chore(deps): pin Codex provider to published npm 0.1.1 (#1192)

Author: TheGreatAxios

bun.lock

@@ -87,7 +87,7 @@
   },
   "dependencies": {
     "@corbits/agent-intern": "workspace:*",
-    "@corbits/codex-provider": "github:corbitsdev/corbits-codex-provider",
+    "@corbits/codex-provider": "0.1.1",
     "@corbits/oauth-core": "0.2.0",
     "@corbits/openai-responses": "github:corbitsdev/corbits-openai-responses",
     "@corbits/xai-provider": "github:corbitsdev/corbits-xai-provider",

package.json

@@ -157,6 +157,17 @@ describe("accountIdFromIdToken", () => {
     expect(accountIdFromIdToken("not-a-jwt")).toBeUndefined();
     expect(accountIdFromIdToken(makeIdToken({ sub: "x" }))).toBeUndefined();
   });
+
+  test("omits account ids that would split a chatgpt-account-id header", () => {
+    expect(
+      accountIdFromIdToken(
+        makeIdToken({ chatgpt_account_id: "acct\r\ninjected" }),
+      ),
+    ).toBeUndefined();
+    expect(
+      accountIdFromIdToken(makeIdToken({ chatgpt_account_id: "acct\0nul" })),
+    ).toBeUndefined();
+  });
 });
 
 describe("Codex profile store", () => {