY | CODEX_SECURE_MODE=1 codex responses-api-proxy --http-shutdown --server-info /tmp/server-info.json
+printenv OPENAI_API_KEY | codex-responses-api-proxy --http-shutdown --server-info /tmp/server-info.json
 ```

 A non-privileged user would then run Codex as follows, specifying the `model_provider` dynamically:
@@ -22,7 +22,7 @@ codex exec -c "model_providers.openai-proxy={ name = 'OpenAI Proxy', base_url =
    'Your prompt here'
 ```

-When the unprivileged user was finished, they could shutdown the server using `curl` (since `kill -9` is not an option):
+When the unprivileged user was finished, they could shutdown the server using `curl` (since `kill -SIGTERM` is not an option):

 ```shell
 curl --fail --silent --show-error "${PROXY_BASE_URL}/shutdown"
@@ -30,17 +30,17 @@ curl --fail --silent --show-error "${PROXY_BASE_URL}/shutdown"

 ## Behavior

- Reads the API key from `stdin`. All callers should pipe the key in (for example, `printenv OPENAI_API_KEY | codex responses-api-proxy`).
+- Reads the API key from `stdin`. All callers should pipe the key in (for example, `printenv OPENAI_API_KEY | codex-responses-api-proxy`).
 - Formats the header value as `Bearer <key>` and attempts to `mlock(2)` the memory holding that header so it is not swapped to disk.
 - Listens on the provided port or an ephemeral port if `--port` is not specified.
 - Accepts exactly `POST /v1/responses` (no query string). The request body is forwarded to `https://api.openai.com/v1/responses` with `Authorization: Bearer <key>` set. All original request headers (except any incoming `Authorization`) are forwarded upstream. For other requests, it responds with `403`.
 - Optionally writes a single-line JSON file with server info, currently `{ "port": <u16> }`.
- Optional `--http-shutdown` enables `GET /shutdown` to terminate the process with exit code 0. This allows one user (e.g., root) to start the proxy and another unprivileged user on the host to shut it down.
+- Optional `--http-shutdown` enables `GET /shutdown` to terminate the process with exit code 0. This allows one user (e.g., `root`) to start the proxy and another unprivileged user on the host to shut it down.

 ## CLI

 ```
-responses-api-proxy [--port <PORT>] [--server-info <FILE>] [--http-shutdown]
+codex-responses-api-proxy [--port <PORT>] [--server-info <FILE>] [--http-shutdown]
 ```

 - `--port <PORT>`: Port to bind on `127.0.0.1`. If omitted, an ephemeral port is chosen.
@@ -51,3 +51,19 @@ responses-api-proxy [--port <PORT>] [--server-info <FILE>] [--http-shutdown]

 - Only `POST /v1/responses` is permitted. No query strings are allowed.
 - All request headers are forwarded to the upstream call (aside from overriding `Authorization`). Response status and content-type are mirrored from upstream.
+
+## Hardening Details
+
+Care is taken to restrict access/copying to the value of `OPENAI_API_KEY` retained in memory:
+
+- We leverage [`codex_process_hardening`](https://github.com/openai/codex/blob/main/codex-rs/process-hardening/README.md) so `codex-responses-api-proxy` is run with standard process-hardening techniques.
+- At startup, we allocate a `1024` byte buffer on the stack and write `"Bearer "` as the first `7` bytes.
+- We then read from `stdin`, copying the contents into the buffer after `"Bearer "`.
+- After verifying the key matches `/^[a-zA-Z0-9_-]+$/` (and does not exceed the buffer), we create a `String` from that buffer (so the data is now on the heap).
+- We zero out the stack-allocated buffer using https://crates.io/crates/zeroize so it is not optimized away by the compiler.
+- We invoke `.leak()` on the `String` so we can treat its contents as a `&'static str`, as it will live for the rest of the process.
+- On UNIX, we `mlock(2)` the memory backing the `&'static str`.
+- When using the `&'static str` when building an HTTP request, we use `HeaderValue::from_static()` to avoid copying the `&str`.
+- We also invoke `.set_sensitive(true)` on the `HeaderValue`, which in theory indicates to other parts of the HTTP stack that the header should be treated with "special care" to avoid leakage:
+
+https://github.com/hyperium/http/blob/439d1c50d71e3be3204b6c4a1bf2255ed78e1f93/src/header/value.rs#L346-L376
@@ -0,0 +1,13 @@
+# @openai/codex-responses-api-proxy
+
+<p align="center"><code>npm i -g @openai/codex-responses-api-proxy</code> to install <code>codex-responses-api-proxy</code></p>
+
+This package distributes the prebuilt [Codex Responses API proxy binary](https://github.com/openai/codex/tree/main/codex-rs/responses-api-proxy) for macOS, Linux, and Windows.
+
+To see available options, run:
+
+```
+node ./bin/codex-responses-api-proxy.js --help
+```
+
+Refer to [`codex-rs/responses-api-proxy/README.md`](https://github.com/openai/codex/blob/main/codex-rs/responses-api-proxy/README.md) for detailed documentation.
@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+// Entry point for the Codex responses API proxy binary.
+
+import { spawn } from "node:child_process";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+function determineTargetTriple(platform, arch) {
+  switch (platform) {
+    case "linux":
+    case "android":
+      if (arch === "x64") {
+        return "x86_64-unknown-linux-musl";
+      }
+      if (arch === "arm64") {
+        return "aarch64-unknown-linux-musl";
+      }
+      break;
+    case "darwin":
+      if (arch === "x64") {
+        return "x86_64-apple-darwin";
+      }
+      if (arch === "arm64") {
+        return "aarch64-apple-darwin";
+      }
+      break;
+    case "win32":
+      if (arch === "x64") {
+        return "x86_64-pc-windows-msvc";
+      }
+      if (arch === "arm64") {
+        return "aarch64-pc-windows-msvc";
+      }
+      break;
+    default:
+      break;
+  }
+  return null;
+}
+
+const targetTriple = determineTargetTriple(process.platform, process.arch);
+if (!targetTriple) {
+  throw new Error(
+    `Unsupported platform: ${process.platform} (${process.arch})`,
+  );
+}
+
+const vendorRoot = path.join(__dirname, "..", "vendor");
+const archRoot = path.join(vendorRoot, targetTriple);
+const binaryBaseName = "codex-responses-api-proxy";
+const binaryPath = path.join(
+  archRoot,
+  binaryBaseName,
+  process.platform === "win32" ? `${binaryBaseName}.exe` : binaryBaseName,
+);
+
+const child = spawn(binaryPath, process.argv.slice(2), {
+  stdio: "inherit",
+});
+
+child.on("error", (err) => {
+  console.error(err);
+  process.exit(1);
+});
+
+const forwardSignal = (signal) => {
+  if (!child.killed) {
+    try {
+      child.kill(signal);
+    } catch {
+      /* ignore */
+    }
+  }
+};
+
+["SIGINT", "SIGTERM", "SIGHUP"].forEach((sig) => {
+  process.on(sig, () => forwardSignal(sig));
+});
+
+const childResult = await new Promise((resolve) => {
+  child.on("exit", (code, signal) => {
+    if (signal) {
+      resolve({ type: "signal", signal });
+    } else {
+      resolve({ type: "code", exitCode: code ?? 1 });
+    }
+  });
+});
+
+if (childResult.type === "signal") {
+  process.kill(process.pid, childResult.signal);
+} else {
+  process.exit(childResult.exitCode);
+}
@@ -0,0 +1,21 @@
+{
+  "name": "@openai/codex-responses-api-proxy",
+  "version": "0.0.0-dev",
+  "license": "Apache-2.0",
+  "bin": {
+    "codex-responses-api-proxy": "bin/codex-responses-api-proxy.js"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=16"
+  },
+  "files": [
+    "bin",
+    "vendor"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openai/codex.git",
+    "directory": "codex-rs/responses-api-proxy/npm"
+  }
+}
@@ -6,6 +6,7 @@ use std::net::TcpListener;
 use std::path::Path;
 use std::path::PathBuf;
 use std::sync::Arc;
+use std::time::Duration;

 use anyhow::Context;
 use anyhow::Result;
@@ -62,6 +63,8 @@ pub fn run_main(args: Args) -> Result<()> {
        .map_err(|err| anyhow!("creating HTTP server: {err}"))?;
    let client = Arc::new(
        Client::builder()
+            // Disable reqwest's 30s default so long-lived response streams keep flowing.
+            .timeout(None::<Duration>)
            .build()
            .context("building reqwest client")?,
    );
@@ -1,14 +1,12 @@
-use anyhow::Context;
 use clap::Parser;
-use codex_arg0::arg0_dispatch_or_else;
 use codex_responses_api_proxy::Args as ResponsesApiProxyArgs;

+#[ctor::ctor]
+fn pre_main() {
+    codex_process_hardening::pre_main_hardening();
+}
+
 pub fn main() -> anyhow::Result<()> {
-    arg0_dispatch_or_else(|_codex_linux_sandbox_exe| async move {
-        let args = ResponsesApiProxyArgs::parse();
-        tokio::task::spawn_blocking(move || codex_responses_api_proxy::run_main(args))
-            .await
-            .context("responses-api-proxy blocking task panicked")??;
-        Ok(())
-    })
+    let args = ResponsesApiProxyArgs::parse();
+    codex_responses_api_proxy::run_main(args)
 }
@@ -35,13 +35,6 @@ where
        buf.zeroize();
    })?;

-    if read == buf.len() - AUTH_HEADER_PREFIX.len() {
-        buf.zeroize();
-        return Err(anyhow!(
-            "OPENAI_API_KEY is too large to fit in the 512-byte buffer"
-        ));
-    }
-
    let mut total = AUTH_HEADER_PREFIX.len() + read;
    while total > AUTH_HEADER_PREFIX.len() && (buf[total - 1] == b'\n' || buf[total - 1] == b'\r') {
        total -= 1;
@@ -54,9 +47,23 @@ where
        ));
    }

+    if total == buf.len() {
+        buf.zeroize();
+        return Err(anyhow!(
+            "OPENAI_API_KEY is too large to fit in the 1024-byte buffer"
+        ));
+    }
+
+    if let Err(err) = validate_auth_header_bytes(&buf[AUTH_HEADER_PREFIX.len()..total]) {
+        buf.zeroize();
+        return Err(err);
+    }
+
    let header_str = match std::str::from_utf8(&buf[..total]) {
        Ok(value) => value,
        Err(err) => {
+            // In theory, validate_auth_header_bytes() should have caught
+            // any invalid UTF-8 sequences, but just in case...
            buf.zeroize();
            return Err(err).context("reading Authorization header from stdin as UTF-8");
        }
@@ -113,6 +120,21 @@ fn mlock_str(value: &str) {
 #[cfg(not(unix))]
 fn mlock_str(_value: &str) {}

+/// The key should match /^[A-Za-z0-9\-_]+$/. Ensure there is no funny business
+/// with NUL characters and whatnot.
+fn validate_auth_header_bytes(key_bytes: &[u8]) -> Result<()> {
+    if key_bytes
+        .iter()
+        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    {
+        return Ok(());
+    }
+
+    Err(anyhow!(
+        "OPENAI_API_KEY may only contain ASCII letters, numbers, '-' or '_'"
+    ))
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -158,7 +180,24 @@ mod tests {
        })
        .unwrap_err();
        let message = format!("{err:#}");
-        assert!(message.contains("too large"));
+        assert!(message.contains("OPENAI_API_KEY is too large to fit in the 1024-byte buffer"));
+    }
+
+    #[test]
+    fn accepts_near_limit_key_with_newline() {
+        let key_len = BUFFER_SIZE - AUTH_HEADER_PREFIX.len() - 1;
+        let mut data = vec![b'a'; key_len];
+        data.push(b'\n');
+
+        let header = read_auth_header_with(|buf| {
+            buf[..data.len()].copy_from_slice(&data);
+            Ok(data.len())
+        })
+        .expect("expected near-limit key with newline to succeed");
+
+        assert_eq!(header.len(), AUTH_HEADER_PREFIX.len() + key_len);
+        assert!(header.starts_with("Bearer "));
+        assert!(!header.ends_with('\n'));
    }

    #[test]
@@ -180,6 +219,23 @@ mod tests {
        .unwrap_err();

        let message = format!("{err:#}");
-        assert!(message.contains("UTF-8"));
+        assert!(
+            message.contains("OPENAI_API_KEY may only contain ASCII letters, numbers, '-' or '_'")
+        );
+    }
+
+    #[test]
+    fn errors_on_invalid_characters() {
+        let err = read_auth_header_with(|buf| {
+            let data = b"sk-abc!23";
+            buf[..data.len()].copy_from_slice(data);
+            Ok(data.len())
+        })
+        .unwrap_err();
+
+        let message = format!("{err:#}");
+        assert!(
+            message.contains("OPENAI_API_KEY may only contain ASCII letters, numbers, '-' or '_'")
+        );
    }
 }
@@ -1,276 +0,0 @@
-use crate::tui::FrameRequester;
-use crate::tui::Tui;
-use crate::tui::TuiEvent;
-use codex_core::config::SWIFTFOX_MODEL_DISPLAY_NAME;
-use color_eyre::eyre::Result;
-use crossterm::event::KeyCode;
-use crossterm::event::KeyEvent;
-use crossterm::event::KeyModifiers;
-use rand::Rng as _;
-use ratatui::buffer::Buffer;
-use ratatui::layout::Rect;
-use ratatui::prelude::Widget;
-use ratatui::style::Stylize;
-use ratatui::text::Line;
-use ratatui::widgets::Clear;
-use ratatui::widgets::Paragraph;
-use ratatui::widgets::WidgetRef;
-use ratatui::widgets::Wrap;
-use std::time::Duration;
-use tokio_stream::StreamExt;
-
-// Embed animation frames for each variant at compile time.
-macro_rules! frames_for {
-    ($dir:literal) => {
-        [
-            include_str!(concat!("../frames/", $dir, "/frame_1.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_2.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_3.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_4.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_5.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_6.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_7.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_8.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_9.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_10.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_11.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_12.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_13.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_14.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_15.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_16.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_17.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_18.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_19.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_20.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_21.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_22.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_23.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_24.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_25.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_26.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_27.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_28.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_29.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_30.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_31.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_32.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_33.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_34.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_35.txt")),
-            include_str!(concat!("../frames/", $dir, "/frame_36.txt")),
-        ]
-    };
-}
-
-const FRAMES_DEFAULT: [&str; 36] = frames_for!("default");
-const FRAMES_CODEX: [&str; 36] = frames_for!("codex");
-const FRAMES_OPENAI: [&str; 36] = frames_for!("openai");
-const FRAMES_BLOCKS: [&str; 36] = frames_for!("blocks");
-const FRAMES_DOTS: [&str; 36] = frames_for!("dots");
-const FRAMES_HASH: [&str; 36] = frames_for!("hash");
-const FRAMES_HBARS: [&str; 36] = frames_for!("hbars");
-const FRAMES_VBARS: [&str; 36] = frames_for!("vbars");
-const FRAMES_SHAPES: [&str; 36] = frames_for!("shapes");
-const FRAMES_SLUG: [&str; 36] = frames_for!("slug");
-
-const VARIANTS: &[&[&str]] = &[
-    &FRAMES_DEFAULT,
-    &FRAMES_CODEX,
-    &FRAMES_OPENAI,
-    &FRAMES_BLOCKS,
-    &FRAMES_DOTS,
-    &FRAMES_HASH,
-    &FRAMES_HBARS,
-    &FRAMES_VBARS,
-    &FRAMES_SHAPES,
-    &FRAMES_SLUG,
-];
-
-const FRAME_TICK: Duration = Duration::from_millis(60);
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum ModelUpgradeDecision {
-    Switch,
-    KeepCurrent,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum ModelUpgradeOption {
-    TryNewModel,
-    KeepCurrent,
-}
-
-struct ModelUpgradePopup {
-    highlighted: ModelUpgradeOption,
-    decision: Option<ModelUpgradeDecision>,
-    request_frame: FrameRequester,
-    frame_idx: usize,
-    variant_idx: usize,
-}
-
-impl ModelUpgradePopup {
-    fn new(request_frame: FrameRequester) -> Self {
-        Self {
-            highlighted: ModelUpgradeOption::TryNewModel,
-            decision: None,
-            request_frame,
-            frame_idx: 0,
-            variant_idx: 0,
-        }
-    }
-
-    fn handle_key_event(&mut self, key_event: KeyEvent) {
-        match key_event.code {
-            KeyCode::Up | KeyCode::Char('k') => self.highlight(ModelUpgradeOption::TryNewModel),
-            KeyCode::Down | KeyCode::Char('j') => self.highlight(ModelUpgradeOption::KeepCurrent),
-            KeyCode::Char('1') => self.select(ModelUpgradeOption::TryNewModel),
-            KeyCode::Char('2') => self.select(ModelUpgradeOption::KeepCurrent),
-            KeyCode::Enter => self.select(self.highlighted),
-            KeyCode::Esc => self.select(ModelUpgradeOption::KeepCurrent),
-            KeyCode::Char('.') => {
-                if key_event.modifiers.contains(KeyModifiers::CONTROL) {
-                    self.pick_random_variant();
-                }
-            }
-            _ => {}
-        }
-    }
-
-    fn highlight(&mut self, option: ModelUpgradeOption) {
-        if self.highlighted != option {
-            self.highlighted = option;
-            self.request_frame.schedule_frame();
-        }
-    }
-
-    fn select(&mut self, option: ModelUpgradeOption) {
-        self.decision = Some(option.into());
-        self.request_frame.schedule_frame();
-    }
-
-    fn advance_animation(&mut self) {
-        let len = self.frames().len();
-        self.frame_idx = (self.frame_idx + 1) % len;
-        self.request_frame.schedule_frame_in(FRAME_TICK);
-    }
-
-    fn frames(&self) -> &'static [&'static str] {
-        VARIANTS[self.variant_idx]
-    }
-
-    fn pick_random_variant(&mut self) {
-        let total = VARIANTS.len();
-        if total <= 1 {
-            return;
-        }
-        let mut rng = rand::rng();
-        let mut next = self.variant_idx;
-        while next == self.variant_idx {
-            next = rng.random_range(0..total);
-        }
-        self.variant_idx = next;
-        self.request_frame.schedule_frame();
-    }
-}
-
-impl From<ModelUpgradeOption> for ModelUpgradeDecision {
-    fn from(option: ModelUpgradeOption) -> Self {
-        match option {
-            ModelUpgradeOption::TryNewModel => ModelUpgradeDecision::Switch,
-            ModelUpgradeOption::KeepCurrent => ModelUpgradeDecision::KeepCurrent,
-        }
-    }
-}
-
-impl WidgetRef for &ModelUpgradePopup {
-    fn render_ref(&self, area: Rect, buf: &mut Buffer) {
-        Clear.render(area, buf);
-
-        let mut lines: Vec<Line> = self.frames()[self.frame_idx]
-            .lines()
-            .map(|l| l.to_string().into())
-            .collect();
-
-        // Spacer between animation and text content.
-        lines.push("".into());
-
-        lines.push(
-            format!(
-                "   Code is now powered by {SWIFTFOX_MODEL_DISPLAY_NAME}, a new model that is"
-            )
-            .into(),
-        );
-        lines.push(Line::from(vec![
-            "   ".into(),
-            "faster, a better collaborator, ".bold(),
-            "and ".into(),
-            "more steerable.".bold(),
-        ]));
-        lines.push("".into());
-
-        let create_option =
-            |index: usize, option: ModelUpgradeOption, text: &str| -> Line<'static> {
-                if self.highlighted == option {
-                    Line::from(vec![
-                        format!("> {}. ", index + 1).cyan(),
-                        text.to_owned().cyan(),
-                    ])
-                } else {
-                    format!("  {}. {text}", index + 1).into()
-                }
-            };
-
-        lines.push(create_option(
-            0,
-            ModelUpgradeOption::TryNewModel,
-            &format!("Yes, switch me to {SWIFTFOX_MODEL_DISPLAY_NAME}"),
-        ));
-        lines.push(create_option(
-            1,
-            ModelUpgradeOption::KeepCurrent,
-            "Not right now",
-        ));
-        lines.push("".into());
-        lines.push(
-            "  Press Enter to confirm or Esc to keep your current model"
-                .dim()
-                .into(),
-        );
-
-        Paragraph::new(lines)
-            .wrap(Wrap { trim: false })
-            .render(area, buf);
-    }
-}
-
-pub(crate) async fn run_model_upgrade_popup(tui: &mut Tui) -> Result<ModelUpgradeDecision> {
-    let mut popup = ModelUpgradePopup::new(tui.frame_requester());
-
-    tui.draw(u16::MAX, |frame| {
-        frame.render_widget_ref(&popup, frame.area());
-    })?;
-
-    popup.advance_animation();
-
-    let events = tui.event_stream();
-    tokio::pin!(events);
-    while popup.decision.is_none() {
-        if let Some(event) = events.next().await {
-            match event {
-                TuiEvent::Key(key_event) => popup.handle_key_event(key_event),
-                TuiEvent::Draw => {
-                    popup.advance_animation();
-                    let _ = tui.draw(u16::MAX, |frame| {
-                        frame.render_widget_ref(&popup, frame.area());
-                    });
-                }
-                _ => {}
-            }
-        } else {
-            break;
-        }
-    }
-
-    Ok(popup.decision.unwrap_or(ModelUpgradeDecision::KeepCurrent))
-}