fix: Add provenance-aware untrusted stdin mode

[jbeckwith-oai]

Summary

• Add opt-in OPENAI_UNTRUSTED_STDIN=1 handling for JSON/YAML request documents without changing trusted-input defaults.
• Preserve stdin-versus-CLI provenance across aliases, nested maps and arrays, inner flags, headers, query parameters, and multipart uploads.
• Treat stdin-origin @, @file://, and @data:// strings literally and reject stdin-origin FileInput paths before sending a request, while preserving explicitly supplied file flags.
• Document the mode and add end-to-end HTTP regressions, provenance unit tests, mixed-origin compatibility coverage, and Windows-safe test helpers.

Motivation

Pipelines that consume untrusted request documents need a way to prevent stdin-provided values from being reinterpreted as local file references. The new behavior is explicitly enabled for compatibility; existing trusted heredocs and explicit CLI uploads keep their current behavior.

Verification

GOFLAGS=-buildvcs=false go test ./internal/requestflag ./pkg/cmd -run 'Stdin|ApplyStdinDataToFlags' -count=1
GOFLAGS=-buildvcs=false go test -race ./internal/requestflag ./pkg/cmd -run 'Stdin|ApplyStdinDataToFlags' -count=1
GOFLAGS=-buildvcs=false go test ./... -run '^$'
GOFLAGS=-buildvcs=false ./scripts/lint
GOFLAGS=-buildvcs=false go vet ./...

The full integration suite, Windows amd64 test compilation, module verification, vulnerability-check harness, and GoReleaser installer test also passed during final private review. No Castiron-generated source, generator-owned template, workflow, or custom-code budget was changed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-24T23:29:38.694202Z	834d5c3	New commits
🔒 Security Review	✅ Completed 2026-08-24T23:30:07.058862Z	834d5c3	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

5 mixed files remain; 0 existing customizations changed.

Compared 1f3ba6cc8e8f → 834d5c3ddd97. Generated baselines verified.

5 existing customizations unchanged

• pkg/cmd/adminorganizationcertificate.go
• pkg/cmd/cmd.go
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 32789434458 --repo openai/openai-cli \
  --name castiron-custom-code-32789434458-1 --dir /tmp/castiron-custom-code-32789434458-1
git apply --stat /tmp/castiron-custom-code-32789434458-1/custom-code.patch
cat /tmp/castiron-custom-code-32789434458-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 1f3ba6cc8e8f9ac31744b35093e7a6be4acf2dd0 834d5c3ddd97e2cb7137c803470356be2d6d7fca
python3 scripts/castiron/custom_code_report.py report \
  --base 1f3ba6cc8e8f9ac31744b35093e7a6be4acf2dd0 \
  --head 834d5c3ddd97e2cb7137c803470356be2d6d7fca --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-834d5c3ddd97
cat /tmp/castiron-custom-code-834d5c3ddd97/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 93857fcab1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Adds an opt-in “untrusted stdin” mode to prevent stdin-provided JSON/YAML values from being reinterpreted as local file references, while preserving existing trusted-input behavior by default.

Changes:

• Introduces OPENAI_UNTRUSTED_STDIN and provenance tracking so stdin-origin values are treated as literal data at the file-expansion boundary.
• Rejects stdin-origin FileInput paths early (before any file can be opened) while keeping explicit CLI file flags working as before.
• Adds documentation plus unit and end-to-end regression tests covering mixed-origin behavior and Windows-friendly helpers.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents OPENAI_UNTRUSTED_STDIN and how behavior changes when enabled.
pkg/cmd/stdinsecurity.go	Implements stdin provenance marking and literalization at the embed boundary.
pkg/cmd/stdinsecurity_test.go	Adds unit + end-to-end coverage for untrusted stdin behavior and regression cases.
pkg/cmd/flagoptions.go	Wires provenance-aware stdin application into request assembly and file embedding.
internal/requestflag/stdinprovenance.go	Adds provenance callback support when applying stdin data to flags.
internal/requestflag/stdinprovenance_test.go	Tests provenance reporting behavior for stdin-set flags.
internal/requestflag/requestflag.go	Refactors stdin-to-flags logic to support provenance and explicit-inner preservation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8bec3e463d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

pkg/cmd/flagoptions.go:436

• The FileInput comment block is now an incomplete sentence ("the value is always"), which makes the documentation confusing at this call site. Consider rewriting it as a single coherent explanation of trusted vs untrusted-stdin behavior.

	// For flags marked as FileInput (type: string, format: binary), the value is always
	// A FileInput value is a file path, so wrap trusted values with FilePathValue
	// for automatic expansion. In untrusted-stdin mode, reject piped file paths.
	if err := wrapFileInputValues(cmd, &requestContents); err != nil {

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a6a485c91

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[apcha-oai]

[sdk codex review] Approved after two independent full reviews of all seven changed files at 834d5c3ddd97e2cb7137c803470356be2d6d7fca, including supporting request/multipart paths and all existing feedback. The four previously reported upload-provenance and explicit-value-precedence issues are substantively fixed; no remaining actionable blocker or duplicate inline finding was identified.

Reviewed correctness, security implications, compatibility, tests and maintainability, including opt-in behavior, aliases, mixed-origin nested fields, explicit uploads, and empty/null/numeric stdin values. Existing hosted test and lint logs verify merge 131aff0fcfb3e8e6e94f6d67bd2075d7e2e9f4db of this exact head into current base 1f3ba6cc8e8f9ac31744b35093e7a6be4acf2dd0, using Go 1.25.14 on Linux; the full repository suite passed. Windows coverage here is compilation, not native test execution. Current check runs and budget statuses are successful apart from the expected queue-signal skip. No local code, tests or scans were executed for this review.

Final checks confirmed the unchanged head/base, Justin’s authorship, and open, non-draft, mergeable status. This is an automated code review under the explicit robot-review permission in Slack, not an assertion that any separate human/CODEOWNER approval requirement has been satisfied.