Repository navigation
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the main change: removing OpenSSL startup variables from the Codex updater child environment.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Owner
|
Intake/scoped review at The four OpenSSL startup variables are removed case-insensitively while proxy and NODE_EXTRA_CA_CERTS support remain. The new tests inspect captured spawn options; they do not exercise native provider/engine loading. Current-head functional CI is successful. The dependency-startup/environment boundary still needs the explicit security review required by MAINTAINERS.md; this intake is not that review. Existing current-head CI was inspected; its success is limited to the jobs actually selected, with skipped platforms retaining no runtime certification. No local suite was run for this branch in this intake. No workflow approval, new scan, live configuration change or merge was performed. Required review/readiness gates remain in force. |
3 tasks done
lidge-jun
added a commit
that referenced
this pull request
Oct 19, 2026
…ate paths and shim token handling (B5) (#7397) * fix(oauth): allow dismissing a settled failed login flow (carry #7379) Co-authored-by: Ingwannu <186453546+Ingwannu@users.noreply.github.com> * fix(providers): preserve explicit API-key mode when keys are unavailable (carry #7304) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(dsh): bound account profile response reads (carry #7333) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(dsh): drain server fixtures before removing homes (carry #7305) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude-cli): keep local errors out of subscription cooldown (carry #7343) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude): bound Desktop library reads and preflight writes (carry #7301) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(service): stop scheduler wrappers before Windows reinstall (carry #7313) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(startup): require RunAtLoad before Desktop relaunch (carry #7277) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): strip OpenSSL startup variables from updater child env (carry #7342) Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): keep the service token out of bypassed shim launches All three Codex shims loaded the service API token into OPENCODEX_API_AUTH_TOKEN before checking OCX_SHIM_BYPASS, so a bypassed native passthrough launch handed the proxy data-plane token to the real Codex and its descendants. The POSIX, CMD and PowerShell shims now skip the token load under bypass; the Unix revision marker moves to 4 so installed wrappers are refreshed. loadServiceTokenFromFile reads the inherited OCX_API_TOKEN_FILE through a no-follow, nonblocking descriptor, accepts only a regular file of at most 4 KiB and returns only a single-line printable token. * test(claude): wait for a real ctime transition before requiring rejection Re-applying the same utimes moves ctime only after the kernel clock ticks, so the real ctime case from #7301 often observed no change and the reader correctly returned {}. Repeat the call until ctime has advanced (bounded), assert that precondition, then require desktop_config_not_regular. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(google-antigravity): admit a probed project_id fallback in account import (carry #7385) An Antigravity account whose Cloud Code Assist project is not auto-discovered was rejected with missing_project even when the operator knows its project. A Cockpit record may now carry a bounded project_id (Google Cloud project grammar, 6-30 chars, exact match). Discovery keeps precedence; the fallback is admitted only after the account quota probe succeeds with that account own access token against that project. Probe refusal, probe errors and cancellation write nothing. No shared default project. Co-authored-by: yobushka <51312852+yobushka@users.noreply.github.com> * fix(quota): name a closed reason when an OAuth account quota probe fails Anthropic per-account quota rows reported quotaUnavailable with no reason, and Antigravity reported account_unavailable for any credential-side throw. The Anthropic usage read now reports a closed code for an HTTP status class, an unusable body or a thrown dispatch, and a probe that cannot obtain a credential reports account_unavailable without dispatching. Antigravity distinguishes a credential refresh deadline (timeout). Codes reuse the existing closed QUOTA_FAILURE_CODES set, carry no upstream text and never change account health. * test(claude): match the symlink-resolved rollback target in the picker restore case The atomic writer renames onto the symlink-resolved target, so on macOS (/var -> /private/var) the rollback rename never matched the fixture path and the restore-failure injection did not fire. Compare both spellings. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(google-antigravity): cancel the import project probe with the import request probeAntigravityUsageQuota accepts an optional caller signal that cancels every request of the probe and stops before the models fallback; the import verifier forwards the import signal and never admits after cancellation. * fix(codex): upgrade installed Windows shims that load the token before bypass CMD and PowerShell wrappers now carry a Windows revision marker. A marked wrapper without it (installed before the bypass-token fix) is obsolete: installCodexShim and autoRestoreCodexShim rewrite it in place over the same backing launcher instead of reporting it healthy or already installed, and diagnostics report it unhealthy. On Windows the service token reader also binds the opened descriptor to the path by identity, so a link swapped in after lstat is refused. * test(codex): mark the in-place Windows diagnostics fixture with the current revision * fix(codex): refresh obsolete Windows shims without clobbering a concurrent replacement The obsolete-wrapper refresh truncated whatever occupied the wrapper path. It now moves the observed wrapper aside and proves it is the probed file, stages the current wrapper beside it, and publishes with a hard link that refuses an occupied path. A concurrent replacement is restored or kept untouched and the refresh reports deferred. * docs(structure): record the Windows shim refresh transaction * fix(codex): create the Windows shim refresh stage exclusively and resume partial upgrades The refresh stage is now created with O_CREAT|O_EXCL (and O_NOFOLLOW on POSIX) under an independent random name, and publication, withdrawal and cleanup are bound to the identity of the file this refresh created, so a planted link is never written through. Auto-restore resumes a Windows revision-only sibling mix (current plus obsolete wrappers) instead of deferring forever after one transient publish failure. * fix(codex): bind Windows shim refresh rollback and recovery to observed identities Publication keeps a linked entry only if it is the created stage, and withdraws a link to a swapped stage (file or symlink) while leaving independent replacements. Restoring the moved wrapper requires the aside to still be the moved file. Automatic revision recovery now refreshes only the admitted obsolete wrappers and first re-verifies every current sibling, so a replacement during the stability wait is never adopted. * fix(codex): never displace a Windows shim where its replacement cannot be published The refresh proves hard-link support in the wrapper directory with a throwaway pair before moving the wrapper aside, and if a restore link still fails it falls back to an identity-checked rename onto the empty path, so the launcher never stays missing. --------- Co-authored-by: Ingwannu <186453546+Ingwannu@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: yobushka <51312852+yobushka@users.noreply.github.com>
Owner
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OPENSSL_CONF,OPENSSL_CONF_INCLUDE,OPENSSL_MODULES, andOPENSSL_ENGINES— from the environment handed to the spawned npm.NODE_EXTRA_CA_CERTSstill reach the spawned npm, and the filter remains a denylist for process-startup/output channels rather than an ambient-environment allowlist.structure/codex-cli-update.mdupdated to match the child-environment contract.Verification
bun test tests/codex-integration/codex-cli-update-plan.test.ts— 53 pass, 1 pre-existing skip, 0 fail, 269 assertions (run locally with Bun 1.4.2; hosted CI runtime version not independently verified). New coverage: six capture-only cases assert ambientOPENSSL_*variables (upper- and lowercase) never appear in the spawned child's env, and a sentinel test assertsHTTP_PROXY/NO_PROXY/NODE_EXTRA_CA_CERTSstill pass through case-insensitively. These tests inspect the captured spawn options only; no real OpenSSL provider or engine load is exercised.bun x tsc --noEmit— clean.bun run structure:check— passed.bun run privacy:scan— passed.bun run testsuite was not run locally. Hosted CI on the exact head 56e1d10 has since completed green: Cross-platform CI run 39188196477 SUCCESS - all four Ubuntu test shards, gates and the ci aggregate (https://github.com/lidge-jun/opencodex/actions/runs/39188196477) - and Enforce PR target branch, PR hygiene, PR Labeler, React Doctor and Catalog async contracts all SUCCESS. Conditional Windows/macOS/desktop jobs and other skipped checks were not executed; skipped is not executed. CodeRabbit reviewed the exact head with no actionable comments.Checklist