fix(server): join GPT-Live sideband on the API host, not backend-api

openai/codex builds the sideband WebSocket from the ApiKey provider
default (api.openai.com/v1) even for ChatGPT-auth calls created via
backend-api; chatgpt.com/backend-api rejects sideband upgrades before
101. Route backend-shape sideband joins to wss://api.openai.com/v1
(live/{id}, realtime/calls/{id}, realtime?call_id=) with the same
relayed pool auth. Verified live: session.started received end-to-end.

Author: jun

src/server/live.ts

@@ -45,6 +45,14 @@ const LIVE_RELAY_HEADERS = ["content-type", "location"] as const;
 /** AVAS WebRTC call-create query (openai/codex `configure_realtime_call_request`). */
 export const LIVE_AVAS_QUERY = "intent=quicksilver&architecture=avas";
 
+/**
+ * Sideband WebSocket API root. openai/codex joins the sideband via the API provider default
+ * (`to_api_provider(AuthMode::ApiKey)` → https://api.openai.com/v1) even for ChatGPT-auth calls
+ * created through backend-api; chatgpt.com/backend-api rejects sideband upgrades pre-101
+ * (verified live 2026-07-24). The call-create bearer works on the API host unchanged.
+ */
+export const LIVE_SIDEBAND_API_ROOT = "https://api.openai.com/v1";
+
 /**
  * Client protocol headers relayed verbatim to the upstream on call-create and sideband upgrade.
  * `openai-alpha: quicksilver=v2` carries the Frameless protocol negotiation — without it the
@@ -142,26 +150,29 @@ export function buildLiveSidebandUpstreamWsUrl(
   target: LiveSidebandTarget,
 ): string {
   const root = providerBaseUrl.replace(/\/$/, "");
+  if (usesBackendShape) {
+    // ChatGPT backend-api call-create, but the sideband join lives on the public API host
+    // (matches openai/codex, which builds the sideband from the ApiKey provider default).
+    if (target.style === "frameless-path") {
+      return httpsToWss(`${LIVE_SIDEBAND_API_ROOT}/live/${target.callId}`);
+    }
+    if (target.style === "realtime-calls-path") {
+      return httpsToWss(`${LIVE_SIDEBAND_API_ROOT}/realtime/calls/${target.callId}`);
+    }
+    return httpsToWss(
+      `${LIVE_SIDEBAND_API_ROOT}/realtime?intent=quicksilver&call_id=${encodeURIComponent(target.callId)}`,
+    );
+  }
   if (target.style === "frameless-path") {
     // Frameless: normalize to .../live then append /{callId}.
-    // Backend bases like .../backend-api/codex keep their path and append /{callId}.
-    if (usesBackendShape) {
-      return httpsToWss(`${root}/${target.callId}`);
-    }
     const apiRoot = root.replace(/\/v1\/?$/, "");
     return httpsToWss(`${apiRoot}/v1/live/${target.callId}`);
   }
   if (target.style === "realtime-calls-path") {
-    if (usesBackendShape) {
-      return httpsToWss(`${root}/realtime/calls/${target.callId}`);
-    }
     const apiRoot = root.replace(/\/v1\/?$/, "");
     return httpsToWss(`${apiRoot}/v1/realtime/calls/${target.callId}`);
   }
   // Realtime v1/v2: /v1/realtime?intent=quicksilver&call_id=
-  if (usesBackendShape) {
-    return httpsToWss(`${root}/realtime?intent=quicksilver&call_id=${encodeURIComponent(target.callId)}`);
-  }
   const apiRoot = root.replace(/\/v1\/?$/, "");
   return httpsToWss(
     `${apiRoot}/v1/realtime?intent=quicksilver&call_id=${encodeURIComponent(target.callId)}`,

tests/server-live.test.ts

@@ -498,7 +498,7 @@ test("sideband GET /v1/live/{callId} upgrades and relays bidirectionally to Chat
     constructor(url: string | URL, protocols?: string | string[] | Record<string, unknown>) {
       const parsed = new URL(String(url));
       const target =
-        parsed.hostname === "chatgpt.com" && parsed.pathname.startsWith("/backend-api/codex/")
+        parsed.hostname === "api.openai.com" && parsed.pathname.startsWith("/v1/live/")
           ? `ws://127.0.0.1:${upstreamPort}${parsed.pathname}${parsed.search}`
           : String(url);
       super(target, protocols as string[]);
@@ -526,7 +526,7 @@ test("sideband GET /v1/live/{callId} upgrades and relays bidirectionally to Chat
       client.addEventListener("message", (event) => {
         try {
           expect(String(event.data)).toBe("echo:ping-sideband");
-          expect(seenPaths).toContain("/backend-api/codex/rtc_sideband");
+          expect(seenPaths).toContain("/v1/live/rtc_sideband");
           expect(seenUpgradeHeaders).toHaveLength(1);
           expect(seenUpgradeHeaders[0].get("openai-alpha")).toBe("quicksilver=v2");
           expect(seenUpgradeHeaders[0].get("x-session-id")).toBe("rts_side");
@@ -576,7 +576,19 @@ test("buildLiveSidebandUpstreamWsUrl maps Frameless and Realtime join shapes", a
       style: "frameless-path",
       callId: "rtc_1",
     }),
-  ).toBe("wss://chatgpt.com/backend-api/codex/rtc_1");
+  ).toBe("wss://api.openai.com/v1/live/rtc_1");
+  expect(
+    buildLiveSidebandUpstreamWsUrl("https://chatgpt.com/backend-api/codex", true, {
+      style: "realtime-calls-path",
+      callId: "rtc_1",
+    }),
+  ).toBe("wss://api.openai.com/v1/realtime/calls/rtc_1");
+  expect(
+    buildLiveSidebandUpstreamWsUrl("https://chatgpt.com/backend-api/codex", true, {
+      style: "realtime-query",
+      callId: "rtc_2",
+    }),
+  ).toBe("wss://api.openai.com/v1/realtime?intent=quicksilver&call_id=rtc_2");
   expect(
     buildLiveSidebandUpstreamWsUrl("https://api.openai.com/v1", false, {
       style: "frameless-path",