{"record":{"id":"80e503b6dd6d94c5","repo":"openai/codex","slug":"agent-identity-only-supports-production-and-stagin","errorCode":null,"errorMessage":"Agent Identity only supports production and staging ChatGPT environments","messagePattern":"Agent Identity only supports production and staging ChatGPT environments","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/agent-identity/src/lib.rs","lineNumber":70,"sourceCode":"    Staging,\n}\n\nimpl ChatGptEnvironment {\n    pub fn from_chatgpt_base_url(chatgpt_base_url: &str) -> Result<Self> {\n        match chatgpt_base_url.trim_end_matches('/') {\n            \"https://chatgpt.com\"\n            | \"https://chatgpt.com/backend-api\"\n            | \"https://chatgpt.com/codex\"\n            | \"https://chatgpt.com/backend-api/codex\"\n            | \"https://chat.openai.com\"\n            | \"https://chat.openai.com/backend-api\"\n            | \"https://chat.openai.com/codex\"\n            | \"https://chat.openai.com/backend-api/codex\" => Ok(Self::Production),\n            \"https://chatgpt-staging.com\"\n            | \"https://chatgpt-staging.com/backend-api\"\n            | \"https://chatgpt-staging.com/codex\"\n            | \"https://chatgpt-staging.com/backend-api/codex\" => Ok(Self::Staging),\n            _ => anyhow::bail!(\n                \"Agent Identity only supports production and staging ChatGPT environments\"\n            ),\n        }\n    }\n\n    pub fn chatgpt_base_url(self) -> &'static str {\n        match self {\n            Self::Production => \"https://chatgpt.com/backend-api\",\n            Self::Staging => \"https://chatgpt-staging.com/backend-api\",\n        }\n    }\n\n    pub fn agent_identity_authapi_base_url(self) -> &'static str {\n        match self {\n            Self::Production => PROD_AGENT_IDENTITY_AUTHAPI_BASE_URL,\n            Self::Staging => STAGING_AGENT_IDENTITY_AUTHAPI_BASE_URL,\n        }\n    }","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/agent-identity/src/lib.rs#L52-L88","documentation":"parse_header_name feeds the configured string to rama_http's HeaderName::from_bytes, which accepts only RFC 7230 token characters: ASCII letters and digits plus !#$%&'*+-.^_`|~. Spaces, colons, other delimiters, control bytes, non-ASCII characters, or an empty string all fail. The helper is shared by match.headers keys, strip_request_headers entries, and inject_request_headers names, and runs during both validation and hook compilation.","triggerScenarios":"strip_request_headers = [\"Authorization:\"] (trailing colon copied from a header line), a match.headers key like \"X-Custom Header\" (space), name = \"\" (empty), or a non-ASCII name such as a localized header. Any of these aborts validate_mitm_hook_config or the later compile step.","commonSituations":"Pasting 'Authorization: Bearer x' and keeping the colon; smart quotes or invisible unicode introduced by docs/chat paste; whitespace or CRLF artifacts in generated configs.","solutions":["Keep the bare token form of the name: authorization, x-custom-header","Strip a trailing colon or surrounding whitespace from names copied out of header lines","Verify names programmatically with the same rule: http::HeaderName::from_bytes(name.as_bytes()).is_ok()"],"exampleFix":"// config.toml — before\nstrip_request_headers = [\"Authorization:\"]\n\n// after\nstrip_request_headers = [\"authorization\"]","handlingStrategy":"type-guard","validationCode":"let bad: Vec<_> = hook.actions.strip_request_headers.iter()\n    .chain(hook.matcher.headers.keys().map(String::as_str))\n    .filter(|n| !is_valid_header_name(n))\n    .collect();\nif !bad.is_empty() {\n    return Err(anyhow!(\"invalid header names: {bad:?}\"));\n}","typeGuard":"fn is_valid_header_name(name: &str) -> bool {\n    http::HeaderName::from_bytes(name.as_bytes()).is_ok()\n}","tryCatchPattern":"let name = HeaderName::from_bytes(raw.as_bytes())\n    .map_err(|err| anyhow!(\"invalid header name {raw:?}: {err}\"))?;","preventionTips":["Copy header names without the trailing colon from header lines","Trim names before writing them to config","Unit-test config fixtures against the same RFC 7230 token rule"],"tags":["rust","network-proxy","http-headers","mitm-hooks","config-validation"],"backgroundTag":"invalid-http-header-name","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}