fix: support current Codex web search endpoint

[EdamAme-x]

Closes #315.

Root cause

Codex resolves alpha/search relative to its configured base URL. Pentect replaces that base URL with its authenticated local gateway, so the gateway receives POST /alpha/search; the upstream destination becomes /backend-api/codex/alpha/search after Pentect rejoins the original ChatGPT base. Pentect recognized only fully rooted variants, so fail-closed handling returned HTTP 422 before the request reached OpenAI.

A second bug classified the token-prefixed local URL directly for persistent diagnostics, causing even known endpoints to be logged as endpoint: unknown.

What changed

• classify the actual gateway input /alpha/search as the protected standalone-search dialect
• retain /v1/alpha/search, /api/codex/alpha/search, and /backend-api/codex/alpha/search compatibility
• test the complete local-relative to ChatGPT-upstream path transformation
• verify a synthetic API key in search_query is masked before forwarding
• retain fail-closed behavior for disguised and unknown paths
• strip the local authentication prefix before diagnostic classification
• report unknown endpoint rejection with the fixed safe reason unsupported-endpoint, without bodies, headers, URLs, or credentials

Verification

• reproduced HTTP 422 with Pentect 0.0.70 and Codex 0.152.1
• after the fix, ran the locally built Pentect with logged-in Codex 0.152.1 and completed a real web search successfully
• cargo test -q -p pentect-cli --bin pentect --locked openai_http_proxy::tests (56 passed)
• cargo test -q -p pentect-cli --bin pentect --locked gateway_diagnostics::tests (2 passed)
• cargo fmt --all --check
• git diff --check

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 2720c526-7d72-499b-868d-6c3a294ad534

📥 Commits

Reviewing files that changed from the base of the PR and between c501033 and 6d928a4.

📒 Files selected for processing (1)

• crates/pentect-cli/src/openai_http_proxy.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The OpenAI HTTP proxy now recognizes /api/codex/alpha/search as a standalone search endpoint. Tests cover classification, rejection of disguised paths, and forwarding to the upstream endpoint.

Changes

Codex search endpoint

Layer / File(s)	Summary
Endpoint classification and forwarding crates/pentect-cli/src/openai_http_proxy.rs	The proxy classifies /api/codex/alpha/search as StandaloneSearch. Tests verify the valid path, reject /api/unknown/alpha/search, and expect forwarding to the new upstream path.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 6d928

The change adds support for the current Codex web-search path while preserving protected handling for existing and unknown paths; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The change recognizes and forwards /api/codex/alpha/search, masks the synthetic API key, and keeps unknown endpoint handling fail-closed [#315]. The provided summary does not show the required actiona…	Add or provide evidence for a sanitized regression fixture, safe actionable warning output, and GitHub Actions coverage for the Codex search regression. Confirm that unknown secret-bearing formats remain blocked.
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changes are limited to Codex search endpoint classification and regression tests. No unrelated changes are identified.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding support for the current Codex web search endpoint.

Full details: Linked Issues check

Explanation

The change recognizes and forwards /api/codex/alpha/search, masks the synthetic API key, and keeps unknown endpoint handling fail-closed [#315]. The provided summary does not show the required actionable safe warning update or GitHub Actions regression coverage.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/315-current-search-endpoint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}