Repository navigation
[WRONG BRANCH] release: promote frozen tip 47f9e2dc42 to preview as 2.98.0-preview.20261107 - #8268
Merged
Merged
Conversation
Advisor consultations keep the originating caller's provider/model admission scope on the internal loopback hop, enforced on every final destination including combo picks, nested decision turns, child invocations and fallback hops. Paid-combo consent and device fallback policy follow in #7859. Co-authored-by: Epinephrine <luvs01@hanmail.net>
…tion (#7849) * fix(openai-chat): keep captured usage on an invalid negotiated completion Every other terminal path of the streaming generator attaches `pendingUsage` to its error event (`invalidChoicesEvent`, `invalidToolCallsEvent`, `upstreamErrorEvent`), but the invalid negotiated tool completion path threw it away. When upstream reported usage before a repeated completion marker or a late argument fragment, those tokens were missing from the request's error event even though every other error carries them. Pass `pendingUsage` through like the sibling terminal errors. * fix(openai-chat): keep the usage branch within the file-size cap --------- Co-authored-by: xubenqiang <xubenqiang@users.noreply.github.com> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…namespace (#7852) Squashed onto origin/dev: fixture runtime preload, explicit namespace ownership, layout shard registration, and a direct-socket probe for the held public canary in cli-start-auxiliary-bind. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(codex): keep npm Node cache within inspection lifetime * feat(codex): add confirmed CLI update apply candidate (cherry picked from commit ad1bb33) * fix(codex): preserve canonical staging and complete install preimages (cherry picked from commit a38c1a0) * fix(codex): await archive descriptor release before readback (cherry picked from commit 25b698e) * feat(codex): stage durable CLI update job management (cherry picked from commit be9df8a) * fix(codex): bind management launches and preserve uncertain job lifetimes (cherry picked from commit f33757a) * test(codex): align POSIX CLI job consumer contracts Carry only the request-id, POSIX job-store and status usage hunks from 86ad5a0; Windows read-only plan tests remain separate. * fix(codex): initialize confirmed CLI update jobs safely (cherry picked from commit 7db5a1e) * test(codex): preserve job DTO evidence during matching (cherry picked from commit 1c61f31) * test(codex): isolate npm wrapper module scope (cherry picked from commit 951e594) * docs(codex): describe POSIX update apply and job consumers * fix(cli): document Codex updater resource parity (cherry picked from commit b1dc856) * fix(codex): preserve update job results across store failures * fix(api): advertise retry delay for CLI job admission contention * fix(codex): recover owned job locks and signal apply failures * test(codex): isolate admission lock replacement identity guards * test(codex): align unapplied CLI consumer exit expectation * feat(codex): prove explicit Windows npm installations for read-only plans Port the Windows-plan hunks of 44353b9, 86ad5a0 and c291ff8 onto the 7586 POSIX stack head 4c22308. A proof-captured absolute standard npm codex.cmd shim, its global-prefix package, prefix-local Node/npm and the prefix-local optional backing are bound by held-handle identity re-verification; the plan then reports applicable: false with refusal windows_apply_disabled. PATH-only selection and separate-prefix Node stay refused; Windows apply remains disabled. The independent cli-installation-targets refused-probe fix (#7577) is intentionally not included. * fix(codex): preserve CLI results after persistence failure * fix(test): promote Bun 1.4.4 with independent runner role verification * docs: align Docker Bun comments with unified role defaults * test: use a draining TLS origin for early upload replies * test: confine draining origin to buffered HTTP/1 upload * fix(codex): run cli-update registry queries and session scans async PR #7586 review P1: planning ran three sequential npm view spawnSync calls (12s deadline each) plus the synchronous process-table scan in the server process, parking the proxy event loop for unrelated requests and streaming; background apply repeats the same planning. - spawnCodexCliUpdateMetadata: async child runner preserving the deadline, 1 MiB stdout bound, SIGKILL + bounded reap, and the status-null refusal lanes of spawnSync - resolveCodexCliUpdateTarget/resolveCodexCliUpdateArtifactTarget are async; createCodexCliUpdatePlan awaits them; CodexCliUpdateSpawn keeps sync test injections assignable - scanCodexSessionProcessesAsync plus async darwin/Windows enumeration twins; plan and apply prefer the injected async seam, then sync dep, then the async default - gated-child regressions: a real npm-view-shaped child held on a release file proves timers and a concurrent management request stay responsive while planning waits; wall-clock bounds discriminate a parked loop and the child self-cap keeps the harness hang-free * fix(codex): keep bare Windows check content-observation opt-in A bare check now requests the entrypoint, npm CLI, Node and native files metadata-only: the same handles stay open and identity-bound, but zero content bytes are streamed and installContentDigest stays null. The plan path still opts in, so the plan-bound digest and evidence are unchanged. CodeRabbit review on #7596 comment 4365760303. * docs(cli): align localized update-check wording with Windows x64 support The seven localized CLI pages still claimed Windows defers inspection without reading candidates. Align each check paragraph with the English contract: supported x64 npm installs are inspected under reparse-refusing held handles, and a supported Windows install can produce a deterministic read-only plan refused with windows_apply_disabled. CodeRabbit review on #7596 comment 4365760298. * fix(codex): settle cli-update metadata on the child's terminal event Independent review found real defects the first async revision carried over from spawnSync semantics: - spawnCodexCliUpdateMetadata is now an execFile callback runner: the result resolves only after the child terminated and its piped stdio was consumed, so the caller's isolation cleanup can never outrun a live child; encoding utf8 decodes the buffered output once so a multibyte character split across OS pipe chunks stays intact; maxBuffer bounds both captured streams in bytes; the per-query deadline is latched so a late code-0 close after the kill still refuses, and the arbitrary 1 s reap that settled without close evidence is gone. - applyCodexCliUpdate: the awaited final process scan is the last yield before install, and a synchronous guard in the same event-loop turn as the spawn re-checks the signal, prefix identity, the byte-level preimage taken before the downloads and the launcher's live canonical selection, so an earlier await can no longer hide a mutation between the final check and install. Regressions: real-child lanes prove status null on deadline kill, maxBuffer overflow and spawn ENOENT, exact exit codes, split-multibyte decode, and settlement following the child's own terminal event; an injected pending final scan refuses a signal abort, a preimage drift and a selection change with zero install calls (POSIX). * fix(codex): report windows_apply_disabled for direct Windows apply refusal A direct applyCodexCliUpdate on Windows misreported windows_inspection_deferred, the check-time code for layouts that cannot be inspected, while the plan path refuses with windows_apply_disabled. Align the guard and add the code to CODEX_CLI_JOB_REASONS so a persisted refusal is not rewritten to job_result_unknown. CodeRabbit review on #7596 comment 4365760310. * test(codex): hold Windows toolchain through async metadata resolution * test(codex): pin gated registry fixtures to x64 * ci: record measured Codex CLI apply batch weight * fix(codex): release apply lease when version verifier setup fails before spawn * test(codex): cover terminal pre-child verifier setup on every platform * fix(codex): run CLI update plan/apply hashing in a dedicated worker OpenCodex #7586: the management plan/apply paths ran synchronous full-preimage hashing, file-set walks and process scans on the HTTP event loop. Each admitted job now runs in a fresh Worker realm (cli-update-worker in WORKER_ENTRIES) while admission and the generation-fenced durable ledger stay in the parent. - per-job SAB fence PREPARING->CANCELLED/COMMITTED plus a real AbortSignal driven by a cancel message; the commit CAS is the last guard before the installer spawn, and a post-COMMITTED cancel defers - one process-wide shared selection gate covers the short commit window: the five mutable selection writers, the remote-workspace spawn and the desktop restart ladder report busy instead of racing - the run message carries the allowlisted frozen launcher snapshot; the worker rebuilds inspection deps and derives fresh selection evidence in its own realm - settlement requires a valid reply AND the worker close; the host never terminates a worker, so post-delivery loss settles ambiguous with the lease retained and live workers tracked Base: b0e2d8d * fix(codex): drain CLI update workers on Bun 1.4.4 Guard worker entry installation with Bun.isMainThread, remove message handlers for natural drain, and preserve explicit spawnWorker coverage. Add fresh-main import and real Bun child-drain regressions without forced worker termination. * test(codex): prove worker imports preserve fresh main handler * test(codex): align route planning fixture with worker dispatch * test(codex): isolate selector fixtures from runtime memo expiry * Refine Windows CLI installation checks * fix(codex): validate update paths and retain installation admission * fix(codex): recover update admission after terminal evidence * fix(codex): preserve recovery across admission and storage failures * fix(codex): preserve recovery admission across publication and home aliases * fix(codex): recognize interrupted terminal recovery writes * test(codex): use canonical homes for recovery fixtures * fix(codex): spawn no Windows npm metadata child until the toolchain closure is verified Holding node.exe and npm-cli.js does not cover npm's module closure or Node's executable dependencies. The default Windows plan now reports target_unresolved instead of running npm. The regression uses an npm entrypoint that requires a separate module and asserts it never runs. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(test): promote Bun 1.4.4 with independent runner role verification * docs: align Docker Bun comments with unified role defaults * test: use a draining TLS origin for early upload replies * test: confine draining origin to buffered HTTP/1 upload * perf(tooling): use Bun 1.4.4 native type checking Use bun check --no-script --noEmit for developer checks and retain the installed TypeScript CLI as an explicit reference command. Preserve CI and release checks. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix: preserve reference compiler in prepublish gate --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Validate a selected macOS ChatGPT app executable at each execution boundary it covers (explicit paths, discovered candidates, memoized selections; login, catalog, prompt probe, remote workspace and app-server startup), with bounded, cancellable verification that never becomes a reusable trust grant. ocx codex and the generated app-server launcher script follow in #7860. Co-authored-by: Epinephrine <luvs01@hanmail.net>
…7861) refuses() accepted any refusal text, so a case could pass because an earlier, unrelated gate refused it. Each case now names the gate that must stop the child, following the preload's check order. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Carry the existing replay-refusal marker and suppress synthetic quota metadata during combo failure rebuilds. Stamp adopted child attempts through the shared attribution helper while retaining genuine upstream 429 handling. Refs #7720. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Carries #7608 onto current dev: adds the response-citations structure doc, links it from responses.md and registers the existing url-citation title-repair regression in the test layout. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: Ingwannu <186453546+Ingwannu@users.noreply.github.com>
Rebased onto current dev as one commit (#7506); the transport inventory row keeps dev's new rows and takes this change's preview wording. Co-authored-by: StreamClash Dev <dev@streamclash.local> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(quota-pool): compute pooled windows from held account rows GET /api/quota-pool took pooled windows only from the provider-report cache, so a Home whose cache was cold (fresh start, invalidation, no dashboard read) reported empty pooled windows next to fully populated account rows. Pooled windows are now a pure capacity-weighted aggregate over the eligible account rows, with stale, elapsed and unknown readings excluded, and scopeModel uses the family:<name> form GOAT placement matches. * fix(quota-pool): report pool availability separately and keep key-bound reports Percentage windows now mark exhaustion from their own readings only. A blocked pool is a separate availability window whose reset and observation come from the blocking evidence, which also carries refusal-only blocks. A per-account provider configured with an API key keeps its held report as the pool. * docs(structure): name the API-key report fallback in quota-pool sources * docs(structure): keep openai-tiers within its line budget
Explicitly stopping a Remote Link Child restores local Native Codex routing, its catalog and resume history, and the managed Grok config, while keeping the saved Home connection. Every restoration write re-checks hub ownership inside the config mutation lock, so a concurrent hub connect is never overwritten; unproven ownership keeps the obligation and reports a refusal. The parent stop, the authenticated stop API and signal/exit cleanup share the guard, and a received 409 refusal never falls through to a forced kill. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
* fix(gui): avoid quota refresh failures from paused accounts Rebased onto current dev as one commit (#7628); the branch predated the 2.94.0 version line, which failed the release version gate. * fix(gui): satisfy React Doctor in provider quota refresh --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
) Dashboard sessions can be remembered per device as revocable server-side records bound to an origin-scoped device proof. Remembered sessions keep admin-token parity for ordinary management access but never count as a human dashboard confirmation: every consent-gated session-only mutation, including the desktop compatibility controls, refuses them, while logout and Forget stay available. Co-authored-by: x3M3x <amroeid1999@gmail.com>
* fix(clients): reject drive-less rooted Windows path overrides Rebased onto dev; layout registrations keep both sides. * fix(clients): pass the requested platform to T3CODE_HOME validation absoluteClientPath now applies the requested platform's path rules, so the T3 Code POSIX branch forwards its platform and the POSIX test expects a POSIX join. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#7866) * test: reuse bearer admission fixtures and own teardown Stop rewriting the legacy Cursor config and restarting a full proxy for each bearer row. Share one fixture per surface, retain all eleven negative checks, and bracket them with distinct Cursor wire controls. Track proxy and capture lifetimes so afterEach can close resources left by a timeout while startup or a request is pending. Cover fixture reuse, pending and rejected startup cleanup, and pending capture cleanup without retries, skips, or budget changes. * test: let admission cleanup retry a rejected server stop A rejected stop stayed cached, so afterEach re-read the failure and left the server and its spend-ledger owner registered. A failed attempt now clears the cache and keeps the server registered for the next cleanup. --------- Co-authored-by: t <a@b.com> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(cli): recheck live ownership before journal recovery Rebased onto dev (replaces the previous dev merges). The F4 bind-host source assertion now follows the normalization into src/server/bind-host.ts. * test(cli): supply definitive startup ownership fixture negatives Refuse both exact loopback health URLs in the child transport fixture and serve a valid foreign health identity from the held auxiliary-test canary. The ownership recovery fence correctly treats unexpected fixture errors and unreadable health bodies as unknown; keep its fail-closed behavior unchanged. Add a cross-platform fixture regression requiring all six family attempts to refuse. Preserve the connected-client desktop-claim and no-publication assertions, and keep the canary response at / unchanged. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ncode-free retirement (#7836) * fix(config): keep a protected recovery copy before persisting the opencode-free retirement Rebased onto dev; explicitShards keeps dev's shards and adds layout-config.json. * fix(config): preserve late retired snapshots at save boundary * fix(config): keep the parsed snapshot when retired-entry preservation fails A preservation exception at the save boundary no longer discards the parsed config that the client-state guard and OS-store reference accounting read; the save warns without a path and proceeds. * fix(config): require nonzero temp identity only for exclusive publication Ordinary private temp writes keep working on filesystems that report a zero inode or device; exclusive recovery-copy publication still refuses them. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#7648) Rebased onto the rebased #7626 head: this single commit carries the #7648 layer delta (40 commits on codex/windows-apply-transaction-20261023). It replaces the Supersedes #7614, #7618 and #7619, whose commits are contained in this layer. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…de exports (#7867) * feat(integrations): add opt-in alias names for Hermes and Command Code Persist the naming policy per connection and preserve omission on later Apply. Validate qualified aliases through ingress and router identity, regenerate proof against captured write configuration, and keep managed refresh and undo semantics. Add passive explicit CLI export previews, contract regressions, documentation, and generated operating-skill metadata for issue #7703. * fix(integrations): validate alias selectors at coordinated commit Refuse aliases reassigned after input capture and before a coordinated apply, overwrite or refresh writes. Resolve inherited naming policy through the bound ownership observation, preserve frozen serialization, and keep refusal read-only. Add red-to-green post-capture race regressions and retry guidance for issue #7703. * fix(integrations): treat a config without providers as alias-free The commit-time alias guard computes candidates for an inherited-mode apply. Object.entries on a missing providers map threw, which failed a default routed Command Code catalog refresh (command-code-client-contract). --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(gui): show Terra as the separate memory background model The shadow-call badge listed only the intercepted helper slugs, so an enabled intercept looked as if no background call could still reach OpenAI. Codex's memory consolidation also runs in the background and asks for Terra, but Memory-Routing controls that phase. Keep Terra out of sourceModels: it is a normal foreground and subagent model, and intercepting it wholesale would redirect user turns. Render it as its own memory entry and explain the separation in the dashboard, Models settings, tooltips, and the configuration reference. * fix(gui): qualify the Terra shadow-call exception CodeRabbit found that the tooltip claimed the shadow switch never includes Terra. That is true for the default sources, but an explicit sourceModels entry can still route consolidation through the switch when memory routing is off. Say "normally"/"by default" in the hint, warning, and tooltip in all locales, and name skill orchestration in the Turkish tooltip. * fix(gui): avoid duplicating Terra in the background badge An explicit sourceModels entry can include Terra. The badge already lists it as a source, so appending the memory label would name the same model twice. Treat a matching source prefix as covering the memory model. * feat(shadow-call): expose and persist per-source toggles The management API now returns the runtime-owned source inventory and accepts a validated sourceModels list. Defaults stay unchanged: Terra and the retired mini helper remain opt-in, and a configured memory-consolidation route still wins. * feat(gui): add shadow-call source toggles Dashboard and Models now share one runtime-fed toggle row. Terra is visible as a Memory source instead of being implied, the last active source cannot be switched off, and a broader custom prefix blocks covered toggles instead of changing siblings. * docs(shadow-call): document source toggles and memory precedence Document the runtime-owned source inventory, persistence and validation of sourceModels, the one-source minimum, and the fact that Memory-Routing still wins over a Terra shadow opt-in. * fix(shadow-call): address source-toggle review findings Show the API rejection as a validation message, render disabled-source reasons visibly, make the toggle result order-independent, bound persisted prefixes, and reject whitespace before trimming. * refactor(gui): move shadow-call settings state into a hook Keeps Models.tsx below its file-size ratchet while preserving the new validation feedback and optimistic rollback. * fix(shadow-call): return stable save validation codes * fix(shadow-call): roll back live settings when persistence fails * feat(shadow-call): include gpt-6.1-terra as memory source * fix(shadow-call): surface dashboard save errors and clarify interception
* fix(update): preserve service-home authority during recovery (#7154) Rebased onto dev: this single commit carries the #7154 delta (narrowed head a505545). Update effects are authorized at runtime immediately before they run; the static update scanner is documented as best-effort regression lint. Co-authored-by: Epinephrine <luvs01@hanmail.net> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> * test(update): run update lint only where its parser starts; fix the POSIX launcher fixture TypeScript 7's sync client cannot start under Bun on POSIX, so the auxiliary lint cases now skip there while runtime guard cases always run. The real Node launcher fixture supplies transactionalNpmUpdateSync and the failure-guidance helpers that the POSIX path of bin/ocx.mjs uses. * test(update): recognize guarded launcher spawns in source checks The updater restart now dispatches through guardedSpawn(gate, kind, process.execPath, ...) and the launcher's lazy Bun install through probeSpawnSync; the provenance and launcher-policy source checks match those forms. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* ci: bound frozen installs and retry only deadline stalls A registry or runner stall left 'cd gui && bun install --frozen-lockfile' printing only its banner until the api usage job hit its 5-minute timeout (run 40633760444). The Ubuntu jobs that install root and GUI dependencies now go through scripts/ci/bun-install-frozen.sh, which gives each attempt a 60 s deadline and retries only attempts the deadline killed (at most 3). Lockfile mismatches and other failures still fail at once. * ci: share one install budget across root and GUI Three 60 s attempts per directory could outlast the 5-minute storage-policy and api-usage jobs. Attempts now default to 45 s and all directories share a 150 s total that includes the kill grace, so retries end with time left for setup, the GUI build and the tests. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…settlement (#7869) * fix(windows): admit local config writer phases after ACL settlement Admit local config, effort, custom model and provider mutations through the existing bounded config-root settlement barrier. Derive candidates inside admission and revalidate a confirmed custom-model removal against current state. Apply the same ordering to Advisor settings using its existing failure response. Cover parent-flight overlap, deadline refusal and intervening edits with deterministic regressions. Keep synchronous leaf APIs and wire contracts intact. * fix(advisor): capture the settings receipt inside writer admission Serialize the successful settings response in the synchronous admitted phase so a queued live update cannot change the receipt for the preceding write. Cover the ordering with a deterministic queued-edit regression. * fix(windows): close admitted config writer escapes * fix(config): preserve mutation authority and Advisor live baselines * test(cli): restore an explicit exit code after the dispatch exit-code matrix Bun keeps the previous process.exitCode when it is set to undefined, so the matrix's last code (79) leaked into the test process exit and failed the shard with 0 test failures. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Carries #8187 by @ismell0992-afk. Co-authored-by: ismell0992-afk <255305877+ismell0992-afk@users.noreply.github.com>
* Prioritize critical credits in quota headline Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> * Fix quota headline selection for custom label collisions Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> * Strengthen unlimited credits quota summary fixture Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> * docs: record quota headline precedence Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> * fix(gui): index quota headline windows by label Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> * docs: clarify critical credit precedence in translations Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> * docs: describe quota window projection Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com> --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com>
Carries #8081 by @rrmlima. Co-authored-by: Rafael Moreira <rrmlima@gmail.com>
* fix(ci): rebalance Ubuntu tests across five shards * test(ci): verify five-shard suite coverage
…sktop app (#8105) Design system v2: redesigned dashboard, navigation and desktop windows, revised to the owner's Paper design (sidebar search and shortcuts, Home, Usage source dropdown with privacy-bounded client/device attribution). Classic dashboard kept at /classic/. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…8240) * fix(cli): retain Desktop selection when its executable disappears * docs: record verified Desktop launcher fix and pending live recovery
* test(config): use supported conditional platform skips * test(config): cover log rotation under a busy ownership lock
* test(config): retry busy first ownership registrations * test(config): fail registration workers on barrier expiry Exit before ownership registration when the go signal is still absent after the barrier deadline. A child-local deterministic clock regression fails before the fix and passes afterward without a 20-second delay. Focused gated/cold/racing controls: 4 pass, 20 assertions; typecheck2322 and file-size/diff checks pass. No product change.
* fix(sync): report skipped connected children as partial * fix(sync): make update guidance installation neutral
* fix(sync): defer supervised client restart after apply * fix(sync): clarify deferred supervisor restart guidance
* fix(link): report stale child connection readiness * test(link): seed durable state for tunnel readiness * fix(link): fence stale client status reads
* fix(link): preserve confirmed orphan token files * test(skill): register disconnect capability domain * fix(link): close unknown liveness narrowing * fix(link): protect admission secrets in orphan recovery
…8243) (#8256) Remove a Windows identity pin on refusal while another name still holds the token, name a leftover .identity pin in the nlink refusal, read durable Child state once per /readyz and only for the status routes that report it, type client_state_changed as a LinkReadiness reason, and show the 503 reason with recovery guidance in the dashboard.
* fix(tests): use native homes in launchd fixture * fix(tests): isolate plist home fixtures * fix(tests): account for shell quoting in plist assertion * fix(tests): encode plist whitespace references --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(tests): pair Windows CLI update plan session * fix(tests): isolate Windows plan fixture lifetime * fix(tests): retain plan fixtures until verifier exits * fix(tests): prove paired request reaches junction guard * test: report Windows toolchain refusal gate * fix(tests): contain Windows plan fixture process lifetime * fix(tests): retain ownership of Windows plan child * fix(tests): remove ambiguous descendant socket proof * test: prove Windows fixture job exit with owned handle --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#8265) Hosted Windows TEMP is an NTFS 8.3 alias (C:\Users\RUNNER~1). realpathSync keeps the short name while the sync process canonicalizes CODEX_HOME with realpathSync.native, so its catalog path hashed to a different backup and restoration stripped the catalog to [].
* test: quarantine hosted Windows CI failures for 2.98.0 * test: use Linux paths in systemd admission fixture
…1107 (ours merge of preview)
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
WalkthroughWarning Review details and warnings were omitted to fit the comment limit. |
github-actions
Bot
added
the
intake: hygiene-blocked
Contributor
|
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the frozen
devcandidate47f9e2dc4268a0b24835ad12d571f0e2242fac93topreviewas 2.98.0-preview.20261107. The promotion headb808626e6amerges inpreviewancestry with theoursstrategy, so its tree is exactly the candidate tree, followed by one commit that sets the four version sources to 2.98.0-preview.20261107.devwas already moved to 2.99.0 by #8263 (e804cd418a) before publication.The candidate carries 54 commits since 2.97.0. Highlights:
Known limitation, tracked in #8262: a time-boxed quarantine skips a small set of tests only on hosted Windows CI (overflow network lanes, one client-link-stop case, two CLI-plan cases, the package ancestry guard, one quota-tag case). They still run on Linux, macOS and local Windows.
Verification
release.ymlwill be dispatched only after this branch's push-event Cross-platform CI and Service lifecycle succeed on the exact merge SHA.Checklist