Repository navigation
chore: synchronize upstream and adopt versioned backports - #7
Merged
Merged
Conversation
…cy unchanged) (lidge-jun#7488) * ci(windows): run the Windows shards on Windows-sensitive pull requests again lidge-jun#7052 dropped the pull_request clause from platform-windows, so the changes job's windows=true verdict was computed and ignored; with dev absent from the push trigger, Windows ran only nightly. lidge-jun#7468 landed green that way and broke windows 9/9 on dev. Restore the clause, mirror it in the aggregate, add a spawnsync marker, and correct the comment. Ordinary PRs keep the Ubuntu subset. * ci(windows): keep PRs Ubuntu-only, but flag Windows-sensitive ones for a lane=all dispatch Drop the pull_request clause and aggregate change: AGENTS.md's CI policy keeps Windows off PR CI. A Windows-sensitive PR now gets a non-blocking ::notice and step-summary line to dispatch lane=all before merge, the selector flags added spawnSync lines, and the platform-windows comment states the real policy.
…sing it (lidge-jun#7489) * fix(quota-pool): adopt a concurrent winner's identity instead of refusing it A loser that found no identity, then saw the winner's file appear before its own existence check, threw 'not a valid regular file' and started without an identity; in the race test the child printed nothing. A loser that finds a file now re-reads it within a 500 ms bound and adopts it once valid, never returning or memoizing an empty or partial file; symlinks and persistently malformed files are still refused untouched. Temp and in-place writes are fsynced. Deterministic regressions use injected hooks for both windows, and the race harness now records each child's stderr and exit code. * fix(quota-pool): fsync the identity's directory entry; test the EEXIST adoption fsync the parent directory after publication (best effort, skipped on Windows) so a power loss cannot drop the entry and rotate the identity. Add a deterministic regression for losing the hard-link race.
…eport the apply (OCX-6) (lidge-jun#7484) * feat(link): parity on apply — restart the Child runtime, record and report the apply (OCX-6) A Remote Link Child now records when it applied its Home's Codex settings, restarts its client runtime after an apply that the runtime predates, and reports both facts so a peer can compare them without reading either config. - ocx status --json: appliedCodexSettingsDigest on every device (lowercase hex SHA-256 of the fixed-order compact settings JSON), plus lastApplyAt and runtimeStartedAt (epoch ms) on a Child. - ocx link status --json on the Home: lastApplyAt, runtimeStartedAt, appliedCodexSettingsDigest and reportedAt on every link row, from a report the Child POSTs over the link (in memory, display only). - The client listener serves the bound ocx restart (attested /healthz, capability-only POST /api/system/restart). A replacement that does not come up is stopped and the old runtime binds again and keeps serving; supervised runtimes refuse with 409 restart_supervised and keep serving. - ocx sync restarts the client runtime only when it started before the recorded apply; applies are serialized by an outermost apply lock. * fix(link): pin the rollback port, withdraw a changing apply record, bound the 409 read * test(link): follow the client runtime publication through serve(); keep layout.json under its cap * fix(link): revalidate the connection before a rollback, lock every sync, report a failed record after the cache refresh; point translated sync docs at apply parity * fix(link): report only the apply lock itself as another apply in progress * fix(link): recheck the connection under the lifecycle lock before a rollback publishes * fix(link): order Child reports so a late one never moves the Home view backward * docs(structure): map the new link apply-parity files to remote-link.md * docs(structure): map link-routes.ts and link-home.ts to remote-link.md
…idge-jun#7490) * feat(remote): name the serving Home in x-opencodex-served-by (OCX-2) GET /healthz publishes the install homeId as instanceId and every GET /v1/models response carries it in x-opencodex-served-by. A link Child passes the Home header through; both are omitted while the identity is unavailable. /readyz now advertises served-by-header. * refactor(remote): keep the served-by stamping in served-by.ts Keeps src/server/index/serve-options.ts under the 2000-line file-size ratchet. * fix(remote): keep instanceId on the package-tree-fenced /healthz The fenced 503 /healthz body omitted instanceId while the fenced /v1/models response still carried x-opencodex-served-by, so peers could not compare them during an in-place update. * test(remote): make the opacity check chance-proof; document rotation on restart * test(remote): assert the /v1/models refusal status in the served-by case * test(remote): the keyless loopback refusal is 403 origin_rejected
…-jun#7474 review (lidge-jun#7493) * fix(mistral): scope queue_full to the waiting identity; address lidge-jun#7474 review The Mistral pacer counted every parked waiter in one process-wide counter, so 128 requests queued behind one credential+model's hold answered queue_full (HTTP 429, Retry-After 60) to every other healthy Mistral key and model. The cap is now per identity; a regression case proves a healthy identity sends at once and another held identity still queues while one queue is full. Also from the lidge-jun#7474 CodeRabbit review: date the reasoning-metadata docs note to 2.90.0 (en, ko), trim both operands of OAuth email identity matches, drop leaked '+' diff markers from three tests, reuse httpQuotaFailure in the Antigravity quota probe, assert CodexAccountCooldownError in the exact-binding test, add a WinSW command-line case to the scheduler-wrapper matcher, and fix a sentence case. * fix(mistral): bound queued waiters process-wide; cover review follow-ups Model strings are client-chosen, so per-identity waiter caps alone left the Mistral pacer without a finite aggregate bound. Waiters now count only when they actually park, capped at 128 per identity and 512 in total: a request that can send immediately is never refused, and one identity cannot fill the aggregate alone. Also covers the email-only reauth comparison across case and whitespace, and the Antigravity models-fallback status mapping (401/403/429/503). * test(antigravity): cover the models-fallback redirect mapping Adds a summary-500 then models-302 case asserting redirect_blocked and exactly one request to each endpoint, completing the fallback status table.
…idge-jun#7492) * feat(cli): mark provider list rows active when they serve (OCX-12) ocx provider list --json/--jsonl adds active:boolean per configured row: false while this device is linked to a Home (Remote Link Child or Hub-mode client), true when the row serves. baseUrl drops userinfo and masks credential-shaped query values so no row carries a credential. * test(layout): register the provider list active test inline to keep layout.json under its cap * test(cli): keep the provider list fixture credential out of the privacy scan * docs(cli): document provider list's active field and baseUrl redaction Review (lidge-jun#7492): scripts now receive a required active field with link-dependent semantics, but only the skill reference described it.
…n existing ones (lidge-jun#7496) * fix(link): refuse Windows Children with a Hub-mode pointer and explain existing ones ocx link add and the dashboard already refused a Git Bash Windows Child, but cmd.exe and PowerShell shells surfaced as a generic probe or version failure, and the CLI replaced the refusal with a phase name. Recognise all three before host trust or key issuance, point at ocx hub invite / ocx connect, and add ocx link cleanup, which reports Windows Children enrolled before the refusal and prints the recovery order without revoking anything. * fix(link): confirm localized Windows shells and keep residual recovery Address review on lidge-jun#7496: PowerShell 7 says 'a name of a cmdlet' and localized Windows says neither, so a non-transport failure now gets one fixed, locale-independent 'cmd /c echo %OS%' check against the same strict host key. A residual remote_platform_unsupported after key issuance keeps the Child disconnect/restart recovery instead of the pre-issuance message. structure/remote-link.md lists link cleanup.
…t ignores SIGTERM (lidge-jun#7502) On Windows, kill("SIGTERM") is TerminateProcess, so the first signal is the observed exit and nothing escalates to SIGKILL. The lidge-jun#7484 test assumed POSIX and failed windows 4/9 on dev deterministically. Assert SIGKILL on POSIX and SIGTERM on win32, and assert the exit was observed.
…#7501) * test(claude): wait for the tunnel decision instead of sleeping before settle * test(codex): publish the prompt-lock child result by rename before the parent parses it * test(codex): keep catalog audit cases off the cold Windows SID lookup and icacls * test(responses): keep native-main refresh cases off cold Windows ACL setup * test(cli): warm the routing-editor child graph before timing it * test(gui): warm the CLI start graph before timing standalone pairing readiness * fix(codex): keep the PowerShell DPAPI helper out of cmdlet module discovery * fix(cli): identify update-restart homes by exact file id, not a rounded double * test(clients): warm the real Windows activation validation before bounding it * test(server): keep Anthropic billing cases off cold Windows ACL work inside the request signal * test(cli): give update-restart marker fixtures the exact fileId
… verdict in `ocx status --json` (lidge-jun#7483) * feat(service): passive service status --json and install verdict in status --json ocx service status --json returns a stable, passive document (installed, running, backend, label, serving, log path) built from the reads the text report already makes, answered before platformOps resolves so no install/start/stop/repair path is reachable. ocx status --json gains an additive install field mapped from the updater's own detectInstallOwnership(). Text output is unchanged. * fix(service): keep status --json passive through the serving probe Run the JSON collection inside runPassiveRead so the serving probe's loadConfig() neither hardens modes nor backs up a malformed config, and refuse --json on non-status verbs before the Desktop check and the Windows mutation lock. Tests drive the real probe with network stubbed and assert the config home is unchanged. * fix(cli): skip Codex shim auto-restore for service status --json The CLI preflight repaired the Codex shim before dispatch for every verb outside its skip list, so a passive service status --json could still change the installation. Exempt it (flags may precede the verb), and add an end-to-end CLI test asserting every isolated home is unchanged. * fix(service): emit status JSON even when the serving probe throws * test(service): accept exactly the read-only Windows identity probe in the passive guard On a Windows host the scheduler verdict for a user-scoped task resolves the effective token SID through resolveCurrentWindowsPrincipal (WindowsIdentity::GetCurrent via PowerShell), the same process-cached lookup the secret-ACL code uses; no spawn-free resolver exists, and skipping it would misreport scoped tasks as stale. The guard now accepts that exact argv, at most once and only on win32, and the not-installed CLI case drives Task Scheduler and SCM doubles that report absence (sc.exe 1060) on a Windows runner.
…on Children (lidge-jun#7482) * docs(devlog): OCX-11 fallback off design note * feat(fallback): OCX-11 fallback off per scope, with home_unreachable on Children Add one policy resolver (src/routing/fallback-policy.ts) that every model or provider hop asks before it switches targets: combo failover (reactive, and proactive for a cooling first failover target), routing-profile candidates, subagent model fallback and the main-account hard-lock fallback. A refused hop answers fallback_refused with the triggering failure's status, never contacts the fallback target and names the ocx fallback command that allows it. Config: fallback.{model,provider}, providers/routes/devices maps, and devices.<id>.localFallback (a permission GOAT reads). A device set to off always refuses; otherwise route > provider > global; absent keeps today's behavior. Intra-pool account and key rotation is not a fallback and stays on. A Remote Link Child and a Hub client still never serve local providers; their Home-down 503/502 bodies gain code home_unreachable. State is exposed as ocx.fallback/1 through GET|PUT /api/fallback (also over the link relay), ocx fallback, ocx status --json, /readyz fallback-policy/1, and a dashboard panel on Dashboard and Remote Link. * fix(fallback): resolve link devices through a core-owned slot The request-path resolver imported the link store, which put src/link/ on the always-on core graph (tests/lab/core-link-boundary.test.ts). The link listener lifecycle now registers the key-to-link resolver at creation and releases it on stop; with nothing registered a key id is its own device. * fix(fallback): batch writes in one mutation; semantic device table PUT /api/fallback accepts { writes: [...] } (up to 8) applied in one config mutation, so the dashboard chains switch and ocx fallback --kind all write both kinds atomically; a refused entry writes nothing. The device list is a table (react-doctor prefer-tag-over-role, async-await-in-loop). * fix(gui): translate the French fallback route label * fix(gui): hide the device fallback panel until its state loads; scope two Remote Link request assertions A Home or Child without /api/fallback shows no second error on Remote Link. The two Remote Link tests that asserted the page-wide last request and GET count now scope that accounting to /api/link, since the page also hosts the fallback panel. * fix(fallback): classify hops by resolved destination; record taken after admission; address lidge-jun#7482 review - combo and routing-profile hops compare resolved destinations (provider alias, blockedModelRedirects); the failed child's resolved target is the hop's origin and a profile's current advances to the redirected candidate - every primary-to-later failover start is guarded (disabled, quota spent, ineligible, cooldown) with cooldown/quota_exhausted 429 and unavailable 503 triggers - guardFallbackHop records refusals at once and taken hops only via commit() after the site admits the dispatch (send-budget reservation, profile candidate not skipped) - Link relay authentication failures answer link_relay_auth_failed, never home_unreachable - validateConfigCandidate rejects a malformed fallback section; clearing a removed device's override is allowed; ocx status keeps its 2 s bound on the Child path - GUI: stale poll cannot overwrite a newer save; routing panel read-only on a Child - docs: per-site refusal statuses, pre-send home_unreachable scope, providers key meaning, stray heading, ru label, manifest src/codex/ * docs(structure): name link_relay_auth_failed in the relay-auth contract * fix(fallback): address lidge-jun#7482 re-review: clear local fallback on off, Child write guidance, docs and structure mapping * test(gui): assert the cleared local-fallback state after the PUT (lidge-jun#7482 review) * fix(fallback): classify the hard-lock hop from config, never the policy evaluator hardLockTargetOf ran previewRouteModel on routing-profile fallbacks, which runs the policy evaluator and opens routing-history.sqlite under OPENCODEX_HOME just to classify the hop. On Windows that handle outlived the request's home: the hard-lock routing test took ~15s and its temp-home cleanup failed with EBUSY. A routing profile is now classified from its declared candidates (any candidate on another provider makes a provider hop). Combos, account namespaces and concrete targets still resolve through previewRouteModel, which is config-only.
…#7532) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Stop fetchWithTransientRetry's same-target transient ladder when the upstream gateway status carries the exact x-should-retry: false verdict, returning the original response with its body intact. Carries lidge-jun#7505. Signed-off-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com> Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com>
* chore(providers): deprecate mimo-free * fix(providers): narrow mimo-free deprecation evidence and cover init discovery State the observed failure (the configured mimo-auto is rejected with 400 "Unsupported model") instead of claiming the vendor ended access for every model, and record the retained-vs-new-discovery contract in the adapter structure docs. The deprecated-entry invariant now also asserts the init menu excludes the entry, closing the one surface CodeRabbit found unverified.
…e-jun#7509) * fix(service): preserve unrelated authenticated loopback proxies * fix(service): recognize owned intercept URLs across port changes --------- Co-authored-by: JUN <jun@lidgeai.com>
* fix(messaging): reject macOS ACL-exposed state * fix(messaging): close temporary files when ACL inspection fails * test(messaging): reject unexpected descriptor cleanup errors * fix(messaging): report uncertain publication after ACL probe failure * test(messaging): verify native ACL refusal by stable error code * fix(messaging): classify temporary ACL refusal before publication --------- Co-authored-by: JUN <jun@lidgeai.com>
…plete reason "length" (lidge-jun#7539) Carries lidge-jun#7392 onto current dev. Co-authored-by: hedging8563 <45883076+hedging8563@users.noreply.github.com>
…e-jun#7514) * fix(cli): revalidate usage compare runtime * fix(cli): bind local usage reads to attested capabilities * test(cli): attest usage comparison workflow requests * fix(cli): retain attested usage failure diagnostics --------- Co-authored-by: JUN <jun@lidgeai.com>
…-jun#7522) * fix(codex): distrust picker freshness without binding evidence * docs(codex): describe desktop restart as an attempt * fix(codex): prefer known stale picker evidence --------- Co-authored-by: JUN <jun@lidgeai.com>
…lidge-jun#7442) (lidge-jun#7549) Carries lidge-jun#7442 onto current dev and closes its remaining review findings (Refs lidge-jun#7441). Co-authored-by: nordz0r <6949669+nordz0r@users.noreply.github.com>
…idge-jun#7550) * docs(subagents): explain how spawn_agent fills its five model slots When fewer than five models are featured, Codex fills the remaining spawn_agent slots with the next picker-visible rows by priority. Document which rows those are (routed rows at priority 5 alphabetically, or account-qualified native rows when account selectors exist), how to control the list, and that opencodex v2 guidance never names the filler rows. English plus the seven existing locale translations. Refs lidge-jun#7366 * docs(subagents): describe the spawn_agent window as up to five The FAQ said Codex always fills five slots; with fewer eligible picker rows (for example after v2 skips "disabled" rows) it lists fewer. Applied to every locale copy. Refs lidge-jun#7366
…lation (carry lidge-jun#7459) (lidge-jun#7542) Carries lidge-jun#7459 onto current dev and resolves its review threads. Co-authored-by: rrmlima <137737127+rrmlima@users.noreply.github.com>
…es not wait on a cold PowerShell (lidge-jun#7548) * fix(windows): read the effective SID in-process instead of a cold PowerShell child On Windows x64 the service mutation lock resolved the token SID by spawning powershell.exe, and a cold start on a loaded runner exceeded the 30s budget, so ocx service install refused (lidge-jun#7544). Read the SID through advapi32 via bun:ffi, mirroring the LocalAppData known-folder path. PowerShell stays only where FFI is unavailable (ARM64); native API failures refuse without falling back. * test(layout): register the current-SID test in the codex collision shard layout.json sits one line under the 2000-line file-size ratchet; the entry added in the previous commit pushed it to 2000 and macos 3/3 failed with NEW_OVERSIZED. Move the entry to the existing codex-integration explicit shard so layout.json is unchanged from dev.
…env transport (lidge-jun#7546) Carries lidge-jun#7540 and lidge-jun#7513 onto current dev in one change, with the review findings from both PRs resolved. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
github-actions
Bot
added
the
intake: hygiene-blocked
|
✅ READY
Hygiene✅ Deterministic PR hygiene checks passed. |
jack-o-mania
added
suppression-approved
github-actions
Bot
removed
the
intake: hygiene-blocked
jack-o-mania
marked this pull request as ready for review
October 28, 2026 15:31
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 595fe3d463
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
github-actions
Bot
added
intake: hygiene-blocked
jack-o-mania
added
suppression-approved
Collaborator
Author
|
@codex review |
Collaborator
Author
|
@codex security review |
github-actions
Bot
removed
the
intake: hygiene-blocked
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Collaborator
Author
|
@codex security review |
Collaborator
Author
|
Bootstrap exception recorded for this policy PR: the pre-policy |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Synchronize upstream
devat7eab2439cinto the fork and revertcfe85a4b4(PR #2), removing the manual fork release workflow. Establishdevas the only current integration line and versionedreleases/vX.Y.Zbackport lines, with PR-only changes, upstream synchronization before merges, a patch increment for each backport, and local installations from merged release-branch commits. Never clone or createmain; upstream PRs require an explicit user request and target upstreamdevonly.The trusted PR gate accepts matching same-repository backport branches only in
alexalok/opencodexand no longer requires this fork to havemain. Upstream behavior and workflow token permissions remain unchanged. This sync PR needs merge-commit integration to preserve upstream ancestry.The sync includes upstream PR lidge-jun#7593's remembered-device sign-in. Its screenshot from that PR:
Verification
bun run prepushwas attempted twice: the first run stopped on temporary-filesystem quota; the second reached its 923-second watchdog with fixture trust/ownership failures and contention timeouts. It is not claimed as passing. With a private fixture root, all 248 focused tests across the ten fork behavior, layout, version, and Lab-boundary files passed. Broad sync coverage remains with CI; dependency-install timeout jobs have been retried.dev. No upstream PR is opened.Checklist