[dhaern]

Summary

• Refresh the default Codex client User-Agent from Windows build 10.0.26100 to 10.0.26200, keeping the existing codex-cli/0.125.0 (...; x64) format and avoiding any dependency on a locally installed Codex CLI.
• Generate Codex-style session identity metadata inside OmniRoute: session_id, x-client-request-id, x-codex-window-id, x-codex-turn-metadata, and client_metadata.x-codex-installation-id.
• Align the generated identity with the same safe session source used for prompt_cache_key, so headers and body no longer diverge between workspace-level and conversation-level identifiers.
• Add validation for session IDs before using them as headers, and remove unused legacy Codex system-message hoisting code.

Motivation

A capture from the official Codex CLI shows that requests carry per-session identity headers and client_metadata.x-codex-installation-id alongside prompt_cache_key. OmniRoute already tried to mimic part of that behavior, but buildHeaders() did not have request-body context and could fall back to workspaceId while transformRequest() used session_id/conversation_id for prompt_cache_key.

That meant the upstream request could contain mixed identity/cache affinity signals, e.g.:

• header session_id = workspaceId
• body prompt_cache_key = conversationId

This change creates the identity once in CodexExecutor.execute() using the same safe session source, then applies it consistently to headers and body metadata.

Scope intentionally not changed

This PR does not change Codex response behavior or transport semantics:

• no originator change (codex_cli_rs remains as-is)
• no stream / SSE / WebSocket behavior changes
• no store behavior changes
• no tools behavior changes
• no reasoning behavior changes
• no include changes
• no parallel_tool_calls changes
• no max_output_tokens behavior changes

Implementation notes

• x-codex-installation-id is generated as a stable UUID from connection/account metadata, with optional providerSpecificData.codexInstallationId override if a connection ever stores an explicit one.
• Session IDs are trimmed and validated with a conservative header-safe pattern before being used in headers.
• Unsafe session IDs still do not break the request; OmniRoute simply skips the generated Codex identity headers.
• client_metadata is merged, not replaced.

Validation

• node --import tsx/esm --test tests/unit/executor-codex.test.ts tests/unit/codex-cache-key.test.ts tests/unit/codex-stream-false.test.ts tests/unit/codex-quota-fetcher.test.ts
• npm run typecheck:core
• npm run typecheck:noimplicit:core
• git diff --check

[gemini-code-assist]

Code Review

This pull request introduces a new identity management system for Codex clients, including session, window, and installation tracking. It adds utility functions for normalizing UUIDs and session IDs, generating stable installation IDs from workspace or account data, and applying these identities via request headers and metadata. The CodexExecutor has been updated to integrate these identity headers into its execution flow, and the default user agent platform version was bumped. I have no feedback to provide as the review comments were either informational or lacked actionable suggestions.

[dhaern]

@gemini-code-assist Additional note on scope/simplification before opening this PR:

Before publishing this I did a Codex-specific simplify/YAGNI pass over the executor/config changes. The result was intentionally conservative:

Applied:

• removed unused legacy Codex system-message hoisting helpers from open-sse/executors/codex.ts;
• kept the existing HTTP/SSE and optional WebSocket transport paths intact;
• derived x-codex-turn-metadata when applying headers instead of storing duplicated JSON in the identity object;
• validated session IDs before using them in upstream headers, so unsafe values simply skip the generated identity headers;
• kept client_metadata merging additive instead of replacing caller-provided metadata.

Intentionally not changed in this PR:

• originator remains codex_cli_rs;
• no stream, SSE, WebSocket, retry, or readiness behavior changed;
• no store, tools, reasoning, include, parallel_tool_calls, or max_output_tokens behavior changed;
• no large transformRequest() refactor, because it contains several accumulated compatibility paths.

The main goal is limited to Codex client identity/cache-affinity metadata and a Windows build refresh, not transport or response-shape changes.

[gemini-code-assist]

Gracias por la aclaración detallada sobre el alcance y la intención de estos cambios. Es muy útil entender que el objetivo principal es la alineación de la identidad del cliente y la actualización de la versión de Windows, manteniendo la estabilidad de las rutas de transporte existentes. La estrategia de validación y el enfoque conservador para la integración de metadatos parecen correctos para evitar regresiones no deseadas.

[diegosouzapw]

Thanks @dhaern for this great contribution! 🎉 We've reviewed and merged this into the release/v3.7.5 branch. It will be part of the next release. We appreciate your effort!