Repository navigation
[WRONG BRANCH] release: 2.84.0 - #7016
Merged
Merged
Conversation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…6894) * fix(server): release eager relay abort listeners after producer teardown * test(server): preserve Rust target while naming the relay regression for hygiene --------- Co-authored-by: JUN <jun@lidgeai.com>
…6918) * fix(logs): refuse upstream diagnostics that repeat a sent credential * fix(logs): document sent-credential diagnostics and allow the registry import * fix(logs): mask configured credentials and split sent values into components Address the security review of the sent-credential registry: - read every configured provider key, pool key, header value, credential-named field and OAuth-store token at check time (rebuilt on config/auth/keychain change), so a credential a gateway already knows is refused before it is ever sent by this process - split sent and configured values into components (scheme words dropped, name=value pairs, Basic halves) so a bare token inside a compound header is refused - two-tier send registry: credential-named headers are strict (any length, eviction fails closed); other headers are best effort (8+ chars, eviction never disables diagnostics); correlation ids are skipped - register WebSocket per-turn headers that ride in the reused frame - type, code and request id all fail closed when coverage is incomplete - containment threshold lowered from 12 to 8 characters * fix(logs): parse spaced auth parameters and harden the configured source Address the security re-review of 4cc8176: - parse RFC 9110 auth-params (whitespace around "=", quoted strings with quoted-pairs) before splitting, so a spaced Digest parameter is refused - read keychain references quietly on the observe-only path and retry an incomplete configured set after 30s, so a keychain that becomes readable restores diagnostics without printing reference text - rebuild the configured set when a referenced environment variable changes - treat an existing config/auth store with an unexpected shape as incomplete - collect only credential-named config fields (not labels such as authMode) * docs(structure): note the configured source's env refresh and retry * fix(logs): linear auth-param scan and a metadata-free configured view - replace the auth-param regex with a single linear scanner; a long token-shaped or unclosed-quote header no longer costs quadratic time - hand out only { complete, matches } from the configured source so cache metadata and environment values never ride on the returned object - structure: an incomplete configured source recovers; strict eviction lasts until restart
… of runner load (#6914)
* fix(codex): preserve prompt drafts and bind base imports to previews Carry prompt panel UX and backend follow-ups from source commits 0c112d9 and 99d8dc2 onto current dev. Keep recovery-only Repair on the canonical lock contract already merged upstream, preserve outgoing drafts, and bound external source reads. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(gui): isolate files with the pinned Bun runner Match the GUI test script to CI file isolation. Non-isolated runs allow a pre-existing fixture to leave a readonly React act global that prevents prompt-panel tests from entering their test bodies. Preserve the pinned runner, all assertions, product behavior and dependency lockfiles. * test(gui): update the pinned runner isolation contract Keep the strict GUI script assertion aligned with the isolated pinned runner command. The runtime checks still prove the Bun pin, working directory, name filters and failure propagation. * test(codex): inject import races through canonical targets Resolve the published config target before comparing rename destinations so Windows short TEMP paths still exercise the post-write superseded races. Use a noncanonical fixture spelling and verify each injected edit before checking file and journal preservation. * fix(codex): refuse composite TOML edits and preserve preview typing * fix(codex): retain exact file identities across lock retries * fix(codex): scope prompt scalar edits lexically and keep saved drafts canonical The scalar line editor matched assignments line by line, so assignment-shaped prose inside a multiline developer_instructions value could be edited as the real key: a confirmed base import rewrote the prose and left model_instructions_file pointing at the original file. Lines are now classified by lexical scope across the whole file; only lines that start outside every string and composite span are assignment or table candidates, and an unterminated span refuses the edit before any write. Ordinary multiline values and multi-line arrays keep working. Quoted toggle keys are now read with the same decoded-key matcher the writer uses, so a successful write no longer returns a defaulted snapshot. The base variant dialog reconciles an existing variant to its canonical saved title and body when no newer edit arrived, so a normalized save is not reported dirty. * fix(codex): read prompt toggles with the same lexical scope as writes Toggle reads matched quoted assignments line by line, so assignment-shaped prose inside a multiline value could be reported as the setting and a successful write could return a snapshot that disagreed with the file. The lexical scanner moves to encoding.ts and toggle reads use scopedBool, which skips lines that start inside a string or composite span and bounds tables by top-level headers only. Files whose spans never close keep the plain scan. * fix(codex): scope the model_instructions_file fallback scan lexically When Bun refuses a Codex-valid config (for example an i64 beyond the JS safe range), the model_instructions_file reader falls back to a line scan. That scan read root lines without lexical scope, so a model_instructions_file line inside a multiline value could be taken as the setting and a confirmed base import would install that file. The fallback now uses scopedRootLines, which skips lines that start inside a string or composite span. * fix(codex): read CRLF model_instructions_file lines in the parser fallback The fallback line scan kept the trailing carriage return, and JavaScript's '.' does not match it, so a CRLF line with a trailing comment was reported as unreadable and a base import refused an existing source. Strip the CR before matching. * fix(codex): refuse ambiguous table edits and keep newer bytes on journal retry * style: drop trailing blank lines * test(codex): cover journal retries on commit, rollback and the store target; document the refusals * fix(codex): recheck the import source under the write locks; route import Cancel through the draft guard Two review findings at dd1133c: - importBaseVariant compared the preview hash before either write lock was held, so a source rewritten during lock acquisition was activated as the older approved copy. The locked build now re-reads the source and refuses with import_body_changed unless it still serializes to the previewed hash and path; the unreferenced variant copy is cleaned up as for other provable refusals. - The import preview's Cancel called onClose directly and unmounted the dialog, discarding unsaved base-variant drafts without the confirmation Close and Escape show. It now uses requestClose. Both regressions fail on dd1133c and pass here. * fix(codex): keep an import's copied variant whenever live config references it The locked import recheck added in ca9b7e6 refuses with import_body_changed when the selection is no longer the previewed external file. Cleanup treated every non-uncertain refusal as proof the copy was unreferenced, so a non-cooperating writer that selected the visible copy in the meantime was left pointing at a deleted file. Cleanup now deletes the copy only after variantStillReferenced shows the live config does not name it, for every refusal. The new regression fails on ca9b7e6 and passes here. * fix(codex): treat a symlinked selection of an import's copy as a reference variantStillReferenced compared only lexically resolved paths, so a live model_instructions_file naming a symlink to the freshly copied variant was read as unreferenced and the refused import deleted the prompt in force. It now also compares canonical destinations, and keeps the copy unless the selection provably does not exist. The new regression fails on d19c316199 and passes here. * test(codex): match retry-hook targets by native canonical path on Windows The journal retry regressions intercepted renameAtomicFile only when the destination equalled realpathSync(fixture path). On windows-latest the plain realpath of a temp-dir path can keep its 8.3 short form while the transaction publishes to the realpathSync.native form, so the hooks never fired (windows 4/9 in run 38087693507: intercepted=false, peerEdits=0). Both sides are now resolved with realpathSync.native. Test-only change. --------- Co-authored-by: Epinephrine <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com> Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com>
* fix(ollama): bound generated late-tool attribution Bound cumulative JSON bytes for generated late Ollama tool-output attribution before constructing each caption. Preserve complete identities and admitted output through the existing refusal contract. Add focused regression coverage and synchronize the owning structure contract and canonical adapter reference. * fix(ollama): count joined caption JSON bytes exactly Measure the virtual joined caption with a bounded JSON string counter before constructing it. Preserve split surrogate pairs across parts and the existing request-local refusal contract. Add exact-boundary, one-byte-over, cumulative and UTF-16 regressions, including 32 complete 8192-byte captions. Document the allocation-free accounting contract. * fix(responses): preserve 413 adapter-build budget refusals Carry the validated source correction through both initial and recovery build catches, preserving cancellation and original-refusal precedence. Cover the actual Ollama zero-send refusal and initial/rebuild budget and ordinary-error controls. Document the existing request_too_large wire contract without changing the shared formatter or caption bound. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ollama): name the late-attribution limit and keep it out of the combo overflow rewrite The refusal now reports the full 256 KiB limit and a proxy-owned message that names the cause and points to a new thread; a same-route compaction would resend the same history, so it is not classified as a context overflow. A combo member's refusal reaches the client only as that literal constant envelope. * style: drop trailing blank lines at EOF flagged by git diff --check --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com>
…reconnect (carry #6900) (#6915) * fix(link): reconnect the Home's -R tunnel after sleep and outages The Home ran its link tunnels without a retry policy, so a failed link stayed failed until a proxy restart. A retry that came back up was also promoted only by a catalog request from the Child, so an idle Child's healthy reconnect was killed at the five-minute outage limit: one network blip took the link down for good. - run the Home supervisor with HOME_TUNNEL_RETRY_POLICY, the same cadence as the Child's own tunnel (timeout/forward 60 s, auth 5 min, host key never) - promote a retry whose ssh child outlives a 15 s grace, longer than ssh's ConnectTimeout, as five seconds already promotes a first attempt - keep a retry running while the state reads failed, and let a retry that started just before the outage limit finish its grace - spawn on reload only for a fresh link or a due attempt - report an exit even when its stderr cannot be read - document the Home policy in structure/remote-link.md and the Remote Link guide (all locales) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(link): promote a retry before applying the outage limit A retry whose grace ended on the tick that reached FAILED_AFTER_MS, or one still running when a tick arrived late after a sleep, was first reduced to failed and then killed instead of promoted. Check promotion before the tick so a child that has outlived its grace is kept. Addresses the Codex review on #6900. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(link): keep a draining exit from being overtaken by the outage clock The exit handler drops the child before it awaits stderr. A tick in that window could fail the link on the outage clock with a one-minute retryAt, and the host-key exit that followed was then ignored, so a changed host key was retried. Skip the tick while an exit is still being classified. Addresses the second Codex review on #6900. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(link): make Retry restart a Home link's tunnel In the failed state the dashboard's Retry only re-read /api/link/status, so a link the supervisor had given up on stayed failed until a proxy restart. Retry now restarts the tunnel of each failed or reconnecting Home-initiated link, without restarting OpenCodex. - LinkSupervisor.reconnect(linkId): wait for a running reload, stop the link's child, forget its backoff or failed state and spawn a fresh attempt - POST /api/link/{id}/reconnect for a dashboard session or the loopback admin token; a Child-initiated link is refused (409 link_not_home_initiated) because the Child owns that tunnel - ocx link reconnect --link-id <id> [--json] - an exit that finishes after a reconnect started a fresh child no longer overwrites the new attempt's state - docs: Remote Link guide (all locales), structure docs, generated ocx skill surface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(link): state what the retry grace does and does not prove ConnectTimeout covers the TCP connect, the SSH handshake and key exchange; authentication and the remote forward request come after it. Say so in the supervisor comment and structure/remote-link.md, and record that liveness promotion is the same heuristic the first attempt uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(link): scope exits and stops to their child generation, gate reconnect on the listener - every spawn bumps a per-link generation; an exit still classifying its stderr, or a stop still waiting for its child, applies only while its generation is current, so a reconnect's new child keeps its own state - the draining marker records its generation and is cleared by a newer spawn - overlapping reconnects for one link share one restart - POST /api/link/{id}/reconnect requires the link listener to be listening (503 listener_unavailable), as apply does, before it starts a forward - structure/remote-link.md lists ocx link reconnect in the CLI inventory Addresses the CodeRabbit and Codex reviews of c0a377a on #6900. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(link): serialize reconnect with reload, removal and shutdown - Run reconnect, reload, stopLink and shutdown through one per-supervisor lifecycle queue. After the old child exits, re-resolve the current record and listener ownership, so a link removed, changed or made client-owned during the wait is never respawned (review R1, R1b, R1c; Codex P2). - DELETE holds its link through child stop, remote disconnect, key revocation and store removal, then reloads the supervisor store before releasing the hold. - Global stop now waits for a reconnect's draining child (review R2). - Retry stays disabled until the status refresh after reconnect completes (Codex P2). Co-authored-by: WOULDU-pres <72803972+WOULDU-pres@users.noreply.github.com> * fix(link): issue Home-link reconnects concurrently React Doctor flags await inside a loop. Reconnect requests are independent, so send them together and surface the first failure before refreshing. Co-authored-by: WOULDU-pres <72803972+WOULDU-pres@users.noreply.github.com> * fix(link): bound tunnel output drain after ssh exits Allow 250ms for tunnel output to drain after process exit, then cancel and release the readers while preserving diagnostics already consumed. Keep host-key and auth classification intact when descendants retain pipes, and prove supervisor retries and outage handling can proceed. Co-authored-by: WOULDU-pres <72803972+WOULDU-pres@users.noreply.github.com> --------- Co-authored-by: WOULDU-pres <72803972+WOULDU-pres@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…6917) A Store dropped while another thread was spawning a process could leave cli.lock held by the child's inherited duplicate of the file description, so the next Store::open failed with lock-busy. The lock is now an owning guard that releases with LOCK_UN (Unix) or UnlockFileEx (Windows) before the file closes, including when Store::open fails after acquiring it. Refs #6912
…6919) Combos dropped disabled catalog rows before computing capabilities, so a combo whose target was hidden from the model picker lost its image and reasoning metadata and showed the Image / multimodal switch as unsupported. Capability lookups now use every catalog row while the target picker still excludes disabled rows, and the provider default placeholder is only added when no catalog row exists. Closes #6898
…ding (#6916) * fix(grok): keep coupon callers on an operation that may still be spending * fix(grok): require unanimous status and complete coupon framing * fix(gui): retain Grok coupon holds across remounts * test(grok): pin route behavior for unconfirmed coupon gRPC framing * docs(grok): document coupon operation holds and pre-open refusals * fix(grok): anchor capacity refusals, bind auth replays to the coupon, keep live holds Security review follow-up for #6897: a capacity refusal under a supplied operationId carries that id and stays unconfirmed; pre-open auth refusals replay or reserve only under the requested token; restored records with unresolved codes are never replayed; storage hydration never replaces a live hold; the CLI treats blank and ledger refusal codes in a 200 as unconfirmed. * fix(gui): read coupon replies after the status check; capture the probe controller in an effect React Doctor: no-fetch-response-used-without-status-check on the consume reply, and react-compiler global reassignment in the test probe. * fix(grok): fail closed on unrecognized settled coupon codes Codex review P1s on #6916: the dashboard and CLI now treat a 200 settled code as definitive only when it is one the ledger records as an outcome; any other code keeps the operation and its recovery id.
…6924) The configured-credential cache keys on ino:size:mtimeMs. The test rewrote {"providers":[]} with {"providers":{}} in place: same inode, same size, and on Windows often the same mtime tick, so the cached incomplete view was returned and windows 4/9 failed deterministically. Use a differently sized array shape so the case tests shape classification, not mtime resolution.
…ement ingress (carry #6892) (#6913) * fix: restore remote hub browser pairing Carry of #6892 onto dev (the original targets main and is 26 commits behind dev). Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * fix(link): preserve loopback management access and harden pairing recovery - Resolve a loopback Host before the marked hub-management public-origin check, so ocx gui and local CLI calls to 127.0.0.1:<management port> keep working (Codex P1, review S1-01). - Offer pairing recovery only for 401/403 status failures, not offline, 5xx or malformed responses. - Move focus into the manual pairing form when recovery opens it. - Thread the pairing AbortController through session validation so an unmounted form cannot apply stale App state. - Translate the new pairing errors in every locale and update the owning structure docs. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * docs(structure): scope the management-listener pairing guarantee to what the runtime enforces Independent security review S2-02: the public listener with authentication on still redeems a grant presented with the canonical public Host/Origin, unchanged from dev. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * docs(structure): keep the pairing recovery note in its own paragraph Avoids an adjacent-line conflict with #6915's dashboard route list update; content unchanged. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * fix(gui): retain pairing validation retries and roll back rejected sessions Keep the consumed grant out of retry submissions and validate the installed candidate without automatic session renewal or admin-token fallback. Use an opaque in-memory handoff to restore the previous shared session on definitive rejection or cancellation while preserving newer logins. Cover transient retries, 401/403 rollback, cancellation, and App recovery. Add retry copy to all locales and document the handoff contract. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * fix(gui): preserve pairing rollback ownership after background 401 Carry opaque handoff ownership through automatic session invalidation so validation rejection and cancellation still restore the previous session. Keep newer login, explicit logout, and target replacement authoritative. Add concurrent recovery and supersession regressions, including malformed bootstrap recovery and Cloudflare challenge retry. Qualify the remote hub and structure documentation around definitive rejection and restoration. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * fix(gui): discard session recovery from superseded generations Bind recovery to the runtime and session generation that started it. Check that revision after bootstrap headers and body, before credential changes and admin-token fallback, and before authenticated retry and invalidation. Rollback, login, logout, and target replacement supersede older recovery; unchanged target refreshes retain current recovery and shared resolution. Cover deferred headers/body with valid and malformed HTML across rejection, cancellation, newer login, logout, target round trips, and current recovery. Document the scoped recovery and rollback guarantees. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * fix(gui): preserve explicit session authority across pairing and recovery Block automatic invalidation and recovery during and after logout until an explicit login or target replacement supersedes it. Track overlapping logout requests so a successful logout remains authoritative even if another fails. Capture the pairing revision before sending the exchange and attach handoff ownership before synchronous session events. Superseded exchanges cannot install credentials after delayed headers or body completion. Keep watchdog write cancellation separate from current-request notification so timeouts still report an unavailable session without admitting late writes. Cover deferred exchanges, both logout/recovery response orders, explicit login, overlapping logout, reentrant session events and watchdog ordering. Synchronize the pairing and recovery contracts in both documentation surfaces. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * fix(gui): guard discovery bootstrap and bound pairing requests Route App discovery bootstrap through automatic recovery authority captured before fetching, so delayed headers or bodies cannot supersede logout or a newer session. Share a deadline helper across bootstrap and pairing that also settles signal-dropping transports. Bound pairing exchange and validation through body consumption, preserve validation retry ownership on timeout, and roll back an unreturned exchange handoff on lifecycle cancellation. Cover App discovery/recovery/logout ordering, delayed valid and malformed bootstrap HTML, stalled exchange and validation headers/body, deadline fallbacks and cancellation. Synchronize the documented contracts. Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> * docs(remote-hub): translate pairing recovery rules into the Korean guide Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com> --------- Co-authored-by: Bướm Em <91105424+BuomEm@users.noreply.github.com>
…O_PROXY (#6936) (#6938) * fix(claude): keep loopback off the intercept proxy with NO_PROXY (#6936) Claude intercept mode wrote HTTPS_PROXY and NODE_EXTRA_CA_CERTS into Claude Code's settings.json but no NO_PROXY, so Claude Code sent local HTTP MCP traffic (POST http://127.0.0.1:<port>/mcp) through the CONNECT-only intercept proxy and every loopback MCP server failed with an empty 405. Apply now merges 127.0.0.1, localhost and ::1 into env.NO_PROXY: only missing entries are appended, as one trailing run in canonical order, and a "*" value is left alone. An owned block without the bypass classifies stale, so the startup migrate and reconcile repair existing installs; foreign proxy blocks are untouched. Removal strips exactly that trailing run and deletes the key only when nothing else is left; rollback restores the captured NO_PROXY unless it was edited after the apply. The proxy's non-CONNECT 405 now carries Allow: CONNECT and a short body naming the NO_PROXY fix. Closes #6936 * fix(claude): restore the user's NO_PROXY exactly on removal (#6936) Value-only ownership could not tell a user's own loopback entries from the ones opencodex appended, so removal could strip a user's 127.0.0.1 or delete a hand-written bypass. Apply now records {hadKey, previous, written} in <claudeConfigDir>/opencodex-no-proxy.json (NO_PROXY values only, no token), and removal restores previous only while NO_PROXY still equals written; anything else is preserved. The receipt lives exactly as long as its ownership episode: an apply from an absent block and every removal invalidate it first and fail closed with "unreadable" when they cannot, a failed receipt write leaves none, and rollback restores it with the captured value. Every receipt mutation passes the real-home test guard. An owned block whose NO_PROXY does not cover loopback is stale; null is treated as absent, and any other non-string value is refused as foreign_env instead of being rewritten. The helpers move to src/claude/intercept/settings-no-proxy.ts, the #6936 cases to tests/claude-integration/claude-intercept-no-proxy.test.ts, and the public guide now documents the bypass and the receipt. Refs #6936 * fix(claude): bypass the intercept proxy for 0.0.0.0 too (#6936) The proxy refuses every loopback and unspecified target, but the bypass only named 127.0.0.1, localhost and ::1. A loopback MCP server reached as http://0.0.0.0:<port> still went to the proxy and failed with 405. Add 0.0.0.0 to the canonical entries. Measured against Claude Code 2.1.296: *.localhost names are already covered by the localhost entry (its client suffix-matches), and other 127/8 addresses cannot be expressed in NO_PROXY (no CIDR), so the guide says to add such an address explicitly; the 405 body names the fix. Refs #6936 --------- Co-authored-by: jun <jun@Mac.lan>
…(carry #6931) (#6947) Kimi Code's native Responses endpoint rejects a content-empty assistant message ("the message at position N with role 'assistant' must not be empty"). For the exact api.kimi.com/coding/v1/responses destination, the outgoing input now drops assistant messages whose content is "" or only empty text parts, keeping any message referenced by a same-input item_reference and any message with unknown fields. On the translated Chat wire, an empty assistant turn between a tool call and its result no longer splits the pair: it used to close the pending call with a synthetic "no tool result was recorded" message and turn the real result into an orphan. A standalone empty answer keeps its slot so chat templates with strict role alternation still accept the history. Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: yuanyuanlove <yuanyuanlove@users.noreply.github.com>
…connected hub, and make the headerless probe test deterministic (#6949) * test: make headerless probe deadline deterministic * fix: verify configured credentials by content and route the tray to the connected hub Configured-credential snapshots were keyed by inode/size/mtime, so a same-length rewrite inside one timestamp tick (coarse on Windows) or a timestamp-preserving writer kept serving the previous, complete-looking view and masking could miss a replaced credential (#6923). Every check now reads both stores, compares a sha256 of the bytes it read and parses those same bytes; a store that vanishes or fails between stat and read is unreadable, so coverage fails closed. upstreamDiagnosticLogFields shares one lazily taken snapshot across its three fields. The desktop tray popup is mounted without App, so it never ran target discovery or the hub session bootstrap and, on a connected client, polled the local runtime instead of the hub (#6920). It now resolves targets the way App does before its first request and sends every read and account switch to the shared-plane base; a pending switch is cancelled on unmount. Closes #6923 Closes #6920 Refs #6912 Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> * test(gui): pin tray switch cancellation on unmount --------- Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com>
…tokens as input (#6950) * fix(claude): label alias tier slots in /model and count Anthropic cache tokens as input Claude Code labels a /model tier row with ANTHROPIC_DEFAULT_<TIER>_MODEL_NAME, then its own name for a first-party id, then the raw value, so a tier slot OpenCodex set to an ocx-claude-* alias showed the alias. Pair each alias slot OpenCodex writes with a label spelled like the discovery display_name, on the ocx claude launch env, the launchd system env and the shell hook file. The alias stays the submitted id; user-set slots and labels win, and a native launch drops the label with the stripped slot. Refs #6926. usageFromAnthropicShape reported Anthropic's cache-exclusive input_tokens as the whole input, so a Claude CLI, CodeBuddy or Qoder turn with cache reads and writes lost its cost estimate (normalizeCostTokens requires inclusive input). Report fresh + cache read + cache write, and fold partial snapshots so cache tokens are counted once. Carried from #6566. Co-authored-by: Foodcel <burntbiskit@pm.me> * docs(claude): list tier-slot _MODEL_NAME labels in every locale and note the system-env scope --------- Co-authored-by: Foodcel <burntbiskit@pm.me>
…oc follow-ups (#6936) (#6952) * fix(claude): keep the NO_PROXY receipt when removal cannot write (#6936) Review follow-ups on #6938: - A removal whose settings write fails has not ended the ownership episode, so it now puts the receipt back before rethrowing; a later removal can still restore the user's NO_PROXY. - The proxy's 405 body labels 0.0.0.0 as an unspecified host rather than loopback. - structure/runtime.md states that restoration needs the receipt, and what happens when it could not be written. - The seven translated Claude Code guides now carry the loopback NO_PROXY guidance from the English guide. Refs #6936 * fix(claude): restore the NO_PROXY receipt only before the settings commit (#6936) Review follow-ups on b796729: - Split the settings write into persist and catalog invalidation. Removal now puts the receipt back only when the persist step itself fails; once settings.json has changed, the episode is over and the receipt stays gone. A test seam replaces just the persist step. - Oracles: an uncommitted removal keeps settings and receipt intact and a retry restores the user's value; when the receipt cannot be put back either, the original settings error still surfaces. - The English guide, the seven translations and structure/runtime.md now say the original value comes back only when OpenCodex could record it and it was not changed since. Refs #6936 --------- Co-authored-by: jun <jun@Mac.lan>
…d Qoder Global images (#6921, #6932, carry #6906) (#6951) * feat(qoder): forward Qoder Global image input to the CLI (carry #6906) Remove Qoder Global's adapter-local blanket image rejection so image-bearing turns use the shared coding-agent image projection. Qoder CN keeps its residual raw-image refusal. The static Global roster stays a degraded discovery fallback and no longer seeds noVisionModels. Carried from #6906 by @juzijia (eb75367). Co-authored-by: cubebox <58514883+juzijia@users.noreply.github.com> * fix(responses): preserve user turn models during shadow interception (#6921) * fix(zcode): honor bootstrap data root and preserve ownership (#6932) * fix: address bundle review findings (#6932, #6906) - ocx export resolves the advisory destination before writing --out; an unresolvable client location (relative override, or ZCode bootstrap settings naming an unknown data root) is reported as unknown instead of failing after the file was written. - A startup repair removes a saved Qoder Global noVisionModels list that is still exactly a retired registry seed, so existing presets forward images to the Qoder CLI like fresh ones. Edited lists and rows the registry no longer owns are left alone. * test(zcode): expect restore to re-stamp the restored ownership record (#6932) restoreIntegration deliberately writes the restored record with the restore operation's own opId and time. Three relocation cases compared the record to the pre-disable copy byte for byte and failed on every runner (Cross-platform CI 38144972518, test 3/4). Assert the exact record instead: every field equals the original, and opId/appliedAt equal the restore journal entry's. --------- Co-authored-by: cubebox <58514883+juzijia@users.noreply.github.com>
…tics (#6954) * fix(service): diagnose linger and unloaded desktop login registration * fix(cli): normalize log selectors and disable hub mode atomically * fix(service): revalidate unloaded desktop login registration * fix(config): preserve hub disable through stale live saves
…iption plans (supersedes #6933) (#6953) * fix(anthropic): admit an account after a settled reset grant A journaled reset (including a same-id replay) now lifts that account's cooldown, drops its cached quota row, and rereads its usage. A failed reread keeps the journal answer and leaves the account eligible. Model family exclusions are released only by a reread proving the family is no longer rejected. Carried from #6933 without its dashboard roster refresh. Co-authored-by: jeongjin <jinjeongshin@gmail.com> * fix(oauth): report authenticated subscription plan labels * fix(oauth): bound refresh-time profile reads and keep unobserved Antigravity plans * docs(structure): keep OAuth subscription labels in the account-pool contract * fix(anthropic): bind reset admission to its settlement and force a fresh reread A replayed reset no longer lifts a refusal recorded after the reset settled, and the post-reset usage reread never joins an older account or vendor flight. Same-account logins whose tier read failed keep the stored plan; plan tests drain config-dir hardening before teardown; the provider guide describes the new plan sources. * fix(anthropic): admit only against the canonical settlement time Settlement now returns when the first answer was journaled, so a late overlapping answer cannot lift a refusal recorded after it; a refusal in the same clock tick as the settlement is kept. Explicit reauthentication merges the plan like other same-account logins, and an Antigravity onboarding failure no longer discards an observed tier. The barrier test always releases and awaits its held request. * fix(oauth): compare plan ownership identifiers kind for kind An email-only reauthentication of an account stored with an id and the same email keeps its unobserved plan; a different identifier of the same kind still blocks inheritance. Adds the onboarding-failure tier case. * test(quota): route the refresh-time profile read apart from usage probes Token refresh now reads the Anthropic account profile for its subscription plan (#6935). The background-refresh quota test counted every request carrying the fresh bearer as a usage probe, so that profile read showed up as a second usage call (windows 5/9, run 38145316365). Route /api/oauth/profile separately, as tests/oauth/oauth-refresh.test.ts already does; the one-usage-call assertion is unchanged. * fix(anthropic): fence reset admission at the claim and require cleared windows A reset grant now lifts a cooldown only when it is a quota (429) refusal recorded before the operation was first journaled, i.e. before any claim was sent, and the windows the canonical settlement reported cleared cover every window that refusal named (both when it named none). The journal persists the cleared windows and returns the claim fence on settlement and replay, so retries decide the same way. Entitlement refusals and uncovered windows stay cooled; usage is still reread so reset-derived recovery can act on fresh evidence. The admission evidence is now a required argument. * fix(anthropic): keep an uncovered cooldown recoverable after a reset When a reset grant cannot lift a cooldown (uncovered windows or an entitlement refusal), routing now moves the retained entry to the new cooldown generation together with the account, so stale reads are invalidated but the fresh reset reread can still settle reset-derived recovery. Adds a no-Retry-After regression for both an exhausted and a recovered reread. * docs(structure): drop the subscription-label pointer from the provider overview structure/providers-and-adapters.md is at its 600-line budget on dev (#6950, #6951); the subscription-label contract lives in structure/providers/anthropic-account-pool.md, which already names src/oauth/plan.ts. --------- Co-authored-by: jeongjin <jinjeongshin@gmail.com>
…nrollment (#6955) * fix(link): prefer runnable Desktop binaries over SSH PATH launchers * fix(link): project Home-initiated Child status and name Remote Link Home * fix(link): bound SSH command IO by one deadline * fix(link): verify restarted Child relay and add safe CLI enrollment * test(link): cover bounded server enrollment and authority * style(link): remove extra EOF blank lines * fix(link): preserve role and tunnel ownership in enrollment and status * fix(link): keep initiation unknown for any residual Child marker * docs(link): explain deliberately ignored cleanup errors * fix(link): read live Child status without CLI token file * fix(link): align stored Child observations and error contract checks * test(link): retain legacy error translations after enrollment split * docs(ocx): regenerate combined CLI management surface * docs(link): clarify interactive fingerprint option in locale references * test(link): expose fixture failures and scope POSIX mode checks
* fix(config): retain live hub topology and persisted key ordering * fix(config): project desired topology separately from active state * fix(config): keep client connection paired with active runtime role
Public picker CA metadata (authority.json, authority-init.json) is now refused when the opened descriptor reports a zero inode or a ctimeNs that differs from the pre-open path snapshot. The refusal happens before any credential-store access and leaves public state unchanged; two fault-injection regressions pin both cases, and structure/clients/claude-desktop.md records the contract. Independent boundary review (merge manager): the change only narrows which snapshots are accepted, so the worst case is a fail-closed picker CA on a filesystem that reports zero file IDs.
…ing effort (#6960) Carries LilMGenius's LazyCodex role reasoning-effort series (#6909, #6908, #6907) onto dev as one change. - The omo tab role table has an effort picker next to each model picker; Current shows "model · effort", and "Inherit effort" clears a pinned effort. - PUT /api/codex-agent-roles/{role} keeps the pin when effort is omitted, sets it for a level, and with null removes the root model_reasoning_effort line and the omo.jsonc reasoning. - Auto-assign proposes an effort for every sized role whose model has a non-empty ladder; --apply/Apply inserts or replaces it, and an empty ladder never clears a pin. Maintainer fixes on top: refuse clearing a multiline effort (409 unsupported_model_value) and keep the BOM; keep a pending omo.jsonc mirror retry's effort across later saves and Apply; clear an unterminated last effort line in place; publish a confirmed save into the role store when the reload fails; docs and structure/subagents.md match the behavior. Supersedes #6907, #6908 and #6909. Co-authored-by: LilMGenius <smsmeee@naver.com>
Codex App/CLI requests routed to Flash-Next failed on the first turn or after a developer reminder with "System message must be at the beginning." The translated Chat adapter's leading-system exception recognized Qwen3.8-27B but missed Flash-Next's served model ids. This is the remaining Flash-Next case from #6242. The exception now also covers exact flash-next and Qwen3.8-Flash-Next ids, including gateway namespaces. Text-only developer instructions keep their content and position but use the user wire role, the same tradeoff the Qwen exception already documents. Other model ids, native OpenAI targets and native Chat passthrough are unchanged. Regressions cover first-turn instructions under all three developer-role settings, late reminders, namespaced ids, pending tool-result ordering, nonmatching ids and native OpenAI exclusion; the adapter reference and structure/providers/chat-compat.md are updated.
The PINNED badge is now a keyboard-accessible release action for the native main account and pool accounts, with confirmation and localized feedback. The confirmation is bound to expectedPinnedAccountId and the persisted pin is rechecked under the config mutation lock. The null selection is persisted before the pin, runtime cursor, manual preference and shared/independent rotation seeds are cleared. Existing thread affinity and quota-avoidance health stay intact, and the release response reports appliesImmediately: false. Refused or uncertain releases refresh active state and close the old confirmation. All 11 GUI locales and the dashboard guides are updated; a release does not show the account-switch cache-reset or threshold warnings.
Restores the fr, ja, ko, ru, tr, zh-cn and zh-tw LazyCodex role reasoning-effort sections from #6907 that #6960 did not carry, corrected to the behavior on dev: the per-locale "Inherit effort" label, the null clear and its 409 unsupported_model_value refusal, auto-assign proposing an effort for every sized role, an empty ladder never clearing a pin, and the Retry omo.jsonc button including a carried null. The English guide gains the matching Retry omo.jsonc paragraph. Co-authored-by: LilMGenius <smsmeee@naver.com>
…inning a model (#6975) A LazyCodex role that inherits its model but pins model_reasoning_effort could not change or clear that effort: Save required a non-empty model draft and PUT /api/codex-agent-roles/{role} required a model. Such a row can now save an effort on its own and keeps inheriting its model. model is optional on the PUT route: omitting it leaves the role file's model pin and the omo.jsonc model untouched, omitting effort keeps the effort, and null effort clears it. A request with neither is refused with 400 empty_update before either file is read, and model: null with 400 invalid_model, because a save never removes a model pin. The omo.jsonc mirror only changes reasoning on an effort-only save. Model-only saves, auto-assign Apply, the mirror retry and ocx agent roles set behave as before. The omoComments string in all 11 GUI locales no longer names .model. Resolves the open review finding on #6960 (discussion_r4243110906).
Importing two users of the same Kiro organization (IAM Identity Center) profile through the dashboard's Kiro CLI login kept only one account, because the profile ARN was stored as accountId and the account store matched slots by accountId ?? email. Kiro account identity is now the profile ARN plus the email that same-session kiro-cli whoami reports (src/oauth/kiro-account-identity.ts); accountId still holds the ARN for routing. A second user of the same profile gets a new slot, the same user re-imported updates its slot, and personal/Builder ID accounts are unchanged. When whoami reports no user but the profile already has an identified user, the import is refused with a fixed account-free message unless the refresh token proves the same CLI session, and a forced login rolls the CLI back. Reauth and rotated-session recovery require the same user. Stored rows are never rewritten on load; Add account records the current CLI user on a matching ARN-only row through a serialized email-only bind. The separation is conditional on whoami supplying the user's email for IAM Identity Center logins, which is not yet confirmed against a real CLI; without it, users of one profile stay indistinguishable as before. Refs #6641
… exec (#6977) In a code-mode-only Codex turn the V1 collaboration tools are not declared on the wire; codex-rs renders them inside the code-mode exec description instead. collabSurface() required a directly declared spawn_agent, so "Tell Codex how to split work" guidance was dropped for those turns. collabSurface() now also reads V1 tools rendered in the exec description (src/server/responses/code-mode-collab-surface.ts). The match is strict: the multi_agent_v1__spawn_agent heading plus its complete declaration, on an exec whose description starts with the codex-rs template header. Contradictions are read liberally, so copied text can only turn the surface to null, and nested evidence never yields v2; MCP tools such as mcp__slack.send_message do not veto V1. Deferred V1 (models with tool search, which includes every OpenCodex catalog row) has no request-visible signal and still resolves to null; that case needs a separate design decision. Refs #6844
Squashed from #6961 for the 2.84.0 release train. Closes #6675. - Add a default-off plaintext reasoning replay checkbox to custom Responses provider creation and Settings. Explain that enabling it sends previous reasoning to the endpoint and can increase token use; local/key custom destinations are eligible, and curated/OpenAI/Azure/OAuth/forward surfaces keep their current behavior. - Persist explicit true/false choices through the existing capability, validate boolean/null PATCH values, and retain omitted configuration only when an overwrite keeps the same destination. Hidden stale form values do not enter create or update payloads. - Update all eleven GUI locales and the provider/management documentation. Closes #6675
…tools> fragment Codex defers the V1 collaboration tools whenever the model supports tool search, which every OpenCodex catalog row does. The code-mode exec description then lists none of them (#6977 reads only the rendered case), so collabSurface() stayed null and V1 Max/Ultra turns never received the proactive delegation guidance. When its deferred_tool_world_state feature is on (Codex Desktop sessions receive it), codex-rs sends a developer <tools> fragment listing the deferred namespaces, then Added/Removed diffs on later turns. deferred-collab-surface.ts replays those fragments in input order from developer messages only and treats a current multi_agent_v1 row as V1 evidence, beside a genuine code-mode exec or a structured tool_search host. Omitted rows never establish a namespace; omitted removals and malformed fragments clear what was carried. The evidence combines with the direct and rendered surfaces exactly like #6977: it never yields v2 and yields to any contradicting surface. Clients without the feature still carry no V1 evidence, and the row cannot show whether an embedder's allowlist dropped spawn_agent alone; both limits are documented in structure/subagents.md. Refs #6844
#6986 made the picker's TCP front keep reading and discarding client ciphertext after the backend ends a connection, so an HTTP/1.1 refusal, generated 502 or early reply sent with Connection: close is not reset before the client reads it. That discard had no end: a client that keeps trickling an abandoned upload held the connection until listener shutdown. Once the backend has ended and the reply has flushed to the client socket (finish), the front now arms a drop after PICKER_ABANDONED_INPUT_LINGER_MS (30 s); a connection that closes first cancels it. Arming after the flush keeps the reply and its Connection: close behaviour intact. The timer is injected through a test seam, so claude-picker-linger.test.ts fires it deterministically with a half-open TLS client that never stops uploading; the existing claude-picker-upload cases are unchanged. Refs #6984
inspectDesktopSupervision returned "unsupported" on Windows, so status, doctor, service install/repair/start/restart, stop and update all behaved as if no Desktop ran beside a package-installed ocx. Windows now proves supervision with the issue's standard: ocx.pid and runtime-port.json both name the runtime; its parent is a live opencodex-desktop.exe; both images are drive-qualified and the runtime is the Desktop's sibling ocx.exe; parent and child share a session; the parent was created first; and two snapshots agree. Each snapshot is one bounded PowerShell Win32_Process read (Node-safe, no FFI) inside a 6 s budget per inspection. Anything inconclusive stays unknown, and a Desktop image observed before a later field fails validation keeps its veto. The startup diagnostic gains a Windows path: it names the live supervisor (and, for a durable claim, checks the roaming install-id) but never credits Start at Login, so Windows does not read as Desktop-protected and drops ocx service advice. For an older Windows runtime without a Desktop diagnostic, status and doctor accept an owned local reading bound to the same PID pair; macOS and Linux keep requiring an unowned one. Closes #6853
A Mac whose only Codex is the Codex desktop app (ChatGPT.app, bundle id com.openai.codex) left OpenCodex with no runtime: the macOS installed candidates never looked inside the app, and the Desktop sidecar's GUI PATH never contains it (#6963). macOS now adds the app's CLI as the lowest-precedence candidate: after the environment override, the persisted selection, the shim, PATH, established install locations and the bare fallback; system /Applications before ~/Applications; the current entrypoint Contents/Resources/codex-cli/bin/codex (measured on 26.1007) before the older Contents/Resources/codex. A candidate counts only when the bundle's top-level XML Info.plist reports CFBundleIdentifier com.openai.codex, read in-process with a 64 KiB bound and no subprocess. The identity is re-checked for any path inside either bundle, including an explicit override or a persisted app path after the app is replaced. App candidates never take over a runnable automatically persisted selection: they are excluded from the deferred fast-path handover and from supersededDiscovered, and only appear in newerAvailable. Deferred resolution skips the unproven bare fallback only when a verified app candidate exists. The bundled-catalog and prompt consumers already map unsupported commands and spawn failures to unavailable; structurally malformed JSON (null model rows, null message or content items) no longer throws. Closes #6973
The #6959 passive-read effect watcher counted every numeric open flag other than exactly O_RDONLY as a write. With #6973 a passive GET /api/settings on a Mac that has the Codex app installed resolves the runtime and reads the app's Info.plist with O_RDONLY | O_NONBLOCK (the non-blocking flag keeps a FIFO at that path from hanging discovery), which the watcher reported as a write. Numeric flags are now judged by their write bits (O_WRONLY, O_RDWR, O_CREAT, O_TRUNC, O_APPEND) and string flags by Node's write-capable modes, with a deterministic assertion so the check does not depend on the host having the app installed. Subprocess and write watchers are unchanged.
… control-character regex ca94624 (#6973) rejected control characters in each plist node with a control-character regex literal and an eslint-disable-next-line no-control-regex directive, which the PR hygiene gate refuses as a new suppression. The node check now uses the reader's existing XML 1.0 Char predicate (allXmlChars), a code-point comparison: it rejects everything the regex did (C0 controls other than tab/LF/CR, U+FFFE, U+FFFF) and is the same rule already applied to the whole decoded document, so accepted and rejected plists are unchanged. No suppression remains.
fix: land eight owner fixes for 2.84.0
…ker upload drain fix(responses,claude): detect deferred V1 collaboration tools and bound the picker upload drain
…e Codex app CLI on macOS fix(service,codex): recognize Desktop supervision on Windows and discover the Codex app CLI on macOS
…iders Meta released Muse Wonder on 2026-10-12 (https://x.com/AIatMeta/status/2109691148943999167, research.meta.ai/blog/muse-wonder). Per dev.meta.ai/docs/models and dev.meta.ai/docs/pricing-rate-limits (verified 2026-10-13), muse-wonder-1.0 has a 1,048,576-token window, reasoning effort minimal through max, Standard mode only on the Model API, and costs $4 input / $20 output / $0.20 cached input per 1M tokens. meta-model and meta-muse now seed it beside the Spark 1.3 tiers. On meta-model only Wonder gets the max rung; the Spark rows keep their xhigh ceiling. The default model stays muse-spark-1.3 because Wonder is a preview. Muse Wonder Full is available only inside Muse Code subscriptions and has no Model API id, so it is not seeded.
…uses OpenAI raised GPT-6.1 Sol's default context in Codex & Work from 272k to 500k on 2026-10-11 (https://x.com/thsottiaux/status/2109430343346581527). The bundled codex-rs row still reads 272,000 / 872,000, and built-in natives never take roster values, so opencodex kept advertising 272k and compacting at 244,800. Native gpt-6.1-sol now uses NATIVE_GPT61_SOL_CONTEXT: a 500,000 default window that compacts at 450,000. Retained catalog rows are repaired on the next sync. The 872,000 long-window and input ceiling is unchanged: OpenAI calls the model maximum 1M without saying how that maps onto the native window and input fields. GPT-6 Sol, Luna, Astra, configured natives and the API, Kiro and CodeBuddy rows keep their values, and native spend estimates stay API-referenced as documented.
…and GPT-6.1 Sol 500k
…Wonder feat(catalog): GPT-6.1 Sol 500k default context in Codex and Meta Muse Wonder
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedToo many files! This PR contains 623 files, which is 323 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters (3)
📒 Files selected for processing (623)
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
Owner
Author
|
Release-gate disposition for CodeQL on this promotion (maintainer decision, same as #6910): the 42 "password hashed insecurely" alerts are SHA-256 fingerprints used as identifiers, not password storage. 38 sit on lines unchanged since v2.83.0. The 4 on touched lines are |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promote the frozen
devcandidate3bb7a5612c35c8079f5683a6d408a6907cf98bbetomainas stable 2.84.0. The promotion head6def866095389f1dcee071c7c23bad4b4f5b2287merges inmainancestry with theoursstrategy and has exactly the candidate tree (216ecfb5d3). The version is 2.84.0 in package.json, desktop tauri.conf.json, Cargo.toml and the opencodex-desktop entry of Cargo.lock. The dev pre-move is #7014 (dev → 2.85.0) and merges before this promotion.2.84.0 lands through five integration PRs:
#6999 (#6990) was split out after three repair rounds still stalled the serving loop on hosted Windows; it continues as its own PR.
Release regression audit. An independent gpt-6.1-sol audit of the integrated stack against v2.83.0 found no P0–P3 regressions: 1,595 tests across 56 files passed, plus
typecheck,privacy:scanandstructure:check. It covered request path and Lab boundary, Codex/Anthropic pools and failover, picker drain, Remote Link Child management, Desktop supervision, runtime discovery, reasoning replay and credential diagnostics. A separate cross-bundle review of the stack passed (558 tests). #7013 changes catalog rows only and passed its own exact-head review.Packed-tarball smoke at the candidate.
npm packproduced 2019 files includinggui/distandbin/ocx. Installed into an isolated prefix and home,ocx --versionprinted 2.84.0,/healthzreturned ok with version 2.84.0, andocx stopshut it down cleanly (exit 0) while the live 2.83.0 proxy kept running.Main-review disposition. Promotion from
devtomainand npm releases are maintainer-controlled (MAINTAINERS.md). The project owner instructed this train to be merged, regression-verified, released and deployed with merge decisions delegated to the coordinator, so this promotion merges with owner authority (--admin). The PR targetsmaindeliberately, so anenforce-targetwrong_base failure is expected (as in #6910).Verification
lane=allon the candidate3bb7a5612c(tree identical to this head): https://github.com/lidge-jun/opencodex/actions/runs/38319543073, success on attempt 2. Attempt 1 failed onlywindows 3/9,catalog-modelalias-unique-sync, where a spawned child was killed at its 20 s timeout; the same Windows runner-load class appeared on fix(responses,claude): detect deferred V1 collaboration tools and bound the picker upload drain #7010 and chore(release): open dev at 2.85.0 before releasing 2.84.0 #7014 and passed on a single failed-jobs rerun each time.release.ymldry-run and live withexpected-shaset to that SHA.Checklist