Repository navigation
Conversation
Require a valid Start-at-Login RunAtLoad registration before the cold-start caller relaunches Desktop. Preserve modern and legacy argument forms, running-process waits and manual-open guidance, with focused regression coverage and runtime documentation.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Description Check | |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title accurately and concisely describes the main change: requiring RunAtLoad before relaunching Desktop during startup. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Owner
|
Code/test review at |
3 tasks done
lidge-jun
added a commit
that referenced
this pull request
Oct 19, 2026
…ate paths and shim token handling (B5) (#7397) * fix(oauth): allow dismissing a settled failed login flow (carry #7379) Co-authored-by: Ingwannu <186453546+Ingwannu@users.noreply.github.com> * fix(providers): preserve explicit API-key mode when keys are unavailable (carry #7304) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(dsh): bound account profile response reads (carry #7333) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(dsh): drain server fixtures before removing homes (carry #7305) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude-cli): keep local errors out of subscription cooldown (carry #7343) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude): bound Desktop library reads and preflight writes (carry #7301) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(service): stop scheduler wrappers before Windows reinstall (carry #7313) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(startup): require RunAtLoad before Desktop relaunch (carry #7277) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): strip OpenSSL startup variables from updater child env (carry #7342) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): keep the service token out of bypassed shim launches All three Codex shims loaded the service API token into OPENCODEX_API_AUTH_TOKEN before checking OCX_SHIM_BYPASS, so a bypassed native passthrough launch handed the proxy data-plane token to the real Codex and its descendants. The POSIX, CMD and PowerShell shims now skip the token load under bypass; the Unix revision marker moves to 4 so installed wrappers are refreshed. loadServiceTokenFromFile reads the inherited OCX_API_TOKEN_FILE through a no-follow, nonblocking descriptor, accepts only a regular file of at most 4 KiB and returns only a single-line printable token. * test(claude): wait for a real ctime transition before requiring rejection Re-applying the same utimes moves ctime only after the kernel clock ticks, so the real ctime case from #7301 often observed no change and the reader correctly returned {}. Repeat the call until ctime has advanced (bounded), assert that precondition, then require desktop_config_not_regular. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(google-antigravity): admit a probed project_id fallback in account import (carry #7385) An Antigravity account whose Cloud Code Assist project is not auto-discovered was rejected with missing_project even when the operator knows its project. A Cockpit record may now carry a bounded project_id (Google Cloud project grammar, 6-30 chars, exact match). Discovery keeps precedence; the fallback is admitted only after the account quota probe succeeds with that account own access token against that project. Probe refusal, probe errors and cancellation write nothing. No shared default project. Co-authored-by: yobushka <51312852+yobushka@users.noreply.github.com> * fix(quota): name a closed reason when an OAuth account quota probe fails Anthropic per-account quota rows reported quotaUnavailable with no reason, and Antigravity reported account_unavailable for any credential-side throw. The Anthropic usage read now reports a closed code for an HTTP status class, an unusable body or a thrown dispatch, and a probe that cannot obtain a credential reports account_unavailable without dispatching. Antigravity distinguishes a credential refresh deadline (timeout). Codes reuse the existing closed QUOTA_FAILURE_CODES set, carry no upstream text and never change account health. * test(claude): match the symlink-resolved rollback target in the picker restore case The atomic writer renames onto the symlink-resolved target, so on macOS (/var -> /private/var) the rollback rename never matched the fixture path and the restore-failure injection did not fire. Compare both spellings. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(google-antigravity): cancel the import project probe with the import request probeAntigravityUsageQuota accepts an optional caller signal that cancels every request of the probe and stops before the models fallback; the import verifier forwards the import signal and never admits after cancellation. * fix(codex): upgrade installed Windows shims that load the token before bypass CMD and PowerShell wrappers now carry a Windows revision marker. A marked wrapper without it (installed before the bypass-token fix) is obsolete: installCodexShim and autoRestoreCodexShim rewrite it in place over the same backing launcher instead of reporting it healthy or already installed, and diagnostics report it unhealthy. On Windows the service token reader also binds the opened descriptor to the path by identity, so a link swapped in after lstat is refused. * test(codex): mark the in-place Windows diagnostics fixture with the current revision * fix(codex): refresh obsolete Windows shims without clobbering a concurrent replacement The obsolete-wrapper refresh truncated whatever occupied the wrapper path. It now moves the observed wrapper aside and proves it is the probed file, stages the current wrapper beside it, and publishes with a hard link that refuses an occupied path. A concurrent replacement is restored or kept untouched and the refresh reports deferred. * docs(structure): record the Windows shim refresh transaction * fix(codex): create the Windows shim refresh stage exclusively and resume partial upgrades The refresh stage is now created with O_CREAT|O_EXCL (and O_NOFOLLOW on POSIX) under an independent random name, and publication, withdrawal and cleanup are bound to the identity of the file this refresh created, so a planted link is never written through. Auto-restore resumes a Windows revision-only sibling mix (current plus obsolete wrappers) instead of deferring forever after one transient publish failure. * fix(codex): bind Windows shim refresh rollback and recovery to observed identities Publication keeps a linked entry only if it is the created stage, and withdraws a link to a swapped stage (file or symlink) while leaving independent replacements. Restoring the moved wrapper requires the aside to still be the moved file. Automatic revision recovery now refreshes only the admitted obsolete wrappers and first re-verifies every current sibling, so a replacement during the stability wait is never adopted. * fix(codex): never displace a Windows shim where its replacement cannot be published The refresh proves hard-link support in the wrapper directory with a throwaway pair before moving the wrapper aside, and if a restore link still fails it falls back to an identity-checked rename onto the empty path, so the launcher never stays missing. --------- Co-authored-by: Ingwannu <186453546+Ingwannu@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: yobushka <51312852+yobushka@users.noreply.github.com>
Owner
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The cold-start caller could accept a matching macOS LaunchAgent without the required Start-at-Login
RunAtLoad: truefield, as described in the upstream discussion. Require that boolean before the lease-owning caller attempts relaunch; false or missing values return manual-open guidance without launch, readiness waiting or a competing CLI proxy, while releasing the lease. Both true modern[program, "--autostart"]and legacy[program]registrations remain accepted, and an already-running Desktop or a lease held by another caller retains its existing wait path.Verification
GitHub's update-branch operation merged current dev into the PR branch. Signed publication HEAD:
031917f996a9a624ff68becaddf7f0bd1d362849; first parent:6ee0dd7150448864f0834540caeae3e07f8ae3af; second parent (dev):8640c2f30edbd2fbb6947ed5c25e2793f5ae72a6; tree:0b87cfff23a39e1754b793f823755a25652b5a2e. GitHub reports signature verification valid, authorluvs01, and GitHub as committer. The server tree exactly matches the locally validated merge candidate. Its delta against dev is 3 files, 25 insertions, 5 deletions, frozen patch SHA256b71ea9c19a24997d62e081585091946b45f7a92238ab18f1680f33cea7da2c45. Source and test blobs are unchanged from the original PR; the runtime documentation also retains the current dev prose.Fresh local validation of that exact merge tree on 2026-10-18:
bun test tests/cli/cli-ensure-desktop-cold-start.test.ts --timeout 30000— 30 passed, 7 skipped, 0 failed, 186 assertions, 42.33 seconds. Covers rejected false/missing RunAtLoad, accepted modern/legacy registrations, running Desktop waits, manual-open guidance and refusal of CLI fallback.node node_modules/typescript/bin/tsc --noEmit— PASS, exit 0. The compiler was invoked directly because the reused dependency Bun shim previously failed; no helper was modified.Exact-head Cross-platform CI run 39097190022 on
031917f996a9a624ff68becaddf7f0bd1d362849completed successfully at 2026-10-18 04:38:26 UTC: 14 successful jobs, 9 skipped, 0 failed, 0 cancelled, all 23 jobs completed. Skipped platform/native jobs are not passing coverage. The new-head React Doctor, Catalog async contracts, target-branch and label checks also completed successfully. PR hygiene run39097188514succeeded; the separate body-edit-triggered hygiene run39097233018was cancelled, not passed. These results do not claim every merge prerequisite or approval is complete.The original-head Cross-platform CI run 39041846086 completed with 14 successful and 9 skipped jobs on
6ee0dd7150448864f0834540caeae3e07f8ae3af; that remains historical evidence only, separate from the refreshed-head CI above.The full suite and changed-test wrapper were NOT RUN locally for this refreshed tree, under the focused-validation/shared-resource scope. Seven native/macOS/Linux-specific tests skipped on Windows remain UNVERIFIED; no real Desktop launch, native plutil, LaunchServices or service registration was exercised. Maintainer/code-owner approval and explicit security review remain pending before merge. Author validation is complete and this PR is ready for review. Maintainer/code-owner approval and explicit security review remain separate merge prerequisites; no approval, merge, release or deployment is claimed.
Checklist
Summary by CodeRabbit