fix(auth): support OpenAI OAuth vision in Peekaboo - #293
Open
scotthuang wants to merge 3 commits into
Open
Conversation
scotthuang
marked this pull request as ready for review
July 23, 2026 09:26
clawsweeper
Bot
added
proof: sufficient
|
Codex review: found issues before merge. Reviewed July 31, 2026, 7:51 PM ET / 23:51 UTC. ClawSweeper reviewWhat this changesThis PR lets Peekaboo accept a refreshable OpenAI OAuth session for vision, keeps access-token expiry paired with its credential source, updates the Tachikoma submodule, and documents stored versus environment refresh behavior. Merge readinessThis PR remains necessary: current Priority: P2 Review scores
Verification
How this fits togetherPeekaboo’s configuration manager gates image-analysis and agent-vision requests before they reach Tachikoma, which resolves OpenAI API-key or OAuth credentials. Tachikoma refreshes an eligible OAuth session and sends the resulting text-and-image request to the OpenAI Responses service. flowchart LR
A[Image or agent vision request] --> B[Peekaboo configuration]
B --> C{OpenAI credentials available?}
C -->|no| D[Provider unavailable]
C -->|yes| E[Tachikoma credential resolver]
E --> F[Use API key or refresh OAuth]
F --> G[OpenAI Responses vision]
G --> H[Visual answer]
Before merge
Findings
Agent review detailsSecurityNeeds attention: No separate application-code security defect is evident, but the unfinalized dependency pin governs a sensitive OAuth credential-persistence boundary and must be finalized before merge. Review metrics
Merge-risk optionsMaintainer options:
Copy recommended automerge instructionTechnical reviewBest possible solution: Once the Tachikoma OAuth vision work is merged upstream, repin this PR to its final merge commit and validate the focused Peekaboo availability cases plus Tachikoma’s stored and environment credential-boundary behavior against that exact revision. Do we have a high-confidence way to reproduce the issue? Yes. Current main has a clear source-level path: an expired OpenAI OAuth access token makes Is this the best way to solve the issue? Yes, conditionally. Admitting a refreshable OAuth session and pairing access-token expiry by source is the narrow maintainable fix, but the provider dependency must be repinned to its final merged upstream revision before this implementation is safe to land. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 8448599ab899. LabelsLabel justifications:
EvidenceSecurity concerns:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (11 earlier review cycles; latest 8 shown)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem this solves
Peekaboo already converts captures into provider-neutral image messages, but its OpenAI availability gate only accepted a currently valid OAuth access token. Once that token expired, Peekaboo reported OpenAI as unavailable and stopped before Tachikoma had a chance to use the refresh token.
Previous call chain
New call chain
Implementation
see --analyze,image --analyze, and agent visionpeekaboo config loginpersists refresh rotationEvidence
Red-green availability proof
The deterministic setup stores:
Red step: the PR test was run with only the new refresh-token clause temporarily removed, reproducing the previous implementation.
Observed result:
Green step: restore the PR implementation:
Observed result:
Only that availability condition changed between the red and green runs. Both repositories were restored to clean state afterward.
Reproduction command:
Real OAuth vision proof from the pinned Tachikoma dependency
openclaw/Tachikoma#40 includes protocol-level red/green evidence using the same valid ChatGPT OAuth token:
The image is embedded in the live integration test; no host desktop was captured.
Environment credential-boundary proof
The pinned Tachikoma commit
d4cd49fadds direct tests proving that an environment-supplied OAuth refresh does not write to~/.peekaboo/credentials:The tests assert an empty credential store for environment-only sessions, unchanged stored values when a separate stored account exists, correct use of rotated refresh tokens, and cache invalidation when the source changes. Stored-login refreshes retain their separate atomic-persistence test.
Dependency
Important
Depends on openclaw/Tachikoma#40. This PR must merge only after that dependency lands; then the Tachikoma gitlink must be repinned to the final upstream merge commit before Peekaboo merges.
User impact
After the Tachikoma dependency lands, users authenticated through
peekaboo config login openaican use OpenAI OAuth for image analysis and agent vision without configuring a separate OpenAI API key. Existing explicit API-key configurations retain priority. Hosts that inject OAuth through environment variables keep those credentials ephemeral and must provide fresh values after a process restart.Validation
ConfigurationAccessorsOAuthTests— 14 tests passedAuthManagerTests— 19 tests passedOpenAIResponsesProviderTests— 30 tests passedpnpm run lint:docs— passedgit diff --check