[WRONG BRANCH] fix(responses): strip admission bearer from forwarded headers for routed providers

src/codex/auth-context.ts

@@ -576,11 +576,13 @@ export class CodexMainSubstitutionUnavailableError extends Error {
  *   Silently forwarding would be the leak validateForwardAdmissionCredential exists to prevent.
  * - `main` with a dedicated-header caller keeps the existing intentional passthrough: the bearer
  *   there is the user's own ChatGPT credential, not ours.
+ * - `main` on a non-Codex route strips a bearer used for OpenCodex admission, because routed
+ *   adapters may otherwise interpret that forwarded header as their own upstream credential.
  */
 export function materializeCodexUpstreamAuth(
   headers: Headers,
   ctx: CodexAuthContext,
-  options: { substituteMainCredential?: boolean } = {},
+  options: { substituteMainCredential?: boolean; stripAuthorization?: boolean } = {},
 ): Headers {
   const selected = new Headers();
   for (const name of FORWARD_HEADERS) {
@@ -602,6 +604,7 @@ export function materializeCodexUpstreamAuth(
     if (stored.chatgptAccountId) selected.set("chatgpt-account-id", stored.chatgptAccountId);
     return selected;
   }
+  if (options.stripAuthorization === true) selected.delete("authorization");
   return selected;
 }
 

src/server/responses/core.ts

@@ -1201,10 +1201,18 @@ async function resolveResponsesCodexAuth(
         response: formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication"),
       };
     }
+    // A bearer admission proves access with one of OpenCodex's own secrets. Routes that do not
+    // consume a stored Codex credential still need the caller's admission Authorization removed:
+    // some adapters intentionally use forwarded Authorization as their provider credential.
+    // Dedicated-header admission remains unchanged because its Authorization belongs upstream.
+    const stripAuthorization = options.admission?.source === "bearer" && !substituteMainCredential;
     return {
       ok: true,
       authCtx,
-      headers: materializeCodexUpstreamAuth(req.headers, authCtx, { substituteMainCredential }),
+      headers: materializeCodexUpstreamAuth(req.headers, authCtx, {
+        substituteMainCredential,
+        stripAuthorization,
+      }),
     };
   } catch (err) {
     if (err instanceof CodexAccountCooldownError) {

tests/codex-auth-context.test.ts

@@ -787,6 +787,21 @@ describe("Codex auth context", () => {
     );
     expect(headers.get("authorization")).toBe("Bearer user_chatgpt_token");
   });
+
+  test("a routed-provider admission bearer is removed while other headers remain", () => {
+    const headers = materializeCodexUpstreamAuth(
+      new Headers({
+        authorization: "Bearer ocx_data_localsecret",
+        "openai-beta": "responses=experimental",
+      }),
+      { kind: "main", accountId: null },
+      { stripAuthorization: true },
+    );
+
+    expect(headers.has("authorization")).toBe(false);
+    expect(headers.get("openai-beta")).toBe("responses=experimental");
+  });
+
   test("selected pool headers replace inbound main auth", () => {
     const headers = headersForCodexAuthContext(
       new Headers({ authorization: "Bearer main_token", "chatgpt-account-id": "main_acc", "openai-beta": "responses=experimental" }),