[chopratejas]

Description

The WebSocket routes (/v1/responses, /v1/live) check the browser Origin against HEADROOM_WS_ORIGINS, falling back to HEADROOM_CORS_ORIGINS. A * entry in either made every Origin acceptable. HEADROOM_CORS_ORIGINS=* is a documented value for CORS (which pages may read a response), so loosening CORS for a remote dashboard also let any page open in the user's browser open these sockets, and the proxy then adds its own credentials upstream.

* now matches nothing in the Origin check. A list that holds only * keeps the loopback default; explicit origins in either variable keep working. CORS itself is unchanged.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Performance improvement
• Code refactoring (no functional changes)

Changes Made

• headroom/proxy/handlers/openai.py: _allowed_ws_origins_from_env drops * entries (empty result means the loopback default); _is_allowed_websocket_origin no longer short-circuits to True on *. providers/codex/live.py uses the same helper, so /v1/live is covered too.
• tests/test_openai_codex_routing.py: policy test for * via either variable and mixed with an explicit origin, plus a handler test that a foreign Origin is closed with 1008 under HEADROOM_CORS_ORIGINS=*.

Testing

• Unit tests pass (pytest)
• Linting passes (ruff check .)
• Type checking passes (mypy headroom)
• New tests added for new functionality
• Manual testing performed

Test Output

# new tests on origin/main (before the fix)
$ pytest tests/test_openai_codex_routing.py -k wildcard
FAILED tests/test_openai_codex_routing.py::test_websocket_origin_policy_ignores_wildcard[None-*]
FAILED tests/test_openai_codex_routing.py::test_websocket_origin_policy_ignores_wildcard[*-None]
FAILED tests/test_openai_codex_routing.py::test_websocket_origin_policy_ignores_wildcard[None-*, https://dash.example.com]
FAILED tests/test_openai_codex_routing.py::test_handle_openai_responses_ws_closes_foreign_origin_under_wildcard_cors
======================= 4 failed, 43 deselected in 1.33s =======================

# with the fix
$ pytest tests/test_openai_codex_routing.py tests/test_codex_live.py
======================= 57 passed, 7 warnings in 16.31s ========================

$ ruff check headroom/proxy/handlers/openai.py tests/test_openai_codex_routing.py
All checks passed!
$ mypy headroom/proxy/handlers/openai.py --ignore-missing-imports
Success: no issues found in 1 source file

Real Behavior Proof

• Environment: macOS, Python 3.12, headroom proxy --host 127.0.0.1 --no-optimize started with HEADROOM_CORS_ORIGINS='*', one run on origin/main and one on this branch.
• Exact command / steps: open ws://127.0.0.1:<port>/v1/responses with the websockets client, once with Origin: https://page.example and once with Origin: http://127.0.0.1:<port>.
• Observed result:

  == origin/main (HEADROOM_CORS_ORIGINS=*)
  Origin=https://page.example -> handshake accepted, socket open
  Origin=http://127.0.0.1:18941 -> handshake accepted, socket open
  == this branch (HEADROOM_CORS_ORIGINS=*)
  Origin=https://page.example -> handshake refused HTTP 403
  Origin=http://127.0.0.1:18942 -> handshake accepted, socket open
  

• Not tested: /v1/live end to end (same helper, covered by the unit tests' shared code path).

Runtime Rollout Safety

• Rollout-managed feature(s): none
• Minimum rollout channel: n/a
• Stable/default behavior changed: only for operators who set * in HEADROOM_WS_ORIGINS or HEADROOM_CORS_ORIGINS. Native clients (Codex, SDKs) send no Origin and are unaffected; loopback pages still connect.
• Kill switch / disable path: list the browser origins that need the WebSocket routes explicitly in HEADROOM_WS_ORIGINS.
• Unsafe override required: no
• Qualification impact: none
• Rollback path: revert this commit

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I did not edit CHANGELOG.md — it is generated by release-please from my Conventional Commit PR title (a CI guard enforces this)

Additional Notes

HEADROOM_WS_ORIGINS is not documented anywhere, so there was no doc to update. A companion PR applies the same Origin rule to the HTTP routes; once both land, * is ignored there too because they share _is_allowed_websocket_origin.

🤖 Generated with Claude Code

---

Reported by @JoaoMarcos44. Thank you for your contribution! 🩵

[github-actions]

PR governance

This PR does not yet satisfy the required template fields:

• Fill in Real Behavior Proof → Observed result.

Please update the PR body, or move the PR back to draft while it is still in progress.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
headroom/proxy/handlers/openai.py	50.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[JerrettDavis]

The origin-policy change looks correct: isolated checks pass 13 cases, including rejecting foreign origins under either wildcard setting, preserving loopback defaults, and retaining explicit-origin matching. The same checks reproduce five wildcard-policy mismatches on recorded main. No changed-code defect found. Full handler/live validation was not independently run. Review qualification remains held by the inherited shared workflow audit. CI also reports commitlint failing; its diagnostic is needed before proposing a concrete repair.

[JerrettDavis]

The origin-policy source change looks correct, and the prior 13 policy checks remain applicable at this unchanged head. The outstanding CI failure is now diagnosed: commitlint rejects the merge commit c14e46a because its Assay-Ask footer is 116 characters (limit 100). The original fix commit 190eabf also has a 126-character Assay-Ask footer. Reproduce by inspecting git log main..HEAD --format=%B and counting those footer lines. Please wrap both footers to at most 100 characters, preserving their content, then obtain a passing commitlint check. These commits are unique to the PR, so this is separate from inherited workflow provenance issues. Full handler/live validation was not independently rerun.

[JerrettDavis]

The origin-policy delta still looks correct against updated main. The previously requested commit-message repair remains unresolved: current CI run 43547199764 reports footer-max-line-length. Reproduce with git log main..HEAD --format=%B: Assay-Ask lines in c14e46a and 190eabf are 116 and 126 characters, exceeding 100. Please wrap both footers while preserving their content and obtain a passing commitlint check. The latest merge retains both offending commits. No new source defect found; earlier-head policy tests are context only, and full handler/live validation was not independently rerun.

[chopratejas]

Jerrett, the commitlint blocker is cleared. The footer-length rule fix (#4868) is merged into main, and I merged main into this branch, so commitlint now passes on this head. No code changes in this update.

[JerrettDavis]

Applied the requested mechanical fix: rewrote the PR-range commits to wrap the oversized Assay-Ask footer(s) to under the 100-character commitlint limit (content preserved, wrapped at word boundaries). Branch force-pushed; commitlint and CI are re-running at the new head.

[chopratejas]

Jerrett, after main was merged in, CI failed on tests/test_proxy_cors.py::test_wildcard_optback (403 instead of 200). The cause is the combination of this PR and the HTTP browser-origin check now on main. With HEADROOM_CORS_ORIGINS=*, * no longer matches any Origin, so the security gate refuses a foreign page's preflight before CORS answers it. That is the intended combined behaviour: * widens which pages may read a response, not which pages may drive the proxy. The test still expected the old answer.

I merged origin/main into this branch (aaf8648), then updated the test in c5d935e. It now pins three things under *: a foreign preflight and a foreign POST get 403, a loopback page still gets Access-Control-Allow-Origin: *, and credentials stay off. No code change. Locally, tests/test_proxy_cors.py, test_proxy_browser_origin.py, test_openai_codex_routing.py, test_codex_live.py and test_proxy_loopback_gating.py pass (237 passed). The test_memory_tools_only_when_injected failures are unrelated and are being fixed on main. Could you take another look?