add native responses api passthrough

Add an optional, default-disabled POST /v1/responses endpoint so native
OpenAI clients can use stored Codex authentication without Anthropic protocol
translation.

Preserve native JSON and SSE behavior, replace incoming credentials, refresh
rejected access tokens, validate Codex models, filter response headers, and
record bounded monitor and traffic data. Images API and stored response routes
remain outside the supported surface.

Author: raine

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## Unreleased
+
+- Native OpenAI Responses clients can use `POST /v1/responses` with existing
+  Codex authentication, including JSON responses, SSE streaming, and automatic
+  token refresh. Enable the endpoint with `codex.responsesApi` or
+  `CCP_CODEX_RESPONSES_API=1`; it is disabled by default.
+
 ## v0.1.23 (2026-07-22)
 
 - Codex WebSocket streaming handles pooled connections and HTTP fallback more

README.md

@@ -664,6 +664,9 @@ The proxy speaks enough of the Anthropic API for Claude Code:
 - `POST /v1/messages?beta=true`: same (Claude Code always sends `?beta=true`)
 - `POST /v1/messages/count_tokens`: local token count via `gpt-tokenizer`
   (o200k_base); used by Claude Code's compaction logic
+- `POST /v1/responses`: optional native OpenAI Responses passthrough using stored
+  Codex authentication; enable with `codex.responsesApi` or
+  `CCP_CODEX_RESPONSES_API=1`
 - `GET /healthz`: liveness check
 
 ## Configuration
@@ -692,7 +695,8 @@ Windows, and at
     "serviceTier": "fast",
     "baseUrl": "https://chatgpt.com/backend-api/codex/responses",
     "transport": "websocket",
-    "previousResponseId": false
+    "previousResponseId": false,
+    "responsesApi": false
   },
   "kimi": {
     "userAgent": "KimiCLI/1.37.0",
@@ -734,6 +738,7 @@ Windows, and at
 | `CCP_CODEX_BASE_URL`             | `codex.baseUrl`            | `https://chatgpt.com/backend-api/codex/responses` | Override the Codex Responses endpoint                                                                                                                                             |
 | `CCP_CODEX_TRANSPORT`            | `codex.transport`          | `websocket`                                       | Codex transport: `websocket`, `http`, or `auto`                                                                                                                                   |
 | `CCP_CODEX_PREVIOUS_RESPONSE_ID` | `codex.previousResponseId` | `false`                                           | Enable WebSocket continuation with `previous_response_id` when the request is append-only                                                                                         |
+| `CCP_CODEX_RESPONSES_API`        | `codex.responsesApi`       | `false`                                           | Enable `POST /v1/responses` with native OpenAI Responses request, JSON response, and SSE behavior using stored Codex authentication                                               |
 | `CCP_CODEX_ORIGINATOR`           | `codex.originator`         | `claude-code-proxy`                               | Override the `originator` header sent to Codex                                                                                                                                    |
 | `CCP_CODEX_USER_AGENT`           | `codex.userAgent`          | `claude-code-proxy/<version>`                     | Override the `User-Agent` header sent to Codex                                                                                                                                    |
 | `CCP_KIMI_USER_AGENT`            | `kimi.userAgent`           | `KimiCLI/1.37.0`                                  | Override the `User-Agent` header sent to Kimi                                                                                                                                     |
@@ -750,6 +755,14 @@ A malformed `config.json` is reported on stderr and ignored; defaults are used
 in its place. Invalid types for individual keys are warned and skipped without
 affecting other keys.
 
+`CCP_CODEX_RESPONSES_API=1` enables `POST /v1/responses` for clients that use
+OpenAI's native Responses protocol. The route replaces incoming credentials with
+the proxy's stored Codex authentication, refreshes rejected access tokens before
+forwarding a response, and preserves native JSON or SSE response bodies. The
+route accepts Codex models listed by `claude-code-proxy models`; Images API,
+stored response retrieval and deletion, and WebSocket ingress are outside its
+scope.
+
 Codex uses the WebSocket Responses transport by default. Set
 `CCP_CODEX_TRANSPORT=http` to use the older HTTP SSE transport for debugging or
 compatibility, or `CCP_CODEX_TRANSPORT=auto` to try WebSocket with HTTP fallback

src/config.rs

@@ -54,6 +54,8 @@ struct CodexConfig {
     pub user_agent: Option<String>,
     #[serde(rename = "previousResponseId")]
     pub previous_response_id: Option<bool>,
+    #[serde(rename = "responsesApi")]
+    pub responses_api: Option<bool>,
     #[serde(rename = "serviceTier")]
     pub service_tier: Option<String>,
     #[serde(rename = "reasoningSummary")]
@@ -217,6 +219,9 @@ pub fn config_override_summary_lines(cfg: &LoadedConfig) -> Vec<String> {
     if env.contains_key("CCP_LOG_STDERR") {
         out.push("log.stderr (env)".to_string());
     }
+    if env.contains_key("CCP_CODEX_RESPONSES_API") {
+        out.push("codex.responsesApi (env)".to_string());
+    }
     if env.contains_key("CCP_KIMI_OAUTH_HOST") {
         out.push("kimi.oauthHost (env)".to_string());
     }
@@ -262,11 +267,15 @@ pub fn config_override_summary_lines(cfg: &LoadedConfig) -> Vec<String> {
                 out.push(format!("log.stderr: {v}"));
             }
         }
-        if let Some(codex) = file_cfg.codex
-            && let Some(summary) = codex.reasoning_summary
-            && !summary.is_empty()
-        {
-            out.push("codex.reasoningSummary (config)".to_string());
+        if let Some(codex) = file_cfg.codex {
+            if codex.responses_api == Some(true) {
+                out.push("codex.responsesApi: true".to_string());
+            }
+            if let Some(summary) = codex.reasoning_summary
+                && !summary.is_empty()
+            {
+                out.push("codex.reasoningSummary (config)".to_string());
+            }
         }
     }
     out
@@ -420,6 +429,21 @@ pub fn codex_previous_response_id() -> bool {
     false
 }
 
+pub fn codex_responses_api() -> bool {
+    let env: HashMap<_, _> = std::env::vars().collect();
+    if let Some(raw) = env.get("CCP_CODEX_RESPONSES_API") {
+        return matches!(raw.to_ascii_lowercase().as_str(), "1" | "true" | "yes");
+    }
+    let config_dir = paths::config_dir();
+    if let Some(file) = read_file_config(&config_dir)
+        && let Some(codex) = file.codex
+        && let Some(enabled) = codex.responses_api
+    {
+        return enabled;
+    }
+    false
+}
+
 pub fn codex_service_tier() -> Option<String> {
     let env: HashMap<_, _> = std::env::vars().collect();
     if let Some(raw) = env.get("CCP_CODEX_SERVICE_TIER") {
@@ -592,6 +616,7 @@ mod tests {
             std::env::remove_var("CCP_LOG_VERBOSE");
             std::env::remove_var("CCP_LOG_STDERR");
             std::env::remove_var("CCP_CODEX_REASONING_SUMMARY");
+            std::env::remove_var("CCP_CODEX_RESPONSES_API");
         }
     }
 
@@ -747,6 +772,46 @@ mod tests {
         assert!(loaded.log_stderr);
     }
 
+    #[test]
+    fn codex_responses_api_defaults_to_disabled() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        clear_env();
+        let config = tempfile::TempDir::new().unwrap();
+        let _config_env = EnvGuard::set("CCP_CONFIG_DIR", config.path());
+
+        assert!(!codex_responses_api());
+    }
+
+    #[test]
+    fn codex_responses_api_reads_config_and_env_takes_precedence() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        clear_env();
+        let config = tempfile::TempDir::new().unwrap();
+        std::fs::write(
+            config.path().join("config.json"),
+            r#"{"codex":{"responsesApi":true}}"#,
+        )
+        .unwrap();
+        let _config_env = EnvGuard::set("CCP_CONFIG_DIR", config.path());
+
+        assert!(codex_responses_api());
+        let _responses_env = EnvGuard::set("CCP_CODEX_RESPONSES_API", "false");
+        assert!(!codex_responses_api());
+    }
+
+    #[test]
+    fn codex_responses_api_accepts_enabled_env_values() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        clear_env();
+        let config = tempfile::TempDir::new().unwrap();
+        let _config_env = EnvGuard::set("CCP_CONFIG_DIR", config.path());
+
+        for value in ["1", "true", "TRUE", "yes"] {
+            let _responses_env = EnvGuard::set("CCP_CODEX_RESPONSES_API", value);
+            assert!(codex_responses_api(), "{value}");
+        }
+    }
+
     #[test]
     fn codex_reasoning_summary_reads_config() {
         let _guard = ENV_LOCK.lock().unwrap();

src/monitor.rs

@@ -16,13 +16,15 @@ pub const SESSION_TOKEN_BUCKET_SECS: u64 = 10;
 pub enum EndpointKind {
     Messages,
     CountTokens,
+    Responses,
 }
 
 impl EndpointKind {
     pub fn label(self) -> &'static str {
         match self {
             Self::Messages => "messages",
             Self::CountTokens => "count_tokens",
+            Self::Responses => "responses",
         }
     }
 }

src/providers/codex/auth/manager.rs

@@ -1,4 +1,5 @@
 use std::sync::Arc;
+use std::sync::LazyLock;
 #[cfg(test)]
 use std::sync::Mutex;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
@@ -9,6 +10,9 @@ use super::jwt::{TokenResponse, extract_account_id, validate_token_response};
 use super::token_store::{CodexTokenStore, StoredAuth};
 use crate::auth::AuthStorage;
 
+static CODEX_REFRESH_LOCK: LazyLock<Arc<AsyncMutex<()>>> =
+    LazyLock::new(|| Arc::new(AsyncMutex::new(())));
+
 pub struct CodexAuthManager<S: AuthStorage<StoredAuth>> {
     pub store: CodexTokenStore<S>,
     #[cfg(test)]
@@ -28,7 +32,7 @@ impl<S: AuthStorage<StoredAuth>> CodexAuthManager<S> {
             store,
             #[cfg(test)]
             test_auth: Arc::new(Mutex::new(None)),
-            refresh_lock: Arc::new(AsyncMutex::new(())),
+            refresh_lock: CODEX_REFRESH_LOCK.clone(),
             refresh_client: reqwest::Client::builder()
                 .connect_timeout(Duration::from_secs(15))
                 .timeout(Duration::from_secs(30))