hanzoai/opencode-openai-codex-auth
2
0
Fork 0
mirror of https://github.com/hanzoai/opencode-openai-codex-auth.git synced 2026-09-24 17:01:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
31970d72b772d730f2a7f4f1e092a12ae2bdbc7f
opencode-openai-codex-auth/SECURITY.md
T
Numman AliandHanzo Dev fe29b2110d feat: Add comprehensive compliance documentation and fix critical bugs (v2.1.2) 
This release includes comprehensive OpenAI ToS compliance updates and fixes
4 critical bugs that prevented per-model options and multi-turn conversations
from working correctly.

## ๐Ÿ”’ Compliance & Legal Updates

### Terms of Service & Usage Guidelines
- Added comprehensive ToS & Usage Notice to README emphasizing personal use only
- Added Rate Limits & Responsible Use section with best practices
- Added extensive FAQ section addressing TOS compliance questions
- Updated LICENSE with MIT + Usage Disclaimer for personal development use
- Added compliance header to index.ts documenting intended use cases

### New Documentation
- **CONTRIBUTING.md**: Complete contribution guidelines with compliance requirements
- **SECURITY.md**: Security policy, vulnerability reporting, best practices
- **docs/privacy.md**: Comprehensive privacy & data handling documentation
- **Issue Templates**: Bug reports & feature requests with compliance checklists

### Documentation Updates
- Updated docs/index.md with usage notice and trademark disclaimers
- Updated docs/getting-started.md with "Before You Begin" compliance notice
- Updated docs/troubleshooting.md with subscription & compliance sections
- All references updated to "Plus/Pro" (removed Team/Enterprise mentions)

### Key Compliance Principles
- โœ… Emphasizes personal development use with own ChatGPT Plus/Pro subscription
- โœ… Uses OpenAI's official OAuth authentication (same as Codex CLI)
- โœ… Clear prohibition of commercial resale, multi-user services
- โœ… Not a "free API alternative" - uses existing ChatGPT subscription
- โœ… Proper trademark notices and attribution to OpenAI
- โœ… Transparent about data handling and privacy

## ๐Ÿ› Critical Bug Fixes

### Bug #1: Per-Model Options Ignored (Config Lookup Mismatch)
**Severity:** ๐Ÿ”ด HIGH

Users configured different reasoning levels for each model variant, but all
variants behaved identically because the plugin was looking up normalized
model names instead of the original config keys.

**Fix:** lib/request/request-transformer.ts:277
- Use original model name for config lookup before normalization
- Allows per-model options to work correctly
- Impact: Different reasoning levels now properly applied per variant

### Bug #2: Multi-Turn Conversations Fail (AI SDK Compatibility)
**Severity:** ๐Ÿ”ด CRITICAL

Multi-turn conversations failed with "Item not found" errors because:
1. AI SDK sends `item_reference` (not in Codex API spec)
2. IDs weren't completely stripped for stateless mode (store: false)

**Fix:** lib/request/request-transformer.ts:114-135
- Filter out AI SDK `item_reference` items
- Strip ALL IDs from remaining items (not just rs_* prefix)
- Confirmed ChatGPT backend requires store: false via testing
- Full message history preserved for LLM context

### Bug #3: Case-Sensitive Normalization
**Severity:** ๐ŸŸก MEDIUM

**Fix:** lib/request/request-transformer.ts:22-27
- Added toLowerCase() for case-insensitive matching
- Backwards compatible with old verbose config names
- Handles uppercase/mixed case user input

### Bug #4: GitHub API Rate Limiting
**Severity:** ๐ŸŸก MEDIUM

Plugin checked GitHub on every request, exhausting 60 req/hour limit.
15-minute cache timestamp was stored but never checked.

**Fix:** lib/prompts/codex.ts:50-53, lib/prompts/opencode-codex.ts:47-50
- Check cache TTL before GitHub API call
- Only fetch if cache >15min old
- Prevents rate limit exhaustion during testing

## โœจ Enhancements

### Debug Logging System
- New environment variable: `DEBUG_CODEX_PLUGIN=1`
- Added logDebug() and logWarn() functions
- Shows config lookups, ID filtering, options resolution
- File: lib/logger.ts

### Optimized Config Structure
- Changed to Codex CLI preset names (gpt-5-codex-low, etc.)
- Removed redundant `id` field (not used by OpenAI provider)
- Added `name` field for friendly TUI display
- File: config/full-opencode.json

### GitHub Pages Documentation
- Complete documentation restructure for GitHub Pages
- User guides: getting-started.md, configuration.md, troubleshooting.md
- Developer guides: ARCHITECTURE.md, CONFIG_FLOW.md, CONFIG_FIELDS.md, TESTING.md
- Privacy policy, security policy, contribution guidelines

## ๐Ÿงช Testing

### Test Coverage
- โœ… 159 unit tests passing (30+ new tests)
- โœ… 14 integration tests passing (actual API verification)
- โœ… All documented scenarios have test coverage

### Integration Tests (scripts/test-all-models.sh)
- Tests all 9 custom model configurations
- Tests all 4 default OpenCode models
- Verifies backwards compatibility with old config format
- Uses ENABLE_PLUGIN_REQUEST_LOGGING to verify actual API requests

### Test Results
- 14/14 model configuration tests passing
- All per-model options verified correct
- Multi-turn conversations work without errors
- Backwards compatibility confirmed

## ๐Ÿ“ Files Changed

### Modified (7 files)
- lib/request/request-transformer.ts: Config lookup & ID filtering fixes
- lib/prompts/codex.ts: 15-minute cache TTL
- lib/prompts/opencode-codex.ts: 15-minute cache TTL
- lib/logger.ts: Debug logging system
- config/full-opencode.json: Optimized structure
- test/request-transformer.test.ts: 30+ new tests
- LICENSE: Added usage disclaimer
- index.ts: Added compliance header
- README.md: Added ToS, Rate Limits, FAQ sections

### Created (20+ files)
- CONTRIBUTING.md: Contribution guidelines
- SECURITY.md: Security policy
- docs/index.md: GitHub Pages landing
- docs/getting-started.md: Installation guide
- docs/configuration.md: Advanced config
- docs/troubleshooting.md: Debug guide
- docs/privacy.md: Privacy policy
- docs/development/ARCHITECTURE.md: Technical architecture
- docs/development/CONFIG_FLOW.md: Config system internals
- docs/development/CONFIG_FIELDS.md: Field usage guide
- docs/development/TESTING.md: Testing guide
- .github/ISSUE_TEMPLATE/bug_report.md
- .github/ISSUE_TEMPLATE/feature_request.md
- .github/ISSUE_TEMPLATE/config.yml
- scripts/test-all-models.sh: Automated testing

## ๐ŸŽฏ Verification

All scenarios tested and verified:
- โœ… Default models work without config
- โœ… Custom models with per-variant options
- โœ… Old config format (backwards compatible)
- โœ… Mixed default + custom models
- โœ… Multi-turn conversations (no "item not found" errors)
- โœ… Model switching with different options
- โœ… All normalization patterns
- โœ… Complete ID filtering

## ๐Ÿ“š Documentation

Complete documentation suite (100+ KB):
- User guides for installation, configuration, troubleshooting
- Developer guides for architecture, config system, testing
- Privacy policy and security policy
- Compliance guidelines and contribution requirements
- Release notes in tmp/release-notes/

## ๐Ÿ”— References

- OpenAI Terms of Use: https://openai.com/policies/terms-of-use/
- OpenAI Usage Policies: https://openai.com/policies/usage-policies/
- OpenAI Platform API: https://platform.openai.com/
- OpenAI Codex CLI: https://github.com/openai/codex

Co-authored-by: Hanzo Dev <[email protected]>
2025-10-12 21:25:43 +01:00

2.7 KiB
Raw Blame History

Security Policy

Supported Versions

We provide security updates for the latest version of the plugin.

Version Supported
Latest โœ… Active support
< 1.0 โŒ No longer supported

Security Considerations

OAuth Token Security

This plugin handles sensitive OAuth tokens. To protect your security:

โœ… What we do:

  • Store tokens securely via opencode's credential management
  • Use PKCE-secured OAuth 2.0 flows
  • Never transmit tokens to third parties
  • Implement automatic token refresh
  • Use industry-standard authentication practices

โš ๏ธ What you should do:

  • Never share your ~/.opencode/ directory
  • Do not commit OAuth tokens to version control
  • Regularly review authorized apps at ChatGPT Settings
  • Use opencode auth logout when done on shared systems
  • Enable debug logging (ENABLE_PLUGIN_REQUEST_LOGGING=1) only when troubleshooting

Reporting a Vulnerability

If you discover a security vulnerability:

  1. DO NOT open a public issue
  2. Email the maintainer directly (check GitHub profile for contact)
  3. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

We aim to respond to security reports within 48 hours.

Responsible Disclosure

We follow responsible disclosure practices:

  • Security issues are patched before public disclosure
  • Reporter receives credit (unless anonymity is requested)
  • Timeline for disclosure is coordinated with reporter

Security Best Practices

When using this plugin:

  • Personal use only: Do not use for commercial services
  • Respect rate limits: Avoid excessive automation
  • Monitor usage: Review your ChatGPT usage regularly
  • Keep updated: Use the latest version for security patches
  • Secure your machine: This plugin is as secure as your development environment
  • Review permissions: Understand what the plugin can access via OAuth

Out of Scope

The following are not security vulnerabilities:

  • Issues related to violating OpenAI's Terms of Service
  • Rate limiting by OpenAI's servers
  • Authentication failures due to expired subscriptions
  • OpenAI API or service outages

Third-Party Dependencies

This plugin minimizes dependencies for security:

  • Only dependency: @openauthjs/openauth (for OAuth handling)
  • Regular dependency updates for security patches
  • No telemetry or analytics dependencies

Questions?

For security questions that are not vulnerabilities, open a discussion thread on GitHub.

Note: This plugin is not affiliated with OpenAI. For OpenAI security concerns, contact OpenAI directly.

Reference in New Issue View Git Blame Copy Permalink