Skip to content

fix: restore native browser ESM imports - #2495

Open
jbeckwith-oai wants to merge 1 commit into
mainfrom
codex/fix-browser-direct-import-2494
Open

fix: restore native browser ESM imports#2495
jbeckwith-oai wants to merge 1 commit into
mainfrom
codex/fix-browser-direct-import-2494

Conversation

@jbeckwith-oai

Copy link
Copy Markdown
Contributor
  • I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

Fixes #2494.

  • Rewrite emitted ESM references to the private X.509 state package import into browser-resolvable relative imports.
  • Keep one private state registry across Node CommonJS and ESM consumers while allowing native browsers to load the SDK directly.
  • Preserve browser credential protections, blocked internal package exports, and compatibility with browser process, module, and exports shims.

This is intentionally the production-only release fix. Expanded browser and bundler regression coverage will follow separately.

Additional context & links

Verified locally:

  • Real headless Chrome directly imports the built SDK without an import map and rejects browser API-key usage by default, including with browser process, module, and exports shims.
  • Browser-targeted ES2020 bundling succeeds.
  • Node 22.0.0 preserves both mixed CommonJS/ESM X.509 authentication combinations.
  • Existing packed-package checks pass, including CommonJS, ESM, browser conditions, and optional dependencies.
  • pnpm build, pnpm lint, pnpm exec tsc, and 196 focused authentication/browser-security tests pass.
  • The complete existing test suite previously passed: 7,548 tests, with 2 skipped.

@jbeckwith-oai
jbeckwith-oai requested a review from a team as a code owner August 27, 2026 05:34
@openai-sdks

openai-sdks Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

OkTest Summary

237/237 SDK tests passed in 10.515s for Node SDK PR #2495.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 121ms
tests/chat-completions-create.test.ts ✅ Passed 196ms
tests/chat-completions-stream.test.ts ✅ Passed 282ms
tests/files-content-binary.test.ts ✅ Passed 132ms
tests/files-create-multipart.test.ts ✅ Passed 169ms
tests/files-list-pagination.test.ts ✅ Passed 206ms
tests/initialize-config.test.ts ✅ Passed 199ms
tests/instance-isolation.test.ts ✅ Passed 90ms
tests/models-list.test.ts ✅ Passed 133ms
tests/responses-background-lifecycle.test.ts ✅ Passed 223ms
tests/responses-body-method-errors.test.ts ✅ Passed 352ms
tests/responses-cancel-timeout.test.ts ✅ Passed 195ms
tests/responses-cancel.test.ts ✅ Passed 181ms
tests/responses-compact-retries.test.ts ✅ Passed 236ms
tests/responses-compact.test.ts ✅ Passed 251ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 103ms
tests/responses-create-advanced.test.ts ✅ Passed 149ms
tests/responses-create-disconnect.test.ts ✅ Passed 1.172s
tests/responses-create-errors.test.ts ✅ Passed 212ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 245ms
tests/responses-create-retries.test.ts ✅ Passed 297ms
tests/responses-create-stream-failures.test.ts ✅ Passed 268ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 2.217s
tests/responses-create-stream-wire.test.ts ✅ Passed 2.559s
tests/responses-create-stream.test.ts ✅ Passed 90ms
tests/responses-create-terminal-states.test.ts ✅ Passed 217ms
tests/responses-create-timeout.test.ts ✅ Passed 224ms
tests/responses-create.test.ts ✅ Passed 134ms
tests/responses-delete.test.ts ✅ Passed 202ms
tests/responses-input-items-errors.test.ts ✅ Passed 266ms
tests/responses-input-items-list.test.ts ✅ Passed 224ms
tests/responses-input-items-options.test.ts ✅ Passed 103ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 253ms
tests/responses-input-tokens-count.test.ts ✅ Passed 198ms
tests/responses-malformed-inputs.test.ts ✅ Passed 2.241s
tests/responses-not-found-errors.test.ts ✅ Passed 210ms
tests/responses-parse.test.ts ✅ Passed 139ms
tests/responses-retrieve-retries.test.ts ✅ Passed 266ms
tests/responses-retrieve.test.ts ✅ Passed 203ms
tests/responses-stored-method-errors.test.ts ✅ Passed 500ms
tests/retry-behavior.test.ts ✅ Passed 3.203s
tests/sdk-error-shape.test.ts ✅ Passed 275ms

View OkTest run #33042951114

SDK merge (a40fec5c6fdf) · head (a3f004f24006) · base (76b73a9c73aa) · OkTest (2b1bdfd25e98)

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 27, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-27T05:37:32.521532Z a3f004f PR opened
🔒 Security Review Completed 2026-08-27T05:37:58.996326Z a3f004f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

Copy link
Copy Markdown
Contributor

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared 76b73a9c73aaa3f004f24006. Generated baselines verified.

32 existing customizations unchanged
  • api.md
  • scripts/castiron/README.md
  • scripts/castiron/custom_code_report.py
  • scripts/castiron/test_custom_code_report.py
  • src/client.ts
  • src/resources/audio/transcriptions.ts
  • src/resources/audio/translations.ts
  • src/resources/beta/assistants.ts
  • src/resources/beta/beta.ts
  • src/resources/beta/index.ts
  • src/resources/beta/responses/internal-base.ts
  • src/resources/beta/responses/responses.ts
  • src/resources/beta/threads/index.ts
  • src/resources/beta/threads/runs/index.ts
  • src/resources/beta/threads/runs/runs.ts
  • src/resources/beta/threads/threads.ts
  • src/resources/chat/completions/completions.ts
  • src/resources/chat/completions/index.ts
  • src/resources/conversations/index.ts
  • src/resources/embeddings.ts
  • src/resources/files.ts
  • src/resources/fine-tuning/checkpoints/permissions.ts
  • src/resources/images.ts
  • src/resources/responses/internal-base.ts
  • src/resources/responses/responses.ts
  • src/resources/skills/skills.ts
  • src/resources/skills/versions/versions.ts
  • src/resources/vector-stores/file-batches.ts
  • src/resources/vector-stores/files.ts
  • src/resources/webhooks/index.ts
  • src/resources/webhooks/webhooks.ts
  • tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33042968288 --repo openai/openai-node \
  --name castiron-custom-code-33042968288-1 --dir /tmp/castiron-custom-code-33042968288-1
git apply --stat /tmp/castiron-custom-code-33042968288-1/custom-code.patch
cat /tmp/castiron-custom-code-33042968288-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 76b73a9c73aafe11c60a425a82898705f1db966d a3f004f24006473347c532b7cebd495277853dc1
python3 scripts/castiron/custom_code_report.py report \
  --base 76b73a9c73aafe11c60a425a82898705f1db966d \
  --head a3f004f24006473347c532b7cebd495277853dc1 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-a3f004f24006
cat /tmp/castiron-custom-code-a3f004f24006/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3f004f240

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

const statePath = path.join(distDir, 'internal/auth/x509-transport-state.mjs');
const relativeStatePath = path.relative(path.dirname(file), statePath).split(path.sep).join('/');
const stateSpecifier = relativeStatePath.startsWith('.') ? relativeStatePath : `./${relativeStatePath}`;
const transformed = code.replaceAll(/from (['"])#x509-transport-state\1/g, `from '${stateSpecifier}'`);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add a native-browser regression for the rewritten imports

This packaging fix rewrites the private package import and introduces runtime selection between browser and CommonJS state, but the commit adds no focused regression exercising the built public SDK in a native browser. A future compiler or postprocessor change could therefore reintroduce the unresolved #x509-transport-state specifier—or break the shim-dependent fallback—without any test failing; add a public-entrypoint browser test that fails against the parent revision and passes with this rewrite.

AGENTS.md reference: AGENTS.md:L18-L21

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Browser direct import fails on unresolved #x509-transport-state specifier

1 participant