Skip to content

fix(codex): floor upstream client version to unblock gated models (gpt-5.6-sol) - #884

Open
xky-at-pku wants to merge 1 commit into
kittors:mainfrom
xky-at-pku:fix/codex-client-version-floor
Open

fix(codex): floor upstream client version to unblock gated models (gpt-5.6-sol)#884
xky-at-pku wants to merge 1 commit into
kittors:mainfrom
xky-at-pku:fix/codex-client-version-floor

Conversation

@xky-at-pku

Copy link
Copy Markdown

问题

ChatGPT 的 Codex 后端对较新模型(如 gpt-5.6-sol)做了客户端版本门槛。当 relay 以旧版本 Codex 客户端身份请求时,上游返回 400:

{"detail":"The 'gpt-5.6-sol' model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again."}

根因(两层)

  1. 内置身份默认值过旧codex-tui/0.118.0codex_cli_rs/0.76.0,且默认不发送 Version 头。
  2. 更隐蔽的一层:身份指纹学习(identity-fingerprint learning)会把之前观察到的客户端版本(例如 codex_exec/0.130.0)记录为出站身份。一旦学进旧版本,它会在后续的 fingerprint 选择中覆盖默认值,即使升级了常量也依然复现该报错。

修复内容

  • 将内置 codex-tui / codex_cli_rs 身份升级到 0.147.0
  • 当入站客户端未提供 Version 头时,默认发送当前 Codex 版本(0.147.0),不再留空。
  • 在 codex 指纹解析层新增最低版本下限(0.147.0):任何学习到 / 配置的旧于下限的版本都会被提升,同时 UA 中的 product token 和括号内 (product; ver) 版本会被一致改写(保留 OS / 终端等其余数字)。不低于下限的版本原样透传

改动文件

  • internal/config/identity_fingerprint.go — 默认 UA / Version 升级
  • internal/runtime/executor/codex_auth.go — 默认 UA 升级 + Version 头默认值
  • internal/runtime/executor/codex_websockets_helpers.go — websocket 路径 Version 默认值
  • internal/management/aiaccountstatus/probe_codex.go — 探测 UA 升级
  • internal/identityfingerprint/resolve.go — 新增版本下限钳制 + UA 版本改写
  • internal/identityfingerprint/resolve_floor_test.go — 新增钳制单元测试
  • 相关存量测试同步更新

验证

在真实部署环境验证通过:

场景 结果
公网域名 + claude-cli UA + gpt-5.6-sol ✅ 成功
直连 + 旧 codex_exec/0.130.0 身份 + gpt-5.6-sol ✅ 成功(版本被钳制到 0.147.0)
gpt-5.5 回归 ✅ 正常

go test ./... 通过(仅容器缺 bash 导致的部署脚本测试失败,与本改动无关)。

🤖 Generated with Claude Code

ChatGPT's Codex backend rejects requests for newer models (e.g.
gpt-5.6-sol) when the client advertises an old Codex version, returning:

  The 'gpt-5.6-sol' model requires a newer version of Codex.

The relay was hitting this for two reasons:

1. The built-in identity defaults were stale (codex-tui/0.118.0,
   codex_cli_rs/0.76.0) and no Version header was sent by default.
2. The identity-fingerprint learning layer replays a previously
   observed client version (e.g. codex_exec/0.130.0) as the outbound
   identity. Once a stale version is learned, it overrides the defaults
   and keeps tripping the upstream version gate even after the defaults
   are bumped.

Changes:

- Bump the built-in codex-tui / codex_cli_rs identity to 0.147.0.
- Send a current Codex "Version" header (0.147.0) when the inbound
  client did not provide one, instead of leaving it empty.
- Add a minimum-version floor (0.147.0) in the codex identity-fingerprint
  resolution so any learned or configured version older than the floor is
  raised, and the User-Agent product/parenthesized version tokens are
  rewritten to stay consistent. OS/terminal numbers in the UA are
  preserved. Versions at or above the floor pass through untouched.

Verified against a live deployment: gpt-5.6-sol now succeeds through the
relay with both claude-cli and (stale) codex_exec client identities, and
gpt-5.5 still works.

Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant