The Wire · Showcase
CODEX HARDENS LOGIN FLOW WITH ONBOARDING HINTS AND METADATA PROTECTION
By RepoJournal · Filed · About OpenAI
Three critical fixes shipped across auth, data persistence, and usage tracking to prevent thread metadata loss and secure OAuth callback handling.
Codex now accepts allowlisted onboarding entry points in OAuth state parameters while rejecting malformed suffixes, exposing onboarding hints through the v2 login completion notification [1]. This tightens the login flow without breaking existing callback handling. In parallel, a SQLite metadata preservation fix prevents goal mutations from reconciling rollouts unnecessarily and overwriting thread previews and session data [2]. The change skips reconciliation when the indexed rollout matches what's already stored, letting goal mutations repair corrupted thread metadata only when needed. Finally, the platform began capturing rollout budget units from Responses API usage, routing the provider-only value through TokenUsage while keeping it out of client-facing schemas and TypeScript representations [3]. All three changes land as 3 commits across 3 PRs with no breaking shifts to public contracts.
One email a day. Unsubscribe in one click.
Keep up with OpenAI in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Verify onboarding entrypoint handling in your OAuth integrations for life_sciences suffix support openai/codex [plan]
- → Test thread goal mutations in staging to confirm metadata preservation on next deploy openai/codex [plan]
- → Monitor rollout budget unit capture in token usage telemetry openai/codex [monitor]
References
- [1] Expose onboarding hints in login completion notifications ↗ openai/codex
- [2] Preserve SQLite thread metadata during goal mutations ↗ openai/codex
- [3] Capture rollout budget units from response usage ↗ openai/codex