fix(openai): support http:// baseURL by mapping to ws:// (not wss://) on WebSocket URLs#1540
Merged
toubatbrian merged 2 commits intoMay 18, 2026
Conversation
…cket URLs The Responses-API LLM (`ws/llm.ts`), realtime STT (`stt.ts`), and conversational Realtime endpoint (`realtime/realtime_model.ts`) all build their upgrade URL from `baseURL`, but force-mapped (or only half-mapped) the scheme to `wss://`. With a plain-HTTP baseURL (e.g. an in-cluster LiteLLM proxy at `http://litellm:4000`), this produced a `wss://litellm:4000/...` URL, attempted a TLS handshake against a non-TLS listener, and failed with `tls_get_more_records:packet length too long`. The fix maps `http://` -> `ws://` and `https://` -> `wss://`. OpenAI's native endpoint is always HTTPS, so this is a no-op for direct connections. - `ws/llm.ts`: regex `/^https?/, 'wss'` -> `/^http(s?):/, 'ws$1:'` - `stt.ts`: add `else if (url.protocol === 'http:') url.protocol = 'ws:'` - `realtime/realtime_model.ts`: same as stt.ts; export `processBaseURL` for unit testing - add unit tests covering `http://` baseURLs for all three builders
🦋 Changeset detectedLatest commit: 369e90e The changes in this PR will be included in the next version bump. This PR includes changesets to release 31 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
The fix simply respects the scheme of baseURL; the LiteLLM in-cluster example was a specific motivating case, not the contract. Generalize the doc comments and test fixtures accordingly.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
Author
|
r? @toubatbrian sorry for the ping but in case this can go out with the prior - realized our team had to put a separate patch in place to support our internal litellm instance (http vs. https -> ws vs. wss) |
toubatbrian
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The OpenAI plugin's three WebSocket URL builders (Responses-API LLM, realtime STT, conversational Realtime) all derive their upgrade URL from
baseURLbut assumed the scheme was always HTTPS — either by force-mappinghttp://andhttps://towss://via regex, or by only handlinghttps:→wss:and leavinghttp:unchanged. With a plain-HTTPbaseURL, this produced either an invalid WebSocket URL or a spurious TLS handshake against a non-TLS listener.The scheme of
baseURLis now respected:http://maps tows://andhttps://maps towss://. OpenAI's native endpoint is HTTPS, so this is a no-op for direct connections; the change unbreaks OpenAI-compatible proxy / gateway setups (which might be in-cluster, no TLS), which are an explicit design goal ofbaseURLparameter support.Files
plugins/openai/src/ws/llm.ts—buildResponsesWsUrl: regex/^https?/, 'wss'→/^http(s?):/, 'ws$1:'plugins/openai/src/stt.ts—buildRealtimeSttUrl: addelse if (url.protocol === 'http:') url.protocol = 'ws:'plugins/openai/src/realtime/realtime_model.ts—processBaseURL: samehttp:→ws:branch; exported for unit testingPrior art
#1467 added gateway routing via
?model=to these same builders. This PR addresses a separate assumption (baseURLis always HTTPS) inherited from before #1467 — same proxy use case, complementary fix.Test plan
pnpm installpnpm build:agents && pnpm --filter "@livekit/agents-plugin-openai..." build— succeedspnpm test -- --run plugins/openai— 35 passed, 7 skipped (requireOPENAI_API_KEY)pnpm --filter @livekit/agents-plugin-openai lint— only pre-existing warnings; no new findingspnpm format:check— cleanhttp://baseURLs in all three builders, plus regression guards forhttps:///wss:///ws://passthrough🤖 Generated with Claude Code